?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
perf bpf: Move perf_event_output() from stdio.h to bpf.h
[linux/fpc-iii.git] / net / bluetooth / hci_event.c
blobef9928d7b4fb5abd497e01a45261aa5dab8ac1e0
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI event handling. */
26
27 #include <asm/unaligned.h>
28
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "hci_request.h"
34 #include "hci_debugfs.h"
35 #include "a2mp.h"
36 #include "amp.h"
37 #include "smp.h"
38
39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
42 /* Handle HCI Event packets */
43
44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
45 {
46 __u8 status = *((__u8 *) skb->data);
47
48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
49
50 if (status)
51 return;
52
53 clear_bit(HCI_INQUIRY, &hdev->flags);
54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
56
57 hci_dev_lock(hdev);
58 /* Set discovery state to stopped if we're not doing LE active
59 * scanning.
60 */
61 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
62 hdev->le_scan_type != LE_SCAN_ACTIVE)
63 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
64 hci_dev_unlock(hdev);
65
66 hci_conn_check_pending(hdev);
67 }
68
69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
70 {
71 __u8 status = *((__u8 *) skb->data);
72
73 BT_DBG("%s status 0x%2.2x", hdev->name, status);
74
75 if (status)
76 return;
77
78 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
79 }
80
81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
82 {
83 __u8 status = *((__u8 *) skb->data);
84
85 BT_DBG("%s status 0x%2.2x", hdev->name, status);
86
87 if (status)
88 return;
89
90 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
91
92 hci_conn_check_pending(hdev);
93 }
94
95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
96 struct sk_buff *skb)
97 {
98 BT_DBG("%s", hdev->name);
99 }
100
101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
102 {
103 struct hci_rp_role_discovery *rp = (void *) skb->data;
104 struct hci_conn *conn;
105
106 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
107
108 if (rp->status)
109 return;
110
111 hci_dev_lock(hdev);
112
113 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
114 if (conn)
115 conn->role = rp->role;
116
117 hci_dev_unlock(hdev);
118 }
119
120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
121 {
122 struct hci_rp_read_link_policy *rp = (void *) skb->data;
123 struct hci_conn *conn;
124
125 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
126
127 if (rp->status)
128 return;
129
130 hci_dev_lock(hdev);
131
132 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
133 if (conn)
134 conn->link_policy = __le16_to_cpu(rp->policy);
135
136 hci_dev_unlock(hdev);
137 }
138
139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
140 {
141 struct hci_rp_write_link_policy *rp = (void *) skb->data;
142 struct hci_conn *conn;
143 void *sent;
144
145 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
146
147 if (rp->status)
148 return;
149
150 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
151 if (!sent)
152 return;
153
154 hci_dev_lock(hdev);
155
156 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
157 if (conn)
158 conn->link_policy = get_unaligned_le16(sent + 2);
159
160 hci_dev_unlock(hdev);
161 }
162
163 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
164 struct sk_buff *skb)
165 {
166 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
167
168 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
169
170 if (rp->status)
171 return;
172
173 hdev->link_policy = __le16_to_cpu(rp->policy);
174 }
175
176 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
177 struct sk_buff *skb)
178 {
179 __u8 status = *((__u8 *) skb->data);
180 void *sent;
181
182 BT_DBG("%s status 0x%2.2x", hdev->name, status);
183
184 if (status)
185 return;
186
187 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
188 if (!sent)
189 return;
190
191 hdev->link_policy = get_unaligned_le16(sent);
192 }
193
194 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
195 {
196 __u8 status = *((__u8 *) skb->data);
197
198 BT_DBG("%s status 0x%2.2x", hdev->name, status);
199
200 clear_bit(HCI_RESET, &hdev->flags);
201
202 if (status)
203 return;
204
205 /* Reset all non-persistent flags */
206 hci_dev_clear_volatile_flags(hdev);
207
208 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
209
210 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
211 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
212
213 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
214 hdev->adv_data_len = 0;
215
216 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
217 hdev->scan_rsp_data_len = 0;
218
219 hdev->le_scan_type = LE_SCAN_PASSIVE;
220
221 hdev->ssp_debug_mode = 0;
222
223 hci_bdaddr_list_clear(&hdev->le_white_list);
224 hci_bdaddr_list_clear(&hdev->le_resolv_list);
225 }
226
227 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
228 struct sk_buff *skb)
229 {
230 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
231 struct hci_cp_read_stored_link_key *sent;
232
233 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
234
235 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
236 if (!sent)
237 return;
238
239 if (!rp->status && sent->read_all == 0x01) {
240 hdev->stored_max_keys = rp->max_keys;
241 hdev->stored_num_keys = rp->num_keys;
242 }
243 }
244
245 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
246 struct sk_buff *skb)
247 {
248 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
249
250 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
251
252 if (rp->status)
253 return;
254
255 if (rp->num_keys <= hdev->stored_num_keys)
256 hdev->stored_num_keys -= rp->num_keys;
257 else
258 hdev->stored_num_keys = 0;
259 }
260
261 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
262 {
263 __u8 status = *((__u8 *) skb->data);
264 void *sent;
265
266 BT_DBG("%s status 0x%2.2x", hdev->name, status);
267
268 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
269 if (!sent)
270 return;
271
272 hci_dev_lock(hdev);
273
274 if (hci_dev_test_flag(hdev, HCI_MGMT))
275 mgmt_set_local_name_complete(hdev, sent, status);
276 else if (!status)
277 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
278
279 hci_dev_unlock(hdev);
280 }
281
282 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
283 {
284 struct hci_rp_read_local_name *rp = (void *) skb->data;
285
286 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
287
288 if (rp->status)
289 return;
290
291 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
292 hci_dev_test_flag(hdev, HCI_CONFIG))
293 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
294 }
295
296 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
297 {
298 __u8 status = *((__u8 *) skb->data);
299 void *sent;
300
301 BT_DBG("%s status 0x%2.2x", hdev->name, status);
302
303 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
304 if (!sent)
305 return;
306
307 hci_dev_lock(hdev);
308
309 if (!status) {
310 __u8 param = *((__u8 *) sent);
311
312 if (param == AUTH_ENABLED)
313 set_bit(HCI_AUTH, &hdev->flags);
314 else
315 clear_bit(HCI_AUTH, &hdev->flags);
316 }
317
318 if (hci_dev_test_flag(hdev, HCI_MGMT))
319 mgmt_auth_enable_complete(hdev, status);
320
321 hci_dev_unlock(hdev);
322 }
323
324 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
325 {
326 __u8 status = *((__u8 *) skb->data);
327 __u8 param;
328 void *sent;
329
330 BT_DBG("%s status 0x%2.2x", hdev->name, status);
331
332 if (status)
333 return;
334
335 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
336 if (!sent)
337 return;
338
339 param = *((__u8 *) sent);
340
341 if (param)
342 set_bit(HCI_ENCRYPT, &hdev->flags);
343 else
344 clear_bit(HCI_ENCRYPT, &hdev->flags);
345 }
346
347 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
348 {
349 __u8 status = *((__u8 *) skb->data);
350 __u8 param;
351 void *sent;
352
353 BT_DBG("%s status 0x%2.2x", hdev->name, status);
354
355 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
356 if (!sent)
357 return;
358
359 param = *((__u8 *) sent);
360
361 hci_dev_lock(hdev);
362
363 if (status) {
364 hdev->discov_timeout = 0;
365 goto done;
366 }
367
368 if (param & SCAN_INQUIRY)
369 set_bit(HCI_ISCAN, &hdev->flags);
370 else
371 clear_bit(HCI_ISCAN, &hdev->flags);
372
373 if (param & SCAN_PAGE)
374 set_bit(HCI_PSCAN, &hdev->flags);
375 else
376 clear_bit(HCI_PSCAN, &hdev->flags);
377
378 done:
379 hci_dev_unlock(hdev);
380 }
381
382 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
383 {
384 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
385
386 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
387
388 if (rp->status)
389 return;
390
391 memcpy(hdev->dev_class, rp->dev_class, 3);
392
393 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
394 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
395 }
396
397 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
398 {
399 __u8 status = *((__u8 *) skb->data);
400 void *sent;
401
402 BT_DBG("%s status 0x%2.2x", hdev->name, status);
403
404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
405 if (!sent)
406 return;
407
408 hci_dev_lock(hdev);
409
410 if (status == 0)
411 memcpy(hdev->dev_class, sent, 3);
412
413 if (hci_dev_test_flag(hdev, HCI_MGMT))
414 mgmt_set_class_of_dev_complete(hdev, sent, status);
415
416 hci_dev_unlock(hdev);
417 }
418
419 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
420 {
421 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
422 __u16 setting;
423
424 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
425
426 if (rp->status)
427 return;
428
429 setting = __le16_to_cpu(rp->voice_setting);
430
431 if (hdev->voice_setting == setting)
432 return;
433
434 hdev->voice_setting = setting;
435
436 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
437
438 if (hdev->notify)
439 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
440 }
441
442 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
443 struct sk_buff *skb)
444 {
445 __u8 status = *((__u8 *) skb->data);
446 __u16 setting;
447 void *sent;
448
449 BT_DBG("%s status 0x%2.2x", hdev->name, status);
450
451 if (status)
452 return;
453
454 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
455 if (!sent)
456 return;
457
458 setting = get_unaligned_le16(sent);
459
460 if (hdev->voice_setting == setting)
461 return;
462
463 hdev->voice_setting = setting;
464
465 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
466
467 if (hdev->notify)
468 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
469 }
470
471 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
472 struct sk_buff *skb)
473 {
474 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
475
476 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
477
478 if (rp->status)
479 return;
480
481 hdev->num_iac = rp->num_iac;
482
483 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
484 }
485
486 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
487 {
488 __u8 status = *((__u8 *) skb->data);
489 struct hci_cp_write_ssp_mode *sent;
490
491 BT_DBG("%s status 0x%2.2x", hdev->name, status);
492
493 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
494 if (!sent)
495 return;
496
497 hci_dev_lock(hdev);
498
499 if (!status) {
500 if (sent->mode)
501 hdev->features[1][0] |= LMP_HOST_SSP;
502 else
503 hdev->features[1][0] &= ~LMP_HOST_SSP;
504 }
505
506 if (hci_dev_test_flag(hdev, HCI_MGMT))
507 mgmt_ssp_enable_complete(hdev, sent->mode, status);
508 else if (!status) {
509 if (sent->mode)
510 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
511 else
512 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
513 }
514
515 hci_dev_unlock(hdev);
516 }
517
518 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
519 {
520 u8 status = *((u8 *) skb->data);
521 struct hci_cp_write_sc_support *sent;
522
523 BT_DBG("%s status 0x%2.2x", hdev->name, status);
524
525 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
526 if (!sent)
527 return;
528
529 hci_dev_lock(hdev);
530
531 if (!status) {
532 if (sent->support)
533 hdev->features[1][0] |= LMP_HOST_SC;
534 else
535 hdev->features[1][0] &= ~LMP_HOST_SC;
536 }
537
538 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
539 if (sent->support)
540 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
541 else
542 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
543 }
544
545 hci_dev_unlock(hdev);
546 }
547
548 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
549 {
550 struct hci_rp_read_local_version *rp = (void *) skb->data;
551
552 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
553
554 if (rp->status)
555 return;
556
557 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
558 hci_dev_test_flag(hdev, HCI_CONFIG)) {
559 hdev->hci_ver = rp->hci_ver;
560 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
561 hdev->lmp_ver = rp->lmp_ver;
562 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
563 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
564 }
565 }
566
567 static void hci_cc_read_local_commands(struct hci_dev *hdev,
568 struct sk_buff *skb)
569 {
570 struct hci_rp_read_local_commands *rp = (void *) skb->data;
571
572 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
573
574 if (rp->status)
575 return;
576
577 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
578 hci_dev_test_flag(hdev, HCI_CONFIG))
579 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
580 }
581
582 static void hci_cc_read_local_features(struct hci_dev *hdev,
583 struct sk_buff *skb)
584 {
585 struct hci_rp_read_local_features *rp = (void *) skb->data;
586
587 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
588
589 if (rp->status)
590 return;
591
592 memcpy(hdev->features, rp->features, 8);
593
594 /* Adjust default settings according to features
595 * supported by device. */
596
597 if (hdev->features[0][0] & LMP_3SLOT)
598 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
599
600 if (hdev->features[0][0] & LMP_5SLOT)
601 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
602
603 if (hdev->features[0][1] & LMP_HV2) {
604 hdev->pkt_type |= (HCI_HV2);
605 hdev->esco_type |= (ESCO_HV2);
606 }
607
608 if (hdev->features[0][1] & LMP_HV3) {
609 hdev->pkt_type |= (HCI_HV3);
610 hdev->esco_type |= (ESCO_HV3);
611 }
612
613 if (lmp_esco_capable(hdev))
614 hdev->esco_type |= (ESCO_EV3);
615
616 if (hdev->features[0][4] & LMP_EV4)
617 hdev->esco_type |= (ESCO_EV4);
618
619 if (hdev->features[0][4] & LMP_EV5)
620 hdev->esco_type |= (ESCO_EV5);
621
622 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
623 hdev->esco_type |= (ESCO_2EV3);
624
625 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
626 hdev->esco_type |= (ESCO_3EV3);
627
628 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
629 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
630 }
631
632 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
633 struct sk_buff *skb)
634 {
635 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
636
637 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
638
639 if (rp->status)
640 return;
641
642 if (hdev->max_page < rp->max_page)
643 hdev->max_page = rp->max_page;
644
645 if (rp->page < HCI_MAX_PAGES)
646 memcpy(hdev->features[rp->page], rp->features, 8);
647 }
648
649 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
650 struct sk_buff *skb)
651 {
652 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
653
654 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
655
656 if (rp->status)
657 return;
658
659 hdev->flow_ctl_mode = rp->mode;
660 }
661
662 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
663 {
664 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
665
666 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
667
668 if (rp->status)
669 return;
670
671 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
672 hdev->sco_mtu = rp->sco_mtu;
673 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
674 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
675
676 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
677 hdev->sco_mtu = 64;
678 hdev->sco_pkts = 8;
679 }
680
681 hdev->acl_cnt = hdev->acl_pkts;
682 hdev->sco_cnt = hdev->sco_pkts;
683
684 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
685 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
686 }
687
688 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
689 {
690 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
691
692 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
693
694 if (rp->status)
695 return;
696
697 if (test_bit(HCI_INIT, &hdev->flags))
698 bacpy(&hdev->bdaddr, &rp->bdaddr);
699
700 if (hci_dev_test_flag(hdev, HCI_SETUP))
701 bacpy(&hdev->setup_addr, &rp->bdaddr);
702 }
703
704 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
705 struct sk_buff *skb)
706 {
707 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
708
709 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
710
711 if (rp->status)
712 return;
713
714 if (test_bit(HCI_INIT, &hdev->flags)) {
715 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
716 hdev->page_scan_window = __le16_to_cpu(rp->window);
717 }
718 }
719
720 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
721 struct sk_buff *skb)
722 {
723 u8 status = *((u8 *) skb->data);
724 struct hci_cp_write_page_scan_activity *sent;
725
726 BT_DBG("%s status 0x%2.2x", hdev->name, status);
727
728 if (status)
729 return;
730
731 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
732 if (!sent)
733 return;
734
735 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
736 hdev->page_scan_window = __le16_to_cpu(sent->window);
737 }
738
739 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
740 struct sk_buff *skb)
741 {
742 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
743
744 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
745
746 if (rp->status)
747 return;
748
749 if (test_bit(HCI_INIT, &hdev->flags))
750 hdev->page_scan_type = rp->type;
751 }
752
753 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
754 struct sk_buff *skb)
755 {
756 u8 status = *((u8 *) skb->data);
757 u8 *type;
758
759 BT_DBG("%s status 0x%2.2x", hdev->name, status);
760
761 if (status)
762 return;
763
764 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
765 if (type)
766 hdev->page_scan_type = *type;
767 }
768
769 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
770 struct sk_buff *skb)
771 {
772 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
773
774 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
775
776 if (rp->status)
777 return;
778
779 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
780 hdev->block_len = __le16_to_cpu(rp->block_len);
781 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
782
783 hdev->block_cnt = hdev->num_blocks;
784
785 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
786 hdev->block_cnt, hdev->block_len);
787 }
788
789 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
790 {
791 struct hci_rp_read_clock *rp = (void *) skb->data;
792 struct hci_cp_read_clock *cp;
793 struct hci_conn *conn;
794
795 BT_DBG("%s", hdev->name);
796
797 if (skb->len < sizeof(*rp))
798 return;
799
800 if (rp->status)
801 return;
802
803 hci_dev_lock(hdev);
804
805 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
806 if (!cp)
807 goto unlock;
808
809 if (cp->which == 0x00) {
810 hdev->clock = le32_to_cpu(rp->clock);
811 goto unlock;
812 }
813
814 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
815 if (conn) {
816 conn->clock = le32_to_cpu(rp->clock);
817 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
818 }
819
820 unlock:
821 hci_dev_unlock(hdev);
822 }
823
824 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
825 struct sk_buff *skb)
826 {
827 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
828
829 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
830
831 if (rp->status)
832 return;
833
834 hdev->amp_status = rp->amp_status;
835 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
836 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
837 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
838 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
839 hdev->amp_type = rp->amp_type;
840 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
841 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
842 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
843 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
844 }
845
846 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
847 struct sk_buff *skb)
848 {
849 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
850
851 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
852
853 if (rp->status)
854 return;
855
856 hdev->inq_tx_power = rp->tx_power;
857 }
858
859 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
860 {
861 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
862 struct hci_cp_pin_code_reply *cp;
863 struct hci_conn *conn;
864
865 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
866
867 hci_dev_lock(hdev);
868
869 if (hci_dev_test_flag(hdev, HCI_MGMT))
870 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
871
872 if (rp->status)
873 goto unlock;
874
875 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
876 if (!cp)
877 goto unlock;
878
879 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
880 if (conn)
881 conn->pin_length = cp->pin_len;
882
883 unlock:
884 hci_dev_unlock(hdev);
885 }
886
887 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
888 {
889 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
890
891 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
892
893 hci_dev_lock(hdev);
894
895 if (hci_dev_test_flag(hdev, HCI_MGMT))
896 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
897 rp->status);
898
899 hci_dev_unlock(hdev);
900 }
901
902 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
903 struct sk_buff *skb)
904 {
905 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
906
907 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
908
909 if (rp->status)
910 return;
911
912 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
913 hdev->le_pkts = rp->le_max_pkt;
914
915 hdev->le_cnt = hdev->le_pkts;
916
917 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
918 }
919
920 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
921 struct sk_buff *skb)
922 {
923 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
924
925 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
926
927 if (rp->status)
928 return;
929
930 memcpy(hdev->le_features, rp->features, 8);
931 }
932
933 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
934 struct sk_buff *skb)
935 {
936 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
937
938 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
939
940 if (rp->status)
941 return;
942
943 hdev->adv_tx_power = rp->tx_power;
944 }
945
946 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
947 {
948 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
949
950 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
951
952 hci_dev_lock(hdev);
953
954 if (hci_dev_test_flag(hdev, HCI_MGMT))
955 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
956 rp->status);
957
958 hci_dev_unlock(hdev);
959 }
960
961 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
962 struct sk_buff *skb)
963 {
964 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
965
966 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
967
968 hci_dev_lock(hdev);
969
970 if (hci_dev_test_flag(hdev, HCI_MGMT))
971 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
972 ACL_LINK, 0, rp->status);
973
974 hci_dev_unlock(hdev);
975 }
976
977 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
978 {
979 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
980
981 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
982
983 hci_dev_lock(hdev);
984
985 if (hci_dev_test_flag(hdev, HCI_MGMT))
986 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
987 0, rp->status);
988
989 hci_dev_unlock(hdev);
990 }
991
992 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
993 struct sk_buff *skb)
994 {
995 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
996
997 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
998
999 hci_dev_lock(hdev);
1000
1001 if (hci_dev_test_flag(hdev, HCI_MGMT))
1002 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1003 ACL_LINK, 0, rp->status);
1004
1005 hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1009 struct sk_buff *skb)
1010 {
1011 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
1013 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1014 }
1015
1016 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1017 struct sk_buff *skb)
1018 {
1019 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1020
1021 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022 }
1023
1024 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1025 {
1026 __u8 status = *((__u8 *) skb->data);
1027 bdaddr_t *sent;
1028
1029 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1030
1031 if (status)
1032 return;
1033
1034 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1035 if (!sent)
1036 return;
1037
1038 hci_dev_lock(hdev);
1039
1040 bacpy(&hdev->random_addr, sent);
1041
1042 hci_dev_unlock(hdev);
1043 }
1044
1045 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1046 {
1047 __u8 status = *((__u8 *) skb->data);
1048 struct hci_cp_le_set_default_phy *cp;
1049
1050 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1051
1052 if (status)
1053 return;
1054
1055 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1056 if (!cp)
1057 return;
1058
1059 hci_dev_lock(hdev);
1060
1061 hdev->le_tx_def_phys = cp->tx_phys;
1062 hdev->le_rx_def_phys = cp->rx_phys;
1063
1064 hci_dev_unlock(hdev);
1065 }
1066
1067 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1068 struct sk_buff *skb)
1069 {
1070 __u8 status = *((__u8 *) skb->data);
1071 struct hci_cp_le_set_adv_set_rand_addr *cp;
1072 struct adv_info *adv_instance;
1073
1074 if (status)
1075 return;
1076
1077 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1078 if (!cp)
1079 return;
1080
1081 hci_dev_lock(hdev);
1082
1083 if (!hdev->cur_adv_instance) {
1084 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1085 bacpy(&hdev->random_addr, &cp->bdaddr);
1086 } else {
1087 adv_instance = hci_find_adv_instance(hdev,
1088 hdev->cur_adv_instance);
1089 if (adv_instance)
1090 bacpy(&adv_instance->random_addr, &cp->bdaddr);
1091 }
1092
1093 hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098 __u8 *sent, status = *((__u8 *) skb->data);
1099
1100 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1101
1102 if (status)
1103 return;
1104
1105 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1106 if (!sent)
1107 return;
1108
1109 hci_dev_lock(hdev);
1110
1111 /* If we're doing connection initiation as peripheral. Set a
1112 * timeout in case something goes wrong.
