?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
kvm tools, setup: Create private directory
[linux-2.6/next.git] / net / bluetooth / hci_event.c
blob77930aa522e3456231d6482f0683d60598771937
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI event handling. */
26
27 #include <linux/module.h>
28
29 #include <linux/types.h>
30 #include <linux/errno.h>
31 #include <linux/kernel.h>
32 #include <linux/slab.h>
33 #include <linux/poll.h>
34 #include <linux/fcntl.h>
35 #include <linux/init.h>
36 #include <linux/skbuff.h>
37 #include <linux/interrupt.h>
38 #include <linux/notifier.h>
39 #include <net/sock.h>
40
41 #include <asm/system.h>
42 #include <linux/uaccess.h>
43 #include <asm/unaligned.h>
44
45 #include <net/bluetooth/bluetooth.h>
46 #include <net/bluetooth/hci_core.h>
47
48 /* Handle HCI Event packets */
49
50 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
51 {
52 __u8 status = *((__u8 *) skb->data);
53
54 BT_DBG("%s status 0x%x", hdev->name, status);
55
56 if (status)
57 return;
58
59 if (test_bit(HCI_MGMT, &hdev->flags) &&
60 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
61 mgmt_discovering(hdev->id, 0);
62
63 hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
64
65 hci_conn_check_pending(hdev);
66 }
67
68 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
69 {
70 __u8 status = *((__u8 *) skb->data);
71
72 BT_DBG("%s status 0x%x", hdev->name, status);
73
74 if (status)
75 return;
76
77 if (test_bit(HCI_MGMT, &hdev->flags) &&
78 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
79 mgmt_discovering(hdev->id, 0);
80
81 hci_conn_check_pending(hdev);
82 }
83
84 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
85 {
86 BT_DBG("%s", hdev->name);
87 }
88
89 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
90 {
91 struct hci_rp_role_discovery *rp = (void *) skb->data;
92 struct hci_conn *conn;
93
94 BT_DBG("%s status 0x%x", hdev->name, rp->status);
95
96 if (rp->status)
97 return;
98
99 hci_dev_lock(hdev);
100
101 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
102 if (conn) {
103 if (rp->role)
104 conn->link_mode &= ~HCI_LM_MASTER;
105 else
106 conn->link_mode |= HCI_LM_MASTER;
107 }
108
109 hci_dev_unlock(hdev);
110 }
111
112 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
113 {
114 struct hci_rp_read_link_policy *rp = (void *) skb->data;
115 struct hci_conn *conn;
116
117 BT_DBG("%s status 0x%x", hdev->name, rp->status);
118
119 if (rp->status)
120 return;
121
122 hci_dev_lock(hdev);
123
124 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
125 if (conn)
126 conn->link_policy = __le16_to_cpu(rp->policy);
127
128 hci_dev_unlock(hdev);
129 }
130
131 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
132 {
133 struct hci_rp_write_link_policy *rp = (void *) skb->data;
134 struct hci_conn *conn;
135 void *sent;
136
137 BT_DBG("%s status 0x%x", hdev->name, rp->status);
138
139 if (rp->status)
140 return;
141
142 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
143 if (!sent)
144 return;
145
146 hci_dev_lock(hdev);
147
148 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
149 if (conn)
150 conn->link_policy = get_unaligned_le16(sent + 2);
151
152 hci_dev_unlock(hdev);
153 }
154
155 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
156 {
157 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
158
159 BT_DBG("%s status 0x%x", hdev->name, rp->status);
160
161 if (rp->status)
162 return;
163
164 hdev->link_policy = __le16_to_cpu(rp->policy);
165 }
166
167 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
168 {
169 __u8 status = *((__u8 *) skb->data);
170 void *sent;
171
172 BT_DBG("%s status 0x%x", hdev->name, status);
173
174 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
175 if (!sent)
176 return;
177
178 if (!status)
179 hdev->link_policy = get_unaligned_le16(sent);
180
181 hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
182 }
183
184 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
185 {
186 __u8 status = *((__u8 *) skb->data);
187
188 BT_DBG("%s status 0x%x", hdev->name, status);
189
190 clear_bit(HCI_RESET, &hdev->flags);
191
192 hci_req_complete(hdev, HCI_OP_RESET, status);
193 }
194
195 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
196 {
197 __u8 status = *((__u8 *) skb->data);
198 void *sent;
199
200 BT_DBG("%s status 0x%x", hdev->name, status);
201
202 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
203 if (!sent)
204 return;
205
206 if (test_bit(HCI_MGMT, &hdev->flags))
207 mgmt_set_local_name_complete(hdev->id, sent, status);
208
209 if (status)
210 return;
211
212 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
213 }
214
215 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
216 {
217 struct hci_rp_read_local_name *rp = (void *) skb->data;
218
219 BT_DBG("%s status 0x%x", hdev->name, rp->status);
220
221 if (rp->status)
222 return;
223
224 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
225 }
226
227 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
228 {
229 __u8 status = *((__u8 *) skb->data);
230 void *sent;
231
232 BT_DBG("%s status 0x%x", hdev->name, status);
233
234 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
235 if (!sent)
236 return;
237
238 if (!status) {
239 __u8 param = *((__u8 *) sent);
240
241 if (param == AUTH_ENABLED)
242 set_bit(HCI_AUTH, &hdev->flags);
243 else
244 clear_bit(HCI_AUTH, &hdev->flags);
245 }
246
247 hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
248 }
249
250 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
251 {
252 __u8 status = *((__u8 *) skb->data);
253 void *sent;
254
255 BT_DBG("%s status 0x%x", hdev->name, status);
256
257 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
258 if (!sent)
259 return;
260
261 if (!status) {
262 __u8 param = *((__u8 *) sent);
263
264 if (param)
265 set_bit(HCI_ENCRYPT, &hdev->flags);
266 else
267 clear_bit(HCI_ENCRYPT, &hdev->flags);
268 }
269
270 hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
271 }
272
273 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
274 {
275 __u8 status = *((__u8 *) skb->data);
276 void *sent;
277
278 BT_DBG("%s status 0x%x", hdev->name, status);
279
280 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
281 if (!sent)
282 return;
283
284 if (!status) {
285 __u8 param = *((__u8 *) sent);
286 int old_pscan, old_iscan;
287
288 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
289 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
290
291 if (param & SCAN_INQUIRY) {
292 set_bit(HCI_ISCAN, &hdev->flags);
293 if (!old_iscan)
294 mgmt_discoverable(hdev->id, 1);
295 } else if (old_iscan)
296 mgmt_discoverable(hdev->id, 0);
297
298 if (param & SCAN_PAGE) {
299 set_bit(HCI_PSCAN, &hdev->flags);
300 if (!old_pscan)
301 mgmt_connectable(hdev->id, 1);
302 } else if (old_pscan)
303 mgmt_connectable(hdev->id, 0);
304 }
305
306 hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
307 }
308
309 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
310 {
311 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
312
313 BT_DBG("%s status 0x%x", hdev->name, rp->status);
314
315 if (rp->status)
316 return;
317
318 memcpy(hdev->dev_class, rp->dev_class, 3);
319
320 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
321 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
322 }
323
324 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
325 {
326 __u8 status = *((__u8 *) skb->data);
327 void *sent;
328
329 BT_DBG("%s status 0x%x", hdev->name, status);
330
331 if (status)
332 return;
333
334 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
335 if (!sent)
336 return;
337
338 memcpy(hdev->dev_class, sent, 3);
339 }
340
341 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
342 {
343 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
344 __u16 setting;
345
346 BT_DBG("%s status 0x%x", hdev->name, rp->status);
347
348 if (rp->status)
349 return;
350
351 setting = __le16_to_cpu(rp->voice_setting);
352
353 if (hdev->voice_setting == setting)
354 return;
355
356 hdev->voice_setting = setting;
357
358 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
359
360 if (hdev->notify) {
361 tasklet_disable(&hdev->tx_task);
362 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
363 tasklet_enable(&hdev->tx_task);
364 }
365 }
366
367 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
368 {
369 __u8 status = *((__u8 *) skb->data);
370 __u16 setting;
371 void *sent;
372
373 BT_DBG("%s status 0x%x", hdev->name, status);
374
375 if (status)
376 return;
377
378 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
379 if (!sent)
380 return;
381
382 setting = get_unaligned_le16(sent);
383
384 if (hdev->voice_setting == setting)
385 return;
386
387 hdev->voice_setting = setting;
388
389 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
390
391 if (hdev->notify) {
392 tasklet_disable(&hdev->tx_task);
393 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
394 tasklet_enable(&hdev->tx_task);
395 }
396 }
397
398 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
399 {
400 __u8 status = *((__u8 *) skb->data);
401
402 BT_DBG("%s status 0x%x", hdev->name, status);
403
404 hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
405 }
406
