]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/hci_event.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Delay LTK encryption to let remote receive all keys
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
7024728e 33#include "a2mp.h"
7ef9fbf0 34#include "amp.h"
1da177e4 35
1da177e4
LT		 36/* Handle HCI Event packets */
37
a9de9248 38static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 39{
a9de9248 40 __u8 status = *((__u8 *) skb->data);
1da177e4 41
9f1db00c 42 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 43
82f4785c 44 if (status)
a9de9248 45 return;
1da177e4 46
89352e7d 47 clear_bit(HCI_INQUIRY, &hdev->flags);
3e13fa1e
AG		 48 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
49 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 50
a9de9248
MH		 51 hci_conn_check_pending(hdev);
52}
6bd57416 53
4d93483b
AG		 54static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
55{
56 __u8 status = *((__u8 *) skb->data);
57
9f1db00c 58 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 59
60 if (status)
61 return;
62
63 set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
4d93483b
AG		 64}
65
a9de9248
MH		 66static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
67{
68 __u8 status = *((__u8 *) skb->data);
6bd57416 69
9f1db00c 70 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 71
a9de9248
MH		 72 if (status)
73 return;
1da177e4 74
ae854a70
AG		 75 clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
76
a9de9248
MH		 77 hci_conn_check_pending(hdev);
78}
79
807deac2
GP		 80static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
81 struct sk_buff *skb)
a9de9248
MH		 82{
83 BT_DBG("%s", hdev->name);
84}
85
86static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
87{
88 struct hci_rp_role_discovery *rp = (void *) skb->data;
89 struct hci_conn *conn;
90
9f1db00c 91 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 92
93 if (rp->status)
94 return;
95
96 hci_dev_lock(hdev);
97
98 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
99 if (conn) {
100 if (rp->role)
101 conn->link_mode &= ~HCI_LM_MASTER;
102 else
103 conn->link_mode |= HCI_LM_MASTER;
1da177e4 104 }
a9de9248
MH		 105
106 hci_dev_unlock(hdev);
1da177e4
LT		 107}
108
e4e8e37c
MH		 109static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
110{
111 struct hci_rp_read_link_policy *rp = (void *) skb->data;
112 struct hci_conn *conn;
113
9f1db00c 114 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 115
116 if (rp->status)
117 return;
118
119 hci_dev_lock(hdev);
120
121 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
122 if (conn)
123 conn->link_policy = __le16_to_cpu(rp->policy);
124
125 hci_dev_unlock(hdev);
126}
127
a9de9248 128static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 129{
a9de9248 130 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 131 struct hci_conn *conn;
04837f64 132 void *sent;
1da177e4 133
9f1db00c 134 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 135
a9de9248
MH		 136 if (rp->status)
137 return;
1da177e4 138
a9de9248
MH		 139 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
140 if (!sent)
141 return;
1da177e4 142
a9de9248 143 hci_dev_lock(hdev);
1da177e4 144
a9de9248 145 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 146 if (conn)
83985319 147 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 148
a9de9248
MH		 149 hci_dev_unlock(hdev);
150}
1da177e4 151
807deac2
GP		 152static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
153 struct sk_buff *skb)
e4e8e37c
MH		 154{
155 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
156
9f1db00c 157 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 158
159 if (rp->status)
160 return;
161
162 hdev->link_policy = __le16_to_cpu(rp->policy);
163}
164
807deac2
GP		 165static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
166 struct sk_buff *skb)
e4e8e37c
MH		 167{
168 __u8 status = *((__u8 *) skb->data);
169 void *sent;
170
9f1db00c 171 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c
MH		 172
173 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
174 if (!sent)
175 return;
176
177 if (!status)
178 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 179}
180
a9de9248
MH		 181static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
182{
183 __u8 status = *((__u8 *) skb->data);
04837f64 184
9f1db00c 185 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 186
10572132
GP		 187 clear_bit(HCI_RESET, &hdev->flags);
188
a297e97c 189 /* Reset all non-persistent flags */
2cc6fb00 190 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
69775ff6
AG		 191
192 hdev->discovery.state = DISCOVERY_STOPPED;
bbaf444a
JH		 193 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
194 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 195
196 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
197 hdev->adv_data_len = 0;
f8e808bd
MH		 198
199 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
200 hdev->scan_rsp_data_len = 0;
06f5b778
MH		 201
202 hdev->ssp_debug_mode = 0;
a9de9248 203}
04837f64 204
a9de9248
MH		 205static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
206{
207 __u8 status = *((__u8 *) skb->data);
208 void *sent;
04837f64 209
9f1db00c 210 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 211
a9de9248
MH		 212 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
213 if (!sent)
214 return;
04837f64 215
56e5cb86
JH		 216 hci_dev_lock(hdev);
217
f51d5b24
JH		 218 if (test_bit(HCI_MGMT, &hdev->dev_flags))
219 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 220 else if (!status)
221 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 222
56e5cb86 223 hci_dev_unlock(hdev);
a9de9248
MH		 224}
225
226static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
227{
228 struct hci_rp_read_local_name *rp = (void *) skb->data;
229
9f1db00c 230 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 231
232 if (rp->status)
233 return;
234
db99b5fc
JH		 235 if (test_bit(HCI_SETUP, &hdev->dev_flags))
236 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 237}
238
239static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
240{
241 __u8 status = *((__u8 *) skb->data);
242 void *sent;
243
9f1db00c 244 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 245
246 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
247 if (!sent)
248 return;
249
250 if (!status) {
251 __u8 param = *((__u8 *) sent);
252
253 if (param == AUTH_ENABLED)
254 set_bit(HCI_AUTH, &hdev->flags);
255 else
256 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 257 }
a9de9248 258
33ef95ed
JH		 259 if (test_bit(HCI_MGMT, &hdev->dev_flags))
260 mgmt_auth_enable_complete(hdev, status);
1da177e4
LT		 261}
262
a9de9248 263static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 264{
a9de9248 265 __u8 status = *((__u8 *) skb->data);
1da177e4
LT		 266 void *sent;
267
9f1db00c 268 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 269
a9de9248
MH		 270 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
271 if (!sent)
272 return;
1da177e4 273
a9de9248
MH		 274 if (!status) {
275 __u8 param = *((__u8 *) sent);
276
277 if (param)
278 set_bit(HCI_ENCRYPT, &hdev->flags);
279 else
280 clear_bit(HCI_ENCRYPT, &hdev->flags);
281 }
a9de9248 282}
1da177e4 283
a9de9248
MH		 284static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
285{
36f7fc7e
JH		 286 __u8 param, status = *((__u8 *) skb->data);
287 int old_pscan, old_iscan;
a9de9248 288 void *sent;
1da177e4 289
9f1db00c 290 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 291
a9de9248
MH		 292 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
293 if (!sent)
294 return;
1da177e4 295
36f7fc7e
JH		 296 param = *((__u8 *) sent);
297
56e5cb86
JH		 298 hci_dev_lock(hdev);
299
fa1bd918 300 if (status) {
744cf19e 301 mgmt_write_scan_failed(hdev, param, status);
2d7cee58
JH		 302 hdev->discov_timeout = 0;
303 goto done;
304 }
305
0663ca2a
JH		 306 /* We need to ensure that we set this back on if someone changed
307 * the scan mode through a raw HCI socket.
308 */
309 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
310
36f7fc7e
JH		 311 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
312 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
313
314 if (param & SCAN_INQUIRY) {
315 set_bit(HCI_ISCAN, &hdev->flags);
316 if (!old_iscan)
744cf19e 317 mgmt_discoverable(hdev, 1);
36f7fc7e 318 } else if (old_iscan)
744cf19e 319 mgmt_discoverable(hdev, 0);
36f7fc7e
JH		 320
321 if (param & SCAN_PAGE) {
322 set_bit(HCI_PSCAN, &hdev->flags);
323 if (!old_pscan)
744cf19e 324 mgmt_connectable(hdev, 1);
36f7fc7e 325 } else if (old_pscan)
744cf19e 326 mgmt_connectable(hdev, 0);
1da177e4 327
36f7fc7e 328done:
56e5cb86 329 hci_dev_unlock(hdev);
a9de9248 330}
1da177e4 331
a9de9248
MH		 332static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
333{
334 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 335
9f1db00c 336 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 337
a9de9248
MH		 338 if (rp->status)
339 return;
1da177e4 340
a9de9248 341 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 342
a9de9248 343 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 344 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 345}
1da177e4 346
a9de9248
MH		 347static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
348{
349 __u8 status = *((__u8 *) skb->data);
350 void *sent;
1da177e4 351
9f1db00c 352 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 353
a9de9248
MH		 354 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
355 if (!sent)
356 return;
1da177e4 357
7f9a903c
MH		 358 hci_dev_lock(hdev);
359
360 if (status == 0)
361 memcpy(hdev->dev_class, sent, 3);
362
363 if (test_bit(HCI_MGMT, &hdev->dev_flags))
364 mgmt_set_class_of_dev_complete(hdev, sent, status);
365
366 hci_dev_unlock(hdev);
a9de9248 367}
1da177e4 368
a9de9248
MH		 369static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
370{
371 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
372 __u16 setting;
373
9f1db00c 374 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 375
376 if (rp->status)
377 return;
378
379 setting = __le16_to_cpu(rp->voice_setting);
380
f383f275 381 if (hdev->voice_setting == setting)
a9de9248
MH		 382 return;
383
384 hdev->voice_setting = setting;
385
9f1db00c 386 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 387
3c54711c 388 if (hdev->notify)
a9de9248 389 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 390}
391
8fc9ced3
GP		 392static void hci_cc_write_voice_setting(struct hci_dev *hdev,
393 struct sk_buff *skb)
a9de9248
MH		 394{
395 __u8 status = *((__u8 *) skb->data);
f383f275 396 __u16 setting;
a9de9248
MH		 397 void *sent;
398
9f1db00c 399 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 400
f383f275
MH		 401 if (status)
402 return;
403
a9de9248
MH		 404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
405 if (!sent)
406 return;
1da177e4 407
f383f275 408 setting = get_unaligned_le16(sent);
1da177e4 409
f383f275
MH		 410 if (hdev->voice_setting == setting)
411 return;
412
413 hdev->voice_setting = setting;
1da177e4 414
9f1db00c 415 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 416
3c54711c 417 if (hdev->notify)
f383f275 418 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 419}
420
b4cb9fb2
MH		 421static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
422 struct sk_buff *skb)
423{
424 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
425
426 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
427
428 if (rp->status)
429 return;
430
431 hdev->num_iac = rp->num_iac;
432
433 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
434}
435
333140b5
MH		 436static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
437{
438 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 439 struct hci_cp_write_ssp_mode *sent;
333140b5 440
9f1db00c 441 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 442
333140b5
MH		 443 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
444 if (!sent)
445 return;
446
5ed8eb2f
JH		 447 if (!status) {
448 if (sent->mode)
cad718ed 449 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 450 else
cad718ed 451 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 452 }
453
ed2c4ee3 454 if (test_bit(HCI_MGMT, &hdev->dev_flags))
5ed8eb2f 455 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 456 else if (!status) {
5ed8eb2f 457 if (sent->mode)
c0ecddc2
JH		 458 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
459 else
460 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
461 }
333140b5
MH		 462}
463
eac83dc6
MH		 464static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
465{
466 u8 status = *((u8 *) skb->data);
467 struct hci_cp_write_sc_support *sent;
468
469 BT_DBG("%s status 0x%2.2x", hdev->name, status);
470
471 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
472 if (!sent)
473 return;
474
475 if (!status) {
476 if (sent->support)
477 hdev->features[1][0] |= LMP_HOST_SC;
478 else
479 hdev->features[1][0] &= ~LMP_HOST_SC;
480 }
481
482 if (test_bit(HCI_MGMT, &hdev->dev_flags))
483 mgmt_sc_enable_complete(hdev, sent->support, status);
484 else if (!status) {
485 if (sent->support)
486 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
487 else
488 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
489 }
490}
491
a9de9248
MH		 492static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
493{
494 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 495
9f1db00c 496 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 497
a9de9248 498 if (rp->status)
42c6b129 499 return;
1143e5a6 500
0d5551f5
MH		 501 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
502 hdev->hci_ver = rp->hci_ver;
503 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
504 hdev->lmp_ver = rp->lmp_ver;
505 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
506 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
507 }
d5859e22
JH		 508}
509
8fc9ced3
GP		 510static void hci_cc_read_local_commands(struct hci_dev *hdev,
511 struct sk_buff *skb)
a9de9248
MH		 512{
513 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 514
9f1db00c 515 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 516
6a070e6e
MH		 517 if (rp->status)
518 return;
519
520 if (test_bit(HCI_SETUP, &hdev->dev_flags))
2177bab5 521 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 522}
1da177e4 523
8fc9ced3
GP		 524static void hci_cc_read_local_features(struct hci_dev *hdev,
525 struct sk_buff *skb)
a9de9248
MH		 526{
527 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 528
9f1db00c 529 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 530
a9de9248
MH		 531 if (rp->status)
532 return;
5b7f9909 533
a9de9248 534 memcpy(hdev->features, rp->features, 8);
5b7f9909 535
a9de9248
MH		 536 /* Adjust default settings according to features
537 * supported by device. */
1da177e4 538
cad718ed 539 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 540 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 541
cad718ed 542 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 543 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 544
cad718ed 545 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 546 hdev->pkt_type |= (HCI_HV2);
547 hdev->esco_type |= (ESCO_HV2);
548 }
1da177e4 549
cad718ed 550 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 551 hdev->pkt_type |= (HCI_HV3);
552 hdev->esco_type |= (ESCO_HV3);
553 }
1da177e4 554
45db810f 555 if (lmp_esco_capable(hdev))
a9de9248 556 hdev->esco_type |= (ESCO_EV3);
da1f5198 557
cad718ed 558 if (hdev->features[0][4] & LMP_EV4)
a9de9248 559 hdev->esco_type |= (ESCO_EV4);
da1f5198 560
cad718ed 561 if (hdev->features[0][4] & LMP_EV5)
a9de9248 562 hdev->esco_type |= (ESCO_EV5);
1da177e4 563
cad718ed 564 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 565 hdev->esco_type |= (ESCO_2EV3);
566
cad718ed 567 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 568 hdev->esco_type |= (ESCO_3EV3);
569
cad718ed 570 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 571 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 572}
1da177e4 573
971e3a4b 574static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 575 struct sk_buff *skb)
971e3a4b
AG		 576{
577 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
578
9f1db00c 579 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 580
581 if (rp->status)
42c6b129 582 return;
971e3a4b 583
57af75a8
MH		 584 if (hdev->max_page < rp->max_page)
585 hdev->max_page = rp->max_page;
d2c5d77f 586
cad718ed
JH		 587 if (rp->page < HCI_MAX_PAGES)
588 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 589}
590
1e89cffb 591static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 592 struct sk_buff *skb)
1e89cffb
AE		 593{
594 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
595
9f1db00c 596 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 597
42c6b129
JH		 598 if (!rp->status)
599 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 600}
601
a9de9248
MH		 602static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
603{
604 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 605
9f1db00c 606 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 607
a9de9248
MH		 608 if (rp->status)
609 return;
1da177e4 610
a9de9248
MH		 611 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
612 hdev->sco_mtu = rp->sco_mtu;
613 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
614 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
615
616 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
617 hdev->sco_mtu = 64;
618 hdev->sco_pkts = 8;
1da177e4 619 }
a9de9248
MH		 620
621 hdev->acl_cnt = hdev->acl_pkts;
622 hdev->sco_cnt = hdev->sco_pkts;
623
807deac2
GP		 624 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
625 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 626}
627
628static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
629{
630 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
631
9f1db00c 632 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 633
634 if (!rp->status)
635 bacpy(&hdev->bdaddr, &rp->bdaddr);
23bb5763
JH		 636}
637
f332ec66
JH		 638static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
639 struct sk_buff *skb)
640{
641 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
642
643 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
644
645 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
646 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
647 hdev->page_scan_window = __le16_to_cpu(rp->window);
648 }
649}
650
4a3ee763
JH		 651static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
652 struct sk_buff *skb)
653{
654 u8 status = *((u8 *) skb->data);
655 struct hci_cp_write_page_scan_activity *sent;
656
657 BT_DBG("%s status 0x%2.2x", hdev->name, status);