1113 */
1114 if (*sent) {
1115 struct hci_conn *conn;
1116
1117 hci_dev_set_flag(hdev, HCI_LE_ADV);
1118
1119 conn = hci_lookup_le_connect(hdev);
1120 if (conn)
1121 queue_delayed_work(hdev->workqueue,
1122 &conn->le_conn_timeout,
1123 conn->conn_timeout);
1124 } else {
1125 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1126 }
1127
1128 hci_dev_unlock(hdev);
1129 }
1130
1131 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1132 struct sk_buff *skb)
1133 {
1134 struct hci_cp_le_set_ext_adv_enable *cp;
1135 __u8 status = *((__u8 *) skb->data);
1136
1137 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1138
1139 if (status)
1140 return;
1141
1142 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1143 if (!cp)
1144 return;
1145
1146 hci_dev_lock(hdev);
1147
1148 if (cp->enable) {
1149 struct hci_conn *conn;
1150
1151 hci_dev_set_flag(hdev, HCI_LE_ADV);
1152
1153 conn = hci_lookup_le_connect(hdev);
1154 if (conn)
1155 queue_delayed_work(hdev->workqueue,
1156 &conn->le_conn_timeout,
1157 conn->conn_timeout);
1158 } else {
1159 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1160 }
1161
1162 hci_dev_unlock(hdev);
1163 }
1164
1165 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1166 {
1167 struct hci_cp_le_set_scan_param *cp;
1168 __u8 status = *((__u8 *) skb->data);
1169
1170 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1171
1172 if (status)
1173 return;
1174
1175 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1176 if (!cp)
1177 return;
1178
1179 hci_dev_lock(hdev);
1180
1181 hdev->le_scan_type = cp->type;
1182
1183 hci_dev_unlock(hdev);
1184 }
1185
1186 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1187 struct sk_buff *skb)
1188 {
1189 struct hci_cp_le_set_ext_scan_params *cp;
1190 __u8 status = *((__u8 *) skb->data);
1191 struct hci_cp_le_scan_phy_params *phy_param;
1192
1193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1194
1195 if (status)
1196 return;
1197
1198 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1199 if (!cp)
1200 return;
1201
1202 phy_param = (void *)cp->data;
1203
1204 hci_dev_lock(hdev);
1205
1206 hdev->le_scan_type = phy_param->type;
1207
1208 hci_dev_unlock(hdev);
1209 }
1210
1211 static bool has_pending_adv_report(struct hci_dev *hdev)
1212 {
1213 struct discovery_state *d = &hdev->discovery;
1214
1215 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1216 }
1217
1218 static void clear_pending_adv_report(struct hci_dev *hdev)
1219 {
1220 struct discovery_state *d = &hdev->discovery;
1221
1222 bacpy(&d->last_adv_addr, BDADDR_ANY);
1223 d->last_adv_data_len = 0;
1224 }
1225
1226 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1227 u8 bdaddr_type, s8 rssi, u32 flags,
1228 u8 *data, u8 len)
1229 {
1230 struct discovery_state *d = &hdev->discovery;
1231
1232 bacpy(&d->last_adv_addr, bdaddr);
1233 d->last_adv_addr_type = bdaddr_type;
1234 d->last_adv_rssi = rssi;
1235 d->last_adv_flags = flags;
1236 memcpy(d->last_adv_data, data, len);
1237 d->last_adv_data_len = len;
1238 }
1239
1240 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1241 {
1242 hci_dev_lock(hdev);
1243
1244 switch (enable) {
1245 case LE_SCAN_ENABLE:
1246 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1247 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1248 clear_pending_adv_report(hdev);
1249 break;
1250
1251 case LE_SCAN_DISABLE:
1252 /* We do this here instead of when setting DISCOVERY_STOPPED
1253 * since the latter would potentially require waiting for
1254 * inquiry to stop too.
1255 */
1256 if (has_pending_adv_report(hdev)) {
1257 struct discovery_state *d = &hdev->discovery;
1258
1259 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1260 d->last_adv_addr_type, NULL,
1261 d->last_adv_rssi, d->last_adv_flags,
1262 d->last_adv_data,
1263 d->last_adv_data_len, NULL, 0);
1264 }
1265
1266 /* Cancel this timer so that we don't try to disable scanning
1267 * when it's already disabled.
1268 */
1269 cancel_delayed_work(&hdev->le_scan_disable);
1270
1271 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1272
1273 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1274 * interrupted scanning due to a connect request. Mark
1275 * therefore discovery as stopped. If this was not
1276 * because of a connect request advertising might have
1277 * been disabled because of active scanning, so
1278 * re-enable it again if necessary.
1279 */
1280 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1281 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1282 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1283 hdev->discovery.state == DISCOVERY_FINDING)
1284 hci_req_reenable_advertising(hdev);
1285
1286 break;
1287
1288 default:
1289 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1290 enable);
1291 break;
1292 }
1293
1294 hci_dev_unlock(hdev);
1295 }
1296
1297 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1298 struct sk_buff *skb)
1299 {
1300 struct hci_cp_le_set_scan_enable *cp;
1301 __u8 status = *((__u8 *) skb->data);
1302
1303 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1304
1305 if (status)
1306 return;
1307
1308 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1309 if (!cp)
1310 return;
1311
1312 le_set_scan_enable_complete(hdev, cp->enable);
1313 }
1314
1315 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1316 struct sk_buff *skb)
1317 {
1318 struct hci_cp_le_set_ext_scan_enable *cp;
1319 __u8 status = *((__u8 *) skb->data);
1320
1321 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1322
1323 if (status)
1324 return;
1325
1326 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1327 if (!cp)
1328 return;
1329
1330 le_set_scan_enable_complete(hdev, cp->enable);
1331 }
1332
1333 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1334 struct sk_buff *skb)
1335 {
1336 struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1337
1338 BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1339 rp->num_of_sets);
1340
1341 if (rp->status)
1342 return;
1343
1344 hdev->le_num_of_adv_sets = rp->num_of_sets;
1345 }
1346
1347 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1348 struct sk_buff *skb)
1349 {
1350 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1351
1352 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1353
1354 if (rp->status)
1355 return;
1356
1357 hdev->le_white_list_size = rp->size;
1358 }
1359
1360 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1361 struct sk_buff *skb)
1362 {
1363 __u8 status = *((__u8 *) skb->data);
1364
1365 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1366
1367 if (status)
1368 return;
1369
1370 hci_bdaddr_list_clear(&hdev->le_white_list);
1371 }
1372
1373 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1374 struct sk_buff *skb)
1375 {
1376 struct hci_cp_le_add_to_white_list *sent;
1377 __u8 status = *((__u8 *) skb->data);
1378
1379 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1380
1381 if (status)
1382 return;
1383
1384 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1385 if (!sent)
1386 return;
1387
1388 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1389 sent->bdaddr_type);
1390 }
1391
1392 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1393 struct sk_buff *skb)
1394 {
1395 struct hci_cp_le_del_from_white_list *sent;
1396 __u8 status = *((__u8 *) skb->data);
1397
1398 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
1400 if (status)
1401 return;
1402
1403 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1404 if (!sent)
1405 return;
1406
1407 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1408 sent->bdaddr_type);
1409 }
1410
1411 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1412 struct sk_buff *skb)
1413 {
1414 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1415
1416 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1417
1418 if (rp->status)
1419 return;
1420
1421 memcpy(hdev->le_states, rp->le_states, 8);
1422 }
1423
1424 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1425 struct sk_buff *skb)
1426 {
1427 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1428
1429 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1430
1431 if (rp->status)
1432 return;
1433
1434 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1435 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1436 }
1437
1438 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1439 struct sk_buff *skb)
1440 {
1441 struct hci_cp_le_write_def_data_len *sent;
1442 __u8 status = *((__u8 *) skb->data);
1443
1444 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1445
1446 if (status)
1447 return;
1448
1449 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1450 if (!sent)
1451 return;
1452
1453 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1454 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1455 }
1456
1457 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1458 struct sk_buff *skb)
1459 {
1460 struct hci_cp_le_add_to_resolv_list *sent;
1461 __u8 status = *((__u8 *) skb->data);
1462
1463 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1464
1465 if (status)
1466 return;
1467
1468 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1469 if (!sent)
1470 return;
1471
1472 hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1473 sent->bdaddr_type, sent->peer_irk,
1474 sent->local_irk);
1475 }
1476
1477 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1478 struct sk_buff *skb)
1479 {
1480 struct hci_cp_le_del_from_resolv_list *sent;
1481 __u8 status = *((__u8 *) skb->data);
1482
1483 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1484
1485 if (status)
1486 return;
1487
1488 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1489 if (!sent)
1490 return;
1491
1492 hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1493 sent->bdaddr_type);
1494 }
1495
1496 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1497 struct sk_buff *skb)
1498 {
1499 __u8 status = *((__u8 *) skb->data);
1500
1501 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1502
1503 if (status)
1504 return;
1505
1506 hci_bdaddr_list_clear(&hdev->le_resolv_list);
1507 }
1508
1509 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1510 struct sk_buff *skb)
1511 {
1512 struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1513
1514 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1515
1516 if (rp->status)
1517 return;
1518
1519 hdev->le_resolv_list_size = rp->size;
1520 }
1521
1522 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1523 struct sk_buff *skb)
1524 {
1525 __u8 *sent, status = *((__u8 *) skb->data);
1526
1527 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1528
1529 if (status)
1530 return;
1531
1532 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1533 if (!sent)
1534 return;
1535
1536 hci_dev_lock(hdev);
1537
1538 if (*sent)
1539 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1540 else
1541 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1542
1543 hci_dev_unlock(hdev);
1544 }
1545
1546 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1547 struct sk_buff *skb)
1548 {
1549 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1550
1551 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1552
1553 if (rp->status)
1554 return;
1555
1556 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1557 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1558 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1559 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1560 }
1561
1562 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1563 struct sk_buff *skb)
1564 {
1565 struct hci_cp_write_le_host_supported *sent;
1566 __u8 status = *((__u8 *) skb->data);
1567
1568 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1569
1570 if (status)
1571 return;
1572
1573 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1574 if (!sent)
1575 return;
1576
1577 hci_dev_lock(hdev);
1578
1579 if (sent->le) {
1580 hdev->features[1][0] |= LMP_HOST_LE;
1581 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1582 } else {
1583 hdev->features[1][0] &= ~LMP_HOST_LE;
1584 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1585 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1586 }
1587
1588 if (sent->simul)
1589 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1590 else
1591 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1592
1593 hci_dev_unlock(hdev);
1594 }
1595
1596 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1597 {
1598 struct hci_cp_le_set_adv_param *cp;
1599 u8 status = *((u8 *) skb->data);
1600
1601 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1602
1603 if (status)
1604 return;
1605
1606 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1607 if (!cp)
1608 return;
1609
1610 hci_dev_lock(hdev);
1611 hdev->adv_addr_type = cp->own_address_type;
1612 hci_dev_unlock(hdev);
1613 }
1614
1615 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1616 {
1617 struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1618 struct hci_cp_le_set_ext_adv_params *cp;
1619 struct adv_info *adv_instance;
1620
1621 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1622
1623 if (rp->status)
1624 return;
1625
1626 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1627 if (!cp)
1628 return;
1629
1630 hci_dev_lock(hdev);
1631 hdev->adv_addr_type = cp->own_addr_type;
1632 if (!hdev->cur_adv_instance) {
1633 /* Store in hdev for instance 0 */
1634 hdev->adv_tx_power = rp->tx_power;
1635 } else {
1636 adv_instance = hci_find_adv_instance(hdev,
1637 hdev->cur_adv_instance);
1638 if (adv_instance)
1639 adv_instance->tx_power = rp->tx_power;
1640 }
1641 /* Update adv data as tx power is known now */
1642 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1643 hci_dev_unlock(hdev);
1644 }
1645
1646 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1647 {
1648 struct hci_rp_read_rssi *rp = (void *) skb->data;
1649 struct hci_conn *conn;
1650
1651 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1652
1653 if (rp->status)
1654 return;
1655
1656 hci_dev_lock(hdev);
1657
1658 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1659 if (conn)
1660 conn->rssi = rp->rssi;
1661
1662 hci_dev_unlock(hdev);
1663 }
1664
1665 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1666 {
1667 struct hci_cp_read_tx_power *sent;
1668 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1669 struct hci_conn *conn;
1670
1671 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1672
1673 if (rp->status)
1674 return;
1675
1676 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1677 if (!sent)
1678 return;
1679
1680 hci_dev_lock(hdev);
1681
1682 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1683 if (!conn)
1684 goto unlock;
1685
1686 switch (sent->type) {
1687 case 0x00:
1688 conn->tx_power = rp->tx_power;
1689 break;
1690 case 0x01:
1691 conn->max_tx_power = rp->tx_power;
1692 break;
1693 }
1694
1695 unlock:
1696 hci_dev_unlock(hdev);
1697 }
1698
1699 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1700 {
1701 u8 status = *((u8 *) skb->data);
1702 u8 *mode;
1703
1704 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1705
1706 if (status)
1707 return;
1708
1709 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1710 if (mode)
1711 hdev->ssp_debug_mode = *mode;
1712 }
1713
1714 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1715 {
1716 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1717
1718 if (status) {
1719 hci_conn_check_pending(hdev);
1720 return;
1721 }
1722
1723 set_bit(HCI_INQUIRY, &hdev->flags);
1724 }
1725
1726 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1727 {
1728 struct hci_cp_create_conn *cp;
1729 struct hci_conn *conn;
1730
1731 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1732
1733 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1734 if (!cp)
1735 return;
1736
1737 hci_dev_lock(hdev);
1738
1739 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1740
1741 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1742
1743 if (status) {
1744 if (conn && conn->state == BT_CONNECT) {
1745 if (status != 0x0c || conn->attempt > 2) {
1746 conn->state = BT_CLOSED;
1747 hci_connect_cfm(conn, status);
1748 hci_conn_del(conn);
1749 } else
1750 conn->state = BT_CONNECT2;
1751 }
1752 } else {
1753 if (!conn) {
1754 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1755 HCI_ROLE_MASTER);
1756 if (!conn)
1757 bt_dev_err(hdev, "no memory for new connection");
1758 }
1759 }
1760
1761 hci_dev_unlock(hdev);
1762 }
1763
1764 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1765 {
1766 struct hci_cp_add_sco *cp;
1767 struct hci_conn *acl, *sco;
1768 __u16 handle;
1769
1770 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1771
1772 if (!status)
1773 return;
1774
1775 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1776 if (!cp)
1777 return;
1778
1779 handle = __le16_to_cpu(cp->handle);
1780
1781 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1782
1783 hci_dev_lock(hdev);
1784
1785 acl = hci_conn_hash_lookup_handle(hdev, handle);
1786 if (acl) {
1787 sco = acl->link;
1788 if (sco) {
1789 sco->state = BT_CLOSED;
1790
1791 hci_connect_cfm(sco, status);
1792 hci_conn_del(sco);
1793 }
1794 }
1795
1796 hci_dev_unlock(hdev);
1797 }
1798
1799 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1800 {
1801 struct hci_cp_auth_requested *cp;
1802 struct hci_conn *conn;
1803
1804 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1805
1806 if (!status)
1807 return;
1808
1809 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1810 if (!cp)
1811 return;
1812
1813 hci_dev_lock(hdev);
1814
1815 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1816 if (conn) {
1817 if (conn->state == BT_CONFIG) {
1818 hci_connect_cfm(conn, status);
1819 hci_conn_drop(conn);
1820 }
1821 }
1822
1823 hci_dev_unlock(hdev);
1824 }
1825
1826 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1827 {
1828 struct hci_cp_set_conn_encrypt *cp;
1829 struct hci_conn *conn;
1830
1831 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1832
1833 if (!status)
1834 return;
1835
1836 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1837 if (!cp)
1838 return;
1839
1840 hci_dev_lock(hdev);
1841
1842 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1843 if (conn) {
1844 if (conn->state == BT_CONFIG) {
1845 hci_connect_cfm(conn, status);
1846 hci_conn_drop(conn);
1847 }
1848 }
1849
1850 hci_dev_unlock(hdev);
1851 }
1852
1853 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1854 struct hci_conn *conn)
1855 {
1856 if (conn->state != BT_CONFIG || !conn->out)
1857 return 0;
1858
1859 if (conn->pending_sec_level == BT_SECURITY_SDP)
1860 return 0;
1861
1862 /* Only request authentication for SSP connections or non-SSP
1863 * devices with sec_level MEDIUM or HIGH or if MITM protection
1864 * is requested.
