?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
mm/zsmalloc: allocate exactly size of struct zs_pool
[linux/fpc-iii.git] / net / bluetooth / hci_event.c
blob322abbbbcef991a36adaaf0750c723ceebba3147
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI event handling. */
26
27 #include <asm/unaligned.h>
28
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "a2mp.h"
34 #include "amp.h"
35 #include "smp.h"
36
37 /* Handle HCI Event packets */
38
39 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
40 {
41 __u8 status = *((__u8 *) skb->data);
42
43 BT_DBG("%s status 0x%2.2x", hdev->name, status);
44
45 if (status)
46 return;
47
48 clear_bit(HCI_INQUIRY, &hdev->flags);
49 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
50 wake_up_bit(&hdev->flags, HCI_INQUIRY);
51
52 hci_dev_lock(hdev);
53 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
54 hci_dev_unlock(hdev);
55
56 hci_conn_check_pending(hdev);
57 }
58
59 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
60 {
61 __u8 status = *((__u8 *) skb->data);
62
63 BT_DBG("%s status 0x%2.2x", hdev->name, status);
64
65 if (status)
66 return;
67
68 set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
69 }
70
71 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
72 {
73 __u8 status = *((__u8 *) skb->data);
74
75 BT_DBG("%s status 0x%2.2x", hdev->name, status);
76
77 if (status)
78 return;
79
80 clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
81
82 hci_conn_check_pending(hdev);
83 }
84
85 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
86 struct sk_buff *skb)
87 {
88 BT_DBG("%s", hdev->name);
89 }
90
91 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
92 {
93 struct hci_rp_role_discovery *rp = (void *) skb->data;
94 struct hci_conn *conn;
95
96 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
97
98 if (rp->status)
99 return;
100
101 hci_dev_lock(hdev);
102
103 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
104 if (conn)
105 conn->role = rp->role;
106
107 hci_dev_unlock(hdev);
108 }
109
110 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
111 {
112 struct hci_rp_read_link_policy *rp = (void *) skb->data;
113 struct hci_conn *conn;
114
115 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
116
117 if (rp->status)
118 return;
119
120 hci_dev_lock(hdev);
121
122 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
123 if (conn)
124 conn->link_policy = __le16_to_cpu(rp->policy);
125
126 hci_dev_unlock(hdev);
127 }
128
129 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
130 {
131 struct hci_rp_write_link_policy *rp = (void *) skb->data;
132 struct hci_conn *conn;
133 void *sent;
134
135 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
136
137 if (rp->status)
138 return;
139
140 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
141 if (!sent)
142 return;
143
144 hci_dev_lock(hdev);
145
146 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
147 if (conn)
148 conn->link_policy = get_unaligned_le16(sent + 2);
149
150 hci_dev_unlock(hdev);
151 }
152
153 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
154 struct sk_buff *skb)
155 {
156 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
157
158 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
159
160 if (rp->status)
161 return;
162
163 hdev->link_policy = __le16_to_cpu(rp->policy);
164 }
165
166 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
167 struct sk_buff *skb)
168 {
169 __u8 status = *((__u8 *) skb->data);
170 void *sent;
171
172 BT_DBG("%s status 0x%2.2x", hdev->name, status);
173
174 if (status)
175 return;
176
177 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
178 if (!sent)
179 return;
180
181 hdev->link_policy = get_unaligned_le16(sent);
182 }
183
184 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
185 {
186 __u8 status = *((__u8 *) skb->data);
187
188 BT_DBG("%s status 0x%2.2x", hdev->name, status);
189
190 clear_bit(HCI_RESET, &hdev->flags);
191
192 if (status)
193 return;
194
195 /* Reset all non-persistent flags */
196 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
197
198 hdev->discovery.state = DISCOVERY_STOPPED;
199 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
200 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
201
202 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
203 hdev->adv_data_len = 0;
204
205 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
206 hdev->scan_rsp_data_len = 0;
207
208 hdev->le_scan_type = LE_SCAN_PASSIVE;
209
210 hdev->ssp_debug_mode = 0;
211
212 hci_bdaddr_list_clear(&hdev->le_white_list);
213 }
214
215 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
216 {
217 __u8 status = *((__u8 *) skb->data);
218 void *sent;
219
220 BT_DBG("%s status 0x%2.2x", hdev->name, status);
221
222 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
223 if (!sent)
224 return;
225
226 hci_dev_lock(hdev);
227
228 if (test_bit(HCI_MGMT, &hdev->dev_flags))
229 mgmt_set_local_name_complete(hdev, sent, status);
230 else if (!status)
231 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
232
233 hci_dev_unlock(hdev);
234 }
235
236 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
237 {
238 struct hci_rp_read_local_name *rp = (void *) skb->data;
239
240 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
241
242 if (rp->status)
243 return;
244
245 if (test_bit(HCI_SETUP, &hdev->dev_flags))
246 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
247 }
248
249 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
250 {
251 __u8 status = *((__u8 *) skb->data);
252 void *sent;
253
254 BT_DBG("%s status 0x%2.2x", hdev->name, status);
255
256 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
257 if (!sent)
258 return;
259
260 if (!status) {
261 __u8 param = *((__u8 *) sent);
262
263 if (param == AUTH_ENABLED)
264 set_bit(HCI_AUTH, &hdev->flags);
265 else
266 clear_bit(HCI_AUTH, &hdev->flags);
267 }
268
269 if (test_bit(HCI_MGMT, &hdev->dev_flags))
270 mgmt_auth_enable_complete(hdev, status);
271 }
272
273 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
274 {
275 __u8 status = *((__u8 *) skb->data);
276 __u8 param;
277 void *sent;
278
279 BT_DBG("%s status 0x%2.2x", hdev->name, status);
280
281 if (status)
282 return;
283
284 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
285 if (!sent)
286 return;
287
288 param = *((__u8 *) sent);
289
290 if (param)
291 set_bit(HCI_ENCRYPT, &hdev->flags);
292 else
293 clear_bit(HCI_ENCRYPT, &hdev->flags);
294 }
295
296 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
297 {
298 __u8 status = *((__u8 *) skb->data);
299 __u8 param;
300 void *sent;
301
302 BT_DBG("%s status 0x%2.2x", hdev->name, status);
303
304 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
305 if (!sent)
306 return;
307
308 param = *((__u8 *) sent);
309
310 hci_dev_lock(hdev);
311
312 if (status) {
313 hdev->discov_timeout = 0;
314 goto done;
315 }
316
317 if (param & SCAN_INQUIRY)
318 set_bit(HCI_ISCAN, &hdev->flags);
319 else
320 clear_bit(HCI_ISCAN, &hdev->flags);
321
322 if (param & SCAN_PAGE)
323 set_bit(HCI_PSCAN, &hdev->flags);
324 else
325 clear_bit(HCI_PSCAN, &hdev->flags);
326
327 done:
328 hci_dev_unlock(hdev);
329 }
330
331 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
332 {
333 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
334
335 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
336
337 if (rp->status)
338 return;
339
340 memcpy(hdev->dev_class, rp->dev_class, 3);
341
342 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
343 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
344 }
345
346 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
347 {
348 __u8 status = *((__u8 *) skb->data);
349 void *sent;
350
351 BT_DBG("%s status 0x%2.2x", hdev->name, status);
352
353 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
354 if (!sent)
355 return;
356
357 hci_dev_lock(hdev);
358
359 if (status == 0)
360 memcpy(hdev->dev_class, sent, 3);
361
362 if (test_bit(HCI_MGMT, &hdev->dev_flags))
363 mgmt_set_class_of_dev_complete(hdev, sent, status);
364
365 hci_dev_unlock(hdev);
366 }
367
368 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
369 {
370 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
371 __u16 setting;
372
373 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
374
375 if (rp->status)
376 return;
377
378 setting = __le16_to_cpu(rp->voice_setting);
379
380 if (hdev->voice_setting == setting)
381 return;
382
383 hdev->voice_setting = setting;
384
385 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
386
387 if (hdev->notify)
388 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
389 }
390
391 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
392 struct sk_buff *skb)
393 {
394 __u8 status = *((__u8 *) skb->data);
395 __u16 setting;
396 void *sent;
397
398 BT_DBG("%s status 0x%2.2x", hdev->name, status);
399
400 if (status)
401 return;
402
403 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
404 if (!sent)
405 return;
406
407 setting = get_unaligned_le16(sent);
408
409 if (hdev->voice_setting == setting)
410 return;
411
412 hdev->voice_setting = setting;
413
414 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
415
416 if (hdev->notify)
417 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
418 }
419
420 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
421 struct sk_buff *skb)
422 {
423 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
424
425 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
426
427 if (rp->status)
428 return;
429
430 hdev->num_iac = rp->num_iac;
431
432 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
433 }
434
435 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
436 {
437 __u8 status = *((__u8 *) skb->data);
438 struct hci_cp_write_ssp_mode *sent;
439
440 BT_DBG("%s status 0x%2.2x", hdev->name, status);
441
442 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
443 if (!sent)
444 return;
445
446 if (!status) {
447 if (sent->mode)
448 hdev->features[1][0] |= LMP_HOST_SSP;
449 else
450 hdev->features[1][0] &= ~LMP_HOST_SSP;
451 }
452
453 if (test_bit(HCI_MGMT, &hdev->dev_flags))
454 mgmt_ssp_enable_complete(hdev, sent->mode, status);
455 else if (!status) {
456 if (sent->mode)
457 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
458 else
459 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
460 }
461 }
462
463 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
464 {
465 u8 status = *((u8 *) skb->data);
466 struct hci_cp_write_sc_support *sent;
467
468 BT_DBG("%s status 0x%2.2x", hdev->name, status);
469
470 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
471 if (!sent)
472 return;
473
474 if (!status) {
475 if (sent->support)
476 hdev->features[1][0] |= LMP_HOST_SC;
477 else
478 hdev->features[1][0] &= ~LMP_HOST_SC;
479 }
480
481 if (test_bit(HCI_MGMT, &hdev->dev_flags))
482 mgmt_sc_enable_complete(hdev, sent->support, status);
483 else if (!status) {
484 if (sent->support)
485 set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
486 else
487 clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
488 }
489 }
490
491 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
492 {
493 struct hci_rp_read_local_version *rp = (void *) skb->data;
494
495 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
496
497 if (rp->status)
498 return;
499
500 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
501 hdev->hci_ver = rp->hci_ver;
502 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
503 hdev->lmp_ver = rp->lmp_ver;
504 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
505 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
506 }
507 }
508
509 static void hci_cc_read_local_commands(struct hci_dev *hdev,
510 struct sk_buff *skb)
511 {
512 struct hci_rp_read_local_commands *rp = (void *) skb->data;
513
514 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
515
516 if (rp->status)
517 return;
518
519 if (test_bit(HCI_SETUP, &hdev->dev_flags))
520 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
521 }
522
523 static void hci_cc_read_local_features(struct hci_dev *hdev,
524 struct sk_buff *skb)
525 {
526 struct hci_rp_read_local_features *rp = (void *) skb->data;
527
528 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
529
530 if (rp->status)
531 return;
532
533 memcpy(hdev->features, rp->features, 8);
534
535 /* Adjust default settings according to features
536 * supported by device. */
537
538 if (hdev->features[0][0] & LMP_3SLOT)
539 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
540
541 if (hdev->features[0][0] & LMP_5SLOT)
542 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
543
544 if (hdev->features[0][1] & LMP_HV2) {
545 hdev->pkt_type |= (HCI_HV2);
546 hdev->esco_type |= (ESCO_HV2);
547 }
548
549 if (hdev->features[0][1] & LMP_HV3) {
550 hdev->pkt_type |= (HCI_HV3);
551 hdev->esco_type |= (ESCO_HV3);
552 }
553
554 if (lmp_esco_capable(hdev))
555 hdev->esco_type |= (ESCO_EV3);
556
557 if (hdev->features[0][4] & LMP_EV4)
558 hdev->esco_type |= (ESCO_EV4);
559
560 if (hdev->features[0][4] & LMP_EV5)
561 hdev->esco_type |= (ESCO_EV5);
562
563 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
564 hdev->esco_type |= (ESCO_2EV3);
565
566 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
567 hdev->esco_type |= (ESCO_3EV3);
568
569 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
570 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
571 }
572
573 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
574 struct sk_buff *skb)
575 {
576 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
577
578 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
579
580 if (rp->status)
581 return;
582
583 if (hdev->max_page < rp->max_page)
584 hdev->max_page = rp->max_page;
585
586 if (rp->page < HCI_MAX_PAGES)
587 memcpy(hdev->features[rp->page], rp->features, 8);
588 }
589
590 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
591 struct sk_buff *skb)
592 {
593 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
594
595 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
596
597 if (rp->status)
598 return;
599
600 hdev->flow_ctl_mode = rp->mode;
601 }
602
603 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
604 {
605 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
606
607 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
608
609 if (rp->status)
610 return;
611
612 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
613 hdev->sco_mtu = rp->sco_mtu;
614 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
615 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
616
617 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
618 hdev->sco_mtu = 64;
619 hdev->sco_pkts = 8;
620 }
621
622 hdev->acl_cnt = hdev->acl_pkts;
623 hdev->sco_cnt = hdev->sco_pkts;
624
625 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
626 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
627 }
628
629 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
630 {
631 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
632
633 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
634
635 if (rp->status)
636 return;
637
638 if (test_bit(HCI_INIT, &hdev->flags))
639 bacpy(&hdev->bdaddr, &rp->bdaddr);
640
641 if (test_bit(HCI_SETUP, &hdev->dev_flags))
642 bacpy(&hdev->setup_addr, &rp->bdaddr);
643 }
644
645 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
646 struct sk_buff *skb)
647 {
648 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
649
650 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
651
652 if (rp->status)
653 return;
654
655 if (test_bit(HCI_INIT, &hdev->flags)) {
656 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
657 hdev->page_scan_window = __le16_to_cpu(rp->window);
658 }
659 }
660
661 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
662 struct sk_buff *skb)
663 {
664 u8 status = *((u8 *) skb->data);
665 struct hci_cp_write_page_scan_activity *sent;
666
667 BT_DBG("%s status 0x%2.2x", hdev->name, status);
668
669 if (status)
670 return;
671
672 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
673 if (!sent)
674 return;
675
676 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
677 hdev->page_scan_window = __le16_to_cpu(sent->window);
678 }
679
680 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
681 struct sk_buff *skb)
682 {
683 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
684
685 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
686
687 if (rp->status)
688 return;
689
690 if (test_bit(HCI_INIT, &hdev->flags))
691 hdev->page_scan_type = rp->type;
692 }
693
694 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
695 struct sk_buff *skb)
696 {
697 u8 status = *((u8 *) skb->data);
698 u8 *type;
699
700 BT_DBG("%s status 0x%2.2x", hdev->name, status);
701
702 if (status)
703 return;
704
705 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
706 if (type)
707 hdev->page_scan_type = *type;
708 }
709
710 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
711 struct sk_buff *skb)
712 {
713 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
714
715 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
716
717 if (rp->status)
718 return;
719
720 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
721 hdev->block_len = __le16_to_cpu(rp->block_len);
722 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
723
724 hdev->block_cnt = hdev->num_blocks;
725
726 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
727 hdev->block_cnt, hdev->block_len);
728 }
729
730 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
731 {
732 struct hci_rp_read_clock *rp = (void *) skb->data;
733 struct hci_cp_read_clock *cp;
734 struct hci_conn *conn;
735
736 BT_DBG("%s", hdev->name);
737
738 if (skb->len < sizeof(*rp))
739 return;
740
741 if (rp->status)
742 return;
743
744 hci_dev_lock(hdev);
745
746 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
747 if (!cp)
748 goto unlock;
749
750 if (cp->which == 0x00) {
751 hdev->clock = le32_to_cpu(rp->clock);
752 goto unlock;
753 }
754
755 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
756 if (conn) {
757 conn->clock = le32_to_cpu(rp->clock);
758 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
759 }
760
761 unlock:
762 hci_dev_unlock(hdev);
763 }
764
765 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
766 struct sk_buff *skb)
767 {
768 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
769
770 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
771
772 if (rp->status)
773 goto a2mp_rsp;
774
775 hdev->amp_status = rp->amp_status;
776 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
777 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
778 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
779 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
780 hdev->amp_type = rp->amp_type;
781 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