658
659 if (status)
660 return;
661
662 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
663 if (!sent)
664 return;
665
666 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
667 hdev->page_scan_window = __le16_to_cpu(sent->window);
668}
669
f332ec66
JH		 670static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
671 struct sk_buff *skb)
672{
673 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
674
675 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
676
677 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
678 hdev->page_scan_type = rp->type;
679}
680
4a3ee763
JH		 681static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
682 struct sk_buff *skb)
683{
684 u8 status = *((u8 *) skb->data);
685 u8 *type;
686
687 BT_DBG("%s status 0x%2.2x", hdev->name, status);
688
689 if (status)
690 return;
691
692 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
693 if (type)
694 hdev->page_scan_type = *type;
695}
696
350ee4cf 697static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 698 struct sk_buff *skb)
350ee4cf
AE		 699{
700 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
701
9f1db00c 702 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 703
704 if (rp->status)
705 return;
706
707 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
708 hdev->block_len = __le16_to_cpu(rp->block_len);
709 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
710
711 hdev->block_cnt = hdev->num_blocks;
712
713 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 714 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 715}
716
928abaa7 717static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 718 struct sk_buff *skb)
928abaa7
AE		 719{
720 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
721
9f1db00c 722 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 723
724 if (rp->status)
8e2a0d92 725 goto a2mp_rsp;
928abaa7
AE		 726
727 hdev->amp_status = rp->amp_status;
728 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
729 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
730 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
731 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
732 hdev->amp_type = rp->amp_type;
733 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
734 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
735 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
736 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
737
8e2a0d92
AE		 738a2mp_rsp:
739 a2mp_send_getinfo_rsp(hdev);
928abaa7
AE		 740}
741
903e4541
AE		 742static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
743 struct sk_buff *skb)
744{
745 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
746 struct amp_assoc *assoc = &hdev->loc_assoc;
747 size_t rem_len, frag_len;
748
749 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
750
751 if (rp->status)
752 goto a2mp_rsp;
753
754 frag_len = skb->len - sizeof(*rp);
755 rem_len = __le16_to_cpu(rp->rem_len);
756
757 if (rem_len > frag_len) {
2e430be3 758 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
903e4541
AE		 759
760 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
761 assoc->offset += frag_len;
762
763 /* Read other fragments */
764 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
765
766 return;
767 }
768
769 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
770 assoc->len = assoc->offset + rem_len;
771 assoc->offset = 0;
772
773a2mp_rsp:
774 /* Send A2MP Rsp when all fragments are received */
775 a2mp_send_getampassoc_rsp(hdev, rp->status);
9495b2ee 776 a2mp_send_create_phy_link_req(hdev, rp->status);
903e4541
AE		 777}
778
d5859e22 779static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 780 struct sk_buff *skb)
d5859e22 781{
91c4e9b1 782 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 783
9f1db00c 784 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1
MH		 785
786 if (!rp->status)
787 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 788}
789
980e1a53
JH		 790static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
791{
792 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
793 struct hci_cp_pin_code_reply *cp;
794 struct hci_conn *conn;
795
9f1db00c 796 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 797
56e5cb86
JH		 798 hci_dev_lock(hdev);
799
a8b2d5c2 800 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 801 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 802
fa1bd918 803 if (rp->status)
56e5cb86 804 goto unlock;
980e1a53
JH		 805
806 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
807 if (!cp)
56e5cb86 808 goto unlock;
980e1a53
JH		 809
810 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
811 if (conn)
812 conn->pin_length = cp->pin_len;
56e5cb86
JH		 813
814unlock:
815 hci_dev_unlock(hdev);
980e1a53
JH		 816}
817
818static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
819{
820 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
821
9f1db00c 822 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 823
56e5cb86
JH		 824 hci_dev_lock(hdev);
825
a8b2d5c2 826 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 827 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 828 rp->status);
56e5cb86
JH		 829
830 hci_dev_unlock(hdev);
980e1a53 831}
56e5cb86 832
6ed58ec5
VT		 833static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
834 struct sk_buff *skb)
835{
836 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
837
9f1db00c 838 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 839
840 if (rp->status)
841 return;
842
843 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
844 hdev->le_pkts = rp->le_max_pkt;
845
846 hdev->le_cnt = hdev->le_pkts;
847
848 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 849}
980e1a53 850
60e77321
JH		 851static void hci_cc_le_read_local_features(struct hci_dev *hdev,
852 struct sk_buff *skb)
853{
854 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
855
856 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
857
858 if (!rp->status)
859 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 860}
861
8fa19098
JH		 862static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
863 struct sk_buff *skb)
864{
865 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
866
867 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
868
04b4edcb 869 if (!rp->status)
8fa19098 870 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 871}
872
a5c29683
JH		 873static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
874{
875 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
876
9f1db00c 877 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 878
56e5cb86
JH		 879 hci_dev_lock(hdev);
880
a8b2d5c2 881 if (test_bit(HCI_MGMT, &hdev->dev_flags))
04124681
GP		 882 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
883 rp->status);
56e5cb86
JH		 884
885 hci_dev_unlock(hdev);
a5c29683
JH		 886}
887
888static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 889 struct sk_buff *skb)
a5c29683
JH		 890{
891 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
892
9f1db00c 893 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 894
56e5cb86
JH		 895 hci_dev_lock(hdev);
896
a8b2d5c2 897 if (test_bit(HCI_MGMT, &hdev->dev_flags))
744cf19e 898 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 899 ACL_LINK, 0, rp->status);
56e5cb86
JH		 900
901 hci_dev_unlock(hdev);
a5c29683
JH		 902}
903
1143d458
BG		 904static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
905{
906 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
907
9f1db00c 908 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 909
910 hci_dev_lock(hdev);
911
a8b2d5c2 912 if (test_bit(HCI_MGMT, &hdev->dev_flags))
272d90df 913 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 914 0, rp->status);
1143d458
BG		 915
916 hci_dev_unlock(hdev);
917}
918
919static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 920 struct sk_buff *skb)
1143d458
BG		 921{
922 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
923
9f1db00c 924 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 925
926 hci_dev_lock(hdev);
927
a8b2d5c2 928 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1143d458 929 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 930 ACL_LINK, 0, rp->status);
1143d458
BG		 931
932 hci_dev_unlock(hdev);
933}
934
4d2d2796
MH		 935static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
936 struct sk_buff *skb)
c35938b2
SJ		 937{
938 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
939
9f1db00c 940 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2 941
56e5cb86 942 hci_dev_lock(hdev);
4d2d2796
MH		 943 mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->randomizer,
944 NULL, NULL, rp->status);
945 hci_dev_unlock(hdev);
946}
947
948static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
949 struct sk_buff *skb)
950{
951 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
952
953 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
954
955 hci_dev_lock(hdev);
956 mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->randomizer192,
957 rp->hash256, rp->randomizer256,
958 rp->status);
56e5cb86 959 hci_dev_unlock(hdev);
c35938b2
SJ		 960}
961
7a4cd51d
MH		 962
963static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
964{
965 __u8 status = *((__u8 *) skb->data);
966 bdaddr_t *sent;
967
968 BT_DBG("%s status 0x%2.2x", hdev->name, status);
969
970 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
971 if (!sent)
972 return;
973
974 hci_dev_lock(hdev);
975
976 if (!status)
977 bacpy(&hdev->random_addr, sent);
978
979 hci_dev_unlock(hdev);
980}
981
c1d5dc4a
JH		 982static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
983{
984 __u8 *sent, status = *((__u8 *) skb->data);
985
986 BT_DBG("%s status 0x%2.2x", hdev->name, status);
987
988 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
989 if (!sent)
990 return;
991
992 hci_dev_lock(hdev);
993
778b235a
JH		 994 if (!status)
995 mgmt_advertising(hdev, *sent);
c1d5dc4a 996
04b4edcb 997 hci_dev_unlock(hdev);
c1d5dc4a
JH		 998}
999
eb9d91f5 1000static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
807deac2 1001 struct sk_buff *skb)
eb9d91f5
AG		 1002{
1003 struct hci_cp_le_set_scan_enable *cp;
1004 __u8 status = *((__u8 *) skb->data);
1005
9f1db00c 1006 BT_DBG("%s status 0x%2.2x", hdev->name, status);
eb9d91f5 1007
eb9d91f5
AG		 1008 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1009 if (!cp)
1010 return;
1011
3fd319b8
AG		 1012 if (status)
1013 return;
1014
68a8aea4 1015 switch (cp->enable) {
76a388be 1016 case LE_SCAN_ENABLE:
d23264a8 1017 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
68a8aea4
AE		 1018 break;
1019
76a388be 1020 case LE_SCAN_DISABLE:
d23264a8 1021 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
68a8aea4
AE		 1022 break;
1023
1024 default:
1025 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1026 break;
35815085 1027 }
eb9d91f5
AG		 1028}
1029
cf1d081f
JH		 1030static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1031 struct sk_buff *skb)
1032{
1033 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1034
1035 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1036
1037 if (!rp->status)
1038 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1039}
1040
0f36b589
MH		 1041static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1042 struct sk_buff *skb)
1043{
1044 __u8 status = *((__u8 *) skb->data);
1045
1046 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1047
1048 if (!status)
1049 hci_white_list_clear(hdev);
1050}
1051
1052static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1053 struct sk_buff *skb)
1054{
1055 struct hci_cp_le_add_to_white_list *sent;
1056 __u8 status = *((__u8 *) skb->data);
1057
1058 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1059
1060 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1061 if (!sent)
1062 return;
1063
1064 if (!status)
1065 hci_white_list_add(hdev, &sent->bdaddr, sent->bdaddr_type);
1066}
1067
1068static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1069 struct sk_buff *skb)
1070{
1071 struct hci_cp_le_del_from_white_list *sent;
1072 __u8 status = *((__u8 *) skb->data);
1073
1074 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1075
1076 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1077 if (!sent)
1078 return;
1079
1080 if (!status)
1081 hci_white_list_del(hdev, &sent->bdaddr, sent->bdaddr_type);
1082}
1083
9b008c04
JH		 1084static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1085 struct sk_buff *skb)
1086{
1087 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1088
1089 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1090
1091 if (!rp->status)
1092 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1093}
1094
6039aa73
GP		 1095static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1096 struct sk_buff *skb)
f9b49306 1097{
06199cf8 1098 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1099 __u8 status = *((__u8 *) skb->data);
1100
9f1db00c 1101 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1102
06199cf8 1103 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1104 if (!sent)
f9b49306
AG		 1105 return;
1106
8f984dfa 1107 if (!status) {
416a4ae5 1108 if (sent->le) {
cad718ed 1109 hdev->features[1][0] |= LMP_HOST_LE;
416a4ae5
JH		 1110 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1111 } else {
cad718ed 1112 hdev->features[1][0] &= ~LMP_HOST_LE;
416a4ae5 1113 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
f3d3444a 1114 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
416a4ae5 1115 }
53b2caab
JH		 1116
1117 if (sent->simul)
cad718ed 1118 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
53b2caab 1119 else
cad718ed 1120 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
8f984dfa 1121 }
f9b49306
AG		 1122}
1123
56ed2cb8
JH		 1124static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1125{
1126 struct hci_cp_le_set_adv_param *cp;
1127 u8 status = *((u8 *) skb->data);
1128
1129 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1130
1131 if (status)
1132 return;
1133
1134 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1135 if (!cp)
1136 return;
1137
1138 hci_dev_lock(hdev);
1139 hdev->adv_addr_type = cp->own_address_type;
1140 hci_dev_unlock(hdev);
1141}
1142
93c284ee
AE		 1143static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1144 struct sk_buff *skb)
1145{
1146 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1147
1148 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1149 hdev->name, rp->status, rp->phy_handle);
1150
1151 if (rp->status)
1152 return;
1153
1154 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1155}
1156
6039aa73 1157static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1158{
9f1db00c 1159 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1160
1161 if (status) {
a9de9248 1162 hci_conn_check_pending(hdev);
314b2381
JH		 1163 return;
1164 }
1165
89352e7d 1166 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1167}
1168
6039aa73 1169static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1170{
a9de9248 1171 struct hci_cp_create_conn *cp;
1da177e4 1172 struct hci_conn *conn;
1da177e4 1173
9f1db00c 1174 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1175
1176 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1177 if (!cp)
1178 return;
1179
1180 hci_dev_lock(hdev);
1181
1182 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1183
6ed93dc6 1184 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1185
1186 if (status) {
1187 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1188 if (status != 0x0c || conn->attempt > 2) {
1189 conn->state = BT_CLOSED;
1190 hci_proto_connect_cfm(conn, status);
1191 hci_conn_del(conn);
1192 } else
1193 conn->state = BT_CONNECT2;
1da177e4
LT		 1194 }
1195 } else {
1196 if (!conn) {
1197 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1198 if (conn) {
a0c808b3 1199 conn->out = true;
1da177e4
LT		 1200 conn->link_mode |= HCI_LM_MASTER;
1201 } else
893ef971 1202 BT_ERR("No memory for new connection");
1da177e4
LT		 1203 }
1204 }
1205
1206 hci_dev_unlock(hdev);
1207}
1208
a9de9248 1209static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1210{
a9de9248
MH		 1211 struct hci_cp_add_sco *cp;
1212 struct hci_conn *acl, *sco;
1213 __u16 handle;
1da177e4 1214
9f1db00c 1215 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1216
a9de9248
MH		 1217 if (!status)
1218 return;
1da177e4 1219
a9de9248
MH		 1220 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1221 if (!cp)
1222 return;
1da177e4 1223
a9de9248 1224 handle = __le16_to_cpu(cp->handle);
1da177e4 1225
9f1db00c 1226 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1227
a9de9248 1228 hci_dev_lock(hdev);
1da177e4 1229
a9de9248 1230 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1231 if (acl) {
1232 sco = acl->link;
1233 if (sco) {
1234 sco->state = BT_CLOSED;
1da177e4 1235
5a08ecce
AE		 1236 hci_proto_connect_cfm(sco, status);
1237 hci_conn_del(sco);
1238 }
a9de9248 1239 }
1da177e4 1240
a9de9248
MH		 1241 hci_dev_unlock(hdev);
1242}
1da177e4 1243
f8558555
MH		 1244static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1245{
1246 struct hci_cp_auth_requested *cp;
1247 struct hci_conn *conn;
1248
9f1db00c 1249 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1250
1251 if (!status)
1252 return;
1253
1254 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1255 if (!cp)
1256 return;
1257
1258 hci_dev_lock(hdev);
1259
1260 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1261 if (conn) {
1262 if (conn->state == BT_CONFIG) {
1263 hci_proto_connect_cfm(conn, status);
76a68ba0 1264 hci_conn_drop(conn);
f8558555
MH		 1265 }
1266 }
1267
1268 hci_dev_unlock(hdev);
1269}
1270
1271static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1272{
1273 struct hci_cp_set_conn_encrypt *cp;
1274 struct hci_conn *conn;
1275
9f1db00c 1276 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1277
1278 if (!status)
1279 return;
1280
1281 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1282 if (!cp)
1283 return;
1284
1285 hci_dev_lock(hdev);
1286
1287 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1288 if (conn) {
1289 if (conn->state == BT_CONFIG) {
1290 hci_proto_connect_cfm(conn, status);
76a68ba0 1291 hci_conn_drop(conn);
f8558555
MH		 1292 }
1293 }
1294
1295 hci_dev_unlock(hdev);
1296}
1297
127178d2 1298static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1299 struct hci_conn *conn)
392599b9 1300{
392599b9
JH		 1301 if (conn->state != BT_CONFIG || !conn->out)
1302 return 0;
1303
765c2a96 1304 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1305 return 0;
1306
1307 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1308 * devices with sec_level MEDIUM or HIGH or if MITM protection
1309 * is requested.
