]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/hci_event.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Refactor arguments of mgmt_device_connected
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
7024728e 33#include "a2mp.h"
7ef9fbf0 34#include "amp.h"
2ceba539 35#include "smp.h"
1da177e4 36
1da177e4
LT		 37/* Handle HCI Event packets */
38
a9de9248 39static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 40{
a9de9248 41 __u8 status = *((__u8 *) skb->data);
1da177e4 42
9f1db00c 43 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 44
82f4785c 45 if (status)
a9de9248 46 return;
1da177e4 47
89352e7d 48 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 49 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 50 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 51
50143a43
JH		 52 hci_dev_lock(hdev);
53 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
54 hci_dev_unlock(hdev);
55
a9de9248
MH		 56 hci_conn_check_pending(hdev);
57}
6bd57416 58
4d93483b
AG		 59static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
60{
61 __u8 status = *((__u8 *) skb->data);
62
9f1db00c 63 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 64
65 if (status)
66 return;
67
68 set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
4d93483b
AG		 69}
70
a9de9248
MH		 71static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
72{
73 __u8 status = *((__u8 *) skb->data);
6bd57416 74
9f1db00c 75 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 76
a9de9248
MH		 77 if (status)
78 return;
1da177e4 79
ae854a70
AG		 80 clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
81
a9de9248
MH		 82 hci_conn_check_pending(hdev);
83}
84
807deac2
GP		 85static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
86 struct sk_buff *skb)
a9de9248
MH		 87{
88 BT_DBG("%s", hdev->name);
89}
90
91static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
92{
93 struct hci_rp_role_discovery *rp = (void *) skb->data;
94 struct hci_conn *conn;
95
9f1db00c 96 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 97
98 if (rp->status)
99 return;
100
101 hci_dev_lock(hdev);
102
103 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 104 if (conn)
105 conn->role = rp->role;
a9de9248
MH		 106
107 hci_dev_unlock(hdev);
1da177e4
LT		 108}
109
e4e8e37c
MH		 110static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
111{
112 struct hci_rp_read_link_policy *rp = (void *) skb->data;
113 struct hci_conn *conn;
114
9f1db00c 115 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 116
117 if (rp->status)
118 return;
119
120 hci_dev_lock(hdev);
121
122 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
123 if (conn)
124 conn->link_policy = __le16_to_cpu(rp->policy);
125
126 hci_dev_unlock(hdev);
127}
128
a9de9248 129static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 130{
a9de9248 131 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 132 struct hci_conn *conn;
04837f64 133 void *sent;
1da177e4 134
9f1db00c 135 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 136
a9de9248
MH		 137 if (rp->status)
138 return;
1da177e4 139
a9de9248
MH		 140 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
141 if (!sent)
142 return;
1da177e4 143
a9de9248 144 hci_dev_lock(hdev);
1da177e4 145
a9de9248 146 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 147 if (conn)
83985319 148 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 149
a9de9248
MH		 150 hci_dev_unlock(hdev);
151}
1da177e4 152
807deac2
GP		 153static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
154 struct sk_buff *skb)
e4e8e37c
MH		 155{
156 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
157
9f1db00c 158 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 159
160 if (rp->status)
161 return;
162
163 hdev->link_policy = __le16_to_cpu(rp->policy);
164}
165
807deac2
GP		 166static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
167 struct sk_buff *skb)
e4e8e37c
MH		 168{
169 __u8 status = *((__u8 *) skb->data);
170 void *sent;
171
9f1db00c 172 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 173
45296acd
MH		 174 if (status)
175 return;
176
e4e8e37c
MH		 177 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
178 if (!sent)
179 return;
180
45296acd 181 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 182}
183
a9de9248
MH		 184static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
185{
186 __u8 status = *((__u8 *) skb->data);
04837f64 187
9f1db00c 188 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 189
10572132
GP		 190 clear_bit(HCI_RESET, &hdev->flags);
191
a297e97c 192 /* Reset all non-persistent flags */
2cc6fb00 193 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
69775ff6
AG		 194
195 hdev->discovery.state = DISCOVERY_STOPPED;
bbaf444a
JH		 196 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
197 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 198
199 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
200 hdev->adv_data_len = 0;
f8e808bd
MH		 201
202 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
203 hdev->scan_rsp_data_len = 0;
06f5b778 204
533553f8
MH		 205 hdev->le_scan_type = LE_SCAN_PASSIVE;
206
06f5b778 207 hdev->ssp_debug_mode = 0;
a9de9248 208}
04837f64 209
a9de9248
MH		 210static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
211{
212 __u8 status = *((__u8 *) skb->data);
213 void *sent;
04837f64 214
9f1db00c 215 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 216
a9de9248
MH		 217 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
218 if (!sent)
219 return;
04837f64 220
56e5cb86
JH		 221 hci_dev_lock(hdev);
222
f51d5b24
JH		 223 if (test_bit(HCI_MGMT, &hdev->dev_flags))
224 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 225 else if (!status)
226 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 227
56e5cb86 228 hci_dev_unlock(hdev);
a9de9248
MH		 229}
230
231static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
232{
233 struct hci_rp_read_local_name *rp = (void *) skb->data;
234
9f1db00c 235 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 236
237 if (rp->status)
238 return;
239
db99b5fc
JH		 240 if (test_bit(HCI_SETUP, &hdev->dev_flags))
241 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 242}
243
244static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
245{
246 __u8 status = *((__u8 *) skb->data);
247 void *sent;
248
9f1db00c 249 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 250
251 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
252 if (!sent)
253 return;
254
255 if (!status) {
256 __u8 param = *((__u8 *) sent);
257
258 if (param == AUTH_ENABLED)
259 set_bit(HCI_AUTH, &hdev->flags);
260 else
261 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 262 }
a9de9248 263
33ef95ed
JH		 264 if (test_bit(HCI_MGMT, &hdev->dev_flags))
265 mgmt_auth_enable_complete(hdev, status);
1da177e4
LT		 266}
267
a9de9248 268static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 269{
a9de9248 270 __u8 status = *((__u8 *) skb->data);
45296acd 271 __u8 param;
1da177e4
LT		 272 void *sent;
273
9f1db00c 274 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 275
45296acd
MH		 276 if (status)
277 return;
278
a9de9248
MH		 279 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
280 if (!sent)
281 return;
1da177e4 282
45296acd 283 param = *((__u8 *) sent);
a9de9248 284
45296acd
MH		 285 if (param)
286 set_bit(HCI_ENCRYPT, &hdev->flags);
287 else
288 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 289}
1da177e4 290
a9de9248
MH		 291static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
292{
45296acd
MH		 293 __u8 status = *((__u8 *) skb->data);
294 __u8 param;
a9de9248 295 void *sent;
1da177e4 296
9f1db00c 297 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 298
a9de9248
MH		 299 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
300 if (!sent)
301 return;
1da177e4 302
36f7fc7e
JH		 303 param = *((__u8 *) sent);
304
56e5cb86
JH		 305 hci_dev_lock(hdev);
306
fa1bd918 307 if (status) {
2d7cee58
JH		 308 hdev->discov_timeout = 0;
309 goto done;
310 }
311
bc6d2d04 312 if (param & SCAN_INQUIRY)
36f7fc7e 313 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 314 else
315 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 316
031547d8 317 if (param & SCAN_PAGE)
36f7fc7e 318 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 319 else
204e3990 320 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 321
36f7fc7e 322done:
56e5cb86 323 hci_dev_unlock(hdev);
a9de9248 324}
1da177e4 325
a9de9248
MH		 326static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
327{
328 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 329
9f1db00c 330 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 331
a9de9248
MH		 332 if (rp->status)
333 return;
1da177e4 334
a9de9248 335 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 336
a9de9248 337 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 338 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 339}
1da177e4 340
a9de9248
MH		 341static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
342{
343 __u8 status = *((__u8 *) skb->data);
344 void *sent;
1da177e4 345
9f1db00c 346 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 347
a9de9248
MH		 348 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
349 if (!sent)
350 return;
1da177e4 351
7f9a903c
MH		 352 hci_dev_lock(hdev);
353
354 if (status == 0)
355 memcpy(hdev->dev_class, sent, 3);
356
357 if (test_bit(HCI_MGMT, &hdev->dev_flags))
358 mgmt_set_class_of_dev_complete(hdev, sent, status);
359
360 hci_dev_unlock(hdev);
a9de9248 361}
1da177e4 362
a9de9248
MH		 363static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
364{
365 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
366 __u16 setting;
367
9f1db00c 368 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 369
370 if (rp->status)
371 return;
372
373 setting = __le16_to_cpu(rp->voice_setting);
374
f383f275 375 if (hdev->voice_setting == setting)
a9de9248
MH		 376 return;
377
378 hdev->voice_setting = setting;
379
9f1db00c 380 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 381
3c54711c 382 if (hdev->notify)
a9de9248 383 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 384}
385
8fc9ced3
GP		 386static void hci_cc_write_voice_setting(struct hci_dev *hdev,
387 struct sk_buff *skb)
a9de9248
MH		 388{
389 __u8 status = *((__u8 *) skb->data);
f383f275 390 __u16 setting;
a9de9248
MH		 391 void *sent;
392
9f1db00c 393 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 394
f383f275
MH		 395 if (status)
396 return;
397
a9de9248
MH		 398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
399 if (!sent)
400 return;
1da177e4 401
f383f275 402 setting = get_unaligned_le16(sent);
1da177e4 403
f383f275
MH		 404 if (hdev->voice_setting == setting)
405 return;
406
407 hdev->voice_setting = setting;
1da177e4 408
9f1db00c 409 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 410
3c54711c 411 if (hdev->notify)
f383f275 412 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 413}
414
b4cb9fb2
MH		 415static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
416 struct sk_buff *skb)
417{
418 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
419
420 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
421
422 if (rp->status)
423 return;
424
425 hdev->num_iac = rp->num_iac;
426
427 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
428}
429
333140b5
MH		 430static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
431{
432 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 433 struct hci_cp_write_ssp_mode *sent;
333140b5 434
9f1db00c 435 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 436
333140b5
MH		 437 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
438 if (!sent)
439 return;
440
5ed8eb2f
JH		 441 if (!status) {
442 if (sent->mode)
cad718ed 443 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 444 else
cad718ed 445 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 446 }
447
ed2c4ee3 448 if (test_bit(HCI_MGMT, &hdev->dev_flags))
5ed8eb2f 449 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 450 else if (!status) {
5ed8eb2f 451 if (sent->mode)
c0ecddc2
JH		 452 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
453 else
454 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
455 }
333140b5
MH		 456}
457
eac83dc6
MH		 458static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
459{
460 u8 status = *((u8 *) skb->data);
461 struct hci_cp_write_sc_support *sent;
462
463 BT_DBG("%s status 0x%2.2x", hdev->name, status);
464
465 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
466 if (!sent)
467 return;
468
469 if (!status) {
470 if (sent->support)
471 hdev->features[1][0] |= LMP_HOST_SC;
472 else
473 hdev->features[1][0] &= ~LMP_HOST_SC;
474 }
475
476 if (test_bit(HCI_MGMT, &hdev->dev_flags))
477 mgmt_sc_enable_complete(hdev, sent->support, status);
478 else if (!status) {
479 if (sent->support)
480 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
481 else
482 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
483 }
484}
485
a9de9248
MH		 486static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
487{
488 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 489
9f1db00c 490 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 491
a9de9248 492 if (rp->status)
42c6b129 493 return;
1143e5a6 494
0d5551f5
MH		 495 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
496 hdev->hci_ver = rp->hci_ver;
497 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
498 hdev->lmp_ver = rp->lmp_ver;
499 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
500 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
501 }
d5859e22
JH		 502}
503
8fc9ced3
GP		 504static void hci_cc_read_local_commands(struct hci_dev *hdev,
505 struct sk_buff *skb)
a9de9248
MH		 506{
507 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 508
9f1db00c 509 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 510
6a070e6e
MH		 511 if (rp->status)
512 return;
513
514 if (test_bit(HCI_SETUP, &hdev->dev_flags))
2177bab5 515 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 516}
1da177e4 517
8fc9ced3
GP		 518static void hci_cc_read_local_features(struct hci_dev *hdev,
519 struct sk_buff *skb)
a9de9248
MH		 520{
521 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 522
9f1db00c 523 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 524
a9de9248
MH		 525 if (rp->status)
526 return;
5b7f9909 527
a9de9248 528 memcpy(hdev->features, rp->features, 8);
5b7f9909 529
a9de9248
MH		 530 /* Adjust default settings according to features
531 * supported by device. */
1da177e4 532
cad718ed 533 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 534 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 535
cad718ed 536 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 537 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 538
cad718ed 539 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 540 hdev->pkt_type |= (HCI_HV2);
541 hdev->esco_type |= (ESCO_HV2);
542 }
1da177e4 543
cad718ed 544 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 545 hdev->pkt_type |= (HCI_HV3);
546 hdev->esco_type |= (ESCO_HV3);
547 }
1da177e4 548
45db810f 549 if (lmp_esco_capable(hdev))
a9de9248 550 hdev->esco_type |= (ESCO_EV3);
da1f5198 551
cad718ed 552 if (hdev->features[0][4] & LMP_EV4)
a9de9248 553 hdev->esco_type |= (ESCO_EV4);
da1f5198 554
cad718ed 555 if (hdev->features[0][4] & LMP_EV5)
a9de9248 556 hdev->esco_type |= (ESCO_EV5);
1da177e4 557
cad718ed 558 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 559 hdev->esco_type |= (ESCO_2EV3);
560
cad718ed 561 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 562 hdev->esco_type |= (ESCO_3EV3);
563
cad718ed 564 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 565 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 566}
1da177e4 567
971e3a4b 568static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 569 struct sk_buff *skb)
971e3a4b
AG		 570{
571 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
572
9f1db00c 573 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 574
575 if (rp->status)
42c6b129 576 return;
971e3a4b 577
57af75a8
MH		 578 if (hdev->max_page < rp->max_page)
579 hdev->max_page = rp->max_page;
d2c5d77f 580
cad718ed
JH		 581 if (rp->page < HCI_MAX_PAGES)
582 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 583}
584
1e89cffb 585static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 586 struct sk_buff *skb)
1e89cffb
AE		 587{
588 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
589
9f1db00c 590 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 591
45296acd
MH		 592 if (rp->status)
593 return;
594
595 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 596}
597
a9de9248
MH		 598static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
599{
600 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 601
9f1db00c 602 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 603
a9de9248
MH		 604 if (rp->status)
605 return;
1da177e4 606
a9de9248
MH		 607 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
608 hdev->sco_mtu = rp->sco_mtu;
609 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
610 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
611
612 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
613 hdev->sco_mtu = 64;
614 hdev->sco_pkts = 8;
1da177e4 615 }
a9de9248
MH		 616
617 hdev->acl_cnt = hdev->acl_pkts;
618 hdev->sco_cnt = hdev->sco_pkts;
619
807deac2
GP		 620 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
621 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 622}
623
624static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
625{
626 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
627
9f1db00c 628 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 629
e30d3f5f
MH		 630 if (rp->status)
631 return;
632
633 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 634 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f
MH		 635
636 if (test_bit(HCI_SETUP, &hdev->dev_flags))
637 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 638}
639
f332ec66
JH		 640static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
641 struct sk_buff *skb)
642{
643 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
644
645 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
646
45296acd
MH		 647 if (rp->status)
648 return;
649
650 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 651 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
652 hdev->page_scan_window = __le16_to_cpu(rp->window);
653 }
654}
655
4a3ee763
JH		 656static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
657 struct sk_buff *skb)
658{
659 u8 status = *((u8 *) skb->data);
660 struct hci_cp_write_page_scan_activity *sent;
661
662 BT_DBG("%s status 0x%2.2x", hdev->name, status);
663
664 if (status)
665 return;
666
667 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
668 if (!sent)
669 return;
670
671 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
672 hdev->page_scan_window = __le16_to_cpu(sent->window);
673}
674
f332ec66
JH		 675static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
676 struct sk_buff *skb)
677{
678 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
679
680 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
681
45296acd
MH		 682 if (rp->status)
683 return;
684
685 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 686 hdev->page_scan_type = rp->type;
687}
688
4a3ee763
JH		 689static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
690 struct sk_buff *skb)
691{
692 u8 status = *((u8 *) skb->data);
693 u8 *type;
694
695 BT_DBG("%s status 0x%2.2x", hdev->name, status);
696
697 if (status)
698 return;
699
700 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
701 if (type)
702 hdev->page_scan_type = *type;
703}
704
350ee4cf 705static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 706 struct sk_buff *skb)
350ee4cf
AE		 707{
708 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
709
9f1db00c 710 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 711
712 if (rp->status)
713 return;
714
715 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
716 hdev->block_len = __le16_to_cpu(rp->block_len);
717 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
718
719 hdev->block_cnt = hdev->num_blocks;
720
721 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 722 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 723}
724
33f35721
JH		 725static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
726{
727 struct hci_rp_read_clock *rp = (void *) skb->data;
728 struct hci_cp_read_clock *cp;
729 struct hci_conn *conn;
730
731 BT_DBG("%s", hdev->name);
732
733 if (skb->len < sizeof(*rp))
734 return;
735
736 if (rp->status)
737 return;
738
739 hci_dev_lock(hdev);
740
741 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
742 if (!cp)
743 goto unlock;
744
745 if (cp->which == 0x00) {
746 hdev->clock = le32_to_cpu(rp->clock);
747 goto unlock;
748 }
749
750 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
751 if (conn) {
752 conn->clock = le32_to_cpu(rp->clock);
753 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
754 }
755
756unlock:
757 hci_dev_unlock(hdev);
758}
759
928abaa7 760static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 761 struct sk_buff *skb)
928abaa7
AE		 762{
763 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
764
9f1db00c 765 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 766
767 if (rp->status)
8e2a0d92 768 goto a2mp_rsp;
928abaa7
AE		 769
770 hdev->amp_status = rp->amp_status;
771 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
772 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
773 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
774 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