1865 */
1866 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1867 conn->pending_sec_level != BT_SECURITY_FIPS &&
1868 conn->pending_sec_level != BT_SECURITY_HIGH &&
1869 conn->pending_sec_level != BT_SECURITY_MEDIUM)
1870 return 0;
1871
1872 return 1;
1873 }
1874
1875 static int hci_resolve_name(struct hci_dev *hdev,
1876 struct inquiry_entry *e)
1877 {
1878 struct hci_cp_remote_name_req cp;
1879
1880 memset(&cp, 0, sizeof(cp));
1881
1882 bacpy(&cp.bdaddr, &e->data.bdaddr);
1883 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1884 cp.pscan_mode = e->data.pscan_mode;
1885 cp.clock_offset = e->data.clock_offset;
1886
1887 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1888 }
1889
1890 static bool hci_resolve_next_name(struct hci_dev *hdev)
1891 {
1892 struct discovery_state *discov = &hdev->discovery;
1893 struct inquiry_entry *e;
1894
1895 if (list_empty(&discov->resolve))
1896 return false;
1897
1898 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1899 if (!e)
1900 return false;
1901
1902 if (hci_resolve_name(hdev, e) == 0) {
1903 e->name_state = NAME_PENDING;
1904 return true;
1905 }
1906
1907 return false;
1908 }
1909
1910 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1911 bdaddr_t *bdaddr, u8 *name, u8 name_len)
1912 {
1913 struct discovery_state *discov = &hdev->discovery;
1914 struct inquiry_entry *e;
1915
1916 /* Update the mgmt connected state if necessary. Be careful with
1917 * conn objects that exist but are not (yet) connected however.
1918 * Only those in BT_CONFIG or BT_CONNECTED states can be
1919 * considered connected.
1920 */
1921 if (conn &&
1922 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1923 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1924 mgmt_device_connected(hdev, conn, 0, name, name_len);
1925
1926 if (discov->state == DISCOVERY_STOPPED)
1927 return;
1928
1929 if (discov->state == DISCOVERY_STOPPING)
1930 goto discov_complete;
1931
1932 if (discov->state != DISCOVERY_RESOLVING)
1933 return;
1934
1935 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1936 /* If the device was not found in a list of found devices names of which
1937 * are pending. there is no need to continue resolving a next name as it
1938 * will be done upon receiving another Remote Name Request Complete
1939 * Event */
1940 if (!e)
1941 return;
1942
1943 list_del(&e->list);
1944 if (name) {
1945 e->name_state = NAME_KNOWN;
1946 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1947 e->data.rssi, name, name_len);
1948 } else {
1949 e->name_state = NAME_NOT_KNOWN;
1950 }
1951
1952 if (hci_resolve_next_name(hdev))
1953 return;
1954
1955 discov_complete:
1956 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1957 }
1958
1959 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1960 {
1961 struct hci_cp_remote_name_req *cp;
1962 struct hci_conn *conn;
1963
1964 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1965
1966 /* If successful wait for the name req complete event before
1967 * checking for the need to do authentication */
1968 if (!status)
1969 return;
1970
1971 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1972 if (!cp)
1973 return;
1974
1975 hci_dev_lock(hdev);
1976
1977 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1978
1979 if (hci_dev_test_flag(hdev, HCI_MGMT))
1980 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1981
1982 if (!conn)
1983 goto unlock;
1984
1985 if (!hci_outgoing_auth_needed(hdev, conn))
1986 goto unlock;
1987
1988 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1989 struct hci_cp_auth_requested auth_cp;
1990
1991 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1992
1993 auth_cp.handle = __cpu_to_le16(conn->handle);
1994 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1995 sizeof(auth_cp), &auth_cp);
1996 }
1997
1998 unlock:
1999 hci_dev_unlock(hdev);
2000 }
2001
2002 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2003 {
2004 struct hci_cp_read_remote_features *cp;
2005 struct hci_conn *conn;
2006
2007 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2008
2009 if (!status)
2010 return;
2011
2012 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2013 if (!cp)
2014 return;
2015
2016 hci_dev_lock(hdev);
2017
2018 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2019 if (conn) {
2020 if (conn->state == BT_CONFIG) {
2021 hci_connect_cfm(conn, status);
2022 hci_conn_drop(conn);
2023 }
2024 }
2025
2026 hci_dev_unlock(hdev);
2027 }
2028
2029 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2030 {
2031 struct hci_cp_read_remote_ext_features *cp;
2032 struct hci_conn *conn;
2033
2034 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2035
2036 if (!status)
2037 return;
2038
2039 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2040 if (!cp)
2041 return;
2042
2043 hci_dev_lock(hdev);
2044
2045 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2046 if (conn) {
2047 if (conn->state == BT_CONFIG) {
2048 hci_connect_cfm(conn, status);
2049 hci_conn_drop(conn);
2050 }
2051 }
2052
2053 hci_dev_unlock(hdev);
2054 }
2055
2056 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2057 {
2058 struct hci_cp_setup_sync_conn *cp;
2059 struct hci_conn *acl, *sco;
2060 __u16 handle;
2061
2062 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2063
2064 if (!status)
2065 return;
2066
2067 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2068 if (!cp)
2069 return;
2070
2071 handle = __le16_to_cpu(cp->handle);
2072
2073 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2074
2075 hci_dev_lock(hdev);
2076
2077 acl = hci_conn_hash_lookup_handle(hdev, handle);
2078 if (acl) {
2079 sco = acl->link;
2080 if (sco) {
2081 sco->state = BT_CLOSED;
2082
2083 hci_connect_cfm(sco, status);
2084 hci_conn_del(sco);
2085 }
2086 }
2087
2088 hci_dev_unlock(hdev);
2089 }
2090
2091 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2092 {
2093 struct hci_cp_sniff_mode *cp;
2094 struct hci_conn *conn;
2095
2096 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2097
2098 if (!status)
2099 return;
2100
2101 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2102 if (!cp)
2103 return;
2104
2105 hci_dev_lock(hdev);
2106
2107 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2108 if (conn) {
2109 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2110
2111 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2112 hci_sco_setup(conn, status);
2113 }
2114
2115 hci_dev_unlock(hdev);
2116 }
2117
2118 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2119 {
2120 struct hci_cp_exit_sniff_mode *cp;
2121 struct hci_conn *conn;
2122
2123 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2124
2125 if (!status)
2126 return;
2127
2128 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2129 if (!cp)
2130 return;
2131
2132 hci_dev_lock(hdev);
2133
2134 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2135 if (conn) {
2136 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2137
2138 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2139 hci_sco_setup(conn, status);
2140 }
2141
2142 hci_dev_unlock(hdev);
2143 }
2144
2145 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2146 {
2147 struct hci_cp_disconnect *cp;
2148 struct hci_conn *conn;
2149
2150 if (!status)
2151 return;
2152
2153 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2154 if (!cp)
2155 return;
2156
2157 hci_dev_lock(hdev);
2158
2159 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2160 if (conn)
2161 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2162 conn->dst_type, status);
2163
2164 hci_dev_unlock(hdev);
2165 }
2166
2167 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2168 u8 peer_addr_type, u8 own_address_type,
2169 u8 filter_policy)
2170 {
2171 struct hci_conn *conn;
2172
2173 conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2174 peer_addr_type);
2175 if (!conn)
2176 return;
2177
2178 /* Store the initiator and responder address information which
2179 * is needed for SMP. These values will not change during the
2180 * lifetime of the connection.
2181 */
2182 conn->init_addr_type = own_address_type;
2183 if (own_address_type == ADDR_LE_DEV_RANDOM)
2184 bacpy(&conn->init_addr, &hdev->random_addr);
2185 else
2186 bacpy(&conn->init_addr, &hdev->bdaddr);
2187
2188 conn->resp_addr_type = peer_addr_type;
2189 bacpy(&conn->resp_addr, peer_addr);
2190
2191 /* We don't want the connection attempt to stick around
2192 * indefinitely since LE doesn't have a page timeout concept
2193 * like BR/EDR. Set a timer for any connection that doesn't use
2194 * the white list for connecting.
2195 */
2196 if (filter_policy == HCI_LE_USE_PEER_ADDR)
2197 queue_delayed_work(conn->hdev->workqueue,
2198 &conn->le_conn_timeout,
2199 conn->conn_timeout);
2200 }
2201
2202 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2203 {
2204 struct hci_cp_le_create_conn *cp;
2205
2206 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2207
2208 /* All connection failure handling is taken care of by the
2209 * hci_le_conn_failed function which is triggered by the HCI
2210 * request completion callbacks used for connecting.
2211 */
2212 if (status)
2213 return;
2214
2215 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2216 if (!cp)
2217 return;
2218
2219 hci_dev_lock(hdev);
2220
2221 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2222 cp->own_address_type, cp->filter_policy);
2223
2224 hci_dev_unlock(hdev);
2225 }
2226
2227 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2228 {
2229 struct hci_cp_le_ext_create_conn *cp;
2230
2231 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2232
2233 /* All connection failure handling is taken care of by the
2234 * hci_le_conn_failed function which is triggered by the HCI
2235 * request completion callbacks used for connecting.
2236 */
2237 if (status)
2238 return;
2239
2240 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2241 if (!cp)
2242 return;
2243
2244 hci_dev_lock(hdev);
2245
2246 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2247 cp->own_addr_type, cp->filter_policy);
2248
2249 hci_dev_unlock(hdev);
2250 }
2251
2252 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2253 {
2254 struct hci_cp_le_read_remote_features *cp;
2255 struct hci_conn *conn;
2256
2257 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2258
2259 if (!status)
2260 return;
2261
2262 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2263 if (!cp)
2264 return;
2265
2266 hci_dev_lock(hdev);
2267
2268 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2269 if (conn) {
2270 if (conn->state == BT_CONFIG) {
2271 hci_connect_cfm(conn, status);
2272 hci_conn_drop(conn);
2273 }
2274 }
2275
2276 hci_dev_unlock(hdev);
2277 }
2278
2279 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2280 {
2281 struct hci_cp_le_start_enc *cp;
2282 struct hci_conn *conn;
2283
2284 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2285
2286 if (!status)
2287 return;
2288
2289 hci_dev_lock(hdev);
2290
2291 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2292 if (!cp)
2293 goto unlock;
2294
2295 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2296 if (!conn)
2297 goto unlock;
2298
2299 if (conn->state != BT_CONNECTED)
2300 goto unlock;
2301
2302 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2303 hci_conn_drop(conn);
2304
2305 unlock:
2306 hci_dev_unlock(hdev);
2307 }
2308
2309 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2310 {
2311 struct hci_cp_switch_role *cp;
2312 struct hci_conn *conn;
2313
2314 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2315
2316 if (!status)
2317 return;
2318
2319 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2320 if (!cp)
2321 return;
2322
2323 hci_dev_lock(hdev);
2324
2325 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2326 if (conn)
2327 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2328
2329 hci_dev_unlock(hdev);
2330 }
2331
2332 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2333 {
2334 __u8 status = *((__u8 *) skb->data);
2335 struct discovery_state *discov = &hdev->discovery;
2336 struct inquiry_entry *e;
2337
2338 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2339
2340 hci_conn_check_pending(hdev);
2341
2342 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2343 return;
2344
2345 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2346 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2347
2348 if (!hci_dev_test_flag(hdev, HCI_MGMT))
2349 return;
2350
2351 hci_dev_lock(hdev);
2352
2353 if (discov->state != DISCOVERY_FINDING)
2354 goto unlock;
2355
2356 if (list_empty(&discov->resolve)) {
2357 /* When BR/EDR inquiry is active and no LE scanning is in
2358 * progress, then change discovery state to indicate completion.
2359 *
2360 * When running LE scanning and BR/EDR inquiry simultaneously
2361 * and the LE scan already finished, then change the discovery
2362 * state to indicate completion.
2363 */
2364 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2365 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2366 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2367 goto unlock;
2368 }
2369
2370 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2371 if (e && hci_resolve_name(hdev, e) == 0) {
2372 e->name_state = NAME_PENDING;
2373 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2374 } else {
2375 /* When BR/EDR inquiry is active and no LE scanning is in
2376 * progress, then change discovery state to indicate completion.
2377 *
2378 * When running LE scanning and BR/EDR inquiry simultaneously
2379 * and the LE scan already finished, then change the discovery
2380 * state to indicate completion.
2381 */
2382 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2383 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2384 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2385 }
2386
2387 unlock:
2388 hci_dev_unlock(hdev);
2389 }
2390
2391 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2392 {
2393 struct inquiry_data data;
2394 struct inquiry_info *info = (void *) (skb->data + 1);
2395 int num_rsp = *((__u8 *) skb->data);
2396
2397 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2398
2399 if (!num_rsp)
2400 return;
2401
2402 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2403 return;
2404
2405 hci_dev_lock(hdev);
2406
2407 for (; num_rsp; num_rsp--, info++) {
2408 u32 flags;
2409
2410 bacpy(&data.bdaddr, &info->bdaddr);
2411 data.pscan_rep_mode = info->pscan_rep_mode;
2412 data.pscan_period_mode = info->pscan_period_mode;
2413 data.pscan_mode = info->pscan_mode;
2414 memcpy(data.dev_class, info->dev_class, 3);
2415 data.clock_offset = info->clock_offset;
2416 data.rssi = HCI_RSSI_INVALID;
2417 data.ssp_mode = 0x00;
2418
2419 flags = hci_inquiry_cache_update(hdev, &data, false);
2420
2421 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2422 info->dev_class, HCI_RSSI_INVALID,
2423 flags, NULL, 0, NULL, 0);
2424 }
2425
2426 hci_dev_unlock(hdev);
2427 }
2428
2429 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2430 {
2431 struct hci_ev_conn_complete *ev = (void *) skb->data;
2432 struct hci_conn *conn;
2433
2434 BT_DBG("%s", hdev->name);
2435
2436 hci_dev_lock(hdev);
2437
2438 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2439 if (!conn) {
2440 if (ev->link_type != SCO_LINK)
2441 goto unlock;
2442
2443 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2444 if (!conn)
2445 goto unlock;
2446
2447 conn->type = SCO_LINK;
2448 }
2449
2450 if (!ev->status) {
2451 conn->handle = __le16_to_cpu(ev->handle);
2452
2453 if (conn->type == ACL_LINK) {
2454 conn->state = BT_CONFIG;
2455 hci_conn_hold(conn);
2456
2457 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2458 !hci_find_link_key(hdev, &ev->bdaddr))
2459 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2460 else
2461 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2462 } else
2463 conn->state = BT_CONNECTED;
2464
2465 hci_debugfs_create_conn(conn);
2466 hci_conn_add_sysfs(conn);
2467
2468 if (test_bit(HCI_AUTH, &hdev->flags))
2469 set_bit(HCI_CONN_AUTH, &conn->flags);
2470
2471 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2472 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2473
2474 /* Get remote features */
2475 if (conn->type == ACL_LINK) {
2476 struct hci_cp_read_remote_features cp;
2477 cp.handle = ev->handle;
2478 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2479 sizeof(cp), &cp);
2480
2481 hci_req_update_scan(hdev);
2482 }
2483
2484 /* Set packet type for incoming connection */
2485 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2486 struct hci_cp_change_conn_ptype cp;
2487 cp.handle = ev->handle;
2488 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2489 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2490 &cp);
2491 }
2492 } else {
2493 conn->state = BT_CLOSED;
2494 if (conn->type == ACL_LINK)
2495 mgmt_connect_failed(hdev, &conn->dst, conn->type,
2496 conn->dst_type, ev->status);
2497 }
2498
2499 if (conn->type == ACL_LINK)
2500 hci_sco_setup(conn, ev->status);
2501
2502 if (ev->status) {
2503 hci_connect_cfm(conn, ev->status);
2504 hci_conn_del(conn);
2505 } else if (ev->link_type != ACL_LINK)
2506 hci_connect_cfm(conn, ev->status);
2507
2508 unlock:
2509 hci_dev_unlock(hdev);
2510
2511 hci_conn_check_pending(hdev);
2512 }
2513
2514 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2515 {
2516 struct hci_cp_reject_conn_req cp;
2517
2518 bacpy(&cp.bdaddr, bdaddr);
2519 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2520 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2521 }
2522
2523 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2524 {
2525 struct hci_ev_conn_request *ev = (void *) skb->data;
2526 int mask = hdev->link_mode;
2527 struct inquiry_entry *ie;
2528 struct hci_conn *conn;
2529 __u8 flags = 0;
2530
2531 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2532 ev->link_type);
2533
2534 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2535 &flags);
2536
2537 if (!(mask & HCI_LM_ACCEPT)) {
2538 hci_reject_conn(hdev, &ev->bdaddr);
2539 return;
2540 }
2541
2542 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2543 BDADDR_BREDR)) {
2544 hci_reject_conn(hdev, &ev->bdaddr);
2545 return;
2546 }
2547
2548 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2549 * connection. These features are only touched through mgmt so
2550 * only do the checks if HCI_MGMT is set.