407 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
408 {
409 struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
410
411 BT_DBG("%s status 0x%x", hdev->name, rp->status);
412
413 if (rp->status)
414 return;
415
416 hdev->ssp_mode = rp->mode;
417 }
418
419 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
420 {
421 __u8 status = *((__u8 *) skb->data);
422 void *sent;
423
424 BT_DBG("%s status 0x%x", hdev->name, status);
425
426 if (status)
427 return;
428
429 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
430 if (!sent)
431 return;
432
433 hdev->ssp_mode = *((__u8 *) sent);
434 }
435
436 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
437 {
438 if (hdev->features[6] & LMP_EXT_INQ)
439 return 2;
440
441 if (hdev->features[3] & LMP_RSSI_INQ)
442 return 1;
443
444 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
445 hdev->lmp_subver == 0x0757)
446 return 1;
447
448 if (hdev->manufacturer == 15) {
449 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
450 return 1;
451 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
452 return 1;
453 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
454 return 1;
455 }
456
457 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
458 hdev->lmp_subver == 0x1805)
459 return 1;
460
461 return 0;
462 }
463
464 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
465 {
466 u8 mode;
467
468 mode = hci_get_inquiry_mode(hdev);
469
470 hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
471 }
472
473 static void hci_setup_event_mask(struct hci_dev *hdev)
474 {
475 /* The second byte is 0xff instead of 0x9f (two reserved bits
476 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
477 * command otherwise */
478 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
479
480 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
481 * any event mask for pre 1.2 devices */
482 if (hdev->lmp_ver <= 1)
483 return;
484
485 events[4] |= 0x01; /* Flow Specification Complete */
486 events[4] |= 0x02; /* Inquiry Result with RSSI */
487 events[4] |= 0x04; /* Read Remote Extended Features Complete */
488 events[5] |= 0x08; /* Synchronous Connection Complete */
489 events[5] |= 0x10; /* Synchronous Connection Changed */
490
491 if (hdev->features[3] & LMP_RSSI_INQ)
492 events[4] |= 0x04; /* Inquiry Result with RSSI */
493
494 if (hdev->features[5] & LMP_SNIFF_SUBR)
495 events[5] |= 0x20; /* Sniff Subrating */
496
497 if (hdev->features[5] & LMP_PAUSE_ENC)
498 events[5] |= 0x80; /* Encryption Key Refresh Complete */
499
500 if (hdev->features[6] & LMP_EXT_INQ)
501 events[5] |= 0x40; /* Extended Inquiry Result */
502
503 if (hdev->features[6] & LMP_NO_FLUSH)
504 events[7] |= 0x01; /* Enhanced Flush Complete */
505
506 if (hdev->features[7] & LMP_LSTO)
507 events[6] |= 0x80; /* Link Supervision Timeout Changed */
508
509 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
510 events[6] |= 0x01; /* IO Capability Request */
511 events[6] |= 0x02; /* IO Capability Response */
512 events[6] |= 0x04; /* User Confirmation Request */
513 events[6] |= 0x08; /* User Passkey Request */
514 events[6] |= 0x10; /* Remote OOB Data Request */
515 events[6] |= 0x20; /* Simple Pairing Complete */
516 events[7] |= 0x04; /* User Passkey Notification */
517 events[7] |= 0x08; /* Keypress Notification */
518 events[7] |= 0x10; /* Remote Host Supported
519 * Features Notification */
520 }
521
522 if (hdev->features[4] & LMP_LE)
523 events[7] |= 0x20; /* LE Meta-Event */
524
525 hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
526 }
527
528 static void hci_setup(struct hci_dev *hdev)
529 {
530 hci_setup_event_mask(hdev);
531
532 if (hdev->lmp_ver > 1)
533 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
534
535 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
536 u8 mode = 0x01;
537 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
538 }
539
540 if (hdev->features[3] & LMP_RSSI_INQ)
541 hci_setup_inquiry_mode(hdev);
542
543 if (hdev->features[7] & LMP_INQ_TX_PWR)
544 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
545 }
546
547 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
548 {
549 struct hci_rp_read_local_version *rp = (void *) skb->data;
550
551 BT_DBG("%s status 0x%x", hdev->name, rp->status);
552
553 if (rp->status)
554 return;
555
556 hdev->hci_ver = rp->hci_ver;
557 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
558 hdev->lmp_ver = rp->lmp_ver;
559 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
560 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
561
562 BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
563 hdev->manufacturer,
564 hdev->hci_ver, hdev->hci_rev);
565
566 if (test_bit(HCI_INIT, &hdev->flags))
567 hci_setup(hdev);
568 }
569
570 static void hci_setup_link_policy(struct hci_dev *hdev)
571 {
572 u16 link_policy = 0;
573
574 if (hdev->features[0] & LMP_RSWITCH)
575 link_policy |= HCI_LP_RSWITCH;
576 if (hdev->features[0] & LMP_HOLD)
577 link_policy |= HCI_LP_HOLD;
578 if (hdev->features[0] & LMP_SNIFF)
579 link_policy |= HCI_LP_SNIFF;
580 if (hdev->features[1] & LMP_PARK)
581 link_policy |= HCI_LP_PARK;
582
583 link_policy = cpu_to_le16(link_policy);
584 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
585 sizeof(link_policy), &link_policy);
586 }
587
588 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
589 {
590 struct hci_rp_read_local_commands *rp = (void *) skb->data;
591
592 BT_DBG("%s status 0x%x", hdev->name, rp->status);
593
594 if (rp->status)
595 goto done;
596
597 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
598
599 if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
600 hci_setup_link_policy(hdev);
601
602 done:
603 hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
604 }
605
606 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
607 {
608 struct hci_rp_read_local_features *rp = (void *) skb->data;
609
610 BT_DBG("%s status 0x%x", hdev->name, rp->status);
611
612 if (rp->status)
613 return;
614
615 memcpy(hdev->features, rp->features, 8);
616
617 /* Adjust default settings according to features
618 * supported by device. */
619
620 if (hdev->features[0] & LMP_3SLOT)
621 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
622
623 if (hdev->features[0] & LMP_5SLOT)
624 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
625
626 if (hdev->features[1] & LMP_HV2) {
627 hdev->pkt_type |= (HCI_HV2);
628 hdev->esco_type |= (ESCO_HV2);
629 }
630
631 if (hdev->features[1] & LMP_HV3) {
632 hdev->pkt_type |= (HCI_HV3);
633 hdev->esco_type |= (ESCO_HV3);
634 }
635
636 if (hdev->features[3] & LMP_ESCO)
637 hdev->esco_type |= (ESCO_EV3);
638
639 if (hdev->features[4] & LMP_EV4)
640 hdev->esco_type |= (ESCO_EV4);
641
642 if (hdev->features[4] & LMP_EV5)
643 hdev->esco_type |= (ESCO_EV5);
644
645 if (hdev->features[5] & LMP_EDR_ESCO_2M)
646 hdev->esco_type |= (ESCO_2EV3);
647
648 if (hdev->features[5] & LMP_EDR_ESCO_3M)
649 hdev->esco_type |= (ESCO_3EV3);
650
651 if (hdev->features[5] & LMP_EDR_3S_ESCO)
652 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
653
654 BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
655 hdev->features[0], hdev->features[1],
656 hdev->features[2], hdev->features[3],
657 hdev->features[4], hdev->features[5],
658 hdev->features[6], hdev->features[7]);
659 }
660
661 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
662 {
663 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
664
665 BT_DBG("%s status 0x%x", hdev->name, rp->status);
666
667 if (rp->status)
668 return;
669
670 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
671 hdev->sco_mtu = rp->sco_mtu;
672 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
673 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
674
675 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
676 hdev->sco_mtu = 64;
677 hdev->sco_pkts = 8;
678 }
679
680 hdev->acl_cnt = hdev->acl_pkts;
681 hdev->sco_cnt = hdev->sco_pkts;
682
683 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
684 hdev->acl_mtu, hdev->acl_pkts,
685 hdev->sco_mtu, hdev->sco_pkts);
686 }
687
688 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
689 {
690 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
691
692 BT_DBG("%s status 0x%x", hdev->name, rp->status);
693
694 if (!rp->status)
695 bacpy(&hdev->bdaddr, &rp->bdaddr);
696
697 hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
698 }
699
700 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
701 {
702 __u8 status = *((__u8 *) skb->data);
703
704 BT_DBG("%s status 0x%x", hdev->name, status);
705
706 hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
707 }
708
709 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
710 struct sk_buff *skb)
711 {
712 __u8 status = *((__u8 *) skb->data);
713
714 BT_DBG("%s status 0x%x", hdev->name, status);
715
716 hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
717 }
718
719 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
720 {
721 __u8 status = *((__u8 *) skb->data);
722
723 BT_DBG("%s status 0x%x", hdev->name, status);
724
725 hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
726 }
727
728 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
729 struct sk_buff *skb)
730 {
731 __u8 status = *((__u8 *) skb->data);