775 hdev->amp_type = rp->amp_type;
776 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
777 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
778 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
779 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
780
8e2a0d92
AE		 781a2mp_rsp:
782 a2mp_send_getinfo_rsp(hdev);
928abaa7
AE		 783}
784
903e4541
AE		 785static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
786 struct sk_buff *skb)
787{
788 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
789 struct amp_assoc *assoc = &hdev->loc_assoc;
790 size_t rem_len, frag_len;
791
792 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
793
794 if (rp->status)
795 goto a2mp_rsp;
796
797 frag_len = skb->len - sizeof(*rp);
798 rem_len = __le16_to_cpu(rp->rem_len);
799
800 if (rem_len > frag_len) {
2e430be3 801 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
903e4541
AE		 802
803 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
804 assoc->offset += frag_len;
805
806 /* Read other fragments */
807 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
808
809 return;
810 }
811
812 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
813 assoc->len = assoc->offset + rem_len;
814 assoc->offset = 0;
815
816a2mp_rsp:
817 /* Send A2MP Rsp when all fragments are received */
818 a2mp_send_getampassoc_rsp(hdev, rp->status);
9495b2ee 819 a2mp_send_create_phy_link_req(hdev, rp->status);
903e4541
AE		 820}
821
d5859e22 822static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 823 struct sk_buff *skb)
d5859e22 824{
91c4e9b1 825 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 826
9f1db00c 827 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 828
45296acd
MH		 829 if (rp->status)
830 return;
831
832 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 833}
834
980e1a53
JH		 835static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
836{
837 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
838 struct hci_cp_pin_code_reply *cp;
839 struct hci_conn *conn;
840
9f1db00c 841 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 842
56e5cb86
JH		 843 hci_dev_lock(hdev);
844
a8b2d5c2 845 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 846 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 847
fa1bd918 848 if (rp->status)
56e5cb86 849 goto unlock;
980e1a53
JH		 850
851 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
852 if (!cp)
56e5cb86 853 goto unlock;
980e1a53
JH		 854
855 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
856 if (conn)
857 conn->pin_length = cp->pin_len;
56e5cb86
JH		 858
859unlock:
860 hci_dev_unlock(hdev);
980e1a53
JH		 861}
862
863static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
864{
865 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
866
9f1db00c 867 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 868
56e5cb86
JH		 869 hci_dev_lock(hdev);
870
a8b2d5c2 871 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 872 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 873 rp->status);
56e5cb86
JH		 874
875 hci_dev_unlock(hdev);
980e1a53 876}
56e5cb86 877
6ed58ec5
VT		 878static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
879 struct sk_buff *skb)
880{
881 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
882
9f1db00c 883 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 884
885 if (rp->status)
886 return;
887
888 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
889 hdev->le_pkts = rp->le_max_pkt;
890
891 hdev->le_cnt = hdev->le_pkts;
892
893 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 894}
980e1a53 895
60e77321
JH		 896static void hci_cc_le_read_local_features(struct hci_dev *hdev,
897 struct sk_buff *skb)
898{
899 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
900
901 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
902
45296acd
MH		 903 if (rp->status)
904 return;
905
906 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 907}
908
8fa19098
JH		 909static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
910 struct sk_buff *skb)
911{
912 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
913
914 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
915
45296acd
MH		 916 if (rp->status)
917 return;
918
919 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 920}
921
a5c29683
JH		 922static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
923{
924 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
925
9f1db00c 926 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 927
56e5cb86
JH		 928 hci_dev_lock(hdev);
929
a8b2d5c2 930 if (test_bit(HCI_MGMT, &hdev->dev_flags))
04124681
GP		 931 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
932 rp->status);
56e5cb86
JH		 933
934 hci_dev_unlock(hdev);
a5c29683
JH		 935}
936
937static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 938 struct sk_buff *skb)
a5c29683
JH		 939{
940 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
941
9f1db00c 942 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 943
56e5cb86
JH		 944 hci_dev_lock(hdev);
945
a8b2d5c2 946 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 947 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 948 ACL_LINK, 0, rp->status);
56e5cb86
JH		 949
950 hci_dev_unlock(hdev);
a5c29683
JH		 951}
952
1143d458
BG		 953static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
954{
955 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
956
9f1db00c 957 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 958
959 hci_dev_lock(hdev);
960
a8b2d5c2 961 if (test_bit(HCI_MGMT, &hdev->dev_flags))
272d90df 962 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 963 0, rp->status);
1143d458
BG		 964
965 hci_dev_unlock(hdev);
966}
967
968static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 969 struct sk_buff *skb)
1143d458
BG		 970{
971 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
972
9f1db00c 973 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 974
975 hci_dev_lock(hdev);
976
a8b2d5c2 977 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1143d458 978 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 979 ACL_LINK, 0, rp->status);
1143d458
BG		 980
981 hci_dev_unlock(hdev);
982}
983
4d2d2796
MH		 984static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
985 struct sk_buff *skb)
c35938b2
SJ		 986{
987 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
988
9f1db00c 989 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2 990
56e5cb86 991 hci_dev_lock(hdev);
4d2d2796
MH		 992 mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->randomizer,
993 NULL, NULL, rp->status);
994 hci_dev_unlock(hdev);
995}
996
997static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
998 struct sk_buff *skb)
999{
1000 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1001
1002 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1003
1004 hci_dev_lock(hdev);
1005 mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->randomizer192,
1006 rp->hash256, rp->randomizer256,
1007 rp->status);
56e5cb86 1008 hci_dev_unlock(hdev);
c35938b2
SJ		 1009}
1010
7a4cd51d
MH		 1011
1012static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1013{
1014 __u8 status = *((__u8 *) skb->data);
1015 bdaddr_t *sent;
1016
1017 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1018
45296acd
MH		 1019 if (status)
1020 return;
1021
7a4cd51d
MH		 1022 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1023 if (!sent)
1024 return;
1025
1026 hci_dev_lock(hdev);
1027
45296acd 1028 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1029
1030 hci_dev_unlock(hdev);
1031}
1032
c1d5dc4a
JH		 1033static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1034{
1035 __u8 *sent, status = *((__u8 *) skb->data);
1036
1037 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1038
45296acd 1039 if (status)
c1d5dc4a
JH		 1040 return;
1041
45296acd
MH		 1042 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1043 if (!sent)
3c857757
JH		 1044 return;
1045
c1d5dc4a
JH		 1046 hci_dev_lock(hdev);
1047
3c857757
JH		 1048 /* If we're doing connection initation as peripheral. Set a
1049 * timeout in case something goes wrong.
1050 */
1051 if (*sent) {
1052 struct hci_conn *conn;
1053
66c417c1
JH		 1054 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1055
3c857757
JH		 1056 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1057 if (conn)
1058 queue_delayed_work(hdev->workqueue,
1059 &conn->le_conn_timeout,
09ae260b 1060 conn->conn_timeout);
66c417c1
JH		 1061 } else {
1062 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
3c857757
JH		 1063 }
1064
04b4edcb 1065 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1066}
1067
533553f8
MH		 1068static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1069{
1070 struct hci_cp_le_set_scan_param *cp;
1071 __u8 status = *((__u8 *) skb->data);
1072
1073 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1074
45296acd
MH		 1075 if (status)
1076 return;
1077
533553f8
MH		 1078 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1079 if (!cp)
1080 return;
1081
1082 hci_dev_lock(hdev);
1083
45296acd 1084 hdev->le_scan_type = cp->type;
533553f8
MH		 1085
1086 hci_dev_unlock(hdev);
1087}
1088
b9a6328f
JH		 1089static bool has_pending_adv_report(struct hci_dev *hdev)
1090{
1091 struct discovery_state *d = &hdev->discovery;
1092
1093 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1094}
1095
1096static void clear_pending_adv_report(struct hci_dev *hdev)
1097{
1098 struct discovery_state *d = &hdev->discovery;
1099
1100 bacpy(&d->last_adv_addr, BDADDR_ANY);
1101 d->last_adv_data_len = 0;
1102}
1103
1104static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1105 u8 bdaddr_type, s8 rssi, u32 flags,
1106 u8 *data, u8 len)
b9a6328f
JH		 1107{
1108 struct discovery_state *d = &hdev->discovery;
1109
1110 bacpy(&d->last_adv_addr, bdaddr);
1111 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1112 d->last_adv_rssi = rssi;
c70a7e4c 1113 d->last_adv_flags = flags;
b9a6328f
JH		 1114 memcpy(d->last_adv_data, data, len);
1115 d->last_adv_data_len = len;
1116}
1117
eb9d91f5 1118static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
807deac2 1119 struct sk_buff *skb)
eb9d91f5
AG		 1120{
1121 struct hci_cp_le_set_scan_enable *cp;
1122 __u8 status = *((__u8 *) skb->data);
1123
9f1db00c 1124 BT_DBG("%s status 0x%2.2x", hdev->name, status);
eb9d91f5 1125
45296acd 1126 if (status)
eb9d91f5
AG		 1127 return;
1128
45296acd
MH		 1129 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1130 if (!cp)
3fd319b8
AG		 1131 return;
1132
68a8aea4 1133 switch (cp->enable) {
76a388be 1134 case LE_SCAN_ENABLE:
d23264a8 1135 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
b9a6328f
JH		 1136 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1137 clear_pending_adv_report(hdev);
68a8aea4
AE		 1138 break;
1139
76a388be 1140 case LE_SCAN_DISABLE:
b9a6328f
JH		 1141 /* We do this here instead of when setting DISCOVERY_STOPPED
1142 * since the latter would potentially require waiting for
1143 * inquiry to stop too.
1144 */
1145 if (has_pending_adv_report(hdev)) {
1146 struct discovery_state *d = &hdev->discovery;
1147
1148 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1149 d->last_adv_addr_type, NULL,
c70a7e4c 1150 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1151 d->last_adv_data,
b9a6328f
JH		 1152 d->last_adv_data_len, NULL, 0);
1153 }
1154
317ac8cb
JH		 1155 /* Cancel this timer so that we don't try to disable scanning
1156 * when it's already disabled.
1157 */
1158 cancel_delayed_work(&hdev->le_scan_disable);
1159
d23264a8 1160 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
e8bb6b97 1161
81ad6fd9
JH		 1162 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1163 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1164 * therefore discovery as stopped. If this was not
1165 * because of a connect request advertising might have
1166 * been disabled because of active scanning, so
1167 * re-enable it again if necessary.
81ad6fd9
JH		 1168 */
1169 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1170 &hdev->dev_flags))
1171 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
e8bb6b97 1172 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
34722277 1173 hdev->discovery.state == DISCOVERY_FINDING)
e8bb6b97
JH		 1174 mgmt_reenable_advertising(hdev);
1175
68a8aea4
AE		 1176 break;
1177
1178 default:
1179 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1180 break;
35815085 1181 }
eb9d91f5
AG		 1182}
1183
cf1d081f
JH		 1184static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1185 struct sk_buff *skb)
1186{
1187 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1188
1189 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1190
45296acd
MH		 1191 if (rp->status)
1192 return;
1193
1194 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1195}
1196
0f36b589
MH		 1197static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1198 struct sk_buff *skb)
1199{
1200 __u8 status = *((__u8 *) skb->data);
1201
1202 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1203
45296acd
MH		 1204 if (status)
1205 return;
1206
dcc36c16 1207 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1208}
1209
1210static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1211 struct sk_buff *skb)
1212{
1213 struct hci_cp_le_add_to_white_list *sent;
1214 __u8 status = *((__u8 *) skb->data);
1215
1216 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1217
45296acd
MH		 1218 if (status)
1219 return;
1220
0f36b589
MH		 1221 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1222 if (!sent)
1223 return;
1224
dcc36c16
JH		 1225 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1226 sent->bdaddr_type);
0f36b589
MH		 1227}
1228
1229static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1230 struct sk_buff *skb)
1231{
1232 struct hci_cp_le_del_from_white_list *sent;
1233 __u8 status = *((__u8 *) skb->data);
1234
1235 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1236
45296acd
MH		 1237 if (status)
1238 return;
1239
0f36b589
MH		 1240 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1241 if (!sent)
1242 return;
1243
dcc36c16
JH		 1244 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1245 sent->bdaddr_type);
0f36b589
MH		 1246}
1247
9b008c04
JH		 1248static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1249 struct sk_buff *skb)
1250{
1251 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1252
1253 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1254
45296acd
MH		 1255 if (rp->status)
1256 return;
1257
1258 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1259}
1260
6039aa73
GP		 1261static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1262 struct sk_buff *skb)
f9b49306 1263{
06199cf8 1264 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1265 __u8 status = *((__u8 *) skb->data);
1266
9f1db00c 1267 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1268
45296acd
MH		 1269 if (status)
1270 return;
1271
06199cf8 1272 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1273 if (!sent)
f9b49306
AG		 1274 return;
1275
45296acd
MH		 1276 if (sent->le) {
1277 hdev->features[1][0] |= LMP_HOST_LE;
1278 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1279 } else {
1280 hdev->features[1][0] &= ~LMP_HOST_LE;
1281 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1282 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
8f984dfa 1283 }
45296acd
MH		 1284
1285 if (sent->simul)
1286 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1287 else
1288 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
f9b49306
AG		 1289}
1290
56ed2cb8
JH		 1291static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1292{
1293 struct hci_cp_le_set_adv_param *cp;
1294 u8 status = *((u8 *) skb->data);
1295
1296 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1297
1298 if (status)
1299 return;
1300
1301 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1302 if (!cp)
1303 return;
1304
1305 hci_dev_lock(hdev);
1306 hdev->adv_addr_type = cp->own_address_type;
1307 hci_dev_unlock(hdev);
1308}
1309
93c284ee
AE		 1310static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1311 struct sk_buff *skb)
1312{
1313 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1314
1315 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1316 hdev->name, rp->status, rp->phy_handle);
1317
1318 if (rp->status)
1319 return;
1320
1321 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1322}
1323
5ae76a94
AK		 1324static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1325{
1326 struct hci_rp_read_rssi *rp = (void *) skb->data;
1327 struct hci_conn *conn;
1328
1329 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1330
1331 if (rp->status)
1332 return;
1333
1334 hci_dev_lock(hdev);
1335
1336 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1337 if (conn)
1338 conn->rssi = rp->rssi;
1339
1340 hci_dev_unlock(hdev);
1341}
1342
5a134fae
AK		 1343static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1344{
1345 struct hci_cp_read_tx_power *sent;
1346 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1347 struct hci_conn *conn;
1348
1349 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1350
1351 if (rp->status)
1352 return;
1353
1354 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1355 if (!sent)
1356 return;
1357
1358 hci_dev_lock(hdev);
1359
1360 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1361 if (!conn)
1362 goto unlock;
1363
1364 switch (sent->type) {
1365 case 0x00:
5a134fae 1366 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1367 break;
1368 case 0x01:
1369 conn->max_tx_power = rp->tx_power;
1370 break;
1371 }
5a134fae 1372
d0455ed9 1373unlock:
5a134fae
AK		 1374 hci_dev_unlock(hdev);
1375}
1376
6039aa73 1377static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1378{
9f1db00c 1379 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1380
1381 if (status) {
a9de9248 1382 hci_conn_check_pending(hdev);
314b2381
JH		 1383 return;
1384 }
1385
89352e7d 1386 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1387}
1388
6039aa73 1389static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1390{
a9de9248 1391 struct hci_cp_create_conn *cp;
1da177e4 1392 struct hci_conn *conn;
1da177e4 1393
9f1db00c 1394 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1395
1396 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1397 if (!cp)
1398 return;
1399
1400 hci_dev_lock(hdev);
1401
1402 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1403
6ed93dc6 1404 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1405
1406 if (status) {
1407 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1408 if (status != 0x0c || conn->attempt > 2) {
1409 conn->state = BT_CLOSED;
1410 hci_proto_connect_cfm(conn, status);
1411 hci_conn_del(conn);
1412 } else
1413 conn->state = BT_CONNECT2;
1da177e4
LT		 1414 }
1415 } else {
1416 if (!conn) {
a5c4e309
JH		 1417 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1418 HCI_ROLE_MASTER);
1419 if (!conn)
893ef971 1420 BT_ERR("No memory for new connection");
1da177e4
LT		 1421 }
1422 }
1423
1424 hci_dev_unlock(hdev);
1425}
1426
a9de9248 1427static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1428{
a9de9248
MH		 1429 struct hci_cp_add_sco *cp;
1430 struct hci_conn *acl, *sco;
1431 __u16 handle;
1da177e4 1432
9f1db00c 1433 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1434
a9de9248
MH		 1435 if (!status)
1436 return;
1da177e4 1437
a9de9248
MH		 1438 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1439 if (!cp)
1440 return;
1da177e4 1441
a9de9248 1442 handle = __le16_to_cpu(cp->handle);
1da177e4 1443
9f1db00c 1444 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1445
a9de9248 1446 hci_dev_lock(hdev);
1da177e4 1447
a9de9248 1448 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1449 if (acl) {
1450 sco = acl->link;
1451 if (sco) {
1452 sco->state = BT_CLOSED;
1da177e4 1453
5a08ecce
AE		 1454 hci_proto_connect_cfm(sco, status);
1455 hci_conn_del(sco);
1456 }
a9de9248 1457 }
1da177e4 1458
a9de9248
MH		 1459 hci_dev_unlock(hdev);
1460}
1da177e4 1461
f8558555
MH		 1462static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1463{
1464 struct hci_cp_auth_requested *cp;
1465 struct hci_conn *conn;
1466
9f1db00c 1467 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1468
1469 if (!status)
1470 return;
1471
1472 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1473 if (!cp)
1474 return;
1475
1476 hci_dev_lock(hdev);
1477
1478 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1479 if (conn) {
1480 if (conn->state == BT_CONFIG) {
1481 hci_proto_connect_cfm(conn, status);
76a68ba0 1482 hci_conn_drop(conn);
f8558555
MH		 1483 }
1484 }
1485
1486 hci_dev_unlock(hdev);
1487}
1488
1489static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1490{
1491 struct hci_cp_set_conn_encrypt *cp;
1492 struct hci_conn *conn;
1493
9f1db00c 1494 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1495
1496 if (!status)
1497 return;
1498
1499 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1500 if (!cp)
1501 return;
1502
1503 hci_dev_lock(hdev);
1504
1505 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1506 if (conn) {
1507 if (conn->state == BT_CONFIG) {
1508 hci_proto_connect_cfm(conn, status);
76a68ba0 1509 hci_conn_drop(conn);
f8558555
MH		 1510 }
1511 }
1512
1513 hci_dev_unlock(hdev);
1514}
1515
127178d2 1516static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1517 struct hci_conn *conn)
392599b9 1518{
392599b9
JH		 1519 if (conn->state != BT_CONFIG || !conn->out)
1520 return 0;
1521
765c2a96 1522 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1523 return 0;
1524
1525 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1526 * devices with sec_level MEDIUM or HIGH or if MITM protection
1527 * is requested.