782 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
783 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
784 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
785
786 a2mp_rsp:
787 a2mp_send_getinfo_rsp(hdev);
788 }
789
790 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
791 struct sk_buff *skb)
792 {
793 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
794 struct amp_assoc *assoc = &hdev->loc_assoc;
795 size_t rem_len, frag_len;
796
797 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
798
799 if (rp->status)
800 goto a2mp_rsp;
801
802 frag_len = skb->len - sizeof(*rp);
803 rem_len = __le16_to_cpu(rp->rem_len);
804
805 if (rem_len > frag_len) {
806 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
807
808 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
809 assoc->offset += frag_len;
810
811 /* Read other fragments */
812 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
813
814 return;
815 }
816
817 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
818 assoc->len = assoc->offset + rem_len;
819 assoc->offset = 0;
820
821 a2mp_rsp:
822 /* Send A2MP Rsp when all fragments are received */
823 a2mp_send_getampassoc_rsp(hdev, rp->status);
824 a2mp_send_create_phy_link_req(hdev, rp->status);
825 }
826
827 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
828 struct sk_buff *skb)
829 {
830 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
831
832 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
833
834 if (rp->status)
835 return;
836
837 hdev->inq_tx_power = rp->tx_power;
838 }
839
840 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
841 {
842 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
843 struct hci_cp_pin_code_reply *cp;
844 struct hci_conn *conn;
845
846 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
847
848 hci_dev_lock(hdev);
849
850 if (test_bit(HCI_MGMT, &hdev->dev_flags))
851 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
852
853 if (rp->status)
854 goto unlock;
855
856 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
857 if (!cp)
858 goto unlock;
859
860 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
861 if (conn)
862 conn->pin_length = cp->pin_len;
863
864 unlock:
865 hci_dev_unlock(hdev);
866 }
867
868 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
869 {
870 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
871
872 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
873
874 hci_dev_lock(hdev);
875
876 if (test_bit(HCI_MGMT, &hdev->dev_flags))
877 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
878 rp->status);
879
880 hci_dev_unlock(hdev);
881 }
882
883 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
884 struct sk_buff *skb)
885 {
886 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
887
888 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
889
890 if (rp->status)
891 return;
892
893 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
894 hdev->le_pkts = rp->le_max_pkt;
895
896 hdev->le_cnt = hdev->le_pkts;
897
898 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
899 }
900
901 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
902 struct sk_buff *skb)
903 {
904 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
905
906 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
907
908 if (rp->status)
909 return;
910
911 memcpy(hdev->le_features, rp->features, 8);
912 }
913
914 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
915 struct sk_buff *skb)
916 {
917 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
918
919 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
920
921 if (rp->status)
922 return;
923
924 hdev->adv_tx_power = rp->tx_power;
925 }
926
927 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
928 {
929 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
930
931 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
932
933 hci_dev_lock(hdev);
934
935 if (test_bit(HCI_MGMT, &hdev->dev_flags))
936 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
937 rp->status);
938
939 hci_dev_unlock(hdev);
940 }
941
942 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
943 struct sk_buff *skb)
944 {
945 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
946
947 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
948
949 hci_dev_lock(hdev);
950
951 if (test_bit(HCI_MGMT, &hdev->dev_flags))
952 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
953 ACL_LINK, 0, rp->status);
954
955 hci_dev_unlock(hdev);
956 }
957
958 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
959 {
960 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
961
962 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
963
964 hci_dev_lock(hdev);
965
966 if (test_bit(HCI_MGMT, &hdev->dev_flags))
967 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
968 0, rp->status);
969
970 hci_dev_unlock(hdev);
971 }
972
973 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
974 struct sk_buff *skb)
975 {
976 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
977
978 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
979
980 hci_dev_lock(hdev);
981
982 if (test_bit(HCI_MGMT, &hdev->dev_flags))
983 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
984 ACL_LINK, 0, rp->status);
985
986 hci_dev_unlock(hdev);
987 }
988
989 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
990 struct sk_buff *skb)
991 {
992 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
993
994 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
995
996 hci_dev_lock(hdev);
997 mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
998 rp->status);
999 hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1003 struct sk_buff *skb)
1004 {
1005 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1006
1007 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1008
1009 hci_dev_lock(hdev);
1010 mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1011 rp->hash256, rp->rand256,
1012 rp->status);
1013 hci_dev_unlock(hdev);
1014 }
1015
1016
1017 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1018 {
1019 __u8 status = *((__u8 *) skb->data);
1020 bdaddr_t *sent;
1021
1022 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1023
1024 if (status)
1025 return;
1026
1027 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1028 if (!sent)
1029 return;
1030
1031 hci_dev_lock(hdev);
1032
1033 bacpy(&hdev->random_addr, sent);
1034
1035 hci_dev_unlock(hdev);
1036 }
1037
1038 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1039 {
1040 __u8 *sent, status = *((__u8 *) skb->data);
1041
1042 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1043
1044 if (status)
1045 return;
1046
1047 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1048 if (!sent)
1049 return;
1050
1051 hci_dev_lock(hdev);
1052
1053 /* If we're doing connection initiation as peripheral. Set a
1054 * timeout in case something goes wrong.
1055 */
1056 if (*sent) {
1057 struct hci_conn *conn;
1058
1059 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1060
1061 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1062 if (conn)
1063 queue_delayed_work(hdev->workqueue,
1064 &conn->le_conn_timeout,
1065 conn->conn_timeout);
1066 } else {
1067 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1068 }
1069
1070 hci_dev_unlock(hdev);
1071 }
1072
1073 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1074 {
1075 struct hci_cp_le_set_scan_param *cp;
1076 __u8 status = *((__u8 *) skb->data);
1077
1078 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1079
1080 if (status)
1081 return;
1082
1083 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1084 if (!cp)
1085 return;
1086
1087 hci_dev_lock(hdev);
1088
1089 hdev->le_scan_type = cp->type;
1090
1091 hci_dev_unlock(hdev);
1092 }
1093
1094 static bool has_pending_adv_report(struct hci_dev *hdev)
1095 {
1096 struct discovery_state *d = &hdev->discovery;
1097
1098 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1099 }
1100
1101 static void clear_pending_adv_report(struct hci_dev *hdev)
1102 {
1103 struct discovery_state *d = &hdev->discovery;
1104
1105 bacpy(&d->last_adv_addr, BDADDR_ANY);
1106 d->last_adv_data_len = 0;
1107 }
1108
1109 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1110 u8 bdaddr_type, s8 rssi, u32 flags,
1111 u8 *data, u8 len)
1112 {
1113 struct discovery_state *d = &hdev->discovery;
1114
1115 bacpy(&d->last_adv_addr, bdaddr);
1116 d->last_adv_addr_type = bdaddr_type;
1117 d->last_adv_rssi = rssi;
1118 d->last_adv_flags = flags;
1119 memcpy(d->last_adv_data, data, len);
1120 d->last_adv_data_len = len;
1121 }
1122
1123 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1124 struct sk_buff *skb)
1125 {
1126 struct hci_cp_le_set_scan_enable *cp;
1127 __u8 status = *((__u8 *) skb->data);
1128
1129 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1130
1131 if (status)
1132 return;
1133
1134 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1135 if (!cp)
1136 return;
1137
1138 switch (cp->enable) {
1139 case LE_SCAN_ENABLE:
1140 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1141 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1142 clear_pending_adv_report(hdev);
1143 break;
1144
1145 case LE_SCAN_DISABLE:
1146 /* We do this here instead of when setting DISCOVERY_STOPPED
1147 * since the latter would potentially require waiting for
1148 * inquiry to stop too.
1149 */
1150 if (has_pending_adv_report(hdev)) {
1151 struct discovery_state *d = &hdev->discovery;
1152
1153 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1154 d->last_adv_addr_type, NULL,
1155 d->last_adv_rssi, d->last_adv_flags,
1156 d->last_adv_data,
1157 d->last_adv_data_len, NULL, 0);
1158 }
1159
1160 /* Cancel this timer so that we don't try to disable scanning
1161 * when it's already disabled.
1162 */
1163 cancel_delayed_work(&hdev->le_scan_disable);
1164
1165 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1166
1167 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1168 * interrupted scanning due to a connect request. Mark
1169 * therefore discovery as stopped. If this was not
1170 * because of a connect request advertising might have
1171 * been disabled because of active scanning, so
1172 * re-enable it again if necessary.
1173 */
1174 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1175 &hdev->dev_flags))
1176 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1177 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
1178 hdev->discovery.state == DISCOVERY_FINDING)
1179 mgmt_reenable_advertising(hdev);
1180
1181 break;
1182
1183 default:
1184 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1185 break;
1186 }
1187 }
1188
1189 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1190 struct sk_buff *skb)
1191 {
1192 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1193
1194 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1195
1196 if (rp->status)
1197 return;
1198
1199 hdev->le_white_list_size = rp->size;
1200 }
1201
1202 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1203 struct sk_buff *skb)
1204 {
1205 __u8 status = *((__u8 *) skb->data);
1206
1207 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1208
1209 if (status)
1210 return;
1211
1212 hci_bdaddr_list_clear(&hdev->le_white_list);
1213 }
1214
1215 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1216 struct sk_buff *skb)
1217 {
1218 struct hci_cp_le_add_to_white_list *sent;
1219 __u8 status = *((__u8 *) skb->data);
1220
1221 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1222
1223 if (status)
1224 return;
1225
1226 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1227 if (!sent)
1228 return;
1229
1230 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1231 sent->bdaddr_type);
1232 }
1233
1234 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1235 struct sk_buff *skb)
1236 {
1237 struct hci_cp_le_del_from_white_list *sent;
1238 __u8 status = *((__u8 *) skb->data);
1239
1240 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1241
1242 if (status)
1243 return;
1244
1245 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1246 if (!sent)
1247 return;
1248
1249 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1250 sent->bdaddr_type);
1251 }
1252
1253 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1254 struct sk_buff *skb)
1255 {
1256 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1257
1258 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1259
1260 if (rp->status)
1261 return;
1262
1263 memcpy(hdev->le_states, rp->le_states, 8);
1264 }
1265
1266 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1267 struct sk_buff *skb)
1268 {
1269 struct hci_cp_write_le_host_supported *sent;
1270 __u8 status = *((__u8 *) skb->data);
1271
1272 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1273
1274 if (status)
1275 return;
1276
1277 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1278 if (!sent)
1279 return;
1280
1281 if (sent->le) {
1282 hdev->features[1][0] |= LMP_HOST_LE;
1283 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1284 } else {
1285 hdev->features[1][0] &= ~LMP_HOST_LE;
1286 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1287 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1288 }
1289
1290 if (sent->simul)
1291 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1292 else
1293 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1294 }
1295
1296 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1297 {
1298 struct hci_cp_le_set_adv_param *cp;
1299 u8 status = *((u8 *) skb->data);
1300
1301 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1302
1303 if (status)
1304 return;
1305
1306 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1307 if (!cp)
1308 return;
1309
1310 hci_dev_lock(hdev);
1311 hdev->adv_addr_type = cp->own_address_type;
1312 hci_dev_unlock(hdev);
1313 }
1314
1315 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1316 struct sk_buff *skb)
1317 {
1318 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1319
1320 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1321 hdev->name, rp->status, rp->phy_handle);
1322
1323 if (rp->status)
1324 return;
1325
1326 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1327 }
1328
1329 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1330 {
1331 struct hci_rp_read_rssi *rp = (void *) skb->data;
1332 struct hci_conn *conn;
1333
1334 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1335
1336 if (rp->status)
1337 return;
1338
1339 hci_dev_lock(hdev);
1340
1341 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1342 if (conn)
1343 conn->rssi = rp->rssi;
1344
1345 hci_dev_unlock(hdev);
1346 }
1347
1348 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1349 {
1350 struct hci_cp_read_tx_power *sent;
1351 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1352 struct hci_conn *conn;
1353
1354 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1355
1356 if (rp->status)
1357 return;
1358
1359 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1360 if (!sent)
1361 return;
1362
1363 hci_dev_lock(hdev);
1364
1365 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1366 if (!conn)
1367 goto unlock;
1368
1369 switch (sent->type) {
1370 case 0x00:
1371 conn->tx_power = rp->tx_power;
1372 break;
1373 case 0x01:
1374 conn->max_tx_power = rp->tx_power;
1375 break;
1376 }
1377
1378 unlock:
1379 hci_dev_unlock(hdev);
1380 }
1381
1382 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1383 {
1384 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1385
1386 if (status) {
1387 hci_conn_check_pending(hdev);
1388 return;
1389 }
1390
1391 set_bit(HCI_INQUIRY, &hdev->flags);
1392 }
1393
1394 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1395 {
1396 struct hci_cp_create_conn *cp;
1397 struct hci_conn *conn;
1398
1399 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1400
1401 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1402 if (!cp)
1403 return;
1404
1405 hci_dev_lock(hdev);
1406
1407 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1408
1409 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1410
1411 if (status) {
1412 if (conn && conn->state == BT_CONNECT) {
1413 if (status != 0x0c || conn->attempt > 2) {
1414 conn->state = BT_CLOSED;
1415 hci_proto_connect_cfm(conn, status);
1416 hci_conn_del(conn);
1417 } else
1418 conn->state = BT_CONNECT2;
1419 }
1420 } else {
1421 if (!conn) {
1422 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1423 HCI_ROLE_MASTER);
1424 if (!conn)
1425 BT_ERR("No memory for new connection");
1426 }
1427 }
1428
1429 hci_dev_unlock(hdev);
1430 }
1431
1432 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1433 {
1434 struct hci_cp_add_sco *cp;
1435 struct hci_conn *acl, *sco;
1436 __u16 handle;
1437
1438 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1439
1440 if (!status)
1441 return;
1442
1443 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1444 if (!cp)
1445 return;
1446
1447 handle = __le16_to_cpu(cp->handle);
1448
1449 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1450
1451 hci_dev_lock(hdev);
1452
1453 acl = hci_conn_hash_lookup_handle(hdev, handle);
1454 if (acl) {
1455 sco = acl->link;
1456 if (sco) {
1457 sco->state = BT_CLOSED;
1458
1459 hci_proto_connect_cfm(sco, status);
1460 hci_conn_del(sco);
1461 }
1462 }
1463
1464 hci_dev_unlock(hdev);
1465 }
1466
1467 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1468 {
1469 struct hci_cp_auth_requested *cp;
1470 struct hci_conn *conn;
1471
1472 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1473
1474 if (!status)
1475 return;
1476
1477 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1478 if (!cp)
1479 return;
1480
1481 hci_dev_lock(hdev);
1482
1483 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1484 if (conn) {
1485 if (conn->state == BT_CONFIG) {
1486 hci_proto_connect_cfm(conn, status);
1487 hci_conn_drop(conn);
1488 }
1489 }
1490
1491 hci_dev_unlock(hdev);
1492 }
1493
1494 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1495 {
1496 struct hci_cp_set_conn_encrypt *cp;
1497 struct hci_conn *conn;
1498
1499 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1500
1501 if (!status)
1502 return;
1503
1504 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1505 if (!cp)
1506 return;
1507
1508 hci_dev_lock(hdev);
1509
1510 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1511 if (conn) {
1512 if (conn->state == BT_CONFIG) {
1513 hci_proto_connect_cfm(conn, status);
1514 hci_conn_drop(conn);
1515 }
1516 }
1517
1518 hci_dev_unlock(hdev);
1519 }
1520
1521 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1522 struct hci_conn *conn)
1523 {
1524 if (conn->state != BT_CONFIG || !conn->out)
1525 return 0;
1526
1527 if (conn->pending_sec_level == BT_SECURITY_SDP)
1528 return 0;
1529
1530 /* Only request authentication for SSP connections or non-SSP
1531 * devices with sec_level MEDIUM or HIGH or if MITM protection
1532 * is requested.
