]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/hci_event.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'metag-for-v4.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan...
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_event.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI event handling. */
26
27 #include <asm/unaligned.h>
28
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "hci_request.h"
34 #include "hci_debugfs.h"
35 #include "a2mp.h"
36 #include "amp.h"
37 #include "smp.h"
38
39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
42 /* Handle HCI Event packets */
43
44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
45 {
46 __u8 status = *((__u8 *) skb->data);
47
48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
49
50 if (status)
51 return;
52
53 clear_bit(HCI_INQUIRY, &hdev->flags);
54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
56
57 hci_dev_lock(hdev);
58 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
59 hci_dev_unlock(hdev);
60
61 hci_conn_check_pending(hdev);
62 }
63
64 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
65 {
66 __u8 status = *((__u8 *) skb->data);
67
68 BT_DBG("%s status 0x%2.2x", hdev->name, status);
69
70 if (status)
71 return;
72
73 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
74 }
75
76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
77 {
78 __u8 status = *((__u8 *) skb->data);
79
80 BT_DBG("%s status 0x%2.2x", hdev->name, status);
81
82 if (status)
83 return;
84
85 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
86
87 hci_conn_check_pending(hdev);
88 }
89
90 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
91 struct sk_buff *skb)
92 {
93 BT_DBG("%s", hdev->name);
94 }
95
96 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
97 {
98 struct hci_rp_role_discovery *rp = (void *) skb->data;
99 struct hci_conn *conn;
100
101 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
102
103 if (rp->status)
104 return;
105
106 hci_dev_lock(hdev);
107
108 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
109 if (conn)
110 conn->role = rp->role;
111
112 hci_dev_unlock(hdev);
113 }
114
115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
116 {
117 struct hci_rp_read_link_policy *rp = (void *) skb->data;
118 struct hci_conn *conn;
119
120 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
121
122 if (rp->status)
123 return;
124
125 hci_dev_lock(hdev);
126
127 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
128 if (conn)
129 conn->link_policy = __le16_to_cpu(rp->policy);
130
131 hci_dev_unlock(hdev);
132 }
133
134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
135 {
136 struct hci_rp_write_link_policy *rp = (void *) skb->data;
137 struct hci_conn *conn;
138 void *sent;
139
140 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
141
142 if (rp->status)
143 return;
144
145 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
146 if (!sent)
147 return;
148
149 hci_dev_lock(hdev);
150
151 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
152 if (conn)
153 conn->link_policy = get_unaligned_le16(sent + 2);
154
155 hci_dev_unlock(hdev);
156 }
157
158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
159 struct sk_buff *skb)
160 {
161 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
162
163 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
164
165 if (rp->status)
166 return;
167
168 hdev->link_policy = __le16_to_cpu(rp->policy);
169 }
170
171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
172 struct sk_buff *skb)
173 {
174 __u8 status = *((__u8 *) skb->data);
175 void *sent;
176
177 BT_DBG("%s status 0x%2.2x", hdev->name, status);
178
179 if (status)
180 return;
181
182 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
183 if (!sent)
184 return;
185
186 hdev->link_policy = get_unaligned_le16(sent);
187 }
188
189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
190 {
191 __u8 status = *((__u8 *) skb->data);
192
193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
194
195 clear_bit(HCI_RESET, &hdev->flags);
196
197 if (status)
198 return;
199
200 /* Reset all non-persistent flags */
201 hci_dev_clear_volatile_flags(hdev);
202
203 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
204
205 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
206 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
207
208 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
209 hdev->adv_data_len = 0;
210
211 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
212 hdev->scan_rsp_data_len = 0;
213
214 hdev->le_scan_type = LE_SCAN_PASSIVE;
215
216 hdev->ssp_debug_mode = 0;
217
218 hci_bdaddr_list_clear(&hdev->le_white_list);
219 }
220
221 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
222 struct sk_buff *skb)
223 {
224 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
225 struct hci_cp_read_stored_link_key *sent;
226
227 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
228
229 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
230 if (!sent)
231 return;
232
233 if (!rp->status && sent->read_all == 0x01) {
234 hdev->stored_max_keys = rp->max_keys;
235 hdev->stored_num_keys = rp->num_keys;
236 }
237 }
238
239 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
240 struct sk_buff *skb)
241 {
242 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
245
246 if (rp->status)
247 return;
248
249 if (rp->num_keys <= hdev->stored_num_keys)
250 hdev->stored_num_keys -= rp->num_keys;
251 else
252 hdev->stored_num_keys = 0;
253 }
254
255 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
256 {
257 __u8 status = *((__u8 *) skb->data);
258 void *sent;
259
260 BT_DBG("%s status 0x%2.2x", hdev->name, status);
261
262 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
263 if (!sent)
264 return;
265
266 hci_dev_lock(hdev);
267
268 if (hci_dev_test_flag(hdev, HCI_MGMT))
269 mgmt_set_local_name_complete(hdev, sent, status);
270 else if (!status)
271 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
272
273 hci_dev_unlock(hdev);
274 }
275
276 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
277 {
278 struct hci_rp_read_local_name *rp = (void *) skb->data;
279
280 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
281
282 if (rp->status)
283 return;
284
285 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
286 hci_dev_test_flag(hdev, HCI_CONFIG))
287 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
288 }
289
290 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
291 {
292 __u8 status = *((__u8 *) skb->data);
293 void *sent;
294
295 BT_DBG("%s status 0x%2.2x", hdev->name, status);
296
297 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
298 if (!sent)
299 return;
300
301 hci_dev_lock(hdev);
302
303 if (!status) {
304 __u8 param = *((__u8 *) sent);
305
306 if (param == AUTH_ENABLED)
307 set_bit(HCI_AUTH, &hdev->flags);
308 else
309 clear_bit(HCI_AUTH, &hdev->flags);
310 }
311
312 if (hci_dev_test_flag(hdev, HCI_MGMT))
313 mgmt_auth_enable_complete(hdev, status);
314
315 hci_dev_unlock(hdev);
316 }
317
318 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
319 {
320 __u8 status = *((__u8 *) skb->data);
321 __u8 param;
322 void *sent;
323
324 BT_DBG("%s status 0x%2.2x", hdev->name, status);
325
326 if (status)
327 return;
328
329 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
330 if (!sent)
331 return;
332
333 param = *((__u8 *) sent);
334
335 if (param)
336 set_bit(HCI_ENCRYPT, &hdev->flags);
337 else
338 clear_bit(HCI_ENCRYPT, &hdev->flags);
339 }
340
341 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
342 {
343 __u8 status = *((__u8 *) skb->data);
344 __u8 param;
345 void *sent;
346
347 BT_DBG("%s status 0x%2.2x", hdev->name, status);
348
349 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
350 if (!sent)
351 return;
352
353 param = *((__u8 *) sent);
354
355 hci_dev_lock(hdev);
356
357 if (status) {
358 hdev->discov_timeout = 0;
359 goto done;
360 }
361
362 if (param & SCAN_INQUIRY)
363 set_bit(HCI_ISCAN, &hdev->flags);
364 else
365 clear_bit(HCI_ISCAN, &hdev->flags);
366
367 if (param & SCAN_PAGE)
368 set_bit(HCI_PSCAN, &hdev->flags);
369 else
370 clear_bit(HCI_PSCAN, &hdev->flags);
371
372 done:
373 hci_dev_unlock(hdev);
374 }
375
376 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
377 {
378 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
379
380 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
381
382 if (rp->status)
383 return;
384
385 memcpy(hdev->dev_class, rp->dev_class, 3);
386
387 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
388 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
389 }
390
391 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
392 {
393 __u8 status = *((__u8 *) skb->data);
394 void *sent;
395
396 BT_DBG("%s status 0x%2.2x", hdev->name, status);
397
398 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
399 if (!sent)
400 return;
401
402 hci_dev_lock(hdev);
403
404 if (status == 0)
405 memcpy(hdev->dev_class, sent, 3);
406
407 if (hci_dev_test_flag(hdev, HCI_MGMT))
408 mgmt_set_class_of_dev_complete(hdev, sent, status);
409
410 hci_dev_unlock(hdev);
411 }
412
413 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
414 {
415 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
416 __u16 setting;
417
418 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
419
420 if (rp->status)
421 return;
422
423 setting = __le16_to_cpu(rp->voice_setting);
424
425 if (hdev->voice_setting == setting)
426 return;
427
428 hdev->voice_setting = setting;
429
430 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
431
432 if (hdev->notify)
433 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
434 }
435
436 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
437 struct sk_buff *skb)
438 {
439 __u8 status = *((__u8 *) skb->data);
440 __u16 setting;
441 void *sent;
442
443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
444
445 if (status)
446 return;
447
448 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
449 if (!sent)
450 return;
451
452 setting = get_unaligned_le16(sent);
453
454 if (hdev->voice_setting == setting)
455 return;
456
457 hdev->voice_setting = setting;
458
459 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
460
461 if (hdev->notify)
462 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
463 }
464
465 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
466 struct sk_buff *skb)
467 {
468 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
469
470 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
471
472 if (rp->status)
473 return;
474
475 hdev->num_iac = rp->num_iac;
476
477 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
478 }
479
480 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
481 {
482 __u8 status = *((__u8 *) skb->data);
483 struct hci_cp_write_ssp_mode *sent;
484
485 BT_DBG("%s status 0x%2.2x", hdev->name, status);
486
487 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
488 if (!sent)
489 return;
490
491 hci_dev_lock(hdev);
492
493 if (!status) {
494 if (sent->mode)
495 hdev->features[1][0] |= LMP_HOST_SSP;
496 else
497 hdev->features[1][0] &= ~LMP_HOST_SSP;
498 }
499
500 if (hci_dev_test_flag(hdev, HCI_MGMT))
501 mgmt_ssp_enable_complete(hdev, sent->mode, status);
502 else if (!status) {
503 if (sent->mode)
504 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
505 else
506 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
507 }
508
509 hci_dev_unlock(hdev);
510 }
511
512 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
513 {
514 u8 status = *((u8 *) skb->data);
515 struct hci_cp_write_sc_support *sent;
516
517 BT_DBG("%s status 0x%2.2x", hdev->name, status);
518
519 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
520 if (!sent)
521 return;
522
523 hci_dev_lock(hdev);
524
525 if (!status) {
526 if (sent->support)
527 hdev->features[1][0] |= LMP_HOST_SC;
528 else
529 hdev->features[1][0] &= ~LMP_HOST_SC;
530 }
531
532 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
533 if (sent->support)
534 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
535 else
536 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
537 }
538
539 hci_dev_unlock(hdev);
540 }
541
542 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
543 {
544 struct hci_rp_read_local_version *rp = (void *) skb->data;
545
546 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
547
548 if (rp->status)
549 return;
550
551 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
552 hci_dev_test_flag(hdev, HCI_CONFIG)) {
553 hdev->hci_ver = rp->hci_ver;
554 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
555 hdev->lmp_ver = rp->lmp_ver;
556 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
557 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
558 }
559 }
560
561 static void hci_cc_read_local_commands(struct hci_dev *hdev,
562 struct sk_buff *skb)
563 {
564 struct hci_rp_read_local_commands *rp = (void *) skb->data;
565
566 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
567
568 if (rp->status)
569 return;
570
571 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
572 hci_dev_test_flag(hdev, HCI_CONFIG))
573 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
574 }
575
576 static void hci_cc_read_local_features(struct hci_dev *hdev,
577 struct sk_buff *skb)
578 {
579 struct hci_rp_read_local_features *rp = (void *) skb->data;
580
581 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
582
583 if (rp->status)
584 return;
585
586 memcpy(hdev->features, rp->features, 8);
587
588 /* Adjust default settings according to features
589 * supported by device. */
590
591 if (hdev->features[0][0] & LMP_3SLOT)
592 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
593
594 if (hdev->features[0][0] & LMP_5SLOT)
595 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
596
597 if (hdev->features[0][1] & LMP_HV2) {
598 hdev->pkt_type |= (HCI_HV2);
599 hdev->esco_type |= (ESCO_HV2);
600 }
601
602 if (hdev->features[0][1] & LMP_HV3) {
603 hdev->pkt_type |= (HCI_HV3);
604 hdev->esco_type |= (ESCO_HV3);
605 }
606
607 if (lmp_esco_capable(hdev))
608 hdev->esco_type |= (ESCO_EV3);
609
610 if (hdev->features[0][4] & LMP_EV4)
611 hdev->esco_type |= (ESCO_EV4);
612
613 if (hdev->features[0][4] & LMP_EV5)
614 hdev->esco_type |= (ESCO_EV5);
615
616 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
617 hdev->esco_type |= (ESCO_2EV3);
618
619 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
620 hdev->esco_type |= (ESCO_3EV3);
621
622 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
623 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
624 }
625
626 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
627 struct sk_buff *skb)
628 {
629 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
630
631 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
632
633 if (rp->status)
634 return;
635
636 if (hdev->max_page < rp->max_page)
637 hdev->max_page = rp->max_page;
638
639 if (rp->page < HCI_MAX_PAGES)
640 memcpy(hdev->features[rp->page], rp->features, 8);
641 }
642
643 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
644 struct sk_buff *skb)
645 {
646 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
647
648 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
649
650 if (rp->status)
651 return;
652
653 hdev->flow_ctl_mode = rp->mode;
654 }
655
656 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
657 {
658 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
659
660 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
661
662 if (rp->status)
663 return;
664
665 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
666 hdev->sco_mtu = rp->sco_mtu;
667 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
668 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
669
670 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
671 hdev->sco_mtu = 64;
672 hdev->sco_pkts = 8;
673 }
674
675 hdev->acl_cnt = hdev->acl_pkts;
676 hdev->sco_cnt = hdev->sco_pkts;
677
678 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
679 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
680 }
681
682 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
683 {
684 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
685
686 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
687
688 if (rp->status)
689 return;
690
691 if (test_bit(HCI_INIT, &hdev->flags))
692 bacpy(&hdev->bdaddr, &rp->bdaddr);
693
694 if (hci_dev_test_flag(hdev, HCI_SETUP))
695 bacpy(&hdev->setup_addr, &rp->bdaddr);
696 }
697
698 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
699 struct sk_buff *skb)
700 {
701 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
702
703 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
704
705 if (rp->status)
706 return;
707
708 if (test_bit(HCI_INIT, &hdev->flags)) {
709 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
710 hdev->page_scan_window = __le16_to_cpu(rp->window);
711 }
712 }
713
714 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
715 struct sk_buff *skb)
716 {
717 u8 status = *((u8 *) skb->data);
718 struct hci_cp_write_page_scan_activity *sent;
719
720 BT_DBG("%s status 0x%2.2x", hdev->name, status);
721
722 if (status)
723 return;
724
725 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
726 if (!sent)
727 return;
728
729 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
730 hdev->page_scan_window = __le16_to_cpu(sent->window);
731 }
732
733 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
734 struct sk_buff *skb)
735 {
736 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
737
738 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
739
740 if (rp->status)
741 return;
742
743 if (test_bit(HCI_INIT, &hdev->flags))
744 hdev->page_scan_type = rp->type;
745 }
746
747 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
748 struct sk_buff *skb)
749 {
750 u8 status = *((u8 *) skb->data);
751 u8 *type;
752
753 BT_DBG("%s status 0x%2.2x", hdev->name, status);
754
755 if (status)
756 return;
757
758 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
759 if (type)
760 hdev->page_scan_type = *type;
761 }
762
763 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
764 struct sk_buff *skb)
765 {
766 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
767
768 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
769
770 if (rp->status)
771 return;
772
773 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
774 hdev->block_len = __le16_to_cpu(rp->block_len);
775 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
776
777 hdev->block_cnt = hdev->num_blocks;
778
779 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
780 hdev->block_cnt, hdev->block_len);
781 }
782
783 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
784 {
785 struct hci_rp_read_clock *rp = (void *) skb->data;
786 struct hci_cp_read_clock *cp;
787 struct hci_conn *conn;
788
789 BT_DBG("%s", hdev->name);
790
791 if (skb->len < sizeof(*rp))
792 return;
793
794 if (rp->status)
795 return;
796
797 hci_dev_lock(hdev);
798
799 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
800 if (!cp)
801 goto unlock;
802
803 if (cp->which == 0x00) {
804 hdev->clock = le32_to_cpu(rp->clock);
805 goto unlock;
806 }
807
808 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
809 if (conn) {
810 conn->clock = le32_to_cpu(rp->clock);
811 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
812 }
813
814 unlock:
815 hci_dev_unlock(hdev);
816 }
817
818 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
819 struct sk_buff *skb)
820 {
821 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
822
823 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
824
825 if (rp->status)
826 return;
827
828 hdev->amp_status = rp->amp_status;
829 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
830 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
831 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
832 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
833 hdev->amp_type = rp->amp_type;
834 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
835 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
836 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
837 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
838 }
839
840 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
841 struct sk_buff *skb)
842 {
843 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
844
845 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
846
847 if (rp->status)
848 return;
849
850 hdev->inq_tx_power = rp->tx_power;
851 }
852
853 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
854 {
855 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
856 struct hci_cp_pin_code_reply *cp;
857 struct hci_conn *conn;
858
859 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
860
861 hci_dev_lock(hdev);
862
863 if (hci_dev_test_flag(hdev, HCI_MGMT))
864 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
865
866 if (rp->status)
867 goto unlock;
868
869 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
870 if (!cp)
871 goto unlock;
872
873 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
874 if (conn)
875 conn->pin_length = cp->pin_len;
876
877 unlock:
878 hci_dev_unlock(hdev);
879 }
880
881 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
882 {
883 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
884
885 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
886
887 hci_dev_lock(hdev);
888
889 if (hci_dev_test_flag(hdev, HCI_MGMT))
890 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
891 rp->status);
892
893 hci_dev_unlock(hdev);
894 }
895
896 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
897 struct sk_buff *skb)
898 {
899 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
900
901 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
902
903 if (rp->status)
904 return;
905
906 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
907 hdev->le_pkts = rp->le_max_pkt;
908
909 hdev->le_cnt = hdev->le_pkts;
910
911 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
912 }
913
914 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
915 struct sk_buff *skb)
916 {
917 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
918
919 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
920
921 if (rp->status)
922 return;
923
924 memcpy(hdev->le_features, rp->features, 8);
925 }
926
927 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
928 struct sk_buff *skb)
929 {
930 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
931
932 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
933
934 if (rp->status)
935 return;
936
937 hdev->adv_tx_power = rp->tx_power;
938 }
939
940 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
941 {
942 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
943
944 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
945
946 hci_dev_lock(hdev);
947
948 if (hci_dev_test_flag(hdev, HCI_MGMT))
949 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
950 rp->status);
951
952 hci_dev_unlock(hdev);
953 }
954
955 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
956 struct sk_buff *skb)
957 {
958 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
959
960 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
961
962 hci_dev_lock(hdev);
963
964 if (hci_dev_test_flag(hdev, HCI_MGMT))
965 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
966 ACL_LINK, 0, rp->status);
967
968 hci_dev_unlock(hdev);
969 }
970
971 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
972 {
973 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
974
975 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
976
977 hci_dev_lock(hdev);
978
979 if (hci_dev_test_flag(hdev, HCI_MGMT))
980 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
981 0, rp->status);
982
983 hci_dev_unlock(hdev);
984 }
985
986 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
987 struct sk_buff *skb)
988 {
989 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
990
991 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
992
993 hci_dev_lock(hdev);
994
995 if (hci_dev_test_flag(hdev, HCI_MGMT))
996 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
997 ACL_LINK, 0, rp->status);
998
999 hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1003 struct sk_buff *skb)
1004 {
1005 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1006
1007 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1008 }
1009
1010 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1011 struct sk_buff *skb)
1012 {
1013 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1014
1015 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1016 }
1017
1018 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1019 {
1020 __u8 status = *((__u8 *) skb->data);
1021 bdaddr_t *sent;
1022
1023 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1024
1025 if (status)
1026 return;
1027
1028 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1029 if (!sent)
1030 return;
1031
1032 hci_dev_lock(hdev);
1033
1034 bacpy(&hdev->random_addr, sent);
1035
1036 hci_dev_unlock(hdev);
1037 }
1038
1039 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1040 {
1041 __u8 *sent, status = *((__u8 *) skb->data);
1042
1043 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1044
1045 if (status)
1046 return;
1047
1048 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1049 if (!sent)
1050 return;
1051
1052 hci_dev_lock(hdev);
1053
1054 /* If we're doing connection initiation as peripheral. Set a
1055 * timeout in case something goes wrong.