1528 */
807deac2 1529 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1530 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1531 conn->pending_sec_level != BT_SECURITY_HIGH &&
1532 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1533 return 0;
1534
392599b9
JH		 1535 return 1;
1536}
1537
6039aa73 1538static int hci_resolve_name(struct hci_dev *hdev,
04124681 1539 struct inquiry_entry *e)
30dc78e1
JH		 1540{
1541 struct hci_cp_remote_name_req cp;
1542
1543 memset(&cp, 0, sizeof(cp));
1544
1545 bacpy(&cp.bdaddr, &e->data.bdaddr);
1546 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1547 cp.pscan_mode = e->data.pscan_mode;
1548 cp.clock_offset = e->data.clock_offset;
1549
1550 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1551}
1552
b644ba33 1553static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1554{
1555 struct discovery_state *discov = &hdev->discovery;
1556 struct inquiry_entry *e;
1557
b644ba33
JH		 1558 if (list_empty(&discov->resolve))
1559 return false;
1560
1561 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1562 if (!e)
1563 return false;
1564
b644ba33
JH		 1565 if (hci_resolve_name(hdev, e) == 0) {
1566 e->name_state = NAME_PENDING;
1567 return true;
1568 }
1569
1570 return false;
1571}
1572
1573static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1574 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1575{
1576 struct discovery_state *discov = &hdev->discovery;
1577 struct inquiry_entry *e;
1578
1579 if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1580 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1581
1582 if (discov->state == DISCOVERY_STOPPED)
1583 return;
1584
30dc78e1
JH		 1585 if (discov->state == DISCOVERY_STOPPING)
1586 goto discov_complete;
1587
1588 if (discov->state != DISCOVERY_RESOLVING)
1589 return;
1590
1591 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1592 /* If the device was not found in a list of found devices names of which
1593 * are pending. there is no need to continue resolving a next name as it
1594 * will be done upon receiving another Remote Name Request Complete
1595 * Event */
1596 if (!e)
1597 return;
1598
1599 list_del(&e->list);
1600 if (name) {
30dc78e1 1601 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1602 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1603 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1604 } else {
1605 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1606 }
1607
b644ba33 1608 if (hci_resolve_next_name(hdev))
30dc78e1 1609 return;
30dc78e1
JH		 1610
1611discov_complete:
1612 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1613}
1614
a9de9248
MH		 1615static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1616{
127178d2
JH		 1617 struct hci_cp_remote_name_req *cp;
1618 struct hci_conn *conn;
1619
9f1db00c 1620 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1621
1622 /* If successful wait for the name req complete event before
1623 * checking for the need to do authentication */
1624 if (!status)
1625 return;
1626
1627 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1628 if (!cp)
1629 return;
1630
1631 hci_dev_lock(hdev);
1632
b644ba33
JH		 1633 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1634
a8b2d5c2 1635 if (test_bit(HCI_MGMT, &hdev->dev_flags))
b644ba33 1636 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1637
79c6c70c
JH		 1638 if (!conn)
1639 goto unlock;
1640
1641 if (!hci_outgoing_auth_needed(hdev, conn))
1642 goto unlock;
1643
51a8efd7 1644 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1645 struct hci_cp_auth_requested auth_cp;
1646
977f8fce
JH		 1647 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1648
c1f23a2b
JB		 1649 auth_cp.handle = __cpu_to_le16(conn->handle);
1650 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1651 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1652 }
1653
79c6c70c 1654unlock:
127178d2 1655 hci_dev_unlock(hdev);
a9de9248 1656}
1da177e4 1657
769be974
MH		 1658static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1659{
1660 struct hci_cp_read_remote_features *cp;
1661 struct hci_conn *conn;
1662
9f1db00c 1663 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1664
1665 if (!status)
1666 return;
1667
1668 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1669 if (!cp)
1670 return;
1671
1672 hci_dev_lock(hdev);
1673
1674 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1675 if (conn) {
1676 if (conn->state == BT_CONFIG) {
769be974 1677 hci_proto_connect_cfm(conn, status);
76a68ba0 1678 hci_conn_drop(conn);
769be974
MH		 1679 }
1680 }
1681
1682 hci_dev_unlock(hdev);
1683}
1684
1685static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1686{
1687 struct hci_cp_read_remote_ext_features *cp;
1688 struct hci_conn *conn;
1689
9f1db00c 1690 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1691
1692 if (!status)
1693 return;
1694
1695 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1696 if (!cp)
1697 return;
1698
1699 hci_dev_lock(hdev);
1700
1701 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1702 if (conn) {
1703 if (conn->state == BT_CONFIG) {
769be974 1704 hci_proto_connect_cfm(conn, status);
76a68ba0 1705 hci_conn_drop(conn);
769be974
MH		 1706 }
1707 }
1708
1709 hci_dev_unlock(hdev);
1710}
1711
a9de9248
MH		 1712static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1713{
b6a0dc82
MH		 1714 struct hci_cp_setup_sync_conn *cp;
1715 struct hci_conn *acl, *sco;
1716 __u16 handle;
1717
9f1db00c 1718 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 1719
1720 if (!status)
1721 return;
1722
1723 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1724 if (!cp)
1725 return;
1726
1727 handle = __le16_to_cpu(cp->handle);
1728
9f1db00c 1729 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 1730
1731 hci_dev_lock(hdev);
1732
1733 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1734 if (acl) {
1735 sco = acl->link;
1736 if (sco) {
1737 sco->state = BT_CLOSED;
b6a0dc82 1738
5a08ecce
AE		 1739 hci_proto_connect_cfm(sco, status);
1740 hci_conn_del(sco);
1741 }
b6a0dc82
MH		 1742 }
1743
1744 hci_dev_unlock(hdev);
1da177e4
LT		 1745}
1746
a9de9248 1747static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1748{
a9de9248
MH		 1749 struct hci_cp_sniff_mode *cp;
1750 struct hci_conn *conn;
1da177e4 1751
9f1db00c 1752 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1753
a9de9248
MH		 1754 if (!status)
1755 return;
04837f64 1756
a9de9248
MH		 1757 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1758 if (!cp)
1759 return;
04837f64 1760
a9de9248 1761 hci_dev_lock(hdev);
04837f64 1762
a9de9248 1763 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1764 if (conn) {
51a8efd7 1765 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 1766
51a8efd7 1767 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1768 hci_sco_setup(conn, status);
1769 }
1770
a9de9248
MH		 1771 hci_dev_unlock(hdev);
1772}
04837f64 1773
a9de9248
MH		 1774static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1775{
1776 struct hci_cp_exit_sniff_mode *cp;
1777 struct hci_conn *conn;
04837f64 1778
9f1db00c 1779 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1780
a9de9248
MH		 1781 if (!status)
1782 return;
04837f64 1783
a9de9248
MH		 1784 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1785 if (!cp)
1786 return;
04837f64 1787
a9de9248 1788 hci_dev_lock(hdev);
1da177e4 1789
a9de9248 1790 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1791 if (conn) {
51a8efd7 1792 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 1793
51a8efd7 1794 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1795 hci_sco_setup(conn, status);
1796 }
1797
a9de9248 1798 hci_dev_unlock(hdev);
1da177e4
LT		 1799}
1800
88c3df13
JH		 1801static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1802{
1803 struct hci_cp_disconnect *cp;
1804 struct hci_conn *conn;
1805
1806 if (!status)
1807 return;
1808
1809 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1810 if (!cp)
1811 return;
1812
1813 hci_dev_lock(hdev);
1814
1815 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1816 if (conn)
1817 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 1818 conn->dst_type, status);
88c3df13
JH		 1819
1820 hci_dev_unlock(hdev);
1821}
1822
a02226d6
AE		 1823static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1824{
93c284ee
AE		 1825 struct hci_cp_create_phy_link *cp;
1826
a02226d6 1827 BT_DBG("%s status 0x%2.2x", hdev->name, status);
93c284ee 1828
93c284ee
AE		 1829 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1830 if (!cp)
1831 return;
1832
e58917b9
AE		 1833 hci_dev_lock(hdev);
1834
1835 if (status) {
1836 struct hci_conn *hcon;
1837
1838 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1839 if (hcon)
1840 hci_conn_del(hcon);
1841 } else {
1842 amp_write_remote_assoc(hdev, cp->phy_handle);
1843 }
1844
1845 hci_dev_unlock(hdev);
a02226d6
AE		 1846}
1847
0b26ab9d
AE		 1848static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1849{
1850 struct hci_cp_accept_phy_link *cp;
1851
1852 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1853
1854 if (status)
1855 return;
1856
1857 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1858 if (!cp)
1859 return;
1860
1861 amp_write_remote_assoc(hdev, cp->phy_handle);
1862}
1863
cb1d68f7
JH		 1864static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1865{
1866 struct hci_cp_le_create_conn *cp;
1867 struct hci_conn *conn;
1868
1869 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1870
1871 /* All connection failure handling is taken care of by the
1872 * hci_le_conn_failed function which is triggered by the HCI
1873 * request completion callbacks used for connecting.
1874 */
1875 if (status)
1876 return;
1877
1878 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1879 if (!cp)
1880 return;
1881
1882 hci_dev_lock(hdev);
1883
1884 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1885 if (!conn)
1886 goto unlock;
1887
1888 /* Store the initiator and responder address information which
1889 * is needed for SMP. These values will not change during the
1890 * lifetime of the connection.
1891 */
1892 conn->init_addr_type = cp->own_address_type;
1893 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1894 bacpy(&conn->init_addr, &hdev->random_addr);
1895 else
1896 bacpy(&conn->init_addr, &hdev->bdaddr);
1897
1898 conn->resp_addr_type = cp->peer_addr_type;
1899 bacpy(&conn->resp_addr, &cp->peer_addr);
1900
9489eca4
JH		 1901 /* We don't want the connection attempt to stick around
1902 * indefinitely since LE doesn't have a page timeout concept
1903 * like BR/EDR. Set a timer for any connection that doesn't use
1904 * the white list for connecting.
1905 */
1906 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1907 queue_delayed_work(conn->hdev->workqueue,
1908 &conn->le_conn_timeout,
09ae260b 1909 conn->conn_timeout);
9489eca4 1910
cb1d68f7
JH		 1911unlock:
1912 hci_dev_unlock(hdev);
1913}
1914
81d0c8ad
JH		 1915static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1916{
1917 struct hci_cp_le_start_enc *cp;
1918 struct hci_conn *conn;
1919
1920 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1921
1922 if (!status)
1923 return;
1924
1925 hci_dev_lock(hdev);
1926
1927 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
1928 if (!cp)
1929 goto unlock;
1930
1931 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1932 if (!conn)
1933 goto unlock;
1934
1935 if (conn->state != BT_CONNECTED)
1936 goto unlock;
1937
1938 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1939 hci_conn_drop(conn);
1940
1941unlock:
1942 hci_dev_unlock(hdev);
1943}
1944
6039aa73 1945static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 1946{
1947 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 1948 struct discovery_state *discov = &hdev->discovery;
1949 struct inquiry_entry *e;
1da177e4 1950
9f1db00c 1951 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 1952
a9de9248 1953 hci_conn_check_pending(hdev);
89352e7d
AG		 1954
1955 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1956 return;
1957
4e857c58 1958 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 1959 wake_up_bit(&hdev->flags, HCI_INQUIRY);
1960
a8b2d5c2 1961 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
30dc78e1
JH		 1962 return;
1963
56e5cb86 1964 hci_dev_lock(hdev);
30dc78e1 1965
343f935b 1966 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 1967 goto unlock;
1968
1969 if (list_empty(&discov->resolve)) {
1970 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1971 goto unlock;
1972 }
1973
1974 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1975 if (e && hci_resolve_name(hdev, e) == 0) {
1976 e->name_state = NAME_PENDING;
1977 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1978 } else {
1979 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1980 }
1981
1982unlock:
56e5cb86 1983 hci_dev_unlock(hdev);
1da177e4
LT		 1984}
1985
6039aa73 1986static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1987{
45bb4bf0 1988 struct inquiry_data data;
a9de9248 1989 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 1990 int num_rsp = *((__u8 *) skb->data);
1991
1992 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1993
45bb4bf0
MH		 1994 if (!num_rsp)
1995 return;
1996
1519cc17
AG		 1997 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1998 return;
1999
1da177e4 2000 hci_dev_lock(hdev);
45bb4bf0 2001
e17acd40 2002 for (; num_rsp; num_rsp--, info++) {
af58925c 2003 u32 flags;
3175405b 2004
1da177e4
LT		 2005 bacpy(&data.bdaddr, &info->bdaddr);
2006 data.pscan_rep_mode = info->pscan_rep_mode;
2007 data.pscan_period_mode = info->pscan_period_mode;
2008 data.pscan_mode = info->pscan_mode;
2009 memcpy(data.dev_class, info->dev_class, 3);
2010 data.clock_offset = info->clock_offset;
2011 data.rssi = 0x00;
41a96212 2012 data.ssp_mode = 0x00;
3175405b 2013
af58925c
MH		 2014 flags = hci_inquiry_cache_update(hdev, &data, false);
2015
48264f06 2016 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c 2017 info->dev_class, 0, flags, NULL, 0, NULL, 0);
1da177e4 2018 }
45bb4bf0 2019
1da177e4
LT		 2020 hci_dev_unlock(hdev);
2021}
2022
6039aa73 2023static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2024{
a9de9248
MH		 2025 struct hci_ev_conn_complete *ev = (void *) skb->data;
2026 struct hci_conn *conn;
1da177e4
LT		 2027
2028 BT_DBG("%s", hdev->name);
2029
2030 hci_dev_lock(hdev);
2031
2032 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2033 if (!conn) {
2034 if (ev->link_type != SCO_LINK)
2035 goto unlock;
2036
2037 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2038 if (!conn)
2039 goto unlock;
2040
2041 conn->type = SCO_LINK;
2042 }
1da177e4
LT		 2043
2044 if (!ev->status) {
2045 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2046
2047 if (conn->type == ACL_LINK) {
2048 conn->state = BT_CONFIG;
2049 hci_conn_hold(conn);
a9ea3ed9
SJ		 2050
2051 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2052 !hci_find_link_key(hdev, &ev->bdaddr))
2053 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2054 else
2055 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2056 } else
2057 conn->state = BT_CONNECTED;
1da177e4 2058
7d0db0a3
MH		 2059 hci_conn_add_sysfs(conn);
2060
1da177e4 2061 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2062 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2063
2064 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2065 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2066
04837f64
MH		 2067 /* Get remote features */
2068 if (conn->type == ACL_LINK) {
2069 struct hci_cp_read_remote_features cp;
2070 cp.handle = ev->handle;
769be974 2071 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2072 sizeof(cp), &cp);
22f433dc
JH		 2073
2074 hci_update_page_scan(hdev, NULL);
04837f64
MH		 2075 }
2076
1da177e4 2077 /* Set packet type for incoming connection */
d095c1eb 2078 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2079 struct hci_cp_change_conn_ptype cp;
2080 cp.handle = ev->handle;
a8746417 2081 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2082 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2083 &cp);
1da177e4 2084 }
17d5c04c 2085 } else {
1da177e4 2086 conn->state = BT_CLOSED;
17d5c04c 2087 if (conn->type == ACL_LINK)
64c7b77c 2088 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2089 conn->dst_type, ev->status);
17d5c04c 2090 }
1da177e4 2091
e73439d8
MH		 2092 if (conn->type == ACL_LINK)
2093 hci_sco_setup(conn, ev->status);
1da177e4 2094
769be974
MH		 2095 if (ev->status) {
2096 hci_proto_connect_cfm(conn, ev->status);
1da177e4 2097 hci_conn_del(conn);
c89b6e6b
MH		 2098 } else if (ev->link_type != ACL_LINK)
2099 hci_proto_connect_cfm(conn, ev->status);
1da177e4 2100
a9de9248 2101unlock:
1da177e4 2102 hci_dev_unlock(hdev);
1da177e4 2103
a9de9248 2104 hci_conn_check_pending(hdev);
1da177e4
LT		 2105}
2106
70c46425
JH		 2107static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2108{
2109 struct hci_cp_reject_conn_req cp;
2110
2111 bacpy(&cp.bdaddr, bdaddr);
2112 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2113 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2114}
2115
6039aa73 2116static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2117{
