]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame - net/bluetooth/hci_event.c
projects / mirror_ubuntu-zesty-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Convert local OOB data reading to use HCI request
[mirror_ubuntu-zesty-kernel.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
0857dd3b 33#include "hci_request.h"
23b9ceb7 34#include "hci_debugfs.h"
7024728e 35#include "a2mp.h"
7ef9fbf0 36#include "amp.h"
2ceba539 37#include "smp.h"
1da177e4 38
aa5b0345
MH		 39#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
1da177e4
LT		 42/* Handle HCI Event packets */
43
a9de9248 44static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 45{
a9de9248 46 __u8 status = *((__u8 *) skb->data);
1da177e4 47
9f1db00c 48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 49
82f4785c 50 if (status)
a9de9248 51 return;
1da177e4 52
89352e7d 53 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 56
50143a43
JH		 57 hci_dev_lock(hdev);
58 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
59 hci_dev_unlock(hdev);
60
a9de9248
MH		 61 hci_conn_check_pending(hdev);
62}
6bd57416 63
4d93483b
AG		 64static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
65{
66 __u8 status = *((__u8 *) skb->data);
67
9f1db00c 68 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 69
70 if (status)
71 return;
72
a1536da2 73 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
4d93483b
AG		 74}
75
a9de9248
MH		 76static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
77{
78 __u8 status = *((__u8 *) skb->data);
6bd57416 79
9f1db00c 80 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 81
a9de9248
MH		 82 if (status)
83 return;
1da177e4 84
a358dc11 85 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
ae854a70 86
a9de9248
MH		 87 hci_conn_check_pending(hdev);
88}
89
807deac2
GP		 90static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
91 struct sk_buff *skb)
a9de9248
MH		 92{
93 BT_DBG("%s", hdev->name);
94}
95
96static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
97{
98 struct hci_rp_role_discovery *rp = (void *) skb->data;
99 struct hci_conn *conn;
100
9f1db00c 101 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 102
103 if (rp->status)
104 return;
105
106 hci_dev_lock(hdev);
107
108 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 109 if (conn)
110 conn->role = rp->role;
a9de9248
MH		 111
112 hci_dev_unlock(hdev);
1da177e4
LT		 113}
114
e4e8e37c
MH		 115static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
116{
117 struct hci_rp_read_link_policy *rp = (void *) skb->data;
118 struct hci_conn *conn;
119
9f1db00c 120 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 121
122 if (rp->status)
123 return;
124
125 hci_dev_lock(hdev);
126
127 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
128 if (conn)
129 conn->link_policy = __le16_to_cpu(rp->policy);
130
131 hci_dev_unlock(hdev);
132}
133
a9de9248 134static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 135{
a9de9248 136 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 137 struct hci_conn *conn;
04837f64 138 void *sent;
1da177e4 139
9f1db00c 140 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 141
a9de9248
MH		 142 if (rp->status)
143 return;
1da177e4 144
a9de9248
MH		 145 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
146 if (!sent)
147 return;
1da177e4 148
a9de9248 149 hci_dev_lock(hdev);
1da177e4 150
a9de9248 151 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 152 if (conn)
83985319 153 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 154
a9de9248
MH		 155 hci_dev_unlock(hdev);
156}
1da177e4 157
807deac2
GP		 158static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
159 struct sk_buff *skb)
e4e8e37c
MH		 160{
161 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
162
9f1db00c 163 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 164
165 if (rp->status)
166 return;
167
168 hdev->link_policy = __le16_to_cpu(rp->policy);
169}
170
807deac2
GP		 171static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
172 struct sk_buff *skb)
e4e8e37c
MH		 173{
174 __u8 status = *((__u8 *) skb->data);
175 void *sent;
176
9f1db00c 177 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 178
45296acd
MH		 179 if (status)
180 return;
181
e4e8e37c
MH		 182 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
183 if (!sent)
184 return;
185
45296acd 186 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 187}
188
a9de9248
MH		 189static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
190{
191 __u8 status = *((__u8 *) skb->data);
04837f64 192
9f1db00c 193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 194
10572132
GP		 195 clear_bit(HCI_RESET, &hdev->flags);
196
8761f9d6
MH		 197 if (status)
198 return;
199
a297e97c 200 /* Reset all non-persistent flags */
eacb44df 201 hci_dev_clear_volatile_flags(hdev);
69775ff6 202
39c5d970
JH		 203 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
204
bbaf444a
JH		 205 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
206 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 207
208 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
209 hdev->adv_data_len = 0;
f8e808bd
MH		 210
211 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
212 hdev->scan_rsp_data_len = 0;
06f5b778 213
533553f8
MH		 214 hdev->le_scan_type = LE_SCAN_PASSIVE;
215
06f5b778 216 hdev->ssp_debug_mode = 0;
a4d5504d
MH		 217
218 hci_bdaddr_list_clear(&hdev->le_white_list);
a9de9248 219}
04837f64 220
c2f0f979
MH		 221static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
222 struct sk_buff *skb)
223{
224 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
225 struct hci_cp_read_stored_link_key *sent;
226
227 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
228
229 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
230 if (!sent)
231 return;
232
233 if (!rp->status && sent->read_all == 0x01) {
234 hdev->stored_max_keys = rp->max_keys;
235 hdev->stored_num_keys = rp->num_keys;
236 }
237}
238
a9366120
MH		 239static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
240 struct sk_buff *skb)
241{
242 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
245
246 if (rp->status)
247 return;
248
249 if (rp->num_keys <= hdev->stored_num_keys)
250 hdev->stored_num_keys -= rp->num_keys;
251 else
252 hdev->stored_num_keys = 0;
253}
254
a9de9248
MH		 255static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
256{
257 __u8 status = *((__u8 *) skb->data);
258 void *sent;
04837f64 259
9f1db00c 260 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 261
a9de9248
MH		 262 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
263 if (!sent)
264 return;
04837f64 265
56e5cb86
JH		 266 hci_dev_lock(hdev);
267
d7a5a11d 268 if (hci_dev_test_flag(hdev, HCI_MGMT))
f51d5b24 269 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 270 else if (!status)
271 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 272
56e5cb86 273 hci_dev_unlock(hdev);
a9de9248
MH		 274}
275
276static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
277{
278 struct hci_rp_read_local_name *rp = (void *) skb->data;
279
9f1db00c 280 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 281
282 if (rp->status)
283 return;
284
d7a5a11d
MH		 285 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
286 hci_dev_test_flag(hdev, HCI_CONFIG))
db99b5fc 287 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 288}
289
290static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
291{
292 __u8 status = *((__u8 *) skb->data);
293 void *sent;
294
9f1db00c 295 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 296
297 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
298 if (!sent)
299 return;
300
5c1a4c8f
JK		 301 hci_dev_lock(hdev);
302
a9de9248
MH		 303 if (!status) {
304 __u8 param = *((__u8 *) sent);
305
306 if (param == AUTH_ENABLED)
307 set_bit(HCI_AUTH, &hdev->flags);
308 else
309 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 310 }
a9de9248 311
d7a5a11d 312 if (hci_dev_test_flag(hdev, HCI_MGMT))
33ef95ed 313 mgmt_auth_enable_complete(hdev, status);
5c1a4c8f
JK		 314
315 hci_dev_unlock(hdev);
1da177e4
LT		 316}
317
a9de9248 318static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 319{
a9de9248 320 __u8 status = *((__u8 *) skb->data);
45296acd 321 __u8 param;
1da177e4
LT		 322 void *sent;
323
9f1db00c 324 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 325
45296acd
MH		 326 if (status)
327 return;
328
a9de9248
MH		 329 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
330 if (!sent)
331 return;
1da177e4 332
45296acd 333 param = *((__u8 *) sent);
a9de9248 334
45296acd
MH		 335 if (param)
336 set_bit(HCI_ENCRYPT, &hdev->flags);
337 else
338 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 339}
1da177e4 340
a9de9248
MH		 341static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
342{
45296acd
MH		 343 __u8 status = *((__u8 *) skb->data);
344 __u8 param;
a9de9248 345 void *sent;
1da177e4 346
9f1db00c 347 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 348
a9de9248
MH		 349 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
350 if (!sent)
351 return;
1da177e4 352
36f7fc7e
JH		 353 param = *((__u8 *) sent);
354
56e5cb86
JH		 355 hci_dev_lock(hdev);
356
fa1bd918 357 if (status) {
2d7cee58
JH		 358 hdev->discov_timeout = 0;
359 goto done;
360 }
361
bc6d2d04 362 if (param & SCAN_INQUIRY)
36f7fc7e 363 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 364 else
365 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 366
031547d8 367 if (param & SCAN_PAGE)
36f7fc7e 368 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 369 else
204e3990 370 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 371
36f7fc7e 372done:
56e5cb86 373 hci_dev_unlock(hdev);
a9de9248 374}
1da177e4 375
a9de9248
MH		 376static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
377{
378 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 379
9f1db00c 380 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 381
a9de9248
MH		 382 if (rp->status)
383 return;
1da177e4 384
a9de9248 385 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 386
a9de9248 387 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 388 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 389}
1da177e4 390
a9de9248
MH		 391static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
392{
393 __u8 status = *((__u8 *) skb->data);
394 void *sent;
1da177e4 395
9f1db00c 396 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 397
a9de9248
MH		 398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
399 if (!sent)
400 return;
1da177e4 401
7f9a903c
MH		 402 hci_dev_lock(hdev);
403
404 if (status == 0)
405 memcpy(hdev->dev_class, sent, 3);
406
d7a5a11d 407 if (hci_dev_test_flag(hdev, HCI_MGMT))
7f9a903c
MH		 408 mgmt_set_class_of_dev_complete(hdev, sent, status);
409
410 hci_dev_unlock(hdev);
a9de9248 411}
1da177e4 412
a9de9248
MH		 413static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
414{
415 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
416 __u16 setting;
417
9f1db00c 418 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 419
420 if (rp->status)
421 return;
422
423 setting = __le16_to_cpu(rp->voice_setting);
424
f383f275 425 if (hdev->voice_setting == setting)
a9de9248
MH		 426 return;
427
428 hdev->voice_setting = setting;
429
9f1db00c 430 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 431
3c54711c 432 if (hdev->notify)
a9de9248 433 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 434}
435
8fc9ced3
GP		 436static void hci_cc_write_voice_setting(struct hci_dev *hdev,
437 struct sk_buff *skb)
a9de9248
MH		 438{
439 __u8 status = *((__u8 *) skb->data);
f383f275 440 __u16 setting;
a9de9248
MH		 441 void *sent;
442
9f1db00c 443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 444
f383f275
MH		 445 if (status)
446 return;
447
a9de9248
MH		 448 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
449 if (!sent)
450 return;
1da177e4 451
f383f275 452 setting = get_unaligned_le16(sent);
1da177e4 453
f383f275
MH		 454 if (hdev->voice_setting == setting)
455 return;
456
457 hdev->voice_setting = setting;
1da177e4 458
9f1db00c 459 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 460
3c54711c 461 if (hdev->notify)
f383f275 462 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 463}
464
b4cb9fb2
MH		 465static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
466 struct sk_buff *skb)
467{
468 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
469
470 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
471
472 if (rp->status)
473 return;
474
475 hdev->num_iac = rp->num_iac;
476
477 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
478}
479
333140b5
MH		 480static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
481{
482 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 483 struct hci_cp_write_ssp_mode *sent;
333140b5 484
9f1db00c 485 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 486
333140b5
MH		 487 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
488 if (!sent)
489 return;
490
5c1a4c8f
JK		 491 hci_dev_lock(hdev);
492
5ed8eb2f
JH		 493 if (!status) {
494 if (sent->mode)
cad718ed 495 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 496 else
cad718ed 497 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 498 }
499
d7a5a11d 500 if (hci_dev_test_flag(hdev, HCI_MGMT))
5ed8eb2f 501 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 502 else if (!status) {
5ed8eb2f 503 if (sent->mode)
a1536da2 504 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 505 else
a358dc11 506 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 507 }
5c1a4c8f
JK		 508
509 hci_dev_unlock(hdev);
333140b5
MH		 510}
511
eac83dc6
MH		 512static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
513{
514 u8 status = *((u8 *) skb->data);
515 struct hci_cp_write_sc_support *sent;
516
517 BT_DBG("%s status 0x%2.2x", hdev->name, status);
518
519 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
520 if (!sent)
521 return;
522
5c1a4c8f
JK		 523 hci_dev_lock(hdev);
524
eac83dc6
MH		 525 if (!status) {
526 if (sent->support)
527 hdev->features[1][0] |= LMP_HOST_SC;
528 else
529 hdev->features[1][0] &= ~LMP_HOST_SC;
530 }
531
d7a5a11d 532 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
eac83dc6 533 if (sent->support)
a1536da2 534 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
eac83dc6 535 else
a358dc11 536 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
eac83dc6 537 }
5c1a4c8f
JK		 538
539 hci_dev_unlock(hdev);
eac83dc6
MH		 540}
541
a9de9248
MH		 542static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
543{
544 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 545
9f1db00c 546 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 547
a9de9248 548 if (rp->status)
42c6b129 549 return;
1143e5a6 550
d7a5a11d
MH		 551 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
552 hci_dev_test_flag(hdev, HCI_CONFIG)) {
0d5551f5
MH		 553 hdev->hci_ver = rp->hci_ver;
554 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
555 hdev->lmp_ver = rp->lmp_ver;
556 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
557 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
558 }
d5859e22
JH		 559}
560
8fc9ced3
GP		 561static void hci_cc_read_local_commands(struct hci_dev *hdev,
562 struct sk_buff *skb)
a9de9248
MH		 563{
564 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 565
9f1db00c 566 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 567
6a070e6e
MH		 568 if (rp->status)
569 return;
570
d7a5a11d
MH		 571 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
572 hci_dev_test_flag(hdev, HCI_CONFIG))
2177bab5 573 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 574}
1da177e4 575
8fc9ced3
GP		 576static void hci_cc_read_local_features(struct hci_dev *hdev,
577 struct sk_buff *skb)
a9de9248
MH		 578{
579 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 580
9f1db00c 581 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 582
a9de9248
MH		 583 if (rp->status)
584 return;
5b7f9909 585
a9de9248 586 memcpy(hdev->features, rp->features, 8);
5b7f9909 587
a9de9248
MH		 588 /* Adjust default settings according to features
589 * supported by device. */
1da177e4 590
cad718ed 591 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 592 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 593
cad718ed 594 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 595 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 596
cad718ed 597 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 598 hdev->pkt_type |= (HCI_HV2);
599 hdev->esco_type |= (ESCO_HV2);
600 }
1da177e4 601
cad718ed 602 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 603 hdev->pkt_type |= (HCI_HV3);
604 hdev->esco_type |= (ESCO_HV3);
605 }
1da177e4 606
45db810f 607 if (lmp_esco_capable(hdev))
a9de9248 608 hdev->esco_type |= (ESCO_EV3);
da1f5198 609
cad718ed 610 if (hdev->features[0][4] & LMP_EV4)
a9de9248 611 hdev->esco_type |= (ESCO_EV4);
da1f5198 612
cad718ed 613 if (hdev->features[0][4] & LMP_EV5)
a9de9248 614 hdev->esco_type |= (ESCO_EV5);
1da177e4 615
cad718ed 616 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 617 hdev->esco_type |= (ESCO_2EV3);
618
cad718ed 619 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 620 hdev->esco_type |= (ESCO_3EV3);
621
cad718ed 622 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 623 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 624}
1da177e4 625
971e3a4b 626static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 627 struct sk_buff *skb)
971e3a4b
AG		 628{
629 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
630
9f1db00c 631 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 632
633 if (rp->status)
42c6b129 634 return;
971e3a4b 635
57af75a8
MH		 636 if (hdev->max_page < rp->max_page)
637 hdev->max_page = rp->max_page;
d2c5d77f 638
cad718ed
JH		 639 if (rp->page < HCI_MAX_PAGES)
640 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 641}
642
1e89cffb 643static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 644 struct sk_buff *skb)
1e89cffb
AE		 645{
646 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
647
9f1db00c 648 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 649
45296acd
MH		 650 if (rp->status)
651 return;
652
653 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 654}
655
a9de9248
MH		 656static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
657{
658 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 659
9f1db00c 660 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 661
a9de9248
MH		 662 if (rp->status)
663 return;
1da177e4 664
a9de9248
MH		 665 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
666 hdev->sco_mtu = rp->sco_mtu;
667 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
668 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
669
670 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
671 hdev->sco_mtu = 64;
672 hdev->sco_pkts = 8;
1da177e4 673 }
a9de9248
MH		 674
675 hdev->acl_cnt = hdev->acl_pkts;
676 hdev->sco_cnt = hdev->sco_pkts;
677
807deac2
GP		 678 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
679 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 680}
681
682static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
683{
684 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
685
9f1db00c 686 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 687
e30d3f5f
MH		 688 if (rp->status)
689 return;
690
691 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 692 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f 693
d7a5a11d 694 if (hci_dev_test_flag(hdev, HCI_SETUP))
e30d3f5f 695 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 696}
697
f332ec66
JH		 698static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
699 struct sk_buff *skb)
700{
701 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
702
703 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
704
45296acd
MH		 705 if (rp->status)
706 return;
707
708 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 709 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
710 hdev->page_scan_window = __le16_to_cpu(rp->window);
711 }
712}
713
4a3ee763
JH		 714static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
715 struct sk_buff *skb)
716{
717 u8 status = *((u8 *) skb->data);
718 struct hci_cp_write_page_scan_activity *sent;
719
720 BT_DBG("%s status 0x%2.2x", hdev->name, status);
721
722 if (status)
723 return;
724
725 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
726 if (!sent)
727 return;
728
729 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
730 hdev->page_scan_window = __le16_to_cpu(sent->window);
731}
732
f332ec66
JH		 733static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
734 struct sk_buff *skb)
735{
736 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
737
738 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
739
45296acd
MH		 740 if (rp->status)
741 return;
742
743 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 744 hdev->page_scan_type = rp->type;
745}
746
4a3ee763
JH		 747static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
748 struct sk_buff *skb)
749{
750 u8 status = *((u8 *) skb->data);
751 u8 *type;
752
753 BT_DBG("%s status 0x%2.2x", hdev->name, status);
754
755 if (status)
756 return;
757
758 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
759 if (type)
760 hdev->page_scan_type = *type;
761}
762
350ee4cf 763static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 764 struct sk_buff *skb)
350ee4cf
AE		 765{
766 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
767
9f1db00c 768 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 769
770 if (rp->status)
771 return;
772
773 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
774 hdev->block_len = __le16_to_cpu(rp->block_len);
775 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
776
777 hdev->block_cnt = hdev->num_blocks;
778
779 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 780 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 781}
782
33f35721
JH		 783static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
784{
785 struct hci_rp_read_clock *rp = (void *) skb->data;
786 struct hci_cp_read_clock *cp;
787 struct hci_conn *conn;
788
789 BT_DBG("%s", hdev->name);
790
791 if (skb->len < sizeof(*rp))
792 return;
793
794 if (rp->status)
795 return;
796
797 hci_dev_lock(hdev);
798
799 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
800 if (!cp)
801 goto unlock;
802
803 if (cp->which == 0x00) {
804 hdev->clock = le32_to_cpu(rp->clock);
805 goto unlock;
806 }
807
808 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
809 if (conn) {
810 conn->clock = le32_to_cpu(rp->clock);
811 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
812 }
813
814unlock:
815 hci_dev_unlock(hdev);
816}
817
928abaa7 818static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 819 struct sk_buff *skb)
928abaa7
AE		 820{
821 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
822
9f1db00c 823 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 824
825 if (rp->status)
8e2a0d92 826 goto a2mp_rsp;
928abaa7
AE		 827
828 hdev->amp_status = rp->amp_status;
829 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
830 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
831 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
832 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