1310 */
807deac2 1311 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
264b8b4e
JH		 1312 conn->pending_sec_level != BT_SECURITY_HIGH &&
1313 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1314 return 0;
1315
392599b9
JH		 1316 return 1;
1317}
1318
6039aa73 1319static int hci_resolve_name(struct hci_dev *hdev,
04124681 1320 struct inquiry_entry *e)
30dc78e1
JH		 1321{
1322 struct hci_cp_remote_name_req cp;
1323
1324 memset(&cp, 0, sizeof(cp));
1325
1326 bacpy(&cp.bdaddr, &e->data.bdaddr);
1327 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1328 cp.pscan_mode = e->data.pscan_mode;
1329 cp.clock_offset = e->data.clock_offset;
1330
1331 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1332}
1333
b644ba33 1334static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1335{
1336 struct discovery_state *discov = &hdev->discovery;
1337 struct inquiry_entry *e;
1338
b644ba33
JH		 1339 if (list_empty(&discov->resolve))
1340 return false;
1341
1342 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1343 if (!e)
1344 return false;
1345
b644ba33
JH		 1346 if (hci_resolve_name(hdev, e) == 0) {
1347 e->name_state = NAME_PENDING;
1348 return true;
1349 }
1350
1351 return false;
1352}
1353
1354static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1355 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1356{
1357 struct discovery_state *discov = &hdev->discovery;
1358 struct inquiry_entry *e;
1359
1360 if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
04124681
GP		 1361 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1362 name_len, conn->dev_class);
b644ba33
JH		 1363
1364 if (discov->state == DISCOVERY_STOPPED)
1365 return;
1366
30dc78e1
JH		 1367 if (discov->state == DISCOVERY_STOPPING)
1368 goto discov_complete;
1369
1370 if (discov->state != DISCOVERY_RESOLVING)
1371 return;
1372
1373 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1374 /* If the device was not found in a list of found devices names of which
1375 * are pending. there is no need to continue resolving a next name as it
1376 * will be done upon receiving another Remote Name Request Complete
1377 * Event */
1378 if (!e)
1379 return;
1380
1381 list_del(&e->list);
1382 if (name) {
30dc78e1 1383 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1384 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1385 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1386 } else {
1387 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1388 }
1389
b644ba33 1390 if (hci_resolve_next_name(hdev))
30dc78e1 1391 return;
30dc78e1
JH		 1392
1393discov_complete:
1394 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1395}
1396
a9de9248
MH		 1397static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1398{
127178d2
JH		 1399 struct hci_cp_remote_name_req *cp;
1400 struct hci_conn *conn;
1401
9f1db00c 1402 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1403
1404 /* If successful wait for the name req complete event before
1405 * checking for the need to do authentication */
1406 if (!status)
1407 return;
1408
1409 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1410 if (!cp)
1411 return;
1412
1413 hci_dev_lock(hdev);
1414
b644ba33
JH		 1415 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1416
a8b2d5c2 1417 if (test_bit(HCI_MGMT, &hdev->dev_flags))
b644ba33 1418 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1419
79c6c70c
JH		 1420 if (!conn)
1421 goto unlock;
1422
1423 if (!hci_outgoing_auth_needed(hdev, conn))
1424 goto unlock;
1425
51a8efd7 1426 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1427 struct hci_cp_auth_requested auth_cp;
1428
1429 auth_cp.handle = __cpu_to_le16(conn->handle);
1430 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1431 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1432 }
1433
79c6c70c 1434unlock:
127178d2 1435 hci_dev_unlock(hdev);
a9de9248 1436}
1da177e4 1437
769be974
MH		 1438static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1439{
1440 struct hci_cp_read_remote_features *cp;
1441 struct hci_conn *conn;
1442
9f1db00c 1443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1444
1445 if (!status)
1446 return;
1447
1448 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1449 if (!cp)
1450 return;
1451
1452 hci_dev_lock(hdev);
1453
1454 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1455 if (conn) {
1456 if (conn->state == BT_CONFIG) {
769be974 1457 hci_proto_connect_cfm(conn, status);
76a68ba0 1458 hci_conn_drop(conn);
769be974
MH		 1459 }
1460 }
1461
1462 hci_dev_unlock(hdev);
1463}
1464
1465static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1466{
1467 struct hci_cp_read_remote_ext_features *cp;
1468 struct hci_conn *conn;
1469
9f1db00c 1470 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 1471
1472 if (!status)
1473 return;
1474
1475 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1476 if (!cp)
1477 return;
1478
1479 hci_dev_lock(hdev);
1480
1481 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1482 if (conn) {
1483 if (conn->state == BT_CONFIG) {
769be974 1484 hci_proto_connect_cfm(conn, status);
76a68ba0 1485 hci_conn_drop(conn);
769be974
MH		 1486 }
1487 }
1488
1489 hci_dev_unlock(hdev);
1490}
1491
a9de9248
MH		 1492static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1493{
b6a0dc82
MH		 1494 struct hci_cp_setup_sync_conn *cp;
1495 struct hci_conn *acl, *sco;
1496 __u16 handle;
1497
9f1db00c 1498 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 1499
1500 if (!status)
1501 return;
1502
1503 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1504 if (!cp)
1505 return;
1506
1507 handle = __le16_to_cpu(cp->handle);
1508
9f1db00c 1509 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 1510
1511 hci_dev_lock(hdev);
1512
1513 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1514 if (acl) {
1515 sco = acl->link;
1516 if (sco) {
1517 sco->state = BT_CLOSED;
b6a0dc82 1518
5a08ecce
AE		 1519 hci_proto_connect_cfm(sco, status);
1520 hci_conn_del(sco);
1521 }
b6a0dc82
MH		 1522 }
1523
1524 hci_dev_unlock(hdev);
1da177e4
LT		 1525}
1526
a9de9248 1527static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1528{
a9de9248
MH		 1529 struct hci_cp_sniff_mode *cp;
1530 struct hci_conn *conn;
1da177e4 1531
9f1db00c 1532 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1533
a9de9248
MH		 1534 if (!status)
1535 return;
04837f64 1536
a9de9248
MH		 1537 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1538 if (!cp)
1539 return;
04837f64 1540
a9de9248 1541 hci_dev_lock(hdev);
04837f64 1542
a9de9248 1543 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1544 if (conn) {
51a8efd7 1545 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 1546
51a8efd7 1547 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1548 hci_sco_setup(conn, status);
1549 }
1550
a9de9248
MH		 1551 hci_dev_unlock(hdev);
1552}
04837f64 1553
a9de9248
MH		 1554static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1555{
1556 struct hci_cp_exit_sniff_mode *cp;
1557 struct hci_conn *conn;
04837f64 1558
9f1db00c 1559 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 1560
a9de9248
MH		 1561 if (!status)
1562 return;
04837f64 1563
a9de9248
MH		 1564 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1565 if (!cp)
1566 return;
04837f64 1567
a9de9248 1568 hci_dev_lock(hdev);
1da177e4 1569
a9de9248 1570 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1571 if (conn) {
51a8efd7 1572 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 1573
51a8efd7 1574 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 1575 hci_sco_setup(conn, status);
1576 }
1577
a9de9248 1578 hci_dev_unlock(hdev);
1da177e4
LT		 1579}
1580
88c3df13
JH		 1581static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1582{
1583 struct hci_cp_disconnect *cp;
1584 struct hci_conn *conn;
1585
1586 if (!status)
1587 return;
1588
1589 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1590 if (!cp)
1591 return;
1592
1593 hci_dev_lock(hdev);
1594
1595 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1596 if (conn)
1597 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 1598 conn->dst_type, status);
88c3df13
JH		 1599
1600 hci_dev_unlock(hdev);
1601}
1602
a02226d6
AE		 1603static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1604{
93c284ee
AE		 1605 struct hci_cp_create_phy_link *cp;
1606
a02226d6 1607 BT_DBG("%s status 0x%2.2x", hdev->name, status);
93c284ee 1608
93c284ee
AE		 1609 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1610 if (!cp)
1611 return;
1612
e58917b9
AE		 1613 hci_dev_lock(hdev);
1614
1615 if (status) {
1616 struct hci_conn *hcon;
1617
1618 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1619 if (hcon)
1620 hci_conn_del(hcon);
1621 } else {
1622 amp_write_remote_assoc(hdev, cp->phy_handle);
1623 }
1624
1625 hci_dev_unlock(hdev);
a02226d6
AE		 1626}
1627
0b26ab9d
AE		 1628static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1629{
1630 struct hci_cp_accept_phy_link *cp;
1631
1632 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1633
1634 if (status)
1635 return;
1636
1637 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1638 if (!cp)
1639 return;
1640
1641 amp_write_remote_assoc(hdev, cp->phy_handle);
1642}
1643
cb1d68f7
JH		 1644static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1645{
1646 struct hci_cp_le_create_conn *cp;
1647 struct hci_conn *conn;
1648
1649 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1650
1651 /* All connection failure handling is taken care of by the
1652 * hci_le_conn_failed function which is triggered by the HCI
1653 * request completion callbacks used for connecting.
1654 */
1655 if (status)
1656 return;
1657
1658 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1659 if (!cp)
1660 return;
1661
1662 hci_dev_lock(hdev);
1663
1664 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1665 if (!conn)
1666 goto unlock;
1667
1668 /* Store the initiator and responder address information which
1669 * is needed for SMP. These values will not change during the
1670 * lifetime of the connection.
1671 */
1672 conn->init_addr_type = cp->own_address_type;
1673 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1674 bacpy(&conn->init_addr, &hdev->random_addr);
1675 else
1676 bacpy(&conn->init_addr, &hdev->bdaddr);
1677
1678 conn->resp_addr_type = cp->peer_addr_type;
1679 bacpy(&conn->resp_addr, &cp->peer_addr);
1680
9489eca4
JH		 1681 /* We don't want the connection attempt to stick around
1682 * indefinitely since LE doesn't have a page timeout concept
1683 * like BR/EDR. Set a timer for any connection that doesn't use
1684 * the white list for connecting.