a9de9248
MH		 2118 struct hci_ev_conn_request *ev = (void *) skb->data;
2119 int mask = hdev->link_mode;
70c46425
JH		 2120 struct inquiry_entry *ie;
2121 struct hci_conn *conn;
20714bfe 2122 __u8 flags = 0;
1da177e4 2123
6ed93dc6 2124 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2125 ev->link_type);
1da177e4 2126
20714bfe
FD		 2127 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2128 &flags);
1da177e4 2129
70c46425
JH		 2130 if (!(mask & HCI_LM_ACCEPT)) {
2131 hci_reject_conn(hdev, &ev->bdaddr);
2132 return;
2133 }
2134
46c4c941
JH		 2135 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2136 BDADDR_BREDR)) {
2137 hci_reject_conn(hdev, &ev->bdaddr);
2138 return;
2139 }
2140
2141 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2142 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2143 BDADDR_BREDR)) {
2144 hci_reject_conn(hdev, &ev->bdaddr);
2145 return;
70c46425 2146 }
1da177e4 2147
70c46425 2148 /* Connection accepted */
b6a0dc82 2149
70c46425
JH		 2150 hci_dev_lock(hdev);
2151
2152 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2153 if (ie)
2154 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2155
70c46425
JH		 2156 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2157 &ev->bdaddr);
2158 if (!conn) {
a5c4e309
JH		 2159 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2160 HCI_ROLE_SLAVE);
a9de9248 2161 if (!conn) {
70c46425
JH		 2162 BT_ERR("No memory for new connection");
2163 hci_dev_unlock(hdev);
2164 return;
1da177e4 2165 }
70c46425 2166 }
b6a0dc82 2167
70c46425 2168 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2169
70c46425 2170 hci_dev_unlock(hdev);
1da177e4 2171
70c46425
JH		 2172 if (ev->link_type == ACL_LINK ||
2173 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2174 struct hci_cp_accept_conn_req cp;
2175 conn->state = BT_CONNECT;
1da177e4 2176
70c46425 2177 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2178
70c46425
JH		 2179 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2180 cp.role = 0x00; /* Become master */
2181 else
2182 cp.role = 0x01; /* Remain slave */
b6a0dc82 2183
70c46425
JH		 2184 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2185 } else if (!(flags & HCI_PROTO_DEFER)) {
2186 struct hci_cp_accept_sync_conn_req cp;
2187 conn->state = BT_CONNECT;
b6a0dc82 2188
70c46425
JH		 2189 bacpy(&cp.bdaddr, &ev->bdaddr);
2190 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2191
70c46425
JH		 2192 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2193 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2194 cp.max_latency = cpu_to_le16(0xffff);
2195 cp.content_format = cpu_to_le16(hdev->voice_setting);
2196 cp.retrans_effort = 0xff;
1da177e4 2197
70c46425
JH		 2198 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2199 &cp);
a9de9248 2200 } else {
70c46425
JH		 2201 conn->state = BT_CONNECT2;
2202 hci_proto_connect_cfm(conn, 0);
1da177e4 2203 }
1da177e4
LT		 2204}
2205
f0d6a0ea
MA		 2206static u8 hci_to_mgmt_reason(u8 err)
2207{
2208 switch (err) {
2209 case HCI_ERROR_CONNECTION_TIMEOUT:
2210 return MGMT_DEV_DISCONN_TIMEOUT;
2211 case HCI_ERROR_REMOTE_USER_TERM:
2212 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2213 case HCI_ERROR_REMOTE_POWER_OFF:
2214 return MGMT_DEV_DISCONN_REMOTE;
2215 case HCI_ERROR_LOCAL_HOST_TERM:
2216 return MGMT_DEV_DISCONN_LOCAL_HOST;
2217 default:
2218 return MGMT_DEV_DISCONN_UNKNOWN;
2219 }
2220}
2221
6039aa73 2222static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2223{
a9de9248 2224 struct hci_ev_disconn_complete *ev = (void *) skb->data;
abf54a50 2225 u8 reason = hci_to_mgmt_reason(ev->reason);
9fcb18ef 2226 struct hci_conn_params *params;
04837f64 2227 struct hci_conn *conn;
12d4a3b2 2228 bool mgmt_connected;
3846220b 2229 u8 type;
04837f64 2230
9f1db00c 2231 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2232
2233 hci_dev_lock(hdev);
2234
2235 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2236 if (!conn)
2237 goto unlock;
7d0db0a3 2238
abf54a50
AG		 2239 if (ev->status) {
2240 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2241 conn->dst_type, ev->status);
2242 goto unlock;
37d9ef76 2243 }
f7520543 2244
3846220b
AG		 2245 conn->state = BT_CLOSED;
2246
12d4a3b2
JH		 2247 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2248 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2249 reason, mgmt_connected);
abf54a50 2250
22f433dc
JH		 2251 if (conn->type == ACL_LINK) {
2252 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2253 hci_remove_link_key(hdev, &conn->dst);
2254
2255 hci_update_page_scan(hdev, NULL);
2256 }
2210246c 2257
9fcb18ef
AG		 2258 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2259 if (params) {
2260 switch (params->auto_connect) {
2261 case HCI_AUTO_CONN_LINK_LOSS:
2262 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2263 break;
2264 /* Fall through */
2265
4b9e7e75 2266 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2267 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2268 list_del_init(&params->action);
2269 list_add(&params->action, &hdev->pend_le_conns);
2270 hci_update_background_scan(hdev);
9fcb18ef
AG		 2271 break;
2272
2273 default:
2274 break;
2275 }
2276 }
2277
3846220b 2278 type = conn->type;
2210246c 2279
3846220b
AG		 2280 hci_proto_disconn_cfm(conn, ev->reason);
2281 hci_conn_del(conn);
2282
2283 /* Re-enable advertising if necessary, since it might
2284 * have been disabled by the connection. From the
2285 * HCI_LE_Set_Advertise_Enable command description in
2286 * the core specification (v4.0):
2287 * "The Controller shall continue advertising until the Host
2288 * issues an LE_Set_Advertise_Enable command with
2289 * Advertising_Enable set to 0x00 (Advertising is disabled)
2290 * or until a connection is created or until the Advertising
2291 * is timed out due to Directed Advertising."
2292 */
2293 if (type == LE_LINK)
2294 mgmt_reenable_advertising(hdev);
f7520543
JH		 2295
2296unlock:
04837f64
MH		 2297 hci_dev_unlock(hdev);
2298}
2299
6039aa73 2300static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2301{
a9de9248 2302 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2303 struct hci_conn *conn;
1da177e4 2304
9f1db00c 2305 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2306
2307 hci_dev_lock(hdev);
2308
04837f64 2309 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2310 if (!conn)
2311 goto unlock;
2312
2313 if (!ev->status) {
aa64a8b5 2314 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2315 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
d7556e20 2316 BT_INFO("re-auth of legacy device is not possible.");
2a611692 2317 } else {
4dae2798 2318 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2319 conn->sec_level = conn->pending_sec_level;
2a611692 2320 }
d7556e20 2321 } else {
e1e930f5 2322 mgmt_auth_failed(conn, ev->status);
d7556e20 2323 }
1da177e4 2324
51a8efd7
JH		 2325 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2326 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2327
d7556e20 2328 if (conn->state == BT_CONFIG) {
aa64a8b5 2329 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2330 struct hci_cp_set_conn_encrypt cp;
2331 cp.handle = ev->handle;
2332 cp.encrypt = 0x01;
2333 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2334 &cp);
052b30b0 2335 } else {
d7556e20
WR		 2336 conn->state = BT_CONNECTED;
2337 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 2338 hci_conn_drop(conn);
052b30b0 2339 }
d7556e20
WR		 2340 } else {
2341 hci_auth_cfm(conn, ev->status);
052b30b0 2342
d7556e20
WR		 2343 hci_conn_hold(conn);
2344 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2345 hci_conn_drop(conn);
d7556e20
WR		 2346 }
2347
51a8efd7 2348 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2349 if (!ev->status) {
2350 struct hci_cp_set_conn_encrypt cp;
2351 cp.handle = ev->handle;
2352 cp.encrypt = 0x01;
2353 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2354 &cp);
d7556e20 2355 } else {
51a8efd7 2356 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2357 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2358 }
2359 }
2360
d7556e20 2361unlock:
1da177e4
LT		 2362 hci_dev_unlock(hdev);
2363}
2364
6039aa73 2365static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2366{
127178d2
JH		 2367 struct hci_ev_remote_name *ev = (void *) skb->data;
2368 struct hci_conn *conn;
2369
a9de9248 2370 BT_DBG("%s", hdev->name);
1da177e4 2371
a9de9248 2372 hci_conn_check_pending(hdev);
127178d2
JH		 2373
2374 hci_dev_lock(hdev);
2375
b644ba33 2376 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2377
b644ba33
JH		 2378 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2379 goto check_auth;
a88a9652 2380
b644ba33
JH		 2381 if (ev->status == 0)
2382 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2383 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2384 else
2385 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2386
2387check_auth:
79c6c70c
JH		 2388 if (!conn)
2389 goto unlock;
2390
2391 if (!hci_outgoing_auth_needed(hdev, conn))
2392 goto unlock;
2393
51a8efd7 2394 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2395 struct hci_cp_auth_requested cp;
977f8fce
JH		 2396
2397 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2398
127178d2
JH		 2399 cp.handle = __cpu_to_le16(conn->handle);
2400 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2401 }
2402
79c6c70c 2403unlock:
127178d2 2404 hci_dev_unlock(hdev);
a9de9248
MH		 2405}
2406
6039aa73 2407static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2408{
2409 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2410 struct hci_conn *conn;
2411
9f1db00c 2412 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2413
2414 hci_dev_lock(hdev);
2415
04837f64 2416 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2417 if (!conn)
2418 goto unlock;
1da177e4 2419
dc8357cc
MH		 2420 if (!ev->status) {
2421 if (ev->encrypt) {
2422 /* Encryption implies authentication */
4dae2798
JH		 2423 set_bit(HCI_CONN_AUTH, &conn->flags);
2424 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2425 conn->sec_level = conn->pending_sec_level;
abf76bad 2426
914a6ffe
MH		 2427 /* P-256 authentication key implies FIPS */
2428 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2429 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2430
abf76bad
MH		 2431 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2432 conn->type == LE_LINK)
2433 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2434 } else {
4dae2798 2435 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2436 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2437 }
dc8357cc 2438 }
a7d7723a 2439
7ed3fa20
JH		 2440 /* We should disregard the current RPA and generate a new one
2441 * whenever the encryption procedure fails.
2442 */
2443 if (ev->status && conn->type == LE_LINK)
2444 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2445
dc8357cc 2446 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2447
dc8357cc
MH		 2448 if (ev->status && conn->state == BT_CONNECTED) {
2449 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2450 hci_conn_drop(conn);
2451 goto unlock;
1da177e4
LT		 2452 }
2453
dc8357cc
MH		 2454 if (conn->state == BT_CONFIG) {
2455 if (!ev->status)
2456 conn->state = BT_CONNECTED;
2457
40b552aa
MH		 2458 /* In Secure Connections Only mode, do not allow any
2459 * connections that are not encrypted with AES-CCM
2460 * using a P-256 authenticated combination key.
2461 */
2462 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2463 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2464 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2465 hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2466 hci_conn_drop(conn);
2467 goto unlock;
2468 }
2469
dc8357cc
MH		 2470 hci_proto_connect_cfm(conn, ev->status);
2471 hci_conn_drop(conn);
2472 } else
2473 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2474
a7d7723a 2475unlock:
1da177e4
LT		 2476 hci_dev_unlock(hdev);
2477}
2478
6039aa73
GP		 2479static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2480 struct sk_buff *skb)
1da177e4 2481{
a9de9248 2482 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2483 struct hci_conn *conn;
1da177e4 2484
9f1db00c 2485 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2486
2487 hci_dev_lock(hdev);
2488
04837f64 2489 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2490 if (conn) {
2491 if (!ev->status)
4dae2798 2492 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 2493
51a8efd7 2494 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 2495
2496 hci_key_change_cfm(conn, ev->status);
2497 }
2498
2499 hci_dev_unlock(hdev);
2500}
2501
6039aa73
GP		 2502static void hci_remote_features_evt(struct hci_dev *hdev,
2503 struct sk_buff *skb)
1da177e4 2504{
a9de9248
MH		 2505 struct hci_ev_remote_features *ev = (void *) skb->data;
2506 struct hci_conn *conn;
2507
9f1db00c 2508 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 2509
a9de9248
MH		 2510 hci_dev_lock(hdev);
2511
2512 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2513 if (!conn)
2514 goto unlock;
769be974 2515
ccd556fe 2516 if (!ev->status)
cad718ed 2517 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 2518
2519 if (conn->state != BT_CONFIG)
2520 goto unlock;
2521
2522 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2523 struct hci_cp_read_remote_ext_features cp;
2524 cp.handle = ev->handle;
2525 cp.page = 0x01;
2526 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 2527 sizeof(cp), &cp);
392599b9
JH		 2528 goto unlock;
2529 }
2530
671267bf 2531 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 2532 struct hci_cp_remote_name_req cp;
2533 memset(&cp, 0, sizeof(cp));
2534 bacpy(&cp.bdaddr, &conn->dst);
2535 cp.pscan_rep_mode = 0x02;
2536 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 2537 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 2538 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 2539
127178d2 2540 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 2541 conn->state = BT_CONNECTED;
2542 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 2543 hci_conn_drop(conn);
769be974 2544 }
a9de9248 2545
ccd556fe 2546unlock:
a9de9248 2547 hci_dev_unlock(hdev);
1da177e4
LT		 2548}
2549
6039aa73 2550static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2551{
2552 struct hci_ev_cmd_complete *ev = (void *) skb->data;
9238f36a 2553 u8 status = skb->data[sizeof(*ev)];
a9de9248
MH		 2554 __u16 opcode;
2555
2556 skb_pull(skb, sizeof(*ev));
2557
2558 opcode = __le16_to_cpu(ev->opcode);
2559
2560 switch (opcode) {
2561 case HCI_OP_INQUIRY_CANCEL:
2562 hci_cc_inquiry_cancel(hdev, skb);
2563 break;
2564
4d93483b
AG		 2565 case HCI_OP_PERIODIC_INQ:
2566 hci_cc_periodic_inq(hdev, skb);
2567 break;
2568
a9de9248
MH		 2569 case HCI_OP_EXIT_PERIODIC_INQ:
2570 hci_cc_exit_periodic_inq(hdev, skb);
2571 break;
2572
2573 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2574 hci_cc_remote_name_req_cancel(hdev, skb);
2575 break;
2576
2577 case HCI_OP_ROLE_DISCOVERY:
2578 hci_cc_role_discovery(hdev, skb);
2579 break;
2580
e4e8e37c
MH		 2581 case HCI_OP_READ_LINK_POLICY:
2582 hci_cc_read_link_policy(hdev, skb);
2583 break;
2584
a9de9248
MH		 2585 case HCI_OP_WRITE_LINK_POLICY:
2586 hci_cc_write_link_policy(hdev, skb);
2587 break;
2588
e4e8e37c
MH		 2589 case HCI_OP_READ_DEF_LINK_POLICY:
2590 hci_cc_read_def_link_policy(hdev, skb);
2591 break;
2592
2593 case HCI_OP_WRITE_DEF_LINK_POLICY:
2594 hci_cc_write_def_link_policy(hdev, skb);
2595 break;
2596
a9de9248
MH		 2597 case HCI_OP_RESET:
2598 hci_cc_reset(hdev, skb);
2599 break;
2600
2601 case HCI_OP_WRITE_LOCAL_NAME:
2602 hci_cc_write_local_name(hdev, skb);
2603 break;
2604
2605 case HCI_OP_READ_LOCAL_NAME:
2606 hci_cc_read_local_name(hdev, skb);
2607 break;
2608
2609 case HCI_OP_WRITE_AUTH_ENABLE:
2610 hci_cc_write_auth_enable(hdev, skb);
2611 break;
2612
2613 case HCI_OP_WRITE_ENCRYPT_MODE:
2614 hci_cc_write_encrypt_mode(hdev, skb);
2615 break;
2616
2617 case HCI_OP_WRITE_SCAN_ENABLE:
2618 hci_cc_write_scan_enable(hdev, skb);
2619 break;
2620
2621 case HCI_OP_READ_CLASS_OF_DEV:
2622 hci_cc_read_class_of_dev(hdev, skb);
2623 break;
2624
2625 case HCI_OP_WRITE_CLASS_OF_DEV:
2626 hci_cc_write_class_of_dev(hdev, skb);
2627 break;
2628
2629 case HCI_OP_READ_VOICE_SETTING:
2630 hci_cc_read_voice_setting(hdev, skb);
2631 break;
2632
2633 case HCI_OP_WRITE_VOICE_SETTING:
2634 hci_cc_write_voice_setting(hdev, skb);
2635 break;
2636
b4cb9fb2
MH		 2637 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2638 hci_cc_read_num_supported_iac(hdev, skb);
2639 break;
2640
333140b5
MH		 2641 case HCI_OP_WRITE_SSP_MODE:
2642 hci_cc_write_ssp_mode(hdev, skb);
2643 break;
2644
eac83dc6
MH		 2645 case HCI_OP_WRITE_SC_SUPPORT:
2646 hci_cc_write_sc_support(hdev, skb);
2647 break;
2648
a9de9248
MH		 2649 case HCI_OP_READ_LOCAL_VERSION:
2650 hci_cc_read_local_version(hdev, skb);
2651 break;
2652
2653 case HCI_OP_READ_LOCAL_COMMANDS:
2654 hci_cc_read_local_commands(hdev, skb);
2655 break;
2656
2657 case HCI_OP_READ_LOCAL_FEATURES:
2658 hci_cc_read_local_features(hdev, skb);
2659 break;
2660
971e3a4b