833 hdev->amp_type = rp->amp_type;
834 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
835 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
836 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
837 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
838
8e2a0d92
AE		 839a2mp_rsp:
840 a2mp_send_getinfo_rsp(hdev);
928abaa7
AE		 841}
842
903e4541
AE		 843static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
844 struct sk_buff *skb)
845{
846 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
847 struct amp_assoc *assoc = &hdev->loc_assoc;
848 size_t rem_len, frag_len;
849
850 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
851
852 if (rp->status)
853 goto a2mp_rsp;
854
855 frag_len = skb->len - sizeof(*rp);
856 rem_len = __le16_to_cpu(rp->rem_len);
857
858 if (rem_len > frag_len) {
2e430be3 859 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
903e4541
AE		 860
861 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
862 assoc->offset += frag_len;
863
864 /* Read other fragments */
865 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
866
867 return;
868 }
869
870 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
871 assoc->len = assoc->offset + rem_len;
872 assoc->offset = 0;
873
874a2mp_rsp:
875 /* Send A2MP Rsp when all fragments are received */
876 a2mp_send_getampassoc_rsp(hdev, rp->status);
9495b2ee 877 a2mp_send_create_phy_link_req(hdev, rp->status);
903e4541
AE		 878}
879
d5859e22 880static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 881 struct sk_buff *skb)
d5859e22 882{
91c4e9b1 883 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 884
9f1db00c 885 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 886
45296acd
MH		 887 if (rp->status)
888 return;
889
890 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 891}
892
980e1a53
JH		 893static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
894{
895 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
896 struct hci_cp_pin_code_reply *cp;
897 struct hci_conn *conn;
898
9f1db00c 899 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 900
56e5cb86
JH		 901 hci_dev_lock(hdev);
902
d7a5a11d 903 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 904 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 905
fa1bd918 906 if (rp->status)
56e5cb86 907 goto unlock;
980e1a53
JH		 908
909 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
910 if (!cp)
56e5cb86 911 goto unlock;
980e1a53
JH		 912
913 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
914 if (conn)
915 conn->pin_length = cp->pin_len;
56e5cb86
JH		 916
917unlock:
918 hci_dev_unlock(hdev);
980e1a53
JH		 919}
920
921static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
922{
923 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
924
9f1db00c 925 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 926
56e5cb86
JH		 927 hci_dev_lock(hdev);
928
d7a5a11d 929 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 930 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 931 rp->status);
56e5cb86
JH		 932
933 hci_dev_unlock(hdev);
980e1a53 934}
56e5cb86 935
6ed58ec5
VT		 936static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
937 struct sk_buff *skb)
938{
939 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
940
9f1db00c 941 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 942
943 if (rp->status)
944 return;
945
946 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
947 hdev->le_pkts = rp->le_max_pkt;
948
949 hdev->le_cnt = hdev->le_pkts;
950
951 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 952}
980e1a53 953
60e77321
JH		 954static void hci_cc_le_read_local_features(struct hci_dev *hdev,
955 struct sk_buff *skb)
956{
957 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
958
959 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
960
45296acd
MH		 961 if (rp->status)
962 return;
963
964 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 965}
966
8fa19098
JH		 967static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
968 struct sk_buff *skb)
969{
970 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
971
972 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
973
45296acd
MH		 974 if (rp->status)
975 return;
976
977 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 978}
979
a5c29683
JH		 980static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
981{
982 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
983
9f1db00c 984 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 985
56e5cb86
JH		 986 hci_dev_lock(hdev);
987
d7a5a11d 988 if (hci_dev_test_flag(hdev, HCI_MGMT))
04124681
GP		 989 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
990 rp->status);
56e5cb86
JH		 991
992 hci_dev_unlock(hdev);
a5c29683
JH		 993}
994
995static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 996 struct sk_buff *skb)
a5c29683
JH		 997{
998 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
999
9f1db00c 1000 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 1001
56e5cb86
JH		 1002 hci_dev_lock(hdev);
1003
d7a5a11d 1004 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 1005 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1006 ACL_LINK, 0, rp->status);
56e5cb86
JH		 1007
1008 hci_dev_unlock(hdev);
a5c29683
JH		 1009}
1010
1143d458
BG		 1011static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1012{
1013 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1014
9f1db00c 1015 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1016
1017 hci_dev_lock(hdev);
1018
d7a5a11d 1019 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 1020 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 1021 0, rp->status);
1143d458
BG		 1022
1023 hci_dev_unlock(hdev);
1024}
1025
1026static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 1027 struct sk_buff *skb)
1143d458
BG		 1028{
1029 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1030
9f1db00c 1031 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1032
1033 hci_dev_lock(hdev);
1034
d7a5a11d 1035 if (hci_dev_test_flag(hdev, HCI_MGMT))
1143d458 1036 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1037 ACL_LINK, 0, rp->status);
1143d458
BG		 1038
1039 hci_dev_unlock(hdev);
1040}
1041
4d2d2796
MH		 1042static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1043 struct sk_buff *skb)
c35938b2
SJ		 1044{
1045 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1046
9f1db00c 1047 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
4d2d2796
MH		 1048}
1049
1050static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1051 struct sk_buff *skb)
1052{
1053 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1054
1055 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2
SJ		 1056}
1057
7a4cd51d
MH		 1058static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1059{
1060 __u8 status = *((__u8 *) skb->data);
1061 bdaddr_t *sent;
1062
1063 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1064
45296acd
MH		 1065 if (status)
1066 return;
1067
7a4cd51d
MH		 1068 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1069 if (!sent)
1070 return;
1071
1072 hci_dev_lock(hdev);
1073
45296acd 1074 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1075
1076 hci_dev_unlock(hdev);
1077}
1078
c1d5dc4a
JH		 1079static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1080{
1081 __u8 *sent, status = *((__u8 *) skb->data);
1082
1083 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1084
45296acd 1085 if (status)
c1d5dc4a
JH		 1086 return;
1087
45296acd
MH		 1088 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1089 if (!sent)
3c857757
JH		 1090 return;
1091
c1d5dc4a
JH		 1092 hci_dev_lock(hdev);
1093
49c922bb 1094 /* If we're doing connection initiation as peripheral. Set a
3c857757
JH		 1095 * timeout in case something goes wrong.
1096 */
1097 if (*sent) {
1098 struct hci_conn *conn;
1099
a1536da2 1100 hci_dev_set_flag(hdev, HCI_LE_ADV);
66c417c1 1101
3c857757
JH		 1102 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1103 if (conn)
1104 queue_delayed_work(hdev->workqueue,
1105 &conn->le_conn_timeout,
09ae260b 1106 conn->conn_timeout);
66c417c1 1107 } else {
a358dc11 1108 hci_dev_clear_flag(hdev, HCI_LE_ADV);
3c857757
JH		 1109 }
1110
04b4edcb 1111 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1112}
1113
533553f8
MH		 1114static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1115{
1116 struct hci_cp_le_set_scan_param *cp;
1117 __u8 status = *((__u8 *) skb->data);
1118
1119 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1120
45296acd
MH		 1121 if (status)
1122 return;
1123
533553f8
MH		 1124 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1125 if (!cp)
1126 return;
1127
1128 hci_dev_lock(hdev);
1129
45296acd 1130 hdev->le_scan_type = cp->type;
533553f8
MH		 1131
1132 hci_dev_unlock(hdev);
1133}
1134
b9a6328f
JH		 1135static bool has_pending_adv_report(struct hci_dev *hdev)
1136{
1137 struct discovery_state *d = &hdev->discovery;
1138
1139 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1140}
1141
1142static void clear_pending_adv_report(struct hci_dev *hdev)
1143{
1144 struct discovery_state *d = &hdev->discovery;
1145
1146 bacpy(&d->last_adv_addr, BDADDR_ANY);
1147 d->last_adv_data_len = 0;
1148}
1149
1150static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1151 u8 bdaddr_type, s8 rssi, u32 flags,
1152 u8 *data, u8 len)
b9a6328f
JH		 1153{
1154 struct discovery_state *d = &hdev->discovery;
1155
1156 bacpy(&d->last_adv_addr, bdaddr);
1157 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1158 d->last_adv_rssi = rssi;
c70a7e4c 1159 d->last_adv_flags = flags;
b9a6328f
JH		 1160 memcpy(d->last_adv_data, data, len);
1161 d->last_adv_data_len = len;
1162}
1163
eb9d91f5 1164static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
807deac2 1165 struct sk_buff *skb)
eb9d91f5
AG		 1166{
1167 struct hci_cp_le_set_scan_enable *cp;
1168 __u8 status = *((__u8 *) skb->data);
1169
9f1db00c 1170 BT_DBG("%s status 0x%2.2x", hdev->name, status);
eb9d91f5 1171
45296acd 1172 if (status)
eb9d91f5
AG		 1173 return;
1174
45296acd
MH		 1175 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1176 if (!cp)
3fd319b8
AG		 1177 return;
1178
5c1a4c8f
JK		 1179 hci_dev_lock(hdev);
1180
68a8aea4 1181 switch (cp->enable) {
76a388be 1182 case LE_SCAN_ENABLE:
a1536da2 1183 hci_dev_set_flag(hdev, HCI_LE_SCAN);
b9a6328f
JH		 1184 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1185 clear_pending_adv_report(hdev);
68a8aea4
AE		 1186 break;
1187
76a388be 1188 case LE_SCAN_DISABLE:
b9a6328f
JH		 1189 /* We do this here instead of when setting DISCOVERY_STOPPED
1190 * since the latter would potentially require waiting for
1191 * inquiry to stop too.
1192 */
1193 if (has_pending_adv_report(hdev)) {
1194 struct discovery_state *d = &hdev->discovery;
1195
1196 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1197 d->last_adv_addr_type, NULL,
c70a7e4c 1198 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1199 d->last_adv_data,
b9a6328f
JH		 1200 d->last_adv_data_len, NULL, 0);
1201 }
1202
317ac8cb
JH		 1203 /* Cancel this timer so that we don't try to disable scanning
1204 * when it's already disabled.
1205 */
1206 cancel_delayed_work(&hdev->le_scan_disable);
1207
a358dc11 1208 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
e8bb6b97 1209
81ad6fd9
JH		 1210 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1211 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1212 * therefore discovery as stopped. If this was not
1213 * because of a connect request advertising might have
1214 * been disabled because of active scanning, so
1215 * re-enable it again if necessary.
81ad6fd9 1216 */
a69d8927 1217 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
81ad6fd9 1218 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
d7a5a11d 1219 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
34722277 1220 hdev->discovery.state == DISCOVERY_FINDING)
e8bb6b97
JH		 1221 mgmt_reenable_advertising(hdev);
1222
68a8aea4
AE		 1223 break;
1224
1225 default:
1226 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1227 break;
35815085 1228 }
5c1a4c8f
JK		 1229
1230 hci_dev_unlock(hdev);
eb9d91f5
AG		 1231}
1232
cf1d081f
JH		 1233static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1234 struct sk_buff *skb)
1235{
1236 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1237
1238 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1239
45296acd
MH		 1240 if (rp->status)
1241 return;
1242
1243 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1244}
1245
0f36b589
MH		 1246static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1247 struct sk_buff *skb)
1248{
1249 __u8 status = *((__u8 *) skb->data);
1250
1251 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1252
45296acd
MH		 1253 if (status)
1254 return;
1255
dcc36c16 1256 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1257}
1258
1259static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1260 struct sk_buff *skb)
1261{
1262 struct hci_cp_le_add_to_white_list *sent;
1263 __u8 status = *((__u8 *) skb->data);
1264
1265 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1266
45296acd
MH		 1267 if (status)
1268 return;
1269
0f36b589
MH		 1270 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1271 if (!sent)
1272 return;
1273
dcc36c16
JH		 1274 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1275 sent->bdaddr_type);
0f36b589
MH		 1276}
1277
1278static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1279 struct sk_buff *skb)
1280{
1281 struct hci_cp_le_del_from_white_list *sent;
1282 __u8 status = *((__u8 *) skb->data);
1283
1284 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1285
45296acd
MH		 1286 if (status)
1287 return;
1288
0f36b589
MH		 1289 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1290 if (!sent)
1291 return;
1292
dcc36c16
JH		 1293 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1294 sent->bdaddr_type);
0f36b589
MH		 1295}
1296
9b008c04
JH		 1297static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1298 struct sk_buff *skb)
1299{
1300 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1301
1302 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1303
45296acd
MH		 1304 if (rp->status)
1305 return;
1306
1307 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1308}
1309
a8e1bfaa
MH		 1310static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1311 struct sk_buff *skb)
1312{
1313 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1314
1315 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1316
1317 if (rp->status)
1318 return;
1319
1320 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1321 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1322}
1323
1324static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1325 struct sk_buff *skb)
1326{
1327 struct hci_cp_le_write_def_data_len *sent;
1328 __u8 status = *((__u8 *) skb->data);
1329
1330 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1331
1332 if (status)
1333 return;
1334
1335 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1336 if (!sent)
1337 return;
1338
1339 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1340 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1341}
1342
1343static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1344 struct sk_buff *skb)
1345{
1346 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1347
1348 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1349
1350 if (rp->status)
1351 return;
1352
1353 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1354 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1355 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1356 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1357}
1358
6039aa73
GP		 1359static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1360 struct sk_buff *skb)
f9b49306 1361{
06199cf8 1362 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1363 __u8 status = *((__u8 *) skb->data);
1364
9f1db00c 1365 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1366
45296acd
MH		 1367 if (status)
1368 return;
1369
06199cf8 1370 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1371 if (!sent)
f9b49306
AG		 1372 return;
1373
5c1a4c8f
JK		 1374 hci_dev_lock(hdev);
1375
45296acd
MH		 1376 if (sent->le) {
1377 hdev->features[1][0] |= LMP_HOST_LE;
a1536da2 1378 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
45296acd
MH		 1379 } else {
1380 hdev->features[1][0] &= ~LMP_HOST_LE;
a358dc11
MH		 1381 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1382 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
8f984dfa 1383 }
45296acd
MH		 1384
1385 if (sent->simul)
1386 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1387 else
1388 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
5c1a4c8f
JK		 1389
1390 hci_dev_unlock(hdev);
f9b49306
AG		 1391}
1392
56ed2cb8
JH		 1393static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1394{
1395 struct hci_cp_le_set_adv_param *cp;
1396 u8 status = *((u8 *) skb->data);
1397
1398 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
1400 if (status)
1401 return;
1402
1403 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1404 if (!cp)
1405 return;
1406
1407 hci_dev_lock(hdev);
1408 hdev->adv_addr_type = cp->own_address_type;
1409 hci_dev_unlock(hdev);
1410}
1411
93c284ee
AE		 1412static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1413 struct sk_buff *skb)
1414{
1415 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1416
1417 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1418 hdev->name, rp->status, rp->phy_handle);
1419
1420 if (rp->status)
1421 return;
1422
1423 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1424}
1425
5ae76a94
AK		 1426static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1427{
1428 struct hci_rp_read_rssi *rp = (void *) skb->data;
1429 struct hci_conn *conn;
1430
1431 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1432
1433 if (rp->status)
1434 return;
1435
1436 hci_dev_lock(hdev);
1437
1438 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1439 if (conn)
1440 conn->rssi = rp->rssi;
1441
1442 hci_dev_unlock(hdev);
1443}
1444
5a134fae
AK		 1445static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1446{
1447 struct hci_cp_read_tx_power *sent;
1448 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1449 struct hci_conn *conn;
1450
1451 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1452
1453 if (rp->status)
1454 return;
1455
1456 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1457 if (!sent)
1458 return;
1459
1460 hci_dev_lock(hdev);
1461
1462 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1463 if (!conn)
1464 goto unlock;
1465
1466 switch (sent->type) {
1467 case 0x00:
5a134fae 1468 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1469 break;
1470 case 0x01:
1471 conn->max_tx_power = rp->tx_power;
1472 break;
1473 }
5a134fae 1474
d0455ed9 1475unlock:
5a134fae
AK		 1476 hci_dev_unlock(hdev);
1477}
1478
c50b33c8
MH		 1479static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1480{
1481 u8 status = *((u8 *) skb->data);
1482 u8 *mode;
1483
1484 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1485
1486 if (status)
1487 return;
1488
1489 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1490 if (mode)
1491 hdev->ssp_debug_mode = *mode;
1492}
1493
6039aa73 1494static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1495{
9f1db00c 1496 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1497
1498 if (status) {
a9de9248 1499 hci_conn_check_pending(hdev);
314b2381
JH		 1500 return;
1501 }
1502
89352e7d 1503 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1504}
1505
6039aa73 1506static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1507{
a9de9248 1508 struct hci_cp_create_conn *cp;
1da177e4 1509 struct hci_conn *conn;
1da177e4 1510
9f1db00c 1511 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1512
1513 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1514 if (!cp)
1515 return;
1516
1517 hci_dev_lock(hdev);
1518
1519 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1520
6ed93dc6 1521 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1522
1523 if (status) {
1524 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1525 if (status != 0x0c || conn->attempt > 2) {
1526 conn->state = BT_CLOSED;
539c496d 1527 hci_connect_cfm(conn, status);
4c67bc74
MH		 1528 hci_conn_del(conn);
1529 } else
1530 conn->state = BT_CONNECT2;
1da177e4
LT		 1531 }
1532 } else {
1533 if (!conn) {
a5c4e309
JH		 1534 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1535 HCI_ROLE_MASTER);
1536 if (!conn)
893ef971 1537 BT_ERR("No memory for new connection");
1da177e4
LT		 1538 }
1539 }
1540
1541 hci_dev_unlock(hdev);
1542}
1543
a9de9248 1544static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1545{
a9de9248
MH		 1546 struct hci_cp_add_sco *cp;
1547 struct hci_conn *acl, *sco;
1548 __u16 handle;
1da177e4 1549
9f1db00c 1550 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1551
a9de9248
MH		 1552 if (!status)
1553 return;
1da177e4 1554
a9de9248
MH		 1555 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1556 if (!cp)
1557 return;
1da177e4 1558
a9de9248 1559 handle = __le16_to_cpu(cp->handle);
1da177e4 1560
9f1db00c 1561 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1562
a9de9248 1563 hci_dev_lock(hdev);
1da177e4 1564
a9de9248 1565 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1566 if (acl) {
1567 sco = acl->link;
1568 if (sco) {
1569 sco->state = BT_CLOSED;
1da177e4 1570
539c496d 1571 hci_connect_cfm(sco, status);
5a08ecce
AE		 1572 hci_conn_del(sco);
1573 }
a9de9248 1574 }
1da177e4 1575
a9de9248
MH		 1576 hci_dev_unlock(hdev);
1577}
1da177e4 1578
f8558555
MH		 1579static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1580{
1581 struct hci_cp_auth_requested *cp;
1582 struct hci_conn *conn;
1583
9f1db00c 1584 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1585
1586 if (!status)
1587 return;
1588
1589 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1590 if (!cp)
1591 return;
1592
1593 hci_dev_lock(hdev);
1594
1595 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1596 if (conn) {
1597 if (conn->state == BT_CONFIG) {
539c496d 1598 hci_connect_cfm(conn, status);
76a68ba0 1599 hci_conn_drop(conn);
f8558555
MH		 1600 }
1601 }
1602
1603 hci_dev_unlock(hdev);
1604}
1605
1606static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1607{
1608 struct hci_cp_set_conn_encrypt *cp;
1609 struct hci_conn *conn;
1610
9f1db00c 1611 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1612
1613 if (!status)
1614 return;
1615
1616 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1617 if (!cp)
1618 return;
1619
1620 hci_dev_lock(hdev);
1621
1622 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1623 if (conn) {
1624 if (conn->state == BT_CONFIG) {
539c496d 1625 hci_connect_cfm(conn, status);
76a68ba0 1626 hci_conn_drop(conn);
f8558555
MH		 1627 }
1628 }
1629
1630 hci_dev_unlock(hdev);
1631}
1632
127178d2 1633static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1634 struct hci_conn *conn)
392599b9 1635{
392599b9
JH		 1636 if (conn->state != BT_CONFIG || !conn->out)
1637 return 0;
1638
765c2a96 1639 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1640 return 0;
1641
1642 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1643 * devices with sec_level MEDIUM or HIGH or if MITM protection
1644 * is requested.