1685 */
1686 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1687 queue_delayed_work(conn->hdev->workqueue,
1688 &conn->le_conn_timeout,
1689 HCI_LE_CONN_TIMEOUT);
1690
cb1d68f7
JH		 1691unlock:
1692 hci_dev_unlock(hdev);
1693}
1694
6039aa73 1695static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 1696{
1697 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 1698 struct discovery_state *discov = &hdev->discovery;
1699 struct inquiry_entry *e;
1da177e4 1700
9f1db00c 1701 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 1702
a9de9248 1703 hci_conn_check_pending(hdev);
89352e7d
AG		 1704
1705 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1706 return;
1707
3e13fa1e
AG		 1708 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1709 wake_up_bit(&hdev->flags, HCI_INQUIRY);
1710
a8b2d5c2 1711 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
30dc78e1
JH		 1712 return;
1713
56e5cb86 1714 hci_dev_lock(hdev);
30dc78e1 1715
343f935b 1716 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 1717 goto unlock;
1718
1719 if (list_empty(&discov->resolve)) {
1720 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1721 goto unlock;
1722 }
1723
1724 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1725 if (e && hci_resolve_name(hdev, e) == 0) {
1726 e->name_state = NAME_PENDING;
1727 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1728 } else {
1729 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1730 }
1731
1732unlock:
56e5cb86 1733 hci_dev_unlock(hdev);
1da177e4
LT		 1734}
1735
6039aa73 1736static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1737{
45bb4bf0 1738 struct inquiry_data data;
a9de9248 1739 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 1740 int num_rsp = *((__u8 *) skb->data);
1741
1742 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1743
45bb4bf0
MH		 1744 if (!num_rsp)
1745 return;
1746
1519cc17
AG		 1747 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1748 return;
1749
1da177e4 1750 hci_dev_lock(hdev);
45bb4bf0 1751
e17acd40 1752 for (; num_rsp; num_rsp--, info++) {
388fc8fa 1753 bool name_known, ssp;
3175405b 1754
1da177e4
LT		 1755 bacpy(&data.bdaddr, &info->bdaddr);
1756 data.pscan_rep_mode = info->pscan_rep_mode;
1757 data.pscan_period_mode = info->pscan_period_mode;
1758 data.pscan_mode = info->pscan_mode;
1759 memcpy(data.dev_class, info->dev_class, 3);
1760 data.clock_offset = info->clock_offset;
1761 data.rssi = 0x00;
41a96212 1762 data.ssp_mode = 0x00;
3175405b 1763
388fc8fa 1764 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
48264f06 1765 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681
GP		 1766 info->dev_class, 0, !name_known, ssp, NULL,
1767 0);
1da177e4 1768 }
45bb4bf0 1769
1da177e4
LT		 1770 hci_dev_unlock(hdev);
1771}
1772
6039aa73 1773static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1774{
a9de9248
MH		 1775 struct hci_ev_conn_complete *ev = (void *) skb->data;
1776 struct hci_conn *conn;
1da177e4
LT		 1777
1778 BT_DBG("%s", hdev->name);
1779
1780 hci_dev_lock(hdev);
1781
1782 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 1783 if (!conn) {
1784 if (ev->link_type != SCO_LINK)
1785 goto unlock;
1786
1787 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1788 if (!conn)
1789 goto unlock;
1790
1791 conn->type = SCO_LINK;
1792 }
1da177e4
LT		 1793
1794 if (!ev->status) {
1795 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 1796
1797 if (conn->type == ACL_LINK) {
1798 conn->state = BT_CONFIG;
1799 hci_conn_hold(conn);
a9ea3ed9
SJ		 1800
1801 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1802 !hci_find_link_key(hdev, &ev->bdaddr))
1803 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1804 else
1805 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 1806 } else
1807 conn->state = BT_CONNECTED;
1da177e4 1808
7d0db0a3
MH		 1809 hci_conn_add_sysfs(conn);
1810
1da177e4
LT		 1811 if (test_bit(HCI_AUTH, &hdev->flags))
1812 conn->link_mode |= HCI_LM_AUTH;
1813
1814 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1815 conn->link_mode |= HCI_LM_ENCRYPT;
1816
04837f64
MH		 1817 /* Get remote features */
1818 if (conn->type == ACL_LINK) {
1819 struct hci_cp_read_remote_features cp;
1820 cp.handle = ev->handle;
769be974 1821 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 1822 sizeof(cp), &cp);
04837f64
MH		 1823 }
1824
1da177e4 1825 /* Set packet type for incoming connection */
d095c1eb 1826 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 1827 struct hci_cp_change_conn_ptype cp;
1828 cp.handle = ev->handle;
a8746417 1829 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 1830 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1831 &cp);
1da177e4 1832 }
17d5c04c 1833 } else {
1da177e4 1834 conn->state = BT_CLOSED;
17d5c04c 1835 if (conn->type == ACL_LINK)
64c7b77c 1836 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 1837 conn->dst_type, ev->status);
17d5c04c 1838 }
1da177e4 1839
e73439d8
MH		 1840 if (conn->type == ACL_LINK)
1841 hci_sco_setup(conn, ev->status);
1da177e4 1842
769be974
MH		 1843 if (ev->status) {
1844 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1845 hci_conn_del(conn);
c89b6e6b
MH		 1846 } else if (ev->link_type != ACL_LINK)
1847 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1848
a9de9248 1849unlock:
1da177e4 1850 hci_dev_unlock(hdev);
1da177e4 1851
a9de9248 1852 hci_conn_check_pending(hdev);
1da177e4
LT		 1853}
1854
6039aa73 1855static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1856{
a9de9248
MH		 1857 struct hci_ev_conn_request *ev = (void *) skb->data;
1858 int mask = hdev->link_mode;
20714bfe 1859 __u8 flags = 0;
1da177e4 1860
6ed93dc6 1861 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 1862 ev->link_type);
1da177e4 1863
20714bfe
FD		 1864 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1865 &flags);
1da177e4 1866
138d22ef 1867 if ((mask & HCI_LM_ACCEPT) &&
b9ee0a78 1868 !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
a9de9248 1869 /* Connection accepted */
c7bdd502 1870 struct inquiry_entry *ie;
1da177e4 1871 struct hci_conn *conn;
1da177e4 1872
a9de9248 1873 hci_dev_lock(hdev);
b6a0dc82 1874
cc11b9c1
AE		 1875 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1876 if (ie)
c7bdd502
MH		 1877 memcpy(ie->data.dev_class, ev->dev_class, 3);
1878
8fc9ced3
GP		 1879 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1880 &ev->bdaddr);
a9de9248 1881 if (!conn) {
cc11b9c1
AE		 1882 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1883 if (!conn) {
893ef971 1884 BT_ERR("No memory for new connection");
a9de9248
MH		 1885 hci_dev_unlock(hdev);
1886 return;
1da177e4
LT		 1887 }
1888 }
b6a0dc82 1889
a9de9248 1890 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 1891
a9de9248 1892 hci_dev_unlock(hdev);
1da177e4 1893
20714bfe
FD		 1894 if (ev->link_type == ACL_LINK ||
1895 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
b6a0dc82 1896 struct hci_cp_accept_conn_req cp;
20714bfe 1897 conn->state = BT_CONNECT;
1da177e4 1898
b6a0dc82
MH		 1899 bacpy(&cp.bdaddr, &ev->bdaddr);
1900
1901 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1902 cp.role = 0x00; /* Become master */
1903 else
1904 cp.role = 0x01; /* Remain slave */
1905
04124681
GP		 1906 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1907 &cp);
20714bfe 1908 } else if (!(flags & HCI_PROTO_DEFER)) {
b6a0dc82 1909 struct hci_cp_accept_sync_conn_req cp;
20714bfe 1910 conn->state = BT_CONNECT;
b6a0dc82
MH		 1911
1912 bacpy(&cp.bdaddr, &ev->bdaddr);
a8746417 1913 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 1914
82781e63
AE		 1915 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1916 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1917 cp.max_latency = __constant_cpu_to_le16(0xffff);
b6a0dc82
MH		 1918 cp.content_format = cpu_to_le16(hdev->voice_setting);
1919 cp.retrans_effort = 0xff;
1da177e4 1920
b6a0dc82 1921 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
04124681 1922 sizeof(cp), &cp);
20714bfe
FD		 1923 } else {
1924 conn->state = BT_CONNECT2;
1925 hci_proto_connect_cfm(conn, 0);
b6a0dc82 1926 }
a9de9248
MH		 1927 } else {
1928 /* Connection rejected */
1929 struct hci_cp_reject_conn_req cp;
1da177e4 1930
a9de9248 1931 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 1932 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
a9de9248 1933 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1da177e4 1934 }
1da177e4
LT		 1935}
1936
f0d6a0ea
MA		 1937static u8 hci_to_mgmt_reason(u8 err)
1938{
1939 switch (err) {
1940 case HCI_ERROR_CONNECTION_TIMEOUT:
1941 return MGMT_DEV_DISCONN_TIMEOUT;
1942 case HCI_ERROR_REMOTE_USER_TERM:
1943 case HCI_ERROR_REMOTE_LOW_RESOURCES:
1944 case HCI_ERROR_REMOTE_POWER_OFF:
1945 return MGMT_DEV_DISCONN_REMOTE;
1946 case HCI_ERROR_LOCAL_HOST_TERM:
1947 return MGMT_DEV_DISCONN_LOCAL_HOST;
1948 default:
1949 return MGMT_DEV_DISCONN_UNKNOWN;
1950 }
1951}
1952
6039aa73 1953static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 1954{
a9de9248 1955 struct hci_ev_disconn_complete *ev = (void *) skb->data;
abf54a50 1956 u8 reason = hci_to_mgmt_reason(ev->reason);
9fcb18ef 1957 struct hci_conn_params *params;
04837f64 1958 struct hci_conn *conn;
12d4a3b2 1959 bool mgmt_connected;
3846220b 1960 u8 type;
04837f64 1961
9f1db00c 1962 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 1963
1964 hci_dev_lock(hdev);
1965
1966 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 1967 if (!conn)
1968 goto unlock;
7d0db0a3 1969
abf54a50
AG		 1970 if (ev->status) {
1971 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1972 conn->dst_type, ev->status);
1973 goto unlock;
37d9ef76 1974 }
f7520543 1975
3846220b
AG		 1976 conn->state = BT_CLOSED;
1977
12d4a3b2
JH		 1978 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
1979 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
1980 reason, mgmt_connected);
abf54a50 1981
3846220b
AG		 1982 if (conn->type == ACL_LINK && conn->flush_key)
1983 hci_remove_link_key(hdev, &conn->dst);
2210246c 1984
9fcb18ef
AG		 1985 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
1986 if (params) {
1987 switch (params->auto_connect) {
1988 case HCI_AUTO_CONN_LINK_LOSS:
1989 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
1990 break;
1991 /* Fall through */
1992
1993 case HCI_AUTO_CONN_ALWAYS:
1994 hci_pend_le_conn_add(hdev, &conn->dst, conn->dst_type);
1995 break;
1996
1997 default:
1998 break;
1999 }
2000 }
2001
3846220b 2002 type = conn->type;
2210246c 2003
3846220b
AG		 2004 hci_proto_disconn_cfm(conn, ev->reason);
2005 hci_conn_del(conn);
2006
2007 /* Re-enable advertising if necessary, since it might
2008 * have been disabled by the connection. From the
2009 * HCI_LE_Set_Advertise_Enable command description in
2010 * the core specification (v4.0):
2011 * "The Controller shall continue advertising until the Host
2012 * issues an LE_Set_Advertise_Enable command with
2013 * Advertising_Enable set to 0x00 (Advertising is disabled)
2014 * or until a connection is created or until the Advertising
2015 * is timed out due to Directed Advertising."
2016 */
2017 if (type == LE_LINK)
2018 mgmt_reenable_advertising(hdev);
f7520543
JH		 2019
2020unlock:
04837f64
MH		 2021 hci_dev_unlock(hdev);
2022}
2023
6039aa73 2024static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2025{
a9de9248 2026 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2027 struct hci_conn *conn;
1da177e4 2028
9f1db00c 2029 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2030
2031 hci_dev_lock(hdev);
2032
04837f64 2033 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2034 if (!conn)
2035 goto unlock;
2036
2037 if (!ev->status) {
aa64a8b5 2038 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2039 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
d7556e20 2040 BT_INFO("re-auth of legacy device is not possible.");
2a611692 2041 } else {
d7556e20
WR		 2042 conn->link_mode |= HCI_LM_AUTH;
2043 conn->sec_level = conn->pending_sec_level;
2a611692 2044 }
d7556e20 2045 } else {
bab73cb6 2046 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
04124681 2047 ev->status);
d7556e20 2048 }
1da177e4 2049
51a8efd7
JH		 2050 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2051 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2052
d7556e20 2053 if (conn->state == BT_CONFIG) {
aa64a8b5 2054 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2055 struct hci_cp_set_conn_encrypt cp;
2056 cp.handle = ev->handle;
2057 cp.encrypt = 0x01;
2058 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2059 &cp);
052b30b0 2060 } else {
d7556e20
WR		 2061 conn->state = BT_CONNECTED;
2062 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 2063 hci_conn_drop(conn);
052b30b0 2064 }
d7556e20
WR		 2065 } else {
2066 hci_auth_cfm(conn, ev->status);
052b30b0 2067
d7556e20
WR		 2068 hci_conn_hold(conn);
2069 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2070 hci_conn_drop(conn);
d7556e20
WR		 2071 }
2072
51a8efd7 2073 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2074 if (!ev->status) {
2075 struct hci_cp_set_conn_encrypt cp;
2076 cp.handle = ev->handle;
2077 cp.encrypt = 0x01;
2078 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2079 &cp);
d7556e20 2080 } else {
51a8efd7 2081 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2082 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2083 }
2084 }
2085
d7556e20 2086unlock:
1da177e4
LT		 2087 hci_dev_unlock(hdev);
2088}
2089
6039aa73 2090static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2091{
127178d2
JH		 2092 struct hci_ev_remote_name *ev = (void *) skb->data;
2093 struct hci_conn *conn;
2094
a9de9248 2095 BT_DBG("%s", hdev->name);
1da177e4 2096
a9de9248 2097 hci_conn_check_pending(hdev);
127178d2
JH		 2098
2099 hci_dev_lock(hdev);
2100
b644ba33 2101 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2102
b644ba33
JH		 2103 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2104 goto check_auth;
a88a9652 2105
b644ba33
JH		 2106 if (ev->status == 0)
2107 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2108 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2109 else
2110 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2111
2112check_auth:
79c6c70c
JH		 2113 if (!conn)
2114 goto unlock;
2115
2116 if (!hci_outgoing_auth_needed(hdev, conn))
2117 goto unlock;
2118
51a8efd7 2119 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2
JH		 2120 struct hci_cp_auth_requested cp;
2121 cp.handle = __cpu_to_le16(conn->handle);
2122 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2123 }
2124
79c6c70c 2125unlock:
127178d2 2126 hci_dev_unlock(hdev);
a9de9248
MH		 2127}
2128
6039aa73 2129static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2130{
2131 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2132 struct hci_conn *conn;
2133
9f1db00c 2134 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2135
2136 hci_dev_lock(hdev);
2137
04837f64 2138 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2139 if (!conn)
2140 goto unlock;
1da177e4 2141
dc8357cc
MH		 2142 if (!ev->status) {
2143 if (ev->encrypt) {
2144 /* Encryption implies authentication */
2145 conn->link_mode |= HCI_LM_AUTH;
2146 conn->link_mode |= HCI_LM_ENCRYPT;
2147 conn->sec_level = conn->pending_sec_level;
abf76bad 2148
914a6ffe
MH		 2149 /* P-256 authentication key implies FIPS */
2150 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2151 conn->link_mode |= HCI_LM_FIPS;
2152
abf76bad
MH		 2153 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2154 conn->type == LE_LINK)
2155 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2156 } else {
dc8357cc 2157 conn->link_mode &= ~HCI_LM_ENCRYPT;
abf76bad
MH		 2158 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2159 }
dc8357cc 2160 }
a7d7723a 2161
dc8357cc 2162 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2163
dc8357cc
MH		 2164 if (ev->status && conn->state == BT_CONNECTED) {
2165 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2166 hci_conn_drop(conn);
2167 goto unlock;
1da177e4
LT		 2168 }
2169
dc8357cc
MH		 2170 if (conn->state == BT_CONFIG) {
2171 if (!ev->status)
2172 conn->state = BT_CONNECTED;
2173
2174 hci_proto_connect_cfm(conn, ev->status);
2175 hci_conn_drop(conn);
2176 } else
2177 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2178
a7d7723a 2179unlock:
1da177e4
LT		 2180 hci_dev_unlock(hdev);
2181}
2182
6039aa73
GP		 2183static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2184 struct sk_buff *skb)
1da177e4 2185{
a9de9248 2186 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2187 struct hci_conn *conn;
1da177e4 2188
9f1db00c 2189 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2190
2191 hci_dev_lock(hdev);
2192
04837f64 2193 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2194 if (conn) {
2195 if (!ev->status)
2196 conn->link_mode |= HCI_LM_SECURE;
2197
51a8efd7 2198 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 2199
2200 hci_key_change_cfm(conn, ev->status);
2201 }
2202
2203 hci_dev_unlock(hdev);