1056 */
1057 if (*sent) {
1058 struct hci_conn *conn;
1059
1060 hci_dev_set_flag(hdev, HCI_LE_ADV);
1061
1062 conn = hci_lookup_le_connect(hdev);
1063 if (conn)
1064 queue_delayed_work(hdev->workqueue,
1065 &conn->le_conn_timeout,
1066 conn->conn_timeout);
1067 } else {
1068 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1069 }
1070
1071 hci_dev_unlock(hdev);
1072 }
1073
1074 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1075 {
1076 struct hci_cp_le_set_scan_param *cp;
1077 __u8 status = *((__u8 *) skb->data);
1078
1079 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1080
1081 if (status)
1082 return;
1083
1084 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1085 if (!cp)
1086 return;
1087
1088 hci_dev_lock(hdev);
1089
1090 hdev->le_scan_type = cp->type;
1091
1092 hci_dev_unlock(hdev);
1093 }
1094
1095 static bool has_pending_adv_report(struct hci_dev *hdev)
1096 {
1097 struct discovery_state *d = &hdev->discovery;
1098
1099 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1100 }
1101
1102 static void clear_pending_adv_report(struct hci_dev *hdev)
1103 {
1104 struct discovery_state *d = &hdev->discovery;
1105
1106 bacpy(&d->last_adv_addr, BDADDR_ANY);
1107 d->last_adv_data_len = 0;
1108 }
1109
1110 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1111 u8 bdaddr_type, s8 rssi, u32 flags,
1112 u8 *data, u8 len)
1113 {
1114 struct discovery_state *d = &hdev->discovery;
1115
1116 bacpy(&d->last_adv_addr, bdaddr);
1117 d->last_adv_addr_type = bdaddr_type;
1118 d->last_adv_rssi = rssi;
1119 d->last_adv_flags = flags;
1120 memcpy(d->last_adv_data, data, len);
1121 d->last_adv_data_len = len;
1122 }
1123
1124 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1125 struct sk_buff *skb)
1126 {
1127 struct hci_cp_le_set_scan_enable *cp;
1128 __u8 status = *((__u8 *) skb->data);
1129
1130 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1131
1132 if (status)
1133 return;
1134
1135 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1136 if (!cp)
1137 return;
1138
1139 hci_dev_lock(hdev);
1140
1141 switch (cp->enable) {
1142 case LE_SCAN_ENABLE:
1143 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1144 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1145 clear_pending_adv_report(hdev);
1146 break;
1147
1148 case LE_SCAN_DISABLE:
1149 /* We do this here instead of when setting DISCOVERY_STOPPED
1150 * since the latter would potentially require waiting for
1151 * inquiry to stop too.
1152 */
1153 if (has_pending_adv_report(hdev)) {
1154 struct discovery_state *d = &hdev->discovery;
1155
1156 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1157 d->last_adv_addr_type, NULL,
1158 d->last_adv_rssi, d->last_adv_flags,
1159 d->last_adv_data,
1160 d->last_adv_data_len, NULL, 0);
1161 }
1162
1163 /* Cancel this timer so that we don't try to disable scanning
1164 * when it's already disabled.
1165 */
1166 cancel_delayed_work(&hdev->le_scan_disable);
1167
1168 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1169
1170 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1171 * interrupted scanning due to a connect request. Mark
1172 * therefore discovery as stopped. If this was not
1173 * because of a connect request advertising might have
1174 * been disabled because of active scanning, so
1175 * re-enable it again if necessary.
1176 */
1177 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1178 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1179 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1180 hdev->discovery.state == DISCOVERY_FINDING)
1181 mgmt_reenable_advertising(hdev);
1182
1183 break;
1184
1185 default:
1186 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1187 break;
1188 }
1189
1190 hci_dev_unlock(hdev);
1191 }
1192
1193 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1194 struct sk_buff *skb)
1195 {
1196 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1197
1198 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1199
1200 if (rp->status)
1201 return;
1202
1203 hdev->le_white_list_size = rp->size;
1204 }
1205
1206 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1207 struct sk_buff *skb)
1208 {
1209 __u8 status = *((__u8 *) skb->data);
1210
1211 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1212
1213 if (status)
1214 return;
1215
1216 hci_bdaddr_list_clear(&hdev->le_white_list);
1217 }
1218
1219 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1220 struct sk_buff *skb)
1221 {
1222 struct hci_cp_le_add_to_white_list *sent;
1223 __u8 status = *((__u8 *) skb->data);
1224
1225 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1226
1227 if (status)
1228 return;
1229
1230 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1231 if (!sent)
1232 return;
1233
1234 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1235 sent->bdaddr_type);
1236 }
1237
1238 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1239 struct sk_buff *skb)
1240 {
1241 struct hci_cp_le_del_from_white_list *sent;
1242 __u8 status = *((__u8 *) skb->data);
1243
1244 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1245
1246 if (status)
1247 return;
1248
1249 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1250 if (!sent)
1251 return;
1252
1253 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1254 sent->bdaddr_type);
1255 }
1256
1257 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1258 struct sk_buff *skb)
1259 {
1260 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1261
1262 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1263
1264 if (rp->status)
1265 return;
1266
1267 memcpy(hdev->le_states, rp->le_states, 8);
1268 }
1269
1270 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1271 struct sk_buff *skb)
1272 {
1273 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1274
1275 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1276
1277 if (rp->status)
1278 return;
1279
1280 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1281 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1282 }
1283
1284 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1285 struct sk_buff *skb)
1286 {
1287 struct hci_cp_le_write_def_data_len *sent;
1288 __u8 status = *((__u8 *) skb->data);
1289
1290 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1291
1292 if (status)
1293 return;
1294
1295 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1296 if (!sent)
1297 return;
1298
1299 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1300 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1301 }
1302
1303 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1304 struct sk_buff *skb)
1305 {
1306 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1307
1308 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1309
1310 if (rp->status)
1311 return;
1312
1313 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1314 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1315 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1316 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1317 }
1318
1319 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1320 struct sk_buff *skb)
1321 {
1322 struct hci_cp_write_le_host_supported *sent;
1323 __u8 status = *((__u8 *) skb->data);
1324
1325 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1326
1327 if (status)
1328 return;
1329
1330 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1331 if (!sent)
1332 return;
1333
1334 hci_dev_lock(hdev);
1335
1336 if (sent->le) {
1337 hdev->features[1][0] |= LMP_HOST_LE;
1338 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1339 } else {
1340 hdev->features[1][0] &= ~LMP_HOST_LE;
1341 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1342 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1343 }
1344
1345 if (sent->simul)
1346 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1347 else
1348 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1349
1350 hci_dev_unlock(hdev);
1351 }
1352
1353 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1354 {
1355 struct hci_cp_le_set_adv_param *cp;
1356 u8 status = *((u8 *) skb->data);
1357
1358 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1359
1360 if (status)
1361 return;
1362
1363 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1364 if (!cp)
1365 return;
1366
1367 hci_dev_lock(hdev);
1368 hdev->adv_addr_type = cp->own_address_type;
1369 hci_dev_unlock(hdev);
1370 }
1371
1372 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1373 {
1374 struct hci_rp_read_rssi *rp = (void *) skb->data;
1375 struct hci_conn *conn;
1376
1377 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1378
1379 if (rp->status)
1380 return;
1381
1382 hci_dev_lock(hdev);
1383
1384 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1385 if (conn)
1386 conn->rssi = rp->rssi;
1387
1388 hci_dev_unlock(hdev);
1389 }
1390
1391 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1392 {
1393 struct hci_cp_read_tx_power *sent;
1394 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1395 struct hci_conn *conn;
1396
1397 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1398
1399 if (rp->status)
1400 return;
1401
1402 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1403 if (!sent)
1404 return;
1405
1406 hci_dev_lock(hdev);
1407
1408 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1409 if (!conn)
1410 goto unlock;
1411
1412 switch (sent->type) {
1413 case 0x00:
1414 conn->tx_power = rp->tx_power;
1415 break;
1416 case 0x01:
1417 conn->max_tx_power = rp->tx_power;
1418 break;
1419 }
1420
1421 unlock:
1422 hci_dev_unlock(hdev);
1423 }
1424
1425 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1426 {
1427 u8 status = *((u8 *) skb->data);
1428 u8 *mode;
1429
1430 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1431
1432 if (status)
1433 return;
1434
1435 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1436 if (mode)
1437 hdev->ssp_debug_mode = *mode;
1438 }
1439
1440 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1441 {
1442 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1443
1444 if (status) {
1445 hci_conn_check_pending(hdev);
1446 return;
1447 }
1448
1449 set_bit(HCI_INQUIRY, &hdev->flags);
1450 }
1451
1452 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1453 {
1454 struct hci_cp_create_conn *cp;
1455 struct hci_conn *conn;
1456
1457 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1458
1459 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1460 if (!cp)
1461 return;
1462
1463 hci_dev_lock(hdev);
1464
1465 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1466
1467 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1468
1469 if (status) {
1470 if (conn && conn->state == BT_CONNECT) {
1471 if (status != 0x0c || conn->attempt > 2) {
1472 conn->state = BT_CLOSED;
1473 hci_connect_cfm(conn, status);
1474 hci_conn_del(conn);
1475 } else
1476 conn->state = BT_CONNECT2;
1477 }
1478 } else {
1479 if (!conn) {
1480 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1481 HCI_ROLE_MASTER);
1482 if (!conn)
1483 BT_ERR("No memory for new connection");
1484 }
1485 }
1486
1487 hci_dev_unlock(hdev);
1488 }
1489
1490 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1491 {
1492 struct hci_cp_add_sco *cp;
1493 struct hci_conn *acl, *sco;
1494 __u16 handle;
1495
1496 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1497
1498 if (!status)
1499 return;
1500
1501 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1502 if (!cp)
1503 return;
1504
1505 handle = __le16_to_cpu(cp->handle);
1506
1507 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1508
1509 hci_dev_lock(hdev);
1510
1511 acl = hci_conn_hash_lookup_handle(hdev, handle);
1512 if (acl) {
1513 sco = acl->link;
1514 if (sco) {
1515 sco->state = BT_CLOSED;
1516
1517 hci_connect_cfm(sco, status);
1518 hci_conn_del(sco);
1519 }
1520 }
1521
1522 hci_dev_unlock(hdev);
1523 }
1524
1525 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1526 {
1527 struct hci_cp_auth_requested *cp;
1528 struct hci_conn *conn;
1529
1530 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1531
1532 if (!status)
1533 return;
1534
1535 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1536 if (!cp)
1537 return;
1538
1539 hci_dev_lock(hdev);
1540
1541 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1542 if (conn) {
1543 if (conn->state == BT_CONFIG) {
1544 hci_connect_cfm(conn, status);
1545 hci_conn_drop(conn);
1546 }
1547 }
1548
1549 hci_dev_unlock(hdev);
1550 }
1551
1552 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1553 {
1554 struct hci_cp_set_conn_encrypt *cp;
1555 struct hci_conn *conn;
1556
1557 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1558
1559 if (!status)
1560 return;
1561
1562 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1563 if (!cp)
1564 return;
1565
1566 hci_dev_lock(hdev);
1567
1568 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1569 if (conn) {
1570 if (conn->state == BT_CONFIG) {
1571 hci_connect_cfm(conn, status);
1572 hci_conn_drop(conn);
1573 }
1574 }
1575
1576 hci_dev_unlock(hdev);
1577 }
1578
1579 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1580 struct hci_conn *conn)
1581 {
1582 if (conn->state != BT_CONFIG || !conn->out)
1583 return 0;
1584
1585 if (conn->pending_sec_level == BT_SECURITY_SDP)
1586 return 0;
1587
1588 /* Only request authentication for SSP connections or non-SSP
1589 * devices with sec_level MEDIUM or HIGH or if MITM protection
1590 * is requested.
1591 */
1592 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1593 conn->pending_sec_level != BT_SECURITY_FIPS &&
1594 conn->pending_sec_level != BT_SECURITY_HIGH &&
1595 conn->pending_sec_level != BT_SECURITY_MEDIUM)
1596 return 0;
1597
1598 return 1;
1599 }
1600
1601 static int hci_resolve_name(struct hci_dev *hdev,
1602 struct inquiry_entry *e)
1603 {
1604 struct hci_cp_remote_name_req cp;
1605
1606 memset(&cp, 0, sizeof(cp));
1607
1608 bacpy(&cp.bdaddr, &e->data.bdaddr);
1609 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1610 cp.pscan_mode = e->data.pscan_mode;
1611 cp.clock_offset = e->data.clock_offset;
1612
1613 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1614 }
1615
1616 static bool hci_resolve_next_name(struct hci_dev *hdev)
1617 {
1618 struct discovery_state *discov = &hdev->discovery;
1619 struct inquiry_entry *e;
1620
1621 if (list_empty(&discov->resolve))
1622 return false;
1623
1624 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1625 if (!e)
1626 return false;
1627
1628 if (hci_resolve_name(hdev, e) == 0) {
1629 e->name_state = NAME_PENDING;
1630 return true;
1631 }
1632
1633 return false;
1634 }
1635
1636 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1637 bdaddr_t *bdaddr, u8 *name, u8 name_len)
1638 {
1639 struct discovery_state *discov = &hdev->discovery;
1640 struct inquiry_entry *e;
1641
1642 /* Update the mgmt connected state if necessary. Be careful with
1643 * conn objects that exist but are not (yet) connected however.
1644 * Only those in BT_CONFIG or BT_CONNECTED states can be
1645 * considered connected.