1645 */
807deac2 1646 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1647 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1648 conn->pending_sec_level != BT_SECURITY_HIGH &&
1649 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1650 return 0;
1651
392599b9
JH		 1652 return 1;
1653}
1654
6039aa73 1655static int hci_resolve_name(struct hci_dev *hdev,
04124681 1656 struct inquiry_entry *e)
30dc78e1
JH		 1657{
1658 struct hci_cp_remote_name_req cp;
1659
1660 memset(&cp, 0, sizeof(cp));
1661
1662 bacpy(&cp.bdaddr, &e->data.bdaddr);
1663 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1664 cp.pscan_mode = e->data.pscan_mode;
1665 cp.clock_offset = e->data.clock_offset;
1666
1667 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1668}
1669
b644ba33 1670static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1671{
1672 struct discovery_state *discov = &hdev->discovery;
1673 struct inquiry_entry *e;
1674
b644ba33
JH		 1675 if (list_empty(&discov->resolve))
1676 return false;
1677
1678 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1679 if (!e)
1680 return false;
1681
b644ba33
JH		 1682 if (hci_resolve_name(hdev, e) == 0) {
1683 e->name_state = NAME_PENDING;
1684 return true;
1685 }
1686
1687 return false;
1688}
1689
1690static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1691 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1692{
1693 struct discovery_state *discov = &hdev->discovery;
1694 struct inquiry_entry *e;
1695
60cb49d2
JH		 1696 /* Update the mgmt connected state if necessary. Be careful with
1697 * conn objects that exist but are not (yet) connected however.
1698 * Only those in BT_CONFIG or BT_CONNECTED states can be
1699 * considered connected.
1700 */
1701 if (conn &&
1702 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
cb77c3ec 1703 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1704 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1705
1706 if (discov->state == DISCOVERY_STOPPED)
1707 return;
1708
30dc78e1
JH		 1709 if (discov->state == DISCOVERY_STOPPING)
1710 goto discov_complete;
1711
1712 if (discov->state != DISCOVERY_RESOLVING)
1713 return;
1714
1715 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1716 /* If the device was not found in a list of found devices names of which
1717 * are pending. there is no need to continue resolving a next name as it
1718 * will be done upon receiving another Remote Name Request Complete
1719 * Event */
1720 if (!e)
1721 return;
1722
1723 list_del(&e->list);
1724 if (name) {
30dc78e1 1725 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1726 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1727 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1728 } else {
1729 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1730 }
1731
b644ba33 1732 if (hci_resolve_next_name(hdev))
30dc78e1 1733 return;
30dc78e1
JH		 1734
1735discov_complete:
1736 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1737}
1738
a9de9248
MH		 1739static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1740{
127178d2
JH		 1741 struct hci_cp_remote_name_req *cp;
1742 struct hci_conn *conn;
1743
9f1db00c 1744 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1745
1746 /* If successful wait for the name req complete event before
1747 * checking for the need to do authentication */
1748 if (!status)
1749 return;
1750
1751 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1752 if (!cp)
1753 return;
1754
1755 hci_dev_lock(hdev);
1756
b644ba33
JH		 1757 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1758
d7a5a11d 1759 if (hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 1760 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1761
79c6c70c
JH		 1762 if (!conn)
1763 goto unlock;
1764
1765 if (!hci_outgoing_auth_needed(hdev, conn))
1766 goto unlock;
1767
51a8efd7 1768 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1769 struct hci_cp_auth_requested auth_cp;
1770
977f8fce
JH		 1771 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1772
c1f23a2b
JB		 1773 auth_cp.handle = __cpu_to_le16(conn->handle);
1774 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1775 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1776 }
1777
79c6c70c 1778unlock:
127178d2 1779 hci_dev_unlock(hdev);
a9de9248 1780}
1da177e4 1781
769be974
MH		 1782static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1783{
1784 struct hci_cp_read_remote_features *cp;
1785 struct hci_conn *conn;
1786
9f1db00c 1787 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1788
1789 if (!status)
1790 return;
1791
1792 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1793 if (!cp)
1794 return;
1795
1796 hci_dev_lock(hdev);
1797
1798 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1799 if (conn) {
1800 if (conn->state == BT_CONFIG) {
539c496d 1801 hci_connect_cfm(conn, status);
76a68ba0 1802 hci_conn_drop(conn);
769be974
MH		 1803 }
1804 }
1805
1806 hci_dev_unlock(hdev);
1807}
1808
1809static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1810{
1811 struct hci_cp_read_remote_ext_features *cp;
1812 struct hci_conn *conn;
1813
9f1db00c 1814 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1815
1816 if (!status)
1817 return;
1818
1819 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1820 if (!cp)
1821 return;
1822
1823 hci_dev_lock(hdev);
1824
1825 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1826 if (conn) {
1827 if (conn->state == BT_CONFIG) {
539c496d 1828 hci_connect_cfm(conn, status);
76a68ba0 1829 hci_conn_drop(conn);
769be974
MH		 1830 }
1831 }
1832
1833 hci_dev_unlock(hdev);
1834}
1835
a9de9248
MH		 1836static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1837{
b6a0dc82
MH		 1838 struct hci_cp_setup_sync_conn *cp;
1839 struct hci_conn *acl, *sco;
1840 __u16 handle;
1841
9f1db00c 1842 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 1843
1844 if (!status)
1845 return;
1846
1847 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1848 if (!cp)
1849 return;
1850
1851 handle = __le16_to_cpu(cp->handle);
1852
9f1db00c 1853 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 1854
1855 hci_dev_lock(hdev);
1856
1857 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1858 if (acl) {
1859 sco = acl->link;
1860 if (sco) {
1861 sco->state = BT_CLOSED;
b6a0dc82 1862
539c496d 1863 hci_connect_cfm(sco, status);
5a08ecce
AE		 1864 hci_conn_del(sco);
1865 }
b6a0dc82
MH		 1866 }
1867
1868 hci_dev_unlock(hdev);
1da177e4
LT		 1869}
1870
a9de9248 1871static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1872{
a9de9248
MH		 1873 struct hci_cp_sniff_mode *cp;
1874 struct hci_conn *conn;
1da177e4 1875
9f1db00c 1876 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1877
a9de9248
MH		 1878 if (!status)
1879 return;
04837f64 1880
a9de9248
MH		 1881 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1882 if (!cp)
1883 return;
04837f64 1884
a9de9248 1885 hci_dev_lock(hdev);
04837f64 1886
a9de9248 1887 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1888 if (conn) {
51a8efd7 1889 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 1890
51a8efd7 1891 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1892 hci_sco_setup(conn, status);
1893 }
1894
a9de9248
MH		 1895 hci_dev_unlock(hdev);
1896}
04837f64 1897
a9de9248
MH		 1898static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1899{
1900 struct hci_cp_exit_sniff_mode *cp;
1901 struct hci_conn *conn;
04837f64 1902
9f1db00c 1903 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1904
a9de9248
MH		 1905 if (!status)
1906 return;
04837f64 1907
a9de9248
MH		 1908 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1909 if (!cp)
1910 return;
04837f64 1911
a9de9248 1912 hci_dev_lock(hdev);
1da177e4 1913
a9de9248 1914 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1915 if (conn) {
51a8efd7 1916 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 1917
51a8efd7 1918 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1919 hci_sco_setup(conn, status);
1920 }
1921
a9de9248 1922 hci_dev_unlock(hdev);
1da177e4
LT		 1923}
1924
88c3df13
JH		 1925static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1926{
1927 struct hci_cp_disconnect *cp;
1928 struct hci_conn *conn;
1929
1930 if (!status)
1931 return;
1932
1933 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1934 if (!cp)
1935 return;
1936
1937 hci_dev_lock(hdev);
1938
1939 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1940 if (conn)
1941 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 1942 conn->dst_type, status);
88c3df13
JH		 1943
1944 hci_dev_unlock(hdev);
1945}
1946
a02226d6
AE		 1947static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1948{
93c284ee
AE		 1949 struct hci_cp_create_phy_link *cp;
1950
a02226d6 1951 BT_DBG("%s status 0x%2.2x", hdev->name, status);
93c284ee 1952
93c284ee
AE		 1953 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1954 if (!cp)
1955 return;
1956
e58917b9
AE		 1957 hci_dev_lock(hdev);
1958
1959 if (status) {
1960 struct hci_conn *hcon;
1961
1962 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1963 if (hcon)
1964 hci_conn_del(hcon);
1965 } else {
1966 amp_write_remote_assoc(hdev, cp->phy_handle);
1967 }
1968
1969 hci_dev_unlock(hdev);
a02226d6
AE		 1970}
1971
0b26ab9d
AE		 1972static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1973{
1974 struct hci_cp_accept_phy_link *cp;
1975
1976 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1977
1978 if (status)
1979 return;
1980
1981 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1982 if (!cp)
1983 return;
1984
1985 amp_write_remote_assoc(hdev, cp->phy_handle);
1986}
1987
cb1d68f7
JH		 1988static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1989{
1990 struct hci_cp_le_create_conn *cp;
1991 struct hci_conn *conn;
1992
1993 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1994
1995 /* All connection failure handling is taken care of by the
1996 * hci_le_conn_failed function which is triggered by the HCI
1997 * request completion callbacks used for connecting.
1998 */
1999 if (status)
2000 return;
2001
2002 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2003 if (!cp)
2004 return;
2005
2006 hci_dev_lock(hdev);
2007
2008 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2009 if (!conn)
2010 goto unlock;
2011
2012 /* Store the initiator and responder address information which
2013 * is needed for SMP. These values will not change during the
2014 * lifetime of the connection.
2015 */
2016 conn->init_addr_type = cp->own_address_type;
2017 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2018 bacpy(&conn->init_addr, &hdev->random_addr);
2019 else
2020 bacpy(&conn->init_addr, &hdev->bdaddr);
2021
2022 conn->resp_addr_type = cp->peer_addr_type;
2023 bacpy(&conn->resp_addr, &cp->peer_addr);
2024
9489eca4
JH		 2025 /* We don't want the connection attempt to stick around
2026 * indefinitely since LE doesn't have a page timeout concept
2027 * like BR/EDR. Set a timer for any connection that doesn't use
2028 * the white list for connecting.
2029 */
2030 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2031 queue_delayed_work(conn->hdev->workqueue,
2032 &conn->le_conn_timeout,
09ae260b 2033 conn->conn_timeout);
9489eca4 2034
cb1d68f7
JH		 2035unlock:
2036 hci_dev_unlock(hdev);
2037}
2038
81d0c8ad
JH		 2039static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2040{
2041 struct hci_cp_le_start_enc *cp;
2042 struct hci_conn *conn;
2043
2044 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2045
2046 if (!status)
2047 return;
2048
2049 hci_dev_lock(hdev);
2050
2051 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2052 if (!cp)
2053 goto unlock;
2054
2055 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2056 if (!conn)
2057 goto unlock;
2058
2059 if (conn->state != BT_CONNECTED)
2060 goto unlock;
2061
2062 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2063 hci_conn_drop(conn);
2064
2065unlock:
2066 hci_dev_unlock(hdev);
2067}
2068
50fc85f1
KP		 2069static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2070{
2071 struct hci_cp_switch_role *cp;
2072 struct hci_conn *conn;
2073
2074 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2075
2076 if (!status)
2077 return;
2078
2079 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2080 if (!cp)
2081 return;
2082
2083 hci_dev_lock(hdev);
2084
2085 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2086 if (conn)
2087 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2088
2089 hci_dev_unlock(hdev);
2090}
2091
6039aa73 2092static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2093{
2094 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 2095 struct discovery_state *discov = &hdev->discovery;
2096 struct inquiry_entry *e;
1da177e4 2097
9f1db00c 2098 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 2099
a9de9248 2100 hci_conn_check_pending(hdev);
89352e7d
AG		 2101
2102 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2103 return;
2104
4e857c58 2105 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 2106 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2107
d7a5a11d 2108 if (!hci_dev_test_flag(hdev, HCI_MGMT))
30dc78e1
JH		 2109 return;
2110
56e5cb86 2111 hci_dev_lock(hdev);
30dc78e1 2112
343f935b 2113 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 2114 goto unlock;
2115
2116 if (list_empty(&discov->resolve)) {
07d2334a
JP		 2117 /* When BR/EDR inquiry is active and no LE scanning is in
2118 * progress, then change discovery state to indicate completion.
2119 *
2120 * When running LE scanning and BR/EDR inquiry simultaneously
2121 * and the LE scan already finished, then change the discovery
2122 * state to indicate completion.
2123 */
2124 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2125 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2126 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2127 goto unlock;
2128 }
2129
2130 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2131 if (e && hci_resolve_name(hdev, e) == 0) {
2132 e->name_state = NAME_PENDING;
2133 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2134 } else {
07d2334a
JP		 2135 /* When BR/EDR inquiry is active and no LE scanning is in
2136 * progress, then change discovery state to indicate completion.
2137 *
2138 * When running LE scanning and BR/EDR inquiry simultaneously
2139 * and the LE scan already finished, then change the discovery
2140 * state to indicate completion.
2141 */
2142 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2143 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2144 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2145 }
2146
2147unlock:
56e5cb86 2148 hci_dev_unlock(hdev);
1da177e4
LT		 2149}
2150
6039aa73 2151static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2152{
45bb4bf0 2153 struct inquiry_data data;
a9de9248 2154 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 2155 int num_rsp = *((__u8 *) skb->data);
2156
2157 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2158
45bb4bf0
MH		 2159 if (!num_rsp)
2160 return;
2161
d7a5a11d 2162 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 2163 return;
2164
1da177e4 2165 hci_dev_lock(hdev);
45bb4bf0 2166
e17acd40 2167 for (; num_rsp; num_rsp--, info++) {
af58925c 2168 u32 flags;
3175405b 2169
1da177e4
LT		 2170 bacpy(&data.bdaddr, &info->bdaddr);
2171 data.pscan_rep_mode = info->pscan_rep_mode;
2172 data.pscan_period_mode = info->pscan_period_mode;
2173 data.pscan_mode = info->pscan_mode;
2174 memcpy(data.dev_class, info->dev_class, 3);
2175 data.clock_offset = info->clock_offset;
efb2513f 2176 data.rssi = HCI_RSSI_INVALID;
41a96212 2177 data.ssp_mode = 0x00;
3175405b 2178
af58925c
MH		 2179 flags = hci_inquiry_cache_update(hdev, &data, false);
2180
48264f06 2181 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
efb2513f
MH		 2182 info->dev_class, HCI_RSSI_INVALID,
2183 flags, NULL, 0, NULL, 0);
1da177e4 2184 }
45bb4bf0 2185
1da177e4
LT		 2186 hci_dev_unlock(hdev);
2187}
2188
6039aa73 2189static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2190{
a9de9248
MH		 2191 struct hci_ev_conn_complete *ev = (void *) skb->data;
2192 struct hci_conn *conn;
1da177e4
LT		 2193
2194 BT_DBG("%s", hdev->name);
2195
2196 hci_dev_lock(hdev);
2197
2198 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2199 if (!conn) {
2200 if (ev->link_type != SCO_LINK)
2201 goto unlock;
2202
2203 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2204 if (!conn)
2205 goto unlock;
2206
2207 conn->type = SCO_LINK;
2208 }
1da177e4
LT		 2209
2210 if (!ev->status) {
2211 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2212
2213 if (conn->type == ACL_LINK) {
2214 conn->state = BT_CONFIG;
2215 hci_conn_hold(conn);
a9ea3ed9
SJ		 2216
2217 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2218 !hci_find_link_key(hdev, &ev->bdaddr))
2219 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2220 else
2221 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2222 } else
2223 conn->state = BT_CONNECTED;
1da177e4 2224
23b9ceb7 2225 hci_debugfs_create_conn(conn);
7d0db0a3
MH		 2226 hci_conn_add_sysfs(conn);
2227
1da177e4 2228 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2229 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2230
2231 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2232 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2233
04837f64
MH		 2234 /* Get remote features */
2235 if (conn->type == ACL_LINK) {
2236 struct hci_cp_read_remote_features cp;
2237 cp.handle = ev->handle;
769be974 2238 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2239 sizeof(cp), &cp);
22f433dc 2240
1d2dc5b7 2241 hci_update_page_scan(hdev);
04837f64
MH		 2242 }
2243
1da177e4 2244 /* Set packet type for incoming connection */
d095c1eb 2245 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2246 struct hci_cp_change_conn_ptype cp;
2247 cp.handle = ev->handle;
a8746417 2248 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2249 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2250 &cp);
1da177e4 2251 }
17d5c04c 2252 } else {
1da177e4 2253 conn->state = BT_CLOSED;
17d5c04c 2254 if (conn->type == ACL_LINK)
64c7b77c 2255 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2256 conn->dst_type, ev->status);
17d5c04c 2257 }
1da177e4 2258
e73439d8
MH		 2259 if (conn->type == ACL_LINK)
2260 hci_sco_setup(conn, ev->status);
1da177e4 2261
769be974 2262 if (ev->status) {
539c496d 2263 hci_connect_cfm(conn, ev->status);
1da177e4 2264 hci_conn_del(conn);
c89b6e6b 2265 } else if (ev->link_type != ACL_LINK)
539c496d 2266 hci_connect_cfm(conn, ev->status);
1da177e4 2267
a9de9248 2268unlock:
1da177e4 2269 hci_dev_unlock(hdev);
1da177e4 2270
a9de9248 2271 hci_conn_check_pending(hdev);
1da177e4
LT		 2272}
2273
70c46425
JH		 2274static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2275{
2276 struct hci_cp_reject_conn_req cp;
2277
2278 bacpy(&cp.bdaddr, bdaddr);
2279 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2280 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2281}
2282
6039aa73 2283static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2284{
a9de9248
MH		 2285 struct hci_ev_conn_request *ev = (void *) skb->data;
2286 int mask = hdev->link_mode;
70c46425
JH		 2287 struct inquiry_entry *ie;
2288 struct hci_conn *conn;
20714bfe 2289 __u8 flags = 0;
1da177e4 2290
6ed93dc6 2291 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2292 ev->link_type);
1da177e4 2293
20714bfe
FD		 2294 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2295 &flags);
1da177e4 2296
70c46425
JH		 2297 if (!(mask & HCI_LM_ACCEPT)) {
2298 hci_reject_conn(hdev, &ev->bdaddr);
2299 return;
2300 }
2301
46c4c941
JH		 2302 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2303 BDADDR_BREDR)) {
2304 hci_reject_conn(hdev, &ev->bdaddr);
2305 return;
2306 }
2307
6a8fc95c
JH		 2308 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2309 * connection. These features are only touched through mgmt so
2310 * only do the checks if HCI_MGMT is set.