2204}
2205
6039aa73
GP		 2206static void hci_remote_features_evt(struct hci_dev *hdev,
2207 struct sk_buff *skb)
1da177e4 2208{
a9de9248
MH		 2209 struct hci_ev_remote_features *ev = (void *) skb->data;
2210 struct hci_conn *conn;
2211
9f1db00c 2212 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 2213
a9de9248
MH		 2214 hci_dev_lock(hdev);
2215
2216 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2217 if (!conn)
2218 goto unlock;
769be974 2219
ccd556fe 2220 if (!ev->status)
cad718ed 2221 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 2222
2223 if (conn->state != BT_CONFIG)
2224 goto unlock;
2225
2226 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2227 struct hci_cp_read_remote_ext_features cp;
2228 cp.handle = ev->handle;
2229 cp.page = 0x01;
2230 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 2231 sizeof(cp), &cp);
392599b9
JH		 2232 goto unlock;
2233 }
2234
671267bf 2235 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 2236 struct hci_cp_remote_name_req cp;
2237 memset(&cp, 0, sizeof(cp));
2238 bacpy(&cp.bdaddr, &conn->dst);
2239 cp.pscan_rep_mode = 0x02;
2240 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33
JH		 2241 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2242 mgmt_device_connected(hdev, &conn->dst, conn->type,
04124681
GP		 2243 conn->dst_type, 0, NULL, 0,
2244 conn->dev_class);
392599b9 2245
127178d2 2246 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 2247 conn->state = BT_CONNECTED;
2248 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 2249 hci_conn_drop(conn);
769be974 2250 }
a9de9248 2251
ccd556fe 2252unlock:
a9de9248 2253 hci_dev_unlock(hdev);
1da177e4
LT		 2254}
2255
6039aa73 2256static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2257{
2258 struct hci_ev_cmd_complete *ev = (void *) skb->data;
9238f36a 2259 u8 status = skb->data[sizeof(*ev)];
a9de9248
MH		 2260 __u16 opcode;
2261
2262 skb_pull(skb, sizeof(*ev));
2263
2264 opcode = __le16_to_cpu(ev->opcode);
2265
2266 switch (opcode) {
2267 case HCI_OP_INQUIRY_CANCEL:
2268 hci_cc_inquiry_cancel(hdev, skb);
2269 break;
2270
4d93483b
AG		 2271 case HCI_OP_PERIODIC_INQ:
2272 hci_cc_periodic_inq(hdev, skb);
2273 break;
2274
a9de9248
MH		 2275 case HCI_OP_EXIT_PERIODIC_INQ:
2276 hci_cc_exit_periodic_inq(hdev, skb);
2277 break;
2278
2279 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2280 hci_cc_remote_name_req_cancel(hdev, skb);
2281 break;
2282
2283 case HCI_OP_ROLE_DISCOVERY:
2284 hci_cc_role_discovery(hdev, skb);
2285 break;
2286
e4e8e37c
MH		 2287 case HCI_OP_READ_LINK_POLICY:
2288 hci_cc_read_link_policy(hdev, skb);
2289 break;
2290
a9de9248
MH		 2291 case HCI_OP_WRITE_LINK_POLICY:
2292 hci_cc_write_link_policy(hdev, skb);
2293 break;
2294
e4e8e37c
MH		 2295 case HCI_OP_READ_DEF_LINK_POLICY:
2296 hci_cc_read_def_link_policy(hdev, skb);
2297 break;
2298
2299 case HCI_OP_WRITE_DEF_LINK_POLICY:
2300 hci_cc_write_def_link_policy(hdev, skb);
2301 break;
2302
a9de9248
MH		 2303 case HCI_OP_RESET:
2304 hci_cc_reset(hdev, skb);
2305 break;
2306
2307 case HCI_OP_WRITE_LOCAL_NAME:
2308 hci_cc_write_local_name(hdev, skb);
2309 break;
2310
2311 case HCI_OP_READ_LOCAL_NAME:
2312 hci_cc_read_local_name(hdev, skb);
2313 break;
2314
2315 case HCI_OP_WRITE_AUTH_ENABLE:
2316 hci_cc_write_auth_enable(hdev, skb);
2317 break;
2318
2319 case HCI_OP_WRITE_ENCRYPT_MODE:
2320 hci_cc_write_encrypt_mode(hdev, skb);
2321 break;
2322
2323 case HCI_OP_WRITE_SCAN_ENABLE:
2324 hci_cc_write_scan_enable(hdev, skb);
2325 break;
2326
2327 case HCI_OP_READ_CLASS_OF_DEV:
2328 hci_cc_read_class_of_dev(hdev, skb);
2329 break;
2330
2331 case HCI_OP_WRITE_CLASS_OF_DEV:
2332 hci_cc_write_class_of_dev(hdev, skb);
2333 break;
2334
2335 case HCI_OP_READ_VOICE_SETTING:
2336 hci_cc_read_voice_setting(hdev, skb);
2337 break;
2338
2339 case HCI_OP_WRITE_VOICE_SETTING:
2340 hci_cc_write_voice_setting(hdev, skb);
2341 break;
2342
b4cb9fb2
MH		 2343 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2344 hci_cc_read_num_supported_iac(hdev, skb);
2345 break;
2346
333140b5
MH		 2347 case HCI_OP_WRITE_SSP_MODE:
2348 hci_cc_write_ssp_mode(hdev, skb);
2349 break;
2350
eac83dc6
MH		 2351 case HCI_OP_WRITE_SC_SUPPORT:
2352 hci_cc_write_sc_support(hdev, skb);
2353 break;
2354
a9de9248
MH		 2355 case HCI_OP_READ_LOCAL_VERSION:
2356 hci_cc_read_local_version(hdev, skb);
2357 break;
2358
2359 case HCI_OP_READ_LOCAL_COMMANDS:
2360 hci_cc_read_local_commands(hdev, skb);
2361 break;
2362
2363 case HCI_OP_READ_LOCAL_FEATURES:
2364 hci_cc_read_local_features(hdev, skb);
2365 break;
2366
971e3a4b
AG		 2367 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2368 hci_cc_read_local_ext_features(hdev, skb);
2369 break;
2370
a9de9248
MH		 2371 case HCI_OP_READ_BUFFER_SIZE:
2372 hci_cc_read_buffer_size(hdev, skb);
2373 break;
2374
2375 case HCI_OP_READ_BD_ADDR:
2376 hci_cc_read_bd_addr(hdev, skb);
2377 break;
2378
f332ec66
JH		 2379 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2380 hci_cc_read_page_scan_activity(hdev, skb);
2381 break;
2382
4a3ee763
JH		 2383 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2384 hci_cc_write_page_scan_activity(hdev, skb);
2385 break;
2386
f332ec66
JH		 2387 case HCI_OP_READ_PAGE_SCAN_TYPE:
2388 hci_cc_read_page_scan_type(hdev, skb);
2389 break;
2390
4a3ee763
JH		 2391 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2392 hci_cc_write_page_scan_type(hdev, skb);
2393 break;
2394
350ee4cf
AE		 2395 case HCI_OP_READ_DATA_BLOCK_SIZE:
2396 hci_cc_read_data_block_size(hdev, skb);
2397 break;
2398
1e89cffb
AE		 2399 case HCI_OP_READ_FLOW_CONTROL_MODE:
2400 hci_cc_read_flow_control_mode(hdev, skb);
2401 break;
2402
928abaa7
AE		 2403 case HCI_OP_READ_LOCAL_AMP_INFO:
2404 hci_cc_read_local_amp_info(hdev, skb);
2405 break;
2406
903e4541
AE		 2407 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2408 hci_cc_read_local_amp_assoc(hdev, skb);
2409 break;
2410
d5859e22
JH		 2411 case HCI_OP_READ_INQ_RSP_TX_POWER:
2412 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2413 break;
2414
980e1a53
JH		 2415 case HCI_OP_PIN_CODE_REPLY:
2416 hci_cc_pin_code_reply(hdev, skb);
2417 break;
2418
2419 case HCI_OP_PIN_CODE_NEG_REPLY:
2420 hci_cc_pin_code_neg_reply(hdev, skb);
2421 break;
2422
c35938b2 2423 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 2424 hci_cc_read_local_oob_data(hdev, skb);
2425 break;
2426
2427 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2428 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 2429 break;
2430
6ed58ec5
VT		 2431 case HCI_OP_LE_READ_BUFFER_SIZE:
2432 hci_cc_le_read_buffer_size(hdev, skb);
2433 break;
2434
60e77321
JH		 2435 case HCI_OP_LE_READ_LOCAL_FEATURES:
2436 hci_cc_le_read_local_features(hdev, skb);
2437 break;
2438
8fa19098
JH		 2439 case HCI_OP_LE_READ_ADV_TX_POWER:
2440 hci_cc_le_read_adv_tx_power(hdev, skb);
2441 break;
2442
a5c29683
JH		 2443 case HCI_OP_USER_CONFIRM_REPLY:
2444 hci_cc_user_confirm_reply(hdev, skb);
2445 break;
2446
2447 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2448 hci_cc_user_confirm_neg_reply(hdev, skb);
2449 break;
2450
1143d458
BG		 2451 case HCI_OP_USER_PASSKEY_REPLY:
2452 hci_cc_user_passkey_reply(hdev, skb);
2453 break;
2454
2455 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2456 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 2457 break;
07f7fa5d 2458
7a4cd51d
MH		 2459 case HCI_OP_LE_SET_RANDOM_ADDR:
2460 hci_cc_le_set_random_addr(hdev, skb);
2461 break;
2462
c1d5dc4a
JH		 2463 case HCI_OP_LE_SET_ADV_ENABLE:
2464 hci_cc_le_set_adv_enable(hdev, skb);
2465 break;
2466
eb9d91f5
AG		 2467 case HCI_OP_LE_SET_SCAN_ENABLE:
2468 hci_cc_le_set_scan_enable(hdev, skb);
2469 break;
2470
cf1d081f
JH		 2471 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2472 hci_cc_le_read_white_list_size(hdev, skb);
2473 break;
2474
0f36b589
MH		 2475 case HCI_OP_LE_CLEAR_WHITE_LIST:
2476 hci_cc_le_clear_white_list(hdev, skb);
2477 break;
2478
2479 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2480 hci_cc_le_add_to_white_list(hdev, skb);
2481 break;
2482
2483 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2484 hci_cc_le_del_from_white_list(hdev, skb);
2485 break;
2486
9b008c04
JH		 2487 case HCI_OP_LE_READ_SUPPORTED_STATES:
2488 hci_cc_le_read_supported_states(hdev, skb);
2489 break;
2490
f9b49306
AG		 2491 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2492 hci_cc_write_le_host_supported(hdev, skb);
2493 break;
2494
56ed2cb8
JH		 2495 case HCI_OP_LE_SET_ADV_PARAM:
2496 hci_cc_set_adv_param(hdev, skb);
2497 break;
2498
93c284ee
AE		 2499 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2500 hci_cc_write_remote_amp_assoc(hdev, skb);
2501 break;
2502
a9de9248 2503 default:
9f1db00c 2504 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
a9de9248
MH		 2505 break;
2506 }
2507
ad82cdd1 2508 if (opcode != HCI_OP_NOP)
6bd32326
VT		 2509 del_timer(&hdev->cmd_timer);
2510
ad82cdd1 2511 hci_req_cmd_complete(hdev, opcode, status);
9238f36a 2512
dbccd791 2513 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 2514 atomic_set(&hdev->cmd_cnt, 1);
2515 if (!skb_queue_empty(&hdev->cmd_q))
c347b765 2516 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 2517 }
2518}
2519
6039aa73 2520static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2521{
2522 struct hci_ev_cmd_status *ev = (void *) skb->data;
2523 __u16 opcode;
2524
2525 skb_pull(skb, sizeof(*ev));
2526
2527 opcode = __le16_to_cpu(ev->opcode);
2528
2529 switch (opcode) {
2530 case HCI_OP_INQUIRY:
2531 hci_cs_inquiry(hdev, ev->status);
2532 break;
2533
2534 case HCI_OP_CREATE_CONN:
2535 hci_cs_create_conn(hdev, ev->status);
2536 break;
2537
2538 case HCI_OP_ADD_SCO:
2539 hci_cs_add_sco(hdev, ev->status);
2540 break;
2541
f8558555
MH		 2542 case HCI_OP_AUTH_REQUESTED:
2543 hci_cs_auth_requested(hdev, ev->status);
2544 break;
2545
2546 case HCI_OP_SET_CONN_ENCRYPT:
2547 hci_cs_set_conn_encrypt(hdev, ev->status);
2548 break;
2549
a9de9248
MH		 2550 case HCI_OP_REMOTE_NAME_REQ:
2551 hci_cs_remote_name_req(hdev, ev->status);
2552 break;
2553
769be974
MH		 2554 case HCI_OP_READ_REMOTE_FEATURES:
2555 hci_cs_read_remote_features(hdev, ev->status);
2556 break;
2557
2558 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2559 hci_cs_read_remote_ext_features(hdev, ev->status);
2560 break;
2561
a9de9248
MH		 2562 case HCI_OP_SETUP_SYNC_CONN:
2563 hci_cs_setup_sync_conn(hdev, ev->status);
2564 break;
2565
2566 case HCI_OP_SNIFF_MODE:
2567 hci_cs_sniff_mode(hdev, ev->status);
2568 break;
2569
2570 case HCI_OP_EXIT_SNIFF_MODE:
2571 hci_cs_exit_sniff_mode(hdev, ev->status);
2572 break;
2573
8962ee74 2574 case HCI_OP_DISCONNECT:
88c3df13 2575 hci_cs_disconnect(hdev, ev->status);
8962ee74
JH		 2576 break;
2577
a02226d6
AE		 2578 case HCI_OP_CREATE_PHY_LINK:
2579 hci_cs_create_phylink(hdev, ev->status);
2580 break;
2581
0b26ab9d
AE		 2582 case HCI_OP_ACCEPT_PHY_LINK:
2583 hci_cs_accept_phylink(hdev, ev->status);
2584 break;
2585
cb1d68f7
JH		 2586 case HCI_OP_LE_CREATE_CONN:
2587 hci_cs_le_create_conn(hdev, ev->status);
2588 break;
2589
a9de9248 2590 default:
9f1db00c 2591 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
a9de9248
MH		 2592 break;
2593 }
2594
ad82cdd1 2595 if (opcode != HCI_OP_NOP)
6bd32326
VT		 2596 del_timer(&hdev->cmd_timer);
2597
02350a72
JH		 2598 if (ev->status ||
2599 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2600 hci_req_cmd_complete(hdev, opcode, ev->status);
9238f36a 2601
10572132 2602 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 2603 atomic_set(&hdev->cmd_cnt, 1);
2604 if (!skb_queue_empty(&hdev->cmd_q))
c347b765 2605 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 2606 }
2607}
2608
6039aa73 2609static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2610{
2611 struct hci_ev_role_change *ev = (void *) skb->data;
2612 struct hci_conn *conn;
2613
9f1db00c 2614 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 2615
2616 hci_dev_lock(hdev);
2617
2618 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2619 if (conn) {
2620 if (!ev->status) {
2621 if (ev->role)
2622 conn->link_mode &= ~HCI_LM_MASTER;
2623 else
2624 conn->link_mode |= HCI_LM_MASTER;
2625 }
2626
51a8efd7 2627 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 2628
2629 hci_role_switch_cfm(conn, ev->status, ev->role);
2630 }
2631
2632 hci_dev_unlock(hdev);
2633}
2634
6039aa73 2635static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2636{
2637 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 2638 int i;
2639
32ac5b9b
AE		 2640 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2641 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2642 return;
2643 }
2644
c5993de8 2645 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 2646 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
a9de9248
MH		 2647 BT_DBG("%s bad parameters", hdev->name);
2648 return;
2649 }
2650
c5993de8
AE		 2651 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2652
613a1c0c
AE		 2653 for (i = 0; i < ev->num_hndl; i++) {
2654 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 2655 struct hci_conn *conn;
2656 __u16 handle, count;
2657
613a1c0c
AE		 2658 handle = __le16_to_cpu(info->handle);
2659 count = __le16_to_cpu(info->count);
a9de9248
MH		 2660
2661 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 2662 if (!conn)
2663 continue;
2664
2665 conn->sent -= count;
2666
2667 switch (conn->type) {
2668 case ACL_LINK:
2669 hdev->acl_cnt += count;
2670 if (hdev->acl_cnt > hdev->acl_pkts)
2671 hdev->acl_cnt = hdev->acl_pkts;
2672 break;
2673
2674 case LE_LINK:
2675 if (hdev->le_pkts) {
2676 hdev->le_cnt += count;
2677 if (hdev->le_cnt > hdev->le_pkts)
2678 hdev->le_cnt = hdev->le_pkts;
2679 } else {
70f23020
AE		 2680 hdev->acl_cnt += count;
2681 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 2682 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 2683 }
f4280918
AE		 2684 break;
2685
2686 case SCO_LINK:
2687 hdev->sco_cnt += count;
2688 if (hdev->sco_cnt > hdev->sco_pkts)
2689 hdev->sco_cnt = hdev->sco_pkts;
2690 break;
2691
2692 default:
2693 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2694 break;
a9de9248
MH		 2695 }
2696 }
2697
3eff45ea 2698 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 2699}
2700
76ef7cf7
AE		 2701static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2702 __u16 handle)
2703{
2704 struct hci_chan *chan;
2705
2706 switch (hdev->dev_type) {
2707 case HCI_BREDR:
2708 return hci_conn_hash_lookup_handle(hdev, handle);
2709 case HCI_AMP:
2710 chan = hci_chan_lookup_handle(hdev, handle);
2711 if (chan)
2712 return chan->conn;
2713 break;
2714 default:
2715 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2716 break;
2717 }
2718
2719 return NULL;
2720}
2721
6039aa73 2722static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 2723{
2724 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2725 int i;
2726
2727 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2728 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2729 return;
2730 }
2731
2732 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
807deac2 2733 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
25e89e99
AE		 2734 BT_DBG("%s bad parameters", hdev->name);
2735 return;
2736 }
2737
2738 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 2739 ev->num_hndl);
25e89e99
AE		 2740
2741 for (i = 0; i < ev->num_hndl; i++) {
2742 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 2743 struct hci_conn *conn = NULL;
25e89e99
AE		 2744 __u16 handle, block_count;
2745
2746 handle = __le16_to_cpu(info->handle);
2747 block_count = __le16_to_cpu(info->blocks);
2748
76ef7cf7 2749 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 2750 if (!conn)
2751 continue;
2752
2753 conn->sent -= block_count;
2754
2755 switch (conn->type) {
2756 case ACL_LINK:
bd1eb66b 2757 case AMP_LINK:
25e89e99
AE		 2758 hdev->block_cnt += block_count;
2759 if (hdev->block_cnt > hdev->num_blocks)
2760 hdev->block_cnt = hdev->num_blocks;
2761 break;
2762
2763 default:
2764 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2765 break;
2766 }
2767 }
2768
2769 queue_work(hdev->workqueue, &hdev->tx_work);
2770}
2771
6039aa73 2772static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2773{
a9de9248 2774 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 2775 struct hci_conn *conn;
2776
9f1db00c 2777 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2778
2779 hci_dev_lock(hdev);
2780
2781 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 2782 if (conn) {
2783 conn->mode = ev->mode;
a9de9248 2784
8fc9ced3
GP		 2785 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2786 &conn->flags)) {
a9de9248 2787 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 2788 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 2789 else
58a681ef 2790 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 2791 }
e73439d8 2792
51a8efd7 2793 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 2794 hci_sco_setup(conn, ev->status);
04837f64
MH		 2795 }
2796