2551 */
2552 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2553 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2554 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2555 BDADDR_BREDR)) {
2556 hci_reject_conn(hdev, &ev->bdaddr);
2557 return;
2558 }
2559
2560 /* Connection accepted */
2561
2562 hci_dev_lock(hdev);
2563
2564 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2565 if (ie)
2566 memcpy(ie->data.dev_class, ev->dev_class, 3);
2567
2568 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2569 &ev->bdaddr);
2570 if (!conn) {
2571 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2572 HCI_ROLE_SLAVE);
2573 if (!conn) {
2574 bt_dev_err(hdev, "no memory for new connection");
2575 hci_dev_unlock(hdev);
2576 return;
2577 }
2578 }
2579
2580 memcpy(conn->dev_class, ev->dev_class, 3);
2581
2582 hci_dev_unlock(hdev);
2583
2584 if (ev->link_type == ACL_LINK ||
2585 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2586 struct hci_cp_accept_conn_req cp;
2587 conn->state = BT_CONNECT;
2588
2589 bacpy(&cp.bdaddr, &ev->bdaddr);
2590
2591 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2592 cp.role = 0x00; /* Become master */
2593 else
2594 cp.role = 0x01; /* Remain slave */
2595
2596 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2597 } else if (!(flags & HCI_PROTO_DEFER)) {
2598 struct hci_cp_accept_sync_conn_req cp;
2599 conn->state = BT_CONNECT;
2600
2601 bacpy(&cp.bdaddr, &ev->bdaddr);
2602 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2603
2604 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2605 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2606 cp.max_latency = cpu_to_le16(0xffff);
2607 cp.content_format = cpu_to_le16(hdev->voice_setting);
2608 cp.retrans_effort = 0xff;
2609
2610 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2611 &cp);
2612 } else {
2613 conn->state = BT_CONNECT2;
2614 hci_connect_cfm(conn, 0);
2615 }
2616 }
2617
2618 static u8 hci_to_mgmt_reason(u8 err)
2619 {
2620 switch (err) {
2621 case HCI_ERROR_CONNECTION_TIMEOUT:
2622 return MGMT_DEV_DISCONN_TIMEOUT;
2623 case HCI_ERROR_REMOTE_USER_TERM:
2624 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2625 case HCI_ERROR_REMOTE_POWER_OFF:
2626 return MGMT_DEV_DISCONN_REMOTE;
2627 case HCI_ERROR_LOCAL_HOST_TERM:
2628 return MGMT_DEV_DISCONN_LOCAL_HOST;
2629 default:
2630 return MGMT_DEV_DISCONN_UNKNOWN;
2631 }
2632 }
2633
2634 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2635 {
2636 struct hci_ev_disconn_complete *ev = (void *) skb->data;
2637 u8 reason;
2638 struct hci_conn_params *params;
2639 struct hci_conn *conn;
2640 bool mgmt_connected;
2641 u8 type;
2642
2643 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2644
2645 hci_dev_lock(hdev);
2646
2647 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2648 if (!conn)
2649 goto unlock;
2650
2651 if (ev->status) {
2652 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2653 conn->dst_type, ev->status);
2654 goto unlock;
2655 }
2656
2657 conn->state = BT_CLOSED;
2658
2659 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2660
2661 if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2662 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2663 else
2664 reason = hci_to_mgmt_reason(ev->reason);
2665
2666 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2667 reason, mgmt_connected);
2668
2669 if (conn->type == ACL_LINK) {
2670 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2671 hci_remove_link_key(hdev, &conn->dst);
2672
2673 hci_req_update_scan(hdev);
2674 }
2675
2676 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2677 if (params) {
2678 switch (params->auto_connect) {
2679 case HCI_AUTO_CONN_LINK_LOSS:
2680 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2681 break;
2682 /* Fall through */
2683
2684 case HCI_AUTO_CONN_DIRECT:
2685 case HCI_AUTO_CONN_ALWAYS:
2686 list_del_init(&params->action);
2687 list_add(&params->action, &hdev->pend_le_conns);
2688 hci_update_background_scan(hdev);
2689 break;
2690
2691 default:
2692 break;
2693 }
2694 }
2695
2696 type = conn->type;
2697
2698 hci_disconn_cfm(conn, ev->reason);
2699 hci_conn_del(conn);
2700
2701 /* Re-enable advertising if necessary, since it might
2702 * have been disabled by the connection. From the
2703 * HCI_LE_Set_Advertise_Enable command description in
2704 * the core specification (v4.0):
2705 * "The Controller shall continue advertising until the Host
2706 * issues an LE_Set_Advertise_Enable command with
2707 * Advertising_Enable set to 0x00 (Advertising is disabled)
2708 * or until a connection is created or until the Advertising
2709 * is timed out due to Directed Advertising."
2710 */
2711 if (type == LE_LINK)
2712 hci_req_reenable_advertising(hdev);
2713
2714 unlock:
2715 hci_dev_unlock(hdev);
2716 }
2717
2718 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2719 {
2720 struct hci_ev_auth_complete *ev = (void *) skb->data;
2721 struct hci_conn *conn;
2722
2723 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2724
2725 hci_dev_lock(hdev);
2726
2727 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2728 if (!conn)
2729 goto unlock;
2730
2731 if (!ev->status) {
2732 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2733
2734 if (!hci_conn_ssp_enabled(conn) &&
2735 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2736 bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2737 } else {
2738 set_bit(HCI_CONN_AUTH, &conn->flags);
2739 conn->sec_level = conn->pending_sec_level;
2740 }
2741 } else {
2742 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2743 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2744
2745 mgmt_auth_failed(conn, ev->status);
2746 }
2747
2748 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2749 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2750
2751 if (conn->state == BT_CONFIG) {
2752 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2753 struct hci_cp_set_conn_encrypt cp;
2754 cp.handle = ev->handle;
2755 cp.encrypt = 0x01;
2756 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2757 &cp);
2758 } else {
2759 conn->state = BT_CONNECTED;
2760 hci_connect_cfm(conn, ev->status);
2761 hci_conn_drop(conn);
2762 }
2763 } else {
2764 hci_auth_cfm(conn, ev->status);
2765
2766 hci_conn_hold(conn);
2767 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2768 hci_conn_drop(conn);
2769 }
2770
2771 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2772 if (!ev->status) {
2773 struct hci_cp_set_conn_encrypt cp;
2774 cp.handle = ev->handle;
2775 cp.encrypt = 0x01;
2776 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2777 &cp);
2778 } else {
2779 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2780 hci_encrypt_cfm(conn, ev->status, 0x00);
2781 }
2782 }
2783
2784 unlock:
2785 hci_dev_unlock(hdev);
2786 }
2787
2788 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2789 {
2790 struct hci_ev_remote_name *ev = (void *) skb->data;
2791 struct hci_conn *conn;
2792
2793 BT_DBG("%s", hdev->name);
2794
2795 hci_conn_check_pending(hdev);
2796
2797 hci_dev_lock(hdev);
2798
2799 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2800
2801 if (!hci_dev_test_flag(hdev, HCI_MGMT))
2802 goto check_auth;
2803
2804 if (ev->status == 0)
2805 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2806 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2807 else
2808 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2809
2810 check_auth:
2811 if (!conn)
2812 goto unlock;
2813
2814 if (!hci_outgoing_auth_needed(hdev, conn))
2815 goto unlock;
2816
2817 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2818 struct hci_cp_auth_requested cp;
2819
2820 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2821
2822 cp.handle = __cpu_to_le16(conn->handle);
2823 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2824 }
2825
2826 unlock:
2827 hci_dev_unlock(hdev);
2828 }
2829
2830 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2831 u16 opcode, struct sk_buff *skb)
2832 {
2833 const struct hci_rp_read_enc_key_size *rp;
2834 struct hci_conn *conn;
2835 u16 handle;
2836
2837 BT_DBG("%s status 0x%02x", hdev->name, status);
2838
2839 if (!skb || skb->len < sizeof(*rp)) {
2840 bt_dev_err(hdev, "invalid read key size response");
2841 return;
2842 }
2843
2844 rp = (void *)skb->data;
2845 handle = le16_to_cpu(rp->handle);
2846
2847 hci_dev_lock(hdev);
2848
2849 conn = hci_conn_hash_lookup_handle(hdev, handle);
2850 if (!conn)
2851 goto unlock;
2852
2853 /* If we fail to read the encryption key size, assume maximum
2854 * (which is the same we do also when this HCI command isn't
2855 * supported.
2856 */
2857 if (rp->status) {
2858 bt_dev_err(hdev, "failed to read key size for handle %u",
2859 handle);
2860 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2861 } else {
2862 conn->enc_key_size = rp->key_size;
2863 }
2864
2865 if (conn->state == BT_CONFIG) {
2866 conn->state = BT_CONNECTED;
2867 hci_connect_cfm(conn, 0);
2868 hci_conn_drop(conn);
2869 } else {
2870 u8 encrypt;
2871
2872 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2873 encrypt = 0x00;
2874 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2875 encrypt = 0x02;
2876 else
2877 encrypt = 0x01;
2878
2879 hci_encrypt_cfm(conn, 0, encrypt);
2880 }
2881
2882 unlock:
2883 hci_dev_unlock(hdev);
2884 }
2885
2886 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2887 {
2888 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2889 struct hci_conn *conn;
2890
2891 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2892
2893 hci_dev_lock(hdev);
2894
2895 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2896 if (!conn)
2897 goto unlock;
2898
2899 if (!ev->status) {
2900 if (ev->encrypt) {
2901 /* Encryption implies authentication */
2902 set_bit(HCI_CONN_AUTH, &conn->flags);
2903 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2904 conn->sec_level = conn->pending_sec_level;
2905
2906 /* P-256 authentication key implies FIPS */
2907 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2908 set_bit(HCI_CONN_FIPS, &conn->flags);
2909
2910 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2911 conn->type == LE_LINK)
2912 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2913 } else {
2914 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2915 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2916 }
2917 }
2918
2919 /* We should disregard the current RPA and generate a new one
2920 * whenever the encryption procedure fails.
2921 */
2922 if (ev->status && conn->type == LE_LINK) {
2923 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2924 hci_adv_instances_set_rpa_expired(hdev, true);
2925 }
2926
2927 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2928
2929 if (ev->status && conn->state == BT_CONNECTED) {
2930 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2931 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2932
2933 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2934 hci_conn_drop(conn);
2935 goto unlock;
2936 }
2937
2938 /* In Secure Connections Only mode, do not allow any connections
2939 * that are not encrypted with AES-CCM using a P-256 authenticated
2940 * combination key.
2941 */
2942 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2943 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2944 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2945 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2946 hci_conn_drop(conn);
2947 goto unlock;
2948 }
2949
2950 /* Try reading the encryption key size for encrypted ACL links */
2951 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2952 struct hci_cp_read_enc_key_size cp;
2953 struct hci_request req;
2954
2955 /* Only send HCI_Read_Encryption_Key_Size if the
2956 * controller really supports it. If it doesn't, assume
2957 * the default size (16).
2958 */
2959 if (!(hdev->commands[20] & 0x10)) {
2960 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2961 goto notify;
2962 }
2963
2964 hci_req_init(&req, hdev);
2965
2966 cp.handle = cpu_to_le16(conn->handle);
2967 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2968
2969 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2970 bt_dev_err(hdev, "sending read key size failed");
2971 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2972 goto notify;
2973 }
2974
2975 goto unlock;
2976 }
2977
2978 notify:
2979 if (conn->state == BT_CONFIG) {
2980 if (!ev->status)
2981 conn->state = BT_CONNECTED;
2982
2983 hci_connect_cfm(conn, ev->status);
2984 hci_conn_drop(conn);
2985 } else
2986 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2987
2988 unlock:
2989 hci_dev_unlock(hdev);
2990 }
2991
2992 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2993 struct sk_buff *skb)
2994 {
2995 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2996 struct hci_conn *conn;
2997
2998 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2999
3000 hci_dev_lock(hdev);
3001
3002 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3003 if (conn) {
3004 if (!ev->status)
3005 set_bit(HCI_CONN_SECURE, &conn->flags);
3006
3007 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3008
3009 hci_key_change_cfm(conn, ev->status);
3010 }
3011
3012 hci_dev_unlock(hdev);
3013 }
3014
3015 static void hci_remote_features_evt(struct hci_dev *hdev,
3016 struct sk_buff *skb)
3017 {
3018 struct hci_ev_remote_features *ev = (void *) skb->data;
3019 struct hci_conn *conn;
3020
3021 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3022
3023 hci_dev_lock(hdev);
3024
3025 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3026 if (!conn)
3027 goto unlock;
3028
3029 if (!ev->status)
3030 memcpy(conn->features[0], ev->features, 8);
3031
3032 if (conn->state != BT_CONFIG)
3033 goto unlock;
3034
3035 if (!ev->status && lmp_ext_feat_capable(hdev) &&
3036 lmp_ext_feat_capable(conn)) {
3037 struct hci_cp_read_remote_ext_features cp;
3038 cp.handle = ev->handle;
3039 cp.page = 0x01;
3040 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3041 sizeof(cp), &cp);
3042 goto unlock;
3043 }
3044
3045 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3046 struct hci_cp_remote_name_req cp;
3047 memset(&cp, 0, sizeof(cp));
3048 bacpy(&cp.bdaddr, &conn->dst);
3049 cp.pscan_rep_mode = 0x02;
3050 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3051 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3052 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3053
3054 if (!hci_outgoing_auth_needed(hdev, conn)) {
3055 conn->state = BT_CONNECTED;
3056 hci_connect_cfm(conn, ev->status);
3057 hci_conn_drop(conn);
3058 }
3059
3060 unlock:
3061 hci_dev_unlock(hdev);
3062 }
3063
3064 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3065 u16 *opcode, u8 *status,
3066 hci_req_complete_t *req_complete,
3067 hci_req_complete_skb_t *req_complete_skb)
3068 {
3069 struct hci_ev_cmd_complete *ev = (void *) skb->data;
3070
3071 *opcode = __le16_to_cpu(ev->opcode);
3072 *status = skb->data[sizeof(*ev)];
3073
3074 skb_pull(skb, sizeof(*ev));
3075
3076 switch (*opcode) {
3077 case HCI_OP_INQUIRY_CANCEL:
3078 hci_cc_inquiry_cancel(hdev, skb);
3079 break;
3080
3081 case HCI_OP_PERIODIC_INQ:
3082 hci_cc_periodic_inq(hdev, skb);
3083 break;
3084
3085 case HCI_OP_EXIT_PERIODIC_INQ:
3086 hci_cc_exit_periodic_inq(hdev, skb);
3087 break;
3088
3089 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3090 hci_cc_remote_name_req_cancel(hdev, skb);
3091 break;
3092
3093 case HCI_OP_ROLE_DISCOVERY:
3094 hci_cc_role_discovery(hdev, skb);
3095 break;
3096
3097 case HCI_OP_READ_LINK_POLICY:
3098 hci_cc_read_link_policy(hdev, skb);
3099 break;
3100
3101 case HCI_OP_WRITE_LINK_POLICY:
3102 hci_cc_write_link_policy(hdev, skb);
3103 break;
3104
3105 case HCI_OP_READ_DEF_LINK_POLICY:
3106 hci_cc_read_def_link_policy(hdev, skb);
3107 break;
3108
3109 case HCI_OP_WRITE_DEF_LINK_POLICY:
3110 hci_cc_write_def_link_policy(hdev, skb);
3111 break;
3112
3113 case HCI_OP_RESET:
3114 hci_cc_reset(hdev, skb);
3115 break;
3116
3117 case HCI_OP_READ_STORED_LINK_KEY:
3118 hci_cc_read_stored_link_key(hdev, skb);
3119 break;
3120
3121 case HCI_OP_DELETE_STORED_LINK_KEY:
3122 hci_cc_delete_stored_link_key(hdev, skb);
3123 break;
3124
3125 case HCI_OP_WRITE_LOCAL_NAME:
3126 hci_cc_write_local_name(hdev, skb);
3127 break;
3128
3129 case HCI_OP_READ_LOCAL_NAME:
3130 hci_cc_read_local_name(hdev, skb);
3131 break;
3132
3133 case HCI_OP_WRITE_AUTH_ENABLE:
3134 hci_cc_write_auth_enable(hdev, skb);
3135 break;
3136
3137 case HCI_OP_WRITE_ENCRYPT_MODE:
3138 hci_cc_write_encrypt_mode(hdev, skb);
3139 break;
3140
3141 case HCI_OP_WRITE_SCAN_ENABLE:
3142 hci_cc_write_scan_enable(hdev, skb);
3143 break;
3144
3145 case HCI_OP_READ_CLASS_OF_DEV:
3146 hci_cc_read_class_of_dev(hdev, skb);
3147 break;
3148
3149 case HCI_OP_WRITE_CLASS_OF_DEV:
3150 hci_cc_write_class_of_dev(hdev, skb);
3151 break;
3152
3153 case HCI_OP_READ_VOICE_SETTING:
3154 hci_cc_read_voice_setting(hdev, skb);
3155 break;
3156
3157 case HCI_OP_WRITE_VOICE_SETTING:
3158 hci_cc_write_voice_setting(hdev, skb);
3159 break;
3160
3161 case HCI_OP_READ_NUM_SUPPORTED_IAC:
3162 hci_cc_read_num_supported_iac(hdev, skb);
3163 break;
3164
3165 case HCI_OP_WRITE_SSP_MODE:
3166 hci_cc_write_ssp_mode(hdev, skb);
3167 break;
3168
3169 case HCI_OP_WRITE_SC_SUPPORT:
3170 hci_cc_write_sc_support(hdev, skb);
3171 break;
3172
3173 case HCI_OP_READ_LOCAL_VERSION:
3174 hci_cc_read_local_version(hdev, skb);
3175 break;
3176
3177 case HCI_OP_READ_LOCAL_COMMANDS:
3178 hci_cc_read_local_commands(hdev, skb);
3179 break;
3180
3181 case HCI_OP_READ_LOCAL_FEATURES:
3182 hci_cc_read_local_features(hdev, skb);
3183 break;
3184
3185 case HCI_OP_READ_LOCAL_EXT_FEATURES:
3186 hci_cc_read_local_ext_features(hdev, skb);
3187 break;
3188
3189 case HCI_OP_READ_BUFFER_SIZE:
3190 hci_cc_read_buffer_size(hdev, skb);
3191 break;
3192
3193 case HCI_OP_READ_BD_ADDR:
3194 hci_cc_read_bd_addr(hdev, skb);
3195 break;
3196
3197 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3198 hci_cc_read_page_scan_activity(hdev, skb);
3199 break;
3200
3201 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3202 hci_cc_write_page_scan_activity(hdev, skb);
3203 break;
3204
3205 case HCI_OP_READ_PAGE_SCAN_TYPE:
3206 hci_cc_read_page_scan_type(hdev, skb);
3207 break;
3208
3209 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3210 hci_cc_write_page_scan_type(hdev, skb);