2311 */
d7a5a11d
MH		 2312 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2313 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
46c4c941
JH		 2314 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2315 BDADDR_BREDR)) {
2316 hci_reject_conn(hdev, &ev->bdaddr);
2317 return;
70c46425 2318 }
1da177e4 2319
70c46425 2320 /* Connection accepted */
b6a0dc82 2321
70c46425
JH		 2322 hci_dev_lock(hdev);
2323
2324 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2325 if (ie)
2326 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2327
70c46425
JH		 2328 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2329 &ev->bdaddr);
2330 if (!conn) {
a5c4e309
JH		 2331 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2332 HCI_ROLE_SLAVE);
a9de9248 2333 if (!conn) {
70c46425
JH		 2334 BT_ERR("No memory for new connection");
2335 hci_dev_unlock(hdev);
2336 return;
1da177e4 2337 }
70c46425 2338 }
b6a0dc82 2339
70c46425 2340 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2341
70c46425 2342 hci_dev_unlock(hdev);
1da177e4 2343
70c46425
JH		 2344 if (ev->link_type == ACL_LINK ||
2345 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2346 struct hci_cp_accept_conn_req cp;
2347 conn->state = BT_CONNECT;
1da177e4 2348
70c46425 2349 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2350
70c46425
JH		 2351 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2352 cp.role = 0x00; /* Become master */
2353 else
2354 cp.role = 0x01; /* Remain slave */
b6a0dc82 2355
70c46425
JH		 2356 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2357 } else if (!(flags & HCI_PROTO_DEFER)) {
2358 struct hci_cp_accept_sync_conn_req cp;
2359 conn->state = BT_CONNECT;
b6a0dc82 2360
70c46425
JH		 2361 bacpy(&cp.bdaddr, &ev->bdaddr);
2362 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2363
70c46425
JH		 2364 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2365 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2366 cp.max_latency = cpu_to_le16(0xffff);
2367 cp.content_format = cpu_to_le16(hdev->voice_setting);
2368 cp.retrans_effort = 0xff;
1da177e4 2369
70c46425
JH		 2370 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2371 &cp);
a9de9248 2372 } else {
70c46425 2373 conn->state = BT_CONNECT2;
539c496d 2374 hci_connect_cfm(conn, 0);
1da177e4 2375 }
1da177e4
LT		 2376}
2377
f0d6a0ea
MA		 2378static u8 hci_to_mgmt_reason(u8 err)
2379{
2380 switch (err) {
2381 case HCI_ERROR_CONNECTION_TIMEOUT:
2382 return MGMT_DEV_DISCONN_TIMEOUT;
2383 case HCI_ERROR_REMOTE_USER_TERM:
2384 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2385 case HCI_ERROR_REMOTE_POWER_OFF:
2386 return MGMT_DEV_DISCONN_REMOTE;
2387 case HCI_ERROR_LOCAL_HOST_TERM:
2388 return MGMT_DEV_DISCONN_LOCAL_HOST;
2389 default:
2390 return MGMT_DEV_DISCONN_UNKNOWN;
2391 }
2392}
2393
6039aa73 2394static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2395{
a9de9248 2396 struct hci_ev_disconn_complete *ev = (void *) skb->data;
abf54a50 2397 u8 reason = hci_to_mgmt_reason(ev->reason);
9fcb18ef 2398 struct hci_conn_params *params;
04837f64 2399 struct hci_conn *conn;
12d4a3b2 2400 bool mgmt_connected;
3846220b 2401 u8 type;
04837f64 2402
9f1db00c 2403 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2404
2405 hci_dev_lock(hdev);
2406
2407 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2408 if (!conn)
2409 goto unlock;
7d0db0a3 2410
abf54a50
AG		 2411 if (ev->status) {
2412 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2413 conn->dst_type, ev->status);
2414 goto unlock;
37d9ef76 2415 }
f7520543 2416
3846220b
AG		 2417 conn->state = BT_CLOSED;
2418
12d4a3b2
JH		 2419 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2420 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2421 reason, mgmt_connected);
abf54a50 2422
22f433dc
JH		 2423 if (conn->type == ACL_LINK) {
2424 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2425 hci_remove_link_key(hdev, &conn->dst);
2426
1d2dc5b7 2427 hci_update_page_scan(hdev);
22f433dc 2428 }
2210246c 2429
9fcb18ef
AG		 2430 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2431 if (params) {
2432 switch (params->auto_connect) {
2433 case HCI_AUTO_CONN_LINK_LOSS:
2434 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2435 break;
2436 /* Fall through */
2437
4b9e7e75 2438 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2439 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2440 list_del_init(&params->action);
2441 list_add(&params->action, &hdev->pend_le_conns);
2442 hci_update_background_scan(hdev);
9fcb18ef
AG		 2443 break;
2444
2445 default:
2446 break;
2447 }
2448 }
2449
3846220b 2450 type = conn->type;
2210246c 2451
3a6d576b 2452 hci_disconn_cfm(conn, ev->reason);
3846220b
AG		 2453 hci_conn_del(conn);
2454
2455 /* Re-enable advertising if necessary, since it might
2456 * have been disabled by the connection. From the
2457 * HCI_LE_Set_Advertise_Enable command description in
2458 * the core specification (v4.0):
2459 * "The Controller shall continue advertising until the Host
2460 * issues an LE_Set_Advertise_Enable command with
2461 * Advertising_Enable set to 0x00 (Advertising is disabled)
2462 * or until a connection is created or until the Advertising
2463 * is timed out due to Directed Advertising."
2464 */
2465 if (type == LE_LINK)
2466 mgmt_reenable_advertising(hdev);
f7520543
JH		 2467
2468unlock:
04837f64
MH		 2469 hci_dev_unlock(hdev);
2470}
2471
6039aa73 2472static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2473{
a9de9248 2474 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2475 struct hci_conn *conn;
1da177e4 2476
9f1db00c 2477 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2478
2479 hci_dev_lock(hdev);
2480
04837f64 2481 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2482 if (!conn)
2483 goto unlock;
2484
2485 if (!ev->status) {
aa64a8b5 2486 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2487 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
d7556e20 2488 BT_INFO("re-auth of legacy device is not possible.");
2a611692 2489 } else {
4dae2798 2490 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2491 conn->sec_level = conn->pending_sec_level;
2a611692 2492 }
d7556e20 2493 } else {
e1e930f5 2494 mgmt_auth_failed(conn, ev->status);
d7556e20 2495 }
1da177e4 2496
51a8efd7
JH		 2497 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2498 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2499
d7556e20 2500 if (conn->state == BT_CONFIG) {
aa64a8b5 2501 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2502 struct hci_cp_set_conn_encrypt cp;
2503 cp.handle = ev->handle;
2504 cp.encrypt = 0x01;
2505 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2506 &cp);
052b30b0 2507 } else {
d7556e20 2508 conn->state = BT_CONNECTED;
539c496d 2509 hci_connect_cfm(conn, ev->status);
76a68ba0 2510 hci_conn_drop(conn);
052b30b0 2511 }
d7556e20
WR		 2512 } else {
2513 hci_auth_cfm(conn, ev->status);
052b30b0 2514
d7556e20
WR		 2515 hci_conn_hold(conn);
2516 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2517 hci_conn_drop(conn);
d7556e20
WR		 2518 }
2519
51a8efd7 2520 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2521 if (!ev->status) {
2522 struct hci_cp_set_conn_encrypt cp;
2523 cp.handle = ev->handle;
2524 cp.encrypt = 0x01;
2525 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2526 &cp);
d7556e20 2527 } else {
51a8efd7 2528 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2529 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2530 }
2531 }
2532
d7556e20 2533unlock:
1da177e4
LT		 2534 hci_dev_unlock(hdev);
2535}
2536
6039aa73 2537static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2538{
127178d2
JH		 2539 struct hci_ev_remote_name *ev = (void *) skb->data;
2540 struct hci_conn *conn;
2541
a9de9248 2542 BT_DBG("%s", hdev->name);
1da177e4 2543
a9de9248 2544 hci_conn_check_pending(hdev);
127178d2
JH		 2545
2546 hci_dev_lock(hdev);
2547
b644ba33 2548 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2549
d7a5a11d 2550 if (!hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2551 goto check_auth;
a88a9652 2552
b644ba33
JH		 2553 if (ev->status == 0)
2554 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2555 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2556 else
2557 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2558
2559check_auth:
79c6c70c
JH		 2560 if (!conn)
2561 goto unlock;
2562
2563 if (!hci_outgoing_auth_needed(hdev, conn))
2564 goto unlock;
2565
51a8efd7 2566 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2567 struct hci_cp_auth_requested cp;
977f8fce
JH		 2568
2569 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2570
127178d2
JH		 2571 cp.handle = __cpu_to_le16(conn->handle);
2572 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2573 }
2574
79c6c70c 2575unlock:
127178d2 2576 hci_dev_unlock(hdev);
a9de9248
MH		 2577}
2578
6039aa73 2579static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2580{
2581 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2582 struct hci_conn *conn;
2583
9f1db00c 2584 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2585
2586 hci_dev_lock(hdev);
2587
04837f64 2588 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2589 if (!conn)
2590 goto unlock;
1da177e4 2591
dc8357cc
MH		 2592 if (!ev->status) {
2593 if (ev->encrypt) {
2594 /* Encryption implies authentication */
4dae2798
JH		 2595 set_bit(HCI_CONN_AUTH, &conn->flags);
2596 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2597 conn->sec_level = conn->pending_sec_level;
abf76bad 2598
914a6ffe
MH		 2599 /* P-256 authentication key implies FIPS */
2600 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2601 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2602
abf76bad
MH		 2603 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2604 conn->type == LE_LINK)
2605 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2606 } else {
4dae2798 2607 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2608 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2609 }
dc8357cc 2610 }
a7d7723a 2611
7ed3fa20
JH		 2612 /* We should disregard the current RPA and generate a new one
2613 * whenever the encryption procedure fails.
2614 */
2615 if (ev->status && conn->type == LE_LINK)
a1536da2 2616 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
7ed3fa20 2617
dc8357cc 2618 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2619
dc8357cc
MH		 2620 if (ev->status && conn->state == BT_CONNECTED) {
2621 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2622 hci_conn_drop(conn);
2623 goto unlock;
1da177e4
LT		 2624 }
2625
dc8357cc
MH		 2626 if (conn->state == BT_CONFIG) {
2627 if (!ev->status)
2628 conn->state = BT_CONNECTED;
2629
40b552aa
MH		 2630 /* In Secure Connections Only mode, do not allow any
2631 * connections that are not encrypted with AES-CCM
2632 * using a P-256 authenticated combination key.
2633 */
d7a5a11d 2634 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
40b552aa
MH		 2635 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2636 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
539c496d 2637 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
40b552aa
MH		 2638 hci_conn_drop(conn);
2639 goto unlock;
2640 }
2641
539c496d 2642 hci_connect_cfm(conn, ev->status);
dc8357cc
MH		 2643 hci_conn_drop(conn);
2644 } else
2645 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2646
a7d7723a 2647unlock:
1da177e4
LT		 2648 hci_dev_unlock(hdev);
2649}
2650
6039aa73
GP		 2651static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2652 struct sk_buff *skb)
1da177e4 2653{
a9de9248 2654 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2655 struct hci_conn *conn;
1da177e4 2656
9f1db00c 2657 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2658
2659 hci_dev_lock(hdev);
2660
04837f64 2661 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2662 if (conn) {
2663 if (!ev->status)
4dae2798 2664 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 2665
51a8efd7 2666 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 2667
2668 hci_key_change_cfm(conn, ev->status);
2669 }
2670
2671 hci_dev_unlock(hdev);
2672}
2673
6039aa73
GP		 2674static void hci_remote_features_evt(struct hci_dev *hdev,
2675 struct sk_buff *skb)
1da177e4 2676{
a9de9248
MH		 2677 struct hci_ev_remote_features *ev = (void *) skb->data;
2678 struct hci_conn *conn;
2679
9f1db00c 2680 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 2681
a9de9248
MH		 2682 hci_dev_lock(hdev);
2683
2684 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2685 if (!conn)
2686 goto unlock;
769be974 2687
ccd556fe 2688 if (!ev->status)
cad718ed 2689 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 2690
2691 if (conn->state != BT_CONFIG)
2692 goto unlock;
2693
ac363cf9
SJ		 2694 if (!ev->status && lmp_ext_feat_capable(hdev) &&
2695 lmp_ext_feat_capable(conn)) {
ccd556fe
JH		 2696 struct hci_cp_read_remote_ext_features cp;
2697 cp.handle = ev->handle;
2698 cp.page = 0x01;
2699 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 2700 sizeof(cp), &cp);
392599b9
JH		 2701 goto unlock;
2702 }
2703
671267bf 2704 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 2705 struct hci_cp_remote_name_req cp;
2706 memset(&cp, 0, sizeof(cp));
2707 bacpy(&cp.bdaddr, &conn->dst);
2708 cp.pscan_rep_mode = 0x02;
2709 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 2710 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 2711 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 2712
127178d2 2713 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 2714 conn->state = BT_CONNECTED;
539c496d 2715 hci_connect_cfm(conn, ev->status);
76a68ba0 2716 hci_conn_drop(conn);
769be974 2717 }
a9de9248 2718
ccd556fe 2719unlock:
a9de9248 2720 hci_dev_unlock(hdev);
1da177e4
LT		 2721}
2722
e6214487
JH		 2723static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2724 u16 *opcode, u8 *status,
2725 hci_req_complete_t *req_complete,
2726 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 2727{
2728 struct hci_ev_cmd_complete *ev = (void *) skb->data;
a9de9248 2729
e6214487
JH		 2730 *opcode = __le16_to_cpu(ev->opcode);
2731 *status = skb->data[sizeof(*ev)];
a9de9248 2732
e6214487 2733 skb_pull(skb, sizeof(*ev));
a9de9248 2734
e6214487 2735 switch (*opcode) {
a9de9248
MH		 2736 case HCI_OP_INQUIRY_CANCEL:
2737 hci_cc_inquiry_cancel(hdev, skb);
2738 break;
2739
4d93483b
AG		 2740 case HCI_OP_PERIODIC_INQ:
2741 hci_cc_periodic_inq(hdev, skb);
2742 break;
2743
a9de9248
MH		 2744 case HCI_OP_EXIT_PERIODIC_INQ:
2745 hci_cc_exit_periodic_inq(hdev, skb);
2746 break;
2747
2748 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2749 hci_cc_remote_name_req_cancel(hdev, skb);
2750 break;
2751
2752 case HCI_OP_ROLE_DISCOVERY:
2753 hci_cc_role_discovery(hdev, skb);
2754 break;
2755
e4e8e37c
MH		 2756 case HCI_OP_READ_LINK_POLICY:
2757 hci_cc_read_link_policy(hdev, skb);
2758 break;
2759
a9de9248
MH		 2760 case HCI_OP_WRITE_LINK_POLICY:
2761 hci_cc_write_link_policy(hdev, skb);
2762 break;
2763
e4e8e37c
MH		 2764 case HCI_OP_READ_DEF_LINK_POLICY:
2765 hci_cc_read_def_link_policy(hdev, skb);
2766 break;
2767
2768 case HCI_OP_WRITE_DEF_LINK_POLICY:
2769 hci_cc_write_def_link_policy(hdev, skb);
2770 break;
2771
a9de9248
MH		 2772 case HCI_OP_RESET:
2773 hci_cc_reset(hdev, skb);
2774 break;
2775
c2f0f979
MH		 2776 case HCI_OP_READ_STORED_LINK_KEY:
2777 hci_cc_read_stored_link_key(hdev, skb);
2778 break;
2779
a9366120
MH		 2780 case HCI_OP_DELETE_STORED_LINK_KEY:
2781 hci_cc_delete_stored_link_key(hdev, skb);
2782 break;
2783
a9de9248
MH		 2784 case HCI_OP_WRITE_LOCAL_NAME:
2785 hci_cc_write_local_name(hdev, skb);
2786 break;
2787
2788 case HCI_OP_READ_LOCAL_NAME:
2789 hci_cc_read_local_name(hdev, skb);
2790 break;
2791
2792 case HCI_OP_WRITE_AUTH_ENABLE:
2793 hci_cc_write_auth_enable(hdev, skb);
2794 break;
2795
2796 case HCI_OP_WRITE_ENCRYPT_MODE:
2797 hci_cc_write_encrypt_mode(hdev, skb);
2798 break;
2799
2800 case HCI_OP_WRITE_SCAN_ENABLE:
2801 hci_cc_write_scan_enable(hdev, skb);
2802 break;
2803
2804 case HCI_OP_READ_CLASS_OF_DEV:
2805 hci_cc_read_class_of_dev(hdev, skb);
2806 break;
2807
2808 case HCI_OP_WRITE_CLASS_OF_DEV:
2809 hci_cc_write_class_of_dev(hdev, skb);
2810 break;
2811
2812 case HCI_OP_READ_VOICE_SETTING:
2813 hci_cc_read_voice_setting(hdev, skb);
2814 break;
2815
2816 case HCI_OP_WRITE_VOICE_SETTING:
2817 hci_cc_write_voice_setting(hdev, skb);
2818 break;
2819
b4cb9fb2
MH		 2820 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2821 hci_cc_read_num_supported_iac(hdev, skb);
2822 break;
2823
333140b5
MH		 2824 case HCI_OP_WRITE_SSP_MODE:
2825 hci_cc_write_ssp_mode(hdev, skb);
2826 break;
2827
eac83dc6
MH		 2828 case HCI_OP_WRITE_SC_SUPPORT:
2829 hci_cc_write_sc_support(hdev, skb);
2830 break;
2831
a9de9248
MH		 2832 case HCI_OP_READ_LOCAL_VERSION:
2833 hci_cc_read_local_version(hdev, skb);
2834 break;
2835
2836 case HCI_OP_READ_LOCAL_COMMANDS:
2837 hci_cc_read_local_commands(hdev, skb);
2838 break;
2839
2840 case HCI_OP_READ_LOCAL_FEATURES:
2841 hci_cc_read_local_features(hdev, skb);
2842 break;
2843
971e3a4b
AG		 2844 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2845 hci_cc_read_local_ext_features(hdev, skb);
2846 break;
2847
a9de9248
MH		 2848 case HCI_OP_READ_BUFFER_SIZE:
2849 hci_cc_read_buffer_size(hdev, skb);
2850 break;
2851
2852 case HCI_OP_READ_BD_ADDR:
2853 hci_cc_read_bd_addr(hdev, skb);
2854 break;
2855
f332ec66
JH		 2856 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2857 hci_cc_read_page_scan_activity(hdev, skb);
2858 break;
2859
4a3ee763
JH		 2860 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2861 hci_cc_write_page_scan_activity(hdev, skb);
2862 break;
2863
f332ec66
JH		 2864 case HCI_OP_READ_PAGE_SCAN_TYPE:
2865 hci_cc_read_page_scan_type(hdev, skb);
2866 break;
2867
4a3ee763
JH		 2868 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2869 hci_cc_write_page_scan_type(hdev, skb);
2870 break;
2871
350ee4cf
AE		 2872 case HCI_OP_READ_DATA_BLOCK_SIZE:
2873 hci_cc_read_data_block_size(hdev, skb);
2874 break;
2875
1e89cffb
AE		 2876 case HCI_OP_READ_FLOW_CONTROL_MODE:
2877 hci_cc_read_flow_control_mode(hdev, skb);
2878 break;
2879
928abaa7
AE		 2880 case HCI_OP_READ_LOCAL_AMP_INFO:
2881 hci_cc_read_local_amp_info(hdev, skb);
2882 break;
2883
33f35721
JH		 2884 case HCI_OP_READ_CLOCK:
2885 hci_cc_read_clock(hdev, skb);
2886 break;
2887
903e4541
AE		 2888 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2889 hci_cc_read_local_amp_assoc(hdev, skb);
2890 break;
2891
d5859e22
JH		 2892 case HCI_OP_READ_INQ_RSP_TX_POWER:
2893 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2894 break;
2895
980e1a53
JH		 2896 case HCI_OP_PIN_CODE_REPLY:
2897 hci_cc_pin_code_reply(hdev, skb);
2898 break;
2899
2900 case HCI_OP_PIN_CODE_NEG_REPLY:
2901 hci_cc_pin_code_neg_reply(hdev, skb);
2902 break;
2903
c35938b2 2904 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 2905 hci_cc_read_local_oob_data(hdev, skb);
2906 break;
2907
2908 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2909 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 2910 break;
2911
6ed58ec5
VT		 2912 case HCI_OP_LE_READ_BUFFER_SIZE:
2913 hci_cc_le_read_buffer_size(hdev, skb);
2914 break;
2915
60e77321
JH		 2916 case HCI_OP_LE_READ_LOCAL_FEATURES:
2917 hci_cc_le_read_local_features(hdev, skb);
2918 break;
2919
8fa19098
JH		 2920 case HCI_OP_LE_READ_ADV_TX_POWER:
2921 hci_cc_le_read_adv_tx_power(hdev, skb);
2922 break;
2923
a5c29683
JH		 2924 case HCI_OP_USER_CONFIRM_REPLY:
2925 hci_cc_user_confirm_reply(hdev, skb);
2926 break;
2927
2928 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2929 hci_cc_user_confirm_neg_reply(hdev, skb);
2930 break;
2931
1143d458
BG		 2932 case HCI_OP_USER_PASSKEY_REPLY:
2933 hci_cc_user_passkey_reply(hdev, skb);
2934 break;
2935
2936 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2937 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 2938 break;
07f7fa5d 2939
7a4cd51d
MH		 2940 case HCI_OP_LE_SET_RANDOM_ADDR:
2941 hci_cc_le_set_random_addr(hdev, skb);
2942 break;
2943
c1d5dc4a
JH		 2944 case HCI_OP_LE_SET_ADV_ENABLE:
2945 hci_cc_le_set_adv_enable(hdev, skb);
2946 break;
2947
533553f8
MH		 2948 case HCI_OP_LE_SET_SCAN_PARAM:
2949 hci_cc_le_set_scan_param(hdev, skb);
2950 break;
2951
eb9d91f5
AG		 2952 case HCI_OP_LE_SET_SCAN_ENABLE:
2953 hci_cc_le_set_scan_enable(hdev, skb);
2954 break;
2955
cf1d081f
JH		 2956 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2957 hci_cc_le_read_white_list_size(hdev, skb);
2958 break;
2959
0f36b589
MH		 2960 case HCI_OP_LE_CLEAR_WHITE_LIST:
2961 hci_cc_le_clear_white_list(hdev, skb);
2962 break;
2963
2964 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2965 hci_cc_le_add_to_white_list(hdev, skb);
2966 break;
2967
2968 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2969 hci_cc_le_del_from_white_list(hdev, skb);
2970 break;
2971
9b008c04
JH		 2972 case HCI_OP_LE_READ_SUPPORTED_STATES:
2973 hci_cc_le_read_supported_states(hdev, skb);
2974 break;
2975
a8e1bfaa
MH		 2976 case HCI_OP_LE_READ_DEF_DATA_LEN:
2977 hci_cc_le_read_def_data_len(hdev, skb);
2978 break;
2979
2980 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
2981 hci_cc_le_write_def_data_len(hdev, skb);
2982 break;
2983
2984 case HCI_OP_LE_READ_MAX_DATA_LEN:
2985 hci_cc_le_read_max_data_len(hdev, skb);
2986 break;
2987
f9b49306
AG		 2988 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2989 hci_cc_write_le_host_supported(hdev, skb);
2990 break;
2991
56ed2cb8
JH		 2992 case HCI_OP_LE_SET_ADV_PARAM:
2993 hci_cc_set_adv_param(hdev, skb);
2994 break;
2995
93c284ee
AE		 2996 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2997 hci_cc_write_remote_amp_assoc(hdev, skb);
2998 break;
2999
5ae76a94
AK		 3000 case HCI_OP_READ_RSSI:
3001 hci_cc_read_rssi(hdev, skb);
3002 break;
3003
5a134fae
AK		 3004 case HCI_OP_READ_TX_POWER:
3005 hci_cc_read_tx_power(hdev, skb);
3006 break;
3007
c50b33c8
MH		 3008 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3009 hci_cc_write_ssp_debug_mode(hdev, skb);
3010 break;
3011
a9de9248 3012 default:
e6214487 3013 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3014 break;
3015 }
3016
e6214487 3017 if (*opcode != HCI_OP_NOP)
65cc2b49 3018 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3019
600b2150
JH		 3020 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3021 atomic_set(&hdev->cmd_cnt, 1);
3022
e6214487
JH		 3023 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3024 req_complete_skb);
9238f36a 3025
600b2150
JH		 3026 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3027 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3028}
3029
e6214487
JH		 3030static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3031 u16 *opcode, u8 *status,
3032 hci_req_complete_t *req_complete,
3033 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3034{
3035 struct hci_ev_cmd_status *ev = (void *) skb->data;
a9de9248
MH		 3036
3037 skb_pull(skb, sizeof(*ev));
3038
e6214487
JH		 3039 *opcode = __le16_to_cpu(ev->opcode);
3040 *status = ev->status;
a9de9248 3041
e6214487 3042 switch (*opcode) {
a9de9248
MH		 3043 case HCI_OP_INQUIRY:
3044 hci_cs_inquiry(hdev, ev->status);
3045 break;
3046
3047 case HCI_OP_CREATE_CONN:
3048 hci_cs_create_conn(hdev, ev->status);
3049 break;
3050
9645c76c
KP		 3051 case HCI_OP_DISCONNECT:
3052 hci_cs_disconnect(hdev, ev->status);
3053 break;
3054
a9de9248
MH		 3055 case HCI_OP_ADD_SCO:
3056 hci_cs_add_sco(hdev, ev->status);
3057 break;
3058
f8558555
MH		 3059 case HCI_OP_AUTH_REQUESTED:
3060 hci_cs_auth_requested(hdev, ev->status);
3061 break;
3062
3063 case HCI_OP_SET_CONN_ENCRYPT:
3064 hci_cs_set_conn_encrypt(hdev, ev->status);
3065 break;
3066
a9de9248
MH		 3067 case HCI_OP_REMOTE_NAME_REQ:
3068 hci_cs_remote_name_req(hdev, ev->status);
3069 break;
3070
769be974
MH		 3071 case HCI_OP_READ_REMOTE_FEATURES:
3072 hci_cs_read_remote_features(hdev, ev->status);
3073 break;
3074
3075 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3076 hci_cs_read_remote_ext_features(hdev, ev->status);
3077 break;
3078
a9de9248
MH		 3079 case HCI_OP_SETUP_SYNC_CONN:
3080 hci_cs_setup_sync_conn(hdev, ev->status);
3081 break;
3082
9645c76c
KP		 3083 case HCI_OP_CREATE_PHY_LINK:
3084 hci_cs_create_phylink(hdev, ev->status);
3085 break;
3086
3087 case HCI_OP_ACCEPT_PHY_LINK:
3088 hci_cs_accept_phylink(hdev, ev->status);
3089 break;
3090
a9de9248
MH		 3091 case HCI_OP_SNIFF_MODE:
3092 hci_cs_sniff_mode(hdev, ev->status);
3093 break;
3094
3095 case HCI_OP_EXIT_SNIFF_MODE:
3096 hci_cs_exit_sniff_mode(hdev, ev->status);
3097 break;
3098
50fc85f1
KP		 3099 case HCI_OP_SWITCH_ROLE:
3100 hci_cs_switch_role(hdev, ev->status);
3101 break;
3102
cb1d68f7
JH		 3103 case HCI_OP_LE_CREATE_CONN:
3104 hci_cs_le_create_conn(hdev, ev->status);
3105 break;
3106
81d0c8ad
JH		 3107 case HCI_OP_LE_START_ENC:
3108 hci_cs_le_start_enc(hdev, ev->status);
3109 break;
3110
a9de9248 3111 default:
e6214487 3112 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3113 break;
3114 }
3115
e6214487 3116 if (*opcode != HCI_OP_NOP)
65cc2b49 3117 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3118
600b2150
JH		 3119 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3120 atomic_set(&hdev->cmd_cnt, 1);
3121
444c6dd5
JH		 3122 /* Indicate request completion if the command failed. Also, if
3123 * we're not waiting for a special event and we get a success
3124 * command status we should try to flag the request as completed
3125 * (since for this kind of commands there will not be a command
3126 * complete event).
3127 */
02350a72 3128 if (ev->status ||
db6e3e8d 3129 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
e6214487
JH		 3130 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3131 req_complete_skb);
9238f36a 3132
600b2150
JH		 3133 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3134 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3135}
3136
24dfa343
MH		 3137static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3138{
3139 struct hci_ev_hardware_error *ev = (void *) skb->data;
3140
c7741d16
MH		 3141 hdev->hw_error_code = ev->code;
3142
3143 queue_work(hdev->req_workqueue, &hdev->error_reset);
24dfa343
MH		 3144}
3145
6039aa73 3146static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3147{
3148 struct hci_ev_role_change *ev = (void *) skb->data;
3149 struct hci_conn *conn;
3150
9f1db00c 3151 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 3152
3153 hci_dev_lock(hdev);
3154
3155 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3156 if (conn) {
40bef302
JH		 3157 if (!ev->status)
3158 conn->role = ev->role;
a9de9248 3159
51a8efd7 3160 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 3161
3162 hci_role_switch_cfm(conn, ev->status, ev->role);
3163 }
3164
3165 hci_dev_unlock(hdev);
3166}
3167
6039aa73 3168static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3169{
3170 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 3171 int i;
3172
32ac5b9b
AE		 3173 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3174 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3175 return;
3176 }
3177
c5993de8 3178 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3179 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
a9de9248
MH		 3180 BT_DBG("%s bad parameters", hdev->name);
3181 return;
3182 }
3183
c5993de8
AE		 3184 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3185
613a1c0c
AE		 3186 for (i = 0; i < ev->num_hndl; i++) {
3187 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 3188 struct hci_conn *conn;
3189 __u16 handle, count;
3190
613a1c0c
AE		 3191 handle = __le16_to_cpu(info->handle);
3192 count = __le16_to_cpu(info->count);
a9de9248
MH		 3193
3194 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 3195 if (!conn)
3196 continue;
3197
3198 conn->sent -= count;
3199
3200 switch (conn->type) {
3201 case ACL_LINK:
3202 hdev->acl_cnt += count;
3203 if (hdev->acl_cnt > hdev->acl_pkts)
3204 hdev->acl_cnt = hdev->acl_pkts;
3205 break;
3206
3207 case LE_LINK:
3208 if (hdev->le_pkts) {
3209 hdev->le_cnt += count;
3210 if (hdev->le_cnt > hdev->le_pkts)
3211 hdev->le_cnt = hdev->le_pkts;
3212 } else {
70f23020
AE		 3213 hdev->acl_cnt += count;
3214 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 3215 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 3216 }
f4280918
AE		 3217 break;
3218
3219 case SCO_LINK:
3220 hdev->sco_cnt += count;
3221 if (hdev->sco_cnt > hdev->sco_pkts)
3222 hdev->sco_cnt = hdev->sco_pkts;
3223 break;
3224
3225 default:
3226 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3227 break;
a9de9248
MH		 3228 }
3229 }
3230
3eff45ea 3231 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3232}
3233
76ef7cf7
AE		 3234static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3235 __u16 handle)
3236{
3237 struct hci_chan *chan;
3238
3239 switch (hdev->dev_type) {
3240 case HCI_BREDR:
3241 return hci_conn_hash_lookup_handle(hdev, handle);
3242 case HCI_AMP:
3243 chan = hci_chan_lookup_handle(hdev, handle);
3244 if (chan)
3245 return chan->conn;
3246 break;
3247 default:
3248 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3249 break;
3250 }
3251
3252 return NULL;
3253}
3254
6039aa73 3255static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3256{
3257 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3258 int i;
3259
3260 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3261 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3262 return;
3263 }
3264
3265 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3266 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
25e89e99
AE		 3267 BT_DBG("%s bad parameters", hdev->name);
3268 return;
3269 }
3270
3271 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3272 ev->num_hndl);
25e89e99
AE		 3273
3274 for (i = 0; i < ev->num_hndl; i++) {
3275 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3276 struct hci_conn *conn = NULL;
25e89e99
AE		 3277 __u16 handle, block_count;
3278
3279 handle = __le16_to_cpu(info->handle);
3280 block_count = __le16_to_cpu(info->blocks);
3281
76ef7cf7 3282 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3283 if (!conn)
3284 continue;
3285
3286 conn->sent -= block_count;
3287
3288 switch (conn->type) {
3289 case ACL_LINK:
bd1eb66b 3290 case AMP_LINK:
25e89e99
AE		 3291 hdev->block_cnt += block_count;
3292 if (hdev->block_cnt > hdev->num_blocks)
3293 hdev->block_cnt = hdev->num_blocks;
3294 break;
3295
3296 default:
3297 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3298 break;
3299 }
3300 }
3301
3302 queue_work(hdev->workqueue, &hdev->tx_work);
3303}
3304
6039aa73 3305static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3306{
a9de9248 3307 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3308 struct hci_conn *conn;
3309
9f1db00c 3310 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3311
3312 hci_dev_lock(hdev);
3313
3314 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3315 if (conn) {
3316 conn->mode = ev->mode;
a9de9248 3317
8fc9ced3
GP		 3318 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3319 &conn->flags)) {
a9de9248 3320 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3321 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3322 else
58a681ef 3323 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3324 }
e73439d8 3325
51a8efd7 3326 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3327 hci_sco_setup(conn, ev->status);
04837f64
MH		 3328 }
3329
3330 hci_dev_unlock(hdev);
3331}
3332
6039aa73 3333static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3334{
052b30b0
MH		 3335 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3336 struct hci_conn *conn;
3337
a9de9248 3338 BT_DBG("%s", hdev->name);
052b30b0
MH		 3339
3340 hci_dev_lock(hdev);
3341
3342 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3343 if (!conn)
3344 goto unlock;
3345
3346 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3347 hci_conn_hold(conn);
3348 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3349 hci_conn_drop(conn);
052b30b0
MH		 3350 }
3351
d7a5a11d 3352 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2f407f0a 3353 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3354 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3355 sizeof(ev->bdaddr), &ev->bdaddr);
d7a5a11d 3356 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
a770bb5a
WR		 3357 u8 secure;
3358
3359 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3360 secure = 1;
3361 else
3362 secure = 0;
3363
744cf19e 3364 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3365 }
980e1a53 3366
b6f98044 3367unlock:
052b30b0 3368 hci_dev_unlock(hdev);
a9de9248
MH		 3369}
3370
cb6f3f7a
JH		 3371static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3372{
3373 if (key_type == HCI_LK_CHANGED_COMBINATION)
3374 return;
3375
3376 conn->pin_length = pin_len;
3377 conn->key_type = key_type;
3378
3379 switch (key_type) {
3380 case HCI_LK_LOCAL_UNIT:
3381 case HCI_LK_REMOTE_UNIT:
3382 case HCI_LK_DEBUG_COMBINATION:
3383 return;
3384 case HCI_LK_COMBINATION:
3385 if (pin_len == 16)
3386 conn->pending_sec_level = BT_SECURITY_HIGH;
3387 else
3388 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3389 break;
3390 case HCI_LK_UNAUTH_COMBINATION_P192:
3391 case HCI_LK_UNAUTH_COMBINATION_P256:
3392 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3393 break;
3394 case HCI_LK_AUTH_COMBINATION_P192:
3395 conn->pending_sec_level = BT_SECURITY_HIGH;
3396 break;
3397 case HCI_LK_AUTH_COMBINATION_P256:
3398 conn->pending_sec_level = BT_SECURITY_FIPS;
3399 break;
3400 }
3401}
3402
6039aa73 3403static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3404{
55ed8ca1
JH		 3405 struct hci_ev_link_key_req *ev = (void *) skb->data;
3406 struct hci_cp_link_key_reply cp;
3407 struct hci_conn *conn;
3408 struct link_key *key;
3409
a9de9248 3410 BT_DBG("%s", hdev->name);
55ed8ca1 3411
d7a5a11d 3412 if (!hci_dev_test_flag(hdev, HCI_MGMT))
55ed8ca1
JH		 3413 return;
3414
3415 hci_dev_lock(hdev);
3416
3417 key = hci_find_link_key(hdev, &ev->bdaddr);
3418 if (!key) {
6ed93dc6
AE		 3419 BT_DBG("%s link key not found for %pMR", hdev->name,
3420 &ev->bdaddr);
55ed8ca1
JH		 3421 goto not_found;
3422 }
3423
6ed93dc6
AE		 3424 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3425 &ev->bdaddr);
55ed8ca1 3426
55ed8ca1 3427 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3428 if (conn) {
fe8bc5ac
JH		 3429 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3430
66138ce8
MH		 3431 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3432 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3433 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3434 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3435 goto not_found;
3436 }
55ed8ca1 3437
60b83f57 3438 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3439 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3440 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3441 BT_DBG("%s ignoring key unauthenticated for high security",
3442 hdev->name);
60b83f57
WR		 3443 goto not_found;
3444 }
3445
cb6f3f7a 3446 conn_set_key(conn, key->type, key->pin_len);
55ed8ca1
JH		 3447 }
3448
3449 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3450 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3451
3452 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3453
3454 hci_dev_unlock(hdev);
3455
3456 return;
3457
3458not_found:
3459 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3460 hci_dev_unlock(hdev);
a9de9248
MH		 3461}
3462
6039aa73 3463static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3464{
052b30b0
MH		 3465 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3466 struct hci_conn *conn;
7652ff6a
JH		 3467 struct link_key *key;
3468 bool persistent;
55ed8ca1 3469 u8 pin_len = 0;
052b30b0 3470
a9de9248 3471 BT_DBG("%s", hdev->name);
052b30b0
MH		 3472
3473 hci_dev_lock(hdev);
3474
3475 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
82c13d42
JH		 3476 if (!conn)
3477 goto unlock;
3478
3479 hci_conn_hold(conn);
3480 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3481 hci_conn_drop(conn);
3482
fe8bc5ac 3483 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
82c13d42 3484 conn_set_key(conn, ev->key_type, conn->pin_length);
052b30b0 3485
d7a5a11d 3486 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7652ff6a
JH		 3487 goto unlock;
3488
3489 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3490 ev->key_type, pin_len, &persistent);
3491 if (!key)
3492 goto unlock;
3493
cb6f3f7a
JH		 3494 /* Update connection information since adding the key will have
3495 * fixed up the type in the case of changed combination keys.