1533 */
1534 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1535 conn->pending_sec_level != BT_SECURITY_FIPS &&
1536 conn->pending_sec_level != BT_SECURITY_HIGH &&
1537 conn->pending_sec_level != BT_SECURITY_MEDIUM)
1538 return 0;
1539
1540 return 1;
1541 }
1542
1543 static int hci_resolve_name(struct hci_dev *hdev,
1544 struct inquiry_entry *e)
1545 {
1546 struct hci_cp_remote_name_req cp;
1547
1548 memset(&cp, 0, sizeof(cp));
1549
1550 bacpy(&cp.bdaddr, &e->data.bdaddr);
1551 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1552 cp.pscan_mode = e->data.pscan_mode;
1553 cp.clock_offset = e->data.clock_offset;
1554
1555 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1556 }
1557
1558 static bool hci_resolve_next_name(struct hci_dev *hdev)
1559 {
1560 struct discovery_state *discov = &hdev->discovery;
1561 struct inquiry_entry *e;
1562
1563 if (list_empty(&discov->resolve))
1564 return false;
1565
1566 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1567 if (!e)
1568 return false;
1569
1570 if (hci_resolve_name(hdev, e) == 0) {
1571 e->name_state = NAME_PENDING;
1572 return true;
1573 }
1574
1575 return false;
1576 }
1577
1578 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1579 bdaddr_t *bdaddr, u8 *name, u8 name_len)
1580 {
1581 struct discovery_state *discov = &hdev->discovery;
1582 struct inquiry_entry *e;
1583
1584 /* Update the mgmt connected state if necessary. Be careful with
1585 * conn objects that exist but are not (yet) connected however.
1586 * Only those in BT_CONFIG or BT_CONNECTED states can be
1587 * considered connected.
1588 */
1589 if (conn &&
1590 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1591 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1592 mgmt_device_connected(hdev, conn, 0, name, name_len);
1593
1594 if (discov->state == DISCOVERY_STOPPED)
1595 return;
1596
1597 if (discov->state == DISCOVERY_STOPPING)
1598 goto discov_complete;
1599
1600 if (discov->state != DISCOVERY_RESOLVING)
1601 return;
1602
1603 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1604 /* If the device was not found in a list of found devices names of which
1605 * are pending. there is no need to continue resolving a next name as it
1606 * will be done upon receiving another Remote Name Request Complete
1607 * Event */
1608 if (!e)
1609 return;
1610
1611 list_del(&e->list);
1612 if (name) {
1613 e->name_state = NAME_KNOWN;
1614 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1615 e->data.rssi, name, name_len);
1616 } else {
1617 e->name_state = NAME_NOT_KNOWN;
1618 }
1619
1620 if (hci_resolve_next_name(hdev))
1621 return;
1622
1623 discov_complete:
1624 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1625 }
1626
1627 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1628 {
1629 struct hci_cp_remote_name_req *cp;
1630 struct hci_conn *conn;
1631
1632 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1633
1634 /* If successful wait for the name req complete event before
1635 * checking for the need to do authentication */
1636 if (!status)
1637 return;
1638
1639 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1640 if (!cp)
1641 return;
1642
1643 hci_dev_lock(hdev);
1644
1645 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1646
1647 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1648 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1649
1650 if (!conn)
1651 goto unlock;
1652
1653 if (!hci_outgoing_auth_needed(hdev, conn))
1654 goto unlock;
1655
1656 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1657 struct hci_cp_auth_requested auth_cp;
1658
1659 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1660
1661 auth_cp.handle = __cpu_to_le16(conn->handle);
1662 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1663 sizeof(auth_cp), &auth_cp);
1664 }
1665
1666 unlock:
1667 hci_dev_unlock(hdev);
1668 }
1669
1670 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1671 {
1672 struct hci_cp_read_remote_features *cp;
1673 struct hci_conn *conn;
1674
1675 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1676
1677 if (!status)
1678 return;
1679
1680 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1681 if (!cp)
1682 return;
1683
1684 hci_dev_lock(hdev);
1685
1686 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1687 if (conn) {
1688 if (conn->state == BT_CONFIG) {
1689 hci_proto_connect_cfm(conn, status);
1690 hci_conn_drop(conn);
1691 }
1692 }
1693
1694 hci_dev_unlock(hdev);
1695 }
1696
1697 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1698 {
1699 struct hci_cp_read_remote_ext_features *cp;
1700 struct hci_conn *conn;
1701
1702 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1703
1704 if (!status)
1705 return;
1706
1707 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1708 if (!cp)
1709 return;
1710
1711 hci_dev_lock(hdev);
1712
1713 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1714 if (conn) {
1715 if (conn->state == BT_CONFIG) {
1716 hci_proto_connect_cfm(conn, status);
1717 hci_conn_drop(conn);
1718 }
1719 }
1720
1721 hci_dev_unlock(hdev);
1722 }
1723
1724 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1725 {
1726 struct hci_cp_setup_sync_conn *cp;
1727 struct hci_conn *acl, *sco;
1728 __u16 handle;
1729
1730 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1731
1732 if (!status)
1733 return;
1734
1735 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1736 if (!cp)
1737 return;
1738
1739 handle = __le16_to_cpu(cp->handle);
1740
1741 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1742
1743 hci_dev_lock(hdev);
1744
1745 acl = hci_conn_hash_lookup_handle(hdev, handle);
1746 if (acl) {
1747 sco = acl->link;
1748 if (sco) {
1749 sco->state = BT_CLOSED;
1750
1751 hci_proto_connect_cfm(sco, status);
1752 hci_conn_del(sco);
1753 }
1754 }
1755
1756 hci_dev_unlock(hdev);
1757 }
1758
1759 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1760 {
1761 struct hci_cp_sniff_mode *cp;
1762 struct hci_conn *conn;
1763
1764 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1765
1766 if (!status)
1767 return;
1768
1769 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1770 if (!cp)
1771 return;
1772
1773 hci_dev_lock(hdev);
1774
1775 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1776 if (conn) {
1777 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1778
1779 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1780 hci_sco_setup(conn, status);
1781 }
1782
1783 hci_dev_unlock(hdev);
1784 }
1785
1786 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1787 {
1788 struct hci_cp_exit_sniff_mode *cp;
1789 struct hci_conn *conn;
1790
1791 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1792
1793 if (!status)
1794 return;
1795
1796 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1797 if (!cp)
1798 return;
1799
1800 hci_dev_lock(hdev);
1801
1802 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1803 if (conn) {
1804 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1805
1806 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1807 hci_sco_setup(conn, status);
1808 }
1809
1810 hci_dev_unlock(hdev);
1811 }
1812
1813 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1814 {
1815 struct hci_cp_disconnect *cp;
1816 struct hci_conn *conn;
1817
1818 if (!status)
1819 return;
1820
1821 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1822 if (!cp)
1823 return;
1824
1825 hci_dev_lock(hdev);
1826
1827 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1828 if (conn)
1829 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1830 conn->dst_type, status);
1831
1832 hci_dev_unlock(hdev);
1833 }
1834
1835 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1836 {
1837 struct hci_cp_create_phy_link *cp;
1838
1839 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1840
1841 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1842 if (!cp)
1843 return;
1844
1845 hci_dev_lock(hdev);
1846
1847 if (status) {
1848 struct hci_conn *hcon;
1849
1850 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1851 if (hcon)
1852 hci_conn_del(hcon);
1853 } else {
1854 amp_write_remote_assoc(hdev, cp->phy_handle);
1855 }
1856
1857 hci_dev_unlock(hdev);
1858 }
1859
1860 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1861 {
1862 struct hci_cp_accept_phy_link *cp;
1863
1864 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1865
1866 if (status)
1867 return;
1868
1869 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1870 if (!cp)
1871 return;
1872
1873 amp_write_remote_assoc(hdev, cp->phy_handle);
1874 }
1875
1876 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1877 {
1878 struct hci_cp_le_create_conn *cp;
1879 struct hci_conn *conn;
1880
1881 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1882
1883 /* All connection failure handling is taken care of by the
1884 * hci_le_conn_failed function which is triggered by the HCI
1885 * request completion callbacks used for connecting.
1886 */
1887 if (status)
1888 return;
1889
1890 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1891 if (!cp)
1892 return;
1893
1894 hci_dev_lock(hdev);
1895
1896 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1897 if (!conn)
1898 goto unlock;
1899
1900 /* Store the initiator and responder address information which
1901 * is needed for SMP. These values will not change during the
1902 * lifetime of the connection.
1903 */
1904 conn->init_addr_type = cp->own_address_type;
1905 if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1906 bacpy(&conn->init_addr, &hdev->random_addr);
1907 else
1908 bacpy(&conn->init_addr, &hdev->bdaddr);
1909
1910 conn->resp_addr_type = cp->peer_addr_type;
1911 bacpy(&conn->resp_addr, &cp->peer_addr);
1912
1913 /* We don't want the connection attempt to stick around
1914 * indefinitely since LE doesn't have a page timeout concept
1915 * like BR/EDR. Set a timer for any connection that doesn't use
1916 * the white list for connecting.
1917 */
1918 if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1919 queue_delayed_work(conn->hdev->workqueue,
1920 &conn->le_conn_timeout,
1921 conn->conn_timeout);
1922
1923 unlock:
1924 hci_dev_unlock(hdev);
1925 }
1926
1927 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1928 {
1929 struct hci_cp_le_start_enc *cp;
1930 struct hci_conn *conn;
1931
1932 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1933
1934 if (!status)
1935 return;
1936
1937 hci_dev_lock(hdev);
1938
1939 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
1940 if (!cp)
1941 goto unlock;
1942
1943 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1944 if (!conn)
1945 goto unlock;
1946
1947 if (conn->state != BT_CONNECTED)
1948 goto unlock;
1949
1950 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1951 hci_conn_drop(conn);
1952
1953 unlock:
1954 hci_dev_unlock(hdev);
1955 }
1956
1957 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
1958 {
1959 struct hci_cp_switch_role *cp;
1960 struct hci_conn *conn;
1961
1962 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1963
1964 if (!status)
1965 return;
1966
1967 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
1968 if (!cp)
1969 return;
1970
1971 hci_dev_lock(hdev);
1972
1973 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1974 if (conn)
1975 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
1976
1977 hci_dev_unlock(hdev);
1978 }
1979
1980 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1981 {
1982 __u8 status = *((__u8 *) skb->data);
1983 struct discovery_state *discov = &hdev->discovery;
1984 struct inquiry_entry *e;
1985
1986 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1987
1988 hci_conn_check_pending(hdev);
1989
1990 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1991 return;
1992
1993 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
1994 wake_up_bit(&hdev->flags, HCI_INQUIRY);
1995
1996 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1997 return;
1998
1999 hci_dev_lock(hdev);
2000
2001 if (discov->state != DISCOVERY_FINDING)
2002 goto unlock;
2003
2004 if (list_empty(&discov->resolve)) {
2005 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2006 goto unlock;
2007 }
2008
2009 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2010 if (e && hci_resolve_name(hdev, e) == 0) {
2011 e->name_state = NAME_PENDING;
2012 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2013 } else {
2014 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2015 }
2016
2017 unlock:
2018 hci_dev_unlock(hdev);
2019 }
2020
2021 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2022 {
2023 struct inquiry_data data;
2024 struct inquiry_info *info = (void *) (skb->data + 1);
2025 int num_rsp = *((__u8 *) skb->data);
2026
2027 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2028
2029 if (!num_rsp)
2030 return;
2031
2032 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2033 return;
2034
2035 hci_dev_lock(hdev);
2036
2037 for (; num_rsp; num_rsp--, info++) {
2038 u32 flags;
2039
2040 bacpy(&data.bdaddr, &info->bdaddr);
2041 data.pscan_rep_mode = info->pscan_rep_mode;
2042 data.pscan_period_mode = info->pscan_period_mode;
2043 data.pscan_mode = info->pscan_mode;
2044 memcpy(data.dev_class, info->dev_class, 3);
2045 data.clock_offset = info->clock_offset;
2046 data.rssi = HCI_RSSI_INVALID;
2047 data.ssp_mode = 0x00;
2048
2049 flags = hci_inquiry_cache_update(hdev, &data, false);
2050
2051 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2052 info->dev_class, HCI_RSSI_INVALID,
2053 flags, NULL, 0, NULL, 0);
2054 }
2055
2056 hci_dev_unlock(hdev);
2057 }
2058
2059 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2060 {
2061 struct hci_ev_conn_complete *ev = (void *) skb->data;
2062 struct hci_conn *conn;
2063
2064 BT_DBG("%s", hdev->name);
2065
2066 hci_dev_lock(hdev);
2067
2068 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2069 if (!conn) {
2070 if (ev->link_type != SCO_LINK)
2071 goto unlock;
2072
2073 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2074 if (!conn)
2075 goto unlock;
2076
2077 conn->type = SCO_LINK;
2078 }
2079
2080 if (!ev->status) {
2081 conn->handle = __le16_to_cpu(ev->handle);
2082
2083 if (conn->type == ACL_LINK) {
2084 conn->state = BT_CONFIG;
2085 hci_conn_hold(conn);
2086
2087 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2088 !hci_find_link_key(hdev, &ev->bdaddr))
2089 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2090 else
2091 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2092 } else
2093 conn->state = BT_CONNECTED;
2094
2095 hci_conn_add_sysfs(conn);
2096
2097 if (test_bit(HCI_AUTH, &hdev->flags))
2098 set_bit(HCI_CONN_AUTH, &conn->flags);
2099
2100 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2101 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2102
2103 /* Get remote features */
2104 if (conn->type == ACL_LINK) {
2105 struct hci_cp_read_remote_features cp;
2106 cp.handle = ev->handle;
2107 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2108 sizeof(cp), &cp);
2109
2110 hci_update_page_scan(hdev, NULL);
2111 }
2112
2113 /* Set packet type for incoming connection */
2114 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2115 struct hci_cp_change_conn_ptype cp;
2116 cp.handle = ev->handle;
2117 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2118 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2119 &cp);
2120 }
2121 } else {
2122 conn->state = BT_CLOSED;
2123 if (conn->type == ACL_LINK)
2124 mgmt_connect_failed(hdev, &conn->dst, conn->type,
2125 conn->dst_type, ev->status);
2126 }
2127
2128 if (conn->type == ACL_LINK)
2129 hci_sco_setup(conn, ev->status);
2130
2131 if (ev->status) {
2132 hci_proto_connect_cfm(conn, ev->status);
2133 hci_conn_del(conn);
2134 } else if (ev->link_type != ACL_LINK)
2135 hci_proto_connect_cfm(conn, ev->status);
2136
2137 unlock:
2138 hci_dev_unlock(hdev);
2139
2140 hci_conn_check_pending(hdev);
2141 }
2142
2143 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2144 {
2145 struct hci_cp_reject_conn_req cp;
2146
2147 bacpy(&cp.bdaddr, bdaddr);
2148 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2149 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2150 }
2151
2152 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2153 {
2154 struct hci_ev_conn_request *ev = (void *) skb->data;
2155 int mask = hdev->link_mode;
2156 struct inquiry_entry *ie;
2157 struct hci_conn *conn;
2158 __u8 flags = 0;
2159
2160 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2161 ev->link_type);
2162
2163 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2164 &flags);
2165
2166 if (!(mask & HCI_LM_ACCEPT)) {
2167 hci_reject_conn(hdev, &ev->bdaddr);
2168 return;
2169 }
2170
2171 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2172 BDADDR_BREDR)) {
2173 hci_reject_conn(hdev, &ev->bdaddr);
2174 return;
2175 }
2176
2177 if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2178 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2179 BDADDR_BREDR)) {
2180 hci_reject_conn(hdev, &ev->bdaddr);
2181 return;
2182 }
2183
2184 /* Connection accepted */
2185
2186 hci_dev_lock(hdev);
2187
2188 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2189 if (ie)
2190 memcpy(ie->data.dev_class, ev->dev_class, 3);
2191
2192 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2193 &ev->bdaddr);
2194 if (!conn) {
2195 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2196 HCI_ROLE_SLAVE);
2197 if (!conn) {
2198 BT_ERR("No memory for new connection");
2199 hci_dev_unlock(hdev);
2200 return;
2201 }
2202 }
2203
2204 memcpy(conn->dev_class, ev->dev_class, 3);
2205
2206 hci_dev_unlock(hdev);
2207
2208 if (ev->link_type == ACL_LINK ||
2209 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2210 struct hci_cp_accept_conn_req cp;
2211 conn->state = BT_CONNECT;
2212
2213 bacpy(&cp.bdaddr, &ev->bdaddr);
2214
2215 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2216 cp.role = 0x00; /* Become master */
2217 else
2218 cp.role = 0x01; /* Remain slave */
2219
2220 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2221 } else if (!(flags & HCI_PROTO_DEFER)) {
2222 struct hci_cp_accept_sync_conn_req cp;
2223 conn->state = BT_CONNECT;
2224
2225 bacpy(&cp.bdaddr, &ev->bdaddr);
2226 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2227
2228 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2229 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2230 cp.max_latency = cpu_to_le16(0xffff);
2231 cp.content_format = cpu_to_le16(hdev->voice_setting);
2232 cp.retrans_effort = 0xff;
2233
2234 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2235 &cp);
2236 } else {
2237 conn->state = BT_CONNECT2;
2238 hci_proto_connect_cfm(conn, 0);
2239 }
2240 }
2241
2242 static u8 hci_to_mgmt_reason(u8 err)
2243 {
2244 switch (err) {
2245 case HCI_ERROR_CONNECTION_TIMEOUT:
2246 return MGMT_DEV_DISCONN_TIMEOUT;
2247 case HCI_ERROR_REMOTE_USER_TERM:
2248 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2249 case HCI_ERROR_REMOTE_POWER_OFF:
2250 return MGMT_DEV_DISCONN_REMOTE;
2251 case HCI_ERROR_LOCAL_HOST_TERM:
2252 return MGMT_DEV_DISCONN_LOCAL_HOST;
2253 default:
2254 return MGMT_DEV_DISCONN_UNKNOWN;
2255 }
2256 }
2257
2258 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2259 {
2260 struct hci_ev_disconn_complete *ev = (void *) skb->data;
2261 u8 reason = hci_to_mgmt_reason(ev->reason);
2262 struct hci_conn_params *params;
2263 struct hci_conn *conn;
2264 bool mgmt_connected;
2265 u8 type;
2266
2267 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2268
2269 hci_dev_lock(hdev);
2270
2271 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2272 if (!conn)
2273 goto unlock;
2274
2275 if (ev->status) {
2276 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2277 conn->dst_type, ev->status);
2278 goto unlock;
2279 }
2280
2281 conn->state = BT_CLOSED;
2282
2283 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2284 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2285 reason, mgmt_connected);
2286
2287 if (conn->type == ACL_LINK) {
2288 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2289 hci_remove_link_key(hdev, &conn->dst);
2290
2291 hci_update_page_scan(hdev, NULL);
2292 }
2293
2294 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2295 if (params) {
2296 switch (params->auto_connect) {
2297 case HCI_AUTO_CONN_LINK_LOSS:
2298 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2299 break;
2300 /* Fall through */
2301
2302 case HCI_AUTO_CONN_DIRECT:
2303 case HCI_AUTO_CONN_ALWAYS:
2304 list_del_init(&params->action);
2305 list_add(&params->action, &hdev->pend_le_conns);
2306 hci_update_background_scan(hdev);
2307 break;
2308
2309 default:
2310 break;
2311 }
2312 }
2313
2314 type = conn->type;
2315
2316 hci_proto_disconn_cfm(conn, ev->reason);
2317 hci_conn_del(conn);
2318
2319 /* Re-enable advertising if necessary, since it might
2320 * have been disabled by the connection. From the
2321 * HCI_LE_Set_Advertise_Enable command description in
2322 * the core specification (v4.0):
2323 * "The Controller shall continue advertising until the Host
2324 * issues an LE_Set_Advertise_Enable command with
2325 * Advertising_Enable set to 0x00 (Advertising is disabled)
2326 * or until a connection is created or until the Advertising
2327 * is timed out due to Directed Advertising."