AG		 2661 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2662 hci_cc_read_local_ext_features(hdev, skb);
2663 break;
2664
a9de9248
MH		 2665 case HCI_OP_READ_BUFFER_SIZE:
2666 hci_cc_read_buffer_size(hdev, skb);
2667 break;
2668
2669 case HCI_OP_READ_BD_ADDR:
2670 hci_cc_read_bd_addr(hdev, skb);
2671 break;
2672
f332ec66
JH		 2673 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2674 hci_cc_read_page_scan_activity(hdev, skb);
2675 break;
2676
4a3ee763
JH		 2677 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2678 hci_cc_write_page_scan_activity(hdev, skb);
2679 break;
2680
f332ec66
JH		 2681 case HCI_OP_READ_PAGE_SCAN_TYPE:
2682 hci_cc_read_page_scan_type(hdev, skb);
2683 break;
2684
4a3ee763
JH		 2685 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2686 hci_cc_write_page_scan_type(hdev, skb);
2687 break;
2688
350ee4cf
AE		 2689 case HCI_OP_READ_DATA_BLOCK_SIZE:
2690 hci_cc_read_data_block_size(hdev, skb);
2691 break;
2692
1e89cffb
AE		 2693 case HCI_OP_READ_FLOW_CONTROL_MODE:
2694 hci_cc_read_flow_control_mode(hdev, skb);
2695 break;
2696
928abaa7
AE		 2697 case HCI_OP_READ_LOCAL_AMP_INFO:
2698 hci_cc_read_local_amp_info(hdev, skb);
2699 break;
2700
33f35721
JH		 2701 case HCI_OP_READ_CLOCK:
2702 hci_cc_read_clock(hdev, skb);
2703 break;
2704
903e4541
AE		 2705 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2706 hci_cc_read_local_amp_assoc(hdev, skb);
2707 break;
2708
d5859e22
JH		 2709 case HCI_OP_READ_INQ_RSP_TX_POWER:
2710 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2711 break;
2712
980e1a53
JH		 2713 case HCI_OP_PIN_CODE_REPLY:
2714 hci_cc_pin_code_reply(hdev, skb);
2715 break;
2716
2717 case HCI_OP_PIN_CODE_NEG_REPLY:
2718 hci_cc_pin_code_neg_reply(hdev, skb);
2719 break;
2720
c35938b2 2721 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 2722 hci_cc_read_local_oob_data(hdev, skb);
2723 break;
2724
2725 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2726 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 2727 break;
2728
6ed58ec5
VT		 2729 case HCI_OP_LE_READ_BUFFER_SIZE:
2730 hci_cc_le_read_buffer_size(hdev, skb);
2731 break;
2732
60e77321
JH		 2733 case HCI_OP_LE_READ_LOCAL_FEATURES:
2734 hci_cc_le_read_local_features(hdev, skb);
2735 break;
2736
8fa19098
JH		 2737 case HCI_OP_LE_READ_ADV_TX_POWER:
2738 hci_cc_le_read_adv_tx_power(hdev, skb);
2739 break;
2740
a5c29683
JH		 2741 case HCI_OP_USER_CONFIRM_REPLY:
2742 hci_cc_user_confirm_reply(hdev, skb);
2743 break;
2744
2745 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2746 hci_cc_user_confirm_neg_reply(hdev, skb);
2747 break;
2748
1143d458
BG		 2749 case HCI_OP_USER_PASSKEY_REPLY:
2750 hci_cc_user_passkey_reply(hdev, skb);
2751 break;
2752
2753 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2754 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 2755 break;
07f7fa5d 2756
7a4cd51d
MH		 2757 case HCI_OP_LE_SET_RANDOM_ADDR:
2758 hci_cc_le_set_random_addr(hdev, skb);
2759 break;
2760
c1d5dc4a
JH		 2761 case HCI_OP_LE_SET_ADV_ENABLE:
2762 hci_cc_le_set_adv_enable(hdev, skb);
2763 break;
2764
533553f8
MH		 2765 case HCI_OP_LE_SET_SCAN_PARAM:
2766 hci_cc_le_set_scan_param(hdev, skb);
2767 break;
2768
eb9d91f5
AG		 2769 case HCI_OP_LE_SET_SCAN_ENABLE:
2770 hci_cc_le_set_scan_enable(hdev, skb);
2771 break;
2772
cf1d081f
JH		 2773 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2774 hci_cc_le_read_white_list_size(hdev, skb);
2775 break;
2776
0f36b589
MH		 2777 case HCI_OP_LE_CLEAR_WHITE_LIST:
2778 hci_cc_le_clear_white_list(hdev, skb);
2779 break;
2780
2781 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2782 hci_cc_le_add_to_white_list(hdev, skb);
2783 break;
2784
2785 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2786 hci_cc_le_del_from_white_list(hdev, skb);
2787 break;
2788
9b008c04
JH		 2789 case HCI_OP_LE_READ_SUPPORTED_STATES:
2790 hci_cc_le_read_supported_states(hdev, skb);
2791 break;
2792
f9b49306
AG		 2793 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2794 hci_cc_write_le_host_supported(hdev, skb);
2795 break;
2796
56ed2cb8
JH		 2797 case HCI_OP_LE_SET_ADV_PARAM:
2798 hci_cc_set_adv_param(hdev, skb);
2799 break;
2800
93c284ee
AE		 2801 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2802 hci_cc_write_remote_amp_assoc(hdev, skb);
2803 break;
2804
5ae76a94
AK		 2805 case HCI_OP_READ_RSSI:
2806 hci_cc_read_rssi(hdev, skb);
2807 break;
2808
5a134fae
AK		 2809 case HCI_OP_READ_TX_POWER:
2810 hci_cc_read_tx_power(hdev, skb);
2811 break;
2812
a9de9248 2813 default:
9f1db00c 2814 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
a9de9248
MH		 2815 break;
2816 }
2817
ad82cdd1 2818 if (opcode != HCI_OP_NOP)
65cc2b49 2819 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 2820
ad82cdd1 2821 hci_req_cmd_complete(hdev, opcode, status);
9238f36a 2822
dbccd791 2823 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 2824 atomic_set(&hdev->cmd_cnt, 1);
2825 if (!skb_queue_empty(&hdev->cmd_q))
c347b765 2826 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 2827 }
2828}
2829
6039aa73 2830static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2831{
2832 struct hci_ev_cmd_status *ev = (void *) skb->data;
2833 __u16 opcode;
2834
2835 skb_pull(skb, sizeof(*ev));
2836
2837 opcode = __le16_to_cpu(ev->opcode);
2838
2839 switch (opcode) {
2840 case HCI_OP_INQUIRY:
2841 hci_cs_inquiry(hdev, ev->status);
2842 break;
2843
2844 case HCI_OP_CREATE_CONN:
2845 hci_cs_create_conn(hdev, ev->status);
2846 break;
2847
2848 case HCI_OP_ADD_SCO:
2849 hci_cs_add_sco(hdev, ev->status);
2850 break;
2851
f8558555
MH		 2852 case HCI_OP_AUTH_REQUESTED:
2853 hci_cs_auth_requested(hdev, ev->status);
2854 break;
2855
2856 case HCI_OP_SET_CONN_ENCRYPT:
2857 hci_cs_set_conn_encrypt(hdev, ev->status);
2858 break;
2859
a9de9248
MH		 2860 case HCI_OP_REMOTE_NAME_REQ:
2861 hci_cs_remote_name_req(hdev, ev->status);
2862 break;
2863
769be974
MH		 2864 case HCI_OP_READ_REMOTE_FEATURES:
2865 hci_cs_read_remote_features(hdev, ev->status);
2866 break;
2867
2868 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2869 hci_cs_read_remote_ext_features(hdev, ev->status);
2870 break;
2871
a9de9248
MH		 2872 case HCI_OP_SETUP_SYNC_CONN:
2873 hci_cs_setup_sync_conn(hdev, ev->status);
2874 break;
2875
2876 case HCI_OP_SNIFF_MODE:
2877 hci_cs_sniff_mode(hdev, ev->status);
2878 break;
2879
2880 case HCI_OP_EXIT_SNIFF_MODE:
2881 hci_cs_exit_sniff_mode(hdev, ev->status);
2882 break;
2883
8962ee74 2884 case HCI_OP_DISCONNECT:
88c3df13 2885 hci_cs_disconnect(hdev, ev->status);
8962ee74
JH		 2886 break;
2887
a02226d6
AE		 2888 case HCI_OP_CREATE_PHY_LINK:
2889 hci_cs_create_phylink(hdev, ev->status);
2890 break;
2891
0b26ab9d
AE		 2892 case HCI_OP_ACCEPT_PHY_LINK:
2893 hci_cs_accept_phylink(hdev, ev->status);
2894 break;
2895
cb1d68f7
JH		 2896 case HCI_OP_LE_CREATE_CONN:
2897 hci_cs_le_create_conn(hdev, ev->status);
2898 break;
2899
81d0c8ad
JH		 2900 case HCI_OP_LE_START_ENC:
2901 hci_cs_le_start_enc(hdev, ev->status);
2902 break;
2903
a9de9248 2904 default:
9f1db00c 2905 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
a9de9248
MH		 2906 break;
2907 }
2908
ad82cdd1 2909 if (opcode != HCI_OP_NOP)
65cc2b49 2910 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 2911
02350a72
JH		 2912 if (ev->status ||
2913 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2914 hci_req_cmd_complete(hdev, opcode, ev->status);
9238f36a 2915
10572132 2916 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 2917 atomic_set(&hdev->cmd_cnt, 1);
2918 if (!skb_queue_empty(&hdev->cmd_q))
c347b765 2919 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 2920 }
2921}
2922
6039aa73 2923static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2924{
2925 struct hci_ev_role_change *ev = (void *) skb->data;
2926 struct hci_conn *conn;
2927
9f1db00c 2928 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 2929
2930 hci_dev_lock(hdev);
2931
2932 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2933 if (conn) {
40bef302
JH		 2934 if (!ev->status)
2935 conn->role = ev->role;
a9de9248 2936
51a8efd7 2937 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 2938
2939 hci_role_switch_cfm(conn, ev->status, ev->role);
2940 }
2941
2942 hci_dev_unlock(hdev);
2943}
2944
6039aa73 2945static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2946{
2947 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 2948 int i;
2949
32ac5b9b
AE		 2950 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2951 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2952 return;
2953 }
2954
c5993de8 2955 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 2956 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
a9de9248
MH		 2957 BT_DBG("%s bad parameters", hdev->name);
2958 return;
2959 }
2960
c5993de8
AE		 2961 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2962
613a1c0c
AE		 2963 for (i = 0; i < ev->num_hndl; i++) {
2964 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 2965 struct hci_conn *conn;
2966 __u16 handle, count;
2967
613a1c0c
AE		 2968 handle = __le16_to_cpu(info->handle);
2969 count = __le16_to_cpu(info->count);
a9de9248
MH		 2970
2971 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 2972 if (!conn)
2973 continue;
2974
2975 conn->sent -= count;
2976
2977 switch (conn->type) {
2978 case ACL_LINK:
2979 hdev->acl_cnt += count;
2980 if (hdev->acl_cnt > hdev->acl_pkts)
2981 hdev->acl_cnt = hdev->acl_pkts;
2982 break;
2983
2984 case LE_LINK:
2985 if (hdev->le_pkts) {
2986 hdev->le_cnt += count;
2987 if (hdev->le_cnt > hdev->le_pkts)
2988 hdev->le_cnt = hdev->le_pkts;
2989 } else {
70f23020
AE		 2990 hdev->acl_cnt += count;
2991 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 2992 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 2993 }
f4280918
AE		 2994 break;
2995
2996 case SCO_LINK:
2997 hdev->sco_cnt += count;
2998 if (hdev->sco_cnt > hdev->sco_pkts)
2999 hdev->sco_cnt = hdev->sco_pkts;
3000 break;
3001
3002 default:
3003 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3004 break;
a9de9248
MH		 3005 }
3006 }
3007
3eff45ea 3008 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3009}
3010
76ef7cf7
AE		 3011static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3012 __u16 handle)
3013{
3014 struct hci_chan *chan;
3015
3016 switch (hdev->dev_type) {
3017 case HCI_BREDR:
3018 return hci_conn_hash_lookup_handle(hdev, handle);
3019 case HCI_AMP:
3020 chan = hci_chan_lookup_handle(hdev, handle);
3021 if (chan)
3022 return chan->conn;
3023 break;
3024 default:
3025 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3026 break;
3027 }
3028
3029 return NULL;
3030}
3031
6039aa73 3032static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3033{
3034 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3035 int i;
3036
3037 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3038 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3039 return;
3040 }
3041
3042 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 3043 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
25e89e99
AE		 3044 BT_DBG("%s bad parameters", hdev->name);
3045 return;
3046 }
3047
3048 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3049 ev->num_hndl);
25e89e99
AE		 3050
3051 for (i = 0; i < ev->num_hndl; i++) {
3052 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3053 struct hci_conn *conn = NULL;
25e89e99
AE		 3054 __u16 handle, block_count;
3055
3056 handle = __le16_to_cpu(info->handle);
3057 block_count = __le16_to_cpu(info->blocks);
3058
76ef7cf7 3059 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3060 if (!conn)
3061 continue;
3062
3063 conn->sent -= block_count;
3064
3065 switch (conn->type) {
3066 case ACL_LINK:
bd1eb66b 3067 case AMP_LINK:
25e89e99
AE		 3068 hdev->block_cnt += block_count;
3069 if (hdev->block_cnt > hdev->num_blocks)
3070 hdev->block_cnt = hdev->num_blocks;
3071 break;
3072
3073 default:
3074 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3075 break;
3076 }
3077 }
3078
3079 queue_work(hdev->workqueue, &hdev->tx_work);
3080}
3081
6039aa73 3082static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3083{
a9de9248 3084 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3085 struct hci_conn *conn;
3086
9f1db00c 3087 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3088
3089 hci_dev_lock(hdev);
3090
3091 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3092 if (conn) {
3093 conn->mode = ev->mode;
a9de9248 3094
8fc9ced3
GP		 3095 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3096 &conn->flags)) {
a9de9248 3097 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3098 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3099 else
58a681ef 3100 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3101 }
e73439d8 3102
51a8efd7 3103 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3104 hci_sco_setup(conn, ev->status);
04837f64
MH		 3105 }
3106
3107 hci_dev_unlock(hdev);
3108}
3109
6039aa73 3110static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3111{
052b30b0
MH		 3112 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3113 struct hci_conn *conn;
3114
a9de9248 3115 BT_DBG("%s", hdev->name);
052b30b0
MH		 3116
3117 hci_dev_lock(hdev);
3118
3119 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3120 if (!conn)
3121 goto unlock;
3122
3123 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3124 hci_conn_hold(conn);
3125 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3126 hci_conn_drop(conn);
052b30b0
MH		 3127 }
3128
b6ae8457 3129 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
2f407f0a 3130 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3131 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3132 sizeof(ev->bdaddr), &ev->bdaddr);
2f407f0a 3133 } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
a770bb5a
WR		 3134 u8 secure;
3135
3136 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3137 secure = 1;
3138 else
3139 secure = 0;
3140
744cf19e 3141 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3142 }
980e1a53 3143
b6f98044 3144unlock:
052b30b0 3145 hci_dev_unlock(hdev);
a9de9248
MH		 3146}
3147
6039aa73 3148static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3149{
55ed8ca1
JH		 3150 struct hci_ev_link_key_req *ev = (void *) skb->data;
3151 struct hci_cp_link_key_reply cp;
3152 struct hci_conn *conn;
3153 struct link_key *key;
3154
a9de9248 3155 BT_DBG("%s", hdev->name);
55ed8ca1 3156
034cbea0 3157 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
55ed8ca1
JH		 3158 return;
3159
3160 hci_dev_lock(hdev);
3161
3162 key = hci_find_link_key(hdev, &ev->bdaddr);
3163 if (!key) {
6ed93dc6
AE		 3164 BT_DBG("%s link key not found for %pMR", hdev->name,
3165 &ev->bdaddr);
55ed8ca1
JH		 3166 goto not_found;
3167 }
3168
6ed93dc6
AE		 3169 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3170 &ev->bdaddr);
55ed8ca1 3171
55ed8ca1 3172 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3173 if (conn) {
66138ce8
MH		 3174 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3175 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3176 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3177 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3178 goto not_found;
3179 }
55ed8ca1 3180
60b83f57 3181 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3182 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3183 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3184 BT_DBG("%s ignoring key unauthenticated for high security",
3185 hdev->name);
60b83f57
WR		 3186 goto not_found;
3187 }
3188
3189 conn->key_type = key->type;
3190 conn->pin_length = key->pin_len;
55ed8ca1
JH		 3191 }
3192
3193 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3194 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3195
3196 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3197
3198 hci_dev_unlock(hdev);
3199
3200 return;
3201
3202not_found:
3203 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3204 hci_dev_unlock(hdev);
a9de9248
MH		 3205}
3206
6039aa73 3207static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3208{
052b30b0
MH		 3209 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3210 struct hci_conn *conn;
7652ff6a
JH		 3211 struct link_key *key;
3212 bool persistent;
55ed8ca1 3213 u8 pin_len = 0;
052b30b0 3214
a9de9248 3215 BT_DBG("%s", hdev->name);
052b30b0
MH		 3216
3217 hci_dev_lock(hdev);
3218
3219 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3220 if (conn) {
3221 hci_conn_hold(conn);
3222 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
980e1a53 3223 pin_len = conn->pin_length;
13d39315
WR		 3224
3225 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
3226 conn->key_type = ev->key_type;
3227
76a68ba0 3228 hci_conn_drop(conn);
052b30b0
MH		 3229 }
3230
7652ff6a
JH		 3231 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3232 goto unlock;
3233
3234 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3235 ev->key_type, pin_len, &persistent);
3236 if (!key)
3237 goto unlock;
3238
3239 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3240
6d5650c4
JH		 3241 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3242 * is set. If it's not set simply remove the key from the kernel
3243 * list (we've still notified user space about it but with
3244 * store_hint being 0).