3496 */
3497 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3498 conn_set_key(conn, key->type, key->pin_len);
3499
7652ff6a 3500 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3501
6d5650c4
JH		 3502 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3503 * is set. If it's not set simply remove the key from the kernel
3504 * list (we've still notified user space about it but with
3505 * store_hint being 0).
3506 */
3507 if (key->type == HCI_LK_DEBUG_COMBINATION &&
d7a5a11d 3508 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
0378b597
JH		 3509 list_del_rcu(&key->list);
3510 kfree_rcu(key, rcu);
82c13d42 3511 goto unlock;
6d5650c4 3512 }
7652ff6a 3513
82c13d42
JH		 3514 if (persistent)
3515 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3516 else
3517 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3518
7652ff6a 3519unlock:
052b30b0 3520 hci_dev_unlock(hdev);
a9de9248
MH		 3521}
3522
6039aa73 3523static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3524{
a9de9248 3525 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3526 struct hci_conn *conn;
1da177e4 3527
9f1db00c 3528 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3529
3530 hci_dev_lock(hdev);
3531
04837f64 3532 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3533 if (conn && !ev->status) {
3534 struct inquiry_entry *ie;
3535
cc11b9c1
AE		 3536 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3537 if (ie) {
1da177e4
LT		 3538 ie->data.clock_offset = ev->clock_offset;
3539 ie->timestamp = jiffies;
3540 }
3541 }
3542
3543 hci_dev_unlock(hdev);
3544}
3545
6039aa73 3546static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 3547{
3548 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3549 struct hci_conn *conn;
3550
9f1db00c 3551 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 3552
3553 hci_dev_lock(hdev);
3554
3555 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3556 if (conn && !ev->status)
3557 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3558
3559 hci_dev_unlock(hdev);
3560}
3561
6039aa73 3562static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 3563{
a9de9248 3564 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 3565 struct inquiry_entry *ie;
3566
3567 BT_DBG("%s", hdev->name);
3568
3569 hci_dev_lock(hdev);
3570
cc11b9c1
AE		 3571 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3572 if (ie) {
85a1e930
MH		 3573 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3574 ie->timestamp = jiffies;
3575 }
3576
3577 hci_dev_unlock(hdev);
3578}
3579
6039aa73
GP		 3580static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3581 struct sk_buff *skb)
a9de9248
MH		 3582{
3583 struct inquiry_data data;
3584 int num_rsp = *((__u8 *) skb->data);
3585
3586 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3587
3588 if (!num_rsp)
3589 return;
3590
d7a5a11d 3591 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3592 return;
3593
a9de9248
MH		 3594 hci_dev_lock(hdev);
3595
3596 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3597 struct inquiry_info_with_rssi_and_pscan_mode *info;
3598 info = (void *) (skb->data + 1);
a9de9248 3599
e17acd40 3600 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3601 u32 flags;
3602
a9de9248
MH		 3603 bacpy(&data.bdaddr, &info->bdaddr);
3604 data.pscan_rep_mode = info->pscan_rep_mode;
3605 data.pscan_period_mode = info->pscan_period_mode;
3606 data.pscan_mode = info->pscan_mode;
3607 memcpy(data.dev_class, info->dev_class, 3);
3608 data.clock_offset = info->clock_offset;
3609 data.rssi = info->rssi;
41a96212 3610 data.ssp_mode = 0x00;
3175405b 3611
af58925c
MH		 3612 flags = hci_inquiry_cache_update(hdev, &data, false);
3613
48264f06 3614 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3615 info->dev_class, info->rssi,
af58925c 3616 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3617 }
3618 } else {
3619 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3620
e17acd40 3621 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3622 u32 flags;
3623
a9de9248
MH		 3624 bacpy(&data.bdaddr, &info->bdaddr);
3625 data.pscan_rep_mode = info->pscan_rep_mode;
3626 data.pscan_period_mode = info->pscan_period_mode;
3627 data.pscan_mode = 0x00;
3628 memcpy(data.dev_class, info->dev_class, 3);
3629 data.clock_offset = info->clock_offset;
3630 data.rssi = info->rssi;
41a96212 3631 data.ssp_mode = 0x00;
af58925c
MH		 3632
3633 flags = hci_inquiry_cache_update(hdev, &data, false);
3634
48264f06 3635 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3636 info->dev_class, info->rssi,
af58925c 3637 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3638 }
3639 }
3640
3641 hci_dev_unlock(hdev);
3642}
3643
6039aa73
GP		 3644static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3645 struct sk_buff *skb)
a9de9248 3646{
41a96212
MH		 3647 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3648 struct hci_conn *conn;
3649
a9de9248 3650 BT_DBG("%s", hdev->name);
41a96212 3651
41a96212
MH		 3652 hci_dev_lock(hdev);
3653
3654 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3655 if (!conn)
3656 goto unlock;
41a96212 3657
cad718ed
JH		 3658 if (ev->page < HCI_MAX_PAGES)
3659 memcpy(conn->features[ev->page], ev->features, 8);
3660
ccd556fe
JH		 3661 if (!ev->status && ev->page == 0x01) {
3662 struct inquiry_entry *ie;
41a96212 3663
cc11b9c1
AE		 3664 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3665 if (ie)
02b7cc62 3666 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 3667
bbb0eada 3668 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 3669 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 3670 } else {
3671 /* It is mandatory by the Bluetooth specification that
3672 * Extended Inquiry Results are only used when Secure
3673 * Simple Pairing is enabled, but some devices violate
3674 * this.
3675 *
3676 * To make these devices work, the internal SSP
3677 * enabled flag needs to be cleared if the remote host
3678 * features do not indicate SSP support */
3679 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3680 }
eb9a8f3f
MH		 3681
3682 if (ev->features[0] & LMP_HOST_SC)
3683 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 3684 }
3685
3686 if (conn->state != BT_CONFIG)
3687 goto unlock;
3688
671267bf 3689 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3690 struct hci_cp_remote_name_req cp;
3691 memset(&cp, 0, sizeof(cp));
3692 bacpy(&cp.bdaddr, &conn->dst);
3693 cp.pscan_rep_mode = 0x02;
3694 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3695 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3696 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3697
127178d2 3698 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 3699 conn->state = BT_CONNECTED;
539c496d 3700 hci_connect_cfm(conn, ev->status);
76a68ba0 3701 hci_conn_drop(conn);
41a96212
MH		 3702 }
3703
ccd556fe 3704unlock:
41a96212 3705 hci_dev_unlock(hdev);
a9de9248
MH		 3706}
3707
6039aa73
GP		 3708static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3709 struct sk_buff *skb)
a9de9248 3710{
b6a0dc82
MH		 3711 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3712 struct hci_conn *conn;
3713
9f1db00c 3714 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 3715
3716 hci_dev_lock(hdev);
3717
3718 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 3719 if (!conn) {
3720 if (ev->link_type == ESCO_LINK)
3721 goto unlock;
3722
3723 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3724 if (!conn)
3725 goto unlock;
3726
3727 conn->type = SCO_LINK;
3728 }
b6a0dc82 3729
732547f9
MH		 3730 switch (ev->status) {
3731 case 0x00:
b6a0dc82
MH		 3732 conn->handle = __le16_to_cpu(ev->handle);
3733 conn->state = BT_CONNECTED;
7d0db0a3 3734
23b9ceb7 3735 hci_debugfs_create_conn(conn);
7d0db0a3 3736 hci_conn_add_sysfs(conn);
732547f9
MH		 3737 break;
3738
81218d20 3739 case 0x10: /* Connection Accept Timeout */
1a4c958c 3740 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 3741 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 3742 case 0x1c: /* SCO interval rejected */
1038a00b 3743 case 0x1a: /* Unsupported Remote Feature */
732547f9 3744 case 0x1f: /* Unspecified error */
27539bc4 3745 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 3746 if (conn->out) {
732547f9
MH		 3747 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3748 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 3749 if (hci_setup_sync(conn, conn->link->handle))
3750 goto unlock;
732547f9
MH		 3751 }
3752 /* fall through */
3753
3754 default:
b6a0dc82 3755 conn->state = BT_CLOSED;
732547f9
MH		 3756 break;
3757 }
b6a0dc82 3758
539c496d 3759 hci_connect_cfm(conn, ev->status);
b6a0dc82
MH		 3760 if (ev->status)
3761 hci_conn_del(conn);
3762
3763unlock:
3764 hci_dev_unlock(hdev);
a9de9248
MH		 3765}
3766
efdcf8e3
MH		 3767static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3768{
3769 size_t parsed = 0;
3770
3771 while (parsed < eir_len) {
3772 u8 field_len = eir[0];
3773
3774 if (field_len == 0)
3775 return parsed;
3776
3777 parsed += field_len + 1;
3778 eir += field_len + 1;
3779 }
3780
3781 return eir_len;
3782}
3783
6039aa73
GP		 3784static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3785 struct sk_buff *skb)
1da177e4 3786{
a9de9248
MH		 3787 struct inquiry_data data;
3788 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3789 int num_rsp = *((__u8 *) skb->data);
9d939d94 3790 size_t eir_len;
1da177e4 3791
a9de9248 3792 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 3793
a9de9248
MH		 3794 if (!num_rsp)
3795 return;
1da177e4 3796
d7a5a11d 3797 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3798 return;
3799
a9de9248
MH		 3800 hci_dev_lock(hdev);
3801
e17acd40 3802 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3803 u32 flags;
3804 bool name_known;
561aafbc 3805
a9de9248 3806 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 3807 data.pscan_rep_mode = info->pscan_rep_mode;
3808 data.pscan_period_mode = info->pscan_period_mode;
3809 data.pscan_mode = 0x00;
a9de9248 3810 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 3811 data.clock_offset = info->clock_offset;
3812 data.rssi = info->rssi;
41a96212 3813 data.ssp_mode = 0x01;
561aafbc 3814
d7a5a11d 3815 if (hci_dev_test_flag(hdev, HCI_MGMT))
4ddb1930 3816 name_known = eir_has_data_type(info->data,
04124681
GP		 3817 sizeof(info->data),
3818 EIR_NAME_COMPLETE);
561aafbc
JH		 3819 else
3820 name_known = true;
3821
af58925c
MH		 3822 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3823
9d939d94 3824 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 3825
48264f06 3826 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 3827 info->dev_class, info->rssi,
3828 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 3829 }
3830
3831 hci_dev_unlock(hdev);
3832}
1da177e4 3833
1c2e0041
JH		 3834static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3835 struct sk_buff *skb)
3836{
3837 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3838 struct hci_conn *conn;
3839
9f1db00c 3840 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 3841 __le16_to_cpu(ev->handle));
3842
3843 hci_dev_lock(hdev);
3844
3845 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3846 if (!conn)
3847 goto unlock;
3848
9eb1fbfa
JH		 3849 /* For BR/EDR the necessary steps are taken through the
3850 * auth_complete event.
3851 */
3852 if (conn->type != LE_LINK)
3853 goto unlock;
3854
1c2e0041
JH		 3855 if (!ev->status)
3856 conn->sec_level = conn->pending_sec_level;
3857
3858 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3859
3860 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 3861 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 3862 hci_conn_drop(conn);
1c2e0041
JH		 3863 goto unlock;
3864 }
3865
3866 if (conn->state == BT_CONFIG) {
3867 if (!ev->status)
3868 conn->state = BT_CONNECTED;
3869
539c496d 3870 hci_connect_cfm(conn, ev->status);
76a68ba0 3871 hci_conn_drop(conn);
1c2e0041
JH		 3872 } else {
3873 hci_auth_cfm(conn, ev->status);
3874
3875 hci_conn_hold(conn);
3876 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3877 hci_conn_drop(conn);
1c2e0041
JH		 3878 }
3879
3880unlock:
3881 hci_dev_unlock(hdev);
3882}
3883
6039aa73 3884static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 3885{
17fa4b9d 3886 /* If remote requests no-bonding follow that lead */
acabae96
MA		 3887 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3888 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 3889 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 3890
b7f94c88
MA		 3891 /* If both remote and local have enough IO capabilities, require
3892 * MITM protection
3893 */
3894 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3895 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3896 return conn->remote_auth | 0x01;
3897
7e74170a
TM		 3898 /* No MITM protection possible so ignore remote requirement */
3899 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 3900}
3901
a83ed81e
MH		 3902static u8 bredr_oob_data_present(struct hci_conn *conn)
3903{
3904 struct hci_dev *hdev = conn->hdev;
3905 struct oob_data *data;
3906
3907 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3908 if (!data)
3909 return 0x00;
3910
455c2ff0
MH		 3911 if (bredr_sc_enabled(hdev)) {
3912 /* When Secure Connections is enabled, then just
3913 * return the present value stored with the OOB
3914 * data. The stored value contains the right present
3915 * information. However it can only be trusted when
3916 * not in Secure Connection Only mode.
3917 */
3918 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3919 return data->present;
659c7fb0 3920
455c2ff0
MH		 3921 /* When Secure Connections Only mode is enabled, then
3922 * the P-256 values are required. If they are not
3923 * available, then do not declare that OOB data is
3924 * present.
659c7fb0 3925 */
455c2ff0
MH		 3926 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3927 !memcmp(data->hash256, ZERO_KEY, 16))
659c7fb0
MH		 3928 return 0x00;
3929
455c2ff0 3930 return 0x02;
659c7fb0 3931 }
a83ed81e 3932
455c2ff0
MH		 3933 /* When Secure Connections is not enabled or actually
3934 * not supported by the hardware, then check that if
3935 * P-192 data values are present.
3936 */
3937 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3938 !memcmp(data->hash192, ZERO_KEY, 16))
3939 return 0x00;
3940
3941 return 0x01;
a83ed81e
MH		 3942}
3943
6039aa73 3944static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 3945{
3946 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3947 struct hci_conn *conn;
3948
3949 BT_DBG("%s", hdev->name);
3950
3951 hci_dev_lock(hdev);
3952
3953 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 3954 if (!conn)
3955 goto unlock;
3956
3957 hci_conn_hold(conn);
3958
d7a5a11d 3959 if (!hci_dev_test_flag(hdev, HCI_MGMT))
03b555e1
JH		 3960 goto unlock;
3961
2f407f0a
JH		 3962 /* Allow pairing if we're pairable, the initiators of the
3963 * pairing or if the remote is not requesting bonding.
3964 */
d7a5a11d 3965 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
2f407f0a 3966 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 3967 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 3968 struct hci_cp_io_capability_reply cp;
3969
3970 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 3971 /* Change the IO capability from KeyboardDisplay
3972 * to DisplayYesNo as it is not supported by BT spec. */
3973 cp.capability = (conn->io_capability == 0x04) ?
a767631a 3974 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 3975
3976 /* If we are initiators, there is no remote information yet */
3977 if (conn->remote_auth == 0xff) {
b16c6604 3978 /* Request MITM protection if our IO caps allow it
4ad51a75 3979 * except for the no-bonding case.
b16c6604 3980 */
6fd6b915 3981 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 3982 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 3983 conn->auth_type |= 0x01;
b7f94c88
MA		 3984 } else {
3985 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 3986 }
17fa4b9d 3987
82c295b1
JH		 3988 /* If we're not bondable, force one of the non-bondable
3989 * authentication requirement values.
3990 */
d7a5a11d 3991 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
82c295b1
JH		 3992 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3993
3994 cp.authentication = conn->auth_type;
a83ed81e 3995 cp.oob_data = bredr_oob_data_present(conn);
ce85ee13 3996
17fa4b9d 3997 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 3998 sizeof(cp), &cp);
03b555e1
JH		 3999 } else {
4000 struct hci_cp_io_capability_neg_reply cp;
4001
4002 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 4003 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 4004
03b555e1 4005 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 4006 sizeof(cp), &cp);
03b555e1
JH		 4007 }
4008
4009unlock:
4010 hci_dev_unlock(hdev);
4011}
4012
6039aa73 4013static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 4014{
4015 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4016 struct hci_conn *conn;
4017
4018 BT_DBG("%s", hdev->name);
4019
4020 hci_dev_lock(hdev);
4021
4022 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4023 if (!conn)
4024 goto unlock;
4025
03b555e1 4026 conn->remote_cap = ev->capability;
03b555e1
JH		 4027 conn->remote_auth = ev->authentication;
4028
4029unlock:
0493684e
MH		 4030 hci_dev_unlock(hdev);
4031}
4032
6039aa73
GP		 4033static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4034 struct sk_buff *skb)
a5c29683
JH		 4035{
4036 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 4037 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 4038 struct hci_conn *conn;
a5c29683
JH		 4039
4040 BT_DBG("%s", hdev->name);
4041
4042 hci_dev_lock(hdev);
4043
d7a5a11d 4044 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7a828908 4045 goto unlock;
a5c29683 4046
7a828908
JH		 4047 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4048 if (!conn)
4049 goto unlock;
4050
4051 loc_mitm = (conn->auth_type & 0x01);
4052 rem_mitm = (conn->remote_auth & 0x01);
4053
4054 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 4055 * (it has NoInputNoOutput) then reject the confirmation
4056 * request. We check the security level here since it doesn't
4057 * necessarily match conn->auth_type.