2328 */
2329 if (type == LE_LINK)
2330 mgmt_reenable_advertising(hdev);
2331
2332 unlock:
2333 hci_dev_unlock(hdev);
2334 }
2335
2336 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2337 {
2338 struct hci_ev_auth_complete *ev = (void *) skb->data;
2339 struct hci_conn *conn;
2340
2341 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2342
2343 hci_dev_lock(hdev);
2344
2345 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2346 if (!conn)
2347 goto unlock;
2348
2349 if (!ev->status) {
2350 if (!hci_conn_ssp_enabled(conn) &&
2351 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2352 BT_INFO("re-auth of legacy device is not possible.");
2353 } else {
2354 set_bit(HCI_CONN_AUTH, &conn->flags);
2355 conn->sec_level = conn->pending_sec_level;
2356 }
2357 } else {
2358 mgmt_auth_failed(conn, ev->status);
2359 }
2360
2361 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2362 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2363
2364 if (conn->state == BT_CONFIG) {
2365 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2366 struct hci_cp_set_conn_encrypt cp;
2367 cp.handle = ev->handle;
2368 cp.encrypt = 0x01;
2369 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2370 &cp);
2371 } else {
2372 conn->state = BT_CONNECTED;
2373 hci_proto_connect_cfm(conn, ev->status);
2374 hci_conn_drop(conn);
2375 }
2376 } else {
2377 hci_auth_cfm(conn, ev->status);
2378
2379 hci_conn_hold(conn);
2380 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2381 hci_conn_drop(conn);
2382 }
2383
2384 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2385 if (!ev->status) {
2386 struct hci_cp_set_conn_encrypt cp;
2387 cp.handle = ev->handle;
2388 cp.encrypt = 0x01;
2389 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2390 &cp);
2391 } else {
2392 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2393 hci_encrypt_cfm(conn, ev->status, 0x00);
2394 }
2395 }
2396
2397 unlock:
2398 hci_dev_unlock(hdev);
2399 }
2400
2401 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2402 {
2403 struct hci_ev_remote_name *ev = (void *) skb->data;
2404 struct hci_conn *conn;
2405
2406 BT_DBG("%s", hdev->name);
2407
2408 hci_conn_check_pending(hdev);
2409
2410 hci_dev_lock(hdev);
2411
2412 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2413
2414 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2415 goto check_auth;
2416
2417 if (ev->status == 0)
2418 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2419 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2420 else
2421 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2422
2423 check_auth:
2424 if (!conn)
2425 goto unlock;
2426
2427 if (!hci_outgoing_auth_needed(hdev, conn))
2428 goto unlock;
2429
2430 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2431 struct hci_cp_auth_requested cp;
2432
2433 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2434
2435 cp.handle = __cpu_to_le16(conn->handle);
2436 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2437 }
2438
2439 unlock:
2440 hci_dev_unlock(hdev);
2441 }
2442
2443 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2444 {
2445 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2446 struct hci_conn *conn;
2447
2448 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2449
2450 hci_dev_lock(hdev);
2451
2452 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2453 if (!conn)
2454 goto unlock;
2455
2456 if (!ev->status) {
2457 if (ev->encrypt) {
2458 /* Encryption implies authentication */
2459 set_bit(HCI_CONN_AUTH, &conn->flags);
2460 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2461 conn->sec_level = conn->pending_sec_level;
2462
2463 /* P-256 authentication key implies FIPS */
2464 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2465 set_bit(HCI_CONN_FIPS, &conn->flags);
2466
2467 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2468 conn->type == LE_LINK)
2469 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2470 } else {
2471 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2472 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2473 }
2474 }
2475
2476 /* We should disregard the current RPA and generate a new one
2477 * whenever the encryption procedure fails.
2478 */
2479 if (ev->status && conn->type == LE_LINK)
2480 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2481
2482 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2483
2484 if (ev->status && conn->state == BT_CONNECTED) {
2485 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2486 hci_conn_drop(conn);
2487 goto unlock;
2488 }
2489
2490 if (conn->state == BT_CONFIG) {
2491 if (!ev->status)
2492 conn->state = BT_CONNECTED;
2493
2494 /* In Secure Connections Only mode, do not allow any
2495 * connections that are not encrypted with AES-CCM
2496 * using a P-256 authenticated combination key.
2497 */
2498 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2499 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2500 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2501 hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2502 hci_conn_drop(conn);
2503 goto unlock;
2504 }
2505
2506 hci_proto_connect_cfm(conn, ev->status);
2507 hci_conn_drop(conn);
2508 } else
2509 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2510
2511 unlock:
2512 hci_dev_unlock(hdev);
2513 }
2514
2515 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2516 struct sk_buff *skb)
2517 {
2518 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2519 struct hci_conn *conn;
2520
2521 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2522
2523 hci_dev_lock(hdev);
2524
2525 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2526 if (conn) {
2527 if (!ev->status)
2528 set_bit(HCI_CONN_SECURE, &conn->flags);
2529
2530 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2531
2532 hci_key_change_cfm(conn, ev->status);
2533 }
2534
2535 hci_dev_unlock(hdev);
2536 }
2537
2538 static void hci_remote_features_evt(struct hci_dev *hdev,
2539 struct sk_buff *skb)
2540 {
2541 struct hci_ev_remote_features *ev = (void *) skb->data;
2542 struct hci_conn *conn;
2543
2544 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2545
2546 hci_dev_lock(hdev);
2547
2548 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2549 if (!conn)
2550 goto unlock;
2551
2552 if (!ev->status)
2553 memcpy(conn->features[0], ev->features, 8);
2554
2555 if (conn->state != BT_CONFIG)
2556 goto unlock;
2557
2558 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2559 struct hci_cp_read_remote_ext_features cp;
2560 cp.handle = ev->handle;
2561 cp.page = 0x01;
2562 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2563 sizeof(cp), &cp);
2564 goto unlock;
2565 }
2566
2567 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2568 struct hci_cp_remote_name_req cp;
2569 memset(&cp, 0, sizeof(cp));
2570 bacpy(&cp.bdaddr, &conn->dst);
2571 cp.pscan_rep_mode = 0x02;
2572 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2573 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2574 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2575
2576 if (!hci_outgoing_auth_needed(hdev, conn)) {
2577 conn->state = BT_CONNECTED;
2578 hci_proto_connect_cfm(conn, ev->status);
2579 hci_conn_drop(conn);
2580 }
2581
2582 unlock:
2583 hci_dev_unlock(hdev);
2584 }
2585
2586 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2587 {
2588 struct hci_ev_cmd_complete *ev = (void *) skb->data;
2589 u8 status = skb->data[sizeof(*ev)];
2590 __u16 opcode;
2591
2592 skb_pull(skb, sizeof(*ev));
2593
2594 opcode = __le16_to_cpu(ev->opcode);
2595
2596 switch (opcode) {
2597 case HCI_OP_INQUIRY_CANCEL:
2598 hci_cc_inquiry_cancel(hdev, skb);
2599 break;
2600
2601 case HCI_OP_PERIODIC_INQ:
2602 hci_cc_periodic_inq(hdev, skb);
2603 break;
2604
2605 case HCI_OP_EXIT_PERIODIC_INQ:
2606 hci_cc_exit_periodic_inq(hdev, skb);
2607 break;
2608
2609 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2610 hci_cc_remote_name_req_cancel(hdev, skb);
2611 break;
2612
2613 case HCI_OP_ROLE_DISCOVERY:
2614 hci_cc_role_discovery(hdev, skb);
2615 break;
2616
2617 case HCI_OP_READ_LINK_POLICY:
2618 hci_cc_read_link_policy(hdev, skb);
2619 break;
2620
2621 case HCI_OP_WRITE_LINK_POLICY:
2622 hci_cc_write_link_policy(hdev, skb);
2623 break;
2624
2625 case HCI_OP_READ_DEF_LINK_POLICY:
2626 hci_cc_read_def_link_policy(hdev, skb);
2627 break;
2628
2629 case HCI_OP_WRITE_DEF_LINK_POLICY:
2630 hci_cc_write_def_link_policy(hdev, skb);
2631 break;
2632
2633 case HCI_OP_RESET:
2634 hci_cc_reset(hdev, skb);
2635 break;
2636
2637 case HCI_OP_WRITE_LOCAL_NAME:
2638 hci_cc_write_local_name(hdev, skb);
2639 break;
2640
2641 case HCI_OP_READ_LOCAL_NAME:
2642 hci_cc_read_local_name(hdev, skb);
2643 break;
2644
2645 case HCI_OP_WRITE_AUTH_ENABLE:
2646 hci_cc_write_auth_enable(hdev, skb);
2647 break;
2648
2649 case HCI_OP_WRITE_ENCRYPT_MODE:
2650 hci_cc_write_encrypt_mode(hdev, skb);
2651 break;
2652
2653 case HCI_OP_WRITE_SCAN_ENABLE:
2654 hci_cc_write_scan_enable(hdev, skb);
2655 break;
2656
2657 case HCI_OP_READ_CLASS_OF_DEV:
2658 hci_cc_read_class_of_dev(hdev, skb);
2659 break;
2660
2661 case HCI_OP_WRITE_CLASS_OF_DEV:
2662 hci_cc_write_class_of_dev(hdev, skb);
2663 break;
2664
2665 case HCI_OP_READ_VOICE_SETTING:
2666 hci_cc_read_voice_setting(hdev, skb);
2667 break;
2668
2669 case HCI_OP_WRITE_VOICE_SETTING:
2670 hci_cc_write_voice_setting(hdev, skb);
2671 break;
2672
2673 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2674 hci_cc_read_num_supported_iac(hdev, skb);
2675 break;
2676
2677 case HCI_OP_WRITE_SSP_MODE:
2678 hci_cc_write_ssp_mode(hdev, skb);
2679 break;
2680
2681 case HCI_OP_WRITE_SC_SUPPORT:
2682 hci_cc_write_sc_support(hdev, skb);
2683 break;
2684
2685 case HCI_OP_READ_LOCAL_VERSION:
2686 hci_cc_read_local_version(hdev, skb);
2687 break;
2688
2689 case HCI_OP_READ_LOCAL_COMMANDS:
2690 hci_cc_read_local_commands(hdev, skb);
2691 break;
2692
2693 case HCI_OP_READ_LOCAL_FEATURES:
2694 hci_cc_read_local_features(hdev, skb);
2695 break;
2696
2697 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2698 hci_cc_read_local_ext_features(hdev, skb);
2699 break;
2700
2701 case HCI_OP_READ_BUFFER_SIZE:
2702 hci_cc_read_buffer_size(hdev, skb);
2703 break;
2704
2705 case HCI_OP_READ_BD_ADDR:
2706 hci_cc_read_bd_addr(hdev, skb);
2707 break;
2708
2709 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2710 hci_cc_read_page_scan_activity(hdev, skb);
2711 break;
2712
2713 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2714 hci_cc_write_page_scan_activity(hdev, skb);
2715 break;
2716
2717 case HCI_OP_READ_PAGE_SCAN_TYPE:
2718 hci_cc_read_page_scan_type(hdev, skb);
2719 break;
2720
2721 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2722 hci_cc_write_page_scan_type(hdev, skb);
2723 break;
2724
2725 case HCI_OP_READ_DATA_BLOCK_SIZE:
2726 hci_cc_read_data_block_size(hdev, skb);
2727 break;
2728
2729 case HCI_OP_READ_FLOW_CONTROL_MODE:
2730 hci_cc_read_flow_control_mode(hdev, skb);
2731 break;
2732
2733 case HCI_OP_READ_LOCAL_AMP_INFO:
2734 hci_cc_read_local_amp_info(hdev, skb);
2735 break;
2736
2737 case HCI_OP_READ_CLOCK:
2738 hci_cc_read_clock(hdev, skb);
2739 break;
2740
2741 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2742 hci_cc_read_local_amp_assoc(hdev, skb);
2743 break;
2744
2745 case HCI_OP_READ_INQ_RSP_TX_POWER:
2746 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2747 break;
2748
2749 case HCI_OP_PIN_CODE_REPLY:
2750 hci_cc_pin_code_reply(hdev, skb);
2751 break;
2752
2753 case HCI_OP_PIN_CODE_NEG_REPLY:
2754 hci_cc_pin_code_neg_reply(hdev, skb);
2755 break;
2756
2757 case HCI_OP_READ_LOCAL_OOB_DATA:
2758 hci_cc_read_local_oob_data(hdev, skb);
2759 break;
2760
2761 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2762 hci_cc_read_local_oob_ext_data(hdev, skb);
2763 break;
2764
2765 case HCI_OP_LE_READ_BUFFER_SIZE:
2766 hci_cc_le_read_buffer_size(hdev, skb);
2767 break;
2768
2769 case HCI_OP_LE_READ_LOCAL_FEATURES:
2770 hci_cc_le_read_local_features(hdev, skb);
2771 break;
2772
2773 case HCI_OP_LE_READ_ADV_TX_POWER:
2774 hci_cc_le_read_adv_tx_power(hdev, skb);
2775 break;
2776
2777 case HCI_OP_USER_CONFIRM_REPLY:
2778 hci_cc_user_confirm_reply(hdev, skb);
2779 break;
2780
2781 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2782 hci_cc_user_confirm_neg_reply(hdev, skb);
2783 break;
2784
2785 case HCI_OP_USER_PASSKEY_REPLY:
2786 hci_cc_user_passkey_reply(hdev, skb);
2787 break;
2788
2789 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2790 hci_cc_user_passkey_neg_reply(hdev, skb);
2791 break;
2792
2793 case HCI_OP_LE_SET_RANDOM_ADDR:
2794 hci_cc_le_set_random_addr(hdev, skb);
2795 break;
2796
2797 case HCI_OP_LE_SET_ADV_ENABLE:
2798 hci_cc_le_set_adv_enable(hdev, skb);
2799 break;
2800
2801 case HCI_OP_LE_SET_SCAN_PARAM:
2802 hci_cc_le_set_scan_param(hdev, skb);
2803 break;
2804
2805 case HCI_OP_LE_SET_SCAN_ENABLE:
2806 hci_cc_le_set_scan_enable(hdev, skb);
2807 break;
2808
2809 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2810 hci_cc_le_read_white_list_size(hdev, skb);
2811 break;
2812
2813 case HCI_OP_LE_CLEAR_WHITE_LIST:
2814 hci_cc_le_clear_white_list(hdev, skb);
2815 break;
2816
2817 case HCI_OP_LE_ADD_TO_WHITE_LIST:
2818 hci_cc_le_add_to_white_list(hdev, skb);
2819 break;
2820
2821 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2822 hci_cc_le_del_from_white_list(hdev, skb);
2823 break;
2824
2825 case HCI_OP_LE_READ_SUPPORTED_STATES:
2826 hci_cc_le_read_supported_states(hdev, skb);
2827 break;
2828
2829 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2830 hci_cc_write_le_host_supported(hdev, skb);
2831 break;
2832
2833 case HCI_OP_LE_SET_ADV_PARAM:
2834 hci_cc_set_adv_param(hdev, skb);
2835 break;
2836
2837 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2838 hci_cc_write_remote_amp_assoc(hdev, skb);
2839 break;
2840
2841 case HCI_OP_READ_RSSI:
2842 hci_cc_read_rssi(hdev, skb);
2843 break;
2844
2845 case HCI_OP_READ_TX_POWER:
2846 hci_cc_read_tx_power(hdev, skb);
2847 break;
2848
2849 default:
2850 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2851 break;
2852 }
2853
2854 if (opcode != HCI_OP_NOP)
2855 cancel_delayed_work(&hdev->cmd_timer);
2856
2857 hci_req_cmd_complete(hdev, opcode, status);
2858
2859 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2860 atomic_set(&hdev->cmd_cnt, 1);
2861 if (!skb_queue_empty(&hdev->cmd_q))
2862 queue_work(hdev->workqueue, &hdev->cmd_work);
2863 }
2864 }
2865
2866 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2867 {
2868 struct hci_ev_cmd_status *ev = (void *) skb->data;
2869 __u16 opcode;
2870
2871 skb_pull(skb, sizeof(*ev));
2872
2873 opcode = __le16_to_cpu(ev->opcode);
2874
2875 switch (opcode) {
2876 case HCI_OP_INQUIRY:
2877 hci_cs_inquiry(hdev, ev->status);
2878 break;
2879
2880 case HCI_OP_CREATE_CONN:
2881 hci_cs_create_conn(hdev, ev->status);
2882 break;
2883
2884 case HCI_OP_DISCONNECT:
2885 hci_cs_disconnect(hdev, ev->status);
2886 break;
2887
2888 case HCI_OP_ADD_SCO:
2889 hci_cs_add_sco(hdev, ev->status);
2890 break;
2891
2892 case HCI_OP_AUTH_REQUESTED:
2893 hci_cs_auth_requested(hdev, ev->status);
2894 break;
2895
2896 case HCI_OP_SET_CONN_ENCRYPT:
2897 hci_cs_set_conn_encrypt(hdev, ev->status);
2898 break;
2899
2900 case HCI_OP_REMOTE_NAME_REQ:
2901 hci_cs_remote_name_req(hdev, ev->status);
2902 break;
2903
2904 case HCI_OP_READ_REMOTE_FEATURES:
2905 hci_cs_read_remote_features(hdev, ev->status);
2906 break;
2907
2908 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2909 hci_cs_read_remote_ext_features(hdev, ev->status);
2910 break;
2911
2912 case HCI_OP_SETUP_SYNC_CONN:
2913 hci_cs_setup_sync_conn(hdev, ev->status);
2914 break;
2915
2916 case HCI_OP_CREATE_PHY_LINK:
2917 hci_cs_create_phylink(hdev, ev->status);
2918 break;
2919
2920 case HCI_OP_ACCEPT_PHY_LINK:
2921 hci_cs_accept_phylink(hdev, ev->status);
2922 break;
2923
2924 case HCI_OP_SNIFF_MODE:
2925 hci_cs_sniff_mode(hdev, ev->status);
2926 break;
2927
2928 case HCI_OP_EXIT_SNIFF_MODE:
2929 hci_cs_exit_sniff_mode(hdev, ev->status);
2930 break;
2931
2932 case HCI_OP_SWITCH_ROLE:
2933 hci_cs_switch_role(hdev, ev->status);
2934 break;
2935
2936 case HCI_OP_LE_CREATE_CONN:
2937 hci_cs_le_create_conn(hdev, ev->status);
2938 break;
2939
2940 case HCI_OP_LE_START_ENC:
2941 hci_cs_le_start_enc(hdev, ev->status);
2942 break;
2943
2944 default:
2945 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2946 break;
2947 }
2948
2949 if (opcode != HCI_OP_NOP)
2950 cancel_delayed_work(&hdev->cmd_timer);
2951
2952 if (ev->status ||
2953 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2954 hci_req_cmd_complete(hdev, opcode, ev->status);
2955
2956 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2957 atomic_set(&hdev->cmd_cnt, 1);
2958 if (!skb_queue_empty(&hdev->cmd_q))
2959 queue_work(hdev->workqueue, &hdev->cmd_work);
2960 }
2961 }
2962
2963 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
2964 {
2965 struct hci_ev_hardware_error *ev = (void *) skb->data;
2966
2967 BT_ERR("%s hardware error 0x%2.2x", hdev->name, ev->code);
2968 }
2969
2970 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2971 {
2972 struct hci_ev_role_change *ev = (void *) skb->data;
2973 struct hci_conn *conn;
2974
2975 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2976
2977 hci_dev_lock(hdev);
2978
2979 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2980 if (conn) {
2981 if (!ev->status)
2982 conn->role = ev->role;
2983
2984 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2985
2986 hci_role_switch_cfm(conn, ev->status, ev->role);
2987 }
2988
2989 hci_dev_unlock(hdev);
2990 }
2991
2992 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2993 {
2994 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2995 int i;
2996
2997 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2998 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2999 return;
3000 }
3001
3002 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3003 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3004 BT_DBG("%s bad parameters", hdev->name);
3005 return;
3006 }
3007
3008 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3009
3010 for (i = 0; i < ev->num_hndl; i++) {
3011 struct hci_comp_pkts_info *info = &ev->handles[i];
3012 struct hci_conn *conn;
3013 __u16 handle, count;
3014
3015 handle = __le16_to_cpu(info->handle);
3016 count = __le16_to_cpu(info->count);
3017
3018 conn = hci_conn_hash_lookup_handle(hdev, handle);
3019 if (!conn)
3020 continue;
3021
3022 conn->sent -= count;
3023
3024 switch (conn->type) {
3025 case ACL_LINK:
3026 hdev->acl_cnt += count;
3027 if (hdev->acl_cnt > hdev->acl_pkts)
3028 hdev->acl_cnt = hdev->acl_pkts;
3029 break;
3030
3031 case LE_LINK:
3032 if (hdev->le_pkts) {
3033 hdev->le_cnt += count;
3034 if (hdev->le_cnt > hdev->le_pkts)
3035 hdev->le_cnt = hdev->le_pkts;
3036 } else {
3037 hdev->acl_cnt += count;
3038 if (hdev->acl_cnt > hdev->acl_pkts)
3039 hdev->acl_cnt = hdev->acl_pkts;
3040 }
3041 break;
3042
3043 case SCO_LINK:
3044 hdev->sco_cnt += count;
3045 if (hdev->sco_cnt > hdev->sco_pkts)
3046 hdev->sco_cnt = hdev->sco_pkts;
3047 break;
3048
3049 default:
3050 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3051 break;
3052 }
3053 }
3054
3055 queue_work(hdev->workqueue, &hdev->tx_work);
3056 }
3057
3058 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3059 __u16 handle)
3060 {
3061 struct hci_chan *chan;
3062
3063 switch (hdev->dev_type) {
3064 case HCI_BREDR:
3065 return hci_conn_hash_lookup_handle(hdev, handle);
3066 case HCI_AMP:
3067 chan = hci_chan_lookup_handle(hdev, handle);
3068 if (chan)
3069 return chan->conn;
3070 break;
3071 default:
3072 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3073 break;
3074 }
3075
3076 return NULL;
3077 }
3078
3079 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3080 {
3081 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3082 int i;
3083
3084 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3085 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3086 return;
3087 }
3088
3089 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3090 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3091 BT_DBG("%s bad parameters", hdev->name);
3092 return;
3093 }
3094
3095 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3096 ev->num_hndl);
3097
3098 for (i = 0; i < ev->num_hndl; i++) {
3099 struct hci_comp_blocks_info *info = &ev->handles[i];
3100 struct hci_conn *conn = NULL;
3101 __u16 handle, block_count;
3102
3103 handle = __le16_to_cpu(info->handle);
3104 block_count = __le16_to_cpu(info->blocks);
3105
3106 conn = __hci_conn_lookup_handle(hdev, handle);
3107 if (!conn)
3108 continue;
3109
3110 conn->sent -= block_count;
3111
3112 switch (conn->type) {
3113 case ACL_LINK:
3114 case AMP_LINK:
3115 hdev->block_cnt += block_count;
3116 if (hdev->block_cnt > hdev->num_blocks)
3117 hdev->block_cnt = hdev->num_blocks;
3118 break;
3119
3120 default:
3121 BT_ERR("Unknown type %d conn %p", conn->type, conn);
3122 break;
3123 }
3124 }
3125
3126 queue_work(hdev->workqueue, &hdev->tx_work);
3127 }
3128
3129 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3130 {
3131 struct hci_ev_mode_change *ev = (void *) skb->data;
3132 struct hci_conn *conn;
3133
3134 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3135
3136 hci_dev_lock(hdev);
3137
3138 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3139 if (conn) {
3140 conn->mode = ev->mode;
3141
3142 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3143 &conn->flags)) {
3144 if (conn->mode == HCI_CM_ACTIVE)
3145 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3146 else
3147 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3148 }
3149
3150 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3151 hci_sco_setup(conn, ev->status);
3152 }
3153
3154 hci_dev_unlock(hdev);
3155 }
3156
3157 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3158 {
3159 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3160 struct hci_conn *conn;
3161
3162 BT_DBG("%s", hdev->name);
3163
3164 hci_dev_lock(hdev);
3165
3166 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3167 if (!conn)
3168 goto unlock;
3169
3170 if (conn->state == BT_CONNECTED) {
3171 hci_conn_hold(conn);
3172 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3173 hci_conn_drop(conn);
3174 }
3175
3176 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
3177 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3178 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3179 sizeof(ev->bdaddr), &ev->bdaddr);
3180 } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3181 u8 secure;
3182
3183 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3184 secure = 1;
3185 else
3186 secure = 0;
3187
3188 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3189 }
3190
3191 unlock:
3192 hci_dev_unlock(hdev);
3193 }
3194
3195 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3196 {
3197 if (key_type == HCI_LK_CHANGED_COMBINATION)
3198 return;
3199
3200 conn->pin_length = pin_len;
3201 conn->key_type = key_type;
3202
3203 switch (key_type) {
3204 case HCI_LK_LOCAL_UNIT:
3205 case HCI_LK_REMOTE_UNIT:
3206 case HCI_LK_DEBUG_COMBINATION:
3207 return;
3208 case HCI_LK_COMBINATION:
3209 if (pin_len == 16)
3210 conn->pending_sec_level = BT_SECURITY_HIGH;
3211 else
3212 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3213 break;
3214 case HCI_LK_UNAUTH_COMBINATION_P192:
3215 case HCI_LK_UNAUTH_COMBINATION_P256:
3216 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3217 break;
3218 case HCI_LK_AUTH_COMBINATION_P192:
3219 conn->pending_sec_level = BT_SECURITY_HIGH;
3220 break;
3221 case HCI_LK_AUTH_COMBINATION_P256:
3222 conn->pending_sec_level = BT_SECURITY_FIPS;
3223 break;
3224 }
3225 }
3226
3227 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3228 {
3229 struct hci_ev_link_key_req *ev = (void *) skb->data;
3230 struct hci_cp_link_key_reply cp;
3231 struct hci_conn *conn;
3232 struct link_key *key;
3233
3234 BT_DBG("%s", hdev->name);
3235
3236 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3237 return;
3238
3239 hci_dev_lock(hdev);
3240
3241 key = hci_find_link_key(hdev, &ev->bdaddr);
3242 if (!key) {
3243 BT_DBG("%s link key not found for %pMR", hdev->name,
3244 &ev->bdaddr);
3245 goto not_found;
3246 }
3247
3248 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3249 &ev->bdaddr);
3250
3251 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3252 if (conn) {
3253 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3254
3255 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3256 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3257 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3258 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3259 goto not_found;
3260 }
3261
3262 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3263 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3264 conn->pending_sec_level == BT_SECURITY_FIPS)) {
3265 BT_DBG("%s ignoring key unauthenticated for high security",
3266 hdev->name);
3267 goto not_found;
3268 }
3269
3270 conn_set_key(conn, key->type, key->pin_len);
3271 }
3272
3273 bacpy(&cp.bdaddr, &ev->bdaddr);
3274 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3275
3276 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3277
3278 hci_dev_unlock(hdev);
3279
3280 return;
3281
3282 not_found:
3283 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3284 hci_dev_unlock(hdev);
3285 }
3286
3287 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3288 {
3289 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3290 struct hci_conn *conn;
3291 struct link_key *key;
3292 bool persistent;
3293 u8 pin_len = 0;
3294
3295 BT_DBG("%s", hdev->name);
3296
3297 hci_dev_lock(hdev);
3298
3299 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3300 if (!conn)
3301 goto unlock;
3302
3303 hci_conn_hold(conn);
3304 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3305 hci_conn_drop(conn);
3306
3307 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3308 conn_set_key(conn, ev->key_type, conn->pin_length);
3309
3310 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3311 goto unlock;
3312
3313 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3314 ev->key_type, pin_len, &persistent);
3315 if (!key)
3316 goto unlock;
3317
3318 /* Update connection information since adding the key will have
3319 * fixed up the type in the case of changed combination keys.