3245 */
3246 if (key->type == HCI_LK_DEBUG_COMBINATION &&
3247 !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3248 list_del(&key->list);
3249 kfree(key);
3250 } else if (conn) {
af6a9c32
JH		 3251 if (persistent)
3252 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3253 else
3254 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
6d5650c4 3255 }
7652ff6a
JH		 3256
3257unlock:
052b30b0 3258 hci_dev_unlock(hdev);
a9de9248
MH		 3259}
3260
6039aa73 3261static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3262{
a9de9248 3263 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3264 struct hci_conn *conn;
1da177e4 3265
9f1db00c 3266 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3267
3268 hci_dev_lock(hdev);
3269
04837f64 3270 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3271 if (conn && !ev->status) {
3272 struct inquiry_entry *ie;
3273
cc11b9c1
AE		 3274 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3275 if (ie) {
1da177e4
LT		 3276 ie->data.clock_offset = ev->clock_offset;
3277 ie->timestamp = jiffies;
3278 }
3279 }
3280
3281 hci_dev_unlock(hdev);
3282}
3283
6039aa73 3284static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 3285{
3286 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3287 struct hci_conn *conn;
3288
9f1db00c 3289 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 3290
3291 hci_dev_lock(hdev);
3292
3293 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3294 if (conn && !ev->status)
3295 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3296
3297 hci_dev_unlock(hdev);
3298}
3299
6039aa73 3300static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 3301{
a9de9248 3302 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 3303 struct inquiry_entry *ie;
3304
3305 BT_DBG("%s", hdev->name);
3306
3307 hci_dev_lock(hdev);
3308
cc11b9c1
AE		 3309 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3310 if (ie) {
85a1e930
MH		 3311 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3312 ie->timestamp = jiffies;
3313 }
3314
3315 hci_dev_unlock(hdev);
3316}
3317
6039aa73
GP		 3318static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3319 struct sk_buff *skb)
a9de9248
MH		 3320{
3321 struct inquiry_data data;
3322 int num_rsp = *((__u8 *) skb->data);
3323
3324 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3325
3326 if (!num_rsp)
3327 return;
3328
1519cc17
AG		 3329 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3330 return;
3331
a9de9248
MH		 3332 hci_dev_lock(hdev);
3333
3334 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3335 struct inquiry_info_with_rssi_and_pscan_mode *info;
3336 info = (void *) (skb->data + 1);
a9de9248 3337
e17acd40 3338 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3339 u32 flags;
3340
a9de9248
MH		 3341 bacpy(&data.bdaddr, &info->bdaddr);
3342 data.pscan_rep_mode = info->pscan_rep_mode;
3343 data.pscan_period_mode = info->pscan_period_mode;
3344 data.pscan_mode = info->pscan_mode;
3345 memcpy(data.dev_class, info->dev_class, 3);
3346 data.clock_offset = info->clock_offset;
3347 data.rssi = info->rssi;
41a96212 3348 data.ssp_mode = 0x00;
3175405b 3349
af58925c
MH		 3350 flags = hci_inquiry_cache_update(hdev, &data, false);
3351
48264f06 3352 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3353 info->dev_class, info->rssi,
af58925c 3354 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3355 }
3356 } else {
3357 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3358
e17acd40 3359 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3360 u32 flags;
3361
a9de9248
MH		 3362 bacpy(&data.bdaddr, &info->bdaddr);
3363 data.pscan_rep_mode = info->pscan_rep_mode;
3364 data.pscan_period_mode = info->pscan_period_mode;
3365 data.pscan_mode = 0x00;
3366 memcpy(data.dev_class, info->dev_class, 3);
3367 data.clock_offset = info->clock_offset;
3368 data.rssi = info->rssi;
41a96212 3369 data.ssp_mode = 0x00;
af58925c
MH		 3370
3371 flags = hci_inquiry_cache_update(hdev, &data, false);
3372
48264f06 3373 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3374 info->dev_class, info->rssi,
af58925c 3375 flags, NULL, 0, NULL, 0);
a9de9248
MH		 3376 }
3377 }
3378
3379 hci_dev_unlock(hdev);
3380}
3381
6039aa73
GP		 3382static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3383 struct sk_buff *skb)
a9de9248 3384{
41a96212
MH		 3385 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3386 struct hci_conn *conn;
3387
a9de9248 3388 BT_DBG("%s", hdev->name);
41a96212 3389
41a96212
MH		 3390 hci_dev_lock(hdev);
3391
3392 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3393 if (!conn)
3394 goto unlock;
41a96212 3395
cad718ed
JH		 3396 if (ev->page < HCI_MAX_PAGES)
3397 memcpy(conn->features[ev->page], ev->features, 8);
3398
ccd556fe
JH		 3399 if (!ev->status && ev->page == 0x01) {
3400 struct inquiry_entry *ie;
41a96212 3401
cc11b9c1
AE		 3402 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3403 if (ie)
02b7cc62 3404 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 3405
bbb0eada 3406 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 3407 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 3408 } else {
3409 /* It is mandatory by the Bluetooth specification that
3410 * Extended Inquiry Results are only used when Secure
3411 * Simple Pairing is enabled, but some devices violate
3412 * this.
3413 *
3414 * To make these devices work, the internal SSP
3415 * enabled flag needs to be cleared if the remote host
3416 * features do not indicate SSP support */
3417 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3418 }
eb9a8f3f
MH		 3419
3420 if (ev->features[0] & LMP_HOST_SC)
3421 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 3422 }
3423
3424 if (conn->state != BT_CONFIG)
3425 goto unlock;
3426
671267bf 3427 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3428 struct hci_cp_remote_name_req cp;
3429 memset(&cp, 0, sizeof(cp));
3430 bacpy(&cp.bdaddr, &conn->dst);
3431 cp.pscan_rep_mode = 0x02;
3432 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3433 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3434 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3435
127178d2 3436 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 3437 conn->state = BT_CONNECTED;
3438 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 3439 hci_conn_drop(conn);
41a96212
MH		 3440 }
3441
ccd556fe 3442unlock:
41a96212 3443 hci_dev_unlock(hdev);
a9de9248
MH		 3444}
3445
6039aa73
GP		 3446static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3447 struct sk_buff *skb)
a9de9248 3448{
b6a0dc82
MH		 3449 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3450 struct hci_conn *conn;
3451
9f1db00c 3452 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 3453
3454 hci_dev_lock(hdev);
3455
3456 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 3457 if (!conn) {
3458 if (ev->link_type == ESCO_LINK)
3459 goto unlock;
3460
3461 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3462 if (!conn)
3463 goto unlock;
3464
3465 conn->type = SCO_LINK;
3466 }
b6a0dc82 3467
732547f9
MH		 3468 switch (ev->status) {
3469 case 0x00:
b6a0dc82
MH		 3470 conn->handle = __le16_to_cpu(ev->handle);
3471 conn->state = BT_CONNECTED;
7d0db0a3
MH		 3472
3473 hci_conn_add_sysfs(conn);
732547f9
MH		 3474 break;
3475
81218d20 3476 case 0x10: /* Connection Accept Timeout */
1a4c958c 3477 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 3478 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 3479 case 0x1c: /* SCO interval rejected */
1038a00b 3480 case 0x1a: /* Unsupported Remote Feature */
732547f9 3481 case 0x1f: /* Unspecified error */
27539bc4 3482 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 3483 if (conn->out) {
732547f9
MH		 3484 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3485 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 3486 if (hci_setup_sync(conn, conn->link->handle))
3487 goto unlock;
732547f9
MH		 3488 }
3489 /* fall through */
3490
3491 default:
b6a0dc82 3492 conn->state = BT_CLOSED;
732547f9
MH		 3493 break;
3494 }
b6a0dc82
MH		 3495
3496 hci_proto_connect_cfm(conn, ev->status);
3497 if (ev->status)
3498 hci_conn_del(conn);
3499
3500unlock:
3501 hci_dev_unlock(hdev);
a9de9248
MH		 3502}
3503
efdcf8e3
MH		 3504static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3505{
3506 size_t parsed = 0;
3507
3508 while (parsed < eir_len) {
3509 u8 field_len = eir[0];
3510
3511 if (field_len == 0)
3512 return parsed;
3513
3514 parsed += field_len + 1;
3515 eir += field_len + 1;
3516 }
3517
3518 return eir_len;
3519}
3520
6039aa73
GP		 3521static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3522 struct sk_buff *skb)
1da177e4 3523{
a9de9248
MH		 3524 struct inquiry_data data;
3525 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3526 int num_rsp = *((__u8 *) skb->data);
9d939d94 3527 size_t eir_len;
1da177e4 3528
a9de9248 3529 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 3530
a9de9248
MH		 3531 if (!num_rsp)
3532 return;
1da177e4 3533
1519cc17
AG		 3534 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3535 return;
3536
a9de9248
MH		 3537 hci_dev_lock(hdev);
3538
e17acd40 3539 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3540 u32 flags;
3541 bool name_known;
561aafbc 3542
a9de9248 3543 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 3544 data.pscan_rep_mode = info->pscan_rep_mode;
3545 data.pscan_period_mode = info->pscan_period_mode;
3546 data.pscan_mode = 0x00;
a9de9248 3547 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 3548 data.clock_offset = info->clock_offset;
3549 data.rssi = info->rssi;
41a96212 3550 data.ssp_mode = 0x01;
561aafbc 3551
a8b2d5c2 3552 if (test_bit(HCI_MGMT, &hdev->dev_flags))
4ddb1930 3553 name_known = eir_has_data_type(info->data,
04124681
GP		 3554 sizeof(info->data),
3555 EIR_NAME_COMPLETE);
561aafbc
JH		 3556 else
3557 name_known = true;
3558
af58925c
MH		 3559 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3560
9d939d94 3561 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 3562
48264f06 3563 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 3564 info->dev_class, info->rssi,
3565 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 3566 }
3567
3568 hci_dev_unlock(hdev);
3569}
1da177e4 3570
1c2e0041
JH		 3571static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3572 struct sk_buff *skb)
3573{
3574 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3575 struct hci_conn *conn;
3576
9f1db00c 3577 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 3578 __le16_to_cpu(ev->handle));
3579
3580 hci_dev_lock(hdev);
3581
3582 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3583 if (!conn)
3584 goto unlock;
3585
9eb1fbfa
JH		 3586 /* For BR/EDR the necessary steps are taken through the
3587 * auth_complete event.
3588 */
3589 if (conn->type != LE_LINK)
3590 goto unlock;
3591
1c2e0041
JH		 3592 if (!ev->status)
3593 conn->sec_level = conn->pending_sec_level;
3594
3595 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3596
3597 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 3598 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 3599 hci_conn_drop(conn);
1c2e0041
JH		 3600 goto unlock;
3601 }
3602
3603 if (conn->state == BT_CONFIG) {
3604 if (!ev->status)
3605 conn->state = BT_CONNECTED;
3606
3607 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 3608 hci_conn_drop(conn);
1c2e0041
JH		 3609 } else {
3610 hci_auth_cfm(conn, ev->status);
3611
3612 hci_conn_hold(conn);
3613 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3614 hci_conn_drop(conn);
1c2e0041
JH		 3615 }
3616
3617unlock:
3618 hci_dev_unlock(hdev);
3619}
3620
6039aa73 3621static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 3622{
17fa4b9d 3623 /* If remote requests no-bonding follow that lead */
acabae96
MA		 3624 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3625 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 3626 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 3627
b7f94c88
MA		 3628 /* If both remote and local have enough IO capabilities, require
3629 * MITM protection
3630 */
3631 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3632 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3633 return conn->remote_auth | 0x01;
3634
7e74170a
TM		 3635 /* No MITM protection possible so ignore remote requirement */
3636 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 3637}
3638
6039aa73 3639static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 3640{
3641 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3642 struct hci_conn *conn;
3643
3644 BT_DBG("%s", hdev->name);
3645
3646 hci_dev_lock(hdev);
3647
3648 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 3649 if (!conn)
3650 goto unlock;
3651
3652 hci_conn_hold(conn);
3653
a8b2d5c2 3654 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
03b555e1
JH		 3655 goto unlock;
3656
2f407f0a
JH		 3657 /* Allow pairing if we're pairable, the initiators of the
3658 * pairing or if the remote is not requesting bonding.
3659 */
b6ae8457 3660 if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
2f407f0a 3661 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 3662 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 3663 struct hci_cp_io_capability_reply cp;
3664
3665 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 3666 /* Change the IO capability from KeyboardDisplay
3667 * to DisplayYesNo as it is not supported by BT spec. */
3668 cp.capability = (conn->io_capability == 0x04) ?
a767631a 3669 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 3670
3671 /* If we are initiators, there is no remote information yet */
3672 if (conn->remote_auth == 0xff) {
b16c6604 3673 /* Request MITM protection if our IO caps allow it
4ad51a75 3674 * except for the no-bonding case.
b16c6604 3675 */
6fd6b915 3676 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 3677 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 3678 conn->auth_type |= 0x01;
b7f94c88
MA		 3679 } else {
3680 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 3681 }
17fa4b9d 3682
82c295b1
JH		 3683 /* If we're not bondable, force one of the non-bondable
3684 * authentication requirement values.
3685 */
3686 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
3687 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3688
3689 cp.authentication = conn->auth_type;
3690
8fc9ced3
GP		 3691 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3692 (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
ce85ee13
SJ		 3693 cp.oob_data = 0x01;
3694 else
3695 cp.oob_data = 0x00;
3696
17fa4b9d 3697 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 3698 sizeof(cp), &cp);
03b555e1
JH		 3699 } else {
3700 struct hci_cp_io_capability_neg_reply cp;
3701
3702 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 3703 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 3704
03b555e1 3705 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 3706 sizeof(cp), &cp);
03b555e1
JH		 3707 }
3708
3709unlock:
3710 hci_dev_unlock(hdev);
3711}
3712
6039aa73 3713static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 3714{
3715 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3716 struct hci_conn *conn;
3717
3718 BT_DBG("%s", hdev->name);
3719
3720 hci_dev_lock(hdev);
3721
3722 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3723 if (!conn)
3724 goto unlock;
3725
03b555e1 3726 conn->remote_cap = ev->capability;
03b555e1 3727 conn->remote_auth = ev->authentication;
58a681ef
JH		 3728 if (ev->oob_data)
3729 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
03b555e1
JH		 3730
3731unlock:
0493684e
MH		 3732 hci_dev_unlock(hdev);
3733}
3734
6039aa73
GP		 3735static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3736 struct sk_buff *skb)
a5c29683
JH		 3737{
3738 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 3739 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 3740 struct hci_conn *conn;
a5c29683
JH		 3741
3742 BT_DBG("%s", hdev->name);
3743
3744 hci_dev_lock(hdev);
3745
a8b2d5c2 3746 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
7a828908 3747 goto unlock;
a5c29683 3748
7a828908
JH		 3749 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3750 if (!conn)
3751 goto unlock;
3752
3753 loc_mitm = (conn->auth_type & 0x01);
3754 rem_mitm = (conn->remote_auth & 0x01);
3755
3756 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 3757 * (it has NoInputNoOutput) then reject the confirmation
3758 * request. We check the security level here since it doesn't
3759 * necessarily match conn->auth_type.