6fd6b915 4058 */
6c53823a
JH		 4059 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4060 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 4061 BT_DBG("Rejecting request: remote device can't provide MITM");
4062 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 4063 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4064 goto unlock;
4065 }
4066
4067 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 4068 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4069 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 4070
4071 /* If we're not the initiators request authorization to
4072 * proceed from user space (mgmt_user_confirm with
ba15a58b 4073 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 4074 * side had MITM or if the local IO capability is
4075 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 4076 */
4077 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 4078 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 4079 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 4080 BT_DBG("Confirming auto-accept as acceptor");
4081 confirm_hint = 1;
4082 goto confirm;
4083 }
4084
9f61656a 4085 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 4086 hdev->auto_accept_delay);
9f61656a
JH		 4087
4088 if (hdev->auto_accept_delay > 0) {
4089 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 4090 queue_delayed_work(conn->hdev->workqueue,
4091 &conn->auto_accept_work, delay);
9f61656a
JH		 4092 goto unlock;
4093 }
4094
7a828908 4095 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 4096 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4097 goto unlock;
4098 }
4099
55bc1a37 4100confirm:
39adbffe
JH		 4101 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4102 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 4103
4104unlock:
a5c29683
JH		 4105 hci_dev_unlock(hdev);
4106}
4107
6039aa73
GP		 4108static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4109 struct sk_buff *skb)
1143d458
BG		 4110{
4111 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4112
4113 BT_DBG("%s", hdev->name);
4114
d7a5a11d 4115 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 4116 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 4117}
4118
92a25256
JH		 4119static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4120 struct sk_buff *skb)
4121{
4122 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4123 struct hci_conn *conn;
4124
4125 BT_DBG("%s", hdev->name);
4126
4127 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4128 if (!conn)
4129 return;
4130
4131 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4132 conn->passkey_entered = 0;
4133
d7a5a11d 4134 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4135 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4136 conn->dst_type, conn->passkey_notify,
4137 conn->passkey_entered);
4138}
4139
4140static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4141{
4142 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4143 struct hci_conn *conn;
4144
4145 BT_DBG("%s", hdev->name);
4146
4147 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4148 if (!conn)
4149 return;
4150
4151 switch (ev->type) {
4152 case HCI_KEYPRESS_STARTED:
4153 conn->passkey_entered = 0;
4154 return;
4155
4156 case HCI_KEYPRESS_ENTERED:
4157 conn->passkey_entered++;
4158 break;
4159
4160 case HCI_KEYPRESS_ERASED:
4161 conn->passkey_entered--;
4162 break;
4163
4164 case HCI_KEYPRESS_CLEARED:
4165 conn->passkey_entered = 0;
4166 break;
4167
4168 case HCI_KEYPRESS_COMPLETED:
4169 return;
4170 }
4171
d7a5a11d 4172 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4173 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4174 conn->dst_type, conn->passkey_notify,
4175 conn->passkey_entered);
4176}
4177
6039aa73
GP		 4178static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4179 struct sk_buff *skb)
0493684e
MH		 4180{
4181 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4182 struct hci_conn *conn;
4183
4184 BT_DBG("%s", hdev->name);
4185
4186 hci_dev_lock(hdev);
4187
4188 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 4189 if (!conn)
4190 goto unlock;
4191
c1d4fa7a
JH		 4192 /* Reset the authentication requirement to unknown */
4193 conn->remote_auth = 0xff;
4194
2a611692
JH		 4195 /* To avoid duplicate auth_failed events to user space we check
4196 * the HCI_CONN_AUTH_PEND flag which will be set if we
4197 * initiated the authentication. A traditional auth_complete
4198 * event gets always produced as initiator and is also mapped to
4199 * the mgmt_auth_failed event */
fa1bd918 4200 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 4201 mgmt_auth_failed(conn, ev->status);
0493684e 4202
76a68ba0 4203 hci_conn_drop(conn);
2a611692
JH		 4204
4205unlock:
0493684e
MH		 4206 hci_dev_unlock(hdev);
4207}
4208
6039aa73
GP		 4209static void hci_remote_host_features_evt(struct hci_dev *hdev,
4210 struct sk_buff *skb)
41a96212
MH		 4211{
4212 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4213 struct inquiry_entry *ie;
cad718ed 4214 struct hci_conn *conn;
41a96212
MH		 4215
4216 BT_DBG("%s", hdev->name);
4217
4218 hci_dev_lock(hdev);
4219
cad718ed
JH		 4220 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4221 if (conn)
4222 memcpy(conn->features[1], ev->features, 8);
4223
cc11b9c1
AE		 4224 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4225 if (ie)
02b7cc62 4226 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 4227
4228 hci_dev_unlock(hdev);
4229}
4230
6039aa73
GP		 4231static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4232 struct sk_buff *skb)
2763eda6
SJ		 4233{
4234 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4235 struct oob_data *data;
4236
4237 BT_DBG("%s", hdev->name);
4238
4239 hci_dev_lock(hdev);
4240
d7a5a11d 4241 if (!hci_dev_test_flag(hdev, HCI_MGMT))
e1ba1f15
SJ		 4242 goto unlock;
4243
6928a924 4244 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
6665d057
MH		 4245 if (!data) {
4246 struct hci_cp_remote_oob_data_neg_reply cp;
519ca9d0 4247
6665d057
MH		 4248 bacpy(&cp.bdaddr, &ev->bdaddr);
4249 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4250 sizeof(cp), &cp);
4251 goto unlock;
4252 }
2763eda6 4253
6665d057
MH		 4254 if (bredr_sc_enabled(hdev)) {
4255 struct hci_cp_remote_oob_ext_data_reply cp;
519ca9d0 4256
6665d057 4257 bacpy(&cp.bdaddr, &ev->bdaddr);
d7a5a11d 4258 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6665d057
MH		 4259 memset(cp.hash192, 0, sizeof(cp.hash192));
4260 memset(cp.rand192, 0, sizeof(cp.rand192));
4261 } else {
4262 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4263 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
519ca9d0 4264 }
6665d057
MH		 4265 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4266 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4267
4268 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4269 sizeof(cp), &cp);
2763eda6 4270 } else {
6665d057 4271 struct hci_cp_remote_oob_data_reply cp;
2763eda6
SJ		 4272
4273 bacpy(&cp.bdaddr, &ev->bdaddr);
6665d057
MH		 4274 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4275 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4276
4277 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
519ca9d0 4278 sizeof(cp), &cp);
2763eda6
SJ		 4279 }
4280
e1ba1f15 4281unlock:
2763eda6
SJ		 4282 hci_dev_unlock(hdev);
4283}
4284
d5e91192
AE		 4285static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4286 struct sk_buff *skb)
4287{
4288 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4289 struct hci_conn *hcon, *bredr_hcon;
4290
4291 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4292 ev->status);
4293
4294 hci_dev_lock(hdev);
4295
4296 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4297 if (!hcon) {
4298 hci_dev_unlock(hdev);
4299 return;
4300 }
4301
4302 if (ev->status) {
4303 hci_conn_del(hcon);
4304 hci_dev_unlock(hdev);
4305 return;
4306 }
4307
4308 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4309
4310 hcon->state = BT_CONNECTED;
4311 bacpy(&hcon->dst, &bredr_hcon->dst);
4312
4313 hci_conn_hold(hcon);
4314 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4315 hci_conn_drop(hcon);
d5e91192 4316
23b9ceb7 4317 hci_debugfs_create_conn(hcon);
d5e91192
AE		 4318 hci_conn_add_sysfs(hcon);
4319
cf70ff22 4320 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4321
cf70ff22 4322 hci_dev_unlock(hdev);
d5e91192
AE		 4323}
4324
27695fb4
AE		 4325static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4326{
4327 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4328 struct hci_conn *hcon;
4329 struct hci_chan *hchan;
4330 struct amp_mgr *mgr;
4331
4332 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4333 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4334 ev->status);
4335
4336 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4337 if (!hcon)
4338 return;
4339
4340 /* Create AMP hchan */
4341 hchan = hci_chan_create(hcon);
4342 if (!hchan)
4343 return;
4344
4345 hchan->handle = le16_to_cpu(ev->handle);
4346
4347 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4348
4349 mgr = hcon->amp_mgr;
4350 if (mgr && mgr->bredr_chan) {
4351 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4352
4353 l2cap_chan_lock(bredr_chan);
4354
4355 bredr_chan->conn->mtu = hdev->block_mtu;
4356 l2cap_logical_cfm(bredr_chan, hchan, 0);
4357 hci_conn_hold(hcon);
4358
4359 l2cap_chan_unlock(bredr_chan);
4360 }
4361}
4362
606e2a10
AE		 4363static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4364 struct sk_buff *skb)
4365{
4366 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4367 struct hci_chan *hchan;
4368
4369 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4370 le16_to_cpu(ev->handle), ev->status);
4371
4372 if (ev->status)
4373 return;
4374
4375 hci_dev_lock(hdev);
4376
4377 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4378 if (!hchan)
4379 goto unlock;
4380
4381 amp_destroy_logical_link(hchan, ev->reason);
4382
4383unlock:
4384 hci_dev_unlock(hdev);
4385}
4386
9eef6b3a
AE		 4387static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4388 struct sk_buff *skb)
4389{
4390 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4391 struct hci_conn *hcon;
4392
4393 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4394
4395 if (ev->status)
4396 return;
4397
4398 hci_dev_lock(hdev);
4399
4400 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4401 if (hcon) {
4402 hcon->state = BT_CLOSED;
4403 hci_conn_del(hcon);
4404 }
4405
4406 hci_dev_unlock(hdev);
4407}
4408
6039aa73 4409static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4410{
4411 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
912b42ef 4412 struct hci_conn_params *params;
fcd89c09 4413 struct hci_conn *conn;
68d6f6de 4414 struct smp_irk *irk;
837d502e 4415 u8 addr_type;
fcd89c09 4416
9f1db00c 4417 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
fcd89c09
VT		 4418
4419 hci_dev_lock(hdev);
4420
fbd96c15
JH		 4421 /* All controllers implicitly stop advertising in the event of a
4422 * connection, so ensure that the state bit is cleared.
4423 */
a358dc11 4424 hci_dev_clear_flag(hdev, HCI_LE_ADV);
fbd96c15 4425
b47a09b3 4426 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
b62f328b 4427 if (!conn) {
a5c4e309 4428 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
b62f328b
VT		 4429 if (!conn) {
4430 BT_ERR("No memory for new connection");
230fd16a 4431 goto unlock;
b62f328b 4432 }
29b7988a
AG		 4433
4434 conn->dst_type = ev->bdaddr_type;
b9b343d2 4435
cb1d68f7
JH		 4436 /* If we didn't have a hci_conn object previously
4437 * but we're in master role this must be something
4438 * initiated using a white list. Since white list based
4439 * connections are not "first class citizens" we don't
4440 * have full tracking of them. Therefore, we go ahead
4441 * with a "best effort" approach of determining the
4442 * initiator address based on the HCI_PRIVACY flag.
4443 */
4444 if (conn->out) {
4445 conn->resp_addr_type = ev->bdaddr_type;
4446 bacpy(&conn->resp_addr, &ev->bdaddr);
d7a5a11d 4447 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
cb1d68f7
JH		 4448 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4449 bacpy(&conn->init_addr, &hdev->rpa);
4450 } else {
4451 hci_copy_identity_address(hdev,
4452 &conn->init_addr,
4453 &conn->init_addr_type);
4454 }
cb1d68f7 4455 }
9489eca4
JH		 4456 } else {
4457 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4458 }
fcd89c09 4459
80c24ab8
JH		 4460 if (!conn->out) {
4461 /* Set the responder (our side) address type based on
4462 * the advertising address type.
4463 */
4464 conn->resp_addr_type = hdev->adv_addr_type;
4465 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4466 bacpy(&conn->resp_addr, &hdev->random_addr);
4467 else
4468 bacpy(&conn->resp_addr, &hdev->bdaddr);
4469
4470 conn->init_addr_type = ev->bdaddr_type;
4471 bacpy(&conn->init_addr, &ev->bdaddr);
a720d735
MH		 4472
4473 /* For incoming connections, set the default minimum
4474 * and maximum connection interval. They will be used
4475 * to check if the parameters are in range and if not
4476 * trigger the connection update procedure.
4477 */
4478 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4479 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4480 }
7be2edbb 4481
edb4b466
MH		 4482 /* Lookup the identity address from the stored connection
4483 * address and address type.
4484 *
4485 * When establishing connections to an identity address, the
4486 * connection procedure will store the resolvable random
4487 * address first. Now if it can be converted back into the
4488 * identity address, start using the identity address from
4489 * now on.
4490 */
4491 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4492 if (irk) {
4493 bacpy(&conn->dst, &irk->bdaddr);
4494 conn->dst_type = irk->addr_type;
4495 }
4496
2d3c2260
JH		 4497 if (ev->status) {
4498 hci_le_conn_failed(conn, ev->status);
837d502e
JH		 4499 goto unlock;
4500 }
4501
08853f18
JH		 4502 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4503 addr_type = BDADDR_LE_PUBLIC;
4504 else
4505 addr_type = BDADDR_LE_RANDOM;
4506
2d3c2260
JH		 4507 /* Drop the connection if the device is blocked */
4508 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4509 hci_conn_drop(conn);
cd17decb
AG		 4510 goto unlock;
4511 }
4512
b644ba33 4513 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4514 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 4515
7b5c0d52 4516 conn->sec_level = BT_SECURITY_LOW;
fcd89c09
VT		 4517 conn->handle = __le16_to_cpu(ev->handle);
4518 conn->state = BT_CONNECTED;
4519
e04fde60
MH		 4520 conn->le_conn_interval = le16_to_cpu(ev->interval);
4521 conn->le_conn_latency = le16_to_cpu(ev->latency);
4522 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4523
23b9ceb7 4524 hci_debugfs_create_conn(conn);
fcd89c09
VT		 4525 hci_conn_add_sysfs(conn);
4526
539c496d 4527 hci_connect_cfm(conn, ev->status);
fcd89c09 4528
5477610f
JH		 4529 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4530 conn->dst_type);
f161dd41 4531 if (params) {
95305baa 4532 list_del_init(&params->action);
f161dd41
JH		 4533 if (params->conn) {
4534 hci_conn_drop(params->conn);
f8aaf9b6 4535 hci_conn_put(params->conn);
f161dd41
JH		 4536 params->conn = NULL;
4537 }
4538 }
a4790dbd 4539
fcd89c09 4540unlock:
223683a5 4541 hci_update_background_scan(hdev);
fcd89c09
VT		 4542 hci_dev_unlock(hdev);
4543}
4544
1855d92d
MH		 4545static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4546 struct sk_buff *skb)
4547{
4548 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4549 struct hci_conn *conn;
4550
4551 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4552
4553 if (ev->status)
4554 return;
4555
4556 hci_dev_lock(hdev);
4557
4558 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4559 if (conn) {
4560 conn->le_conn_interval = le16_to_cpu(ev->interval);
4561 conn->le_conn_latency = le16_to_cpu(ev->latency);
4562 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4563 }
4564
4565 hci_dev_unlock(hdev);
4566}
4567
a4790dbd 4568/* This function requires the caller holds hdev->lock */
fd45ada9
AA		 4569static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4570 bdaddr_t *addr,
4571 u8 addr_type, u8 adv_type)
a4790dbd
AG		 4572{
4573 struct hci_conn *conn;
4b9e7e75 4574 struct hci_conn_params *params;
a4790dbd 4575
1c1abcab
JH		 4576 /* If the event is not connectable don't proceed further */
4577 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4578 return NULL;
1c1abcab
JH		 4579
4580 /* Ignore if the device is blocked */
dcc36c16 4581 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
fd45ada9 4582 return NULL;
1c1abcab 4583
f99353cf
JH		 4584 /* Most controller will fail if we try to create new connections
4585 * while we have an existing one in slave role.
4586 */
4587 if (hdev->conn_hash.le_num_slave > 0)
fd45ada9 4588 return NULL;
f99353cf 4589
1c1abcab
JH		 4590 /* If we're not connectable only connect devices that we have in
4591 * our pend_le_conns list.
4592 */
4b9e7e75
MH		 4593 params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4594 addr, addr_type);
4595 if (!params)
fd45ada9 4596 return NULL;
4b9e7e75
MH		 4597
4598 switch (params->auto_connect) {
4599 case HCI_AUTO_CONN_DIRECT:
4600 /* Only devices advertising with ADV_DIRECT_IND are
4601 * triggering a connection attempt. This is allowing
4602 * incoming connections from slave devices.
4603 */
4604 if (adv_type != LE_ADV_DIRECT_IND)
fd45ada9 4605 return NULL;
4b9e7e75
MH		 4606 break;
4607 case HCI_AUTO_CONN_ALWAYS:
4608 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4609 * are triggering a connection attempt. This means
4610 * that incoming connectioms from slave device are
4611 * accepted and also outgoing connections to slave
4612 * devices are established when found.
4613 */
4614 break;
4615 default:
fd45ada9 4616 return NULL;
4b9e7e75 4617 }
a4790dbd
AG		 4618
4619 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
e804d25d 4620 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
f161dd41
JH		 4621 if (!IS_ERR(conn)) {
4622 /* Store the pointer since we don't really have any
4623 * other owner of the object besides the params that
4624 * triggered it. This way we can abort the connection if
4625 * the parameters get removed and keep the reference
4626 * count consistent once the connection is established.
4627 */
f8aaf9b6 4628 params->conn = hci_conn_get(conn);
fd45ada9 4629 return conn;
f161dd41 4630 }
a4790dbd
AG		 4631
4632 switch (PTR_ERR(conn)) {
4633 case -EBUSY:
4634 /* If hci_connect() returns -EBUSY it means there is already
4635 * an LE connection attempt going on. Since controllers don't
4636 * support more than one connection attempt at the time, we
4637 * don't consider this an error case.
4638 */
4639 break;
4640 default:
4641 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
fd45ada9 4642 return NULL;
a4790dbd 4643 }
fd45ada9
AA		 4644
4645 return NULL;
a4790dbd
AG		 4646}
4647
4af605d8 4648static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
2f010b55
MH		 4649 u8 bdaddr_type, bdaddr_t *direct_addr,
4650 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4af605d8 4651{
b9a6328f 4652 struct discovery_state *d = &hdev->discovery;
1c1abcab 4653 struct smp_irk *irk;
fd45ada9 4654 struct hci_conn *conn;
474ee066 4655 bool match;
c70a7e4c 4656 u32 flags;
b9a6328f 4657
2f010b55
MH		 4658 /* If the direct address is present, then this report is from
4659 * a LE Direct Advertising Report event. In that case it is
4660 * important to see if the address is matching the local
4661 * controller address.
4662 */
4663 if (direct_addr) {
4664 /* Only resolvable random addresses are valid for these
4665 * kind of reports and others can be ignored.
4666 */
4667 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4668 return;
4669
4670 /* If the controller is not using resolvable random
4671 * addresses, then this report can be ignored.
4672 */
d7a5a11d 4673 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2f010b55
MH		 4674 return;
4675
4676 /* If the local IRK of the controller does not match
4677 * with the resolvable random address provided, then
4678 * this report can be ignored.
4679 */
4680 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4681 return;
4682 }
4683
1c1abcab
JH		 4684 /* Check if we need to convert to identity address */
4685 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4686 if (irk) {
4687 bdaddr = &irk->bdaddr;
4688 bdaddr_type = irk->addr_type;
4689 }
4690
4691 /* Check if we have been requested to connect to this device */
fd45ada9
AA		 4692 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4693 if (conn && type == LE_ADV_IND) {
4694 /* Store report for later inclusion by
4695 * mgmt_device_connected
4696 */
4697 memcpy(conn->le_adv_data, data, len);
4698 conn->le_adv_data_len = len;
4699 }
1c1abcab 4700
0d2bf134
JH		 4701 /* Passive scanning shouldn't trigger any device found events,
4702 * except for devices marked as CONN_REPORT for which we do send
4703 * device found events.
4704 */
ca5c4be7 4705 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 4706 if (type == LE_ADV_DIRECT_IND)
4707 return;
4708
3a19b6fe
JH		 4709 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4710 bdaddr, bdaddr_type))
0d2bf134
JH		 4711 return;
4712
4713 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4714 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4715 else
4716 flags = 0;
4717 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4718 rssi, flags, data, len, NULL, 0);
97bf2e99 4719 return;
ca5c4be7 4720 }
4af605d8 4721
c70a7e4c
MH		 4722 /* When receiving non-connectable or scannable undirected
4723 * advertising reports, this means that the remote device is
4724 * not connectable and then clearly indicate this in the
4725 * device found event.