732
733 BT_DBG("%s status 0x%x", hdev->name, status);
734
735 hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
736 }
737
738 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
739 struct sk_buff *skb)
740 {
741 __u8 status = *((__u8 *) skb->data);
742
743 BT_DBG("%s status 0x%x", hdev->name, status);
744
745 hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
746 }
747
748 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
749 {
750 __u8 status = *((__u8 *) skb->data);
751
752 BT_DBG("%s status 0x%x", hdev->name, status);
753
754 hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
755 }
756
757 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
758 {
759 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
760 struct hci_cp_pin_code_reply *cp;
761 struct hci_conn *conn;
762
763 BT_DBG("%s status 0x%x", hdev->name, rp->status);
764
765 if (test_bit(HCI_MGMT, &hdev->flags))
766 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
767
768 if (rp->status != 0)
769 return;
770
771 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
772 if (!cp)
773 return;
774
775 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
776 if (conn)
777 conn->pin_length = cp->pin_len;
778 }
779
780 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
781 {
782 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
783
784 BT_DBG("%s status 0x%x", hdev->name, rp->status);
785
786 if (test_bit(HCI_MGMT, &hdev->flags))
787 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
788 rp->status);
789 }
790 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
791 struct sk_buff *skb)
792 {
793 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
794
795 BT_DBG("%s status 0x%x", hdev->name, rp->status);
796
797 if (rp->status)
798 return;
799
800 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
801 hdev->le_pkts = rp->le_max_pkt;
802
803 hdev->le_cnt = hdev->le_pkts;
804
805 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
806
807 hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
808 }
809
810 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
811 {
812 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
813
814 BT_DBG("%s status 0x%x", hdev->name, rp->status);
815
816 if (test_bit(HCI_MGMT, &hdev->flags))
817 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
818 rp->status);
819 }
820
821 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
822 struct sk_buff *skb)
823 {
824 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
825
826 BT_DBG("%s status 0x%x", hdev->name, rp->status);
827
828 if (test_bit(HCI_MGMT, &hdev->flags))
829 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
830 rp->status);
831 }
832
833 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
834 struct sk_buff *skb)
835 {
836 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
837
838 BT_DBG("%s status 0x%x", hdev->name, rp->status);
839
840 mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
841 rp->randomizer, rp->status);
842 }
843
844 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
845 {
846 BT_DBG("%s status 0x%x", hdev->name, status);
847
848 if (status) {
849 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
850 hci_conn_check_pending(hdev);
851 return;
852 }
853
854 if (test_bit(HCI_MGMT, &hdev->flags) &&
855 !test_and_set_bit(HCI_INQUIRY,
856 &hdev->flags))
857 mgmt_discovering(hdev->id, 1);
858 }
859
860 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
861 {
862 struct hci_cp_create_conn *cp;
863 struct hci_conn *conn;
864
865 BT_DBG("%s status 0x%x", hdev->name, status);
866
867 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
868 if (!cp)
869 return;
870
871 hci_dev_lock(hdev);
872
873 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
874
875 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
876
877 if (status) {
878 if (conn && conn->state == BT_CONNECT) {
879 if (status != 0x0c || conn->attempt > 2) {
880 conn->state = BT_CLOSED;
881 hci_proto_connect_cfm(conn, status);
882 hci_conn_del(conn);
883 } else
884 conn->state = BT_CONNECT2;
885 }
886 } else {
887 if (!conn) {
888 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
889 if (conn) {
890 conn->out = 1;
891 conn->link_mode |= HCI_LM_MASTER;
892 } else
893 BT_ERR("No memory for new connection");
894 }
895 }
896
897 hci_dev_unlock(hdev);
898 }
899
900 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
901 {
902 struct hci_cp_add_sco *cp;
903 struct hci_conn *acl, *sco;
904 __u16 handle;
905
906 BT_DBG("%s status 0x%x", hdev->name, status);
907
908 if (!status)
909 return;
910
911 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
912 if (!cp)
913 return;
914
915 handle = __le16_to_cpu(cp->handle);
916
917 BT_DBG("%s handle %d", hdev->name, handle);
918
919 hci_dev_lock(hdev);
920
921 acl = hci_conn_hash_lookup_handle(hdev, handle);
922 if (acl) {
923 sco = acl->link;
924 if (sco) {
925 sco->state = BT_CLOSED;
926
927 hci_proto_connect_cfm(sco, status);
928 hci_conn_del(sco);
929 }
930 }
931
932 hci_dev_unlock(hdev);
933 }
934
935 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
936 {
937 struct hci_cp_auth_requested *cp;
938 struct hci_conn *conn;
939
940 BT_DBG("%s status 0x%x", hdev->name, status);
941
942 if (!status)
943 return;
944
945 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
946 if (!cp)
947 return;
948
949 hci_dev_lock(hdev);
950
951 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
952 if (conn) {
953 if (conn->state == BT_CONFIG) {
954 hci_proto_connect_cfm(conn, status);
955 hci_conn_put(conn);
956 }
957 }
958
959 hci_dev_unlock(hdev);
960 }
961
962 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
963 {
964 struct hci_cp_set_conn_encrypt *cp;
965 struct hci_conn *conn;
966
967 BT_DBG("%s status 0x%x", hdev->name, status);
968
969 if (!status)
970 return;
971
972 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
973 if (!cp)
974 return;
975
976 hci_dev_lock(hdev);
977
978 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
979 if (conn) {
980 if (conn->state == BT_CONFIG) {
981 hci_proto_connect_cfm(conn, status);
982 hci_conn_put(conn);
983 }
984 }
985
986 hci_dev_unlock(hdev);
987 }
988
989 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
990 struct hci_conn *conn)
991 {
992 if (conn->state != BT_CONFIG || !conn->out)
993 return 0;
994
995 if (conn->pending_sec_level == BT_SECURITY_SDP)
996 return 0;
997
998 /* Only request authentication for SSP connections or non-SSP
999 * devices with sec_level HIGH */
1000 if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1001 conn->pending_sec_level != BT_SECURITY_HIGH)
1002 return 0;
1003
1004 return 1;
1005 }
1006
1007 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1008 {
1009 struct hci_cp_remote_name_req *cp;
1010 struct hci_conn *conn;
1011
1012 BT_DBG("%s status 0x%x", hdev->name, status);
1013
1014 /* If successful wait for the name req complete event before
1015 * checking for the need to do authentication */
1016 if (!status)
1017 return;
1018
1019 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1020 if (!cp)
1021 return;
1022
1023 hci_dev_lock(hdev);
1024
1025 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1026 if (!conn)
1027 goto unlock;
1028
1029 if (!hci_outgoing_auth_needed(hdev, conn))
1030 goto unlock;
1031
1032 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1033 struct hci_cp_auth_requested cp;
1034 cp.handle = __cpu_to_le16(conn->handle);
1035 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1036 }
1037
1038 unlock:
1039 hci_dev_unlock(hdev);
1040 }
1041
1042 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1043 {
1044 struct hci_cp_read_remote_features *cp;
1045 struct hci_conn *conn;
1046
1047 BT_DBG("%s status 0x%x", hdev->name, status);
1048
1049 if (!status)
1050 return;
1051
1052 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1053 if (!cp)
1054 return;
1055
1056 hci_dev_lock(hdev);
1057
1058 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1059 if (conn) {
1060 if (conn->state == BT_CONFIG) {
1061 hci_proto_connect_cfm(conn, status);
1062 hci_conn_put(conn);
1063 }
1064 }
1065
1066 hci_dev_unlock(hdev);
1067 }
1068
1069 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1070 {
1071 struct hci_cp_read_remote_ext_features *cp;
1072 struct hci_conn *conn;
1073
1074 BT_DBG("%s status 0x%x", hdev->name, status);
1075
1076 if (!status)
1077 return;
1078
1079 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1080 if (!cp)
1081 return;
1082
1083 hci_dev_lock(hdev);
1084
1085 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1086 if (conn) {
1087 if (conn->state == BT_CONFIG) {
1088 hci_proto_connect_cfm(conn, status);
1089 hci_conn_put(conn);
1090 }
1091 }
1092
1093 hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1097 {
1098 struct hci_cp_setup_sync_conn *cp;
1099 struct hci_conn *acl, *sco;
1100 __u16 handle;
1101
1102 BT_DBG("%s status 0x%x", hdev->name, status);
1103
1104 if (!status)
1105 return;
1106
1107 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1108 if (!cp)
1109 return;
1110
1111 handle = __le16_to_cpu(cp->handle);
1112
1113 BT_DBG("%s handle %d", hdev->name, handle);
1114
1115 hci_dev_lock(hdev);
1116