3211 break;
3212
3213 case HCI_OP_READ_DATA_BLOCK_SIZE:
3214 hci_cc_read_data_block_size(hdev, skb);
3215 break;
3216
3217 case HCI_OP_READ_FLOW_CONTROL_MODE:
3218 hci_cc_read_flow_control_mode(hdev, skb);
3219 break;
3220
3221 case HCI_OP_READ_LOCAL_AMP_INFO:
3222 hci_cc_read_local_amp_info(hdev, skb);
3223 break;
3224
3225 case HCI_OP_READ_CLOCK:
3226 hci_cc_read_clock(hdev, skb);
3227 break;
3228
3229 case HCI_OP_READ_INQ_RSP_TX_POWER:
3230 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3231 break;
3232
3233 case HCI_OP_PIN_CODE_REPLY:
3234 hci_cc_pin_code_reply(hdev, skb);
3235 break;
3236
3237 case HCI_OP_PIN_CODE_NEG_REPLY:
3238 hci_cc_pin_code_neg_reply(hdev, skb);
3239 break;
3240
3241 case HCI_OP_READ_LOCAL_OOB_DATA:
3242 hci_cc_read_local_oob_data(hdev, skb);
3243 break;
3244
3245 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3246 hci_cc_read_local_oob_ext_data(hdev, skb);
3247 break;
3248
3249 case HCI_OP_LE_READ_BUFFER_SIZE:
3250 hci_cc_le_read_buffer_size(hdev, skb);
3251 break;
3252
3253 case HCI_OP_LE_READ_LOCAL_FEATURES:
3254 hci_cc_le_read_local_features(hdev, skb);
3255 break;
3256
3257 case HCI_OP_LE_READ_ADV_TX_POWER:
3258 hci_cc_le_read_adv_tx_power(hdev, skb);
3259 break;
3260
3261 case HCI_OP_USER_CONFIRM_REPLY:
3262 hci_cc_user_confirm_reply(hdev, skb);
3263 break;
3264
3265 case HCI_OP_USER_CONFIRM_NEG_REPLY:
3266 hci_cc_user_confirm_neg_reply(hdev, skb);
3267 break;
3268
3269 case HCI_OP_USER_PASSKEY_REPLY:
3270 hci_cc_user_passkey_reply(hdev, skb);
3271 break;
3272
3273 case HCI_OP_USER_PASSKEY_NEG_REPLY:
3274 hci_cc_user_passkey_neg_reply(hdev, skb);
3275 break;
3276
3277 case HCI_OP_LE_SET_RANDOM_ADDR:
3278 hci_cc_le_set_random_addr(hdev, skb);
3279 break;
3280
3281 case HCI_OP_LE_SET_ADV_ENABLE:
3282 hci_cc_le_set_adv_enable(hdev, skb);
3283 break;
3284
3285 case HCI_OP_LE_SET_SCAN_PARAM:
3286 hci_cc_le_set_scan_param(hdev, skb);
3287 break;
3288
3289 case HCI_OP_LE_SET_SCAN_ENABLE:
3290 hci_cc_le_set_scan_enable(hdev, skb);
3291 break;
3292
3293 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3294 hci_cc_le_read_white_list_size(hdev, skb);
3295 break;
3296
3297 case HCI_OP_LE_CLEAR_WHITE_LIST:
3298 hci_cc_le_clear_white_list(hdev, skb);
3299 break;
3300
3301 case HCI_OP_LE_ADD_TO_WHITE_LIST:
3302 hci_cc_le_add_to_white_list(hdev, skb);
3303 break;
3304
3305 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3306 hci_cc_le_del_from_white_list(hdev, skb);
3307 break;
3308
3309 case HCI_OP_LE_READ_SUPPORTED_STATES:
3310 hci_cc_le_read_supported_states(hdev, skb);
3311 break;
3312
3313 case HCI_OP_LE_READ_DEF_DATA_LEN:
3314 hci_cc_le_read_def_data_len(hdev, skb);
3315 break;
3316
3317 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3318 hci_cc_le_write_def_data_len(hdev, skb);
3319 break;
3320
3321 case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3322 hci_cc_le_add_to_resolv_list(hdev, skb);
3323 break;
3324
3325 case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3326 hci_cc_le_del_from_resolv_list(hdev, skb);
3327 break;
3328
3329 case HCI_OP_LE_CLEAR_RESOLV_LIST:
3330 hci_cc_le_clear_resolv_list(hdev, skb);
3331 break;
3332
3333 case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3334 hci_cc_le_read_resolv_list_size(hdev, skb);
3335 break;
3336
3337 case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3338 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3339 break;
3340
3341 case HCI_OP_LE_READ_MAX_DATA_LEN:
3342 hci_cc_le_read_max_data_len(hdev, skb);
3343 break;
3344
3345 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3346 hci_cc_write_le_host_supported(hdev, skb);
3347 break;
3348
3349 case HCI_OP_LE_SET_ADV_PARAM:
3350 hci_cc_set_adv_param(hdev, skb);
3351 break;
3352
3353 case HCI_OP_READ_RSSI:
3354 hci_cc_read_rssi(hdev, skb);
3355 break;
3356
3357 case HCI_OP_READ_TX_POWER:
3358 hci_cc_read_tx_power(hdev, skb);
3359 break;
3360
3361 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3362 hci_cc_write_ssp_debug_mode(hdev, skb);
3363 break;
3364
3365 case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3366 hci_cc_le_set_ext_scan_param(hdev, skb);
3367 break;
3368
3369 case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3370 hci_cc_le_set_ext_scan_enable(hdev, skb);
3371 break;
3372
3373 case HCI_OP_LE_SET_DEFAULT_PHY:
3374 hci_cc_le_set_default_phy(hdev, skb);
3375 break;
3376
3377 case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3378 hci_cc_le_read_num_adv_sets(hdev, skb);
3379 break;
3380
3381 case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3382 hci_cc_set_ext_adv_param(hdev, skb);
3383 break;
3384
3385 case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3386 hci_cc_le_set_ext_adv_enable(hdev, skb);
3387 break;
3388
3389 case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3390 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3391 break;
3392
3393 default:
3394 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3395 break;
3396 }
3397
3398 if (*opcode != HCI_OP_NOP)
3399 cancel_delayed_work(&hdev->cmd_timer);
3400
3401 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3402 atomic_set(&hdev->cmd_cnt, 1);
3403
3404 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3405 req_complete_skb);
3406
3407 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3408 queue_work(hdev->workqueue, &hdev->cmd_work);
3409 }
3410
3411 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3412 u16 *opcode, u8 *status,
3413 hci_req_complete_t *req_complete,
3414 hci_req_complete_skb_t *req_complete_skb)
3415 {
3416 struct hci_ev_cmd_status *ev = (void *) skb->data;
3417
3418 skb_pull(skb, sizeof(*ev));
3419
3420 *opcode = __le16_to_cpu(ev->opcode);
3421 *status = ev->status;
3422
3423 switch (*opcode) {
3424 case HCI_OP_INQUIRY:
3425 hci_cs_inquiry(hdev, ev->status);
3426 break;
3427
3428 case HCI_OP_CREATE_CONN:
3429 hci_cs_create_conn(hdev, ev->status);
3430 break;
3431
3432 case HCI_OP_DISCONNECT:
3433 hci_cs_disconnect(hdev, ev->status);
3434 break;
3435
3436 case HCI_OP_ADD_SCO:
3437 hci_cs_add_sco(hdev, ev->status);
3438 break;
3439
3440 case HCI_OP_AUTH_REQUESTED:
3441 hci_cs_auth_requested(hdev, ev->status);
3442 break;
3443
3444 case HCI_OP_SET_CONN_ENCRYPT:
3445 hci_cs_set_conn_encrypt(hdev, ev->status);
3446 break;
3447
3448 case HCI_OP_REMOTE_NAME_REQ:
3449 hci_cs_remote_name_req(hdev, ev->status);
3450 break;
3451
3452 case HCI_OP_READ_REMOTE_FEATURES:
3453 hci_cs_read_remote_features(hdev, ev->status);
3454 break;
3455
3456 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3457 hci_cs_read_remote_ext_features(hdev, ev->status);
3458 break;
3459
3460 case HCI_OP_SETUP_SYNC_CONN:
3461 hci_cs_setup_sync_conn(hdev, ev->status);
3462 break;
3463
3464 case HCI_OP_SNIFF_MODE:
3465 hci_cs_sniff_mode(hdev, ev->status);
3466 break;
3467
3468 case HCI_OP_EXIT_SNIFF_MODE:
3469 hci_cs_exit_sniff_mode(hdev, ev->status);
3470 break;
3471
3472 case HCI_OP_SWITCH_ROLE:
3473 hci_cs_switch_role(hdev, ev->status);
3474 break;
3475
3476 case HCI_OP_LE_CREATE_CONN:
3477 hci_cs_le_create_conn(hdev, ev->status);
3478 break;
3479
3480 case HCI_OP_LE_READ_REMOTE_FEATURES:
3481 hci_cs_le_read_remote_features(hdev, ev->status);
3482 break;
3483
3484 case HCI_OP_LE_START_ENC:
3485 hci_cs_le_start_enc(hdev, ev->status);
3486 break;
3487
3488 case HCI_OP_LE_EXT_CREATE_CONN:
3489 hci_cs_le_ext_create_conn(hdev, ev->status);
3490 break;
3491
3492 default:
3493 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3494 break;
3495 }
3496
3497 if (*opcode != HCI_OP_NOP)
3498 cancel_delayed_work(&hdev->cmd_timer);
3499
3500 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3501 atomic_set(&hdev->cmd_cnt, 1);
3502
3503 /* Indicate request completion if the command failed. Also, if
3504 * we're not waiting for a special event and we get a success
3505 * command status we should try to flag the request as completed
3506 * (since for this kind of commands there will not be a command
3507 * complete event).
3508 */
3509 if (ev->status ||
3510 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3511 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3512 req_complete_skb);
3513
3514 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3515 queue_work(hdev->workqueue, &hdev->cmd_work);
3516 }
3517
3518 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3519 {
3520 struct hci_ev_hardware_error *ev = (void *) skb->data;
3521
3522 hdev->hw_error_code = ev->code;
3523
3524 queue_work(hdev->req_workqueue, &hdev->error_reset);
3525 }
3526
3527 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3528 {
3529 struct hci_ev_role_change *ev = (void *) skb->data;
3530 struct hci_conn *conn;
3531
3532 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3533
3534 hci_dev_lock(hdev);
3535
3536 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3537 if (conn) {
3538 if (!ev->status)
3539 conn->role = ev->role;
3540
3541 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3542
3543 hci_role_switch_cfm(conn, ev->status, ev->role);
3544 }
3545
3546 hci_dev_unlock(hdev);
3547 }
3548
3549 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3550 {
3551 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3552 int i;
3553
3554 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3555 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3556 return;
3557 }
3558
3559 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3560 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3561 BT_DBG("%s bad parameters", hdev->name);
3562 return;
3563 }
3564
3565 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3566
3567 for (i = 0; i < ev->num_hndl; i++) {
3568 struct hci_comp_pkts_info *info = &ev->handles[i];
3569 struct hci_conn *conn;
3570 __u16 handle, count;
3571
3572 handle = __le16_to_cpu(info->handle);
3573 count = __le16_to_cpu(info->count);
3574
3575 conn = hci_conn_hash_lookup_handle(hdev, handle);
3576 if (!conn)
3577 continue;
3578
3579 conn->sent -= count;
3580
3581 switch (conn->type) {
3582 case ACL_LINK:
3583 hdev->acl_cnt += count;
3584 if (hdev->acl_cnt > hdev->acl_pkts)
3585 hdev->acl_cnt = hdev->acl_pkts;
3586 break;
3587
3588 case LE_LINK:
3589 if (hdev->le_pkts) {
3590 hdev->le_cnt += count;
3591 if (hdev->le_cnt > hdev->le_pkts)
3592 hdev->le_cnt = hdev->le_pkts;
3593 } else {
3594 hdev->acl_cnt += count;
3595 if (hdev->acl_cnt > hdev->acl_pkts)
3596 hdev->acl_cnt = hdev->acl_pkts;
3597 }
3598 break;
3599
3600 case SCO_LINK:
3601 hdev->sco_cnt += count;
3602 if (hdev->sco_cnt > hdev->sco_pkts)
3603 hdev->sco_cnt = hdev->sco_pkts;
3604 break;
3605
3606 default:
3607 bt_dev_err(hdev, "unknown type %d conn %p",
3608 conn->type, conn);
3609 break;
3610 }
3611 }
3612
3613 queue_work(hdev->workqueue, &hdev->tx_work);
3614 }
3615
3616 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3617 __u16 handle)
3618 {
3619 struct hci_chan *chan;
3620
3621 switch (hdev->dev_type) {
3622 case HCI_PRIMARY:
3623 return hci_conn_hash_lookup_handle(hdev, handle);
3624 case HCI_AMP:
3625 chan = hci_chan_lookup_handle(hdev, handle);
3626 if (chan)
3627 return chan->conn;
3628 break;
3629 default:
3630 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3631 break;
3632 }
3633
3634 return NULL;
3635 }
3636
3637 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3638 {
3639 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3640 int i;
3641
3642 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3643 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3644 return;
3645 }
3646
3647 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3648 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3649 BT_DBG("%s bad parameters", hdev->name);
3650 return;
3651 }
3652
3653 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3654 ev->num_hndl);
3655
3656 for (i = 0; i < ev->num_hndl; i++) {
3657 struct hci_comp_blocks_info *info = &ev->handles[i];
3658 struct hci_conn *conn = NULL;
3659 __u16 handle, block_count;
3660
3661 handle = __le16_to_cpu(info->handle);
3662 block_count = __le16_to_cpu(info->blocks);
3663
3664 conn = __hci_conn_lookup_handle(hdev, handle);
3665 if (!conn)
3666 continue;
3667
3668 conn->sent -= block_count;
3669
3670 switch (conn->type) {
3671 case ACL_LINK:
3672 case AMP_LINK:
3673 hdev->block_cnt += block_count;
3674 if (hdev->block_cnt > hdev->num_blocks)
3675 hdev->block_cnt = hdev->num_blocks;
3676 break;
3677
3678 default:
3679 bt_dev_err(hdev, "unknown type %d conn %p",
3680 conn->type, conn);
3681 break;
3682 }
3683 }
3684
3685 queue_work(hdev->workqueue, &hdev->tx_work);
3686 }
3687
3688 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3689 {
3690 struct hci_ev_mode_change *ev = (void *) skb->data;
3691 struct hci_conn *conn;
3692
3693 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3694
3695 hci_dev_lock(hdev);
3696
3697 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3698 if (conn) {
3699 conn->mode = ev->mode;
3700
3701 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3702 &conn->flags)) {
3703 if (conn->mode == HCI_CM_ACTIVE)
3704 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3705 else
3706 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3707 }
3708
3709 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3710 hci_sco_setup(conn, ev->status);
3711 }
3712
3713 hci_dev_unlock(hdev);
3714 }
3715
3716 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3717 {
3718 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3719 struct hci_conn *conn;
3720
3721 BT_DBG("%s", hdev->name);
3722
3723 hci_dev_lock(hdev);
3724
3725 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3726 if (!conn)
3727 goto unlock;
3728
3729 if (conn->state == BT_CONNECTED) {
3730 hci_conn_hold(conn);
3731 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3732 hci_conn_drop(conn);
3733 }
3734
3735 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3736 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3737 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3738 sizeof(ev->bdaddr), &ev->bdaddr);
3739 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3740 u8 secure;
3741
3742 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3743 secure = 1;
3744 else
3745 secure = 0;
3746
3747 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3748 }
3749
3750 unlock:
3751 hci_dev_unlock(hdev);
3752 }
3753
3754 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3755 {
3756 if (key_type == HCI_LK_CHANGED_COMBINATION)
3757 return;
3758
3759 conn->pin_length = pin_len;
3760 conn->key_type = key_type;
3761
3762 switch (key_type) {
3763 case HCI_LK_LOCAL_UNIT:
3764 case HCI_LK_REMOTE_UNIT:
3765 case HCI_LK_DEBUG_COMBINATION:
3766 return;
3767 case HCI_LK_COMBINATION:
3768 if (pin_len == 16)
3769 conn->pending_sec_level = BT_SECURITY_HIGH;
3770 else
3771 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3772 break;
3773 case HCI_LK_UNAUTH_COMBINATION_P192:
3774 case HCI_LK_UNAUTH_COMBINATION_P256:
3775 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3776 break;
3777 case HCI_LK_AUTH_COMBINATION_P192:
3778 conn->pending_sec_level = BT_SECURITY_HIGH;
3779 break;
3780 case HCI_LK_AUTH_COMBINATION_P256:
3781 conn->pending_sec_level = BT_SECURITY_FIPS;
3782 break;
3783 }
3784 }
3785
3786 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3787 {
3788 struct hci_ev_link_key_req *ev = (void *) skb->data;
3789 struct hci_cp_link_key_reply cp;
3790 struct hci_conn *conn;
3791 struct link_key *key;
3792
3793 BT_DBG("%s", hdev->name);
3794
3795 if (!hci_dev_test_flag(hdev, HCI_MGMT))
3796 return;
3797
3798 hci_dev_lock(hdev);
3799
3800 key = hci_find_link_key(hdev, &ev->bdaddr);
3801 if (!key) {
3802 BT_DBG("%s link key not found for %pMR", hdev->name,
3803 &ev->bdaddr);
3804 goto not_found;
3805 }
3806
3807 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3808 &ev->bdaddr);
3809
3810 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3811 if (conn) {
3812 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3813
3814 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3815 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3816 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3817 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3818 goto not_found;
3819 }
3820
3821 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3822 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3823 conn->pending_sec_level == BT_SECURITY_FIPS)) {
3824 BT_DBG("%s ignoring key unauthenticated for high security",
3825 hdev->name);
3826 goto not_found;
3827 }
3828
3829 conn_set_key(conn, key->type, key->pin_len);
3830 }
3831
3832 bacpy(&cp.bdaddr, &ev->bdaddr);
3833 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3834
3835 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3836
3837 hci_dev_unlock(hdev);
3838
3839 return;
3840
3841 not_found:
3842 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3843 hci_dev_unlock(hdev);
3844 }
3845
3846 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3847 {
3848 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3849 struct hci_conn *conn;
3850 struct link_key *key;
3851 bool persistent;
3852 u8 pin_len = 0;
3853
3854 BT_DBG("%s", hdev->name);
3855
3856 hci_dev_lock(hdev);
3857
3858 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3859 if (!conn)
3860 goto unlock;
3861
3862 hci_conn_hold(conn);
3863 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3864 hci_conn_drop(conn);
3865
3866 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3867 conn_set_key(conn, ev->key_type, conn->pin_length);
3868
3869 if (!hci_dev_test_flag(hdev, HCI_MGMT))
3870 goto unlock;
3871
3872 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3873 ev->key_type, pin_len, &persistent);
3874 if (!key)
3875 goto unlock;
3876
3877 /* Update connection information since adding the key will have
3878 * fixed up the type in the case of changed combination keys.
3879 */
3880 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3881 conn_set_key(conn, key->type, key->pin_len);
3882
3883 mgmt_new_link_key(hdev, key, persistent);
3884
3885 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3886 * is set. If it's not set simply remove the key from the kernel
3887 * list (we've still notified user space about it but with
3888 * store_hint being 0).