1646 */
1647 if (conn &&
1648 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1649 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1650 mgmt_device_connected(hdev, conn, 0, name, name_len);
1651
1652 if (discov->state == DISCOVERY_STOPPED)
1653 return;
1654
1655 if (discov->state == DISCOVERY_STOPPING)
1656 goto discov_complete;
1657
1658 if (discov->state != DISCOVERY_RESOLVING)
1659 return;
1660
1661 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1662 /* If the device was not found in a list of found devices names of which
1663 * are pending. there is no need to continue resolving a next name as it
1664 * will be done upon receiving another Remote Name Request Complete
1665 * Event */
1666 if (!e)
1667 return;
1668
1669 list_del(&e->list);
1670 if (name) {
1671 e->name_state = NAME_KNOWN;
1672 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1673 e->data.rssi, name, name_len);
1674 } else {
1675 e->name_state = NAME_NOT_KNOWN;
1676 }
1677
1678 if (hci_resolve_next_name(hdev))
1679 return;
1680
1681 discov_complete:
1682 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1683 }
1684
1685 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1686 {
1687 struct hci_cp_remote_name_req *cp;
1688 struct hci_conn *conn;
1689
1690 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1691
1692 /* If successful wait for the name req complete event before
1693 * checking for the need to do authentication */
1694 if (!status)
1695 return;
1696
1697 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1698 if (!cp)
1699 return;
1700
1701 hci_dev_lock(hdev);
1702
1703 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1704
1705 if (hci_dev_test_flag(hdev, HCI_MGMT))
1706 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1707
1708 if (!conn)
1709 goto unlock;
1710
1711 if (!hci_outgoing_auth_needed(hdev, conn))
1712 goto unlock;
1713
1714 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1715 struct hci_cp_auth_requested auth_cp;
1716
1717 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1718
1719 auth_cp.handle = __cpu_to_le16(conn->handle);
1720 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1721 sizeof(auth_cp), &auth_cp);
1722 }
1723
1724 unlock:
1725 hci_dev_unlock(hdev);
1726 }
1727
1728 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1729 {
1730 struct hci_cp_read_remote_features *cp;
1731 struct hci_conn *conn;
1732
1733 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1734
1735 if (!status)
1736 return;
1737
1738 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1739 if (!cp)
1740 return;
1741
1742 hci_dev_lock(hdev);
1743
1744 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1745 if (conn) {
1746 if (conn->state == BT_CONFIG) {
1747 hci_connect_cfm(conn, status);
1748 hci_conn_drop(conn);
1749 }
1750 }
1751
1752 hci_dev_unlock(hdev);
1753 }
1754
1755 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1756 {
1757 struct hci_cp_read_remote_ext_features *cp;
1758 struct hci_conn *conn;
1759
1760 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1761
1762 if (!status)
1763 return;
1764
1765 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1766 if (!cp)
1767 return;
1768
1769 hci_dev_lock(hdev);
1770
1771 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1772 if (conn) {
1773 if (conn->state == BT_CONFIG) {
1774 hci_connect_cfm(conn, status);
1775 hci_conn_drop(conn);
1776 }
1777 }
1778
1779 hci_dev_unlock(hdev);
1780 }
1781
1782 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1783 {
1784 struct hci_cp_setup_sync_conn *cp;
1785 struct hci_conn *acl, *sco;
1786 __u16 handle;
1787
1788 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1789
1790 if (!status)
1791 return;
1792
1793 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1794 if (!cp)
1795 return;
1796
1797 handle = __le16_to_cpu(cp->handle);
1798
1799 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1800
1801 hci_dev_lock(hdev);
1802
1803 acl = hci_conn_hash_lookup_handle(hdev, handle);
1804 if (acl) {
1805 sco = acl->link;
1806 if (sco) {
1807 sco->state = BT_CLOSED;
1808
1809 hci_connect_cfm(sco, status);
1810 hci_conn_del(sco);
1811 }
1812 }
1813
1814 hci_dev_unlock(hdev);
1815 }
1816
1817 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1818 {
1819 struct hci_cp_sniff_mode *cp;
1820 struct hci_conn *conn;
1821
1822 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1823
1824 if (!status)
1825 return;
1826
1827 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1828 if (!cp)
1829 return;
1830
1831 hci_dev_lock(hdev);
1832
1833 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1834 if (conn) {
1835 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1836
1837 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1838 hci_sco_setup(conn, status);
1839 }
1840
1841 hci_dev_unlock(hdev);
1842 }
1843
1844 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1845 {
1846 struct hci_cp_exit_sniff_mode *cp;
1847 struct hci_conn *conn;
1848
1849 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1850
1851 if (!status)
1852 return;
1853
1854 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1855 if (!cp)
1856 return;
1857
1858 hci_dev_lock(hdev);
1859
1860 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1861 if (conn) {
1862 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1863
1864 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1865 hci_sco_setup(conn, status);
1866 }
1867
1868 hci_dev_unlock(hdev);
1869 }
1870
1871 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1872 {
1873 struct hci_cp_disconnect *cp;
1874 struct hci_conn *conn;
1875
1876 if (!status)
1877 return;
1878
1879 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1880 if (!cp)
1881 return;
1882
1883 hci_dev_lock(hdev);
1884
1885 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1886 if (conn)
1887 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1888 conn->dst_type, status);
1889
1890 hci_dev_unlock(hdev);
1891 }
1892
1893 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1894 {
1895 struct hci_cp_le_create_conn *cp;
1896 struct hci_conn *conn;
1897
1898 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1899
1900 /* All connection failure handling is taken care of by the
1901 * hci_le_conn_failed function which is triggered by the HCI
1902 * request completion callbacks used for connecting.
1903 */
1904 if (status)
1905 return;
1906
1907 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1908 if (!cp)
1909 return;
1910
1911 hci_dev_lock(hdev);
1912
1913 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1914 if (!conn)
1915 goto unlock;
1916
1917 /* Store the initiator and responder address information which
1918 * is needed for SMP. These values will not change during the
1919 * lifetime of the connection.
1920 */
1921 conn->init_addr_type = cp->own_address_type;
1922 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1923 bacpy(&conn->init_addr, &hdev->random_addr);
1924 else
1925 bacpy(&conn->init_addr, &hdev->bdaddr);
1926
1927 conn->resp_addr_type = cp->peer_addr_type;
1928 bacpy(&conn->resp_addr, &cp->peer_addr);
1929
1930 /* We don't want the connection attempt to stick around
1931 * indefinitely since LE doesn't have a page timeout concept
1932 * like BR/EDR. Set a timer for any connection that doesn't use
1933 * the white list for connecting.
1934 */
1935 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1936 queue_delayed_work(conn->hdev->workqueue,
1937 &conn->le_conn_timeout,
1938 conn->conn_timeout);
1939
1940 unlock:
1941 hci_dev_unlock(hdev);
1942 }
1943
1944 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
1945 {
1946 struct hci_cp_le_read_remote_features *cp;
1947 struct hci_conn *conn;
1948
1949 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1950
1951 if (!status)
1952 return;
1953
1954 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
1955 if (!cp)
1956 return;
1957
1958 hci_dev_lock(hdev);
1959
1960 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1961 if (conn) {
1962 if (conn->state == BT_CONFIG) {
1963 hci_connect_cfm(conn, status);
1964 hci_conn_drop(conn);
1965 }
1966 }
1967
1968 hci_dev_unlock(hdev);
1969 }
1970
1971 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1972 {
1973 struct hci_cp_le_start_enc *cp;
1974 struct hci_conn *conn;
1975
1976 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1977
1978 if (!status)
1979 return;
1980
1981 hci_dev_lock(hdev);
1982
1983 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
1984 if (!cp)
1985 goto unlock;
1986
1987 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1988 if (!conn)
1989 goto unlock;
1990
1991 if (conn->state != BT_CONNECTED)
1992 goto unlock;
1993
1994 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1995 hci_conn_drop(conn);
1996
1997 unlock:
1998 hci_dev_unlock(hdev);
1999 }
2000
2001 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2002 {
2003 struct hci_cp_switch_role *cp;
2004 struct hci_conn *conn;
2005
2006 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2007
2008 if (!status)
2009 return;
2010
2011 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2012 if (!cp)
2013 return;
2014
2015 hci_dev_lock(hdev);
2016
2017 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2018 if (conn)
2019 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2020
2021 hci_dev_unlock(hdev);
2022 }
2023
2024 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2025 {
2026 __u8 status = *((__u8 *) skb->data);
2027 struct discovery_state *discov = &hdev->discovery;
2028 struct inquiry_entry *e;
2029
2030 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2031
2032 hci_conn_check_pending(hdev);
2033
2034 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2035 return;
2036
2037 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2038 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2039
2040 if (!hci_dev_test_flag(hdev, HCI_MGMT))
2041 return;
2042
2043 hci_dev_lock(hdev);
2044
2045 if (discov->state != DISCOVERY_FINDING)
2046 goto unlock;
2047
2048 if (list_empty(&discov->resolve)) {
2049 /* When BR/EDR inquiry is active and no LE scanning is in
2050 * progress, then change discovery state to indicate completion.
2051 *
2052 * When running LE scanning and BR/EDR inquiry simultaneously
2053 * and the LE scan already finished, then change the discovery
2054 * state to indicate completion.
2055 */
2056 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2057 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2058 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2059 goto unlock;
2060 }
2061
2062 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2063 if (e && hci_resolve_name(hdev, e) == 0) {
2064 e->name_state = NAME_PENDING;
2065 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2066 } else {
2067 /* When BR/EDR inquiry is active and no LE scanning is in
2068 * progress, then change discovery state to indicate completion.
2069 *
2070 * When running LE scanning and BR/EDR inquiry simultaneously
2071 * and the LE scan already finished, then change the discovery
2072 * state to indicate completion.
2073 */
2074 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2075 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2076 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2077 }
2078
2079 unlock:
2080 hci_dev_unlock(hdev);
2081 }
2082
2083 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2084 {
2085 struct inquiry_data data;
2086 struct inquiry_info *info = (void *) (skb->data + 1);
2087 int num_rsp = *((__u8 *) skb->data);
2088
2089 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2090
2091 if (!num_rsp)
2092 return;
2093
2094 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2095 return;
2096
2097 hci_dev_lock(hdev);
2098
2099 for (; num_rsp; num_rsp--, info++) {
2100 u32 flags;
2101
2102 bacpy(&data.bdaddr, &info->bdaddr);
2103 data.pscan_rep_mode = info->pscan_rep_mode;
2104 data.pscan_period_mode = info->pscan_period_mode;
2105 data.pscan_mode = info->pscan_mode;
2106 memcpy(data.dev_class, info->dev_class, 3);
2107 data.clock_offset = info->clock_offset;
2108 data.rssi = HCI_RSSI_INVALID;
2109 data.ssp_mode = 0x00;
2110
2111 flags = hci_inquiry_cache_update(hdev, &data, false);
2112
2113 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2114 info->dev_class, HCI_RSSI_INVALID,
2115 flags, NULL, 0, NULL, 0);
2116 }
2117
2118 hci_dev_unlock(hdev);
2119 }
2120
2121 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2122 {
2123 struct hci_ev_conn_complete *ev = (void *) skb->data;
2124 struct hci_conn *conn;
2125
2126 BT_DBG("%s", hdev->name);
2127
2128 hci_dev_lock(hdev);
2129
2130 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2131 if (!conn) {
2132 if (ev->link_type != SCO_LINK)
2133 goto unlock;
2134
2135 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2136 if (!conn)
2137 goto unlock;
2138
2139 conn->type = SCO_LINK;
2140 }
2141
2142 if (!ev->status) {
2143 conn->handle = __le16_to_cpu(ev->handle);
2144
2145 if (conn->type == ACL_LINK) {
2146 conn->state = BT_CONFIG;
2147 hci_conn_hold(conn);
2148
2149 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2150 !hci_find_link_key(hdev, &ev->bdaddr))
2151 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2152 else
2153 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2154 } else
2155 conn->state = BT_CONNECTED;
2156
2157 hci_debugfs_create_conn(conn);
2158 hci_conn_add_sysfs(conn);
2159
2160 if (test_bit(HCI_AUTH, &hdev->flags))
2161 set_bit(HCI_CONN_AUTH, &conn->flags);
2162
2163 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2164 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2165
2166 /* Get remote features */
2167 if (conn->type == ACL_LINK) {
2168 struct hci_cp_read_remote_features cp;
2169 cp.handle = ev->handle;
2170 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2171 sizeof(cp), &cp);
2172
2173 hci_update_page_scan(hdev);
2174 }
2175
2176 /* Set packet type for incoming connection */
2177 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2178 struct hci_cp_change_conn_ptype cp;
2179 cp.handle = ev->handle;
2180 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2181 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2182 &cp);
2183 }
2184 } else {
2185 conn->state = BT_CLOSED;
2186 if (conn->type == ACL_LINK)
2187 mgmt_connect_failed(hdev, &conn->dst, conn->type,
2188 conn->dst_type, ev->status);
2189 }
2190
2191 if (conn->type == ACL_LINK)
2192 hci_sco_setup(conn, ev->status);
2193
2194 if (ev->status) {
2195 hci_connect_cfm(conn, ev->status);
2196 hci_conn_del(conn);
2197 } else if (ev->link_type != ACL_LINK)
2198 hci_connect_cfm(conn, ev->status);
2199
2200 unlock:
2201 hci_dev_unlock(hdev);
2202
2203 hci_conn_check_pending(hdev);
2204 }
2205
2206 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2207 {
2208 struct hci_cp_reject_conn_req cp;
2209
2210 bacpy(&cp.bdaddr, bdaddr);
2211 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2212 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2213 }
2214
2215 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2216 {
2217 struct hci_ev_conn_request *ev = (void *) skb->data;
2218 int mask = hdev->link_mode;
2219 struct inquiry_entry *ie;
2220 struct hci_conn *conn;
2221 __u8 flags = 0;
2222
2223 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2224 ev->link_type);
2225
2226 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2227 &flags);
2228
2229 if (!(mask & HCI_LM_ACCEPT)) {
2230 hci_reject_conn(hdev, &ev->bdaddr);
2231 return;
2232 }
2233
2234 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2235 BDADDR_BREDR)) {
2236 hci_reject_conn(hdev, &ev->bdaddr);
2237 return;
2238 }
2239
2240 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2241 * connection. These features are only touched through mgmt so
2242 * only do the checks if HCI_MGMT is set.
2243 */
2244 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2245 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2246 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2247 BDADDR_BREDR)) {
2248 hci_reject_conn(hdev, &ev->bdaddr);
2249 return;
2250 }
2251
2252 /* Connection accepted */
2253
2254 hci_dev_lock(hdev);
2255
2256 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2257 if (ie)
2258 memcpy(ie->data.dev_class, ev->dev_class, 3);
2259
2260 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2261 &ev->bdaddr);
2262 if (!conn) {
2263 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2264 HCI_ROLE_SLAVE);
2265 if (!conn) {
2266 BT_ERR("No memory for new connection");
2267 hci_dev_unlock(hdev);
2268 return;
2269 }
2270 }
2271
2272 memcpy(conn->dev_class, ev->dev_class, 3);
2273
2274 hci_dev_unlock(hdev);
2275
2276 if (ev->link_type == ACL_LINK ||
2277 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2278 struct hci_cp_accept_conn_req cp;
2279 conn->state = BT_CONNECT;
2280
2281 bacpy(&cp.bdaddr, &ev->bdaddr);
2282
2283 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2284 cp.role = 0x00; /* Become master */
2285 else
2286 cp.role = 0x01; /* Remain slave */
2287
2288 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2289 } else if (!(flags & HCI_PROTO_DEFER)) {
2290 struct hci_cp_accept_sync_conn_req cp;
2291 conn->state = BT_CONNECT;
2292
2293 bacpy(&cp.bdaddr, &ev->bdaddr);
2294 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2295
2296 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2297 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2298 cp.max_latency = cpu_to_le16(0xffff);
2299 cp.content_format = cpu_to_le16(hdev->voice_setting);
2300 cp.retrans_effort = 0xff;
2301
2302 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2303 &cp);
2304 } else {
2305 conn->state = BT_CONNECT2;
2306 hci_connect_cfm(conn, 0);
2307 }
2308 }
2309
2310 static u8 hci_to_mgmt_reason(u8 err)
2311 {
2312 switch (err) {
2313 case HCI_ERROR_CONNECTION_TIMEOUT:
2314 return MGMT_DEV_DISCONN_TIMEOUT;
2315 case HCI_ERROR_REMOTE_USER_TERM:
2316 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2317 case HCI_ERROR_REMOTE_POWER_OFF:
2318 return MGMT_DEV_DISCONN_REMOTE;
2319 case HCI_ERROR_LOCAL_HOST_TERM:
2320 return MGMT_DEV_DISCONN_LOCAL_HOST;
2321 default:
2322 return MGMT_DEV_DISCONN_UNKNOWN;
2323 }
2324 }
2325
2326 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2327 {
2328 struct hci_ev_disconn_complete *ev = (void *) skb->data;
2329 u8 reason = hci_to_mgmt_reason(ev->reason);
2330 struct hci_conn_params *params;
2331 struct hci_conn *conn;
2332 bool mgmt_connected;
2333 u8 type;
2334
2335 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2336
2337 hci_dev_lock(hdev);
2338
2339 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2340 if (!conn)
2341 goto unlock;
2342
2343 if (ev->status) {
2344 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2345 conn->dst_type, ev->status);
2346 goto unlock;
2347 }
2348
2349 conn->state = BT_CLOSED;
2350
2351 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2352 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2353 reason, mgmt_connected);
2354
2355 if (conn->type == ACL_LINK) {
2356 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2357 hci_remove_link_key(hdev, &conn->dst);
2358
2359 hci_update_page_scan(hdev);
2360 }
2361
2362 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2363 if (params) {
2364 switch (params->auto_connect) {
2365 case HCI_AUTO_CONN_LINK_LOSS:
2366 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2367 break;
2368 /* Fall through */
2369
2370 case HCI_AUTO_CONN_DIRECT:
2371 case HCI_AUTO_CONN_ALWAYS:
2372 list_del_init(&params->action);
2373 list_add(&params->action, &hdev->pend_le_conns);
2374 hci_update_background_scan(hdev);
2375 break;
2376
2377 default:
2378 break;
2379 }
2380 }
2381
2382 type = conn->type;
2383
2384 hci_disconn_cfm(conn, ev->reason);
2385 hci_conn_del(conn);
2386
2387 /* Re-enable advertising if necessary, since it might
2388 * have been disabled by the connection. From the
2389 * HCI_LE_Set_Advertise_Enable command description in
2390 * the core specification (v4.0):
2391 * "The Controller shall continue advertising until the Host
2392 * issues an LE_Set_Advertise_Enable command with
2393 * Advertising_Enable set to 0x00 (Advertising is disabled)
2394 * or until a connection is created or until the Advertising
2395 * is timed out due to Directed Advertising."