2797 hci_dev_unlock(hdev);
2798}
2799
6039aa73 2800static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 2801{
052b30b0
MH		 2802 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2803 struct hci_conn *conn;
2804
a9de9248 2805 BT_DBG("%s", hdev->name);
052b30b0
MH		 2806
2807 hci_dev_lock(hdev);
2808
2809 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 2810 if (!conn)
2811 goto unlock;
2812
2813 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 2814 hci_conn_hold(conn);
2815 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 2816 hci_conn_drop(conn);
052b30b0
MH		 2817 }
2818
a8b2d5c2 2819 if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
03b555e1 2820 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 2821 sizeof(ev->bdaddr), &ev->bdaddr);
a8b2d5c2 2822 else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
a770bb5a
WR		 2823 u8 secure;
2824
2825 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2826 secure = 1;
2827 else
2828 secure = 0;
2829
744cf19e 2830 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 2831 }
980e1a53 2832
b6f98044 2833unlock:
052b30b0 2834 hci_dev_unlock(hdev);
a9de9248
MH		 2835}
2836
6039aa73 2837static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 2838{
55ed8ca1
JH		 2839 struct hci_ev_link_key_req *ev = (void *) skb->data;
2840 struct hci_cp_link_key_reply cp;
2841 struct hci_conn *conn;
2842 struct link_key *key;
2843
a9de9248 2844 BT_DBG("%s", hdev->name);
55ed8ca1 2845
034cbea0 2846 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
55ed8ca1
JH		 2847 return;
2848
2849 hci_dev_lock(hdev);
2850
2851 key = hci_find_link_key(hdev, &ev->bdaddr);
2852 if (!key) {
6ed93dc6
AE		 2853 BT_DBG("%s link key not found for %pMR", hdev->name,
2854 &ev->bdaddr);
55ed8ca1
JH		 2855 goto not_found;
2856 }
2857
6ed93dc6
AE		 2858 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2859 &ev->bdaddr);
55ed8ca1 2860
a8b2d5c2 2861 if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
807deac2 2862 key->type == HCI_LK_DEBUG_COMBINATION) {
55ed8ca1
JH		 2863 BT_DBG("%s ignoring debug key", hdev->name);
2864 goto not_found;
2865 }
2866
2867 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 2868 if (conn) {
66138ce8
MH		 2869 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2870 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 2871 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 2872 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2873 goto not_found;
2874 }
55ed8ca1 2875
60b83f57 2876 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
807deac2 2877 conn->pending_sec_level == BT_SECURITY_HIGH) {
8fc9ced3
GP		 2878 BT_DBG("%s ignoring key unauthenticated for high security",
2879 hdev->name);
60b83f57
WR		 2880 goto not_found;
2881 }
2882
2883 conn->key_type = key->type;
2884 conn->pin_length = key->pin_len;
55ed8ca1
JH		 2885 }
2886
2887 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 2888 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2889
2890 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2891
2892 hci_dev_unlock(hdev);
2893
2894 return;
2895
2896not_found:
2897 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2898 hci_dev_unlock(hdev);
a9de9248
MH		 2899}
2900
6039aa73 2901static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 2902{
052b30b0
MH		 2903 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2904 struct hci_conn *conn;
55ed8ca1 2905 u8 pin_len = 0;
052b30b0 2906
a9de9248 2907 BT_DBG("%s", hdev->name);
052b30b0
MH		 2908
2909 hci_dev_lock(hdev);
2910
2911 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2912 if (conn) {
2913 hci_conn_hold(conn);
2914 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
980e1a53 2915 pin_len = conn->pin_length;
13d39315
WR		 2916
2917 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2918 conn->key_type = ev->key_type;
2919
76a68ba0 2920 hci_conn_drop(conn);
052b30b0
MH		 2921 }
2922
034cbea0 2923 if (test_bit(HCI_MGMT, &hdev->dev_flags))
d25e28ab 2924 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
807deac2 2925 ev->key_type, pin_len);
55ed8ca1 2926
052b30b0 2927 hci_dev_unlock(hdev);
a9de9248
MH		 2928}
2929
6039aa73 2930static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2931{
a9de9248 2932 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 2933 struct hci_conn *conn;
1da177e4 2934
9f1db00c 2935 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2936
2937 hci_dev_lock(hdev);
2938
04837f64 2939 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2940 if (conn && !ev->status) {
2941 struct inquiry_entry *ie;
2942
cc11b9c1
AE		 2943 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2944 if (ie) {
1da177e4
LT		 2945 ie->data.clock_offset = ev->clock_offset;
2946 ie->timestamp = jiffies;
2947 }
2948 }
2949
2950 hci_dev_unlock(hdev);
2951}
2952
6039aa73 2953static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 2954{
2955 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2956 struct hci_conn *conn;
2957
9f1db00c 2958 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 2959
2960 hci_dev_lock(hdev);
2961
2962 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2963 if (conn && !ev->status)
2964 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2965
2966 hci_dev_unlock(hdev);
2967}
2968
6039aa73 2969static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 2970{
a9de9248 2971 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 2972 struct inquiry_entry *ie;
2973
2974 BT_DBG("%s", hdev->name);
2975
2976 hci_dev_lock(hdev);
2977
cc11b9c1
AE		 2978 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2979 if (ie) {
85a1e930
MH		 2980 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2981 ie->timestamp = jiffies;
2982 }
2983
2984 hci_dev_unlock(hdev);
2985}
2986
6039aa73
GP		 2987static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2988 struct sk_buff *skb)
a9de9248
MH		 2989{
2990 struct inquiry_data data;
2991 int num_rsp = *((__u8 *) skb->data);
388fc8fa 2992 bool name_known, ssp;
a9de9248
MH		 2993
2994 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2995
2996 if (!num_rsp)
2997 return;
2998
1519cc17
AG		 2999 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3000 return;
3001
a9de9248
MH		 3002 hci_dev_lock(hdev);
3003
3004 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3005 struct inquiry_info_with_rssi_and_pscan_mode *info;
3006 info = (void *) (skb->data + 1);
a9de9248 3007
e17acd40 3008 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 3009 bacpy(&data.bdaddr, &info->bdaddr);
3010 data.pscan_rep_mode = info->pscan_rep_mode;
3011 data.pscan_period_mode = info->pscan_period_mode;
3012 data.pscan_mode = info->pscan_mode;
3013 memcpy(data.dev_class, info->dev_class, 3);
3014 data.clock_offset = info->clock_offset;
3015 data.rssi = info->rssi;
41a96212 3016 data.ssp_mode = 0x00;
3175405b
JH		 3017
3018 name_known = hci_inquiry_cache_update(hdev, &data,
04124681 3019 false, &ssp);
48264f06 3020 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681
GP		 3021 info->dev_class, info->rssi,
3022 !name_known, ssp, NULL, 0);
a9de9248
MH		 3023 }
3024 } else {
3025 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3026
e17acd40 3027 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 3028 bacpy(&data.bdaddr, &info->bdaddr);
3029 data.pscan_rep_mode = info->pscan_rep_mode;
3030 data.pscan_period_mode = info->pscan_period_mode;
3031 data.pscan_mode = 0x00;
3032 memcpy(data.dev_class, info->dev_class, 3);
3033 data.clock_offset = info->clock_offset;
3034 data.rssi = info->rssi;
41a96212 3035 data.ssp_mode = 0x00;
3175405b 3036 name_known = hci_inquiry_cache_update(hdev, &data,
04124681 3037 false, &ssp);
48264f06 3038 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681
GP		 3039 info->dev_class, info->rssi,
3040 !name_known, ssp, NULL, 0);
a9de9248
MH		 3041 }
3042 }
3043
3044 hci_dev_unlock(hdev);
3045}
3046
6039aa73
GP		 3047static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3048 struct sk_buff *skb)
a9de9248 3049{
41a96212
MH		 3050 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3051 struct hci_conn *conn;
3052
a9de9248 3053 BT_DBG("%s", hdev->name);
41a96212 3054
41a96212
MH		 3055 hci_dev_lock(hdev);
3056
3057 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3058 if (!conn)
3059 goto unlock;
41a96212 3060
cad718ed
JH		 3061 if (ev->page < HCI_MAX_PAGES)
3062 memcpy(conn->features[ev->page], ev->features, 8);
3063
ccd556fe
JH		 3064 if (!ev->status && ev->page == 0x01) {
3065 struct inquiry_entry *ie;
41a96212 3066
cc11b9c1
AE		 3067 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3068 if (ie)
02b7cc62 3069 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 3070
bbb0eada 3071 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 3072 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 3073 } else {
3074 /* It is mandatory by the Bluetooth specification that
3075 * Extended Inquiry Results are only used when Secure
3076 * Simple Pairing is enabled, but some devices violate
3077 * this.
3078 *
3079 * To make these devices work, the internal SSP
3080 * enabled flag needs to be cleared if the remote host
3081 * features do not indicate SSP support */
3082 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3083 }
eb9a8f3f
MH		 3084
3085 if (ev->features[0] & LMP_HOST_SC)
3086 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 3087 }
3088
3089 if (conn->state != BT_CONFIG)
3090 goto unlock;
3091
671267bf 3092 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3093 struct hci_cp_remote_name_req cp;
3094 memset(&cp, 0, sizeof(cp));
3095 bacpy(&cp.bdaddr, &conn->dst);
3096 cp.pscan_rep_mode = 0x02;
3097 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33
JH		 3098 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3099 mgmt_device_connected(hdev, &conn->dst, conn->type,
04124681
GP		 3100 conn->dst_type, 0, NULL, 0,
3101 conn->dev_class);
392599b9 3102
127178d2 3103 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 3104 conn->state = BT_CONNECTED;
3105 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 3106 hci_conn_drop(conn);
41a96212
MH		 3107 }
3108
ccd556fe 3109unlock:
41a96212 3110 hci_dev_unlock(hdev);
a9de9248
MH		 3111}
3112
6039aa73
GP		 3113static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3114 struct sk_buff *skb)
a9de9248 3115{
b6a0dc82
MH		 3116 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3117 struct hci_conn *conn;
3118
9f1db00c 3119 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 3120
3121 hci_dev_lock(hdev);
3122
3123 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 3124 if (!conn) {
3125 if (ev->link_type == ESCO_LINK)
3126 goto unlock;
3127
3128 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3129 if (!conn)
3130 goto unlock;
3131
3132 conn->type = SCO_LINK;
3133 }
b6a0dc82 3134
732547f9
MH		 3135 switch (ev->status) {
3136 case 0x00:
b6a0dc82
MH		 3137 conn->handle = __le16_to_cpu(ev->handle);
3138 conn->state = BT_CONNECTED;
7d0db0a3
MH		 3139
3140 hci_conn_add_sysfs(conn);
732547f9
MH		 3141 break;
3142
1a4c958c 3143 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 3144 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 3145 case 0x1c: /* SCO interval rejected */
1038a00b 3146 case 0x1a: /* Unsupported Remote Feature */
732547f9 3147 case 0x1f: /* Unspecified error */
2dea632f 3148 if (conn->out) {
732547f9
MH		 3149 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3150 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 3151 if (hci_setup_sync(conn, conn->link->handle))
3152 goto unlock;
732547f9
MH		 3153 }
3154 /* fall through */
3155
3156 default:
b6a0dc82 3157 conn->state = BT_CLOSED;
732547f9
MH		 3158 break;
3159 }
b6a0dc82
MH		 3160
3161 hci_proto_connect_cfm(conn, ev->status);
3162 if (ev->status)
3163 hci_conn_del(conn);
3164
3165unlock:
3166 hci_dev_unlock(hdev);
a9de9248
MH		 3167}
3168
efdcf8e3
MH		 3169static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3170{
3171 size_t parsed = 0;
3172
3173 while (parsed < eir_len) {
3174 u8 field_len = eir[0];
3175
3176 if (field_len == 0)
3177 return parsed;
3178
3179 parsed += field_len + 1;
3180 eir += field_len + 1;
3181 }
3182
3183 return eir_len;
3184}
3185
6039aa73
GP		 3186static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3187 struct sk_buff *skb)
1da177e4 3188{
a9de9248
MH		 3189 struct inquiry_data data;
3190 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3191 int num_rsp = *((__u8 *) skb->data);
9d939d94 3192 size_t eir_len;
1da177e4 3193
a9de9248 3194 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 3195
a9de9248
MH		 3196 if (!num_rsp)
3197 return;
1da177e4 3198
1519cc17
AG		 3199 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3200 return;
3201
a9de9248
MH		 3202 hci_dev_lock(hdev);
3203
e17acd40 3204 for (; num_rsp; num_rsp--, info++) {
388fc8fa 3205 bool name_known, ssp;
561aafbc 3206
a9de9248 3207 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 3208 data.pscan_rep_mode = info->pscan_rep_mode;
3209 data.pscan_period_mode = info->pscan_period_mode;
3210 data.pscan_mode = 0x00;
a9de9248 3211 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 3212 data.clock_offset = info->clock_offset;
3213 data.rssi = info->rssi;
41a96212 3214 data.ssp_mode = 0x01;
561aafbc 3215
a8b2d5c2 3216 if (test_bit(HCI_MGMT, &hdev->dev_flags))
4ddb1930 3217 name_known = eir_has_data_type(info->data,
04124681
GP		 3218 sizeof(info->data),
3219 EIR_NAME_COMPLETE);
561aafbc
JH		 3220 else
3221 name_known = true;
3222
388fc8fa 3223 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
04124681 3224 &ssp);
9d939d94 3225 eir_len = eir_get_length(info->data, sizeof(info->data));
48264f06 3226 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 3227 info->dev_class, info->rssi, !name_known,
9d939d94 3228 ssp, info->data, eir_len);
a9de9248
MH		 3229 }
3230
3231 hci_dev_unlock(hdev);
3232}
1da177e4 3233
1c2e0041
JH		 3234static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3235 struct sk_buff *skb)
3236{
3237 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3238 struct hci_conn *conn;
3239
9f1db00c 3240 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 3241 __le16_to_cpu(ev->handle));
3242
3243 hci_dev_lock(hdev);
3244
3245 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3246 if (!conn)
3247 goto unlock;
3248
3249 if (!ev->status)
3250 conn->sec_level = conn->pending_sec_level;
3251
3252 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3253
3254 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 3255 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 3256 hci_conn_drop(conn);
1c2e0041
JH		 3257 goto unlock;
3258 }
3259
3260 if (conn->state == BT_CONFIG) {
3261 if (!ev->status)
3262 conn->state = BT_CONNECTED;
3263
3264 hci_proto_connect_cfm(conn, ev->status);
76a68ba0 3265 hci_conn_drop(conn);
1c2e0041
JH		 3266 } else {
3267 hci_auth_cfm(conn, ev->status);
3268
3269 hci_conn_hold(conn);
3270 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3271 hci_conn_drop(conn);
1c2e0041
JH		 3272 }
3273
3274unlock:
3275 hci_dev_unlock(hdev);
3276}
3277
6039aa73 3278static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d
JH		 3279{
3280 /* If remote requests dedicated bonding follow that lead */
acabae96
MA		 3281 if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3282 conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
17fa4b9d
JH		 3283 /* If both remote and local IO capabilities allow MITM
3284 * protection then require it, otherwise don't */
acabae96
MA		 3285 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3286 conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3287 return HCI_AT_DEDICATED_BONDING;
17fa4b9d 3288 else
acabae96 3289 return HCI_AT_DEDICATED_BONDING_MITM;
17fa4b9d
JH		 3290 }
3291
3292 /* If remote requests no-bonding follow that lead */
acabae96
MA		 3293 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3294 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 3295 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d
JH		 3296
3297 return conn->auth_type;
3298}
3299
6039aa73 3300static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 3301{
3302 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3303 struct hci_conn *conn;
3304
3305 BT_DBG("%s", hdev->name);
3306
3307 hci_dev_lock(hdev);
3308
3309 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 3310 if (!conn)
3311 goto unlock;
3312
3313 hci_conn_hold(conn);
3314
a8b2d5c2 3315 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
03b555e1
JH		 3316 goto unlock;
3317
a8b2d5c2 3318 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
807deac2 3319 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 3320 struct hci_cp_io_capability_reply cp;
3321
3322 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 3323 /* Change the IO capability from KeyboardDisplay
3324 * to DisplayYesNo as it is not supported by BT spec. */
3325 cp.capability = (conn->io_capability == 0x04) ?