1117 acl = hci_conn_hash_lookup_handle(hdev, handle);
1118 if (acl) {
1119 sco = acl->link;
1120 if (sco) {
1121 sco->state = BT_CLOSED;
1122
1123 hci_proto_connect_cfm(sco, status);
1124 hci_conn_del(sco);
1125 }
1126 }
1127
1128 hci_dev_unlock(hdev);
1129 }
1130
1131 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1132 {
1133 struct hci_cp_sniff_mode *cp;
1134 struct hci_conn *conn;
1135
1136 BT_DBG("%s status 0x%x", hdev->name, status);
1137
1138 if (!status)
1139 return;
1140
1141 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1142 if (!cp)
1143 return;
1144
1145 hci_dev_lock(hdev);
1146
1147 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1148 if (conn) {
1149 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1150
1151 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1152 hci_sco_setup(conn, status);
1153 }
1154
1155 hci_dev_unlock(hdev);
1156 }
1157
1158 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1159 {
1160 struct hci_cp_exit_sniff_mode *cp;
1161 struct hci_conn *conn;
1162
1163 BT_DBG("%s status 0x%x", hdev->name, status);
1164
1165 if (!status)
1166 return;
1167
1168 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1169 if (!cp)
1170 return;
1171
1172 hci_dev_lock(hdev);
1173
1174 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1175 if (conn) {
1176 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1177
1178 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1179 hci_sco_setup(conn, status);
1180 }
1181
1182 hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1186 {
1187 struct hci_cp_le_create_conn *cp;
1188 struct hci_conn *conn;
1189
1190 BT_DBG("%s status 0x%x", hdev->name, status);
1191
1192 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1193 if (!cp)
1194 return;
1195
1196 hci_dev_lock(hdev);
1197
1198 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1199
1200 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1201 conn);
1202
1203 if (status) {
1204 if (conn && conn->state == BT_CONNECT) {
1205 conn->state = BT_CLOSED;
1206 hci_proto_connect_cfm(conn, status);
1207 hci_conn_del(conn);
1208 }
1209 } else {
1210 if (!conn) {
1211 conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1212 if (conn)
1213 conn->out = 1;
1214 else
1215 BT_ERR("No memory for new connection");
1216 }
1217 }
1218
1219 hci_dev_unlock(hdev);
1220 }
1221
1222 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1223 {
1224 __u8 status = *((__u8 *) skb->data);
1225
1226 BT_DBG("%s status %d", hdev->name, status);
1227
1228 if (test_bit(HCI_MGMT, &hdev->flags) &&
1229 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1230 mgmt_discovering(hdev->id, 0);
1231
1232 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1233
1234 hci_conn_check_pending(hdev);
1235 }
1236
1237 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1238 {
1239 struct inquiry_data data;
1240 struct inquiry_info *info = (void *) (skb->data + 1);
1241 int num_rsp = *((__u8 *) skb->data);
1242
1243 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1244
1245 if (!num_rsp)
1246 return;
1247
1248 hci_dev_lock(hdev);
1249
1250 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
1251
1252 if (test_bit(HCI_MGMT, &hdev->flags))
1253 mgmt_discovering(hdev->id, 1);
1254 }
1255
1256 for (; num_rsp; num_rsp--, info++) {
1257 bacpy(&data.bdaddr, &info->bdaddr);
1258 data.pscan_rep_mode = info->pscan_rep_mode;
1259 data.pscan_period_mode = info->pscan_period_mode;
1260 data.pscan_mode = info->pscan_mode;
1261 memcpy(data.dev_class, info->dev_class, 3);
1262 data.clock_offset = info->clock_offset;
1263 data.rssi = 0x00;
1264 data.ssp_mode = 0x00;
1265 hci_inquiry_cache_update(hdev, &data);
1266 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
1267 NULL);
1268 }
1269
1270 hci_dev_unlock(hdev);
1271 }
1272
1273 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1274 {
1275 struct hci_ev_conn_complete *ev = (void *) skb->data;
1276 struct hci_conn *conn;
1277
1278 BT_DBG("%s", hdev->name);
1279
1280 hci_dev_lock(hdev);
1281
1282 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1283 if (!conn) {
1284 if (ev->link_type != SCO_LINK)
1285 goto unlock;
1286
1287 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1288 if (!conn)
1289 goto unlock;
1290
1291 conn->type = SCO_LINK;
1292 }
1293
1294 if (!ev->status) {
1295 conn->handle = __le16_to_cpu(ev->handle);
1296
1297 if (conn->type == ACL_LINK) {
1298 conn->state = BT_CONFIG;
1299 hci_conn_hold(conn);
1300 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1301 mgmt_connected(hdev->id, &ev->bdaddr);
1302 } else
1303 conn->state = BT_CONNECTED;
1304
1305 hci_conn_hold_device(conn);
1306 hci_conn_add_sysfs(conn);
1307
1308 if (test_bit(HCI_AUTH, &hdev->flags))
1309 conn->link_mode |= HCI_LM_AUTH;
1310
1311 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1312 conn->link_mode |= HCI_LM_ENCRYPT;
1313
1314 /* Get remote features */
1315 if (conn->type == ACL_LINK) {
1316 struct hci_cp_read_remote_features cp;
1317 cp.handle = ev->handle;
1318 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1319 sizeof(cp), &cp);
1320 }
1321
1322 /* Set packet type for incoming connection */
1323 if (!conn->out && hdev->hci_ver < 3) {
1324 struct hci_cp_change_conn_ptype cp;
1325 cp.handle = ev->handle;
1326 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1327 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1328 sizeof(cp), &cp);
1329 }
1330 } else {
1331 conn->state = BT_CLOSED;
1332 if (conn->type == ACL_LINK)
1333 mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1334 }
1335
1336 if (conn->type == ACL_LINK)
1337 hci_sco_setup(conn, ev->status);
1338
1339 if (ev->status) {
1340 hci_proto_connect_cfm(conn, ev->status);
1341 hci_conn_del(conn);
1342 } else if (ev->link_type != ACL_LINK)
1343 hci_proto_connect_cfm(conn, ev->status);
1344
1345 unlock:
1346 hci_dev_unlock(hdev);
1347
1348 hci_conn_check_pending(hdev);
1349 }
1350
1351 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1352 {
1353 struct hci_ev_conn_request *ev = (void *) skb->data;
1354 int mask = hdev->link_mode;
1355
1356 BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1357 batostr(&ev->bdaddr), ev->link_type);
1358
1359 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1360
1361 if ((mask & HCI_LM_ACCEPT) &&
1362 !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1363 /* Connection accepted */
1364 struct inquiry_entry *ie;
1365 struct hci_conn *conn;
1366
1367 hci_dev_lock(hdev);
1368
1369 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1370 if (ie)
1371 memcpy(ie->data.dev_class, ev->dev_class, 3);
1372
1373 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1374 if (!conn) {
1375 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1376 if (!conn) {
1377 BT_ERR("No memory for new connection");
1378 hci_dev_unlock(hdev);
1379 return;
1380 }
1381 }
1382
1383 memcpy(conn->dev_class, ev->dev_class, 3);
1384 conn->state = BT_CONNECT;
1385
1386 hci_dev_unlock(hdev);
1387
1388 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1389 struct hci_cp_accept_conn_req cp;
1390
1391 bacpy(&cp.bdaddr, &ev->bdaddr);
1392
1393 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1394 cp.role = 0x00; /* Become master */
1395 else
1396 cp.role = 0x01; /* Remain slave */
1397
1398 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1399 sizeof(cp), &cp);
1400 } else {
1401 struct hci_cp_accept_sync_conn_req cp;
1402
1403 bacpy(&cp.bdaddr, &ev->bdaddr);
1404 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1405
1406 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
1407 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
1408 cp.max_latency = cpu_to_le16(0xffff);
1409 cp.content_format = cpu_to_le16(hdev->voice_setting);
1410 cp.retrans_effort = 0xff;
1411
1412 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1413 sizeof(cp), &cp);
1414 }
1415 } else {
1416 /* Connection rejected */
1417 struct hci_cp_reject_conn_req cp;
1418
1419 bacpy(&cp.bdaddr, &ev->bdaddr);
1420 cp.reason = 0x0f;
1421 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1422 }
1423 }
1424
1425 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1426 {
1427 struct hci_ev_disconn_complete *ev = (void *) skb->data;
1428 struct hci_conn *conn;
1429
1430 BT_DBG("%s status %d", hdev->name, ev->status);
1431
1432 if (ev->status) {
1433 mgmt_disconnect_failed(hdev->id);
1434 return;
1435 }
1436
1437 hci_dev_lock(hdev);
1438
1439 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1440 if (!conn)
1441 goto unlock;
1442
1443 conn->state = BT_CLOSED;
1444
1445 if (conn->type == ACL_LINK || conn->type == LE_LINK)
1446 mgmt_disconnected(hdev->id, &conn->dst);
1447
1448 hci_proto_disconn_cfm(conn, ev->reason);
1449 hci_conn_del(conn);
1450
1451 unlock:
1452 hci_dev_unlock(hdev);
1453 }
1454
1455 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1456 {
1457 struct hci_ev_auth_complete *ev = (void *) skb->data;
1458 struct hci_conn *conn;
1459
1460 BT_DBG("%s status %d", hdev->name, ev->status);
1461
1462 hci_dev_lock(hdev);
1463
1464 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1465 if (conn) {
1466 if (!ev->status) {
1467 conn->link_mode |= HCI_LM_AUTH;
1468 conn->sec_level = conn->pending_sec_level;