6fd6b915 3760 */
6c53823a
JH		 3761 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
3762 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 3763 BT_DBG("Rejecting request: remote device can't provide MITM");
3764 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 3765 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 3766 goto unlock;
3767 }
3768
3769 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 3770 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3771 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 3772
3773 /* If we're not the initiators request authorization to
3774 * proceed from user space (mgmt_user_confirm with
ba15a58b 3775 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 3776 * side had MITM or if the local IO capability is
3777 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 3778 */
3779 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 3780 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 3781 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 3782 BT_DBG("Confirming auto-accept as acceptor");
3783 confirm_hint = 1;
3784 goto confirm;
3785 }
3786
9f61656a 3787 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 3788 hdev->auto_accept_delay);
9f61656a
JH		 3789
3790 if (hdev->auto_accept_delay > 0) {
3791 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 3792 queue_delayed_work(conn->hdev->workqueue,
3793 &conn->auto_accept_work, delay);
9f61656a
JH		 3794 goto unlock;
3795 }
3796
7a828908 3797 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 3798 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 3799 goto unlock;
3800 }
3801
55bc1a37 3802confirm:
39adbffe
JH		 3803 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
3804 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 3805
3806unlock:
a5c29683
JH		 3807 hci_dev_unlock(hdev);
3808}
3809
6039aa73
GP		 3810static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3811 struct sk_buff *skb)
1143d458
BG		 3812{
3813 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3814
3815 BT_DBG("%s", hdev->name);
3816
a8b2d5c2 3817 if (test_bit(HCI_MGMT, &hdev->dev_flags))
272d90df 3818 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 3819}
3820
92a25256
JH		 3821static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3822 struct sk_buff *skb)
3823{
3824 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3825 struct hci_conn *conn;
3826
3827 BT_DBG("%s", hdev->name);
3828
3829 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3830 if (!conn)
3831 return;
3832
3833 conn->passkey_notify = __le32_to_cpu(ev->passkey);
3834 conn->passkey_entered = 0;
3835
3836 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3837 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3838 conn->dst_type, conn->passkey_notify,
3839 conn->passkey_entered);
3840}
3841
3842static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3843{
3844 struct hci_ev_keypress_notify *ev = (void *) skb->data;
3845 struct hci_conn *conn;
3846
3847 BT_DBG("%s", hdev->name);
3848
3849 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3850 if (!conn)
3851 return;
3852
3853 switch (ev->type) {
3854 case HCI_KEYPRESS_STARTED:
3855 conn->passkey_entered = 0;
3856 return;
3857
3858 case HCI_KEYPRESS_ENTERED:
3859 conn->passkey_entered++;
3860 break;
3861
3862 case HCI_KEYPRESS_ERASED:
3863 conn->passkey_entered--;
3864 break;
3865
3866 case HCI_KEYPRESS_CLEARED:
3867 conn->passkey_entered = 0;
3868 break;
3869
3870 case HCI_KEYPRESS_COMPLETED:
3871 return;
3872 }
3873
3874 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3875 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3876 conn->dst_type, conn->passkey_notify,
3877 conn->passkey_entered);
3878}
3879
6039aa73
GP		 3880static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3881 struct sk_buff *skb)
0493684e
MH		 3882{
3883 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3884 struct hci_conn *conn;
3885
3886 BT_DBG("%s", hdev->name);
3887
3888 hci_dev_lock(hdev);
3889
3890 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 3891 if (!conn)
3892 goto unlock;
3893
c1d4fa7a
JH		 3894 /* Reset the authentication requirement to unknown */
3895 conn->remote_auth = 0xff;
3896
2a611692
JH		 3897 /* To avoid duplicate auth_failed events to user space we check
3898 * the HCI_CONN_AUTH_PEND flag which will be set if we
3899 * initiated the authentication. A traditional auth_complete
3900 * event gets always produced as initiator and is also mapped to
3901 * the mgmt_auth_failed event */
fa1bd918 3902 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 3903 mgmt_auth_failed(conn, ev->status);
0493684e 3904
76a68ba0 3905 hci_conn_drop(conn);
2a611692
JH		 3906
3907unlock:
0493684e
MH		 3908 hci_dev_unlock(hdev);
3909}
3910
6039aa73
GP		 3911static void hci_remote_host_features_evt(struct hci_dev *hdev,
3912 struct sk_buff *skb)
41a96212
MH		 3913{
3914 struct hci_ev_remote_host_features *ev = (void *) skb->data;
3915 struct inquiry_entry *ie;
cad718ed 3916 struct hci_conn *conn;
41a96212
MH		 3917
3918 BT_DBG("%s", hdev->name);
3919
3920 hci_dev_lock(hdev);
3921
cad718ed
JH		 3922 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3923 if (conn)
3924 memcpy(conn->features[1], ev->features, 8);
3925
cc11b9c1
AE		 3926 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3927 if (ie)
02b7cc62 3928 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 3929
3930 hci_dev_unlock(hdev);
3931}
3932
6039aa73
GP		 3933static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3934 struct sk_buff *skb)
2763eda6
SJ		 3935{
3936 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3937 struct oob_data *data;
3938
3939 BT_DBG("%s", hdev->name);
3940
3941 hci_dev_lock(hdev);
3942
a8b2d5c2 3943 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
e1ba1f15
SJ		 3944 goto unlock;
3945
2763eda6
SJ		 3946 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3947 if (data) {
519ca9d0
MH		 3948 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
3949 struct hci_cp_remote_oob_ext_data_reply cp;
2763eda6 3950
519ca9d0
MH		 3951 bacpy(&cp.bdaddr, &ev->bdaddr);
3952 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
3953 memcpy(cp.randomizer192, data->randomizer192,
3954 sizeof(cp.randomizer192));
3955 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
3956 memcpy(cp.randomizer256, data->randomizer256,
3957 sizeof(cp.randomizer256));
3958
3959 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
3960 sizeof(cp), &cp);
3961 } else {
3962 struct hci_cp_remote_oob_data_reply cp;
2763eda6 3963
519ca9d0
MH		 3964 bacpy(&cp.bdaddr, &ev->bdaddr);
3965 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
3966 memcpy(cp.randomizer, data->randomizer192,
3967 sizeof(cp.randomizer));
3968
3969 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
3970 sizeof(cp), &cp);
3971 }
2763eda6
SJ		 3972 } else {
3973 struct hci_cp_remote_oob_data_neg_reply cp;
3974
3975 bacpy(&cp.bdaddr, &ev->bdaddr);
519ca9d0
MH		 3976 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
3977 sizeof(cp), &cp);
2763eda6
SJ		 3978 }
3979
e1ba1f15 3980unlock:
2763eda6
SJ		 3981 hci_dev_unlock(hdev);
3982}
3983
d5e91192
AE		 3984static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3985 struct sk_buff *skb)
3986{
3987 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3988 struct hci_conn *hcon, *bredr_hcon;
3989
3990 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3991 ev->status);
3992
3993 hci_dev_lock(hdev);
3994
3995 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3996 if (!hcon) {
3997 hci_dev_unlock(hdev);
3998 return;
3999 }
4000
4001 if (ev->status) {
4002 hci_conn_del(hcon);
4003 hci_dev_unlock(hdev);
4004 return;
4005 }
4006
4007 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4008
4009 hcon->state = BT_CONNECTED;
4010 bacpy(&hcon->dst, &bredr_hcon->dst);
4011
4012 hci_conn_hold(hcon);
4013 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4014 hci_conn_drop(hcon);
d5e91192 4015
d5e91192
AE		 4016 hci_conn_add_sysfs(hcon);
4017
cf70ff22 4018 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4019
cf70ff22 4020 hci_dev_unlock(hdev);
d5e91192
AE		 4021}
4022
27695fb4
AE		 4023static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4024{
4025 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4026 struct hci_conn *hcon;
4027 struct hci_chan *hchan;
4028 struct amp_mgr *mgr;
4029
4030 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4031 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4032 ev->status);
4033
4034 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4035 if (!hcon)
4036 return;
4037
4038 /* Create AMP hchan */
4039 hchan = hci_chan_create(hcon);
4040 if (!hchan)
4041 return;
4042
4043 hchan->handle = le16_to_cpu(ev->handle);
4044
4045 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4046
4047 mgr = hcon->amp_mgr;
4048 if (mgr && mgr->bredr_chan) {
4049 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4050
4051 l2cap_chan_lock(bredr_chan);
4052
4053 bredr_chan->conn->mtu = hdev->block_mtu;
4054 l2cap_logical_cfm(bredr_chan, hchan, 0);
4055 hci_conn_hold(hcon);
4056
4057 l2cap_chan_unlock(bredr_chan);
4058 }
4059}
4060
606e2a10
AE		 4061static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4062 struct sk_buff *skb)
4063{
4064 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4065 struct hci_chan *hchan;
4066
4067 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4068 le16_to_cpu(ev->handle), ev->status);
4069
4070 if (ev->status)
4071 return;
4072
4073 hci_dev_lock(hdev);
4074
4075 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4076 if (!hchan)
4077 goto unlock;
4078
4079 amp_destroy_logical_link(hchan, ev->reason);
4080
4081unlock:
4082 hci_dev_unlock(hdev);
4083}
4084
9eef6b3a
AE		 4085static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4086 struct sk_buff *skb)
4087{
4088 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4089 struct hci_conn *hcon;
4090
4091 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4092
4093 if (ev->status)
4094 return;
4095
4096 hci_dev_lock(hdev);
4097
4098 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4099 if (hcon) {
4100 hcon->state = BT_CLOSED;
4101 hci_conn_del(hcon);
4102 }
4103
4104 hci_dev_unlock(hdev);
4105}
4106
6039aa73 4107static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4108{
4109 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
912b42ef 4110 struct hci_conn_params *params;
fcd89c09 4111 struct hci_conn *conn;
68d6f6de 4112 struct smp_irk *irk;
837d502e 4113 u8 addr_type;
fcd89c09 4114
9f1db00c 4115 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
fcd89c09
VT		 4116
4117 hci_dev_lock(hdev);
4118
fbd96c15
JH		 4119 /* All controllers implicitly stop advertising in the event of a
4120 * connection, so ensure that the state bit is cleared.
4121 */
4122 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4123
b47a09b3 4124 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
b62f328b 4125 if (!conn) {
a5c4e309 4126 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
b62f328b
VT		 4127 if (!conn) {
4128 BT_ERR("No memory for new connection");
230fd16a 4129 goto unlock;
b62f328b 4130 }
29b7988a
AG		 4131
4132 conn->dst_type = ev->bdaddr_type;
b9b343d2 4133
cb1d68f7
JH		 4134 /* If we didn't have a hci_conn object previously
4135 * but we're in master role this must be something
4136 * initiated using a white list. Since white list based
4137 * connections are not "first class citizens" we don't
4138 * have full tracking of them. Therefore, we go ahead
4139 * with a "best effort" approach of determining the
4140 * initiator address based on the HCI_PRIVACY flag.
4141 */
4142 if (conn->out) {
4143 conn->resp_addr_type = ev->bdaddr_type;
4144 bacpy(&conn->resp_addr, &ev->bdaddr);
4145 if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4146 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4147 bacpy(&conn->init_addr, &hdev->rpa);
4148 } else {
4149 hci_copy_identity_address(hdev,
4150 &conn->init_addr,
4151 &conn->init_addr_type);
4152 }
cb1d68f7 4153 }
9489eca4
JH		 4154 } else {
4155 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4156 }
fcd89c09 4157
80c24ab8
JH		 4158 if (!conn->out) {
4159 /* Set the responder (our side) address type based on
4160 * the advertising address type.
4161 */
4162 conn->resp_addr_type = hdev->adv_addr_type;
4163 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4164 bacpy(&conn->resp_addr, &hdev->random_addr);
4165 else
4166 bacpy(&conn->resp_addr, &hdev->bdaddr);
4167
4168 conn->init_addr_type = ev->bdaddr_type;
4169 bacpy(&conn->init_addr, &ev->bdaddr);
a720d735
MH		 4170
4171 /* For incoming connections, set the default minimum
4172 * and maximum connection interval. They will be used
4173 * to check if the parameters are in range and if not
4174 * trigger the connection update procedure.
4175 */
4176 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4177 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4178 }
7be2edbb 4179
edb4b466
MH		 4180 /* Lookup the identity address from the stored connection
4181 * address and address type.
4182 *
4183 * When establishing connections to an identity address, the
4184 * connection procedure will store the resolvable random
4185 * address first. Now if it can be converted back into the
4186 * identity address, start using the identity address from
4187 * now on.
4188 */
4189 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4190 if (irk) {
4191 bacpy(&conn->dst, &irk->bdaddr);
4192 conn->dst_type = irk->addr_type;
4193 }
4194
2d3c2260
JH		 4195 if (ev->status) {
4196 hci_le_conn_failed(conn, ev->status);
837d502e
JH		 4197 goto unlock;
4198 }
4199
08853f18
JH		 4200 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4201 addr_type = BDADDR_LE_PUBLIC;
4202 else
4203 addr_type = BDADDR_LE_RANDOM;
4204
2d3c2260
JH		 4205 /* Drop the connection if the device is blocked */
4206 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4207 hci_conn_drop(conn);
cd17decb
AG		 4208 goto unlock;
4209 }
4210
b644ba33 4211 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4212 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 4213
7b5c0d52 4214 conn->sec_level = BT_SECURITY_LOW;
fcd89c09
VT		 4215 conn->handle = __le16_to_cpu(ev->handle);
4216 conn->state = BT_CONNECTED;
4217
e04fde60
MH		 4218 conn->le_conn_interval = le16_to_cpu(ev->interval);
4219 conn->le_conn_latency = le16_to_cpu(ev->latency);
4220 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4221
fcd89c09
VT		 4222 hci_conn_add_sysfs(conn);
4223
4224 hci_proto_connect_cfm(conn, ev->status);
4225
5477610f
JH		 4226 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4227 conn->dst_type);
f161dd41 4228 if (params) {
95305baa 4229 list_del_init(&params->action);
f161dd41
JH		 4230 if (params->conn) {
4231 hci_conn_drop(params->conn);
f8aaf9b6 4232 hci_conn_put(params->conn);
f161dd41
JH		 4233 params->conn = NULL;
4234 }
4235 }
a4790dbd 4236
fcd89c09 4237unlock:
223683a5 4238 hci_update_background_scan(hdev);
fcd89c09
VT		 4239 hci_dev_unlock(hdev);
4240}
4241
1855d92d
MH		 4242static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4243 struct sk_buff *skb)
4244{
4245 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4246 struct hci_conn *conn;
4247
4248 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4249
4250 if (ev->status)
4251 return;
4252
4253 hci_dev_lock(hdev);
4254
4255 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4256 if (conn) {
4257 conn->le_conn_interval = le16_to_cpu(ev->interval);
4258 conn->le_conn_latency = le16_to_cpu(ev->latency);
4259 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4260 }
4261
4262 hci_dev_unlock(hdev);
4263}
4264
a4790dbd 4265/* This function requires the caller holds hdev->lock */
7e899c94 4266static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
1c1abcab 4267 u8 addr_type, u8 adv_type)
a4790dbd
AG		 4268{
4269 struct hci_conn *conn;
4b9e7e75 4270 struct hci_conn_params *params;
a4790dbd 4271
1c1abcab
JH		 4272 /* If the event is not connectable don't proceed further */
4273 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
7e899c94 4274 return;
1c1abcab
JH		 4275
4276 /* Ignore if the device is blocked */
dcc36c16 4277 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
7e899c94 4278 return;
1c1abcab 4279
f99353cf
JH		 4280 /* Most controller will fail if we try to create new connections
4281 * while we have an existing one in slave role.
4282 */
4283 if (hdev->conn_hash.le_num_slave > 0)
4284 return;
4285
1c1abcab
JH		 4286 /* If we're not connectable only connect devices that we have in
4287 * our pend_le_conns list.
4288 */
4b9e7e75
MH		 4289 params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4290 addr, addr_type);
4291 if (!params)
4292 return;
4293
4294 switch (params->auto_connect) {
4295 case HCI_AUTO_CONN_DIRECT:
4296 /* Only devices advertising with ADV_DIRECT_IND are
4297 * triggering a connection attempt. This is allowing
4298 * incoming connections from slave devices.
4299 */
4300 if (adv_type != LE_ADV_DIRECT_IND)
4301 return;
4302 break;
4303 case HCI_AUTO_CONN_ALWAYS:
4304 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4305 * are triggering a connection attempt. This means
4306 * that incoming connectioms from slave device are
4307 * accepted and also outgoing connections to slave
4308 * devices are established when found.
4309 */
4310 break;
4311 default:
7e899c94 4312 return;
4b9e7e75 4313 }
a4790dbd
AG		 4314
4315 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
e804d25d 4316 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
f161dd41
JH		 4317 if (!IS_ERR(conn)) {
4318 /* Store the pointer since we don't really have any
4319 * other owner of the object besides the params that
4320 * triggered it. This way we can abort the connection if
4321 * the parameters get removed and keep the reference
4322 * count consistent once the connection is established.
4323 */
f8aaf9b6 4324 params->conn = hci_conn_get(conn);
7e899c94 4325 return;
f161dd41 4326 }
a4790dbd
AG		 4327
4328 switch (PTR_ERR(conn)) {
4329 case -EBUSY:
4330 /* If hci_connect() returns -EBUSY it means there is already
4331 * an LE connection attempt going on. Since controllers don't
4332 * support more than one connection attempt at the time, we
4333 * don't consider this an error case.