3320 */
3321 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3322 conn_set_key(conn, key->type, key->pin_len);
3323
3324 mgmt_new_link_key(hdev, key, persistent);
3325
3326 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3327 * is set. If it's not set simply remove the key from the kernel
3328 * list (we've still notified user space about it but with
3329 * store_hint being 0).
3330 */
3331 if (key->type == HCI_LK_DEBUG_COMBINATION &&
3332 !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3333 list_del_rcu(&key->list);
3334 kfree_rcu(key, rcu);
3335 goto unlock;
3336 }
3337
3338 if (persistent)
3339 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3340 else
3341 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3342
3343 unlock:
3344 hci_dev_unlock(hdev);
3345 }
3346
3347 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3348 {
3349 struct hci_ev_clock_offset *ev = (void *) skb->data;
3350 struct hci_conn *conn;
3351
3352 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3353
3354 hci_dev_lock(hdev);
3355
3356 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3357 if (conn && !ev->status) {
3358 struct inquiry_entry *ie;
3359
3360 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3361 if (ie) {
3362 ie->data.clock_offset = ev->clock_offset;
3363 ie->timestamp = jiffies;
3364 }
3365 }
3366
3367 hci_dev_unlock(hdev);
3368 }
3369
3370 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3371 {
3372 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3373 struct hci_conn *conn;
3374
3375 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3376
3377 hci_dev_lock(hdev);
3378
3379 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3380 if (conn && !ev->status)
3381 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3382
3383 hci_dev_unlock(hdev);
3384 }
3385
3386 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3387 {
3388 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3389 struct inquiry_entry *ie;
3390
3391 BT_DBG("%s", hdev->name);
3392
3393 hci_dev_lock(hdev);
3394
3395 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3396 if (ie) {
3397 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3398 ie->timestamp = jiffies;
3399 }
3400
3401 hci_dev_unlock(hdev);
3402 }
3403
3404 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3405 struct sk_buff *skb)
3406 {
3407 struct inquiry_data data;
3408 int num_rsp = *((__u8 *) skb->data);
3409
3410 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3411
3412 if (!num_rsp)
3413 return;
3414
3415 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3416 return;
3417
3418 hci_dev_lock(hdev);
3419
3420 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3421 struct inquiry_info_with_rssi_and_pscan_mode *info;
3422 info = (void *) (skb->data + 1);
3423
3424 for (; num_rsp; num_rsp--, info++) {
3425 u32 flags;
3426
3427 bacpy(&data.bdaddr, &info->bdaddr);
3428 data.pscan_rep_mode = info->pscan_rep_mode;
3429 data.pscan_period_mode = info->pscan_period_mode;
3430 data.pscan_mode = info->pscan_mode;
3431 memcpy(data.dev_class, info->dev_class, 3);
3432 data.clock_offset = info->clock_offset;
3433 data.rssi = info->rssi;
3434 data.ssp_mode = 0x00;
3435
3436 flags = hci_inquiry_cache_update(hdev, &data, false);
3437
3438 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3439 info->dev_class, info->rssi,
3440 flags, NULL, 0, NULL, 0);
3441 }
3442 } else {
3443 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3444
3445 for (; num_rsp; num_rsp--, info++) {
3446 u32 flags;
3447
3448 bacpy(&data.bdaddr, &info->bdaddr);
3449 data.pscan_rep_mode = info->pscan_rep_mode;
3450 data.pscan_period_mode = info->pscan_period_mode;
3451 data.pscan_mode = 0x00;
3452 memcpy(data.dev_class, info->dev_class, 3);
3453 data.clock_offset = info->clock_offset;
3454 data.rssi = info->rssi;
3455 data.ssp_mode = 0x00;
3456
3457 flags = hci_inquiry_cache_update(hdev, &data, false);
3458
3459 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3460 info->dev_class, info->rssi,
3461 flags, NULL, 0, NULL, 0);
3462 }
3463 }
3464
3465 hci_dev_unlock(hdev);
3466 }
3467
3468 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3469 struct sk_buff *skb)
3470 {
3471 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3472 struct hci_conn *conn;
3473
3474 BT_DBG("%s", hdev->name);
3475
3476 hci_dev_lock(hdev);
3477
3478 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3479 if (!conn)
3480 goto unlock;
3481
3482 if (ev->page < HCI_MAX_PAGES)
3483 memcpy(conn->features[ev->page], ev->features, 8);
3484
3485 if (!ev->status && ev->page == 0x01) {
3486 struct inquiry_entry *ie;
3487
3488 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3489 if (ie)
3490 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3491
3492 if (ev->features[0] & LMP_HOST_SSP) {
3493 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3494 } else {
3495 /* It is mandatory by the Bluetooth specification that
3496 * Extended Inquiry Results are only used when Secure
3497 * Simple Pairing is enabled, but some devices violate
3498 * this.
3499 *
3500 * To make these devices work, the internal SSP
3501 * enabled flag needs to be cleared if the remote host
3502 * features do not indicate SSP support */
3503 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3504 }
3505
3506 if (ev->features[0] & LMP_HOST_SC)
3507 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3508 }
3509
3510 if (conn->state != BT_CONFIG)
3511 goto unlock;
3512
3513 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3514 struct hci_cp_remote_name_req cp;
3515 memset(&cp, 0, sizeof(cp));
3516 bacpy(&cp.bdaddr, &conn->dst);
3517 cp.pscan_rep_mode = 0x02;
3518 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3519 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3520 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3521
3522 if (!hci_outgoing_auth_needed(hdev, conn)) {
3523 conn->state = BT_CONNECTED;
3524 hci_proto_connect_cfm(conn, ev->status);
3525 hci_conn_drop(conn);
3526 }
3527
3528 unlock:
3529 hci_dev_unlock(hdev);
3530 }
3531
3532 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3533 struct sk_buff *skb)
3534 {
3535 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3536 struct hci_conn *conn;
3537
3538 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3539
3540 hci_dev_lock(hdev);
3541
3542 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3543 if (!conn) {
3544 if (ev->link_type == ESCO_LINK)
3545 goto unlock;
3546
3547 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3548 if (!conn)
3549 goto unlock;
3550
3551 conn->type = SCO_LINK;
3552 }
3553
3554 switch (ev->status) {
3555 case 0x00:
3556 conn->handle = __le16_to_cpu(ev->handle);
3557 conn->state = BT_CONNECTED;
3558
3559 hci_conn_add_sysfs(conn);
3560 break;
3561
3562 case 0x10: /* Connection Accept Timeout */
3563 case 0x0d: /* Connection Rejected due to Limited Resources */
3564 case 0x11: /* Unsupported Feature or Parameter Value */
3565 case 0x1c: /* SCO interval rejected */
3566 case 0x1a: /* Unsupported Remote Feature */
3567 case 0x1f: /* Unspecified error */
3568 case 0x20: /* Unsupported LMP Parameter value */
3569 if (conn->out) {
3570 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3571 (hdev->esco_type & EDR_ESCO_MASK);
3572 if (hci_setup_sync(conn, conn->link->handle))
3573 goto unlock;
3574 }
3575 /* fall through */
3576
3577 default:
3578 conn->state = BT_CLOSED;
3579 break;
3580 }
3581
3582 hci_proto_connect_cfm(conn, ev->status);
3583 if (ev->status)
3584 hci_conn_del(conn);
3585
3586 unlock:
3587 hci_dev_unlock(hdev);
3588 }
3589
3590 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3591 {
3592 size_t parsed = 0;
3593
3594 while (parsed < eir_len) {
3595 u8 field_len = eir[0];
3596
3597 if (field_len == 0)
3598 return parsed;
3599
3600 parsed += field_len + 1;
3601 eir += field_len + 1;
3602 }
3603
3604 return eir_len;
3605 }
3606
3607 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3608 struct sk_buff *skb)
3609 {
3610 struct inquiry_data data;
3611 struct extended_inquiry_info *info = (void *) (skb->data + 1);
3612 int num_rsp = *((__u8 *) skb->data);
3613 size_t eir_len;
3614
3615 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3616
3617 if (!num_rsp)
3618 return;
3619
3620 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3621 return;
3622
3623 hci_dev_lock(hdev);
3624
3625 for (; num_rsp; num_rsp--, info++) {
3626 u32 flags;
3627 bool name_known;
3628
3629 bacpy(&data.bdaddr, &info->bdaddr);
3630 data.pscan_rep_mode = info->pscan_rep_mode;
3631 data.pscan_period_mode = info->pscan_period_mode;
3632 data.pscan_mode = 0x00;
3633 memcpy(data.dev_class, info->dev_class, 3);
3634 data.clock_offset = info->clock_offset;
3635 data.rssi = info->rssi;
3636 data.ssp_mode = 0x01;
3637
3638 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3639 name_known = eir_has_data_type(info->data,
3640 sizeof(info->data),
3641 EIR_NAME_COMPLETE);
3642 else
3643 name_known = true;
3644
3645 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3646
3647 eir_len = eir_get_length(info->data, sizeof(info->data));
3648
3649 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3650 info->dev_class, info->rssi,
3651 flags, info->data, eir_len, NULL, 0);
3652 }
3653
3654 hci_dev_unlock(hdev);
3655 }
3656
3657 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3658 struct sk_buff *skb)
3659 {
3660 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3661 struct hci_conn *conn;
3662
3663 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3664 __le16_to_cpu(ev->handle));
3665
3666 hci_dev_lock(hdev);
3667
3668 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3669 if (!conn)
3670 goto unlock;
3671
3672 /* For BR/EDR the necessary steps are taken through the
3673 * auth_complete event.
3674 */
3675 if (conn->type != LE_LINK)
3676 goto unlock;
3677
3678 if (!ev->status)
3679 conn->sec_level = conn->pending_sec_level;
3680
3681 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3682
3683 if (ev->status && conn->state == BT_CONNECTED) {
3684 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3685 hci_conn_drop(conn);
3686 goto unlock;
3687 }
3688
3689 if (conn->state == BT_CONFIG) {
3690 if (!ev->status)
3691 conn->state = BT_CONNECTED;
3692
3693 hci_proto_connect_cfm(conn, ev->status);
3694 hci_conn_drop(conn);
3695 } else {
3696 hci_auth_cfm(conn, ev->status);
3697
3698 hci_conn_hold(conn);
3699 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3700 hci_conn_drop(conn);
3701 }
3702
3703 unlock:
3704 hci_dev_unlock(hdev);
3705 }
3706
3707 static u8 hci_get_auth_req(struct hci_conn *conn)
3708 {
3709 /* If remote requests no-bonding follow that lead */
3710 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3711 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3712 return conn->remote_auth | (conn->auth_type & 0x01);
3713
3714 /* If both remote and local have enough IO capabilities, require
3715 * MITM protection
3716 */
3717 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3718 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3719 return conn->remote_auth | 0x01;
3720
3721 /* No MITM protection possible so ignore remote requirement */
3722 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3723 }
3724
3725 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3726 {
3727 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3728 struct hci_conn *conn;
3729
3730 BT_DBG("%s", hdev->name);
3731
3732 hci_dev_lock(hdev);
3733
3734 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3735 if (!conn)
3736 goto unlock;
3737
3738 hci_conn_hold(conn);
3739
3740 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3741 goto unlock;
3742
3743 /* Allow pairing if we're pairable, the initiators of the
3744 * pairing or if the remote is not requesting bonding.
3745 */
3746 if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
3747 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
3748 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3749 struct hci_cp_io_capability_reply cp;
3750
3751 bacpy(&cp.bdaddr, &ev->bdaddr);
3752 /* Change the IO capability from KeyboardDisplay
3753 * to DisplayYesNo as it is not supported by BT spec. */
3754 cp.capability = (conn->io_capability == 0x04) ?
3755 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3756
3757 /* If we are initiators, there is no remote information yet */
3758 if (conn->remote_auth == 0xff) {
3759 /* Request MITM protection if our IO caps allow it
3760 * except for the no-bonding case.
3761 */
3762 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3763 conn->auth_type != HCI_AT_NO_BONDING)
3764 conn->auth_type |= 0x01;
3765 } else {
3766 conn->auth_type = hci_get_auth_req(conn);
3767 }
3768
3769 /* If we're not bondable, force one of the non-bondable
3770 * authentication requirement values.
3771 */
3772 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
3773 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
3774
3775 cp.authentication = conn->auth_type;
3776
3777 if (hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR) &&
3778 (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3779 cp.oob_data = 0x01;
3780 else
3781 cp.oob_data = 0x00;
3782
3783 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3784 sizeof(cp), &cp);
3785 } else {
3786 struct hci_cp_io_capability_neg_reply cp;
3787
3788 bacpy(&cp.bdaddr, &ev->bdaddr);
3789 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3790
3791 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3792 sizeof(cp), &cp);
3793 }
3794
3795 unlock:
3796 hci_dev_unlock(hdev);
3797 }
3798
3799 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3800 {
3801 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3802 struct hci_conn *conn;
3803
3804 BT_DBG("%s", hdev->name);
3805
3806 hci_dev_lock(hdev);
3807
3808 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3809 if (!conn)
3810 goto unlock;
3811
3812 conn->remote_cap = ev->capability;
3813 conn->remote_auth = ev->authentication;
3814 if (ev->oob_data)
3815 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3816
3817 unlock:
3818 hci_dev_unlock(hdev);
3819 }
3820
3821 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3822 struct sk_buff *skb)
3823 {
3824 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3825 int loc_mitm, rem_mitm, confirm_hint = 0;
3826 struct hci_conn *conn;
3827
3828 BT_DBG("%s", hdev->name);
3829
3830 hci_dev_lock(hdev);
3831
3832 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3833 goto unlock;
3834
3835 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3836 if (!conn)
3837 goto unlock;
3838
3839 loc_mitm = (conn->auth_type & 0x01);
3840 rem_mitm = (conn->remote_auth & 0x01);
3841
3842 /* If we require MITM but the remote device can't provide that
3843 * (it has NoInputNoOutput) then reject the confirmation
3844 * request. We check the security level here since it doesn't
3845 * necessarily match conn->auth_type.