a767631a 3326 HCI_IO_DISPLAY_YESNO : conn->io_capability;
7cbc9bd9
JH		 3327 conn->auth_type = hci_get_auth_req(conn);
3328 cp.authentication = conn->auth_type;
17fa4b9d 3329
8fc9ced3
GP		 3330 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3331 (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
ce85ee13
SJ		 3332 cp.oob_data = 0x01;
3333 else
3334 cp.oob_data = 0x00;
3335
17fa4b9d 3336 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 3337 sizeof(cp), &cp);
03b555e1
JH		 3338 } else {
3339 struct hci_cp_io_capability_neg_reply cp;
3340
3341 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 3342 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 3343
03b555e1 3344 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 3345 sizeof(cp), &cp);
03b555e1
JH		 3346 }
3347
3348unlock:
3349 hci_dev_unlock(hdev);
3350}
3351
6039aa73 3352static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 3353{
3354 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3355 struct hci_conn *conn;
3356
3357 BT_DBG("%s", hdev->name);
3358
3359 hci_dev_lock(hdev);
3360
3361 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3362 if (!conn)
3363 goto unlock;
3364
03b555e1 3365 conn->remote_cap = ev->capability;
03b555e1 3366 conn->remote_auth = ev->authentication;
58a681ef
JH		 3367 if (ev->oob_data)
3368 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
03b555e1
JH		 3369
3370unlock:
0493684e
MH		 3371 hci_dev_unlock(hdev);
3372}
3373
6039aa73
GP		 3374static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3375 struct sk_buff *skb)
a5c29683
JH		 3376{
3377 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 3378 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 3379 struct hci_conn *conn;
a5c29683
JH		 3380
3381 BT_DBG("%s", hdev->name);
3382
3383 hci_dev_lock(hdev);
3384
a8b2d5c2 3385 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
7a828908 3386 goto unlock;
a5c29683 3387
7a828908
JH		 3388 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3389 if (!conn)
3390 goto unlock;
3391
3392 loc_mitm = (conn->auth_type & 0x01);
3393 rem_mitm = (conn->remote_auth & 0x01);
3394
3395 /* If we require MITM but the remote device can't provide that
3396 * (it has NoInputNoOutput) then reject the confirmation
3397 * request. The only exception is when we're dedicated bonding
3398 * initiators (connect_cfm_cb set) since then we always have the MITM
3399 * bit set. */
a767631a
MA		 3400 if (!conn->connect_cfm_cb && loc_mitm &&
3401 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 3402 BT_DBG("Rejecting request: remote device can't provide MITM");
3403 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 3404 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 3405 goto unlock;
3406 }
3407
3408 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 3409 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3410 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 3411
3412 /* If we're not the initiators request authorization to
3413 * proceed from user space (mgmt_user_confirm with
3414 * confirm_hint set to 1). */
51a8efd7 3415 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
55bc1a37
JH		 3416 BT_DBG("Confirming auto-accept as acceptor");
3417 confirm_hint = 1;
3418 goto confirm;
3419 }
3420
9f61656a 3421 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 3422 hdev->auto_accept_delay);
9f61656a
JH		 3423
3424 if (hdev->auto_accept_delay > 0) {
3425 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 3426 queue_delayed_work(conn->hdev->workqueue,
3427 &conn->auto_accept_work, delay);
9f61656a
JH		 3428 goto unlock;
3429 }
3430
7a828908 3431 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 3432 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 3433 goto unlock;
3434 }
3435
55bc1a37 3436confirm:
272d90df 3437 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
04124681 3438 confirm_hint);
7a828908
JH		 3439
3440unlock:
a5c29683
JH		 3441 hci_dev_unlock(hdev);
3442}
3443
6039aa73
GP		 3444static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3445 struct sk_buff *skb)
1143d458
BG		 3446{
3447 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3448
3449 BT_DBG("%s", hdev->name);
3450
a8b2d5c2 3451 if (test_bit(HCI_MGMT, &hdev->dev_flags))
272d90df 3452 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 3453}
3454
92a25256
JH		 3455static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3456 struct sk_buff *skb)
3457{
3458 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3459 struct hci_conn *conn;
3460
3461 BT_DBG("%s", hdev->name);
3462
3463 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3464 if (!conn)
3465 return;
3466
3467 conn->passkey_notify = __le32_to_cpu(ev->passkey);
3468 conn->passkey_entered = 0;
3469
3470 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3471 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3472 conn->dst_type, conn->passkey_notify,
3473 conn->passkey_entered);
3474}
3475
3476static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3477{
3478 struct hci_ev_keypress_notify *ev = (void *) skb->data;
3479 struct hci_conn *conn;
3480
3481 BT_DBG("%s", hdev->name);
3482
3483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3484 if (!conn)
3485 return;
3486
3487 switch (ev->type) {
3488 case HCI_KEYPRESS_STARTED:
3489 conn->passkey_entered = 0;
3490 return;
3491
3492 case HCI_KEYPRESS_ENTERED:
3493 conn->passkey_entered++;
3494 break;
3495
3496 case HCI_KEYPRESS_ERASED:
3497 conn->passkey_entered--;
3498 break;
3499
3500 case HCI_KEYPRESS_CLEARED:
3501 conn->passkey_entered = 0;
3502 break;
3503
3504 case HCI_KEYPRESS_COMPLETED:
3505 return;
3506 }
3507
3508 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3509 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3510 conn->dst_type, conn->passkey_notify,
3511 conn->passkey_entered);
3512}
3513
6039aa73
GP		 3514static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3515 struct sk_buff *skb)
0493684e
MH		 3516{
3517 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3518 struct hci_conn *conn;
3519
3520 BT_DBG("%s", hdev->name);
3521
3522 hci_dev_lock(hdev);
3523
3524 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 3525 if (!conn)
3526 goto unlock;
3527
3528 /* To avoid duplicate auth_failed events to user space we check
3529 * the HCI_CONN_AUTH_PEND flag which will be set if we
3530 * initiated the authentication. A traditional auth_complete
3531 * event gets always produced as initiator and is also mapped to
3532 * the mgmt_auth_failed event */
fa1bd918 3533 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
bab73cb6 3534 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
04124681 3535 ev->status);
0493684e 3536
76a68ba0 3537 hci_conn_drop(conn);
2a611692
JH		 3538
3539unlock:
0493684e
MH		 3540 hci_dev_unlock(hdev);
3541}
3542
6039aa73
GP		 3543static void hci_remote_host_features_evt(struct hci_dev *hdev,
3544 struct sk_buff *skb)
41a96212
MH		 3545{
3546 struct hci_ev_remote_host_features *ev = (void *) skb->data;
3547 struct inquiry_entry *ie;
cad718ed 3548 struct hci_conn *conn;
41a96212
MH		 3549
3550 BT_DBG("%s", hdev->name);
3551
3552 hci_dev_lock(hdev);
3553
cad718ed
JH		 3554 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3555 if (conn)
3556 memcpy(conn->features[1], ev->features, 8);
3557
cc11b9c1
AE		 3558 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3559 if (ie)
02b7cc62 3560 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 3561
3562 hci_dev_unlock(hdev);
3563}
3564
6039aa73
GP		 3565static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3566 struct sk_buff *skb)
2763eda6
SJ		 3567{
3568 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3569 struct oob_data *data;
3570
3571 BT_DBG("%s", hdev->name);
3572
3573 hci_dev_lock(hdev);
3574
a8b2d5c2 3575 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
e1ba1f15
SJ		 3576 goto unlock;
3577
2763eda6
SJ		 3578 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3579 if (data) {
519ca9d0
MH		 3580 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
3581 struct hci_cp_remote_oob_ext_data_reply cp;
2763eda6 3582
519ca9d0
MH		 3583 bacpy(&cp.bdaddr, &ev->bdaddr);
3584 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
3585 memcpy(cp.randomizer192, data->randomizer192,
3586 sizeof(cp.randomizer192));
3587 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
3588 memcpy(cp.randomizer256, data->randomizer256,
3589 sizeof(cp.randomizer256));
3590
3591 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
3592 sizeof(cp), &cp);
3593 } else {
3594 struct hci_cp_remote_oob_data_reply cp;
2763eda6 3595
519ca9d0
MH		 3596 bacpy(&cp.bdaddr, &ev->bdaddr);
3597 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
3598 memcpy(cp.randomizer, data->randomizer192,
3599 sizeof(cp.randomizer));
3600
3601 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
3602 sizeof(cp), &cp);
3603 }
2763eda6
SJ		 3604 } else {
3605 struct hci_cp_remote_oob_data_neg_reply cp;
3606
3607 bacpy(&cp.bdaddr, &ev->bdaddr);
519ca9d0
MH		 3608 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
3609 sizeof(cp), &cp);
2763eda6
SJ		 3610 }
3611
e1ba1f15 3612unlock:
2763eda6
SJ		 3613 hci_dev_unlock(hdev);
3614}
3615
d5e91192
AE		 3616static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3617 struct sk_buff *skb)
3618{
3619 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3620 struct hci_conn *hcon, *bredr_hcon;
3621
3622 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3623 ev->status);
3624
3625 hci_dev_lock(hdev);
3626
3627 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3628 if (!hcon) {
3629 hci_dev_unlock(hdev);
3630 return;
3631 }
3632
3633 if (ev->status) {
3634 hci_conn_del(hcon);
3635 hci_dev_unlock(hdev);
3636 return;
3637 }
3638
3639 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3640
3641 hcon->state = BT_CONNECTED;
3642 bacpy(&hcon->dst, &bredr_hcon->dst);
3643
3644 hci_conn_hold(hcon);
3645 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 3646 hci_conn_drop(hcon);
d5e91192 3647
d5e91192
AE		 3648 hci_conn_add_sysfs(hcon);
3649
cf70ff22 3650 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 3651
cf70ff22 3652 hci_dev_unlock(hdev);
d5e91192
AE		 3653}
3654
27695fb4
AE		 3655static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3656{
3657 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3658 struct hci_conn *hcon;
3659 struct hci_chan *hchan;
3660 struct amp_mgr *mgr;
3661
3662 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3663 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3664 ev->status);
3665
3666 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3667 if (!hcon)
3668 return;
3669
3670 /* Create AMP hchan */
3671 hchan = hci_chan_create(hcon);
3672 if (!hchan)
3673 return;
3674
3675 hchan->handle = le16_to_cpu(ev->handle);
3676
3677 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3678
3679 mgr = hcon->amp_mgr;
3680 if (mgr && mgr->bredr_chan) {
3681 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3682
3683 l2cap_chan_lock(bredr_chan);
3684
3685 bredr_chan->conn->mtu = hdev->block_mtu;
3686 l2cap_logical_cfm(bredr_chan, hchan, 0);
3687 hci_conn_hold(hcon);
3688
3689 l2cap_chan_unlock(bredr_chan);
3690 }
3691}
3692
606e2a10
AE		 3693static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3694 struct sk_buff *skb)
3695{
3696 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3697 struct hci_chan *hchan;
3698
3699 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3700 le16_to_cpu(ev->handle), ev->status);
3701
3702 if (ev->status)
3703 return;
3704
3705 hci_dev_lock(hdev);
3706
3707 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3708 if (!hchan)
3709 goto unlock;
3710
3711 amp_destroy_logical_link(hchan, ev->reason);
3712
3713unlock:
3714 hci_dev_unlock(hdev);
3715}
3716
9eef6b3a
AE		 3717static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3718 struct sk_buff *skb)
3719{
3720 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3721 struct hci_conn *hcon;
3722
3723 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3724
3725 if (ev->status)
3726 return;
3727
3728 hci_dev_lock(hdev);
3729
3730 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3731 if (hcon) {
3732 hcon->state = BT_CLOSED;
3733 hci_conn_del(hcon);
3734 }
3735
3736 hci_dev_unlock(hdev);
3737}
3738
6039aa73 3739static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 3740{
3741 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3742 struct hci_conn *conn;
68d6f6de 3743 struct smp_irk *irk;
fcd89c09 3744
9f1db00c 3745 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
fcd89c09
VT		 3746
3747 hci_dev_lock(hdev);
3748
b47a09b3 3749 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
b62f328b
VT		 3750 if (!conn) {
3751 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3752 if (!conn) {
3753 BT_ERR("No memory for new connection");
230fd16a 3754 goto unlock;
b62f328b 3755 }
29b7988a
AG		 3756
3757 conn->dst_type = ev->bdaddr_type;
b9b343d2 3758
880be4e8
MH		 3759 /* The advertising parameters for own address type
3760 * define which source address and source address
3761 * type this connections has.
3762 */
3763 if (bacmp(&conn->src, BDADDR_ANY)) {
3764 conn->src_type = ADDR_LE_DEV_PUBLIC;
3765 } else {
3766 bacpy(&conn->src, &hdev->static_addr);
3767 conn->src_type = ADDR_LE_DEV_RANDOM;
3768 }
3769
b9b343d2
AG		 3770 if (ev->role == LE_CONN_ROLE_MASTER) {
3771 conn->out = true;
3772 conn->link_mode |= HCI_LM_MASTER;
3773 }
cb1d68f7
JH		 3774
3775 /* If we didn't have a hci_conn object previously
3776 * but we're in master role this must be something
3777 * initiated using a white list. Since white list based
3778 * connections are not "first class citizens" we don't
3779 * have full tracking of them. Therefore, we go ahead
3780 * with a "best effort" approach of determining the
3781 * initiator address based on the HCI_PRIVACY flag.