2396 */
2397 if (type == LE_LINK)
2398 mgmt_reenable_advertising(hdev);
2399
2400 unlock:
2401 hci_dev_unlock(hdev);
2402 }
2403
2404 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2405 {
2406 struct hci_ev_auth_complete *ev = (void *) skb->data;
2407 struct hci_conn *conn;
2408
2409 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2410
2411 hci_dev_lock(hdev);
2412
2413 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2414 if (!conn)
2415 goto unlock;
2416
2417 if (!ev->status) {
2418 if (!hci_conn_ssp_enabled(conn) &&
2419 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2420 BT_INFO("re-auth of legacy device is not possible.");
2421 } else {
2422 set_bit(HCI_CONN_AUTH, &conn->flags);
2423 conn->sec_level = conn->pending_sec_level;
2424 }
2425 } else {
2426 mgmt_auth_failed(conn, ev->status);
2427 }
2428
2429 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2430 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2431
2432 if (conn->state == BT_CONFIG) {
2433 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2434 struct hci_cp_set_conn_encrypt cp;
2435 cp.handle = ev->handle;
2436 cp.encrypt = 0x01;
2437 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2438 &cp);
2439 } else {
2440 conn->state = BT_CONNECTED;
2441 hci_connect_cfm(conn, ev->status);
2442 hci_conn_drop(conn);
2443 }
2444 } else {
2445 hci_auth_cfm(conn, ev->status);
2446
2447 hci_conn_hold(conn);
2448 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2449 hci_conn_drop(conn);
2450 }
2451
2452 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2453 if (!ev->status) {
2454 struct hci_cp_set_conn_encrypt cp;
2455 cp.handle = ev->handle;
2456 cp.encrypt = 0x01;
2457 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2458 &cp);
2459 } else {
2460 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2461 hci_encrypt_cfm(conn, ev->status, 0x00);
2462 }
2463 }
2464
2465 unlock:
2466 hci_dev_unlock(hdev);
2467 }
2468
2469 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2470 {
2471 struct hci_ev_remote_name *ev = (void *) skb->data;
2472 struct hci_conn *conn;
2473
2474 BT_DBG("%s", hdev->name);
2475
2476 hci_conn_check_pending(hdev);
2477
2478 hci_dev_lock(hdev);
2479
2480 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2481
2482 if (!hci_dev_test_flag(hdev, HCI_MGMT))
2483 goto check_auth;
2484
2485 if (ev->status == 0)
2486 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2487 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2488 else
2489 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2490
2491 check_auth:
2492 if (!conn)
2493 goto unlock;
2494
2495 if (!hci_outgoing_auth_needed(hdev, conn))
2496 goto unlock;
2497
2498 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2499 struct hci_cp_auth_requested cp;
2500
2501 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2502
2503 cp.handle = __cpu_to_le16(conn->handle);
2504 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2505 }
2506
2507 unlock:
2508 hci_dev_unlock(hdev);
2509 }
2510
2511 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2512 u16 opcode, struct sk_buff *skb)
2513 {
2514 const struct hci_rp_read_enc_key_size *rp;
2515 struct hci_conn *conn;
2516 u16 handle;
2517
2518 BT_DBG("%s status 0x%02x", hdev->name, status);
2519
2520 if (!skb || skb->len < sizeof(*rp)) {
2521 BT_ERR("%s invalid HCI Read Encryption Key Size response",
2522 hdev->name);
2523 return;
2524 }
2525
2526 rp = (void *)skb->data;
2527 handle = le16_to_cpu(rp->handle);
2528
2529 hci_dev_lock(hdev);
2530
2531 conn = hci_conn_hash_lookup_handle(hdev, handle);
2532 if (!conn)
2533 goto unlock;
2534
2535 /* If we fail to read the encryption key size, assume maximum
2536 * (which is the same we do also when this HCI command isn't
2537 * supported.
2538 */
2539 if (rp->status) {
2540 BT_ERR("%s failed to read key size for handle %u", hdev->name,
2541 handle);
2542 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2543 } else {
2544 conn->enc_key_size = rp->key_size;
2545 }
2546
2547 if (conn->state == BT_CONFIG) {
2548 conn->state = BT_CONNECTED;
2549 hci_connect_cfm(conn, 0);
2550 hci_conn_drop(conn);
2551 } else {
2552 u8 encrypt;
2553
2554 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2555 encrypt = 0x00;
2556 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2557 encrypt = 0x02;
2558 else
2559 encrypt = 0x01;
2560
2561 hci_encrypt_cfm(conn, 0, encrypt);
2562 }
2563
2564 unlock:
2565 hci_dev_unlock(hdev);
2566 }
2567
2568 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2569 {
2570 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2571 struct hci_conn *conn;
2572
2573 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2574
2575 hci_dev_lock(hdev);
2576
2577 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2578 if (!conn)
2579 goto unlock;
2580
2581 if (!ev->status) {
2582 if (ev->encrypt) {
2583 /* Encryption implies authentication */
2584 set_bit(HCI_CONN_AUTH, &conn->flags);
2585 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2586 conn->sec_level = conn->pending_sec_level;
2587
2588 /* P-256 authentication key implies FIPS */
2589 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2590 set_bit(HCI_CONN_FIPS, &conn->flags);
2591
2592 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2593 conn->type == LE_LINK)
2594 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2595 } else {
2596 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2597 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2598 }
2599 }
2600
2601 /* We should disregard the current RPA and generate a new one
2602 * whenever the encryption procedure fails.
2603 */
2604 if (ev->status && conn->type == LE_LINK)
2605 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2606
2607 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2608
2609 if (ev->status && conn->state == BT_CONNECTED) {
2610 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2611 hci_conn_drop(conn);
2612 goto unlock;
2613 }
2614
2615 /* In Secure Connections Only mode, do not allow any connections
2616 * that are not encrypted with AES-CCM using a P-256 authenticated
2617 * combination key.
2618 */
2619 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2620 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2621 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2622 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2623 hci_conn_drop(conn);
2624 goto unlock;
2625 }
2626
2627 /* Try reading the encryption key size for encrypted ACL links */
2628 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2629 struct hci_cp_read_enc_key_size cp;
2630 struct hci_request req;
2631
2632 /* Only send HCI_Read_Encryption_Key_Size if the
2633 * controller really supports it. If it doesn't, assume
2634 * the default size (16).
2635 */
2636 if (!(hdev->commands[20] & 0x10)) {
2637 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2638 goto notify;
2639 }
2640
2641 hci_req_init(&req, hdev);
2642
2643 cp.handle = cpu_to_le16(conn->handle);
2644 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2645
2646 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2647 BT_ERR("Sending HCI Read Encryption Key Size failed");
2648 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2649 goto notify;
2650 }
2651
2652 goto unlock;
2653 }
2654
2655 notify:
2656 if (conn->state == BT_CONFIG) {
2657 if (!ev->status)
2658 conn->state = BT_CONNECTED;
2659
2660 hci_connect_cfm(conn, ev->status);
2661 hci_conn_drop(conn);
2662 } else
2663 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2664
2665 unlock:
2666 hci_dev_unlock(hdev);
2667 }
2668
2669 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2670 struct sk_buff *skb)
2671 {
2672 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2673 struct hci_conn *conn;
2674
2675 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2676
2677 hci_dev_lock(hdev);
2678
2679 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2680 if (conn) {
2681 if (!ev->status)
2682 set_bit(HCI_CONN_SECURE, &conn->flags);
2683
2684 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2685
2686 hci_key_change_cfm(conn, ev->status);
2687 }
2688
2689 hci_dev_unlock(hdev);
2690 }
2691
2692 static void hci_remote_features_evt(struct hci_dev *hdev,
2693 struct sk_buff *skb)
2694 {
2695 struct hci_ev_remote_features *ev = (void *) skb->data;
2696 struct hci_conn *conn;
2697
2698 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2699
2700 hci_dev_lock(hdev);
2701
2702 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2703 if (!conn)
2704 goto unlock;
2705
2706 if (!ev->status)
2707 memcpy(conn->features[0], ev->features, 8);
2708
2709 if (conn->state != BT_CONFIG)
2710 goto unlock;
2711
2712 if (!ev->status && lmp_ext_feat_capable(hdev) &&
2713 lmp_ext_feat_capable(conn)) {
2714 struct hci_cp_read_remote_ext_features cp;
2715 cp.handle = ev->handle;
2716 cp.page = 0x01;
2717 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2718 sizeof(cp), &cp);
2719 goto unlock;
2720 }
2721
2722 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2723 struct hci_cp_remote_name_req cp;
2724 memset(&cp, 0, sizeof(cp));
2725 bacpy(&cp.bdaddr, &conn->dst);
2726 cp.pscan_rep_mode = 0x02;
2727 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2728 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2729 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2730
2731 if (!hci_outgoing_auth_needed(hdev, conn)) {
2732 conn->state = BT_CONNECTED;
2733 hci_connect_cfm(conn, ev->status);
2734 hci_conn_drop(conn);
2735 }
2736
2737 unlock:
2738 hci_dev_unlock(hdev);
2739 }
2740
2741 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2742 u16 *opcode, u8 *status,
2743 hci_req_complete_t *req_complete,
2744 hci_req_complete_skb_t *req_complete_skb)
2745 {
2746 struct hci_ev_cmd_complete *ev = (void *) skb->data;
2747
2748 *opcode = __le16_to_cpu(ev->opcode);
2749 *status = skb->data[sizeof(*ev)];
2750
2751 skb_pull(skb, sizeof(*ev));
2752
2753 switch (*opcode) {
2754 case HCI_OP_INQUIRY_CANCEL:
2755 hci_cc_inquiry_cancel(hdev, skb);
2756 break;
2757
2758 case HCI_OP_PERIODIC_INQ:
2759 hci_cc_periodic_inq(hdev, skb);
2760 break;
2761
2762 case HCI_OP_EXIT_PERIODIC_INQ:
2763 hci_cc_exit_periodic_inq(hdev, skb);
2764 break;
2765
2766 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2767 hci_cc_remote_name_req_cancel(hdev, skb);
2768 break;
2769
2770 case HCI_OP_ROLE_DISCOVERY:
2771 hci_cc_role_discovery(hdev, skb);
2772 break;
2773
2774 case HCI_OP_READ_LINK_POLICY:
2775 hci_cc_read_link_policy(hdev, skb);
2776 break;
2777
2778 case HCI_OP_WRITE_LINK_POLICY:
2779 hci_cc_write_link_policy(hdev, skb);
2780 break;
2781
2782 case HCI_OP_READ_DEF_LINK_POLICY:
2783 hci_cc_read_def_link_policy(hdev, skb);
2784 break;
2785
2786 case HCI_OP_WRITE_DEF_LINK_POLICY:
2787 hci_cc_write_def_link_policy(hdev, skb);
2788 break;
2789
2790 case HCI_OP_RESET:
2791 hci_cc_reset(hdev, skb);
2792 break;
2793
2794 case HCI_OP_READ_STORED_LINK_KEY:
2795 hci_cc_read_stored_link_key(hdev, skb);
2796 break;
2797
2798 case HCI_OP_DELETE_STORED_LINK_KEY:
2799 hci_cc_delete_stored_link_key(hdev, skb);
2800 break;
2801
2802 case HCI_OP_WRITE_LOCAL_NAME:
2803 hci_cc_write_local_name(hdev, skb);
2804 break;
2805
2806 case HCI_OP_READ_LOCAL_NAME:
2807 hci_cc_read_local_name(hdev, skb);
2808 break;
2809
2810 case HCI_OP_WRITE_AUTH_ENABLE:
2811 hci_cc_write_auth_enable(hdev, skb);
2812 break;
2813
2814 case HCI_OP_WRITE_ENCRYPT_MODE:
2815 hci_cc_write_encrypt_mode(hdev, skb);
2816 break;
2817
2818 case HCI_OP_WRITE_SCAN_ENABLE:
2819 hci_cc_write_scan_enable(hdev, skb);
2820 break;
2821
2822 case HCI_OP_READ_CLASS_OF_DEV:
2823 hci_cc_read_class_of_dev(hdev, skb);
2824 break;
2825
2826 case HCI_OP_WRITE_CLASS_OF_DEV:
2827 hci_cc_write_class_of_dev(hdev, skb);
2828 break;
2829
2830 case HCI_OP_READ_VOICE_SETTING:
2831 hci_cc_read_voice_setting(hdev, skb);
2832 break;
2833
2834 case HCI_OP_WRITE_VOICE_SETTING:
2835 hci_cc_write_voice_setting(hdev, skb);
2836 break;
2837
2838 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2839 hci_cc_read_num_supported_iac(hdev, skb);
2840 break;
2841
2842 case HCI_OP_WRITE_SSP_MODE:
2843 hci_cc_write_ssp_mode(hdev, skb);
2844 break;
2845
2846 case HCI_OP_WRITE_SC_SUPPORT:
2847 hci_cc_write_sc_support(hdev, skb);
2848 break;
2849
2850 case HCI_OP_READ_LOCAL_VERSION:
2851 hci_cc_read_local_version(hdev, skb);
2852 break;
2853
2854 case HCI_OP_READ_LOCAL_COMMANDS:
2855 hci_cc_read_local_commands(hdev, skb);
2856 break;
2857
2858 case HCI_OP_READ_LOCAL_FEATURES:
2859 hci_cc_read_local_features(hdev, skb);
2860 break;
2861
2862 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2863 hci_cc_read_local_ext_features(hdev, skb);
2864 break;
2865
2866 case HCI_OP_READ_BUFFER_SIZE:
2867 hci_cc_read_buffer_size(hdev, skb);
2868 break;
2869
2870 case HCI_OP_READ_BD_ADDR:
2871 hci_cc_read_bd_addr(hdev, skb);
2872 break;
2873
2874 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2875 hci_cc_read_page_scan_activity(hdev, skb);
2876 break;
2877
2878 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2879 hci_cc_write_page_scan_activity(hdev, skb);
2880 break;
2881
2882 case HCI_OP_READ_PAGE_SCAN_TYPE:
2883 hci_cc_read_page_scan_type(hdev, skb);
2884 break;
2885
2886 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2887 hci_cc_write_page_scan_type(hdev, skb);
2888 break;
2889
2890 case HCI_OP_READ_DATA_BLOCK_SIZE:
2891 hci_cc_read_data_block_size(hdev, skb);
2892 break;
2893
2894 case HCI_OP_READ_FLOW_CONTROL_MODE:
2895 hci_cc_read_flow_control_mode(hdev, skb);
2896 break;
2897
2898 case HCI_OP_READ_LOCAL_AMP_INFO:
2899 hci_cc_read_local_amp_info(hdev, skb);
2900 break;
2901
2902 case HCI_OP_READ_CLOCK:
2903 hci_cc_read_clock(hdev, skb);
2904 break;
2905
2906 case HCI_OP_READ_INQ_RSP_TX_POWER:
2907 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2908 break;
2909
2910 case HCI_OP_PIN_CODE_REPLY:
2911 hci_cc_pin_code_reply(hdev, skb);
2912 break;
2913
2914 case HCI_OP_PIN_CODE_NEG_REPLY:
2915 hci_cc_pin_code_neg_reply(hdev, skb);
2916 break;
2917
2918 case HCI_OP_READ_LOCAL_OOB_DATA:
2919 hci_cc_read_local_oob_data(hdev, skb);
2920 break;
2921
2922 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2923 hci_cc_read_local_oob_ext_data(hdev, skb);
2924 break;
2925
2926 case HCI_OP_LE_READ_BUFFER_SIZE:
2927 hci_cc_le_read_buffer_size(hdev, skb);
2928 break;
2929
2930 case HCI_OP_LE_READ_LOCAL_FEATURES:
2931 hci_cc_le_read_local_features(hdev, skb);
2932 break;
2933
2934 case HCI_OP_LE_READ_ADV_TX_POWER:
2935 hci_cc_le_read_adv_tx_power(hdev, skb);
2936 break;
2937
2938 case HCI_OP_USER_CONFIRM_REPLY:
2939 hci_cc_user_confirm_reply(hdev, skb);
2940 break;
2941
2942 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2943 hci_cc_user_confirm_neg_reply(hdev, skb);
2944 break;
2945
2946 case HCI_OP_USER_PASSKEY_REPLY:
2947 hci_cc_user_passkey_reply(hdev, skb);
2948 break;
2949
2950 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2951 hci_cc_user_passkey_neg_reply(hdev, skb);
2952 break;
2953