3889 */
3890 if (key->type == HCI_LK_DEBUG_COMBINATION &&
3891 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3892 list_del_rcu(&key->list);
3893 kfree_rcu(key, rcu);
3894 goto unlock;
3895 }
3896
3897 if (persistent)
3898 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3899 else
3900 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3901
3902 unlock:
3903 hci_dev_unlock(hdev);
3904 }
3905
3906 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3907 {
3908 struct hci_ev_clock_offset *ev = (void *) skb->data;
3909 struct hci_conn *conn;
3910
3911 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3912
3913 hci_dev_lock(hdev);
3914
3915 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3916 if (conn && !ev->status) {
3917 struct inquiry_entry *ie;
3918
3919 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3920 if (ie) {
3921 ie->data.clock_offset = ev->clock_offset;
3922 ie->timestamp = jiffies;
3923 }
3924 }
3925
3926 hci_dev_unlock(hdev);
3927 }
3928
3929 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3930 {
3931 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3932 struct hci_conn *conn;
3933
3934 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3935
3936 hci_dev_lock(hdev);
3937
3938 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3939 if (conn && !ev->status)
3940 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3941
3942 hci_dev_unlock(hdev);
3943 }
3944
3945 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3946 {
3947 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3948 struct inquiry_entry *ie;
3949
3950 BT_DBG("%s", hdev->name);
3951
3952 hci_dev_lock(hdev);
3953
3954 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3955 if (ie) {
3956 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3957 ie->timestamp = jiffies;
3958 }
3959
3960 hci_dev_unlock(hdev);
3961 }
3962
3963 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3964 struct sk_buff *skb)
3965 {
3966 struct inquiry_data data;
3967 int num_rsp = *((__u8 *) skb->data);
3968
3969 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3970
3971 if (!num_rsp)
3972 return;
3973
3974 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3975 return;
3976
3977 hci_dev_lock(hdev);
3978
3979 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3980 struct inquiry_info_with_rssi_and_pscan_mode *info;
3981 info = (void *) (skb->data + 1);
3982
3983 for (; num_rsp; num_rsp--, info++) {
3984 u32 flags;
3985
3986 bacpy(&data.bdaddr, &info->bdaddr);
3987 data.pscan_rep_mode = info->pscan_rep_mode;
3988 data.pscan_period_mode = info->pscan_period_mode;
3989 data.pscan_mode = info->pscan_mode;
3990 memcpy(data.dev_class, info->dev_class, 3);
3991 data.clock_offset = info->clock_offset;
3992 data.rssi = info->rssi;
3993 data.ssp_mode = 0x00;
3994
3995 flags = hci_inquiry_cache_update(hdev, &data, false);
3996
3997 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3998 info->dev_class, info->rssi,
3999 flags, NULL, 0, NULL, 0);
4000 }
4001 } else {
4002 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4003
4004 for (; num_rsp; num_rsp--, info++) {
4005 u32 flags;
4006
4007 bacpy(&data.bdaddr, &info->bdaddr);
4008 data.pscan_rep_mode = info->pscan_rep_mode;
4009 data.pscan_period_mode = info->pscan_period_mode;
4010 data.pscan_mode = 0x00;
4011 memcpy(data.dev_class, info->dev_class, 3);
4012 data.clock_offset = info->clock_offset;
4013 data.rssi = info->rssi;
4014 data.ssp_mode = 0x00;
4015
4016 flags = hci_inquiry_cache_update(hdev, &data, false);
4017
4018 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4019 info->dev_class, info->rssi,
4020 flags, NULL, 0, NULL, 0);
4021 }
4022 }
4023
4024 hci_dev_unlock(hdev);
4025 }
4026
4027 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4028 struct sk_buff *skb)
4029 {
4030 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4031 struct hci_conn *conn;
4032
4033 BT_DBG("%s", hdev->name);
4034
4035 hci_dev_lock(hdev);
4036
4037 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4038 if (!conn)
4039 goto unlock;
4040
4041 if (ev->page < HCI_MAX_PAGES)
4042 memcpy(conn->features[ev->page], ev->features, 8);
4043
4044 if (!ev->status && ev->page == 0x01) {
4045 struct inquiry_entry *ie;
4046
4047 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4048 if (ie)
4049 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4050
4051 if (ev->features[0] & LMP_HOST_SSP) {
4052 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4053 } else {
4054 /* It is mandatory by the Bluetooth specification that
4055 * Extended Inquiry Results are only used when Secure
4056 * Simple Pairing is enabled, but some devices violate
4057 * this.
4058 *
4059 * To make these devices work, the internal SSP
4060 * enabled flag needs to be cleared if the remote host
4061 * features do not indicate SSP support */
4062 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4063 }
4064
4065 if (ev->features[0] & LMP_HOST_SC)
4066 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4067 }
4068
4069 if (conn->state != BT_CONFIG)
4070 goto unlock;
4071
4072 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4073 struct hci_cp_remote_name_req cp;
4074 memset(&cp, 0, sizeof(cp));
4075 bacpy(&cp.bdaddr, &conn->dst);
4076 cp.pscan_rep_mode = 0x02;
4077 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4078 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4079 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4080
4081 if (!hci_outgoing_auth_needed(hdev, conn)) {
4082 conn->state = BT_CONNECTED;
4083 hci_connect_cfm(conn, ev->status);
4084 hci_conn_drop(conn);
4085 }
4086
4087 unlock:
4088 hci_dev_unlock(hdev);
4089 }
4090
4091 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4092 struct sk_buff *skb)
4093 {
4094 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4095 struct hci_conn *conn;
4096
4097 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4098
4099 hci_dev_lock(hdev);
4100
4101 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4102 if (!conn) {
4103 if (ev->link_type == ESCO_LINK)
4104 goto unlock;
4105
4106 /* When the link type in the event indicates SCO connection
4107 * and lookup of the connection object fails, then check
4108 * if an eSCO connection object exists.
4109 *
4110 * The core limits the synchronous connections to either
4111 * SCO or eSCO. The eSCO connection is preferred and tried
4112 * to be setup first and until successfully established,
4113 * the link type will be hinted as eSCO.
4114 */
4115 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4116 if (!conn)
4117 goto unlock;
4118 }
4119
4120 switch (ev->status) {
4121 case 0x00:
4122 conn->handle = __le16_to_cpu(ev->handle);
4123 conn->state = BT_CONNECTED;
4124 conn->type = ev->link_type;
4125
4126 hci_debugfs_create_conn(conn);
4127 hci_conn_add_sysfs(conn);
4128 break;
4129
4130 case 0x10: /* Connection Accept Timeout */
4131 case 0x0d: /* Connection Rejected due to Limited Resources */
4132 case 0x11: /* Unsupported Feature or Parameter Value */
4133 case 0x1c: /* SCO interval rejected */
4134 case 0x1a: /* Unsupported Remote Feature */
4135 case 0x1f: /* Unspecified error */
4136 case 0x20: /* Unsupported LMP Parameter value */
4137 if (conn->out) {
4138 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4139 (hdev->esco_type & EDR_ESCO_MASK);
4140 if (hci_setup_sync(conn, conn->link->handle))
4141 goto unlock;
4142 }
4143 /* fall through */
4144
4145 default:
4146 conn->state = BT_CLOSED;
4147 break;
4148 }
4149
4150 hci_connect_cfm(conn, ev->status);
4151 if (ev->status)
4152 hci_conn_del(conn);
4153
4154 unlock:
4155 hci_dev_unlock(hdev);
4156 }
4157
4158 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4159 {
4160 size_t parsed = 0;
4161
4162 while (parsed < eir_len) {
4163 u8 field_len = eir[0];
4164
4165 if (field_len == 0)
4166 return parsed;
4167
4168 parsed += field_len + 1;
4169 eir += field_len + 1;
4170 }
4171
4172 return eir_len;
4173 }
4174
4175 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4176 struct sk_buff *skb)
4177 {
4178 struct inquiry_data data;
4179 struct extended_inquiry_info *info = (void *) (skb->data + 1);
4180 int num_rsp = *((__u8 *) skb->data);
4181 size_t eir_len;
4182
4183 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4184
4185 if (!num_rsp)
4186 return;
4187
4188 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4189 return;
4190
4191 hci_dev_lock(hdev);
4192
4193 for (; num_rsp; num_rsp--, info++) {
4194 u32 flags;
4195 bool name_known;
4196
4197 bacpy(&data.bdaddr, &info->bdaddr);
4198 data.pscan_rep_mode = info->pscan_rep_mode;
4199 data.pscan_period_mode = info->pscan_period_mode;
4200 data.pscan_mode = 0x00;
4201 memcpy(data.dev_class, info->dev_class, 3);
4202 data.clock_offset = info->clock_offset;
4203 data.rssi = info->rssi;
4204 data.ssp_mode = 0x01;
4205
4206 if (hci_dev_test_flag(hdev, HCI_MGMT))
4207 name_known = eir_get_data(info->data,
4208 sizeof(info->data),
4209 EIR_NAME_COMPLETE, NULL);
4210 else
4211 name_known = true;
4212
4213 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4214
4215 eir_len = eir_get_length(info->data, sizeof(info->data));
4216
4217 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4218 info->dev_class, info->rssi,
4219 flags, info->data, eir_len, NULL, 0);
4220 }
4221
4222 hci_dev_unlock(hdev);
4223 }
4224
4225 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4226 struct sk_buff *skb)
4227 {
4228 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4229 struct hci_conn *conn;
4230
4231 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4232 __le16_to_cpu(ev->handle));
4233
4234 hci_dev_lock(hdev);
4235
4236 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4237 if (!conn)
4238 goto unlock;
4239
4240 /* For BR/EDR the necessary steps are taken through the
4241 * auth_complete event.
4242 */
4243 if (conn->type != LE_LINK)
4244 goto unlock;
4245
4246 if (!ev->status)
4247 conn->sec_level = conn->pending_sec_level;
4248
4249 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4250
4251 if (ev->status && conn->state == BT_CONNECTED) {
4252 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4253 hci_conn_drop(conn);
4254 goto unlock;
4255 }
4256
4257 if (conn->state == BT_CONFIG) {
4258 if (!ev->status)
4259 conn->state = BT_CONNECTED;
4260
4261 hci_connect_cfm(conn, ev->status);
4262 hci_conn_drop(conn);
4263 } else {
4264 hci_auth_cfm(conn, ev->status);
4265
4266 hci_conn_hold(conn);
4267 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4268 hci_conn_drop(conn);
4269 }
4270
4271 unlock:
4272 hci_dev_unlock(hdev);
4273 }
4274
4275 static u8 hci_get_auth_req(struct hci_conn *conn)
4276 {
4277 /* If remote requests no-bonding follow that lead */
4278 if (conn->remote_auth == HCI_AT_NO_BONDING ||
4279 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4280 return conn->remote_auth | (conn->auth_type & 0x01);
4281
4282 /* If both remote and local have enough IO capabilities, require
4283 * MITM protection
4284 */
4285 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4286 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4287 return conn->remote_auth | 0x01;
4288
4289 /* No MITM protection possible so ignore remote requirement */
4290 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4291 }
4292
4293 static u8 bredr_oob_data_present(struct hci_conn *conn)
4294 {
4295 struct hci_dev *hdev = conn->hdev;
4296 struct oob_data *data;
4297
4298 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4299 if (!data)
4300 return 0x00;
4301
4302 if (bredr_sc_enabled(hdev)) {
4303 /* When Secure Connections is enabled, then just
4304 * return the present value stored with the OOB
4305 * data. The stored value contains the right present
4306 * information. However it can only be trusted when
4307 * not in Secure Connection Only mode.
4308 */
4309 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4310 return data->present;
4311
4312 /* When Secure Connections Only mode is enabled, then
4313 * the P-256 values are required. If they are not
4314 * available, then do not declare that OOB data is
4315 * present.
4316 */
4317 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4318 !memcmp(data->hash256, ZERO_KEY, 16))
4319 return 0x00;
4320
4321 return 0x02;
4322 }
4323
4324 /* When Secure Connections is not enabled or actually
4325 * not supported by the hardware, then check that if
4326 * P-192 data values are present.
4327 */
4328 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4329 !memcmp(data->hash192, ZERO_KEY, 16))
4330 return 0x00;
4331
4332 return 0x01;
4333 }
4334
4335 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4336 {
4337 struct hci_ev_io_capa_request *ev = (void *) skb->data;
4338 struct hci_conn *conn;
4339
4340 BT_DBG("%s", hdev->name);
4341
4342 hci_dev_lock(hdev);
4343
4344 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4345 if (!conn)
4346 goto unlock;
4347
4348 hci_conn_hold(conn);
4349
4350 if (!hci_dev_test_flag(hdev, HCI_MGMT))
4351 goto unlock;
4352
4353 /* Allow pairing if we're pairable, the initiators of the
4354 * pairing or if the remote is not requesting bonding.
4355 */
4356 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4357 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4358 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4359 struct hci_cp_io_capability_reply cp;
4360
4361 bacpy(&cp.bdaddr, &ev->bdaddr);
4362 /* Change the IO capability from KeyboardDisplay
4363 * to DisplayYesNo as it is not supported by BT spec. */
4364 cp.capability = (conn->io_capability == 0x04) ?
4365 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4366
4367 /* If we are initiators, there is no remote information yet */
4368 if (conn->remote_auth == 0xff) {
4369 /* Request MITM protection if our IO caps allow it
4370 * except for the no-bonding case.
4371 */
4372 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4373 conn->auth_type != HCI_AT_NO_BONDING)
4374 conn->auth_type |= 0x01;
4375 } else {
4376 conn->auth_type = hci_get_auth_req(conn);
4377 }
4378
4379 /* If we're not bondable, force one of the non-bondable
4380 * authentication requirement values.
4381 */
4382 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4383 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4384
4385 cp.authentication = conn->auth_type;
4386 cp.oob_data = bredr_oob_data_present(conn);
4387
4388 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4389 sizeof(cp), &cp);
4390 } else {
4391 struct hci_cp_io_capability_neg_reply cp;
4392
4393 bacpy(&cp.bdaddr, &ev->bdaddr);
4394 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4395
4396 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4397 sizeof(cp), &cp);
4398 }
4399
4400 unlock:
4401 hci_dev_unlock(hdev);
4402 }
4403
4404 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4405 {
4406 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4407 struct hci_conn *conn;
4408
4409 BT_DBG("%s", hdev->name);
4410
4411 hci_dev_lock(hdev);
4412
4413 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4414 if (!conn)
4415 goto unlock;
4416
4417 conn->remote_cap = ev->capability;
4418 conn->remote_auth = ev->authentication;
4419
4420 unlock:
4421 hci_dev_unlock(hdev);
4422 }
4423
4424 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4425 struct sk_buff *skb)
4426 {
4427 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4428 int loc_mitm, rem_mitm, confirm_hint = 0;
4429 struct hci_conn *conn;
4430
4431 BT_DBG("%s", hdev->name);
4432
4433 hci_dev_lock(hdev);
4434
4435 if (!hci_dev_test_flag(hdev, HCI_MGMT))
4436 goto unlock;
4437
4438 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4439 if (!conn)
4440 goto unlock;
4441
4442 loc_mitm = (conn->auth_type & 0x01);
4443 rem_mitm = (conn->remote_auth & 0x01);
4444
4445 /* If we require MITM but the remote device can't provide that
4446 * (it has NoInputNoOutput) then reject the confirmation
4447 * request. We check the security level here since it doesn't
4448 * necessarily match conn->auth_type.