3782 */
3783 if (conn->out) {
3784 conn->resp_addr_type = ev->bdaddr_type;
3785 bacpy(&conn->resp_addr, &ev->bdaddr);
3786 if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
3787 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
3788 bacpy(&conn->init_addr, &hdev->rpa);
3789 } else {
3790 hci_copy_identity_address(hdev,
3791 &conn->init_addr,
3792 &conn->init_addr_type);
3793 }
3794 } else {
3795 /* Set the responder (our side) address type based on
3796 * the advertising address type.
3797 */
3798 conn->resp_addr_type = hdev->adv_addr_type;
3799 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
3800 bacpy(&conn->resp_addr, &hdev->random_addr);
3801 else
3802 bacpy(&conn->resp_addr, &hdev->bdaddr);
3803
3804 conn->init_addr_type = ev->bdaddr_type;
3805 bacpy(&conn->init_addr, &ev->bdaddr);
3806 }
9489eca4
JH		 3807 } else {
3808 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 3809 }
fcd89c09 3810
7be2edbb
JH		 3811 /* Ensure that the hci_conn contains the identity address type
3812 * regardless of which address the connection was made with.
7be2edbb 3813 */
a1f4c318 3814 hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
7be2edbb 3815
edb4b466
MH		 3816 /* Lookup the identity address from the stored connection
3817 * address and address type.
3818 *
3819 * When establishing connections to an identity address, the
3820 * connection procedure will store the resolvable random
3821 * address first. Now if it can be converted back into the
3822 * identity address, start using the identity address from
3823 * now on.
3824 */
3825 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 3826 if (irk) {
3827 bacpy(&conn->dst, &irk->bdaddr);
3828 conn->dst_type = irk->addr_type;
3829 }
3830
cd17decb 3831 if (ev->status) {
06c053fb 3832 hci_le_conn_failed(conn, ev->status);
cd17decb
AG		 3833 goto unlock;
3834 }
3835
b644ba33 3836 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
01fdb0fc 3837 mgmt_device_connected(hdev, &conn->dst, conn->type,
04124681 3838 conn->dst_type, 0, NULL, 0, NULL);
83bc71b4 3839
7b5c0d52 3840 conn->sec_level = BT_SECURITY_LOW;
fcd89c09
VT		 3841 conn->handle = __le16_to_cpu(ev->handle);
3842 conn->state = BT_CONNECTED;
3843
18722c24
JR		 3844 if (test_bit(HCI_6LOWPAN_ENABLED, &hdev->dev_flags))
3845 set_bit(HCI_CONN_6LOWPAN, &conn->flags);
3846
fcd89c09
VT		 3847 hci_conn_add_sysfs(conn);
3848
3849 hci_proto_connect_cfm(conn, ev->status);
3850
a4790dbd
AG		 3851 hci_pend_le_conn_del(hdev, &conn->dst, conn->dst_type);
3852
fcd89c09
VT		 3853unlock:
3854 hci_dev_unlock(hdev);
3855}
3856
a4790dbd
AG		 3857/* This function requires the caller holds hdev->lock */
3858static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
3859 u8 addr_type)
3860{
3861 struct hci_conn *conn;
5b906a84
AG		 3862 struct smp_irk *irk;
3863
3864 /* If this is a resolvable address, we should resolve it and then
3865 * update address and address type variables.
3866 */
3867 irk = hci_get_irk(hdev, addr, addr_type);
3868 if (irk) {
3869 addr = &irk->bdaddr;
3870 addr_type = irk->addr_type;
3871 }
a4790dbd
AG		 3872
3873 if (!hci_pend_le_conn_lookup(hdev, addr, addr_type))
3874 return;
3875
3876 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
3877 HCI_AT_NO_BONDING);
3878 if (!IS_ERR(conn))
3879 return;
3880
3881 switch (PTR_ERR(conn)) {
3882 case -EBUSY:
3883 /* If hci_connect() returns -EBUSY it means there is already
3884 * an LE connection attempt going on. Since controllers don't
3885 * support more than one connection attempt at the time, we
3886 * don't consider this an error case.
3887 */
3888 break;
3889 default:
3890 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
3891 }
3892}
3893
6039aa73 3894static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 3895{
e95beb41
AG		 3896 u8 num_reports = skb->data[0];
3897 void *ptr = &skb->data[1];
3c9e9195 3898 s8 rssi;
9aa04c91 3899
a4790dbd
AG		 3900 hci_dev_lock(hdev);
3901
e95beb41
AG		 3902 while (num_reports--) {
3903 struct hci_ev_le_advertising_info *ev = ptr;
9aa04c91 3904
a4790dbd
AG		 3905 if (ev->evt_type == LE_ADV_IND ||
3906 ev->evt_type == LE_ADV_DIRECT_IND)
3907 check_pending_le_conn(hdev, &ev->bdaddr,
3908 ev->bdaddr_type);
3909
3c9e9195
AG		 3910 rssi = ev->data[ev->length];
3911 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
04124681 3912 NULL, rssi, 0, 1, ev->data, ev->length);
3c9e9195 3913
e95beb41 3914 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 3915 }
a4790dbd
AG		 3916
3917 hci_dev_unlock(hdev);
9aa04c91
AG		 3918}
3919
6039aa73 3920static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 3921{
3922 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3923 struct hci_cp_le_ltk_reply cp;
bea710fe 3924 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 3925 struct hci_conn *conn;
c9839a11 3926 struct smp_ltk *ltk;
a7a595f6 3927
9f1db00c 3928 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 3929
3930 hci_dev_lock(hdev);
3931
3932 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 3933 if (conn == NULL)
3934 goto not_found;
a7a595f6 3935
fe39c7b2 3936 ltk = hci_find_ltk(hdev, ev->ediv, ev->rand, conn->out);
bea710fe
VCG		 3937 if (ltk == NULL)
3938 goto not_found;
3939
3940 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
a7a595f6 3941 cp.handle = cpu_to_le16(conn->handle);
c9839a11
VCG		 3942
3943 if (ltk->authenticated)
f8776218
AG		 3944 conn->pending_sec_level = BT_SECURITY_HIGH;
3945 else
3946 conn->pending_sec_level = BT_SECURITY_MEDIUM;
a7a595f6 3947
89cbb4da 3948 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 3949
3950 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3951
c9839a11
VCG		 3952 if (ltk->type & HCI_SMP_STK) {
3953 list_del(&ltk->list);
3954 kfree(ltk);
3955 }
3956
a7a595f6 3957 hci_dev_unlock(hdev);
bea710fe
VCG		 3958
3959 return;
3960
3961not_found:
3962 neg.handle = ev->handle;
3963 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3964 hci_dev_unlock(hdev);
a7a595f6
VCG		 3965}
3966
6039aa73 3967static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 3968{
3969 struct hci_ev_le_meta *le_ev = (void *) skb->data;
3970
3971 skb_pull(skb, sizeof(*le_ev));
3972
3973 switch (le_ev->subevent) {
3974 case HCI_EV_LE_CONN_COMPLETE:
3975 hci_le_conn_complete_evt(hdev, skb);
3976 break;
3977
9aa04c91
AG		 3978 case HCI_EV_LE_ADVERTISING_REPORT:
3979 hci_le_adv_report_evt(hdev, skb);
3980 break;
3981
a7a595f6
VCG		 3982 case HCI_EV_LE_LTK_REQ:
3983 hci_le_ltk_request_evt(hdev, skb);
3984 break;
3985
fcd89c09
VT		 3986 default:
3987 break;
3988 }
3989}
3990
9495b2ee
AE		 3991static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3992{
3993 struct hci_ev_channel_selected *ev = (void *) skb->data;
3994 struct hci_conn *hcon;
3995
3996 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3997
3998 skb_pull(skb, sizeof(*ev));
3999
4000 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4001 if (!hcon)
4002 return;
4003
4004 amp_read_loc_assoc_final_data(hdev, hcon);
4005}
4006
a9de9248
MH		 4007void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4008{
4009 struct hci_event_hdr *hdr = (void *) skb->data;
4010 __u8 event = hdr->evt;
4011
b6ddb638
JH		 4012 hci_dev_lock(hdev);
4013
4014 /* Received events are (currently) only needed when a request is
4015 * ongoing so avoid unnecessary memory allocation.
4016 */
4017 if (hdev->req_status == HCI_REQ_PEND) {
4018 kfree_skb(hdev->recv_evt);
4019 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4020 }
4021
4022 hci_dev_unlock(hdev);
4023
a9de9248
MH		 4024 skb_pull(skb, HCI_EVENT_HDR_SIZE);
4025
02350a72 4026 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
c1f23a2b
JB		 4027 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
4028 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
02350a72
JH		 4029
4030 hci_req_cmd_complete(hdev, opcode, 0);
4031 }
4032
a9de9248 4033 switch (event) {
1da177e4
LT		 4034 case HCI_EV_INQUIRY_COMPLETE:
4035 hci_inquiry_complete_evt(hdev, skb);
4036 break;
4037
4038 case HCI_EV_INQUIRY_RESULT:
4039 hci_inquiry_result_evt(hdev, skb);
4040 break;
4041
a9de9248
MH		 4042 case HCI_EV_CONN_COMPLETE:
4043 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 4044 break;
4045
1da177e4
LT		 4046 case HCI_EV_CONN_REQUEST:
4047 hci_conn_request_evt(hdev, skb);
4048 break;
4049
1da177e4
LT		 4050 case HCI_EV_DISCONN_COMPLETE:
4051 hci_disconn_complete_evt(hdev, skb);
4052 break;
4053
1da177e4
LT		 4054 case HCI_EV_AUTH_COMPLETE:
4055 hci_auth_complete_evt(hdev, skb);
4056 break;
4057
a9de9248
MH		 4058 case HCI_EV_REMOTE_NAME:
4059 hci_remote_name_evt(hdev, skb);
4060 break;
4061
1da177e4
LT		 4062 case HCI_EV_ENCRYPT_CHANGE:
4063 hci_encrypt_change_evt(hdev, skb);
4064 break;
4065
a9de9248
MH		 4066 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
4067 hci_change_link_key_complete_evt(hdev, skb);
4068 break;
4069
4070 case HCI_EV_REMOTE_FEATURES:
4071 hci_remote_features_evt(hdev, skb);
4072 break;
4073
a9de9248
MH		 4074 case HCI_EV_CMD_COMPLETE:
4075 hci_cmd_complete_evt(hdev, skb);
4076 break;
4077
4078 case HCI_EV_CMD_STATUS:
4079 hci_cmd_status_evt(hdev, skb);
4080 break;
4081
4082 case HCI_EV_ROLE_CHANGE:
4083 hci_role_change_evt(hdev, skb);
4084 break;
4085
4086 case HCI_EV_NUM_COMP_PKTS:
4087 hci_num_comp_pkts_evt(hdev, skb);
4088 break;
4089
4090 case HCI_EV_MODE_CHANGE:
4091 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 4092 break;
4093
4094 case HCI_EV_PIN_CODE_REQ:
4095 hci_pin_code_request_evt(hdev, skb);
4096 break;
4097
4098 case HCI_EV_LINK_KEY_REQ:
4099 hci_link_key_request_evt(hdev, skb);
4100 break;
4101
4102 case HCI_EV_LINK_KEY_NOTIFY:
4103 hci_link_key_notify_evt(hdev, skb);
4104 break;
4105
4106 case HCI_EV_CLOCK_OFFSET:
4107 hci_clock_offset_evt(hdev, skb);
4108 break;
4109
a8746417
MH		 4110 case HCI_EV_PKT_TYPE_CHANGE:
4111 hci_pkt_type_change_evt(hdev, skb);
4112 break;
4113
85a1e930
MH		 4114 case HCI_EV_PSCAN_REP_MODE:
4115 hci_pscan_rep_mode_evt(hdev, skb);
4116 break;
4117
a9de9248
MH		 4118 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
4119 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 4120 break;
4121
a9de9248
MH		 4122 case HCI_EV_REMOTE_EXT_FEATURES:
4123 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 4124 break;
4125
a9de9248
MH		 4126 case HCI_EV_SYNC_CONN_COMPLETE:
4127 hci_sync_conn_complete_evt(hdev, skb);
4128 break;
1da177e4 4129
a9de9248
MH		 4130 case HCI_EV_EXTENDED_INQUIRY_RESULT:
4131 hci_extended_inquiry_result_evt(hdev, skb);
4132 break;
1da177e4 4133
1c2e0041
JH		 4134 case HCI_EV_KEY_REFRESH_COMPLETE:
4135 hci_key_refresh_complete_evt(hdev, skb);
4136 break;
4137
0493684e
MH		 4138 case HCI_EV_IO_CAPA_REQUEST:
4139 hci_io_capa_request_evt(hdev, skb);
4140 break;
4141
03b555e1
JH		 4142 case HCI_EV_IO_CAPA_REPLY:
4143 hci_io_capa_reply_evt(hdev, skb);
4144 break;
4145
a5c29683
JH		 4146 case HCI_EV_USER_CONFIRM_REQUEST:
4147 hci_user_confirm_request_evt(hdev, skb);
4148 break;
4149
1143d458
BG		 4150 case HCI_EV_USER_PASSKEY_REQUEST:
4151 hci_user_passkey_request_evt(hdev, skb);
4152 break;
4153
92a25256
JH		 4154 case HCI_EV_USER_PASSKEY_NOTIFY:
4155 hci_user_passkey_notify_evt(hdev, skb);
4156 break;
4157
4158 case HCI_EV_KEYPRESS_NOTIFY:
4159 hci_keypress_notify_evt(hdev, skb);
4160 break;
4161
0493684e
MH		 4162 case HCI_EV_SIMPLE_PAIR_COMPLETE:
4163 hci_simple_pair_complete_evt(hdev, skb);
4164 break;
4165
41a96212
MH		 4166 case HCI_EV_REMOTE_HOST_FEATURES:
4167 hci_remote_host_features_evt(hdev, skb);
4168 break;
4169
fcd89c09
VT		 4170 case HCI_EV_LE_META:
4171 hci_le_meta_evt(hdev, skb);
4172 break;
4173
9495b2ee
AE		 4174 case HCI_EV_CHANNEL_SELECTED:
4175 hci_chan_selected_evt(hdev, skb);
4176 break;
4177
2763eda6
SJ		 4178 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4179 hci_remote_oob_data_request_evt(hdev, skb);
4180 break;
4181
d5e91192
AE		 4182 case HCI_EV_PHY_LINK_COMPLETE:
4183 hci_phy_link_complete_evt(hdev, skb);
4184 break;
4185
27695fb4
AE		 4186 case HCI_EV_LOGICAL_LINK_COMPLETE:
4187 hci_loglink_complete_evt(hdev, skb);
4188 break;
4189
606e2a10
AE		 4190 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
4191 hci_disconn_loglink_complete_evt(hdev, skb);
4192 break;
4193
9eef6b3a
AE		 4194 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
4195 hci_disconn_phylink_complete_evt(hdev, skb);
4196 break;
4197
25e89e99
AE		 4198 case HCI_EV_NUM_COMP_BLOCKS:
4199 hci_num_comp_blocks_evt(hdev, skb);
4200 break;
4201
a9de9248 4202 default:
9f1db00c 4203 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 4204 break;
4205 }
4206
4207 kfree_skb(skb);
4208 hdev->stat.evt_rx++;
4209}
ubuntu-bionic-kernel mirror