2954 case HCI_OP_LE_SET_RANDOM_ADDR:
2955 hci_cc_le_set_random_addr(hdev, skb);
2956 break;
2957
2958 case HCI_OP_LE_SET_ADV_ENABLE:
2959 hci_cc_le_set_adv_enable(hdev, skb);
2960 break;
2961
2962 case HCI_OP_LE_SET_SCAN_PARAM:
2963 hci_cc_le_set_scan_param(hdev, skb);
2964 break;
2965
2966 case HCI_OP_LE_SET_SCAN_ENABLE:
2967 hci_cc_le_set_scan_enable(hdev, skb);
2968 break;
2969
2970 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2971 hci_cc_le_read_white_list_size(hdev, skb);
2972 break;
2973
2974 case HCI_OP_LE_CLEAR_WHITE_LIST:
2975 hci_cc_le_clear_white_list(hdev, skb);
2976 break;
2977
2978 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2979 hci_cc_le_add_to_white_list(hdev, skb);
2980 break;
2981
2982 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2983 hci_cc_le_del_from_white_list(hdev, skb);
2984 break;
2985
2986 case HCI_OP_LE_READ_SUPPORTED_STATES:
2987 hci_cc_le_read_supported_states(hdev, skb);
2988 break;
2989
2990 case HCI_OP_LE_READ_DEF_DATA_LEN:
2991 hci_cc_le_read_def_data_len(hdev, skb);
2992 break;
2993
2994 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
2995 hci_cc_le_write_def_data_len(hdev, skb);
2996 break;
2997
2998 case HCI_OP_LE_READ_MAX_DATA_LEN:
2999 hci_cc_le_read_max_data_len(hdev, skb);
3000 break;
3001
3002 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3003 hci_cc_write_le_host_supported(hdev, skb);
3004 break;
3005
3006 case HCI_OP_LE_SET_ADV_PARAM:
3007 hci_cc_set_adv_param(hdev, skb);
3008 break;
3009
3010 case HCI_OP_READ_RSSI:
3011 hci_cc_read_rssi(hdev, skb);
3012 break;
3013
3014 case HCI_OP_READ_TX_POWER:
3015 hci_cc_read_tx_power(hdev, skb);
3016 break;
3017
3018 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3019 hci_cc_write_ssp_debug_mode(hdev, skb);
3020 break;
3021
3022 default:
3023 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3024 break;
3025 }
3026
3027 if (*opcode != HCI_OP_NOP)
3028 cancel_delayed_work(&hdev->cmd_timer);
3029
3030 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3031 atomic_set(&hdev->cmd_cnt, 1);
3032
3033 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3034 req_complete_skb);
3035
3036 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3037 queue_work(hdev->workqueue, &hdev->cmd_work);
3038 }
3039
3040 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3041 u16 *opcode, u8 *status,
3042 hci_req_complete_t *req_complete,
3043 hci_req_complete_skb_t *req_complete_skb)
3044 {
3045 struct hci_ev_cmd_status *ev = (void *) skb->data;
3046
3047 skb_pull(skb, sizeof(*ev));
3048
3049 *opcode = __le16_to_cpu(ev->opcode);
3050 *status = ev->status;
3051
3052 switch (*opcode) {
3053 case HCI_OP_INQUIRY:
3054 hci_cs_inquiry(hdev, ev->status);
3055 break;
3056
3057 case HCI_OP_CREATE_CONN:
3058 hci_cs_create_conn(hdev, ev->status);
3059 break;
3060
3061 case HCI_OP_DISCONNECT:
3062 hci_cs_disconnect(hdev, ev->status);
3063 break;
3064
3065 case HCI_OP_ADD_SCO:
3066 hci_cs_add_sco(hdev, ev->status);
3067 break;
3068
3069 case HCI_OP_AUTH_REQUESTED:
3070 hci_cs_auth_requested(hdev, ev->status);
3071 break;
3072
3073 case HCI_OP_SET_CONN_ENCRYPT:
3074 hci_cs_set_conn_encrypt(hdev, ev->status);
3075 break;
3076
3077 case HCI_OP_REMOTE_NAME_REQ:
3078 hci_cs_remote_name_req(hdev, ev->status);
3079 break;
3080
3081 case HCI_OP_READ_REMOTE_FEATURES:
3082 hci_cs_read_remote_features(hdev, ev->status);
3083 break;
3084
3085 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3086 hci_cs_read_remote_ext_features(hdev, ev->status);
3087 break;
3088
3089 case HCI_OP_SETUP_SYNC_CONN:
3090 hci_cs_setup_sync_conn(hdev, ev->status);
3091 break;
3092
3093 case HCI_OP_SNIFF_MODE:
3094 hci_cs_sniff_mode(hdev, ev->status);
3095 break;
3096
3097 case HCI_OP_EXIT_SNIFF_MODE:
3098 hci_cs_exit_sniff_mode(hdev, ev->status);
3099 break;
3100
3101 case HCI_OP_SWITCH_ROLE:
3102 hci_cs_switch_role(hdev, ev->status);
3103 break;
3104
3105 case HCI_OP_LE_CREATE_CONN:
3106 hci_cs_le_create_conn(hdev, ev->status);
3107 break;
3108
3109 case HCI_OP_LE_READ_REMOTE_FEATURES:
3110 hci_cs_le_read_remote_features(hdev, ev->status);
3111 break;
3112
3113 case HCI_OP_LE_START_ENC:
3114 hci_cs_le_start_enc(hdev, ev->status);
3115 break;
3116
3117 default:
3118 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3119 break;
3120 }
3121
3122 if (*opcode != HCI_OP_NOP)
3123 cancel_delayed_work(&hdev->cmd_timer);
3124
3125 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3126 atomic_set(&hdev->cmd_cnt, 1);
3127
3128 /* Indicate request completion if the command failed. Also, if
3129 * we're not waiting for a special event and we get a success
3130 * command status we should try to flag the request as completed
3131 * (since for this kind of commands there will not be a command
3132 * complete event).
3133 */
3134 if (ev->status ||
3135 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3136 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3137 req_complete_skb);
3138
3139 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3140 queue_work(hdev->workqueue, &hdev->cmd_work);
3141 }
3142
3143 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3144 {
3145 struct hci_ev_hardware_error *ev = (void *) skb->data;
3146
3147 hdev->hw_error_code = ev->code;
3148
3149 queue_work(hdev->req_workqueue, &hdev->error_reset);
3150 }
3151
3152 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3153 {
3154 struct hci_ev_role_change *ev = (void *) skb->data;
3155 struct hci_conn *conn;
3156
3157 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3158
3159 hci_dev_lock(hdev);
3160
3161 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3162 if (conn) {
3163 if (!ev->status)
3164 conn->role = ev->role;
3165
3166 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3167
3168 hci_role_switch_cfm(conn, ev->status, ev->role);
3169 }
3170
3171 hci_dev_unlock(hdev);
3172 }
3173
3174 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3175 {
3176 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3177 int i;
3178
3179 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3180 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3181 return;
3182 }
3183
3184 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3185 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3186 BT_DBG("%s bad parameters", hdev->name);
3187 return;
3188 }
3189
3190 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3191
3192 for (i = 0; i < ev->num_hndl; i++) {
3193 struct hci_comp_pkts_info *info = &ev->handles[i];
3194 struct hci_conn *conn;
3195 __u16 handle, count;
3196
3197 handle = __le16_to_cpu(info->handle);
3198 count = __le16_to_cpu(info->count);
3199
3200 conn = hci_conn_hash_lookup_handle(hdev, handle);
3201 if (!conn)
3202 continue;
3203
3204 conn->sent -= count;
3205
3206 switch (conn->type) {
3207 case ACL_LINK:
3208 hdev->acl_cnt += count;
3209 if (hdev->acl_cnt > hdev->acl_pkts)
3210 hdev->acl_cnt = hdev->acl_pkts;
3211 break;
3212
3213 case LE_LINK:
3214 if (hdev->le_pkts) {
3215 hdev->le_cnt += count;
3216 if (hdev->le_cnt > hdev->le_pkts)
3217 hdev->le_cnt = hdev->le_pkts;
3218 } else {
3219 hdev->acl_cnt += count;
3220 if (hdev->acl_cnt > hdev->acl_pkts)
3221 hdev->acl_cnt = hdev->acl_pkts;
3222 }
3223 break;
3224
3225 case SCO_LINK:
3226 hdev->sco_cnt += count;
3227 if (hdev->sco_cnt > hdev->sco_pkts)
3228 hdev->sco_cnt = hdev->sco_pkts;
3229 break;
3230
3231 default:
3232 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3233 break;
3234 }
3235 }
3236
3237 queue_work(hdev->workqueue, &hdev->tx_work);
3238 }
3239
3240 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3241 __u16 handle)
3242 {
3243 struct hci_chan *chan;
3244
3245 switch (hdev->dev_type) {
3246 case HCI_BREDR:
3247 return hci_conn_hash_lookup_handle(hdev, handle);
3248 case HCI_AMP:
3249 chan = hci_chan_lookup_handle(hdev, handle);
3250 if (chan)
3251 return chan->conn;
3252 break;
3253 default:
3254 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3255 break;
3256 }
3257
3258 return NULL;
3259 }
3260
3261 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3262 {
3263 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3264 int i;
3265
3266 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3267 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3268 return;
3269 }
3270
3271 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3272 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3273 BT_DBG("%s bad parameters", hdev->name);
3274 return;
3275 }
3276
3277 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3278 ev->num_hndl);
3279
3280 for (i = 0; i < ev->num_hndl; i++) {
3281 struct hci_comp_blocks_info *info = &ev->handles[i];
3282 struct hci_conn *conn = NULL;
3283 __u16 handle, block_count;
3284
3285 handle = __le16_to_cpu(info->handle);
3286 block_count = __le16_to_cpu(info->blocks);
3287
3288 conn = __hci_conn_lookup_handle(hdev, handle);
3289 if (!conn)
3290 continue;
3291
3292 conn->sent -= block_count;
3293
3294 switch (conn->type) {
3295 case ACL_LINK:
3296 case AMP_LINK:
3297 hdev->block_cnt += block_count;
3298 if (hdev->block_cnt > hdev->num_blocks)
3299 hdev->block_cnt = hdev->num_blocks;
3300 break;
3301
3302 default:
3303 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3304 break;
3305 }
3306 }
3307
3308 queue_work(hdev->workqueue, &hdev->tx_work);
3309 }
3310
3311 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3312 {
3313 struct hci_ev_mode_change *ev = (void *) skb->data;
3314 struct hci_conn *conn;
3315
3316 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3317
3318 hci_dev_lock(hdev);
3319
3320 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3321 if (conn) {
3322 conn->mode = ev->mode;
3323
3324 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3325 &conn->flags)) {
3326 if (conn->mode == HCI_CM_ACTIVE)
3327 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3328 else
3329 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3330 }
3331
3332 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3333 hci_sco_setup(conn, ev->status);
3334 }
3335
3336 hci_dev_unlock(hdev);
3337 }
3338
3339 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3340 {
3341 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3342 struct hci_conn *conn;
3343
3344 BT_DBG("%s", hdev->name);
3345
3346 hci_dev_lock(hdev);
3347
3348 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3349 if (!conn)
3350 goto unlock;
3351
3352 if (conn->state == BT_CONNECTED) {
3353 hci_conn_hold(conn);
3354 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3355 hci_conn_drop(conn);
3356 }
3357
3358 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3359 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3360 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3361 sizeof(ev->bdaddr), &ev->bdaddr);
3362 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3363 u8 secure;
3364
3365 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3366 secure = 1;
3367 else
3368 secure = 0;
3369
3370 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3371 }
3372
3373 unlock:
3374 hci_dev_unlock(hdev);
3375 }
3376
3377 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3378 {
3379 if (key_type == HCI_LK_CHANGED_COMBINATION)
3380 return;
3381
3382 conn->pin_length = pin_len;
3383 conn->key_type = key_type;
3384
3385 switch (key_type) {
3386 case HCI_LK_LOCAL_UNIT:
3387 case HCI_LK_REMOTE_UNIT:
3388 case HCI_LK_DEBUG_COMBINATION:
3389 return;
3390 case HCI_LK_COMBINATION:
3391 if (pin_len == 16)
3392 conn->pending_sec_level = BT_SECURITY_HIGH;
3393 else
3394 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3395 break;
3396 case HCI_LK_UNAUTH_COMBINATION_P192:
3397 case HCI_LK_UNAUTH_COMBINATION_P256:
3398 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3399 break;
3400 case HCI_LK_AUTH_COMBINATION_P192:
3401 conn->pending_sec_level = BT_SECURITY_HIGH;
3402 break;
3403 case HCI_LK_AUTH_COMBINATION_P256:
3404 conn->pending_sec_level = BT_SECURITY_FIPS;
3405 break;
3406 }
3407 }
3408
3409 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3410 {
3411 struct hci_ev_link_key_req *ev = (void *) skb->data;
3412 struct hci_cp_link_key_reply cp;
3413 struct hci_conn *conn;
3414 struct link_key *key;
3415
3416 BT_DBG("%s", hdev->name);
3417
3418 if (!hci_dev_test_flag(hdev, HCI_MGMT))
3419 return;
3420
3421 hci_dev_lock(hdev);
3422
3423 key = hci_find_link_key(hdev, &ev->bdaddr);
3424 if (!key) {
3425 BT_DBG("%s link key not found for %pMR", hdev->name,
3426 &ev->bdaddr);
3427 goto not_found;
3428 }
3429
3430 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3431 &ev->bdaddr);
3432
3433 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3434 if (conn) {
3435 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3436
3437 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3438 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3439 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3440 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3441 goto not_found;
3442 }
3443
3444 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3445 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3446 conn->pending_sec_level == BT_SECURITY_FIPS)) {
3447 BT_DBG("%s ignoring key unauthenticated for high security",
3448 hdev->name);
3449 goto not_found;
3450 }
3451
3452 conn_set_key(conn, key->type, key->pin_len);
3453 }
3454
3455 bacpy(&cp.bdaddr, &ev->bdaddr);
3456 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3457
3458 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3459
3460 hci_dev_unlock(hdev);
3461
3462 return;
3463
3464 not_found:
3465 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3466 hci_dev_unlock(hdev);
3467 }
3468
3469 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3470 {
3471 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3472 struct hci_conn *conn;
3473 struct link_key *key;
3474 bool persistent;
3475 u8 pin_len = 0;
3476
3477 BT_DBG("%s", hdev->name);
3478
3479 hci_dev_lock(hdev);
3480
3481 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3482 if (!conn)
3483 goto unlock;
3484
3485 hci_conn_hold(conn);
3486 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3487 hci_conn_drop(conn);
3488
3489 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3490 conn_set_key(conn, ev->key_type, conn->pin_length);
3491
3492 if (!hci_dev_test_flag(hdev, HCI_MGMT))
3493 goto unlock;
3494
3495 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3496 ev->key_type, pin_len, &persistent);
3497 if (!key)
3498 goto unlock;
3499
3500 /* Update connection information since adding the key will have
3501 * fixed up the type in the case of changed combination keys.
3502 */
3503 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3504 conn_set_key(conn, key->type, key->pin_len);
3505
3506 mgmt_new_link_key(hdev, key, persistent);
3507
3508 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3509 * is set. If it's not set simply remove the key from the kernel
3510 * list (we've still notified user space about it but with
3511 * store_hint being 0).