4334 */
4335 break;
4336 default:
4337 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4338 }
4339}
4340
4af605d8
JH		 4341static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4342 u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
4343{
b9a6328f 4344 struct discovery_state *d = &hdev->discovery;
1c1abcab 4345 struct smp_irk *irk;
474ee066 4346 bool match;
c70a7e4c 4347 u32 flags;
b9a6328f 4348
1c1abcab
JH		 4349 /* Check if we need to convert to identity address */
4350 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4351 if (irk) {
4352 bdaddr = &irk->bdaddr;
4353 bdaddr_type = irk->addr_type;
4354 }
4355
4356 /* Check if we have been requested to connect to this device */
4357 check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4358
0d2bf134
JH		 4359 /* Passive scanning shouldn't trigger any device found events,
4360 * except for devices marked as CONN_REPORT for which we do send
4361 * device found events.
4362 */
ca5c4be7 4363 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 4364 if (type == LE_ADV_DIRECT_IND)
4365 return;
4366
3a19b6fe
JH		 4367 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4368 bdaddr, bdaddr_type))
0d2bf134
JH		 4369 return;
4370
4371 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4372 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4373 else
4374 flags = 0;
4375 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4376 rssi, flags, data, len, NULL, 0);
97bf2e99 4377 return;
ca5c4be7 4378 }
4af605d8 4379
c70a7e4c
MH		 4380 /* When receiving non-connectable or scannable undirected
4381 * advertising reports, this means that the remote device is
4382 * not connectable and then clearly indicate this in the
4383 * device found event.
4384 *
4385 * When receiving a scan response, then there is no way to
4386 * know if the remote device is connectable or not. However
4387 * since scan responses are merged with a previously seen
4388 * advertising report, the flags field from that report
4389 * will be used.
4390 *
4391 * In the really unlikely case that a controller get confused
4392 * and just sends a scan response event, then it is marked as
4393 * not connectable as well.
4394 */
4395 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4396 type == LE_ADV_SCAN_RSP)
4397 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4398 else
4399 flags = 0;
4400
b9a6328f
JH		 4401 /* If there's nothing pending either store the data from this
4402 * event or send an immediate device found event if the data
4403 * should not be stored for later.
4404 */
4405 if (!has_pending_adv_report(hdev)) {
4406 /* If the report will trigger a SCAN_REQ store it for
4407 * later merging.
4408 */
4409 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4410 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4411 rssi, flags, data, len);
b9a6328f
JH		 4412 return;
4413 }
4414
4415 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4416 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4417 return;
4418 }
4419
474ee066
JH		 4420 /* Check if the pending report is for the same device as the new one */
4421 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4422 bdaddr_type == d->last_adv_addr_type);
4423
b9a6328f
JH		 4424 /* If the pending data doesn't match this report or this isn't a
4425 * scan response (e.g. we got a duplicate ADV_IND) then force
4426 * sending of the pending data.
4427 */
474ee066
JH		 4428 if (type != LE_ADV_SCAN_RSP || !match) {
4429 /* Send out whatever is in the cache, but skip duplicates */
4430 if (!match)
4431 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 4432 d->last_adv_addr_type, NULL,
c70a7e4c 4433 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 4434 d->last_adv_data,
474ee066 4435 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 4436
4437 /* If the new report will trigger a SCAN_REQ store it for
4438 * later merging.
4439 */
4440 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4441 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 4442 rssi, flags, data, len);
b9a6328f
JH		 4443 return;
4444 }
4445
4446 /* The advertising reports cannot be merged, so clear
4447 * the pending report and send out a device found event.
4448 */
4449 clear_pending_adv_report(hdev);
5c5b93e4 4450 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 4451 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 4452 return;
4453 }
4454
4455 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4456 * the new event is a SCAN_RSP. We can therefore proceed with
4457 * sending a merged device found event.
4458 */
4459 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 4460 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 4461 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 4462 clear_pending_adv_report(hdev);
4af605d8
JH		 4463}
4464
6039aa73 4465static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 4466{
e95beb41
AG		 4467 u8 num_reports = skb->data[0];
4468 void *ptr = &skb->data[1];
9aa04c91 4469
a4790dbd
AG		 4470 hci_dev_lock(hdev);
4471
e95beb41
AG		 4472 while (num_reports--) {
4473 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 4474 s8 rssi;
a4790dbd 4475
3c9e9195 4476 rssi = ev->data[ev->length];
4af605d8
JH		 4477 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4478 ev->bdaddr_type, rssi, ev->data, ev->length);
3c9e9195 4479
e95beb41 4480 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 4481 }
a4790dbd
AG		 4482
4483 hci_dev_unlock(hdev);
9aa04c91
AG		 4484}
4485
6039aa73 4486static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 4487{
4488 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4489 struct hci_cp_le_ltk_reply cp;
bea710fe 4490 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 4491 struct hci_conn *conn;
c9839a11 4492 struct smp_ltk *ltk;
a7a595f6 4493
9f1db00c 4494 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 4495
4496 hci_dev_lock(hdev);
4497
4498 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 4499 if (conn == NULL)
4500 goto not_found;
a7a595f6 4501
e804d25d 4502 ltk = hci_find_ltk(hdev, ev->ediv, ev->rand, conn->role);
bea710fe
VCG		 4503 if (ltk == NULL)
4504 goto not_found;
4505
4506 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
a7a595f6 4507 cp.handle = cpu_to_le16(conn->handle);
c9839a11 4508
a6f7833c 4509 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 4510
89cbb4da 4511 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 4512
4513 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4514
5981a882
CT		 4515 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4516 * temporary key used to encrypt a connection following
4517 * pairing. It is used during the Encrypted Session Setup to
4518 * distribute the keys. Later, security can be re-established
4519 * using a distributed LTK.
4520 */
2ceba539 4521 if (ltk->type == SMP_STK) {
fe59a05f 4522 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 4523 list_del(&ltk->list);
4524 kfree(ltk);
fe59a05f
JH		 4525 } else {
4526 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 4527 }
4528
a7a595f6 4529 hci_dev_unlock(hdev);
bea710fe
VCG		 4530
4531 return;
4532
4533not_found:
4534 neg.handle = ev->handle;
4535 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4536 hci_dev_unlock(hdev);
a7a595f6
VCG		 4537}
4538
8e75b46a
AG		 4539static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4540 u8 reason)
4541{
4542 struct hci_cp_le_conn_param_req_neg_reply cp;
4543
4544 cp.handle = cpu_to_le16(handle);
4545 cp.reason = reason;
4546
4547 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4548 &cp);
4549}
4550
4551static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4552 struct sk_buff *skb)
4553{
4554 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4555 struct hci_cp_le_conn_param_req_reply cp;
4556 struct hci_conn *hcon;
4557 u16 handle, min, max, latency, timeout;
4558
4559 handle = le16_to_cpu(ev->handle);
4560 min = le16_to_cpu(ev->interval_min);
4561 max = le16_to_cpu(ev->interval_max);
4562 latency = le16_to_cpu(ev->latency);
4563 timeout = le16_to_cpu(ev->timeout);
4564
4565 hcon = hci_conn_hash_lookup_handle(hdev, handle);
4566 if (!hcon || hcon->state != BT_CONNECTED)
4567 return send_conn_param_neg_reply(hdev, handle,
4568 HCI_ERROR_UNKNOWN_CONN_ID);
4569
4570 if (hci_check_conn_params(min, max, latency, timeout))
4571 return send_conn_param_neg_reply(hdev, handle,
4572 HCI_ERROR_INVALID_LL_PARAMS);
4573
40bef302 4574 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 4575 struct hci_conn_params *params;
f4869e2a 4576 u8 store_hint;
348d50b8
JH		 4577
4578 hci_dev_lock(hdev);
4579
4580 params = hci_conn_params_lookup(hdev, &hcon->dst,
4581 hcon->dst_type);
4582 if (params) {
4583 params->conn_min_interval = min;
4584 params->conn_max_interval = max;
4585 params->conn_latency = latency;
4586 params->supervision_timeout = timeout;
f4869e2a
JH		 4587 store_hint = 0x01;
4588 } else{
4589 store_hint = 0x00;
348d50b8
JH		 4590 }
4591
4592 hci_dev_unlock(hdev);
4593
f4869e2a
JH		 4594 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4595 store_hint, min, max, latency, timeout);
348d50b8 4596 }
ffb5a827 4597
8e75b46a
AG		 4598 cp.handle = ev->handle;
4599 cp.interval_min = ev->interval_min;
4600 cp.interval_max = ev->interval_max;
4601 cp.latency = ev->latency;
4602 cp.timeout = ev->timeout;
4603 cp.min_ce_len = 0;
4604 cp.max_ce_len = 0;
4605
4606 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4607}
4608
6039aa73 4609static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 4610{
4611 struct hci_ev_le_meta *le_ev = (void *) skb->data;
4612
4613 skb_pull(skb, sizeof(*le_ev));
4614
4615 switch (le_ev->subevent) {
4616 case HCI_EV_LE_CONN_COMPLETE:
4617 hci_le_conn_complete_evt(hdev, skb);
4618 break;
4619
1855d92d
MH		 4620 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4621 hci_le_conn_update_complete_evt(hdev, skb);
4622 break;
4623
9aa04c91
AG		 4624 case HCI_EV_LE_ADVERTISING_REPORT:
4625 hci_le_adv_report_evt(hdev, skb);
4626 break;
4627
a7a595f6
VCG		 4628 case HCI_EV_LE_LTK_REQ:
4629 hci_le_ltk_request_evt(hdev, skb);
4630 break;
4631
8e75b46a
AG		 4632 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
4633 hci_le_remote_conn_param_req_evt(hdev, skb);
4634 break;
4635
fcd89c09
VT		 4636 default:
4637 break;
4638 }
4639}
4640
9495b2ee
AE		 4641static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4642{
4643 struct hci_ev_channel_selected *ev = (void *) skb->data;
4644 struct hci_conn *hcon;
4645
4646 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4647
4648 skb_pull(skb, sizeof(*ev));
4649
4650 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4651 if (!hcon)
4652 return;
4653
4654 amp_read_loc_assoc_final_data(hdev, hcon);
4655}
4656
a9de9248
MH		 4657void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4658{
4659 struct hci_event_hdr *hdr = (void *) skb->data;
4660 __u8 event = hdr->evt;
4661
b6ddb638
JH		 4662 hci_dev_lock(hdev);
4663
4664 /* Received events are (currently) only needed when a request is
4665 * ongoing so avoid unnecessary memory allocation.
4666 */
899de765 4667 if (hci_req_pending(hdev)) {
b6ddb638
JH		 4668 kfree_skb(hdev->recv_evt);
4669 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4670 }
4671
4672 hci_dev_unlock(hdev);
4673
a9de9248
MH		 4674 skb_pull(skb, HCI_EVENT_HDR_SIZE);
4675
02350a72 4676 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
c1f23a2b
JB		 4677 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
4678 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
02350a72
JH		 4679
4680 hci_req_cmd_complete(hdev, opcode, 0);
4681 }
4682
a9de9248 4683 switch (event) {
1da177e4
LT		 4684 case HCI_EV_INQUIRY_COMPLETE:
4685 hci_inquiry_complete_evt(hdev, skb);
4686 break;
4687
4688 case HCI_EV_INQUIRY_RESULT:
4689 hci_inquiry_result_evt(hdev, skb);
4690 break;
4691
a9de9248
MH		 4692 case HCI_EV_CONN_COMPLETE:
4693 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 4694 break;
4695
1da177e4
LT		 4696 case HCI_EV_CONN_REQUEST:
4697 hci_conn_request_evt(hdev, skb);
4698 break;
4699
1da177e4
LT		 4700 case HCI_EV_DISCONN_COMPLETE:
4701 hci_disconn_complete_evt(hdev, skb);
4702 break;
4703
1da177e4
LT		 4704 case HCI_EV_AUTH_COMPLETE:
4705 hci_auth_complete_evt(hdev, skb);
4706 break;
4707
a9de9248
MH		 4708 case HCI_EV_REMOTE_NAME:
4709 hci_remote_name_evt(hdev, skb);
4710 break;
4711
1da177e4
LT		 4712 case HCI_EV_ENCRYPT_CHANGE:
4713 hci_encrypt_change_evt(hdev, skb);
4714 break;
4715
a9de9248
MH		 4716 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
4717 hci_change_link_key_complete_evt(hdev, skb);
4718 break;
4719
4720 case HCI_EV_REMOTE_FEATURES:
4721 hci_remote_features_evt(hdev, skb);
4722 break;
4723
a9de9248
MH		 4724 case HCI_EV_CMD_COMPLETE:
4725 hci_cmd_complete_evt(hdev, skb);
4726 break;
4727
4728 case HCI_EV_CMD_STATUS:
4729 hci_cmd_status_evt(hdev, skb);
4730 break;
4731
4732 case HCI_EV_ROLE_CHANGE:
4733 hci_role_change_evt(hdev, skb);
4734 break;
4735
4736 case HCI_EV_NUM_COMP_PKTS:
4737 hci_num_comp_pkts_evt(hdev, skb);
4738 break;
4739
4740 case HCI_EV_MODE_CHANGE:
4741 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 4742 break;
4743
4744 case HCI_EV_PIN_CODE_REQ:
4745 hci_pin_code_request_evt(hdev, skb);
4746 break;
4747
4748 case HCI_EV_LINK_KEY_REQ:
4749 hci_link_key_request_evt(hdev, skb);
4750 break;
4751
4752 case HCI_EV_LINK_KEY_NOTIFY:
4753 hci_link_key_notify_evt(hdev, skb);
4754 break;
4755
4756 case HCI_EV_CLOCK_OFFSET:
4757 hci_clock_offset_evt(hdev, skb);
4758 break;
4759
a8746417
MH		 4760 case HCI_EV_PKT_TYPE_CHANGE:
4761 hci_pkt_type_change_evt(hdev, skb);
4762 break;
4763
85a1e930
MH		 4764 case HCI_EV_PSCAN_REP_MODE:
4765 hci_pscan_rep_mode_evt(hdev, skb);
4766 break;
4767
a9de9248
MH		 4768 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
4769 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 4770 break;
4771
a9de9248
MH		 4772 case HCI_EV_REMOTE_EXT_FEATURES:
4773 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 4774 break;
4775
a9de9248
MH		 4776 case HCI_EV_SYNC_CONN_COMPLETE:
4777 hci_sync_conn_complete_evt(hdev, skb);
4778 break;
1da177e4 4779
a9de9248
MH		 4780 case HCI_EV_EXTENDED_INQUIRY_RESULT:
4781 hci_extended_inquiry_result_evt(hdev, skb);
4782 break;
1da177e4 4783
1c2e0041
JH		 4784 case HCI_EV_KEY_REFRESH_COMPLETE:
4785 hci_key_refresh_complete_evt(hdev, skb);
4786 break;
4787
0493684e
MH		 4788 case HCI_EV_IO_CAPA_REQUEST:
4789 hci_io_capa_request_evt(hdev, skb);
4790 break;
4791
03b555e1
JH		 4792 case HCI_EV_IO_CAPA_REPLY:
4793 hci_io_capa_reply_evt(hdev, skb);
4794 break;
4795
a5c29683
JH		 4796 case HCI_EV_USER_CONFIRM_REQUEST:
4797 hci_user_confirm_request_evt(hdev, skb);
4798 break;
4799
1143d458
BG		 4800 case HCI_EV_USER_PASSKEY_REQUEST:
4801 hci_user_passkey_request_evt(hdev, skb);
4802 break;
4803
92a25256
JH		 4804 case HCI_EV_USER_PASSKEY_NOTIFY:
4805 hci_user_passkey_notify_evt(hdev, skb);
4806 break;
4807
4808 case HCI_EV_KEYPRESS_NOTIFY:
4809 hci_keypress_notify_evt(hdev, skb);
4810 break;
4811
0493684e
MH		 4812 case HCI_EV_SIMPLE_PAIR_COMPLETE:
4813 hci_simple_pair_complete_evt(hdev, skb);
4814 break;
4815
41a96212
MH		 4816 case HCI_EV_REMOTE_HOST_FEATURES:
4817 hci_remote_host_features_evt(hdev, skb);
4818 break;
4819
fcd89c09
VT		 4820 case HCI_EV_LE_META:
4821 hci_le_meta_evt(hdev, skb);
4822 break;
4823
9495b2ee
AE		 4824 case HCI_EV_CHANNEL_SELECTED:
4825 hci_chan_selected_evt(hdev, skb);
4826 break;
4827
2763eda6
SJ		 4828 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4829 hci_remote_oob_data_request_evt(hdev, skb);
4830 break;
4831
d5e91192
AE		 4832 case HCI_EV_PHY_LINK_COMPLETE:
4833 hci_phy_link_complete_evt(hdev, skb);
4834 break;
4835
27695fb4
AE		 4836 case HCI_EV_LOGICAL_LINK_COMPLETE:
4837 hci_loglink_complete_evt(hdev, skb);
4838 break;
4839
606e2a10
AE		 4840 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
4841 hci_disconn_loglink_complete_evt(hdev, skb);
4842 break;
4843
9eef6b3a
AE		 4844 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
4845 hci_disconn_phylink_complete_evt(hdev, skb);
4846 break;
4847
25e89e99
AE		 4848 case HCI_EV_NUM_COMP_BLOCKS:
4849 hci_num_comp_blocks_evt(hdev, skb);
4850 break;
4851
a9de9248 4852 default:
9f1db00c 4853 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 4854 break;
4855 }
4856
4857 kfree_skb(skb);
4858 hdev->stat.evt_rx++;
4859}
ubuntu-bionic-kernel mirror