1469 } else {
1470 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
1471 }
1472
1473 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1474
1475 if (conn->state == BT_CONFIG) {
1476 if (!ev->status && hdev->ssp_mode > 0 &&
1477 conn->ssp_mode > 0) {
1478 struct hci_cp_set_conn_encrypt cp;
1479 cp.handle = ev->handle;
1480 cp.encrypt = 0x01;
1481 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1482 sizeof(cp), &cp);
1483 } else {
1484 conn->state = BT_CONNECTED;
1485 hci_proto_connect_cfm(conn, ev->status);
1486 hci_conn_put(conn);
1487 }
1488 } else {
1489 hci_auth_cfm(conn, ev->status);
1490
1491 hci_conn_hold(conn);
1492 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1493 hci_conn_put(conn);
1494 }
1495
1496 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1497 if (!ev->status) {
1498 struct hci_cp_set_conn_encrypt cp;
1499 cp.handle = ev->handle;
1500 cp.encrypt = 0x01;
1501 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1502 sizeof(cp), &cp);
1503 } else {
1504 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1505 hci_encrypt_cfm(conn, ev->status, 0x00);
1506 }
1507 }
1508 }
1509
1510 hci_dev_unlock(hdev);
1511 }
1512
1513 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1514 {
1515 struct hci_ev_remote_name *ev = (void *) skb->data;
1516 struct hci_conn *conn;
1517
1518 BT_DBG("%s", hdev->name);
1519
1520 hci_conn_check_pending(hdev);
1521
1522 hci_dev_lock(hdev);
1523
1524 if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1525 mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
1526
1527 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1528 if (!conn)
1529 goto unlock;
1530
1531 if (!hci_outgoing_auth_needed(hdev, conn))
1532 goto unlock;
1533
1534 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1535 struct hci_cp_auth_requested cp;
1536 cp.handle = __cpu_to_le16(conn->handle);
1537 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1538 }
1539
1540 unlock:
1541 hci_dev_unlock(hdev);
1542 }
1543
1544 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1545 {
1546 struct hci_ev_encrypt_change *ev = (void *) skb->data;
1547 struct hci_conn *conn;
1548
1549 BT_DBG("%s status %d", hdev->name, ev->status);
1550
1551 hci_dev_lock(hdev);
1552
1553 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1554 if (conn) {
1555 if (!ev->status) {
1556 if (ev->encrypt) {
1557 /* Encryption implies authentication */
1558 conn->link_mode |= HCI_LM_AUTH;
1559 conn->link_mode |= HCI_LM_ENCRYPT;
1560 } else
1561 conn->link_mode &= ~HCI_LM_ENCRYPT;
1562 }
1563
1564 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1565
1566 if (conn->state == BT_CONFIG) {
1567 if (!ev->status)
1568 conn->state = BT_CONNECTED;
1569
1570 hci_proto_connect_cfm(conn, ev->status);
1571 hci_conn_put(conn);
1572 } else
1573 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1574 }
1575
1576 hci_dev_unlock(hdev);
1577 }
1578
1579 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1580 {
1581 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1582 struct hci_conn *conn;
1583
1584 BT_DBG("%s status %d", hdev->name, ev->status);
1585
1586 hci_dev_lock(hdev);
1587
1588 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1589 if (conn) {
1590 if (!ev->status)
1591 conn->link_mode |= HCI_LM_SECURE;
1592
1593 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1594
1595 hci_key_change_cfm(conn, ev->status);
1596 }
1597
1598 hci_dev_unlock(hdev);
1599 }
1600
1601 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1602 {
1603 struct hci_ev_remote_features *ev = (void *) skb->data;
1604 struct hci_conn *conn;
1605
1606 BT_DBG("%s status %d", hdev->name, ev->status);
1607
1608 hci_dev_lock(hdev);
1609
1610 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1611 if (!conn)
1612 goto unlock;
1613
1614 if (!ev->status)
1615 memcpy(conn->features, ev->features, 8);
1616
1617 if (conn->state != BT_CONFIG)
1618 goto unlock;
1619
1620 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1621 struct hci_cp_read_remote_ext_features cp;
1622 cp.handle = ev->handle;
1623 cp.page = 0x01;
1624 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1625 sizeof(cp), &cp);
1626 goto unlock;
1627 }
1628
1629 if (!ev->status) {
1630 struct hci_cp_remote_name_req cp;
1631 memset(&cp, 0, sizeof(cp));
1632 bacpy(&cp.bdaddr, &conn->dst);
1633 cp.pscan_rep_mode = 0x02;
1634 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1635 }
1636
1637 if (!hci_outgoing_auth_needed(hdev, conn)) {
1638 conn->state = BT_CONNECTED;
1639 hci_proto_connect_cfm(conn, ev->status);
1640 hci_conn_put(conn);
1641 }
1642
1643 unlock:
1644 hci_dev_unlock(hdev);
1645 }
1646
1647 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1648 {
1649 BT_DBG("%s", hdev->name);
1650 }
1651
1652 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1653 {
1654 BT_DBG("%s", hdev->name);
1655 }
1656
1657 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1658 {
1659 struct hci_ev_cmd_complete *ev = (void *) skb->data;
1660 __u16 opcode;
1661
1662 skb_pull(skb, sizeof(*ev));
1663
1664 opcode = __le16_to_cpu(ev->opcode);
1665
1666 switch (opcode) {
1667 case HCI_OP_INQUIRY_CANCEL:
1668 hci_cc_inquiry_cancel(hdev, skb);
1669 break;
1670
1671 case HCI_OP_EXIT_PERIODIC_INQ:
1672 hci_cc_exit_periodic_inq(hdev, skb);
1673 break;
1674
1675 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1676 hci_cc_remote_name_req_cancel(hdev, skb);
1677 break;
1678
1679 case HCI_OP_ROLE_DISCOVERY:
1680 hci_cc_role_discovery(hdev, skb);
1681 break;
1682
1683 case HCI_OP_READ_LINK_POLICY:
1684 hci_cc_read_link_policy(hdev, skb);
1685 break;
1686
1687 case HCI_OP_WRITE_LINK_POLICY:
1688 hci_cc_write_link_policy(hdev, skb);
1689 break;
1690
1691 case HCI_OP_READ_DEF_LINK_POLICY:
1692 hci_cc_read_def_link_policy(hdev, skb);
1693 break;
1694
1695 case HCI_OP_WRITE_DEF_LINK_POLICY:
1696 hci_cc_write_def_link_policy(hdev, skb);
1697 break;
1698
1699 case HCI_OP_RESET:
1700 hci_cc_reset(hdev, skb);
1701 break;
1702
1703 case HCI_OP_WRITE_LOCAL_NAME:
1704 hci_cc_write_local_name(hdev, skb);
1705 break;
1706
1707 case HCI_OP_READ_LOCAL_NAME:
1708 hci_cc_read_local_name(hdev, skb);
1709 break;
1710
1711 case HCI_OP_WRITE_AUTH_ENABLE:
1712 hci_cc_write_auth_enable(hdev, skb);
1713 break;
1714
1715 case HCI_OP_WRITE_ENCRYPT_MODE:
1716 hci_cc_write_encrypt_mode(hdev, skb);
1717 break;
1718
1719 case HCI_OP_WRITE_SCAN_ENABLE:
1720 hci_cc_write_scan_enable(hdev, skb);
1721 break;
1722
1723 case HCI_OP_READ_CLASS_OF_DEV:
1724 hci_cc_read_class_of_dev(hdev, skb);
1725 break;
1726
1727 case HCI_OP_WRITE_CLASS_OF_DEV:
1728 hci_cc_write_class_of_dev(hdev, skb);
1729 break;
1730
1731 case HCI_OP_READ_VOICE_SETTING:
1732 hci_cc_read_voice_setting(hdev, skb);
1733 break;
1734
1735 case HCI_OP_WRITE_VOICE_SETTING:
1736 hci_cc_write_voice_setting(hdev, skb);
1737 break;
1738
1739 case HCI_OP_HOST_BUFFER_SIZE:
1740 hci_cc_host_buffer_size(hdev, skb);
1741 break;
1742
1743 case HCI_OP_READ_SSP_MODE:
1744 hci_cc_read_ssp_mode(hdev, skb);
1745 break;
1746
1747 case HCI_OP_WRITE_SSP_MODE:
1748 hci_cc_write_ssp_mode(hdev, skb);
1749 break;
1750
1751 case HCI_OP_READ_LOCAL_VERSION:
1752 hci_cc_read_local_version(hdev, skb);
1753 break;
1754
1755 case HCI_OP_READ_LOCAL_COMMANDS:
1756 hci_cc_read_local_commands(hdev, skb);
1757 break;
1758
1759 case HCI_OP_READ_LOCAL_FEATURES:
1760 hci_cc_read_local_features(hdev, skb);
1761 break;
1762
1763 case HCI_OP_READ_BUFFER_SIZE:
1764 hci_cc_read_buffer_size(hdev, skb);
1765 break;
1766
1767 case HCI_OP_READ_BD_ADDR:
1768 hci_cc_read_bd_addr(hdev, skb);
1769 break;
1770
1771 case HCI_OP_WRITE_CA_TIMEOUT:
1772 hci_cc_write_ca_timeout(hdev, skb);
1773 break;
1774
1775 case HCI_OP_DELETE_STORED_LINK_KEY:
1776 hci_cc_delete_stored_link_key(hdev, skb);
1777 break;
1778
1779 case HCI_OP_SET_EVENT_MASK:
1780 hci_cc_set_event_mask(hdev, skb);
1781 break;
1782
1783 case HCI_OP_WRITE_INQUIRY_MODE:
1784 hci_cc_write_inquiry_mode(hdev, skb);
1785 break;
1786
1787 case HCI_OP_READ_INQ_RSP_TX_POWER:
1788 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1789 break;
1790
1791 case HCI_OP_SET_EVENT_FLT:
1792 hci_cc_set_event_flt(hdev, skb);
1793 break;
1794
1795 case HCI_OP_PIN_CODE_REPLY:
1796 hci_cc_pin_code_reply(hdev, skb);
1797 break;
1798
1799 case HCI_OP_PIN_CODE_NEG_REPLY:
1800 hci_cc_pin_code_neg_reply(hdev, skb);
1801 break;
1802
1803 case HCI_OP_READ_LOCAL_OOB_DATA:
1804 hci_cc_read_local_oob_data_reply(hdev, skb);
1805 break;
1806
1807 case HCI_OP_LE_READ_BUFFER_SIZE:
1808 hci_cc_le_read_buffer_size(hdev, skb);
1809 break;
1810
1811 case HCI_OP_USER_CONFIRM_REPLY:
1812 hci_cc_user_confirm_reply(hdev, skb);
1813 break;
1814
1815 case HCI_OP_USER_CONFIRM_NEG_REPLY:
1816 hci_cc_user_confirm_neg_reply(hdev, skb);
1817 break;
1818
1819 default:
1820 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1821 break;
1822 }
1823
1824 if (ev->opcode != HCI_OP_NOP)
1825 del_timer(&hdev->cmd_timer);
1826
1827 if (ev->ncmd) {
1828 atomic_set(&hdev->cmd_cnt, 1);
1829 if (!skb_queue_empty(&hdev->cmd_q))
1830 tasklet_schedule(&hdev->cmd_task);
1831 }
1832 }
1833
1834 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1835 {
1836 struct hci_ev_cmd_status *ev = (void *) skb->data;