3512 */
3513 if (key->type == HCI_LK_DEBUG_COMBINATION &&
3514 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3515 list_del_rcu(&key->list);
3516 kfree_rcu(key, rcu);
3517 goto unlock;
3518 }
3519
3520 if (persistent)
3521 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3522 else
3523 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3524
3525 unlock:
3526 hci_dev_unlock(hdev);
3527 }
3528
3529 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3530 {
3531 struct hci_ev_clock_offset *ev = (void *) skb->data;
3532 struct hci_conn *conn;
3533
3534 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3535
3536 hci_dev_lock(hdev);
3537
3538 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3539 if (conn && !ev->status) {
3540 struct inquiry_entry *ie;
3541
3542 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3543 if (ie) {
3544 ie->data.clock_offset = ev->clock_offset;
3545 ie->timestamp = jiffies;
3546 }
3547 }
3548
3549 hci_dev_unlock(hdev);
3550 }
3551
3552 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3553 {
3554 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3555 struct hci_conn *conn;
3556
3557 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3558
3559 hci_dev_lock(hdev);
3560
3561 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3562 if (conn && !ev->status)
3563 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3564
3565 hci_dev_unlock(hdev);
3566 }
3567
3568 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3569 {
3570 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3571 struct inquiry_entry *ie;
3572
3573 BT_DBG("%s", hdev->name);
3574
3575 hci_dev_lock(hdev);
3576
3577 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3578 if (ie) {
3579 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3580 ie->timestamp = jiffies;
3581 }
3582
3583 hci_dev_unlock(hdev);
3584 }
3585
3586 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3587 struct sk_buff *skb)
3588 {
3589 struct inquiry_data data;
3590 int num_rsp = *((__u8 *) skb->data);
3591
3592 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3593
3594 if (!num_rsp)
3595 return;
3596
3597 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3598 return;
3599
3600 hci_dev_lock(hdev);
3601
3602 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3603 struct inquiry_info_with_rssi_and_pscan_mode *info;
3604 info = (void *) (skb->data + 1);
3605
3606 for (; num_rsp; num_rsp--, info++) {
3607 u32 flags;
3608
3609 bacpy(&data.bdaddr, &info->bdaddr);
3610 data.pscan_rep_mode = info->pscan_rep_mode;
3611 data.pscan_period_mode = info->pscan_period_mode;
3612 data.pscan_mode = info->pscan_mode;
3613 memcpy(data.dev_class, info->dev_class, 3);
3614 data.clock_offset = info->clock_offset;
3615 data.rssi = info->rssi;
3616 data.ssp_mode = 0x00;
3617
3618 flags = hci_inquiry_cache_update(hdev, &data, false);
3619
3620 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3621 info->dev_class, info->rssi,
3622 flags, NULL, 0, NULL, 0);
3623 }
3624 } else {
3625 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3626
3627 for (; num_rsp; num_rsp--, info++) {
3628 u32 flags;
3629
3630 bacpy(&data.bdaddr, &info->bdaddr);
3631 data.pscan_rep_mode = info->pscan_rep_mode;
3632 data.pscan_period_mode = info->pscan_period_mode;
3633 data.pscan_mode = 0x00;
3634 memcpy(data.dev_class, info->dev_class, 3);
3635 data.clock_offset = info->clock_offset;
3636 data.rssi = info->rssi;
3637 data.ssp_mode = 0x00;
3638
3639 flags = hci_inquiry_cache_update(hdev, &data, false);
3640
3641 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3642 info->dev_class, info->rssi,
3643 flags, NULL, 0, NULL, 0);
3644 }
3645 }
3646
3647 hci_dev_unlock(hdev);
3648 }
3649
3650 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3651 struct sk_buff *skb)
3652 {
3653 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3654 struct hci_conn *conn;
3655
3656 BT_DBG("%s", hdev->name);
3657
3658 hci_dev_lock(hdev);
3659
3660 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3661 if (!conn)
3662 goto unlock;
3663
3664 if (ev->page < HCI_MAX_PAGES)
3665 memcpy(conn->features[ev->page], ev->features, 8);
3666
3667 if (!ev->status && ev->page == 0x01) {
3668 struct inquiry_entry *ie;
3669
3670 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3671 if (ie)
3672 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3673
3674 if (ev->features[0] & LMP_HOST_SSP) {
3675 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3676 } else {
3677 /* It is mandatory by the Bluetooth specification that
3678 * Extended Inquiry Results are only used when Secure
3679 * Simple Pairing is enabled, but some devices violate
3680 * this.
3681 *
3682 * To make these devices work, the internal SSP
3683 * enabled flag needs to be cleared if the remote host
3684 * features do not indicate SSP support */
3685 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3686 }
3687
3688 if (ev->features[0] & LMP_HOST_SC)
3689 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3690 }
3691
3692 if (conn->state != BT_CONFIG)
3693 goto unlock;
3694
3695 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3696 struct hci_cp_remote_name_req cp;
3697 memset(&cp, 0, sizeof(cp));
3698 bacpy(&cp.bdaddr, &conn->dst);
3699 cp.pscan_rep_mode = 0x02;
3700 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3701 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3702 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3703
3704 if (!hci_outgoing_auth_needed(hdev, conn)) {
3705 conn->state = BT_CONNECTED;
3706 hci_connect_cfm(conn, ev->status);
3707 hci_conn_drop(conn);
3708 }
3709
3710 unlock:
3711 hci_dev_unlock(hdev);
3712 }
3713
3714 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3715 struct sk_buff *skb)
3716 {
3717 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3718 struct hci_conn *conn;
3719
3720 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3721
3722 hci_dev_lock(hdev);
3723
3724 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3725 if (!conn) {
3726 if (ev->link_type == ESCO_LINK)
3727 goto unlock;
3728
3729 /* When the link type in the event indicates SCO connection
3730 * and lookup of the connection object fails, then check
3731 * if an eSCO connection object exists.
3732 *
3733 * The core limits the synchronous connections to either
3734 * SCO or eSCO. The eSCO connection is preferred and tried
3735 * to be setup first and until successfully established,
3736 * the link type will be hinted as eSCO.
3737 */
3738 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3739 if (!conn)
3740 goto unlock;
3741 }
3742
3743 switch (ev->status) {
3744 case 0x00:
3745 conn->handle = __le16_to_cpu(ev->handle);
3746 conn->state = BT_CONNECTED;
3747 conn->type = ev->link_type;
3748
3749 hci_debugfs_create_conn(conn);
3750 hci_conn_add_sysfs(conn);
3751 break;
3752
3753 case 0x10: /* Connection Accept Timeout */
3754 case 0x0d: /* Connection Rejected due to Limited Resources */
3755 case 0x11: /* Unsupported Feature or Parameter Value */
3756 case 0x1c: /* SCO interval rejected */
3757 case 0x1a: /* Unsupported Remote Feature */
3758 case 0x1f: /* Unspecified error */
3759 case 0x20: /* Unsupported LMP Parameter value */
3760 if (conn->out) {
3761 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3762 (hdev->esco_type & EDR_ESCO_MASK);
3763 if (hci_setup_sync(conn, conn->link->handle))
3764 goto unlock;
3765 }
3766 /* fall through */
3767
3768 default:
3769 conn->state = BT_CLOSED;
3770 break;
3771 }
3772
3773 hci_connect_cfm(conn, ev->status);
3774 if (ev->status)
3775 hci_conn_del(conn);
3776
3777 unlock:
3778 hci_dev_unlock(hdev);
3779 }
3780
3781 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3782 {
3783 size_t parsed = 0;
3784
3785 while (parsed < eir_len) {
3786 u8 field_len = eir[0];
3787
3788 if (field_len == 0)
3789 return parsed;
3790
3791 parsed += field_len + 1;
3792 eir += field_len + 1;
3793 }
3794
3795 return eir_len;
3796 }
3797
3798 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3799 struct sk_buff *skb)
3800 {
3801 struct inquiry_data data;
3802 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3803 int num_rsp = *((__u8 *) skb->data);
3804 size_t eir_len;
3805
3806 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3807
3808 if (!num_rsp)
3809 return;
3810
3811 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3812 return;
3813
3814 hci_dev_lock(hdev);
3815
3816 for (; num_rsp; num_rsp--, info++) {
3817 u32 flags;
3818 bool name_known;
3819
3820 bacpy(&data.bdaddr, &info->bdaddr);
3821 data.pscan_rep_mode = info->pscan_rep_mode;
3822 data.pscan_period_mode = info->pscan_period_mode;
3823 data.pscan_mode = 0x00;
3824 memcpy(data.dev_class, info->dev_class, 3);
3825 data.clock_offset = info->clock_offset;
3826 data.rssi = info->rssi;
3827 data.ssp_mode = 0x01;
3828
3829 if (hci_dev_test_flag(hdev, HCI_MGMT))
3830 name_known = eir_has_data_type(info->data,
3831 sizeof(info->data),
3832 EIR_NAME_COMPLETE);
3833 else
3834 name_known = true;
3835
3836 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3837
3838 eir_len = eir_get_length(info->data, sizeof(info->data));
3839
3840 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3841 info->dev_class, info->rssi,
3842 flags, info->data, eir_len, NULL, 0);
3843 }
3844
3845 hci_dev_unlock(hdev);
3846 }
3847
3848 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3849 struct sk_buff *skb)
3850 {
3851 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3852 struct hci_conn *conn;
3853
3854 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3855 __le16_to_cpu(ev->handle));
3856
3857 hci_dev_lock(hdev);
3858
3859 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3860 if (!conn)
3861 goto unlock;
3862
3863 /* For BR/EDR the necessary steps are taken through the
3864 * auth_complete event.
3865 */
3866 if (conn->type != LE_LINK)
3867 goto unlock;
3868
3869 if (!ev->status)
3870 conn->sec_level = conn->pending_sec_level;
3871
3872 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3873
3874 if (ev->status && conn->state == BT_CONNECTED) {
3875 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3876 hci_conn_drop(conn);
3877 goto unlock;
3878 }
3879
3880 if (conn->state == BT_CONFIG) {
3881 if (!ev->status)
3882 conn->state = BT_CONNECTED;
3883
3884 hci_connect_cfm(conn, ev->status);
3885 hci_conn_drop(conn);
3886 } else {
3887 hci_auth_cfm(conn, ev->status);
3888
3889 hci_conn_hold(conn);
3890 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3891 hci_conn_drop(conn);
3892 }
3893
3894 unlock:
3895 hci_dev_unlock(hdev);
3896 }
3897
3898 static u8 hci_get_auth_req(struct hci_conn *conn)
3899 {
3900 /* If remote requests no-bonding follow that lead */
3901 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3902 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3903 return conn->remote_auth | (conn->auth_type & 0x01);
3904
3905 /* If both remote and local have enough IO capabilities, require
3906 * MITM protection
3907 */
3908 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3909 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3910 return conn->remote_auth | 0x01;
3911
3912 /* No MITM protection possible so ignore remote requirement */
3913 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3914 }
3915
3916 static u8 bredr_oob_data_present(struct hci_conn *conn)
3917 {
3918 struct hci_dev *hdev = conn->hdev;
3919 struct oob_data *data;
3920
3921 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3922 if (!data)
3923 return 0x00;
3924
3925 if (bredr_sc_enabled(hdev)) {
3926 /* When Secure Connections is enabled, then just
3927 * return the present value stored with the OOB
3928 * data. The stored value contains the right present
3929 * information. However it can only be trusted when
3930 * not in Secure Connection Only mode.
3931 */
3932 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3933 return data->present;
3934
3935 /* When Secure Connections Only mode is enabled, then
3936 * the P-256 values are required. If they are not
3937 * available, then do not declare that OOB data is
3938 * present.
3939 */
3940 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3941 !memcmp(data->hash256, ZERO_KEY, 16))
3942 return 0x00;
3943
3944 return 0x02;
3945 }
3946
3947 /* When Secure Connections is not enabled or actually
3948 * not supported by the hardware, then check that if
3949 * P-192 data values are present.
3950 */
3951 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3952 !memcmp(data->hash192, ZERO_KEY, 16))
3953 return 0x00;
3954
3955 return 0x01;
3956 }
3957
3958 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3959 {
3960 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3961 struct hci_conn *conn;
3962
3963 BT_DBG("%s", hdev->name);
3964
3965 hci_dev_lock(hdev);
3966
3967 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3968 if (!conn)
3969 goto unlock;
3970
3971 hci_conn_hold(conn);
3972
3973 if (!hci_dev_test_flag(hdev, HCI_MGMT))
3974 goto unlock;
3975
3976 /* Allow pairing if we're pairable, the initiators of the
3977 * pairing or if the remote is not requesting bonding.
3978 */
3979 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
3980 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
3981 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3982 struct hci_cp_io_capability_reply cp;
3983
3984 bacpy(&cp.bdaddr, &ev->bdaddr);
3985 /* Change the IO capability from KeyboardDisplay
3986 * to DisplayYesNo as it is not supported by BT spec. */
3987 cp.capability = (conn->io_capability == 0x04) ?
3988 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3989
3990 /* If we are initiators, there is no remote information yet */
3991 if (conn->remote_auth == 0xff) {
3992 /* Request MITM protection if our IO caps allow it
3993 * except for the no-bonding case.
3994 */
3995 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3996 conn->auth_type != HCI_AT_NO_BONDING)
3997 conn->auth_type |= 0x01;
3998 } else {
3999 conn->auth_type = hci_get_auth_req(conn);
4000 }
4001
4002 /* If we're not bondable, force one of the non-bondable
4003 * authentication requirement values.
4004 */
4005 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4006 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4007
4008 cp.authentication = conn->auth_type;
4009 cp.oob_data = bredr_oob_data_present(conn);
4010
4011 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4012 sizeof(cp), &cp);
4013 } else {
4014 struct hci_cp_io_capability_neg_reply cp;
4015
4016 bacpy(&cp.bdaddr, &ev->bdaddr);
4017 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4018
4019 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4020 sizeof(cp), &cp);
4021 }
4022
4023 unlock:
4024 hci_dev_unlock(hdev);
4025 }
4026
4027 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4028 {
4029 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4030 struct hci_conn *conn;
4031
4032 BT_DBG("%s", hdev->name);
4033
4034 hci_dev_lock(hdev);
4035
4036 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4037 if (!conn)
4038 goto unlock;
4039
4040 conn->remote_cap = ev->capability;
4041 conn->remote_auth = ev->authentication;
4042
4043 unlock:
4044 hci_dev_unlock(hdev);
4045 }
4046
4047 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4048 struct sk_buff *skb)
4049 {
4050 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4051 int loc_mitm, rem_mitm, confirm_hint = 0;
4052 struct hci_conn *conn;
4053
4054 BT_DBG("%s", hdev->name);
4055
4056 hci_dev_lock(hdev);
4057
4058 if (!hci_dev_test_flag(hdev, HCI_MGMT))
4059 goto unlock;
4060
4061 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4062 if (!conn)
4063 goto unlock;
4064
4065 loc_mitm = (conn->auth_type & 0x01);
4066 rem_mitm = (conn->remote_auth & 0x01);
4067
4068 /* If we require MITM but the remote device can't provide that
4069 * (it has NoInputNoOutput) then reject the confirmation
4070 * request. We check the security level here since it doesn't
4071 * necessarily match conn->auth_type.