3846 */
3847 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
3848 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3849 BT_DBG("Rejecting request: remote device can't provide MITM");
3850 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3851 sizeof(ev->bdaddr), &ev->bdaddr);
3852 goto unlock;
3853 }
3854
3855 /* If no side requires MITM protection; auto-accept */
3856 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3857 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3858
3859 /* If we're not the initiators request authorization to
3860 * proceed from user space (mgmt_user_confirm with
3861 * confirm_hint set to 1). The exception is if neither
3862 * side had MITM or if the local IO capability is
3863 * NoInputNoOutput, in which case we do auto-accept
3864 */
3865 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
3866 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3867 (loc_mitm || rem_mitm)) {
3868 BT_DBG("Confirming auto-accept as acceptor");
3869 confirm_hint = 1;
3870 goto confirm;
3871 }
3872
3873 BT_DBG("Auto-accept of user confirmation with %ums delay",
3874 hdev->auto_accept_delay);
3875
3876 if (hdev->auto_accept_delay > 0) {
3877 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3878 queue_delayed_work(conn->hdev->workqueue,
3879 &conn->auto_accept_work, delay);
3880 goto unlock;
3881 }
3882
3883 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3884 sizeof(ev->bdaddr), &ev->bdaddr);
3885 goto unlock;
3886 }
3887
3888 confirm:
3889 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
3890 le32_to_cpu(ev->passkey), confirm_hint);
3891
3892 unlock:
3893 hci_dev_unlock(hdev);
3894 }
3895
3896 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3897 struct sk_buff *skb)
3898 {
3899 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3900
3901 BT_DBG("%s", hdev->name);
3902
3903 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3904 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3905 }
3906
3907 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3908 struct sk_buff *skb)
3909 {
3910 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3911 struct hci_conn *conn;
3912
3913 BT_DBG("%s", hdev->name);
3914
3915 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3916 if (!conn)
3917 return;
3918
3919 conn->passkey_notify = __le32_to_cpu(ev->passkey);
3920 conn->passkey_entered = 0;
3921
3922 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3923 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3924 conn->dst_type, conn->passkey_notify,
3925 conn->passkey_entered);
3926 }
3927
3928 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3929 {
3930 struct hci_ev_keypress_notify *ev = (void *) skb->data;
3931 struct hci_conn *conn;
3932
3933 BT_DBG("%s", hdev->name);
3934
3935 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3936 if (!conn)
3937 return;
3938
3939 switch (ev->type) {
3940 case HCI_KEYPRESS_STARTED:
3941 conn->passkey_entered = 0;
3942 return;
3943
3944 case HCI_KEYPRESS_ENTERED:
3945 conn->passkey_entered++;
3946 break;
3947
3948 case HCI_KEYPRESS_ERASED:
3949 conn->passkey_entered--;
3950 break;
3951
3952 case HCI_KEYPRESS_CLEARED:
3953 conn->passkey_entered = 0;
3954 break;
3955
3956 case HCI_KEYPRESS_COMPLETED:
3957 return;
3958 }
3959
3960 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3961 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3962 conn->dst_type, conn->passkey_notify,
3963 conn->passkey_entered);
3964 }
3965
3966 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3967 struct sk_buff *skb)
3968 {
3969 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3970 struct hci_conn *conn;
3971
3972 BT_DBG("%s", hdev->name);
3973
3974 hci_dev_lock(hdev);
3975
3976 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3977 if (!conn)
3978 goto unlock;
3979
3980 /* Reset the authentication requirement to unknown */
3981 conn->remote_auth = 0xff;
3982
3983 /* To avoid duplicate auth_failed events to user space we check
3984 * the HCI_CONN_AUTH_PEND flag which will be set if we
3985 * initiated the authentication. A traditional auth_complete
3986 * event gets always produced as initiator and is also mapped to
3987 * the mgmt_auth_failed event */
3988 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3989 mgmt_auth_failed(conn, ev->status);
3990
3991 hci_conn_drop(conn);
3992
3993 unlock:
3994 hci_dev_unlock(hdev);
3995 }
3996
3997 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3998 struct sk_buff *skb)
3999 {
4000 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4001 struct inquiry_entry *ie;
4002 struct hci_conn *conn;
4003
4004 BT_DBG("%s", hdev->name);
4005
4006 hci_dev_lock(hdev);
4007
4008 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4009 if (conn)
4010 memcpy(conn->features[1], ev->features, 8);
4011
4012 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4013 if (ie)
4014 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4015
4016 hci_dev_unlock(hdev);
4017 }
4018
4019 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4020 struct sk_buff *skb)
4021 {
4022 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4023 struct oob_data *data;
4024
4025 BT_DBG("%s", hdev->name);
4026
4027 hci_dev_lock(hdev);
4028
4029 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4030 goto unlock;
4031
4032 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4033 if (data) {
4034 if (bredr_sc_enabled(hdev)) {
4035 struct hci_cp_remote_oob_ext_data_reply cp;
4036
4037 bacpy(&cp.bdaddr, &ev->bdaddr);
4038 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4039 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4040 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4041 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4042
4043 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4044 sizeof(cp), &cp);
4045 } else {
4046 struct hci_cp_remote_oob_data_reply cp;
4047
4048 bacpy(&cp.bdaddr, &ev->bdaddr);
4049 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4050 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4051
4052 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4053 sizeof(cp), &cp);
4054 }
4055 } else {
4056 struct hci_cp_remote_oob_data_neg_reply cp;
4057
4058 bacpy(&cp.bdaddr, &ev->bdaddr);
4059 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4060 sizeof(cp), &cp);
4061 }
4062
4063 unlock:
4064 hci_dev_unlock(hdev);
4065 }
4066
4067 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4068 struct sk_buff *skb)
4069 {
4070 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4071 struct hci_conn *hcon, *bredr_hcon;
4072
4073 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4074 ev->status);
4075
4076 hci_dev_lock(hdev);
4077
4078 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4079 if (!hcon) {
4080 hci_dev_unlock(hdev);
4081 return;
4082 }
4083
4084 if (ev->status) {
4085 hci_conn_del(hcon);
4086 hci_dev_unlock(hdev);
4087 return;
4088 }
4089
4090 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4091
4092 hcon->state = BT_CONNECTED;
4093 bacpy(&hcon->dst, &bredr_hcon->dst);
4094
4095 hci_conn_hold(hcon);
4096 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4097 hci_conn_drop(hcon);
4098
4099 hci_conn_add_sysfs(hcon);
4100
4101 amp_physical_cfm(bredr_hcon, hcon);
4102
4103 hci_dev_unlock(hdev);
4104 }
4105
4106 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4107 {
4108 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4109 struct hci_conn *hcon;
4110 struct hci_chan *hchan;
4111 struct amp_mgr *mgr;
4112
4113 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4114 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4115 ev->status);
4116
4117 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4118 if (!hcon)
4119 return;
4120
4121 /* Create AMP hchan */
4122 hchan = hci_chan_create(hcon);
4123 if (!hchan)
4124 return;
4125
4126 hchan->handle = le16_to_cpu(ev->handle);
4127
4128 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4129
4130 mgr = hcon->amp_mgr;
4131 if (mgr && mgr->bredr_chan) {
4132 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4133
4134 l2cap_chan_lock(bredr_chan);
4135
4136 bredr_chan->conn->mtu = hdev->block_mtu;
4137 l2cap_logical_cfm(bredr_chan, hchan, 0);
4138 hci_conn_hold(hcon);
4139
4140 l2cap_chan_unlock(bredr_chan);
4141 }
4142 }
4143
4144 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4145 struct sk_buff *skb)
4146 {
4147 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4148 struct hci_chan *hchan;
4149
4150 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4151 le16_to_cpu(ev->handle), ev->status);
4152
4153 if (ev->status)
4154 return;
4155
4156 hci_dev_lock(hdev);
4157
4158 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4159 if (!hchan)
4160 goto unlock;
4161
4162 amp_destroy_logical_link(hchan, ev->reason);
4163
4164 unlock:
4165 hci_dev_unlock(hdev);
4166 }
4167
4168 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4169 struct sk_buff *skb)
4170 {
4171 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4172 struct hci_conn *hcon;
4173
4174 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4175
4176 if (ev->status)
4177 return;
4178
4179 hci_dev_lock(hdev);
4180
4181 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4182 if (hcon) {
4183 hcon->state = BT_CLOSED;
4184 hci_conn_del(hcon);
4185 }
4186
4187 hci_dev_unlock(hdev);
4188 }
4189
4190 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4191 {
4192 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4193 struct hci_conn_params *params;
4194 struct hci_conn *conn;
4195 struct smp_irk *irk;
4196 u8 addr_type;
4197
4198 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4199
4200 hci_dev_lock(hdev);
4201
4202 /* All controllers implicitly stop advertising in the event of a
4203 * connection, so ensure that the state bit is cleared.
4204 */
4205 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4206
4207 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4208 if (!conn) {
4209 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4210 if (!conn) {
4211 BT_ERR("No memory for new connection");
4212 goto unlock;
4213 }
4214
4215 conn->dst_type = ev->bdaddr_type;
4216
4217 /* If we didn't have a hci_conn object previously
4218 * but we're in master role this must be something
4219 * initiated using a white list. Since white list based
4220 * connections are not "first class citizens" we don't
4221 * have full tracking of them. Therefore, we go ahead
4222 * with a "best effort" approach of determining the
4223 * initiator address based on the HCI_PRIVACY flag.
4224 */
4225 if (conn->out) {
4226 conn->resp_addr_type = ev->bdaddr_type;
4227 bacpy(&conn->resp_addr, &ev->bdaddr);
4228 if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4229 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4230 bacpy(&conn->init_addr, &hdev->rpa);
4231 } else {
4232 hci_copy_identity_address(hdev,
4233 &conn->init_addr,
4234 &conn->init_addr_type);
4235 }
4236 }
4237 } else {
4238 cancel_delayed_work(&conn->le_conn_timeout);
4239 }
4240
4241 if (!conn->out) {
4242 /* Set the responder (our side) address type based on
4243 * the advertising address type.
4244 */
4245 conn->resp_addr_type = hdev->adv_addr_type;
4246 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4247 bacpy(&conn->resp_addr, &hdev->random_addr);
4248 else
4249 bacpy(&conn->resp_addr, &hdev->bdaddr);
4250
4251 conn->init_addr_type = ev->bdaddr_type;
4252 bacpy(&conn->init_addr, &ev->bdaddr);
4253
4254 /* For incoming connections, set the default minimum
4255 * and maximum connection interval. They will be used
4256 * to check if the parameters are in range and if not
4257 * trigger the connection update procedure.
4258 */
4259 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4260 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4261 }
4262
4263 /* Lookup the identity address from the stored connection
4264 * address and address type.
4265 *
4266 * When establishing connections to an identity address, the
4267 * connection procedure will store the resolvable random
4268 * address first. Now if it can be converted back into the
4269 * identity address, start using the identity address from
4270 * now on.
4271 */
4272 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4273 if (irk) {
4274 bacpy(&conn->dst, &irk->bdaddr);
4275 conn->dst_type = irk->addr_type;
4276 }
4277
4278 if (ev->status) {
4279 hci_le_conn_failed(conn, ev->status);
4280 goto unlock;
4281 }
4282
4283 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4284 addr_type = BDADDR_LE_PUBLIC;
4285 else
4286 addr_type = BDADDR_LE_RANDOM;
4287
4288 /* Drop the connection if the device is blocked */
4289 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4290 hci_conn_drop(conn);
4291 goto unlock;
4292 }
4293
4294 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4295 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4296
4297 conn->sec_level = BT_SECURITY_LOW;
4298 conn->handle = __le16_to_cpu(ev->handle);
4299 conn->state = BT_CONNECTED;
4300
4301 conn->le_conn_interval = le16_to_cpu(ev->interval);
4302 conn->le_conn_latency = le16_to_cpu(ev->latency);
4303 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4304
4305 hci_conn_add_sysfs(conn);
4306
4307 hci_proto_connect_cfm(conn, ev->status);
4308
4309 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4310 conn->dst_type);
4311 if (params) {
4312 list_del_init(&params->action);
4313 if (params->conn) {
4314 hci_conn_drop(params->conn);
4315 hci_conn_put(params->conn);
4316 params->conn = NULL;
4317 }
4318 }
4319
4320 unlock:
4321 hci_update_background_scan(hdev);
4322 hci_dev_unlock(hdev);
4323 }
4324
4325 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4326 struct sk_buff *skb)
4327 {
4328 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4329 struct hci_conn *conn;
4330
4331 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4332
4333 if (ev->status)
4334 return;
4335
4336 hci_dev_lock(hdev);
4337
4338 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4339 if (conn) {
4340 conn->le_conn_interval = le16_to_cpu(ev->interval);
4341 conn->le_conn_latency = le16_to_cpu(ev->latency);
4342 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4343 }
4344
4345 hci_dev_unlock(hdev);
4346 }
4347
4348 /* This function requires the caller holds hdev->lock */
4349 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4350 bdaddr_t *addr,
4351 u8 addr_type, u8 adv_type)
4352 {
4353 struct hci_conn *conn;
4354 struct hci_conn_params *params;
4355
4356 /* If the event is not connectable don't proceed further */
4357 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4358 return NULL;
4359
4360 /* Ignore if the device is blocked */
4361 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4362 return NULL;
4363
4364 /* Most controller will fail if we try to create new connections
4365 * while we have an existing one in slave role.
4366 */
4367 if (hdev->conn_hash.le_num_slave > 0)
4368 return NULL;
4369
4370 /* If we're not connectable only connect devices that we have in
4371 * our pend_le_conns list.
4372 */
4373 params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4374 addr, addr_type);
4375 if (!params)
4376 return NULL;
4377
4378 switch (params->auto_connect) {
4379 case HCI_AUTO_CONN_DIRECT:
4380 /* Only devices advertising with ADV_DIRECT_IND are
4381 * triggering a connection attempt. This is allowing
4382 * incoming connections from slave devices.
4383 */
4384 if (adv_type != LE_ADV_DIRECT_IND)
4385 return NULL;
4386 break;
4387 case HCI_AUTO_CONN_ALWAYS:
4388 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4389 * are triggering a connection attempt. This means
4390 * that incoming connectioms from slave device are
4391 * accepted and also outgoing connections to slave
4392 * devices are established when found.
4393 */
4394 break;
4395 default:
4396 return NULL;
4397 }
4398
4399 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4400 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4401 if (!IS_ERR(conn)) {
4402 /* Store the pointer since we don't really have any
4403 * other owner of the object besides the params that
4404 * triggered it. This way we can abort the connection if
4405 * the parameters get removed and keep the reference
4406 * count consistent once the connection is established.
4407 */
4408 params->conn = hci_conn_get(conn);
4409 return conn;
4410 }
4411
4412 switch (PTR_ERR(conn)) {
4413 case -EBUSY:
4414 /* If hci_connect() returns -EBUSY it means there is already
4415 * an LE connection attempt going on. Since controllers don't
4416 * support more than one connection attempt at the time, we
4417 * don't consider this an error case.
4418 */
4419 break;
4420 default:
4421 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4422 return NULL;
4423 }
4424
4425 return NULL;
4426 }
4427
4428 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4429 u8 bdaddr_type, bdaddr_t *direct_addr,
4430 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4431 {
4432 struct discovery_state *d = &hdev->discovery;
4433 struct smp_irk *irk;
4434 struct hci_conn *conn;
4435 bool match;
4436 u32 flags;
4437
4438 /* If the direct address is present, then this report is from
4439 * a LE Direct Advertising Report event. In that case it is
4440 * important to see if the address is matching the local
4441 * controller address.
4442 */
4443 if (direct_addr) {
4444 /* Only resolvable random addresses are valid for these
4445 * kind of reports and others can be ignored.
4446 */
4447 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4448 return;
4449
4450 /* If the controller is not using resolvable random
4451 * addresses, then this report can be ignored.
4452 */
4453 if (!test_bit(HCI_PRIVACY, &hdev->dev_flags))
4454 return;
4455
4456 /* If the local IRK of the controller does not match
4457 * with the resolvable random address provided, then
4458 * this report can be ignored.
4459 */
4460 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4461 return;
4462 }
4463
4464 /* Check if we need to convert to identity address */
4465 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4466 if (irk) {
4467 bdaddr = &irk->bdaddr;
4468 bdaddr_type = irk->addr_type;
4469 }
4470
4471 /* Check if we have been requested to connect to this device */
4472 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4473 if (conn && type == LE_ADV_IND) {
4474 /* Store report for later inclusion by
4475 * mgmt_device_connected
4476 */
4477 memcpy(conn->le_adv_data, data, len);
4478 conn->le_adv_data_len = len;
4479 }
4480
4481 /* Passive scanning shouldn't trigger any device found events,
4482 * except for devices marked as CONN_REPORT for which we do send
4483 * device found events.
4484 */
4485 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4486 if (type == LE_ADV_DIRECT_IND)
4487 return;
4488
4489 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4490 bdaddr, bdaddr_type))
4491 return;
4492
4493 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4494 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4495 else
4496 flags = 0;
4497 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4498 rssi, flags, data, len, NULL, 0);
4499 return;
4500 }
4501
4502 /* When receiving non-connectable or scannable undirected
4503 * advertising reports, this means that the remote device is
4504 * not connectable and then clearly indicate this in the
4505 * device found event.