1837 __u16 opcode;
1838
1839 skb_pull(skb, sizeof(*ev));
1840
1841 opcode = __le16_to_cpu(ev->opcode);
1842
1843 switch (opcode) {
1844 case HCI_OP_INQUIRY:
1845 hci_cs_inquiry(hdev, ev->status);
1846 break;
1847
1848 case HCI_OP_CREATE_CONN:
1849 hci_cs_create_conn(hdev, ev->status);
1850 break;
1851
1852 case HCI_OP_ADD_SCO:
1853 hci_cs_add_sco(hdev, ev->status);
1854 break;
1855
1856 case HCI_OP_AUTH_REQUESTED:
1857 hci_cs_auth_requested(hdev, ev->status);
1858 break;
1859
1860 case HCI_OP_SET_CONN_ENCRYPT:
1861 hci_cs_set_conn_encrypt(hdev, ev->status);
1862 break;
1863
1864 case HCI_OP_REMOTE_NAME_REQ:
1865 hci_cs_remote_name_req(hdev, ev->status);
1866 break;
1867
1868 case HCI_OP_READ_REMOTE_FEATURES:
1869 hci_cs_read_remote_features(hdev, ev->status);
1870 break;
1871
1872 case HCI_OP_READ_REMOTE_EXT_FEATURES:
1873 hci_cs_read_remote_ext_features(hdev, ev->status);
1874 break;
1875
1876 case HCI_OP_SETUP_SYNC_CONN:
1877 hci_cs_setup_sync_conn(hdev, ev->status);
1878 break;
1879
1880 case HCI_OP_SNIFF_MODE:
1881 hci_cs_sniff_mode(hdev, ev->status);
1882 break;
1883
1884 case HCI_OP_EXIT_SNIFF_MODE:
1885 hci_cs_exit_sniff_mode(hdev, ev->status);
1886 break;
1887
1888 case HCI_OP_DISCONNECT:
1889 if (ev->status != 0)
1890 mgmt_disconnect_failed(hdev->id);
1891 break;
1892
1893 case HCI_OP_LE_CREATE_CONN:
1894 hci_cs_le_create_conn(hdev, ev->status);
1895 break;
1896
1897 default:
1898 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1899 break;
1900 }
1901
1902 if (ev->opcode != HCI_OP_NOP)
1903 del_timer(&hdev->cmd_timer);
1904
1905 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
1906 atomic_set(&hdev->cmd_cnt, 1);
1907 if (!skb_queue_empty(&hdev->cmd_q))
1908 tasklet_schedule(&hdev->cmd_task);
1909 }
1910 }
1911
1912 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1913 {
1914 struct hci_ev_role_change *ev = (void *) skb->data;
1915 struct hci_conn *conn;
1916
1917 BT_DBG("%s status %d", hdev->name, ev->status);
1918
1919 hci_dev_lock(hdev);
1920
1921 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1922 if (conn) {
1923 if (!ev->status) {
1924 if (ev->role)
1925 conn->link_mode &= ~HCI_LM_MASTER;
1926 else
1927 conn->link_mode |= HCI_LM_MASTER;
1928 }
1929
1930 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1931
1932 hci_role_switch_cfm(conn, ev->status, ev->role);
1933 }
1934
1935 hci_dev_unlock(hdev);
1936 }
1937
1938 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1939 {
1940 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1941 __le16 *ptr;
1942 int i;
1943
1944 skb_pull(skb, sizeof(*ev));
1945
1946 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1947
1948 if (skb->len < ev->num_hndl * 4) {
1949 BT_DBG("%s bad parameters", hdev->name);
1950 return;
1951 }
1952
1953 tasklet_disable(&hdev->tx_task);
1954
1955 for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1956 struct hci_conn *conn;
1957 __u16 handle, count;
1958
1959 handle = get_unaligned_le16(ptr++);
1960 count = get_unaligned_le16(ptr++);
1961
1962 conn = hci_conn_hash_lookup_handle(hdev, handle);
1963 if (conn) {
1964 conn->sent -= count;
1965
1966 if (conn->type == ACL_LINK) {
1967 hdev->acl_cnt += count;
1968 if (hdev->acl_cnt > hdev->acl_pkts)
1969 hdev->acl_cnt = hdev->acl_pkts;
1970 } else if (conn->type == LE_LINK) {
1971 if (hdev->le_pkts) {
1972 hdev->le_cnt += count;
1973 if (hdev->le_cnt > hdev->le_pkts)
1974 hdev->le_cnt = hdev->le_pkts;
1975 } else {
1976 hdev->acl_cnt += count;
1977 if (hdev->acl_cnt > hdev->acl_pkts)
1978 hdev->acl_cnt = hdev->acl_pkts;
1979 }
1980 } else {
1981 hdev->sco_cnt += count;
1982 if (hdev->sco_cnt > hdev->sco_pkts)
1983 hdev->sco_cnt = hdev->sco_pkts;
1984 }
1985 }
1986 }
1987
1988 tasklet_schedule(&hdev->tx_task);
1989
1990 tasklet_enable(&hdev->tx_task);
1991 }
1992
1993 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1994 {
1995 struct hci_ev_mode_change *ev = (void *) skb->data;
1996 struct hci_conn *conn;
1997
1998 BT_DBG("%s status %d", hdev->name, ev->status);
1999
2000 hci_dev_lock(hdev);
2001
2002 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2003 if (conn) {
2004 conn->mode = ev->mode;
2005 conn->interval = __le16_to_cpu(ev->interval);
2006
2007 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2008 if (conn->mode == HCI_CM_ACTIVE)
2009 conn->power_save = 1;
2010 else
2011 conn->power_save = 0;
2012 }
2013
2014 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2015 hci_sco_setup(conn, ev->status);
2016 }
2017
2018 hci_dev_unlock(hdev);
2019 }
2020
2021 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2022 {
2023 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2024 struct hci_conn *conn;
2025
2026 BT_DBG("%s", hdev->name);
2027
2028 hci_dev_lock(hdev);
2029
2030 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2031 if (conn && conn->state == BT_CONNECTED) {
2032 hci_conn_hold(conn);
2033 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2034 hci_conn_put(conn);
2035 }
2036
2037 if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2038 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2039 sizeof(ev->bdaddr), &ev->bdaddr);
2040 else if (test_bit(HCI_MGMT, &hdev->flags)) {
2041 u8 secure;
2042
2043 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2044 secure = 1;
2045 else
2046 secure = 0;
2047
2048 mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
2049 }
2050
2051 hci_dev_unlock(hdev);
2052 }
2053
2054 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2055 {
2056 struct hci_ev_link_key_req *ev = (void *) skb->data;
2057 struct hci_cp_link_key_reply cp;
2058 struct hci_conn *conn;
2059 struct link_key *key;
2060
2061 BT_DBG("%s", hdev->name);
2062
2063 if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2064 return;
2065
2066 hci_dev_lock(hdev);
2067
2068 key = hci_find_link_key(hdev, &ev->bdaddr);
2069 if (!key) {
2070 BT_DBG("%s link key not found for %s", hdev->name,
2071 batostr(&ev->bdaddr));
2072 goto not_found;
2073 }
2074
2075 BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2076 batostr(&ev->bdaddr));
2077
2078 if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2079 key->type == HCI_LK_DEBUG_COMBINATION) {
2080 BT_DBG("%s ignoring debug key", hdev->name);
2081 goto not_found;
2082 }
2083
2084 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2085 if (conn) {
2086 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2087 conn->auth_type != 0xff &&
2088 (conn->auth_type & 0x01)) {
2089 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2090 goto not_found;
2091 }
2092
2093 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2094 conn->pending_sec_level == BT_SECURITY_HIGH) {
2095 BT_DBG("%s ignoring key unauthenticated for high \
2096 security", hdev->name);
2097 goto not_found;
2098 }
2099
2100 conn->key_type = key->type;
2101 conn->pin_length = key->pin_len;
2102 }
2103
2104 bacpy(&cp.bdaddr, &ev->bdaddr);
2105 memcpy(cp.link_key, key->val, 16);
2106
2107 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2108
2109 hci_dev_unlock(hdev);
2110
2111 return;
2112
2113 not_found:
2114 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2115 hci_dev_unlock(hdev);
2116 }
2117
2118 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2119 {
2120 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2121 struct hci_conn *conn;
2122 u8 pin_len = 0;
2123
2124 BT_DBG("%s", hdev->name);
2125
2126 hci_dev_lock(hdev);
2127
2128 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2129 if (conn) {
2130 hci_conn_hold(conn);
2131 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2132 pin_len = conn->pin_length;
2133
2134 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2135 conn->key_type = ev->key_type;
2136
2137 hci_conn_put(conn);
2138 }
2139
2140 if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2141 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2142 ev->key_type, pin_len);
2143
2144 hci_dev_unlock(hdev);
2145 }
2146
2147 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2148 {
2149 struct hci_ev_clock_offset *ev = (void *) skb->data;
2150 struct hci_conn *conn;
2151
2152 BT_DBG("%s status %d", hdev->name, ev->status);
2153
2154 hci_dev_lock(hdev);
2155
2156 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2157 if (conn && !ev->status) {
2158 struct inquiry_entry *ie;
2159
2160 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2161 if (ie) {
2162 ie->data.clock_offset = ev->clock_offset;
2163 ie->timestamp = jiffies;
2164 }
2165 }
2166
2167 hci_dev_unlock(hdev);
2168 }
2169
2170 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2171 {
2172 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2173 struct hci_conn *conn;
2174
2175 BT_DBG("%s status %d", hdev->name, ev->status);
2176
2177 hci_dev_lock(hdev);
2178
2179 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2180 if (conn && !ev->status)
2181 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2182
2183 hci_dev_unlock(hdev);
2184 }
2185
2186 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2187 {
2188 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2189 struct inquiry_entry *ie;
2190
2191 BT_DBG("%s", hdev->name);
2192
2193 hci_dev_lock(hdev);
2194