4072 */
4073 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4074 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4075 BT_DBG("Rejecting request: remote device can't provide MITM");
4076 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4077 sizeof(ev->bdaddr), &ev->bdaddr);
4078 goto unlock;
4079 }
4080
4081 /* If no side requires MITM protection; auto-accept */
4082 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4083 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4084
4085 /* If we're not the initiators request authorization to
4086 * proceed from user space (mgmt_user_confirm with
4087 * confirm_hint set to 1). The exception is if neither
4088 * side had MITM or if the local IO capability is
4089 * NoInputNoOutput, in which case we do auto-accept
4090 */
4091 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4092 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4093 (loc_mitm || rem_mitm)) {
4094 BT_DBG("Confirming auto-accept as acceptor");
4095 confirm_hint = 1;
4096 goto confirm;
4097 }
4098
4099 BT_DBG("Auto-accept of user confirmation with %ums delay",
4100 hdev->auto_accept_delay);
4101
4102 if (hdev->auto_accept_delay > 0) {
4103 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4104 queue_delayed_work(conn->hdev->workqueue,
4105 &conn->auto_accept_work, delay);
4106 goto unlock;
4107 }
4108
4109 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4110 sizeof(ev->bdaddr), &ev->bdaddr);
4111 goto unlock;
4112 }
4113
4114 confirm:
4115 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4116 le32_to_cpu(ev->passkey), confirm_hint);
4117
4118 unlock:
4119 hci_dev_unlock(hdev);
4120 }
4121
4122 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4123 struct sk_buff *skb)
4124 {
4125 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4126
4127 BT_DBG("%s", hdev->name);
4128
4129 if (hci_dev_test_flag(hdev, HCI_MGMT))
4130 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4131 }
4132
4133 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4134 struct sk_buff *skb)
4135 {
4136 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4137 struct hci_conn *conn;
4138
4139 BT_DBG("%s", hdev->name);
4140
4141 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4142 if (!conn)
4143 return;
4144
4145 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4146 conn->passkey_entered = 0;
4147
4148 if (hci_dev_test_flag(hdev, HCI_MGMT))
4149 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4150 conn->dst_type, conn->passkey_notify,
4151 conn->passkey_entered);
4152 }
4153
4154 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4155 {
4156 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4157 struct hci_conn *conn;
4158
4159 BT_DBG("%s", hdev->name);
4160
4161 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4162 if (!conn)
4163 return;
4164
4165 switch (ev->type) {
4166 case HCI_KEYPRESS_STARTED:
4167 conn->passkey_entered = 0;
4168 return;
4169
4170 case HCI_KEYPRESS_ENTERED:
4171 conn->passkey_entered++;
4172 break;
4173
4174 case HCI_KEYPRESS_ERASED:
4175 conn->passkey_entered--;
4176 break;
4177
4178 case HCI_KEYPRESS_CLEARED:
4179 conn->passkey_entered = 0;
4180 break;
4181
4182 case HCI_KEYPRESS_COMPLETED:
4183 return;
4184 }
4185
4186 if (hci_dev_test_flag(hdev, HCI_MGMT))
4187 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4188 conn->dst_type, conn->passkey_notify,
4189 conn->passkey_entered);
4190 }
4191
4192 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4193 struct sk_buff *skb)
4194 {
4195 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4196 struct hci_conn *conn;
4197
4198 BT_DBG("%s", hdev->name);
4199
4200 hci_dev_lock(hdev);
4201
4202 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4203 if (!conn)
4204 goto unlock;
4205
4206 /* Reset the authentication requirement to unknown */
4207 conn->remote_auth = 0xff;
4208
4209 /* To avoid duplicate auth_failed events to user space we check
4210 * the HCI_CONN_AUTH_PEND flag which will be set if we
4211 * initiated the authentication. A traditional auth_complete
4212 * event gets always produced as initiator and is also mapped to
4213 * the mgmt_auth_failed event */
4214 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4215 mgmt_auth_failed(conn, ev->status);
4216
4217 hci_conn_drop(conn);
4218
4219 unlock:
4220 hci_dev_unlock(hdev);
4221 }
4222
4223 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4224 struct sk_buff *skb)
4225 {
4226 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4227 struct inquiry_entry *ie;
4228 struct hci_conn *conn;
4229
4230 BT_DBG("%s", hdev->name);
4231
4232 hci_dev_lock(hdev);
4233
4234 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4235 if (conn)
4236 memcpy(conn->features[1], ev->features, 8);
4237
4238 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4239 if (ie)
4240 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4241
4242 hci_dev_unlock(hdev);
4243 }
4244
4245 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4246 struct sk_buff *skb)
4247 {
4248 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4249 struct oob_data *data;
4250
4251 BT_DBG("%s", hdev->name);
4252
4253 hci_dev_lock(hdev);
4254
4255 if (!hci_dev_test_flag(hdev, HCI_MGMT))
4256 goto unlock;
4257
4258 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4259 if (!data) {
4260 struct hci_cp_remote_oob_data_neg_reply cp;
4261
4262 bacpy(&cp.bdaddr, &ev->bdaddr);
4263 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4264 sizeof(cp), &cp);
4265 goto unlock;
4266 }
4267
4268 if (bredr_sc_enabled(hdev)) {
4269 struct hci_cp_remote_oob_ext_data_reply cp;
4270
4271 bacpy(&cp.bdaddr, &ev->bdaddr);
4272 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4273 memset(cp.hash192, 0, sizeof(cp.hash192));
4274 memset(cp.rand192, 0, sizeof(cp.rand192));
4275 } else {
4276 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4277 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4278 }
4279 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4280 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4281
4282 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4283 sizeof(cp), &cp);
4284 } else {
4285 struct hci_cp_remote_oob_data_reply cp;
4286
4287 bacpy(&cp.bdaddr, &ev->bdaddr);
4288 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4289 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4290
4291 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4292 sizeof(cp), &cp);
4293 }
4294
4295 unlock:
4296 hci_dev_unlock(hdev);
4297 }
4298
4299 #if IS_ENABLED(CONFIG_BT_HS)
4300 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4301 {
4302 struct hci_ev_channel_selected *ev = (void *)skb->data;
4303 struct hci_conn *hcon;
4304
4305 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4306
4307 skb_pull(skb, sizeof(*ev));
4308
4309 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4310 if (!hcon)
4311 return;
4312
4313 amp_read_loc_assoc_final_data(hdev, hcon);
4314 }
4315
4316 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4317 struct sk_buff *skb)
4318 {
4319 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4320 struct hci_conn *hcon, *bredr_hcon;
4321
4322 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4323 ev->status);
4324
4325 hci_dev_lock(hdev);
4326
4327 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4328 if (!hcon) {
4329 hci_dev_unlock(hdev);
4330 return;
4331 }
4332
4333 if (ev->status) {
4334 hci_conn_del(hcon);
4335 hci_dev_unlock(hdev);
4336 return;
4337 }
4338
4339 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4340
4341 hcon->state = BT_CONNECTED;
4342 bacpy(&hcon->dst, &bredr_hcon->dst);
4343
4344 hci_conn_hold(hcon);
4345 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4346 hci_conn_drop(hcon);
4347
4348 hci_debugfs_create_conn(hcon);
4349 hci_conn_add_sysfs(hcon);
4350
4351 amp_physical_cfm(bredr_hcon, hcon);
4352
4353 hci_dev_unlock(hdev);
4354 }
4355
4356 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4357 {
4358 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4359 struct hci_conn *hcon;
4360 struct hci_chan *hchan;
4361 struct amp_mgr *mgr;
4362
4363 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4364 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4365 ev->status);
4366
4367 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4368 if (!hcon)
4369 return;
4370
4371 /* Create AMP hchan */
4372 hchan = hci_chan_create(hcon);
4373 if (!hchan)
4374 return;
4375
4376 hchan->handle = le16_to_cpu(ev->handle);
4377
4378 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4379
4380 mgr = hcon->amp_mgr;
4381 if (mgr && mgr->bredr_chan) {
4382 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4383
4384 l2cap_chan_lock(bredr_chan);
4385
4386 bredr_chan->conn->mtu = hdev->block_mtu;
4387 l2cap_logical_cfm(bredr_chan, hchan, 0);
4388 hci_conn_hold(hcon);
4389
4390 l2cap_chan_unlock(bredr_chan);
4391 }
4392 }
4393
4394 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4395 struct sk_buff *skb)
4396 {
4397 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4398 struct hci_chan *hchan;
4399
4400 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4401 le16_to_cpu(ev->handle), ev->status);
4402
4403 if (ev->status)
4404 return;
4405
4406 hci_dev_lock(hdev);
4407
4408 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4409 if (!hchan)
4410 goto unlock;
4411
4412 amp_destroy_logical_link(hchan, ev->reason);
4413
4414 unlock:
4415 hci_dev_unlock(hdev);
4416 }
4417
4418 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4419 struct sk_buff *skb)
4420 {
4421 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4422 struct hci_conn *hcon;
4423
4424 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4425
4426 if (ev->status)
4427 return;
4428
4429 hci_dev_lock(hdev);
4430
4431 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4432 if (hcon) {
4433 hcon->state = BT_CLOSED;
4434 hci_conn_del(hcon);
4435 }
4436
4437 hci_dev_unlock(hdev);
4438 }
4439 #endif
4440
4441 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4442 {
4443 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4444 struct hci_conn_params *params;
4445 struct hci_conn *conn;
4446 struct smp_irk *irk;
4447 u8 addr_type;
4448
4449 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4450
4451 hci_dev_lock(hdev);
4452
4453 /* All controllers implicitly stop advertising in the event of a
4454 * connection, so ensure that the state bit is cleared.
4455 */
4456 hci_dev_clear_flag(hdev, HCI_LE_ADV);
4457
4458 conn = hci_lookup_le_connect(hdev);
4459 if (!conn) {
4460 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4461 if (!conn) {
4462 BT_ERR("No memory for new connection");
4463 goto unlock;
4464 }
4465
4466 conn->dst_type = ev->bdaddr_type;
4467
4468 /* If we didn't have a hci_conn object previously
4469 * but we're in master role this must be something
4470 * initiated using a white list. Since white list based
4471 * connections are not "first class citizens" we don't
4472 * have full tracking of them. Therefore, we go ahead
4473 * with a "best effort" approach of determining the
4474 * initiator address based on the HCI_PRIVACY flag.
4475 */
4476 if (conn->out) {
4477 conn->resp_addr_type = ev->bdaddr_type;
4478 bacpy(&conn->resp_addr, &ev->bdaddr);
4479 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4480 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4481 bacpy(&conn->init_addr, &hdev->rpa);
4482 } else {
4483 hci_copy_identity_address(hdev,
4484 &conn->init_addr,
4485 &conn->init_addr_type);
4486 }
4487 }
4488 } else {
4489 cancel_delayed_work(&conn->le_conn_timeout);
4490 }
4491
4492 if (!conn->out) {
4493 /* Set the responder (our side) address type based on
4494 * the advertising address type.
4495 */
4496 conn->resp_addr_type = hdev->adv_addr_type;
4497 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4498 bacpy(&conn->resp_addr, &hdev->random_addr);
4499 else
4500 bacpy(&conn->resp_addr, &hdev->bdaddr);
4501
4502 conn->init_addr_type = ev->bdaddr_type;
4503 bacpy(&conn->init_addr, &ev->bdaddr);
4504
4505 /* For incoming connections, set the default minimum
4506 * and maximum connection interval. They will be used
4507 * to check if the parameters are in range and if not
4508 * trigger the connection update procedure.
4509 */
4510 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4511 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4512 }
4513
4514 /* Lookup the identity address from the stored connection
4515 * address and address type.
4516 *
4517 * When establishing connections to an identity address, the
4518 * connection procedure will store the resolvable random
4519 * address first. Now if it can be converted back into the
4520 * identity address, start using the identity address from
4521 * now on.
4522 */
4523 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4524 if (irk) {
4525 bacpy(&conn->dst, &irk->bdaddr);
4526 conn->dst_type = irk->addr_type;
4527 }
4528
4529 if (ev->status) {
4530 hci_le_conn_failed(conn, ev->status);
4531 goto unlock;
4532 }
4533
4534 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4535 addr_type = BDADDR_LE_PUBLIC;
4536 else
4537 addr_type = BDADDR_LE_RANDOM;
4538
4539 /* Drop the connection if the device is blocked */
4540 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4541 hci_conn_drop(conn);
4542 goto unlock;
4543 }
4544
4545 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4546 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4547
4548 conn->sec_level = BT_SECURITY_LOW;
4549 conn->handle = __le16_to_cpu(ev->handle);
4550 conn->state = BT_CONFIG;
4551
4552 conn->le_conn_interval = le16_to_cpu(ev->interval);
4553 conn->le_conn_latency = le16_to_cpu(ev->latency);
4554 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4555
4556 hci_debugfs_create_conn(conn);
4557 hci_conn_add_sysfs(conn);
4558
4559 if (!ev->status) {
4560 /* The remote features procedure is defined for master
4561 * role only. So only in case of an initiated connection
4562 * request the remote features.
4563 *
4564 * If the local controller supports slave-initiated features
4565 * exchange, then requesting the remote features in slave
4566 * role is possible. Otherwise just transition into the
4567 * connected state without requesting the remote features.
4568 */
4569 if (conn->out ||
4570 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4571 struct hci_cp_le_read_remote_features cp;
4572
4573 cp.handle = __cpu_to_le16(conn->handle);
4574
4575 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4576 sizeof(cp), &cp);
4577
4578 hci_conn_hold(conn);
4579 } else {
4580 conn->state = BT_CONNECTED;
4581 hci_connect_cfm(conn, ev->status);
4582 }
4583 } else {
4584 hci_connect_cfm(conn, ev->status);
4585 }
4586
4587 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4588 conn->dst_type);
4589 if (params) {
4590 list_del_init(&params->action);
4591 if (params->conn) {
4592 hci_conn_drop(params->conn);
4593 hci_conn_put(params->conn);
4594 params->conn = NULL;
4595 }
4596 }
4597
4598 unlock:
4599 hci_update_background_scan(hdev);
4600 hci_dev_unlock(hdev);
4601 }
4602
4603 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4604 struct sk_buff *skb)
4605 {
4606 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4607 struct hci_conn *conn;
4608
4609 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4610
4611 if (ev->status)
4612 return;
4613
4614 hci_dev_lock(hdev);
4615
4616 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4617 if (conn) {
4618 conn->le_conn_interval = le16_to_cpu(ev->interval);
4619 conn->le_conn_latency = le16_to_cpu(ev->latency);
4620 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4621 }
4622
4623 hci_dev_unlock(hdev);
4624 }
4625
4626 /* This function requires the caller holds hdev->lock */
4627 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4628 bdaddr_t *addr,
4629 u8 addr_type, u8 adv_type)
4630 {
4631 struct hci_conn *conn;
4632 struct hci_conn_params *params;
4633
4634 /* If the event is not connectable don't proceed further */
4635 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4636 return NULL;
4637
4638 /* Ignore if the device is blocked */
4639 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4640 return NULL;
4641
4642 /* Most controller will fail if we try to create new connections
4643 * while we have an existing one in slave role.
4644 */
4645 if (hdev->conn_hash.le_num_slave > 0)
4646 return NULL;
4647
4648 /* If we're not connectable only connect devices that we have in
4649 * our pend_le_conns list.
4650 */
4651 params = hci_explicit_connect_lookup(hdev, addr, addr_type);
4652
4653 if (!params)
4654 return NULL;
4655
4656 if (!params->explicit_connect) {
4657 switch (params->auto_connect) {
4658 case HCI_AUTO_CONN_DIRECT:
4659 /* Only devices advertising with ADV_DIRECT_IND are
4660 * triggering a connection attempt. This is allowing
4661 * incoming connections from slave devices.
4662 */
4663 if (adv_type != LE_ADV_DIRECT_IND)
4664 return NULL;
4665 break;
4666 case HCI_AUTO_CONN_ALWAYS:
4667 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4668 * are triggering a connection attempt. This means
4669 * that incoming connectioms from slave device are
4670 * accepted and also outgoing connections to slave
4671 * devices are established when found.
4672 */
4673 break;
4674 default:
4675 return NULL;
4676 }
4677 }
4678
4679 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4680 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4681 if (!IS_ERR(conn)) {
4682 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
4683 * by higher layer that tried to connect, if no then
4684 * store the pointer since we don't really have any
4685 * other owner of the object besides the params that
4686 * triggered it. This way we can abort the connection if
4687 * the parameters get removed and keep the reference
4688 * count consistent once the connection is established.
4689 */
4690
4691 if (!params->explicit_connect)
4692 params->conn = hci_conn_get(conn);
4693
4694 return conn;
4695 }
4696
4697 switch (PTR_ERR(conn)) {
4698 case -EBUSY:
4699 /* If hci_connect() returns -EBUSY it means there is already
4700 * an LE connection attempt going on. Since controllers don't
4701 * support more than one connection attempt at the time, we
4702 * don't consider this an error case.
4703 */
4704 break;
4705 default:
4706 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4707 return NULL;
4708 }
4709
4710 return NULL;
4711 }
4712
4713 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4714 u8 bdaddr_type, bdaddr_t *direct_addr,
4715 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4716 {
4717 struct discovery_state *d = &hdev->discovery;
4718 struct smp_irk *irk;
4719 struct hci_conn *conn;
4720 bool match;
4721 u32 flags;
4722
4723 /* If the direct address is present, then this report is from
4724 * a LE Direct Advertising Report event. In that case it is
4725 * important to see if the address is matching the local
4726 * controller address.
4727 */
4728 if (direct_addr) {
4729 /* Only resolvable random addresses are valid for these
4730 * kind of reports and others can be ignored.
4731 */
4732 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4733 return;
4734
4735 /* If the controller is not using resolvable random
4736 * addresses, then this report can be ignored.
4737 */
4738 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4739 return;
4740
4741 /* If the local IRK of the controller does not match
4742 * with the resolvable random address provided, then
4743 * this report can be ignored.
4744 */
4745 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4746 return;
4747 }
4748
4749 /* Check if we need to convert to identity address */
4750 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4751 if (irk) {
4752 bdaddr = &irk->bdaddr;
4753 bdaddr_type = irk->addr_type;
4754 }
4755
4756 /* Check if we have been requested to connect to this device */
4757 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4758 if (conn && type == LE_ADV_IND) {
4759 /* Store report for later inclusion by
4760 * mgmt_device_connected
4761 */
4762 memcpy(conn->le_adv_data, data, len);
4763 conn->le_adv_data_len = len;
4764 }
4765
4766 /* Passive scanning shouldn't trigger any device found events,
4767 * except for devices marked as CONN_REPORT for which we do send
4768 * device found events.
4769 */
4770 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4771 if (type == LE_ADV_DIRECT_IND)
4772 return;
4773
4774 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4775 bdaddr, bdaddr_type))
4776 return;
4777
4778 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4779 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4780 else
4781 flags = 0;
4782 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4783 rssi, flags, data, len, NULL, 0);
4784 return;
4785 }
4786
4787 /* When receiving non-connectable or scannable undirected
4788 * advertising reports, this means that the remote device is
4789 * not connectable and then clearly indicate this in the
4790 * device found event.
4791 *
4792 * When receiving a scan response, then there is no way to
4793 * know if the remote device is connectable or not. However
4794 * since scan responses are merged with a previously seen
4795 * advertising report, the flags field from that report
4796 * will be used.
4797 *
4798 * In the really unlikely case that a controller get confused
4799 * and just sends a scan response event, then it is marked as
4800 * not connectable as well.
4801 */
4802 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4803 type == LE_ADV_SCAN_RSP)
4804 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4805 else
4806 flags = 0;
4807
4808 /* If there's nothing pending either store the data from this
4809 * event or send an immediate device found event if the data
4810 * should not be stored for later.
4811 */
4812 if (!has_pending_adv_report(hdev)) {
4813 /* If the report will trigger a SCAN_REQ store it for
4814 * later merging.