4449 */
4450 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4451 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4452 BT_DBG("Rejecting request: remote device can't provide MITM");
4453 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4454 sizeof(ev->bdaddr), &ev->bdaddr);
4455 goto unlock;
4456 }
4457
4458 /* If no side requires MITM protection; auto-accept */
4459 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4460 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4461
4462 /* If we're not the initiators request authorization to
4463 * proceed from user space (mgmt_user_confirm with
4464 * confirm_hint set to 1). The exception is if neither
4465 * side had MITM or if the local IO capability is
4466 * NoInputNoOutput, in which case we do auto-accept
4467 */
4468 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4469 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4470 (loc_mitm || rem_mitm)) {
4471 BT_DBG("Confirming auto-accept as acceptor");
4472 confirm_hint = 1;
4473 goto confirm;
4474 }
4475
4476 BT_DBG("Auto-accept of user confirmation with %ums delay",
4477 hdev->auto_accept_delay);
4478
4479 if (hdev->auto_accept_delay > 0) {
4480 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4481 queue_delayed_work(conn->hdev->workqueue,
4482 &conn->auto_accept_work, delay);
4483 goto unlock;
4484 }
4485
4486 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4487 sizeof(ev->bdaddr), &ev->bdaddr);
4488 goto unlock;
4489 }
4490
4491 confirm:
4492 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4493 le32_to_cpu(ev->passkey), confirm_hint);
4494
4495 unlock:
4496 hci_dev_unlock(hdev);
4497 }
4498
4499 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4500 struct sk_buff *skb)
4501 {
4502 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4503
4504 BT_DBG("%s", hdev->name);
4505
4506 if (hci_dev_test_flag(hdev, HCI_MGMT))
4507 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4508 }
4509
4510 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4511 struct sk_buff *skb)
4512 {
4513 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4514 struct hci_conn *conn;
4515
4516 BT_DBG("%s", hdev->name);
4517
4518 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4519 if (!conn)
4520 return;
4521
4522 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4523 conn->passkey_entered = 0;
4524
4525 if (hci_dev_test_flag(hdev, HCI_MGMT))
4526 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4527 conn->dst_type, conn->passkey_notify,
4528 conn->passkey_entered);
4529 }
4530
4531 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4532 {
4533 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4534 struct hci_conn *conn;
4535
4536 BT_DBG("%s", hdev->name);
4537
4538 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4539 if (!conn)
4540 return;
4541
4542 switch (ev->type) {
4543 case HCI_KEYPRESS_STARTED:
4544 conn->passkey_entered = 0;
4545 return;
4546
4547 case HCI_KEYPRESS_ENTERED:
4548 conn->passkey_entered++;
4549 break;
4550
4551 case HCI_KEYPRESS_ERASED:
4552 conn->passkey_entered--;
4553 break;
4554
4555 case HCI_KEYPRESS_CLEARED:
4556 conn->passkey_entered = 0;
4557 break;
4558
4559 case HCI_KEYPRESS_COMPLETED:
4560 return;
4561 }
4562
4563 if (hci_dev_test_flag(hdev, HCI_MGMT))
4564 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4565 conn->dst_type, conn->passkey_notify,
4566 conn->passkey_entered);
4567 }
4568
4569 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4570 struct sk_buff *skb)
4571 {
4572 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4573 struct hci_conn *conn;
4574
4575 BT_DBG("%s", hdev->name);
4576
4577 hci_dev_lock(hdev);
4578
4579 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4580 if (!conn)
4581 goto unlock;
4582
4583 /* Reset the authentication requirement to unknown */
4584 conn->remote_auth = 0xff;
4585
4586 /* To avoid duplicate auth_failed events to user space we check
4587 * the HCI_CONN_AUTH_PEND flag which will be set if we
4588 * initiated the authentication. A traditional auth_complete
4589 * event gets always produced as initiator and is also mapped to
4590 * the mgmt_auth_failed event */
4591 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4592 mgmt_auth_failed(conn, ev->status);
4593
4594 hci_conn_drop(conn);
4595
4596 unlock:
4597 hci_dev_unlock(hdev);
4598 }
4599
4600 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4601 struct sk_buff *skb)
4602 {
4603 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4604 struct inquiry_entry *ie;
4605 struct hci_conn *conn;
4606
4607 BT_DBG("%s", hdev->name);
4608
4609 hci_dev_lock(hdev);
4610
4611 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4612 if (conn)
4613 memcpy(conn->features[1], ev->features, 8);
4614
4615 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4616 if (ie)
4617 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4618
4619 hci_dev_unlock(hdev);
4620 }
4621
4622 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4623 struct sk_buff *skb)
4624 {
4625 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4626 struct oob_data *data;
4627
4628 BT_DBG("%s", hdev->name);
4629
4630 hci_dev_lock(hdev);
4631
4632 if (!hci_dev_test_flag(hdev, HCI_MGMT))
4633 goto unlock;
4634
4635 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4636 if (!data) {
4637 struct hci_cp_remote_oob_data_neg_reply cp;
4638
4639 bacpy(&cp.bdaddr, &ev->bdaddr);
4640 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4641 sizeof(cp), &cp);
4642 goto unlock;
4643 }
4644
4645 if (bredr_sc_enabled(hdev)) {
4646 struct hci_cp_remote_oob_ext_data_reply cp;
4647
4648 bacpy(&cp.bdaddr, &ev->bdaddr);
4649 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4650 memset(cp.hash192, 0, sizeof(cp.hash192));
4651 memset(cp.rand192, 0, sizeof(cp.rand192));
4652 } else {
4653 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4654 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4655 }
4656 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4657 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4658
4659 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4660 sizeof(cp), &cp);
4661 } else {
4662 struct hci_cp_remote_oob_data_reply cp;
4663
4664 bacpy(&cp.bdaddr, &ev->bdaddr);
4665 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4666 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4667
4668 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4669 sizeof(cp), &cp);
4670 }
4671
4672 unlock:
4673 hci_dev_unlock(hdev);
4674 }
4675
4676 #if IS_ENABLED(CONFIG_BT_HS)
4677 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4678 {
4679 struct hci_ev_channel_selected *ev = (void *)skb->data;
4680 struct hci_conn *hcon;
4681
4682 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4683
4684 skb_pull(skb, sizeof(*ev));
4685
4686 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4687 if (!hcon)
4688 return;
4689
4690 amp_read_loc_assoc_final_data(hdev, hcon);
4691 }
4692
4693 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4694 struct sk_buff *skb)
4695 {
4696 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4697 struct hci_conn *hcon, *bredr_hcon;
4698
4699 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4700 ev->status);
4701
4702 hci_dev_lock(hdev);
4703
4704 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4705 if (!hcon) {
4706 hci_dev_unlock(hdev);
4707 return;
4708 }
4709
4710 if (ev->status) {
4711 hci_conn_del(hcon);
4712 hci_dev_unlock(hdev);
4713 return;
4714 }
4715
4716 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4717
4718 hcon->state = BT_CONNECTED;
4719 bacpy(&hcon->dst, &bredr_hcon->dst);
4720
4721 hci_conn_hold(hcon);
4722 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4723 hci_conn_drop(hcon);
4724
4725 hci_debugfs_create_conn(hcon);
4726 hci_conn_add_sysfs(hcon);
4727
4728 amp_physical_cfm(bredr_hcon, hcon);
4729
4730 hci_dev_unlock(hdev);
4731 }
4732
4733 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4734 {
4735 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4736 struct hci_conn *hcon;
4737 struct hci_chan *hchan;
4738 struct amp_mgr *mgr;
4739
4740 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4741 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4742 ev->status);
4743
4744 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4745 if (!hcon)
4746 return;
4747
4748 /* Create AMP hchan */
4749 hchan = hci_chan_create(hcon);
4750 if (!hchan)
4751 return;
4752
4753 hchan->handle = le16_to_cpu(ev->handle);
4754
4755 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4756
4757 mgr = hcon->amp_mgr;
4758 if (mgr && mgr->bredr_chan) {
4759 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4760
4761 l2cap_chan_lock(bredr_chan);
4762
4763 bredr_chan->conn->mtu = hdev->block_mtu;
4764 l2cap_logical_cfm(bredr_chan, hchan, 0);
4765 hci_conn_hold(hcon);
4766
4767 l2cap_chan_unlock(bredr_chan);
4768 }
4769 }
4770
4771 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4772 struct sk_buff *skb)
4773 {
4774 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4775 struct hci_chan *hchan;
4776
4777 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4778 le16_to_cpu(ev->handle), ev->status);
4779
4780 if (ev->status)
4781 return;
4782
4783 hci_dev_lock(hdev);
4784
4785 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4786 if (!hchan)
4787 goto unlock;
4788
4789 amp_destroy_logical_link(hchan, ev->reason);
4790
4791 unlock:
4792 hci_dev_unlock(hdev);
4793 }
4794
4795 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4796 struct sk_buff *skb)
4797 {
4798 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4799 struct hci_conn *hcon;
4800
4801 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4802
4803 if (ev->status)
4804 return;
4805
4806 hci_dev_lock(hdev);
4807
4808 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4809 if (hcon) {
4810 hcon->state = BT_CLOSED;
4811 hci_conn_del(hcon);
4812 }
4813
4814 hci_dev_unlock(hdev);
4815 }
4816 #endif
4817
4818 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4819 bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4820 u16 interval, u16 latency, u16 supervision_timeout)
4821 {
4822 struct hci_conn_params *params;
4823 struct hci_conn *conn;
4824 struct smp_irk *irk;
4825 u8 addr_type;
4826
4827 hci_dev_lock(hdev);
4828
4829 /* All controllers implicitly stop advertising in the event of a
4830 * connection, so ensure that the state bit is cleared.
4831 */
4832 hci_dev_clear_flag(hdev, HCI_LE_ADV);
4833
4834 conn = hci_lookup_le_connect(hdev);
4835 if (!conn) {
4836 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4837 if (!conn) {
4838 bt_dev_err(hdev, "no memory for new connection");
4839 goto unlock;
4840 }
4841
4842 conn->dst_type = bdaddr_type;
4843
4844 /* If we didn't have a hci_conn object previously
4845 * but we're in master role this must be something
4846 * initiated using a white list. Since white list based
4847 * connections are not "first class citizens" we don't
4848 * have full tracking of them. Therefore, we go ahead
4849 * with a "best effort" approach of determining the
4850 * initiator address based on the HCI_PRIVACY flag.
4851 */
4852 if (conn->out) {
4853 conn->resp_addr_type = bdaddr_type;
4854 bacpy(&conn->resp_addr, bdaddr);
4855 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4856 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4857 bacpy(&conn->init_addr, &hdev->rpa);
4858 } else {
4859 hci_copy_identity_address(hdev,
4860 &conn->init_addr,
4861 &conn->init_addr_type);
4862 }
4863 }
4864 } else {
4865 cancel_delayed_work(&conn->le_conn_timeout);
4866 }
4867
4868 if (!conn->out) {
4869 /* Set the responder (our side) address type based on
4870 * the advertising address type.
4871 */
4872 conn->resp_addr_type = hdev->adv_addr_type;
4873 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4874 /* In case of ext adv, resp_addr will be updated in
4875 * Adv Terminated event.
4876 */
4877 if (!ext_adv_capable(hdev))
4878 bacpy(&conn->resp_addr, &hdev->random_addr);
4879 } else {
4880 bacpy(&conn->resp_addr, &hdev->bdaddr);
4881 }
4882
4883 conn->init_addr_type = bdaddr_type;
4884 bacpy(&conn->init_addr, bdaddr);
4885
4886 /* For incoming connections, set the default minimum
4887 * and maximum connection interval. They will be used
4888 * to check if the parameters are in range and if not
4889 * trigger the connection update procedure.
4890 */
4891 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4892 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4893 }
4894
4895 /* Lookup the identity address from the stored connection
4896 * address and address type.
4897 *
4898 * When establishing connections to an identity address, the
4899 * connection procedure will store the resolvable random
4900 * address first. Now if it can be converted back into the
4901 * identity address, start using the identity address from
4902 * now on.
4903 */
4904 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4905 if (irk) {
4906 bacpy(&conn->dst, &irk->bdaddr);
4907 conn->dst_type = irk->addr_type;
4908 }
4909
4910 if (status) {
4911 hci_le_conn_failed(conn, status);
4912 goto unlock;
4913 }
4914
4915 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4916 addr_type = BDADDR_LE_PUBLIC;
4917 else
4918 addr_type = BDADDR_LE_RANDOM;
4919
4920 /* Drop the connection if the device is blocked */
4921 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4922 hci_conn_drop(conn);
4923 goto unlock;
4924 }
4925
4926 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4927 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4928
4929 conn->sec_level = BT_SECURITY_LOW;
4930 conn->handle = handle;
4931 conn->state = BT_CONFIG;
4932
4933 conn->le_conn_interval = interval;
4934 conn->le_conn_latency = latency;
4935 conn->le_supv_timeout = supervision_timeout;
4936
4937 hci_debugfs_create_conn(conn);
4938 hci_conn_add_sysfs(conn);
4939
4940 /* The remote features procedure is defined for master
4941 * role only. So only in case of an initiated connection
4942 * request the remote features.
4943 *
4944 * If the local controller supports slave-initiated features
4945 * exchange, then requesting the remote features in slave
4946 * role is possible. Otherwise just transition into the
4947 * connected state without requesting the remote features.
4948 */
4949 if (conn->out ||
4950 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4951 struct hci_cp_le_read_remote_features cp;
4952
4953 cp.handle = __cpu_to_le16(conn->handle);
4954
4955 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4956 sizeof(cp), &cp);
4957
4958 hci_conn_hold(conn);
4959 } else {
4960 conn->state = BT_CONNECTED;
4961 hci_connect_cfm(conn, status);
4962 }
4963
4964 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4965 conn->dst_type);
4966 if (params) {
4967 list_del_init(&params->action);
4968 if (params->conn) {
4969 hci_conn_drop(params->conn);
4970 hci_conn_put(params->conn);
4971 params->conn = NULL;
4972 }
4973 }
4974
4975 unlock:
4976 hci_update_background_scan(hdev);
4977 hci_dev_unlock(hdev);
4978 }
4979
4980 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4981 {
4982 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4983
4984 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4985
4986 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
4987 ev->role, le16_to_cpu(ev->handle),
4988 le16_to_cpu(ev->interval),
4989 le16_to_cpu(ev->latency),
4990 le16_to_cpu(ev->supervision_timeout));
4991 }
4992
4993 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
4994 struct sk_buff *skb)
4995 {
4996 struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
4997
4998 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4999
5000 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5001 ev->role, le16_to_cpu(ev->handle),
5002 le16_to_cpu(ev->interval),
5003 le16_to_cpu(ev->latency),
5004 le16_to_cpu(ev->supervision_timeout));
5005 }
5006
5007 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5008 {
5009 struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5010 struct hci_conn *conn;
5011
5012 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5013
5014 if (ev->status)
5015 return;
5016
5017 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5018 if (conn) {
5019 struct adv_info *adv_instance;
5020
5021 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5022 return;
5023
5024 if (!hdev->cur_adv_instance) {
5025 bacpy(&conn->resp_addr, &hdev->random_addr);
5026 return;
5027 }
5028
5029 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5030 if (adv_instance)
5031 bacpy(&conn->resp_addr, &adv_instance->random_addr);
5032 }
5033 }
5034
5035 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5036 struct sk_buff *skb)
5037 {
5038 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5039 struct hci_conn *conn;
5040
5041 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5042
5043 if (ev->status)
5044 return;
5045
5046 hci_dev_lock(hdev);
5047
5048 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5049 if (conn) {
5050 conn->le_conn_interval = le16_to_cpu(ev->interval);
5051 conn->le_conn_latency = le16_to_cpu(ev->latency);
5052 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5053 }
5054
5055 hci_dev_unlock(hdev);
5056 }
5057
5058 /* This function requires the caller holds hdev->lock */
5059 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5060 bdaddr_t *addr,
5061 u8 addr_type, u8 adv_type,
5062 bdaddr_t *direct_rpa)
5063 {
5064 struct hci_conn *conn;
5065 struct hci_conn_params *params;
5066
5067 /* If the event is not connectable don't proceed further */
5068 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5069 return NULL;
5070
5071 /* Ignore if the device is blocked */
5072 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5073 return NULL;
5074
5075 /* Most controller will fail if we try to create new connections
5076 * while we have an existing one in slave role.
5077 */
5078 if (hdev->conn_hash.le_num_slave > 0)
5079 return NULL;
5080
5081 /* If we're not connectable only connect devices that we have in
5082 * our pend_le_conns list.
5083 */
5084 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5085 addr_type);
5086 if (!params)
5087 return NULL;
5088
5089 if (!params->explicit_connect) {
5090 switch (params->auto_connect) {
5091 case HCI_AUTO_CONN_DIRECT:
5092 /* Only devices advertising with ADV_DIRECT_IND are
5093 * triggering a connection attempt. This is allowing
5094 * incoming connections from slave devices.
5095 */
5096 if (adv_type != LE_ADV_DIRECT_IND)
5097 return NULL;
5098 break;
5099 case HCI_AUTO_CONN_ALWAYS:
5100 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5101 * are triggering a connection attempt. This means
5102 * that incoming connectioms from slave device are
5103 * accepted and also outgoing connections to slave
5104 * devices are established when found.
5105 */
5106 break;
5107 default:
5108 return NULL;
5109 }
5110 }
5111
5112 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5113 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5114 direct_rpa);
5115 if (!IS_ERR(conn)) {
5116 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5117 * by higher layer that tried to connect, if no then
5118 * store the pointer since we don't really have any
5119 * other owner of the object besides the params that
5120 * triggered it. This way we can abort the connection if
5121 * the parameters get removed and keep the reference
5122 * count consistent once the connection is established.
5123 */
5124
5125 if (!params->explicit_connect)
5126 params->conn = hci_conn_get(conn);
5127
5128 return conn;
5129 }
5130
5131 switch (PTR_ERR(conn)) {
5132 case -EBUSY:
5133 /* If hci_connect() returns -EBUSY it means there is already
5134 * an LE connection attempt going on. Since controllers don't
5135 * support more than one connection attempt at the time, we
5136 * don't consider this an error case.
5137 */
5138 break;
5139 default:
5140 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5141 return NULL;
5142 }
5143
5144 return NULL;
5145 }
5146
5147 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5148 u8 bdaddr_type, bdaddr_t *direct_addr,
5149 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5150 {
5151 struct discovery_state *d = &hdev->discovery;
5152 struct smp_irk *irk;
5153 struct hci_conn *conn;
5154 bool match;
5155 u32 flags;
5156 u8 *ptr, real_len;
5157
5158 switch (type) {
5159 case LE_ADV_IND:
5160 case LE_ADV_DIRECT_IND:
5161 case LE_ADV_SCAN_IND:
5162 case LE_ADV_NONCONN_IND:
5163 case LE_ADV_SCAN_RSP:
5164 break;
5165 default:
5166 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5167 "type: 0x%02x", type);
5168 return;
5169 }
5170
5171 /* Find the end of the data in case the report contains padded zero
5172 * bytes at the end causing an invalid length value.
5173 *
5174 * When data is NULL, len is 0 so there is no need for extra ptr
5175 * check as 'ptr < data + 0' is already false in such case.
5176 */
5177 for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5178 if (ptr + 1 + *ptr > data + len)
5179 break;
5180 }
5181
5182 real_len = ptr - data;
5183
5184 /* Adjust for actual length */
5185 if (len != real_len) {
5186 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5187 len = real_len;
5188 }
5189
5190 /* If the direct address is present, then this report is from
5191 * a LE Direct Advertising Report event. In that case it is
5192 * important to see if the address is matching the local
5193 * controller address.
5194 */
5195 if (direct_addr) {
5196 /* Only resolvable random addresses are valid for these
5197 * kind of reports and others can be ignored.
5198 */
5199 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5200 return;
5201
5202 /* If the controller is not using resolvable random
5203 * addresses, then this report can be ignored.
5204 */
5205 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5206 return;
5207
5208 /* If the local IRK of the controller does not match
5209 * with the resolvable random address provided, then
5210 * this report can be ignored.
5211 */
5212 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5213 return;
5214 }
5215
5216 /* Check if we need to convert to identity address */
5217 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5218 if (irk) {
5219 bdaddr = &irk->bdaddr;
5220 bdaddr_type = irk->addr_type;
5221 }
5222
5223 /* Check if we have been requested to connect to this device.
5224 *
5225 * direct_addr is set only for directed advertising reports (it is NULL
5226 * for advertising reports) and is already verified to be RPA above.
5227 */
5228 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5229 direct_addr);
5230 if (conn && type == LE_ADV_IND) {
5231 /* Store report for later inclusion by
5232 * mgmt_device_connected
5233 */
5234 memcpy(conn->le_adv_data, data, len);
5235 conn->le_adv_data_len = len;
5236 }
5237
5238 /* Passive scanning shouldn't trigger any device found events,
5239 * except for devices marked as CONN_REPORT for which we do send
5240 * device found events.
5241 */
5242 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5243 if (type == LE_ADV_DIRECT_IND)
5244 return;
5245
5246 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5247 bdaddr, bdaddr_type))
5248 return;
5249
5250 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5251 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5252 else
5253 flags = 0;
5254 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5255 rssi, flags, data, len, NULL, 0);
5256 return;
5257 }
5258
5259 /* When receiving non-connectable or scannable undirected
5260 * advertising reports, this means that the remote device is
5261 * not connectable and then clearly indicate this in the
5262 * device found event.
5263 *
5264 * When receiving a scan response, then there is no way to
5265 * know if the remote device is connectable or not. However
5266 * since scan responses are merged with a previously seen
5267 * advertising report, the flags field from that report
5268 * will be used.
5269 *
5270 * In the really unlikely case that a controller get confused
5271 * and just sends a scan response event, then it is marked as
5272 * not connectable as well.
5273 */
5274 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5275 type == LE_ADV_SCAN_RSP)
5276 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5277 else
5278 flags = 0;
5279
5280 /* If there's nothing pending either store the data from this
5281 * event or send an immediate device found event if the data
5282 * should not be stored for later.
5283 */
5284 if (!has_pending_adv_report(hdev)) {
5285 /* If the report will trigger a SCAN_REQ store it for
5286 * later merging.
5287 */
5288 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5289 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5290 rssi, flags, data, len);
5291 return;
5292 }
5293
5294 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5295 rssi, flags, data, len, NULL, 0);
5296 return;
5297 }
5298
5299 /* Check if the pending report is for the same device as the new one */
5300 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5301 bdaddr_type == d->last_adv_addr_type);
5302
5303 /* If the pending data doesn't match this report or this isn't a
5304 * scan response (e.g. we got a duplicate ADV_IND) then force
5305 * sending of the pending data.
5306 */
5307 if (type != LE_ADV_SCAN_RSP || !match) {
5308 /* Send out whatever is in the cache, but skip duplicates */
5309 if (!match)
5310 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5311 d->last_adv_addr_type, NULL,
5312 d->last_adv_rssi, d->last_adv_flags,
5313 d->last_adv_data,
5314 d->last_adv_data_len, NULL, 0);
5315
5316 /* If the new report will trigger a SCAN_REQ store it for
5317 * later merging.
5318 */
5319 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5320 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5321 rssi, flags, data, len);
5322 return;
5323 }
5324
5325 /* The advertising reports cannot be merged, so clear
5326 * the pending report and send out a device found event.