2195 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2196 if (ie) {
2197 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2198 ie->timestamp = jiffies;
2199 }
2200
2201 hci_dev_unlock(hdev);
2202 }
2203
2204 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2205 {
2206 struct inquiry_data data;
2207 int num_rsp = *((__u8 *) skb->data);
2208
2209 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2210
2211 if (!num_rsp)
2212 return;
2213
2214 hci_dev_lock(hdev);
2215
2216 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2217
2218 if (test_bit(HCI_MGMT, &hdev->flags))
2219 mgmt_discovering(hdev->id, 1);
2220 }
2221
2222 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2223 struct inquiry_info_with_rssi_and_pscan_mode *info;
2224 info = (void *) (skb->data + 1);
2225
2226 for (; num_rsp; num_rsp--, info++) {
2227 bacpy(&data.bdaddr, &info->bdaddr);
2228 data.pscan_rep_mode = info->pscan_rep_mode;
2229 data.pscan_period_mode = info->pscan_period_mode;
2230 data.pscan_mode = info->pscan_mode;
2231 memcpy(data.dev_class, info->dev_class, 3);
2232 data.clock_offset = info->clock_offset;
2233 data.rssi = info->rssi;
2234 data.ssp_mode = 0x00;
2235 hci_inquiry_cache_update(hdev, &data);
2236 mgmt_device_found(hdev->id, &info->bdaddr,
2237 info->dev_class, info->rssi,
2238 NULL);
2239 }
2240 } else {
2241 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2242
2243 for (; num_rsp; num_rsp--, info++) {
2244 bacpy(&data.bdaddr, &info->bdaddr);
2245 data.pscan_rep_mode = info->pscan_rep_mode;
2246 data.pscan_period_mode = info->pscan_period_mode;
2247 data.pscan_mode = 0x00;
2248 memcpy(data.dev_class, info->dev_class, 3);
2249 data.clock_offset = info->clock_offset;
2250 data.rssi = info->rssi;
2251 data.ssp_mode = 0x00;
2252 hci_inquiry_cache_update(hdev, &data);
2253 mgmt_device_found(hdev->id, &info->bdaddr,
2254 info->dev_class, info->rssi,
2255 NULL);
2256 }
2257 }
2258
2259 hci_dev_unlock(hdev);
2260 }
2261
2262 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2263 {
2264 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2265 struct hci_conn *conn;
2266
2267 BT_DBG("%s", hdev->name);
2268
2269 hci_dev_lock(hdev);
2270
2271 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2272 if (!conn)
2273 goto unlock;
2274
2275 if (!ev->status && ev->page == 0x01) {
2276 struct inquiry_entry *ie;
2277
2278 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2279 if (ie)
2280 ie->data.ssp_mode = (ev->features[0] & 0x01);
2281
2282 conn->ssp_mode = (ev->features[0] & 0x01);
2283 }
2284
2285 if (conn->state != BT_CONFIG)
2286 goto unlock;
2287
2288 if (!ev->status) {
2289 struct hci_cp_remote_name_req cp;
2290 memset(&cp, 0, sizeof(cp));
2291 bacpy(&cp.bdaddr, &conn->dst);
2292 cp.pscan_rep_mode = 0x02;
2293 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2294 }
2295
2296 if (!hci_outgoing_auth_needed(hdev, conn)) {
2297 conn->state = BT_CONNECTED;
2298 hci_proto_connect_cfm(conn, ev->status);
2299 hci_conn_put(conn);
2300 }
2301
2302 unlock:
2303 hci_dev_unlock(hdev);
2304 }
2305
2306 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2307 {
2308 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2309 struct hci_conn *conn;
2310
2311 BT_DBG("%s status %d", hdev->name, ev->status);
2312
2313 hci_dev_lock(hdev);
2314
2315 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2316 if (!conn) {
2317 if (ev->link_type == ESCO_LINK)
2318 goto unlock;
2319
2320 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2321 if (!conn)
2322 goto unlock;
2323
2324 conn->type = SCO_LINK;
2325 }
2326
2327 switch (ev->status) {
2328 case 0x00:
2329 conn->handle = __le16_to_cpu(ev->handle);
2330 conn->state = BT_CONNECTED;
2331
2332 hci_conn_hold_device(conn);
2333 hci_conn_add_sysfs(conn);
2334 break;
2335
2336 case 0x11: /* Unsupported Feature or Parameter Value */
2337 case 0x1c: /* SCO interval rejected */
2338 case 0x1a: /* Unsupported Remote Feature */
2339 case 0x1f: /* Unspecified error */
2340 if (conn->out && conn->attempt < 2) {
2341 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2342 (hdev->esco_type & EDR_ESCO_MASK);
2343 hci_setup_sync(conn, conn->link->handle);
2344 goto unlock;
2345 }
2346 /* fall through */
2347
2348 default:
2349 conn->state = BT_CLOSED;
2350 break;
2351 }
2352
2353 hci_proto_connect_cfm(conn, ev->status);
2354 if (ev->status)
2355 hci_conn_del(conn);
2356
2357 unlock:
2358 hci_dev_unlock(hdev);
2359 }
2360
2361 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2362 {
2363 BT_DBG("%s", hdev->name);
2364 }
2365
2366 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2367 {
2368 struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2369
2370 BT_DBG("%s status %d", hdev->name, ev->status);
2371 }
2372
2373 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374 {
2375 struct inquiry_data data;
2376 struct extended_inquiry_info *info = (void *) (skb->data + 1);
2377 int num_rsp = *((__u8 *) skb->data);
2378
2379 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2380
2381 if (!num_rsp)
2382 return;
2383
2384 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2385
2386 if (test_bit(HCI_MGMT, &hdev->flags))
2387 mgmt_discovering(hdev->id, 1);
2388 }
2389
2390 hci_dev_lock(hdev);
2391
2392 for (; num_rsp; num_rsp--, info++) {
2393 bacpy(&data.bdaddr, &info->bdaddr);
2394 data.pscan_rep_mode = info->pscan_rep_mode;
2395 data.pscan_period_mode = info->pscan_period_mode;
2396 data.pscan_mode = 0x00;
2397 memcpy(data.dev_class, info->dev_class, 3);
2398 data.clock_offset = info->clock_offset;
2399 data.rssi = info->rssi;
2400 data.ssp_mode = 0x01;
2401 hci_inquiry_cache_update(hdev, &data);
2402 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
2403 info->rssi, info->data);
2404 }
2405
2406 hci_dev_unlock(hdev);
2407 }
2408
2409 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2410 {
2411 /* If remote requests dedicated bonding follow that lead */
2412 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2413 /* If both remote and local IO capabilities allow MITM
2414 * protection then require it, otherwise don't */
2415 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2416 return 0x02;
2417 else
2418 return 0x03;
2419 }
2420
2421 /* If remote requests no-bonding follow that lead */
2422 if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2423 return conn->remote_auth | (conn->auth_type & 0x01);
2424
2425 return conn->auth_type;
2426 }
2427
2428 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2429 {
2430 struct hci_ev_io_capa_request *ev = (void *) skb->data;
2431 struct hci_conn *conn;
2432
2433 BT_DBG("%s", hdev->name);
2434
2435 hci_dev_lock(hdev);
2436
2437 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2438 if (!conn)
2439 goto unlock;
2440
2441 hci_conn_hold(conn);
2442
2443 if (!test_bit(HCI_MGMT, &hdev->flags))
2444 goto unlock;
2445
2446 if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2447 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2448 struct hci_cp_io_capability_reply cp;
2449
2450 bacpy(&cp.bdaddr, &ev->bdaddr);
2451 cp.capability = conn->io_capability;
2452 conn->auth_type = hci_get_auth_req(conn);
2453 cp.authentication = conn->auth_type;
2454
2455 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2456 hci_find_remote_oob_data(hdev, &conn->dst))
2457 cp.oob_data = 0x01;
2458 else
2459 cp.oob_data = 0x00;
2460
2461 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2462 sizeof(cp), &cp);
2463 } else {
2464 struct hci_cp_io_capability_neg_reply cp;
2465
2466 bacpy(&cp.bdaddr, &ev->bdaddr);
2467 cp.reason = 0x18; /* Pairing not allowed */
2468
2469 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2470 sizeof(cp), &cp);
2471 }
2472
2473 unlock:
2474 hci_dev_unlock(hdev);
2475 }
2476
2477 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2478 {
2479 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2480 struct hci_conn *conn;
2481
2482 BT_DBG("%s", hdev->name);
2483
2484 hci_dev_lock(hdev);
2485
2486 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2487 if (!conn)
2488 goto unlock;
2489
2490 conn->remote_cap = ev->capability;
2491 conn->remote_oob = ev->oob_data;
2492 conn->remote_auth = ev->authentication;
2493
2494 unlock:
2495 hci_dev_unlock(hdev);
2496 }
2497
2498 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2499 struct sk_buff *skb)
2500 {
2501 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2502 int loc_mitm, rem_mitm, confirm_hint = 0;
2503 struct hci_conn *conn;
2504
2505 BT_DBG("%s", hdev->name);
2506
2507 hci_dev_lock(hdev);
2508
2509 if (!test_bit(HCI_MGMT, &hdev->flags))
2510 goto unlock;
2511
2512 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2513 if (!conn)
2514 goto unlock;
2515
2516 loc_mitm = (conn->auth_type & 0x01);
2517 rem_mitm = (conn->remote_auth & 0x01);
2518
2519 /* If we require MITM but the remote device can't provide that
2520 * (it has NoInputNoOutput) then reject the confirmation
2521 * request. The only exception is when we're dedicated bonding
2522 * initiators (connect_cfm_cb set) since then we always have the MITM
2523 * bit set. */
2524 if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2525 BT_DBG("Rejecting request: remote device can't provide MITM");