4726 *
4727 * When receiving a scan response, then there is no way to
4728 * know if the remote device is connectable or not. However
4729 * since scan responses are merged with a previously seen
4730 * advertising report, the flags field from that report
4731 * will be used.
4732 *
4733 * In the really unlikely case that a controller get confused
4734 * and just sends a scan response event, then it is marked as
4735 * not connectable as well.
4736 */
4737 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4738 type == LE_ADV_SCAN_RSP)
4739 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4740 else
4741 flags = 0;
4742
b9a6328f
JH		 4743 /* If there's nothing pending either store the data from this
4744 * event or send an immediate device found event if the data
4745 * should not be stored for later.
4746 */
4747 if (!has_pending_adv_report(hdev)) {
4748 /* If the report will trigger a SCAN_REQ store it for
4749 * later merging.
4750 */
4751 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4752 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4753 rssi, flags, data, len);
b9a6328f
JH		 4754 return;
4755 }
4756
4757 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4758 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4759 return;
4760 }
4761
474ee066
JH		 4762 /* Check if the pending report is for the same device as the new one */
4763 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4764 bdaddr_type == d->last_adv_addr_type);
4765
b9a6328f
JH		 4766 /* If the pending data doesn't match this report or this isn't a
4767 * scan response (e.g. we got a duplicate ADV_IND) then force
4768 * sending of the pending data.
4769 */
474ee066
JH		 4770 if (type != LE_ADV_SCAN_RSP || !match) {
4771 /* Send out whatever is in the cache, but skip duplicates */
4772 if (!match)
4773 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 4774 d->last_adv_addr_type, NULL,
c70a7e4c 4775 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 4776 d->last_adv_data,
474ee066 4777 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 4778
4779 /* If the new report will trigger a SCAN_REQ store it for
4780 * later merging.
4781 */
4782 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4783 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4784 rssi, flags, data, len);
b9a6328f
JH		 4785 return;
4786 }
4787
4788 /* The advertising reports cannot be merged, so clear
4789 * the pending report and send out a device found event.
4790 */
4791 clear_pending_adv_report(hdev);
5c5b93e4 4792 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4793 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4794 return;
4795 }
4796
4797 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4798 * the new event is a SCAN_RSP. We can therefore proceed with
4799 * sending a merged device found event.
4800 */
4801 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 4802 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 4803 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 4804 clear_pending_adv_report(hdev);
4af605d8
JH		 4805}
4806
6039aa73 4807static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 4808{
e95beb41
AG		 4809 u8 num_reports = skb->data[0];
4810 void *ptr = &skb->data[1];
9aa04c91 4811
a4790dbd
AG		 4812 hci_dev_lock(hdev);
4813
e95beb41
AG		 4814 while (num_reports--) {
4815 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 4816 s8 rssi;
a4790dbd 4817
3c9e9195 4818 rssi = ev->data[ev->length];
4af605d8 4819 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
2f010b55
MH		 4820 ev->bdaddr_type, NULL, 0, rssi,
4821 ev->data, ev->length);
3c9e9195 4822
e95beb41 4823 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 4824 }
a4790dbd
AG		 4825
4826 hci_dev_unlock(hdev);
9aa04c91
AG		 4827}
4828
6039aa73 4829static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 4830{
4831 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4832 struct hci_cp_le_ltk_reply cp;
bea710fe 4833 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 4834 struct hci_conn *conn;
c9839a11 4835 struct smp_ltk *ltk;
a7a595f6 4836
9f1db00c 4837 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 4838
4839 hci_dev_lock(hdev);
4840
4841 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 4842 if (conn == NULL)
4843 goto not_found;
a7a595f6 4844
f3a73d97 4845 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5378bc56 4846 if (!ltk)
bea710fe
VCG		 4847 goto not_found;
4848
5378bc56
JH		 4849 if (smp_ltk_is_sc(ltk)) {
4850 /* With SC both EDiv and Rand are set to zero */
4851 if (ev->ediv || ev->rand)
4852 goto not_found;
4853 } else {
4854 /* For non-SC keys check that EDiv and Rand match */
4855 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4856 goto not_found;
4857 }
4858
bea710fe 4859 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
a7a595f6 4860 cp.handle = cpu_to_le16(conn->handle);
c9839a11 4861
a6f7833c 4862 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 4863
89cbb4da 4864 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 4865
4866 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4867
5981a882
CT		 4868 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4869 * temporary key used to encrypt a connection following
4870 * pairing. It is used during the Encrypted Session Setup to
4871 * distribute the keys. Later, security can be re-established
4872 * using a distributed LTK.
4873 */
2ceba539 4874 if (ltk->type == SMP_STK) {
fe59a05f 4875 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
970d0f1b
JH		 4876 list_del_rcu(&ltk->list);
4877 kfree_rcu(ltk, rcu);
fe59a05f
JH		 4878 } else {
4879 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 4880 }
4881
a7a595f6 4882 hci_dev_unlock(hdev);
bea710fe
VCG		 4883
4884 return;
4885
4886not_found:
4887 neg.handle = ev->handle;
4888 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4889 hci_dev_unlock(hdev);
a7a595f6
VCG		 4890}
4891
8e75b46a
AG		 4892static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4893 u8 reason)
4894{
4895 struct hci_cp_le_conn_param_req_neg_reply cp;
4896
4897 cp.handle = cpu_to_le16(handle);
4898 cp.reason = reason;
4899
4900 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4901 &cp);
4902}
4903
4904static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4905 struct sk_buff *skb)
4906{
4907 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4908 struct hci_cp_le_conn_param_req_reply cp;
4909 struct hci_conn *hcon;
4910 u16 handle, min, max, latency, timeout;
4911
4912 handle = le16_to_cpu(ev->handle);
4913 min = le16_to_cpu(ev->interval_min);
4914 max = le16_to_cpu(ev->interval_max);
4915 latency = le16_to_cpu(ev->latency);
4916 timeout = le16_to_cpu(ev->timeout);
4917
4918 hcon = hci_conn_hash_lookup_handle(hdev, handle);
4919 if (!hcon || hcon->state != BT_CONNECTED)
4920 return send_conn_param_neg_reply(hdev, handle,
4921 HCI_ERROR_UNKNOWN_CONN_ID);
4922
4923 if (hci_check_conn_params(min, max, latency, timeout))
4924 return send_conn_param_neg_reply(hdev, handle,
4925 HCI_ERROR_INVALID_LL_PARAMS);
4926
40bef302 4927 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 4928 struct hci_conn_params *params;
f4869e2a 4929 u8 store_hint;
348d50b8
JH		 4930
4931 hci_dev_lock(hdev);
4932
4933 params = hci_conn_params_lookup(hdev, &hcon->dst,
4934 hcon->dst_type);
4935 if (params) {
4936 params->conn_min_interval = min;
4937 params->conn_max_interval = max;
4938 params->conn_latency = latency;
4939 params->supervision_timeout = timeout;
f4869e2a
JH		 4940 store_hint = 0x01;
4941 } else{
4942 store_hint = 0x00;
348d50b8
JH		 4943 }
4944
4945 hci_dev_unlock(hdev);
4946
f4869e2a
JH		 4947 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4948 store_hint, min, max, latency, timeout);
348d50b8 4949 }
ffb5a827 4950
8e75b46a
AG		 4951 cp.handle = ev->handle;
4952 cp.interval_min = ev->interval_min;
4953 cp.interval_max = ev->interval_max;
4954 cp.latency = ev->latency;
4955 cp.timeout = ev->timeout;
4956 cp.min_ce_len = 0;
4957 cp.max_ce_len = 0;
4958
4959 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4960}
4961
2f010b55
MH		 4962static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
4963 struct sk_buff *skb)
4964{
4965 u8 num_reports = skb->data[0];
4966 void *ptr = &skb->data[1];
4967
4968 hci_dev_lock(hdev);
4969
4970 while (num_reports--) {
4971 struct hci_ev_le_direct_adv_info *ev = ptr;
4972
4973 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4974 ev->bdaddr_type, &ev->direct_addr,
4975 ev->direct_addr_type, ev->rssi, NULL, 0);
4976
4977 ptr += sizeof(*ev);
4978 }
4979
4980 hci_dev_unlock(hdev);
4981}
4982
6039aa73 4983static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4984{
4985 struct hci_ev_le_meta *le_ev = (void *) skb->data;
4986
4987 skb_pull(skb, sizeof(*le_ev));
4988
4989 switch (le_ev->subevent) {
4990 case HCI_EV_LE_CONN_COMPLETE:
4991 hci_le_conn_complete_evt(hdev, skb);
4992 break;
4993
1855d92d
MH		 4994 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4995 hci_le_conn_update_complete_evt(hdev, skb);
4996 break;
4997
9aa04c91
AG		 4998 case HCI_EV_LE_ADVERTISING_REPORT:
4999 hci_le_adv_report_evt(hdev, skb);
5000 break;
5001
a7a595f6
VCG		 5002 case HCI_EV_LE_LTK_REQ:
5003 hci_le_ltk_request_evt(hdev, skb);
5004 break;
5005
8e75b46a
AG		 5006 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5007 hci_le_remote_conn_param_req_evt(hdev, skb);
5008 break;
5009
2f010b55
MH		 5010 case HCI_EV_LE_DIRECT_ADV_REPORT:
5011 hci_le_direct_adv_report_evt(hdev, skb);
5012 break;
5013
fcd89c09
VT		 5014 default:
5015 break;
5016 }
5017}
5018
9495b2ee
AE		 5019static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5020{
5021 struct hci_ev_channel_selected *ev = (void *) skb->data;
5022 struct hci_conn *hcon;
5023
5024 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5025
5026 skb_pull(skb, sizeof(*ev));
5027
5028 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5029 if (!hcon)
5030 return;
5031
5032 amp_read_loc_assoc_final_data(hdev, hcon);
5033}
5034
757aa0b5
JH		 5035static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5036 u8 event, struct sk_buff *skb)
5037{
5038 struct hci_ev_cmd_complete *ev;
5039 struct hci_event_hdr *hdr;
5040
5041 if (!skb)
5042 return false;
5043
5044 if (skb->len < sizeof(*hdr)) {
5045 BT_ERR("Too short HCI event");
5046 return false;
5047 }
5048
5049 hdr = (void *) skb->data;
5050 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5051
5052 if (event) {
5053 if (hdr->evt != event)
5054 return false;
5055 return true;
5056 }
5057
5058 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5059 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5060 return false;
5061 }
5062
5063 if (skb->len < sizeof(*ev)) {
5064 BT_ERR("Too short cmd_complete event");
5065 return false;
5066 }
5067
5068 ev = (void *) skb->data;
5069 skb_pull(skb, sizeof(*ev));
5070
5071 if (opcode != __le16_to_cpu(ev->opcode)) {
5072 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5073 __le16_to_cpu(ev->opcode));
5074 return false;
5075 }
5076
5077 return true;
5078}
5079
a9de9248
MH		 5080void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5081{
5082 struct hci_event_hdr *hdr = (void *) skb->data;
e6214487
JH		 5083 hci_req_complete_t req_complete = NULL;
5084 hci_req_complete_skb_t req_complete_skb = NULL;
5085 struct sk_buff *orig_skb = NULL;
757aa0b5 5086 u8 status = 0, event = hdr->evt, req_evt = 0;
e6214487 5087 u16 opcode = HCI_OP_NOP;
a9de9248 5088
db6e3e8d 5089 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
c1f23a2b 5090 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
e6214487
JH		 5091 opcode = __le16_to_cpu(cmd_hdr->opcode);
5092 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5093 &req_complete_skb);
757aa0b5 5094 req_evt = event;
02350a72
JH		 5095 }
5096
e6214487
JH		 5097 /* If it looks like we might end up having to call
5098 * req_complete_skb, store a pristine copy of the skb since the
5099 * various handlers may modify the original one through
5100 * skb_pull() calls, etc.
5101 */
5102 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5103 event == HCI_EV_CMD_COMPLETE)
5104 orig_skb = skb_clone(skb, GFP_KERNEL);
5105
5106 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5107
a9de9248 5108 switch (event) {
1da177e4
LT		 5109 case HCI_EV_INQUIRY_COMPLETE:
5110 hci_inquiry_complete_evt(hdev, skb);
5111 break;
5112
5113 case HCI_EV_INQUIRY_RESULT:
5114 hci_inquiry_result_evt(hdev, skb);
5115 break;
5116
a9de9248
MH		 5117 case HCI_EV_CONN_COMPLETE:
5118 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 5119 break;
5120
1da177e4
LT		 5121 case HCI_EV_CONN_REQUEST:
5122 hci_conn_request_evt(hdev, skb);
5123 break;
5124
1da177e4
LT		 5125 case HCI_EV_DISCONN_COMPLETE:
5126 hci_disconn_complete_evt(hdev, skb);
5127 break;
5128
1da177e4
LT		 5129 case HCI_EV_AUTH_COMPLETE:
5130 hci_auth_complete_evt(hdev, skb);
5131 break;
5132
a9de9248
MH		 5133 case HCI_EV_REMOTE_NAME:
5134 hci_remote_name_evt(hdev, skb);
5135 break;
5136
1da177e4
LT		 5137 case HCI_EV_ENCRYPT_CHANGE:
5138 hci_encrypt_change_evt(hdev, skb);
5139 break;
5140
a9de9248
MH		 5141 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5142 hci_change_link_key_complete_evt(hdev, skb);
5143 break;
5144
5145 case HCI_EV_REMOTE_FEATURES:
5146 hci_remote_features_evt(hdev, skb);
5147 break;
5148
a9de9248 5149 case HCI_EV_CMD_COMPLETE:
e6214487
JH		 5150 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5151 &req_complete, &req_complete_skb);
a9de9248
MH		 5152 break;
5153
5154 case HCI_EV_CMD_STATUS:
e6214487
JH		 5155 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5156 &req_complete_skb);
a9de9248
MH		 5157 break;
5158
24dfa343
MH		 5159 case HCI_EV_HARDWARE_ERROR:
5160 hci_hardware_error_evt(hdev, skb);
5161 break;
5162
a9de9248
MH		 5163 case HCI_EV_ROLE_CHANGE:
5164 hci_role_change_evt(hdev, skb);
5165 break;
5166
5167 case HCI_EV_NUM_COMP_PKTS:
5168 hci_num_comp_pkts_evt(hdev, skb);
5169 break;
5170
5171 case HCI_EV_MODE_CHANGE:
5172 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 5173 break;
5174
5175 case HCI_EV_PIN_CODE_REQ:
5176 hci_pin_code_request_evt(hdev, skb);
5177 break;
5178
5179 case HCI_EV_LINK_KEY_REQ:
5180 hci_link_key_request_evt(hdev, skb);
5181 break;
5182
5183 case HCI_EV_LINK_KEY_NOTIFY:
5184 hci_link_key_notify_evt(hdev, skb);
5185 break;
5186
5187 case HCI_EV_CLOCK_OFFSET:
5188 hci_clock_offset_evt(hdev, skb);
5189 break;
5190
a8746417
MH		 5191 case HCI_EV_PKT_TYPE_CHANGE:
5192 hci_pkt_type_change_evt(hdev, skb);
5193 break;
5194
85a1e930
MH		 5195 case HCI_EV_PSCAN_REP_MODE:
5196 hci_pscan_rep_mode_evt(hdev, skb);
5197 break;
5198
a9de9248
MH		 5199 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5200 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 5201 break;
5202
a9de9248
MH		 5203 case HCI_EV_REMOTE_EXT_FEATURES:
5204 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 5205 break;
5206
a9de9248
MH		 5207 case HCI_EV_SYNC_CONN_COMPLETE:
5208 hci_sync_conn_complete_evt(hdev, skb);
5209 break;
1da177e4 5210
a9de9248
MH		 5211 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5212 hci_extended_inquiry_result_evt(hdev, skb);
5213 break;
1da177e4 5214
1c2e0041
JH		 5215 case HCI_EV_KEY_REFRESH_COMPLETE:
5216 hci_key_refresh_complete_evt(hdev, skb);
5217 break;
5218
0493684e
MH		 5219 case HCI_EV_IO_CAPA_REQUEST:
5220 hci_io_capa_request_evt(hdev, skb);
5221 break;
5222
03b555e1
JH		 5223 case HCI_EV_IO_CAPA_REPLY:
5224 hci_io_capa_reply_evt(hdev, skb);
5225 break;
5226
a5c29683
JH		 5227 case HCI_EV_USER_CONFIRM_REQUEST:
5228 hci_user_confirm_request_evt(hdev, skb);
5229 break;
5230
1143d458
BG		 5231 case HCI_EV_USER_PASSKEY_REQUEST:
5232 hci_user_passkey_request_evt(hdev, skb);
5233 break;
5234
92a25256
JH		 5235 case HCI_EV_USER_PASSKEY_NOTIFY:
5236 hci_user_passkey_notify_evt(hdev, skb);
5237 break;
5238
5239 case HCI_EV_KEYPRESS_NOTIFY:
5240 hci_keypress_notify_evt(hdev, skb);
5241 break;
5242
0493684e
MH		 5243 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5244 hci_simple_pair_complete_evt(hdev, skb);
5245 break;
5246
41a96212
MH		 5247 case HCI_EV_REMOTE_HOST_FEATURES:
5248 hci_remote_host_features_evt(hdev, skb);
5249 break;
5250
fcd89c09
VT		 5251 case HCI_EV_LE_META:
5252 hci_le_meta_evt(hdev, skb);
5253 break;
5254
9495b2ee
AE		 5255 case HCI_EV_CHANNEL_SELECTED:
5256 hci_chan_selected_evt(hdev, skb);
5257 break;
5258
2763eda6
SJ		 5259 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5260 hci_remote_oob_data_request_evt(hdev, skb);
5261 break;
5262
d5e91192
AE		 5263 case HCI_EV_PHY_LINK_COMPLETE:
5264 hci_phy_link_complete_evt(hdev, skb);
5265 break;
5266
27695fb4
AE		 5267 case HCI_EV_LOGICAL_LINK_COMPLETE:
5268 hci_loglink_complete_evt(hdev, skb);
5269 break;
5270
606e2a10
AE		 5271 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5272 hci_disconn_loglink_complete_evt(hdev, skb);
5273 break;
5274
9eef6b3a
AE		 5275 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5276 hci_disconn_phylink_complete_evt(hdev, skb);
5277 break;
5278
25e89e99
AE		 5279 case HCI_EV_NUM_COMP_BLOCKS:
5280 hci_num_comp_blocks_evt(hdev, skb);
5281 break;
5282
a9de9248 5283 default:
9f1db00c 5284 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 5285 break;
5286 }
5287
757aa0b5 5288 if (req_complete) {
e6214487 5289 req_complete(hdev, status, opcode);
757aa0b5
JH		 5290 } else if (req_complete_skb) {
5291 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5292 kfree_skb(orig_skb);
5293 orig_skb = NULL;
5294 }
e6214487 5295 req_complete_skb(hdev, status, opcode, orig_skb);
757aa0b5 5296 }
e6214487
JH		 5297
5298 kfree_skb(orig_skb);
1da177e4
LT		 5299 kfree_skb(skb);
5300 hdev->stat.evt_rx++;
5301}
ubuntu-zesty-kernel mirror