4506 *
4507 * When receiving a scan response, then there is no way to
4508 * know if the remote device is connectable or not. However
4509 * since scan responses are merged with a previously seen
4510 * advertising report, the flags field from that report
4511 * will be used.
4512 *
4513 * In the really unlikely case that a controller get confused
4514 * and just sends a scan response event, then it is marked as
4515 * not connectable as well.
4516 */
4517 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4518 type == LE_ADV_SCAN_RSP)
4519 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4520 else
4521 flags = 0;
4522
4523 /* If there's nothing pending either store the data from this
4524 * event or send an immediate device found event if the data
4525 * should not be stored for later.
4526 */
4527 if (!has_pending_adv_report(hdev)) {
4528 /* If the report will trigger a SCAN_REQ store it for
4529 * later merging.
4530 */
4531 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4532 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4533 rssi, flags, data, len);
4534 return;
4535 }
4536
4537 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4538 rssi, flags, data, len, NULL, 0);
4539 return;
4540 }
4541
4542 /* Check if the pending report is for the same device as the new one */
4543 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4544 bdaddr_type == d->last_adv_addr_type);
4545
4546 /* If the pending data doesn't match this report or this isn't a
4547 * scan response (e.g. we got a duplicate ADV_IND) then force
4548 * sending of the pending data.
4549 */
4550 if (type != LE_ADV_SCAN_RSP || !match) {
4551 /* Send out whatever is in the cache, but skip duplicates */
4552 if (!match)
4553 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4554 d->last_adv_addr_type, NULL,
4555 d->last_adv_rssi, d->last_adv_flags,
4556 d->last_adv_data,
4557 d->last_adv_data_len, NULL, 0);
4558
4559 /* If the new report will trigger a SCAN_REQ store it for
4560 * later merging.
4561 */
4562 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4563 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4564 rssi, flags, data, len);
4565 return;
4566 }
4567
4568 /* The advertising reports cannot be merged, so clear
4569 * the pending report and send out a device found event.
4570 */
4571 clear_pending_adv_report(hdev);
4572 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4573 rssi, flags, data, len, NULL, 0);
4574 return;
4575 }
4576
4577 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4578 * the new event is a SCAN_RSP. We can therefore proceed with
4579 * sending a merged device found event.
4580 */
4581 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4582 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4583 d->last_adv_data, d->last_adv_data_len, data, len);
4584 clear_pending_adv_report(hdev);
4585 }
4586
4587 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4588 {
4589 u8 num_reports = skb->data[0];
4590 void *ptr = &skb->data[1];
4591
4592 hci_dev_lock(hdev);
4593
4594 while (num_reports--) {
4595 struct hci_ev_le_advertising_info *ev = ptr;
4596 s8 rssi;
4597
4598 rssi = ev->data[ev->length];
4599 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4600 ev->bdaddr_type, NULL, 0, rssi,
4601 ev->data, ev->length);
4602
4603 ptr += sizeof(*ev) + ev->length + 1;
4604 }
4605
4606 hci_dev_unlock(hdev);
4607 }
4608
4609 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4610 {
4611 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4612 struct hci_cp_le_ltk_reply cp;
4613 struct hci_cp_le_ltk_neg_reply neg;
4614 struct hci_conn *conn;
4615 struct smp_ltk *ltk;
4616
4617 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4618
4619 hci_dev_lock(hdev);
4620
4621 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4622 if (conn == NULL)
4623 goto not_found;
4624
4625 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4626 if (!ltk)
4627 goto not_found;
4628
4629 if (smp_ltk_is_sc(ltk)) {
4630 /* With SC both EDiv and Rand are set to zero */
4631 if (ev->ediv || ev->rand)
4632 goto not_found;
4633 } else {
4634 /* For non-SC keys check that EDiv and Rand match */
4635 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4636 goto not_found;
4637 }
4638
4639 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
4640 cp.handle = cpu_to_le16(conn->handle);
4641
4642 conn->pending_sec_level = smp_ltk_sec_level(ltk);
4643
4644 conn->enc_key_size = ltk->enc_size;
4645
4646 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4647
4648 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4649 * temporary key used to encrypt a connection following
4650 * pairing. It is used during the Encrypted Session Setup to
4651 * distribute the keys. Later, security can be re-established
4652 * using a distributed LTK.
4653 */
4654 if (ltk->type == SMP_STK) {
4655 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4656 list_del_rcu(&ltk->list);
4657 kfree_rcu(ltk, rcu);
4658 } else {
4659 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4660 }
4661
4662 hci_dev_unlock(hdev);
4663
4664 return;
4665
4666 not_found:
4667 neg.handle = ev->handle;
4668 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4669 hci_dev_unlock(hdev);
4670 }
4671
4672 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4673 u8 reason)
4674 {
4675 struct hci_cp_le_conn_param_req_neg_reply cp;
4676
4677 cp.handle = cpu_to_le16(handle);
4678 cp.reason = reason;
4679
4680 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4681 &cp);
4682 }
4683
4684 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4685 struct sk_buff *skb)
4686 {
4687 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4688 struct hci_cp_le_conn_param_req_reply cp;
4689 struct hci_conn *hcon;
4690 u16 handle, min, max, latency, timeout;
4691
4692 handle = le16_to_cpu(ev->handle);
4693 min = le16_to_cpu(ev->interval_min);
4694 max = le16_to_cpu(ev->interval_max);
4695 latency = le16_to_cpu(ev->latency);
4696 timeout = le16_to_cpu(ev->timeout);
4697
4698 hcon = hci_conn_hash_lookup_handle(hdev, handle);
4699 if (!hcon || hcon->state != BT_CONNECTED)
4700 return send_conn_param_neg_reply(hdev, handle,
4701 HCI_ERROR_UNKNOWN_CONN_ID);
4702
4703 if (hci_check_conn_params(min, max, latency, timeout))
4704 return send_conn_param_neg_reply(hdev, handle,
4705 HCI_ERROR_INVALID_LL_PARAMS);
4706
4707 if (hcon->role == HCI_ROLE_MASTER) {
4708 struct hci_conn_params *params;
4709 u8 store_hint;
4710
4711 hci_dev_lock(hdev);
4712
4713 params = hci_conn_params_lookup(hdev, &hcon->dst,
4714 hcon->dst_type);
4715 if (params) {
4716 params->conn_min_interval = min;
4717 params->conn_max_interval = max;
4718 params->conn_latency = latency;
4719 params->supervision_timeout = timeout;
4720 store_hint = 0x01;
4721 } else{
4722 store_hint = 0x00;
4723 }
4724
4725 hci_dev_unlock(hdev);
4726
4727 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4728 store_hint, min, max, latency, timeout);
4729 }
4730
4731 cp.handle = ev->handle;
4732 cp.interval_min = ev->interval_min;
4733 cp.interval_max = ev->interval_max;
4734 cp.latency = ev->latency;
4735 cp.timeout = ev->timeout;
4736 cp.min_ce_len = 0;
4737 cp.max_ce_len = 0;
4738
4739 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4740 }
4741
4742 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
4743 struct sk_buff *skb)
4744 {
4745 u8 num_reports = skb->data[0];
4746 void *ptr = &skb->data[1];
4747
4748 hci_dev_lock(hdev);
4749
4750 while (num_reports--) {
4751 struct hci_ev_le_direct_adv_info *ev = ptr;
4752
4753 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4754 ev->bdaddr_type, &ev->direct_addr,
4755 ev->direct_addr_type, ev->rssi, NULL, 0);
4756
4757 ptr += sizeof(*ev);
4758 }
4759
4760 hci_dev_unlock(hdev);
4761 }
4762
4763 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
4764 {
4765 struct hci_ev_le_meta *le_ev = (void *) skb->data;
4766
4767 skb_pull(skb, sizeof(*le_ev));
4768
4769 switch (le_ev->subevent) {
4770 case HCI_EV_LE_CONN_COMPLETE:
4771 hci_le_conn_complete_evt(hdev, skb);
4772 break;
4773
4774 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4775 hci_le_conn_update_complete_evt(hdev, skb);
4776 break;
4777
4778 case HCI_EV_LE_ADVERTISING_REPORT:
4779 hci_le_adv_report_evt(hdev, skb);
4780 break;
4781
4782 case HCI_EV_LE_LTK_REQ:
4783 hci_le_ltk_request_evt(hdev, skb);
4784 break;
4785
4786 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
4787 hci_le_remote_conn_param_req_evt(hdev, skb);
4788 break;
4789
4790 case HCI_EV_LE_DIRECT_ADV_REPORT:
4791 hci_le_direct_adv_report_evt(hdev, skb);
4792 break;
4793
4794 default:
4795 break;
4796 }
4797 }
4798
4799 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4800 {
4801 struct hci_ev_channel_selected *ev = (void *) skb->data;
4802 struct hci_conn *hcon;
4803
4804 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4805
4806 skb_pull(skb, sizeof(*ev));
4807
4808 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4809 if (!hcon)
4810 return;
4811
4812 amp_read_loc_assoc_final_data(hdev, hcon);
4813 }
4814
4815 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4816 {
4817 struct hci_event_hdr *hdr = (void *) skb->data;
4818 __u8 event = hdr->evt;
4819
4820 hci_dev_lock(hdev);
4821
4822 /* Received events are (currently) only needed when a request is
4823 * ongoing so avoid unnecessary memory allocation.
4824 */
4825 if (hci_req_pending(hdev)) {
4826 kfree_skb(hdev->recv_evt);
4827 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4828 }
4829
4830 hci_dev_unlock(hdev);
4831
4832 skb_pull(skb, HCI_EVENT_HDR_SIZE);
4833
4834 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
4835 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
4836 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
4837
4838 hci_req_cmd_complete(hdev, opcode, 0);
4839 }
4840
4841 switch (event) {
4842 case HCI_EV_INQUIRY_COMPLETE:
4843 hci_inquiry_complete_evt(hdev, skb);
4844 break;
4845
4846 case HCI_EV_INQUIRY_RESULT:
4847 hci_inquiry_result_evt(hdev, skb);
4848 break;
4849
4850 case HCI_EV_CONN_COMPLETE:
4851 hci_conn_complete_evt(hdev, skb);
4852 break;
4853
4854 case HCI_EV_CONN_REQUEST:
4855 hci_conn_request_evt(hdev, skb);
4856 break;
4857
4858 case HCI_EV_DISCONN_COMPLETE:
4859 hci_disconn_complete_evt(hdev, skb);
4860 break;
4861
4862 case HCI_EV_AUTH_COMPLETE:
4863 hci_auth_complete_evt(hdev, skb);
4864 break;
4865
4866 case HCI_EV_REMOTE_NAME:
4867 hci_remote_name_evt(hdev, skb);
4868 break;
4869
4870 case HCI_EV_ENCRYPT_CHANGE:
4871 hci_encrypt_change_evt(hdev, skb);
4872 break;
4873
4874 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
4875 hci_change_link_key_complete_evt(hdev, skb);
4876 break;
4877
4878 case HCI_EV_REMOTE_FEATURES:
4879 hci_remote_features_evt(hdev, skb);
4880 break;
4881
4882 case HCI_EV_CMD_COMPLETE:
4883 hci_cmd_complete_evt(hdev, skb);
4884 break;
4885
4886 case HCI_EV_CMD_STATUS:
4887 hci_cmd_status_evt(hdev, skb);
4888 break;
4889
4890 case HCI_EV_HARDWARE_ERROR:
4891 hci_hardware_error_evt(hdev, skb);
4892 break;
4893
4894 case HCI_EV_ROLE_CHANGE:
4895 hci_role_change_evt(hdev, skb);
4896 break;
4897
4898 case HCI_EV_NUM_COMP_PKTS:
4899 hci_num_comp_pkts_evt(hdev, skb);
4900 break;
4901
4902 case HCI_EV_MODE_CHANGE:
4903 hci_mode_change_evt(hdev, skb);
4904 break;
4905
4906 case HCI_EV_PIN_CODE_REQ:
4907 hci_pin_code_request_evt(hdev, skb);
4908 break;
4909
4910 case HCI_EV_LINK_KEY_REQ:
4911 hci_link_key_request_evt(hdev, skb);
4912 break;
4913
4914 case HCI_EV_LINK_KEY_NOTIFY:
4915 hci_link_key_notify_evt(hdev, skb);
4916 break;
4917
4918 case HCI_EV_CLOCK_OFFSET:
4919 hci_clock_offset_evt(hdev, skb);
4920 break;
4921
4922 case HCI_EV_PKT_TYPE_CHANGE:
4923 hci_pkt_type_change_evt(hdev, skb);
4924 break;
4925
4926 case HCI_EV_PSCAN_REP_MODE:
4927 hci_pscan_rep_mode_evt(hdev, skb);
4928 break;
4929
4930 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
4931 hci_inquiry_result_with_rssi_evt(hdev, skb);
4932 break;
4933
4934 case HCI_EV_REMOTE_EXT_FEATURES:
4935 hci_remote_ext_features_evt(hdev, skb);
4936 break;
4937
4938 case HCI_EV_SYNC_CONN_COMPLETE:
4939 hci_sync_conn_complete_evt(hdev, skb);
4940 break;
4941
4942 case HCI_EV_EXTENDED_INQUIRY_RESULT:
4943 hci_extended_inquiry_result_evt(hdev, skb);
4944 break;
4945
4946 case HCI_EV_KEY_REFRESH_COMPLETE:
4947 hci_key_refresh_complete_evt(hdev, skb);
4948 break;
4949
4950 case HCI_EV_IO_CAPA_REQUEST:
4951 hci_io_capa_request_evt(hdev, skb);
4952 break;
4953
4954 case HCI_EV_IO_CAPA_REPLY:
4955 hci_io_capa_reply_evt(hdev, skb);
4956 break;
4957
4958 case HCI_EV_USER_CONFIRM_REQUEST:
4959 hci_user_confirm_request_evt(hdev, skb);
4960 break;
4961
4962 case HCI_EV_USER_PASSKEY_REQUEST:
4963 hci_user_passkey_request_evt(hdev, skb);
4964 break;
4965
4966 case HCI_EV_USER_PASSKEY_NOTIFY:
4967 hci_user_passkey_notify_evt(hdev, skb);
4968 break;
4969
4970 case HCI_EV_KEYPRESS_NOTIFY:
4971 hci_keypress_notify_evt(hdev, skb);
4972 break;
4973
4974 case HCI_EV_SIMPLE_PAIR_COMPLETE:
4975 hci_simple_pair_complete_evt(hdev, skb);
4976 break;
4977
4978 case HCI_EV_REMOTE_HOST_FEATURES:
4979 hci_remote_host_features_evt(hdev, skb);
4980 break;
4981
4982 case HCI_EV_LE_META:
4983 hci_le_meta_evt(hdev, skb);
4984 break;
4985
4986 case HCI_EV_CHANNEL_SELECTED:
4987 hci_chan_selected_evt(hdev, skb);
4988 break;
4989
4990 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4991 hci_remote_oob_data_request_evt(hdev, skb);
4992 break;
4993
4994 case HCI_EV_PHY_LINK_COMPLETE:
4995 hci_phy_link_complete_evt(hdev, skb);
4996 break;
4997
4998 case HCI_EV_LOGICAL_LINK_COMPLETE:
4999 hci_loglink_complete_evt(hdev, skb);
5000 break;
5001
5002 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5003 hci_disconn_loglink_complete_evt(hdev, skb);
5004 break;
5005
5006 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5007 hci_disconn_phylink_complete_evt(hdev, skb);
5008 break;
5009
5010 case HCI_EV_NUM_COMP_BLOCKS:
5011 hci_num_comp_blocks_evt(hdev, skb);
5012 break;
5013
5014 default:
5015 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5016 break;
5017 }
5018
5019 kfree_skb(skb);
5020 hdev->stat.evt_rx++;
5021 }
Linux with added FPC-III support