2526 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2527 sizeof(ev->bdaddr), &ev->bdaddr);
2528 goto unlock;
2529 }
2530
2531 /* If no side requires MITM protection; auto-accept */
2532 if ((!loc_mitm || conn->remote_cap == 0x03) &&
2533 (!rem_mitm || conn->io_capability == 0x03)) {
2534
2535 /* If we're not the initiators request authorization to
2536 * proceed from user space (mgmt_user_confirm with
2537 * confirm_hint set to 1). */
2538 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2539 BT_DBG("Confirming auto-accept as acceptor");
2540 confirm_hint = 1;
2541 goto confirm;
2542 }
2543
2544 BT_DBG("Auto-accept of user confirmation with %ums delay",
2545 hdev->auto_accept_delay);
2546
2547 if (hdev->auto_accept_delay > 0) {
2548 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2549 mod_timer(&conn->auto_accept_timer, jiffies + delay);
2550 goto unlock;
2551 }
2552
2553 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2554 sizeof(ev->bdaddr), &ev->bdaddr);
2555 goto unlock;
2556 }
2557
2558 confirm:
2559 mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
2560 confirm_hint);
2561
2562 unlock:
2563 hci_dev_unlock(hdev);
2564 }
2565
2566 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2567 {
2568 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2569 struct hci_conn *conn;
2570
2571 BT_DBG("%s", hdev->name);
2572
2573 hci_dev_lock(hdev);
2574
2575 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2576 if (!conn)
2577 goto unlock;
2578
2579 /* To avoid duplicate auth_failed events to user space we check
2580 * the HCI_CONN_AUTH_PEND flag which will be set if we
2581 * initiated the authentication. A traditional auth_complete
2582 * event gets always produced as initiator and is also mapped to
2583 * the mgmt_auth_failed event */
2584 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2585 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
2586
2587 hci_conn_put(conn);
2588
2589 unlock:
2590 hci_dev_unlock(hdev);
2591 }
2592
2593 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2594 {
2595 struct hci_ev_remote_host_features *ev = (void *) skb->data;
2596 struct inquiry_entry *ie;
2597
2598 BT_DBG("%s", hdev->name);
2599
2600 hci_dev_lock(hdev);
2601
2602 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2603 if (ie)
2604 ie->data.ssp_mode = (ev->features[0] & 0x01);
2605
2606 hci_dev_unlock(hdev);
2607 }
2608
2609 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2610 struct sk_buff *skb)
2611 {
2612 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2613 struct oob_data *data;
2614
2615 BT_DBG("%s", hdev->name);
2616
2617 hci_dev_lock(hdev);
2618
2619 if (!test_bit(HCI_MGMT, &hdev->flags))
2620 goto unlock;
2621
2622 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2623 if (data) {
2624 struct hci_cp_remote_oob_data_reply cp;
2625
2626 bacpy(&cp.bdaddr, &ev->bdaddr);
2627 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2628 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2629
2630 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2631 &cp);
2632 } else {
2633 struct hci_cp_remote_oob_data_neg_reply cp;
2634
2635 bacpy(&cp.bdaddr, &ev->bdaddr);
2636 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2637 &cp);
2638 }
2639
2640 unlock:
2641 hci_dev_unlock(hdev);
2642 }
2643
2644 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2645 {
2646 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2647 struct hci_conn *conn;
2648
2649 BT_DBG("%s status %d", hdev->name, ev->status);
2650
2651 hci_dev_lock(hdev);
2652
2653 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2654 if (!conn) {
2655 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2656 if (!conn) {
2657 BT_ERR("No memory for new connection");
2658 hci_dev_unlock(hdev);
2659 return;
2660 }
2661 }
2662
2663 if (ev->status) {
2664 mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
2665 hci_proto_connect_cfm(conn, ev->status);
2666 conn->state = BT_CLOSED;
2667 hci_conn_del(conn);
2668 goto unlock;
2669 }
2670
2671 mgmt_connected(hdev->id, &ev->bdaddr);
2672
2673 conn->handle = __le16_to_cpu(ev->handle);
2674 conn->state = BT_CONNECTED;
2675
2676 hci_conn_hold_device(conn);
2677 hci_conn_add_sysfs(conn);
2678
2679 hci_proto_connect_cfm(conn, ev->status);
2680
2681 unlock:
2682 hci_dev_unlock(hdev);
2683 }
2684
2685 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2686 {
2687 struct hci_ev_le_meta *le_ev = (void *) skb->data;
2688
2689 skb_pull(skb, sizeof(*le_ev));
2690
2691 switch (le_ev->subevent) {
2692 case HCI_EV_LE_CONN_COMPLETE:
2693 hci_le_conn_complete_evt(hdev, skb);
2694 break;
2695
2696 default:
2697 break;
2698 }
2699 }
2700
2701 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2702 {
2703 struct hci_event_hdr *hdr = (void *) skb->data;
2704 __u8 event = hdr->evt;
2705
2706 skb_pull(skb, HCI_EVENT_HDR_SIZE);
2707
2708 switch (event) {
2709 case HCI_EV_INQUIRY_COMPLETE:
2710 hci_inquiry_complete_evt(hdev, skb);
2711 break;
2712
2713 case HCI_EV_INQUIRY_RESULT:
2714 hci_inquiry_result_evt(hdev, skb);
2715 break;
2716
2717 case HCI_EV_CONN_COMPLETE:
2718 hci_conn_complete_evt(hdev, skb);
2719 break;
2720
2721 case HCI_EV_CONN_REQUEST:
2722 hci_conn_request_evt(hdev, skb);
2723 break;
2724
2725 case HCI_EV_DISCONN_COMPLETE:
2726 hci_disconn_complete_evt(hdev, skb);
2727 break;
2728
2729 case HCI_EV_AUTH_COMPLETE:
2730 hci_auth_complete_evt(hdev, skb);
2731 break;
2732
2733 case HCI_EV_REMOTE_NAME:
2734 hci_remote_name_evt(hdev, skb);
2735 break;
2736
2737 case HCI_EV_ENCRYPT_CHANGE:
2738 hci_encrypt_change_evt(hdev, skb);
2739 break;
2740
2741 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2742 hci_change_link_key_complete_evt(hdev, skb);
2743 break;
2744
2745 case HCI_EV_REMOTE_FEATURES:
2746 hci_remote_features_evt(hdev, skb);
2747 break;
2748
2749 case HCI_EV_REMOTE_VERSION:
2750 hci_remote_version_evt(hdev, skb);
2751 break;
2752
2753 case HCI_EV_QOS_SETUP_COMPLETE:
2754 hci_qos_setup_complete_evt(hdev, skb);
2755 break;
2756
2757 case HCI_EV_CMD_COMPLETE:
2758 hci_cmd_complete_evt(hdev, skb);
2759 break;
2760
2761 case HCI_EV_CMD_STATUS:
2762 hci_cmd_status_evt(hdev, skb);
2763 break;
2764
2765 case HCI_EV_ROLE_CHANGE:
2766 hci_role_change_evt(hdev, skb);
2767 break;
2768
2769 case HCI_EV_NUM_COMP_PKTS:
2770 hci_num_comp_pkts_evt(hdev, skb);
2771 break;
2772
2773 case HCI_EV_MODE_CHANGE:
2774 hci_mode_change_evt(hdev, skb);
2775 break;
2776
2777 case HCI_EV_PIN_CODE_REQ:
2778 hci_pin_code_request_evt(hdev, skb);
2779 break;
2780
2781 case HCI_EV_LINK_KEY_REQ:
2782 hci_link_key_request_evt(hdev, skb);
2783 break;
2784
2785 case HCI_EV_LINK_KEY_NOTIFY:
2786 hci_link_key_notify_evt(hdev, skb);
2787 break;
2788
2789 case HCI_EV_CLOCK_OFFSET:
2790 hci_clock_offset_evt(hdev, skb);
2791 break;
2792
2793 case HCI_EV_PKT_TYPE_CHANGE:
2794 hci_pkt_type_change_evt(hdev, skb);
2795 break;
2796
2797 case HCI_EV_PSCAN_REP_MODE:
2798 hci_pscan_rep_mode_evt(hdev, skb);
2799 break;
2800
2801 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2802 hci_inquiry_result_with_rssi_evt(hdev, skb);
2803 break;
2804
2805 case HCI_EV_REMOTE_EXT_FEATURES:
2806 hci_remote_ext_features_evt(hdev, skb);
2807 break;
2808
2809 case HCI_EV_SYNC_CONN_COMPLETE:
2810 hci_sync_conn_complete_evt(hdev, skb);
2811 break;
2812
2813 case HCI_EV_SYNC_CONN_CHANGED:
2814 hci_sync_conn_changed_evt(hdev, skb);
2815 break;
2816
2817 case HCI_EV_SNIFF_SUBRATE:
2818 hci_sniff_subrate_evt(hdev, skb);
2819 break;
2820
2821 case HCI_EV_EXTENDED_INQUIRY_RESULT:
2822 hci_extended_inquiry_result_evt(hdev, skb);
2823 break;
2824
2825 case HCI_EV_IO_CAPA_REQUEST:
2826 hci_io_capa_request_evt(hdev, skb);
2827 break;
2828
2829 case HCI_EV_IO_CAPA_REPLY:
2830 hci_io_capa_reply_evt(hdev, skb);
2831 break;
2832
2833 case HCI_EV_USER_CONFIRM_REQUEST:
2834 hci_user_confirm_request_evt(hdev, skb);
2835 break;
2836
2837 case HCI_EV_SIMPLE_PAIR_COMPLETE:
2838 hci_simple_pair_complete_evt(hdev, skb);
2839 break;
2840
2841 case HCI_EV_REMOTE_HOST_FEATURES:
2842 hci_remote_host_features_evt(hdev, skb);
2843 break;
2844
2845 case HCI_EV_LE_META:
2846 hci_le_meta_evt(hdev, skb);
2847 break;
2848
2849 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
2850 hci_remote_oob_data_request_evt(hdev, skb);
2851 break;
2852
2853 default:
2854 BT_DBG("%s event 0x%x", hdev->name, event);
2855 break;
2856 }
2857
2858 kfree_skb(skb);
2859 hdev->stat.evt_rx++;
2860 }
2861
2862 /* Generate internal stack event */
2863 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2864 {
2865 struct hci_event_hdr *hdr;
2866 struct hci_ev_stack_internal *ev;
2867 struct sk_buff *skb;
2868
2869 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2870 if (!skb)
2871 return;
2872
2873 hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2874 hdr->evt = HCI_EV_STACK_INTERNAL;
2875 hdr->plen = sizeof(*ev) + dlen;
2876
2877 ev = (void *) skb_put(skb, sizeof(*ev) + dlen);
2878 ev->type = type;
2879 memcpy(ev->data, data, dlen);
2880
2881 bt_cb(skb)->incoming = 1;
2882 __net_timestamp(skb);
2883
2884 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
2885 skb->dev = (void *) hdev;
2886 hci_send_to_sock(hdev, skb, NULL);
2887 kfree_skb(skb);
2888 }
linux-next