4815 */
4816 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4817 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4818 rssi, flags, data, len);
4819 return;
4820 }
4821
4822 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4823 rssi, flags, data, len, NULL, 0);
4824 return;
4825 }
4826
4827 /* Check if the pending report is for the same device as the new one */
4828 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4829 bdaddr_type == d->last_adv_addr_type);
4830
4831 /* If the pending data doesn't match this report or this isn't a
4832 * scan response (e.g. we got a duplicate ADV_IND) then force
4833 * sending of the pending data.
4834 */
4835 if (type != LE_ADV_SCAN_RSP || !match) {
4836 /* Send out whatever is in the cache, but skip duplicates */
4837 if (!match)
4838 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4839 d->last_adv_addr_type, NULL,
4840 d->last_adv_rssi, d->last_adv_flags,
4841 d->last_adv_data,
4842 d->last_adv_data_len, NULL, 0);
4843
4844 /* If the new report will trigger a SCAN_REQ store it for
4845 * later merging.
4846 */
4847 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4848 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4849 rssi, flags, data, len);
4850 return;
4851 }
4852
4853 /* The advertising reports cannot be merged, so clear
4854 * the pending report and send out a device found event.
4855 */
4856 clear_pending_adv_report(hdev);
4857 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4858 rssi, flags, data, len, NULL, 0);
4859 return;
4860 }
4861
4862 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4863 * the new event is a SCAN_RSP. We can therefore proceed with
4864 * sending a merged device found event.
4865 */
4866 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4867 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4868 d->last_adv_data, d->last_adv_data_len, data, len);
4869 clear_pending_adv_report(hdev);
4870 }
4871
4872 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4873 {
4874 u8 num_reports = skb->data[0];
4875 void *ptr = &skb->data[1];
4876
4877 hci_dev_lock(hdev);
4878
4879 while (num_reports--) {
4880 struct hci_ev_le_advertising_info *ev = ptr;
4881 s8 rssi;
4882
4883 rssi = ev->data[ev->length];
4884 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4885 ev->bdaddr_type, NULL, 0, rssi,
4886 ev->data, ev->length);
4887
4888 ptr += sizeof(*ev) + ev->length + 1;
4889 }
4890
4891 hci_dev_unlock(hdev);
4892 }
4893
4894 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4895 struct sk_buff *skb)
4896 {
4897 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4898 struct hci_conn *conn;
4899
4900 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4901
4902 hci_dev_lock(hdev);
4903
4904 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4905 if (conn) {
4906 if (!ev->status)
4907 memcpy(conn->features[0], ev->features, 8);
4908
4909 if (conn->state == BT_CONFIG) {
4910 __u8 status;
4911
4912 /* If the local controller supports slave-initiated
4913 * features exchange, but the remote controller does
4914 * not, then it is possible that the error code 0x1a
4915 * for unsupported remote feature gets returned.
4916 *
4917 * In this specific case, allow the connection to
4918 * transition into connected state and mark it as
4919 * successful.
4920 */
4921 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
4922 !conn->out && ev->status == 0x1a)
4923 status = 0x00;
4924 else
4925 status = ev->status;
4926
4927 conn->state = BT_CONNECTED;
4928 hci_connect_cfm(conn, status);
4929 hci_conn_drop(conn);
4930 }
4931 }
4932
4933 hci_dev_unlock(hdev);
4934 }
4935
4936 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4937 {
4938 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4939 struct hci_cp_le_ltk_reply cp;
4940 struct hci_cp_le_ltk_neg_reply neg;
4941 struct hci_conn *conn;
4942 struct smp_ltk *ltk;
4943
4944 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4945
4946 hci_dev_lock(hdev);
4947
4948 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4949 if (conn == NULL)
4950 goto not_found;
4951
4952 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4953 if (!ltk)
4954 goto not_found;
4955
4956 if (smp_ltk_is_sc(ltk)) {
4957 /* With SC both EDiv and Rand are set to zero */
4958 if (ev->ediv || ev->rand)
4959 goto not_found;
4960 } else {
4961 /* For non-SC keys check that EDiv and Rand match */
4962 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4963 goto not_found;
4964 }
4965
4966 memcpy(cp.ltk, ltk->val, ltk->enc_size);
4967 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
4968 cp.handle = cpu_to_le16(conn->handle);
4969
4970 conn->pending_sec_level = smp_ltk_sec_level(ltk);
4971
4972 conn->enc_key_size = ltk->enc_size;
4973
4974 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4975
4976 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4977 * temporary key used to encrypt a connection following
4978 * pairing. It is used during the Encrypted Session Setup to
4979 * distribute the keys. Later, security can be re-established
4980 * using a distributed LTK.
4981 */
4982 if (ltk->type == SMP_STK) {
4983 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4984 list_del_rcu(&ltk->list);
4985 kfree_rcu(ltk, rcu);
4986 } else {
4987 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4988 }
4989
4990 hci_dev_unlock(hdev);
4991
4992 return;
4993
4994 not_found:
4995 neg.handle = ev->handle;
4996 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4997 hci_dev_unlock(hdev);
4998 }
4999
5000 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5001 u8 reason)
5002 {
5003 struct hci_cp_le_conn_param_req_neg_reply cp;
5004
5005 cp.handle = cpu_to_le16(handle);
5006 cp.reason = reason;
5007
5008 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5009 &cp);
5010 }
5011
5012 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5013 struct sk_buff *skb)
5014 {
5015 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5016 struct hci_cp_le_conn_param_req_reply cp;
5017 struct hci_conn *hcon;
5018 u16 handle, min, max, latency, timeout;
5019
5020 handle = le16_to_cpu(ev->handle);
5021 min = le16_to_cpu(ev->interval_min);
5022 max = le16_to_cpu(ev->interval_max);
5023 latency = le16_to_cpu(ev->latency);
5024 timeout = le16_to_cpu(ev->timeout);
5025
5026 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5027 if (!hcon || hcon->state != BT_CONNECTED)
5028 return send_conn_param_neg_reply(hdev, handle,
5029 HCI_ERROR_UNKNOWN_CONN_ID);
5030
5031 if (hci_check_conn_params(min, max, latency, timeout))
5032 return send_conn_param_neg_reply(hdev, handle,
5033 HCI_ERROR_INVALID_LL_PARAMS);
5034
5035 if (hcon->role == HCI_ROLE_MASTER) {
5036 struct hci_conn_params *params;
5037 u8 store_hint;
5038
5039 hci_dev_lock(hdev);
5040
5041 params = hci_conn_params_lookup(hdev, &hcon->dst,
5042 hcon->dst_type);
5043 if (params) {
5044 params->conn_min_interval = min;
5045 params->conn_max_interval = max;
5046 params->conn_latency = latency;
5047 params->supervision_timeout = timeout;
5048 store_hint = 0x01;
5049 } else{
5050 store_hint = 0x00;
5051 }
5052
5053 hci_dev_unlock(hdev);
5054
5055 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5056 store_hint, min, max, latency, timeout);
5057 }
5058
5059 cp.handle = ev->handle;
5060 cp.interval_min = ev->interval_min;
5061 cp.interval_max = ev->interval_max;
5062 cp.latency = ev->latency;
5063 cp.timeout = ev->timeout;
5064 cp.min_ce_len = 0;
5065 cp.max_ce_len = 0;
5066
5067 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5068 }
5069
5070 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5071 struct sk_buff *skb)
5072 {
5073 u8 num_reports = skb->data[0];
5074 void *ptr = &skb->data[1];
5075
5076 hci_dev_lock(hdev);
5077
5078 while (num_reports--) {
5079 struct hci_ev_le_direct_adv_info *ev = ptr;
5080
5081 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5082 ev->bdaddr_type, &ev->direct_addr,
5083 ev->direct_addr_type, ev->rssi, NULL, 0);
5084
5085 ptr += sizeof(*ev);
5086 }
5087
5088 hci_dev_unlock(hdev);
5089 }
5090
5091 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5092 {
5093 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5094
5095 skb_pull(skb, sizeof(*le_ev));
5096
5097 switch (le_ev->subevent) {
5098 case HCI_EV_LE_CONN_COMPLETE:
5099 hci_le_conn_complete_evt(hdev, skb);
5100 break;
5101
5102 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5103 hci_le_conn_update_complete_evt(hdev, skb);
5104 break;
5105
5106 case HCI_EV_LE_ADVERTISING_REPORT:
5107 hci_le_adv_report_evt(hdev, skb);
5108 break;
5109
5110 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5111 hci_le_remote_feat_complete_evt(hdev, skb);
5112 break;
5113
5114 case HCI_EV_LE_LTK_REQ:
5115 hci_le_ltk_request_evt(hdev, skb);
5116 break;
5117
5118 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5119 hci_le_remote_conn_param_req_evt(hdev, skb);
5120 break;
5121
5122 case HCI_EV_LE_DIRECT_ADV_REPORT:
5123 hci_le_direct_adv_report_evt(hdev, skb);
5124 break;
5125
5126 default:
5127 break;
5128 }
5129 }
5130
5131 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5132 u8 event, struct sk_buff *skb)
5133 {
5134 struct hci_ev_cmd_complete *ev;
5135 struct hci_event_hdr *hdr;
5136
5137 if (!skb)
5138 return false;
5139
5140 if (skb->len < sizeof(*hdr)) {
5141 BT_ERR("Too short HCI event");
5142 return false;
5143 }
5144
5145 hdr = (void *) skb->data;
5146 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5147
5148 if (event) {
5149 if (hdr->evt != event)
5150 return false;
5151 return true;
5152 }
5153
5154 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5155 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5156 return false;
5157 }
5158
5159 if (skb->len < sizeof(*ev)) {
5160 BT_ERR("Too short cmd_complete event");
5161 return false;
5162 }
5163
5164 ev = (void *) skb->data;
5165 skb_pull(skb, sizeof(*ev));
5166
5167 if (opcode != __le16_to_cpu(ev->opcode)) {
5168 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5169 __le16_to_cpu(ev->opcode));
5170 return false;
5171 }
5172
5173 return true;
5174 }
5175
5176 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5177 {
5178 struct hci_event_hdr *hdr = (void *) skb->data;
5179 hci_req_complete_t req_complete = NULL;
5180 hci_req_complete_skb_t req_complete_skb = NULL;
5181 struct sk_buff *orig_skb = NULL;
5182 u8 status = 0, event = hdr->evt, req_evt = 0;
5183 u16 opcode = HCI_OP_NOP;
5184
5185 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5186 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5187 opcode = __le16_to_cpu(cmd_hdr->opcode);
5188 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5189 &req_complete_skb);
5190 req_evt = event;
5191 }
5192
5193 /* If it looks like we might end up having to call
5194 * req_complete_skb, store a pristine copy of the skb since the
5195 * various handlers may modify the original one through
5196 * skb_pull() calls, etc.
5197 */
5198 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5199 event == HCI_EV_CMD_COMPLETE)
5200 orig_skb = skb_clone(skb, GFP_KERNEL);
5201
5202 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5203
5204 switch (event) {
5205 case HCI_EV_INQUIRY_COMPLETE:
5206 hci_inquiry_complete_evt(hdev, skb);
5207 break;
5208
5209 case HCI_EV_INQUIRY_RESULT:
5210 hci_inquiry_result_evt(hdev, skb);
5211 break;
5212
5213 case HCI_EV_CONN_COMPLETE:
5214 hci_conn_complete_evt(hdev, skb);
5215 break;
5216
5217 case HCI_EV_CONN_REQUEST:
5218 hci_conn_request_evt(hdev, skb);
5219 break;
5220
5221 case HCI_EV_DISCONN_COMPLETE:
5222 hci_disconn_complete_evt(hdev, skb);
5223 break;
5224
5225 case HCI_EV_AUTH_COMPLETE:
5226 hci_auth_complete_evt(hdev, skb);
5227 break;
5228
5229 case HCI_EV_REMOTE_NAME:
5230 hci_remote_name_evt(hdev, skb);
5231 break;
5232
5233 case HCI_EV_ENCRYPT_CHANGE:
5234 hci_encrypt_change_evt(hdev, skb);
5235 break;
5236
5237 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5238 hci_change_link_key_complete_evt(hdev, skb);
5239 break;
5240
5241 case HCI_EV_REMOTE_FEATURES:
5242 hci_remote_features_evt(hdev, skb);
5243 break;
5244
5245 case HCI_EV_CMD_COMPLETE:
5246 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5247 &req_complete, &req_complete_skb);
5248 break;
5249
5250 case HCI_EV_CMD_STATUS:
5251 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5252 &req_complete_skb);
5253 break;
5254
5255 case HCI_EV_HARDWARE_ERROR:
5256 hci_hardware_error_evt(hdev, skb);
5257 break;
5258
5259 case HCI_EV_ROLE_CHANGE:
5260 hci_role_change_evt(hdev, skb);
5261 break;
5262
5263 case HCI_EV_NUM_COMP_PKTS:
5264 hci_num_comp_pkts_evt(hdev, skb);
5265 break;
5266
5267 case HCI_EV_MODE_CHANGE:
5268 hci_mode_change_evt(hdev, skb);
5269 break;
5270
5271 case HCI_EV_PIN_CODE_REQ:
5272 hci_pin_code_request_evt(hdev, skb);
5273 break;
5274
5275 case HCI_EV_LINK_KEY_REQ:
5276 hci_link_key_request_evt(hdev, skb);
5277 break;
5278
5279 case HCI_EV_LINK_KEY_NOTIFY:
5280 hci_link_key_notify_evt(hdev, skb);
5281 break;
5282
5283 case HCI_EV_CLOCK_OFFSET:
5284 hci_clock_offset_evt(hdev, skb);
5285 break;
5286
5287 case HCI_EV_PKT_TYPE_CHANGE:
5288 hci_pkt_type_change_evt(hdev, skb);
5289 break;
5290
5291 case HCI_EV_PSCAN_REP_MODE:
5292 hci_pscan_rep_mode_evt(hdev, skb);
5293 break;
5294
5295 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5296 hci_inquiry_result_with_rssi_evt(hdev, skb);
5297 break;
5298
5299 case HCI_EV_REMOTE_EXT_FEATURES:
5300 hci_remote_ext_features_evt(hdev, skb);
5301 break;
5302
5303 case HCI_EV_SYNC_CONN_COMPLETE:
5304 hci_sync_conn_complete_evt(hdev, skb);
5305 break;
5306
5307 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5308 hci_extended_inquiry_result_evt(hdev, skb);
5309 break;
5310
5311 case HCI_EV_KEY_REFRESH_COMPLETE:
5312 hci_key_refresh_complete_evt(hdev, skb);
5313 break;
5314
5315 case HCI_EV_IO_CAPA_REQUEST:
5316 hci_io_capa_request_evt(hdev, skb);
5317 break;
5318
5319 case HCI_EV_IO_CAPA_REPLY:
5320 hci_io_capa_reply_evt(hdev, skb);
5321 break;
5322
5323 case HCI_EV_USER_CONFIRM_REQUEST:
5324 hci_user_confirm_request_evt(hdev, skb);
5325 break;
5326
5327 case HCI_EV_USER_PASSKEY_REQUEST:
5328 hci_user_passkey_request_evt(hdev, skb);
5329 break;
5330
5331 case HCI_EV_USER_PASSKEY_NOTIFY:
5332 hci_user_passkey_notify_evt(hdev, skb);
5333 break;
5334
5335 case HCI_EV_KEYPRESS_NOTIFY:
5336 hci_keypress_notify_evt(hdev, skb);
5337 break;
5338
5339 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5340 hci_simple_pair_complete_evt(hdev, skb);
5341 break;
5342
5343 case HCI_EV_REMOTE_HOST_FEATURES:
5344 hci_remote_host_features_evt(hdev, skb);
5345 break;
5346
5347 case HCI_EV_LE_META:
5348 hci_le_meta_evt(hdev, skb);
5349 break;
5350
5351 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5352 hci_remote_oob_data_request_evt(hdev, skb);
5353 break;
5354
5355 #if IS_ENABLED(CONFIG_BT_HS)
5356 case HCI_EV_CHANNEL_SELECTED:
5357 hci_chan_selected_evt(hdev, skb);
5358 break;
5359
5360 case HCI_EV_PHY_LINK_COMPLETE:
5361 hci_phy_link_complete_evt(hdev, skb);
5362 break;
5363
5364 case HCI_EV_LOGICAL_LINK_COMPLETE:
5365 hci_loglink_complete_evt(hdev, skb);
5366 break;
5367
5368 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5369 hci_disconn_loglink_complete_evt(hdev, skb);
5370 break;
5371
5372 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5373 hci_disconn_phylink_complete_evt(hdev, skb);
5374 break;
5375 #endif
5376
5377 case HCI_EV_NUM_COMP_BLOCKS:
5378 hci_num_comp_blocks_evt(hdev, skb);
5379 break;
5380
5381 default:
5382 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5383 break;
5384 }
5385
5386 if (req_complete) {
5387 req_complete(hdev, status, opcode);
5388 } else if (req_complete_skb) {
5389 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5390 kfree_skb(orig_skb);
5391 orig_skb = NULL;
5392 }
5393 req_complete_skb(hdev, status, opcode, orig_skb);
5394 }
5395
5396 kfree_skb(orig_skb);
5397 kfree_skb(skb);
5398 hdev->stat.evt_rx++;
5399 }
ubuntu-bionic-kernel mirror