5327 */
5328 clear_pending_adv_report(hdev);
5329 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5330 rssi, flags, data, len, NULL, 0);
5331 return;
5332 }
5333
5334 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5335 * the new event is a SCAN_RSP. We can therefore proceed with
5336 * sending a merged device found event.
5337 */
5338 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5339 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5340 d->last_adv_data, d->last_adv_data_len, data, len);
5341 clear_pending_adv_report(hdev);
5342 }
5343
5344 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5345 {
5346 u8 num_reports = skb->data[0];
5347 void *ptr = &skb->data[1];
5348
5349 hci_dev_lock(hdev);
5350
5351 while (num_reports--) {
5352 struct hci_ev_le_advertising_info *ev = ptr;
5353 s8 rssi;
5354
5355 if (ev->length <= HCI_MAX_AD_LENGTH) {
5356 rssi = ev->data[ev->length];
5357 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5358 ev->bdaddr_type, NULL, 0, rssi,
5359 ev->data, ev->length);
5360 } else {
5361 bt_dev_err(hdev, "Dropping invalid advertising data");
5362 }
5363
5364 ptr += sizeof(*ev) + ev->length + 1;
5365 }
5366
5367 hci_dev_unlock(hdev);
5368 }
5369
5370 static u8 ext_evt_type_to_legacy(u16 evt_type)
5371 {
5372 if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5373 switch (evt_type) {
5374 case LE_LEGACY_ADV_IND:
5375 return LE_ADV_IND;
5376 case LE_LEGACY_ADV_DIRECT_IND:
5377 return LE_ADV_DIRECT_IND;
5378 case LE_LEGACY_ADV_SCAN_IND:
5379 return LE_ADV_SCAN_IND;
5380 case LE_LEGACY_NONCONN_IND:
5381 return LE_ADV_NONCONN_IND;
5382 case LE_LEGACY_SCAN_RSP_ADV:
5383 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5384 return LE_ADV_SCAN_RSP;
5385 }
5386
5387 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5388 evt_type);
5389
5390 return LE_ADV_INVALID;
5391 }
5392
5393 if (evt_type & LE_EXT_ADV_CONN_IND) {
5394 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5395 return LE_ADV_DIRECT_IND;
5396
5397 return LE_ADV_IND;
5398 }
5399
5400 if (evt_type & LE_EXT_ADV_SCAN_RSP)
5401 return LE_ADV_SCAN_RSP;
5402
5403 if (evt_type & LE_EXT_ADV_SCAN_IND)
5404 return LE_ADV_SCAN_IND;
5405
5406 if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5407 evt_type & LE_EXT_ADV_DIRECT_IND)
5408 return LE_ADV_NONCONN_IND;
5409
5410 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5411 evt_type);
5412
5413 return LE_ADV_INVALID;
5414 }
5415
5416 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5417 {
5418 u8 num_reports = skb->data[0];
5419 void *ptr = &skb->data[1];
5420
5421 hci_dev_lock(hdev);
5422
5423 while (num_reports--) {
5424 struct hci_ev_le_ext_adv_report *ev = ptr;
5425 u8 legacy_evt_type;
5426 u16 evt_type;
5427
5428 evt_type = __le16_to_cpu(ev->evt_type);
5429 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5430 if (legacy_evt_type != LE_ADV_INVALID) {
5431 process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5432 ev->bdaddr_type, NULL, 0, ev->rssi,
5433 ev->data, ev->length);
5434 }
5435
5436 ptr += sizeof(*ev) + ev->length + 1;
5437 }
5438
5439 hci_dev_unlock(hdev);
5440 }
5441
5442 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5443 struct sk_buff *skb)
5444 {
5445 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5446 struct hci_conn *conn;
5447
5448 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5449
5450 hci_dev_lock(hdev);
5451
5452 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5453 if (conn) {
5454 if (!ev->status)
5455 memcpy(conn->features[0], ev->features, 8);
5456
5457 if (conn->state == BT_CONFIG) {
5458 __u8 status;
5459
5460 /* If the local controller supports slave-initiated
5461 * features exchange, but the remote controller does
5462 * not, then it is possible that the error code 0x1a
5463 * for unsupported remote feature gets returned.
5464 *
5465 * In this specific case, allow the connection to
5466 * transition into connected state and mark it as
5467 * successful.
5468 */
5469 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5470 !conn->out && ev->status == 0x1a)
5471 status = 0x00;
5472 else
5473 status = ev->status;
5474
5475 conn->state = BT_CONNECTED;
5476 hci_connect_cfm(conn, status);
5477 hci_conn_drop(conn);
5478 }
5479 }
5480
5481 hci_dev_unlock(hdev);
5482 }
5483
5484 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5485 {
5486 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5487 struct hci_cp_le_ltk_reply cp;
5488 struct hci_cp_le_ltk_neg_reply neg;
5489 struct hci_conn *conn;
5490 struct smp_ltk *ltk;
5491
5492 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5493
5494 hci_dev_lock(hdev);
5495
5496 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5497 if (conn == NULL)
5498 goto not_found;
5499
5500 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5501 if (!ltk)
5502 goto not_found;
5503
5504 if (smp_ltk_is_sc(ltk)) {
5505 /* With SC both EDiv and Rand are set to zero */
5506 if (ev->ediv || ev->rand)
5507 goto not_found;
5508 } else {
5509 /* For non-SC keys check that EDiv and Rand match */
5510 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5511 goto not_found;
5512 }
5513
5514 memcpy(cp.ltk, ltk->val, ltk->enc_size);
5515 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5516 cp.handle = cpu_to_le16(conn->handle);
5517
5518 conn->pending_sec_level = smp_ltk_sec_level(ltk);
5519
5520 conn->enc_key_size = ltk->enc_size;
5521
5522 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5523
5524 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5525 * temporary key used to encrypt a connection following
5526 * pairing. It is used during the Encrypted Session Setup to
5527 * distribute the keys. Later, security can be re-established
5528 * using a distributed LTK.
5529 */
5530 if (ltk->type == SMP_STK) {
5531 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5532 list_del_rcu(&ltk->list);
5533 kfree_rcu(ltk, rcu);
5534 } else {
5535 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5536 }
5537
5538 hci_dev_unlock(hdev);
5539
5540 return;
5541
5542 not_found:
5543 neg.handle = ev->handle;
5544 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5545 hci_dev_unlock(hdev);
5546 }
5547
5548 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5549 u8 reason)
5550 {
5551 struct hci_cp_le_conn_param_req_neg_reply cp;
5552
5553 cp.handle = cpu_to_le16(handle);
5554 cp.reason = reason;
5555
5556 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5557 &cp);
5558 }
5559
5560 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5561 struct sk_buff *skb)
5562 {
5563 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5564 struct hci_cp_le_conn_param_req_reply cp;
5565 struct hci_conn *hcon;
5566 u16 handle, min, max, latency, timeout;
5567
5568 handle = le16_to_cpu(ev->handle);
5569 min = le16_to_cpu(ev->interval_min);
5570 max = le16_to_cpu(ev->interval_max);
5571 latency = le16_to_cpu(ev->latency);
5572 timeout = le16_to_cpu(ev->timeout);
5573
5574 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5575 if (!hcon || hcon->state != BT_CONNECTED)
5576 return send_conn_param_neg_reply(hdev, handle,
5577 HCI_ERROR_UNKNOWN_CONN_ID);
5578
5579 if (hci_check_conn_params(min, max, latency, timeout))
5580 return send_conn_param_neg_reply(hdev, handle,
5581 HCI_ERROR_INVALID_LL_PARAMS);
5582
5583 if (hcon->role == HCI_ROLE_MASTER) {
5584 struct hci_conn_params *params;
5585 u8 store_hint;
5586
5587 hci_dev_lock(hdev);
5588
5589 params = hci_conn_params_lookup(hdev, &hcon->dst,
5590 hcon->dst_type);
5591 if (params) {
5592 params->conn_min_interval = min;
5593 params->conn_max_interval = max;
5594 params->conn_latency = latency;
5595 params->supervision_timeout = timeout;
5596 store_hint = 0x01;
5597 } else{
5598 store_hint = 0x00;
5599 }
5600
5601 hci_dev_unlock(hdev);
5602
5603 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5604 store_hint, min, max, latency, timeout);
5605 }
5606
5607 cp.handle = ev->handle;
5608 cp.interval_min = ev->interval_min;
5609 cp.interval_max = ev->interval_max;
5610 cp.latency = ev->latency;
5611 cp.timeout = ev->timeout;
5612 cp.min_ce_len = 0;
5613 cp.max_ce_len = 0;
5614
5615 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5616 }
5617
5618 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5619 struct sk_buff *skb)
5620 {
5621 u8 num_reports = skb->data[0];
5622 void *ptr = &skb->data[1];
5623
5624 hci_dev_lock(hdev);
5625
5626 while (num_reports--) {
5627 struct hci_ev_le_direct_adv_info *ev = ptr;
5628
5629 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5630 ev->bdaddr_type, &ev->direct_addr,
5631 ev->direct_addr_type, ev->rssi, NULL, 0);
5632
5633 ptr += sizeof(*ev);
5634 }
5635
5636 hci_dev_unlock(hdev);
5637 }
5638
5639 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5640 {
5641 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5642
5643 skb_pull(skb, sizeof(*le_ev));
5644
5645 switch (le_ev->subevent) {
5646 case HCI_EV_LE_CONN_COMPLETE:
5647 hci_le_conn_complete_evt(hdev, skb);
5648 break;
5649
5650 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5651 hci_le_conn_update_complete_evt(hdev, skb);
5652 break;
5653
5654 case HCI_EV_LE_ADVERTISING_REPORT:
5655 hci_le_adv_report_evt(hdev, skb);
5656 break;
5657
5658 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5659 hci_le_remote_feat_complete_evt(hdev, skb);
5660 break;
5661
5662 case HCI_EV_LE_LTK_REQ:
5663 hci_le_ltk_request_evt(hdev, skb);
5664 break;
5665
5666 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5667 hci_le_remote_conn_param_req_evt(hdev, skb);
5668 break;
5669
5670 case HCI_EV_LE_DIRECT_ADV_REPORT:
5671 hci_le_direct_adv_report_evt(hdev, skb);
5672 break;
5673
5674 case HCI_EV_LE_EXT_ADV_REPORT:
5675 hci_le_ext_adv_report_evt(hdev, skb);
5676 break;
5677
5678 case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5679 hci_le_enh_conn_complete_evt(hdev, skb);
5680 break;
5681
5682 case HCI_EV_LE_EXT_ADV_SET_TERM:
5683 hci_le_ext_adv_term_evt(hdev, skb);
5684 break;
5685
5686 default:
5687 break;
5688 }
5689 }
5690
5691 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5692 u8 event, struct sk_buff *skb)
5693 {
5694 struct hci_ev_cmd_complete *ev;
5695 struct hci_event_hdr *hdr;
5696
5697 if (!skb)
5698 return false;
5699
5700 if (skb->len < sizeof(*hdr)) {
5701 bt_dev_err(hdev, "too short HCI event");
5702 return false;
5703 }
5704
5705 hdr = (void *) skb->data;
5706 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5707
5708 if (event) {
5709 if (hdr->evt != event)
5710 return false;
5711 return true;
5712 }
5713
5714 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5715 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5716 hdr->evt);
5717 return false;
5718 }
5719
5720 if (skb->len < sizeof(*ev)) {
5721 bt_dev_err(hdev, "too short cmd_complete event");
5722 return false;
5723 }
5724
5725 ev = (void *) skb->data;
5726 skb_pull(skb, sizeof(*ev));
5727
5728 if (opcode != __le16_to_cpu(ev->opcode)) {
5729 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5730 __le16_to_cpu(ev->opcode));
5731 return false;
5732 }
5733
5734 return true;
5735 }
5736
5737 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5738 {
5739 struct hci_event_hdr *hdr = (void *) skb->data;
5740 hci_req_complete_t req_complete = NULL;
5741 hci_req_complete_skb_t req_complete_skb = NULL;
5742 struct sk_buff *orig_skb = NULL;
5743 u8 status = 0, event = hdr->evt, req_evt = 0;
5744 u16 opcode = HCI_OP_NOP;
5745
5746 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5747 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5748 opcode = __le16_to_cpu(cmd_hdr->opcode);
5749 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5750 &req_complete_skb);
5751 req_evt = event;
5752 }
5753
5754 /* If it looks like we might end up having to call
5755 * req_complete_skb, store a pristine copy of the skb since the
5756 * various handlers may modify the original one through
5757 * skb_pull() calls, etc.
5758 */
5759 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5760 event == HCI_EV_CMD_COMPLETE)
5761 orig_skb = skb_clone(skb, GFP_KERNEL);
5762
5763 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5764
5765 switch (event) {
5766 case HCI_EV_INQUIRY_COMPLETE:
5767 hci_inquiry_complete_evt(hdev, skb);
5768 break;
5769
5770 case HCI_EV_INQUIRY_RESULT:
5771 hci_inquiry_result_evt(hdev, skb);
5772 break;
5773
5774 case HCI_EV_CONN_COMPLETE:
5775 hci_conn_complete_evt(hdev, skb);
5776 break;
5777
5778 case HCI_EV_CONN_REQUEST:
5779 hci_conn_request_evt(hdev, skb);
5780 break;
5781
5782 case HCI_EV_DISCONN_COMPLETE:
5783 hci_disconn_complete_evt(hdev, skb);
5784 break;
5785
5786 case HCI_EV_AUTH_COMPLETE:
5787 hci_auth_complete_evt(hdev, skb);
5788 break;
5789
5790 case HCI_EV_REMOTE_NAME:
5791 hci_remote_name_evt(hdev, skb);
5792 break;
5793
5794 case HCI_EV_ENCRYPT_CHANGE:
5795 hci_encrypt_change_evt(hdev, skb);
5796 break;
5797
5798 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5799 hci_change_link_key_complete_evt(hdev, skb);
5800 break;
5801
5802 case HCI_EV_REMOTE_FEATURES:
5803 hci_remote_features_evt(hdev, skb);
5804 break;
5805
5806 case HCI_EV_CMD_COMPLETE:
5807 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5808 &req_complete, &req_complete_skb);
5809 break;
5810
5811 case HCI_EV_CMD_STATUS:
5812 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5813 &req_complete_skb);
5814 break;
5815
5816 case HCI_EV_HARDWARE_ERROR:
5817 hci_hardware_error_evt(hdev, skb);
5818 break;
5819
5820 case HCI_EV_ROLE_CHANGE:
5821 hci_role_change_evt(hdev, skb);
5822 break;
5823
5824 case HCI_EV_NUM_COMP_PKTS:
5825 hci_num_comp_pkts_evt(hdev, skb);
5826 break;
5827
5828 case HCI_EV_MODE_CHANGE:
5829 hci_mode_change_evt(hdev, skb);
5830 break;
5831
5832 case HCI_EV_PIN_CODE_REQ:
5833 hci_pin_code_request_evt(hdev, skb);
5834 break;
5835
5836 case HCI_EV_LINK_KEY_REQ:
5837 hci_link_key_request_evt(hdev, skb);
5838 break;
5839
5840 case HCI_EV_LINK_KEY_NOTIFY:
5841 hci_link_key_notify_evt(hdev, skb);
5842 break;
5843
5844 case HCI_EV_CLOCK_OFFSET:
5845 hci_clock_offset_evt(hdev, skb);
5846 break;
5847
5848 case HCI_EV_PKT_TYPE_CHANGE:
5849 hci_pkt_type_change_evt(hdev, skb);
5850 break;
5851
5852 case HCI_EV_PSCAN_REP_MODE:
5853 hci_pscan_rep_mode_evt(hdev, skb);
5854 break;
5855
5856 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5857 hci_inquiry_result_with_rssi_evt(hdev, skb);
5858 break;
5859
5860 case HCI_EV_REMOTE_EXT_FEATURES:
5861 hci_remote_ext_features_evt(hdev, skb);
5862 break;
5863
5864 case HCI_EV_SYNC_CONN_COMPLETE:
5865 hci_sync_conn_complete_evt(hdev, skb);
5866 break;
5867
5868 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5869 hci_extended_inquiry_result_evt(hdev, skb);
5870 break;
5871
5872 case HCI_EV_KEY_REFRESH_COMPLETE:
5873 hci_key_refresh_complete_evt(hdev, skb);
5874 break;
5875
5876 case HCI_EV_IO_CAPA_REQUEST:
5877 hci_io_capa_request_evt(hdev, skb);
5878 break;
5879
5880 case HCI_EV_IO_CAPA_REPLY:
5881 hci_io_capa_reply_evt(hdev, skb);
5882 break;
5883
5884 case HCI_EV_USER_CONFIRM_REQUEST:
5885 hci_user_confirm_request_evt(hdev, skb);
5886 break;
5887
5888 case HCI_EV_USER_PASSKEY_REQUEST:
5889 hci_user_passkey_request_evt(hdev, skb);
5890 break;
5891
5892 case HCI_EV_USER_PASSKEY_NOTIFY:
5893 hci_user_passkey_notify_evt(hdev, skb);
5894 break;
5895
5896 case HCI_EV_KEYPRESS_NOTIFY:
5897 hci_keypress_notify_evt(hdev, skb);
5898 break;
5899
5900 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5901 hci_simple_pair_complete_evt(hdev, skb);
5902 break;
5903
5904 case HCI_EV_REMOTE_HOST_FEATURES:
5905 hci_remote_host_features_evt(hdev, skb);
5906 break;
5907
5908 case HCI_EV_LE_META:
5909 hci_le_meta_evt(hdev, skb);
5910 break;
5911
5912 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5913 hci_remote_oob_data_request_evt(hdev, skb);
5914 break;
5915
5916 #if IS_ENABLED(CONFIG_BT_HS)
5917 case HCI_EV_CHANNEL_SELECTED:
5918 hci_chan_selected_evt(hdev, skb);
5919 break;
5920
5921 case HCI_EV_PHY_LINK_COMPLETE:
5922 hci_phy_link_complete_evt(hdev, skb);
5923 break;
5924
5925 case HCI_EV_LOGICAL_LINK_COMPLETE:
5926 hci_loglink_complete_evt(hdev, skb);
5927 break;
5928
5929 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5930 hci_disconn_loglink_complete_evt(hdev, skb);
5931 break;
5932
5933 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5934 hci_disconn_phylink_complete_evt(hdev, skb);
5935 break;
5936 #endif
5937
5938 case HCI_EV_NUM_COMP_BLOCKS:
5939 hci_num_comp_blocks_evt(hdev, skb);
5940 break;
5941
5942 default:
5943 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5944 break;
5945 }
5946
5947 if (req_complete) {
5948 req_complete(hdev, status, opcode);
5949 } else if (req_complete_skb) {
5950 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5951 kfree_skb(orig_skb);
5952 orig_skb = NULL;
5953 }
5954 req_complete_skb(hdev, status, opcode, orig_skb);
5955 }
5956
5957 kfree_skb(orig_skb);
5958 kfree_skb(skb);
5959 hdev->stat.evt_rx++;
5960 }
Linux with added FPC-III support