?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris...
[linux/fpc-iii.git] / net / bluetooth / hci_event.c
blob5f812455a4504260927cb2dd5a3bdc018e0e20d4
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI event handling. */
26
27 #include <asm/unaligned.h>
28
29 #include <net/bluetooth/bluetooth.h>
30 #include <net/bluetooth/hci_core.h>
31 #include <net/bluetooth/mgmt.h>
32
33 #include "a2mp.h"
34 #include "amp.h"
35
36 /* Handle HCI Event packets */
37
38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
39 {
40 __u8 status = *((__u8 *) skb->data);
41
42 BT_DBG("%s status 0x%2.2x", hdev->name, status);
43
44 if (status)
45 return;
46
47 clear_bit(HCI_INQUIRY, &hdev->flags);
48 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
49 wake_up_bit(&hdev->flags, HCI_INQUIRY);
50
51 hci_conn_check_pending(hdev);
52 }
53
54 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
55 {
56 __u8 status = *((__u8 *) skb->data);
57
58 BT_DBG("%s status 0x%2.2x", hdev->name, status);
59
60 if (status)
61 return;
62
63 set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
64 }
65
66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
67 {
68 __u8 status = *((__u8 *) skb->data);
69
70 BT_DBG("%s status 0x%2.2x", hdev->name, status);
71
72 if (status)
73 return;
74
75 clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
76
77 hci_conn_check_pending(hdev);
78 }
79
80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
81 struct sk_buff *skb)
82 {
83 BT_DBG("%s", hdev->name);
84 }
85
86 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
87 {
88 struct hci_rp_role_discovery *rp = (void *) skb->data;
89 struct hci_conn *conn;
90
91 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
92
93 if (rp->status)
94 return;
95
96 hci_dev_lock(hdev);
97
98 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
99 if (conn) {
100 if (rp->role)
101 conn->link_mode &= ~HCI_LM_MASTER;
102 else
103 conn->link_mode |= HCI_LM_MASTER;
104 }
105
106 hci_dev_unlock(hdev);
107 }
108
109 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
110 {
111 struct hci_rp_read_link_policy *rp = (void *) skb->data;
112 struct hci_conn *conn;
113
114 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
115
116 if (rp->status)
117 return;
118
119 hci_dev_lock(hdev);
120
121 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
122 if (conn)
123 conn->link_policy = __le16_to_cpu(rp->policy);
124
125 hci_dev_unlock(hdev);
126 }
127
128 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
129 {
130 struct hci_rp_write_link_policy *rp = (void *) skb->data;
131 struct hci_conn *conn;
132 void *sent;
133
134 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
135
136 if (rp->status)
137 return;
138
139 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
140 if (!sent)
141 return;
142
143 hci_dev_lock(hdev);
144
145 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
146 if (conn)
147 conn->link_policy = get_unaligned_le16(sent + 2);
148
149 hci_dev_unlock(hdev);
150 }
151
152 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
153 struct sk_buff *skb)
154 {
155 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
156
157 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
158
159 if (rp->status)
160 return;
161
162 hdev->link_policy = __le16_to_cpu(rp->policy);
163 }
164
165 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
166 struct sk_buff *skb)
167 {
168 __u8 status = *((__u8 *) skb->data);
169 void *sent;
170
171 BT_DBG("%s status 0x%2.2x", hdev->name, status);
172
173 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
174 if (!sent)
175 return;
176
177 if (!status)
178 hdev->link_policy = get_unaligned_le16(sent);
179 }
180
181 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
182 {
183 __u8 status = *((__u8 *) skb->data);
184
185 BT_DBG("%s status 0x%2.2x", hdev->name, status);
186
187 clear_bit(HCI_RESET, &hdev->flags);
188
189 /* Reset all non-persistent flags */
190 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
191
192 hdev->discovery.state = DISCOVERY_STOPPED;
193 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
194 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
195
196 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
197 hdev->adv_data_len = 0;
198
199 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
200 hdev->scan_rsp_data_len = 0;
201
202 hdev->ssp_debug_mode = 0;
203 }
204
205 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
206 {
207 __u8 status = *((__u8 *) skb->data);
208 void *sent;
209
210 BT_DBG("%s status 0x%2.2x", hdev->name, status);
211
212 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
213 if (!sent)
214 return;
215
216 hci_dev_lock(hdev);
217
218 if (test_bit(HCI_MGMT, &hdev->dev_flags))
219 mgmt_set_local_name_complete(hdev, sent, status);
220 else if (!status)
221 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
222
223 hci_dev_unlock(hdev);
224 }
225
226 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
227 {
228 struct hci_rp_read_local_name *rp = (void *) skb->data;
229
230 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
231
232 if (rp->status)
233 return;
234
235 if (test_bit(HCI_SETUP, &hdev->dev_flags))
236 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
237 }
238
239 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
240 {
241 __u8 status = *((__u8 *) skb->data);
242 void *sent;
243
244 BT_DBG("%s status 0x%2.2x", hdev->name, status);
245
246 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
247 if (!sent)
248 return;
249
250 if (!status) {
251 __u8 param = *((__u8 *) sent);
252
253 if (param == AUTH_ENABLED)
254 set_bit(HCI_AUTH, &hdev->flags);
255 else
256 clear_bit(HCI_AUTH, &hdev->flags);
257 }
258
259 if (test_bit(HCI_MGMT, &hdev->dev_flags))
260 mgmt_auth_enable_complete(hdev, status);
261 }
262
263 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
264 {
265 __u8 status = *((__u8 *) skb->data);
266 void *sent;
267
268 BT_DBG("%s status 0x%2.2x", hdev->name, status);
269
270 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
271 if (!sent)
272 return;
273
274 if (!status) {
275 __u8 param = *((__u8 *) sent);
276
277 if (param)
278 set_bit(HCI_ENCRYPT, &hdev->flags);
279 else
280 clear_bit(HCI_ENCRYPT, &hdev->flags);
281 }
282 }
283
284 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
285 {
286 __u8 param, status = *((__u8 *) skb->data);
287 int old_pscan, old_iscan;
288 void *sent;
289
290 BT_DBG("%s status 0x%2.2x", hdev->name, status);
291
292 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
293 if (!sent)
294 return;
295
296 param = *((__u8 *) sent);
297
298 hci_dev_lock(hdev);
299
300 if (status) {
301 mgmt_write_scan_failed(hdev, param, status);
302 hdev->discov_timeout = 0;
303 goto done;
304 }
305
306 /* We need to ensure that we set this back on if someone changed
307 * the scan mode through a raw HCI socket.
308 */
309 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
310
311 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
312 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
313
314 if (param & SCAN_INQUIRY) {
315 set_bit(HCI_ISCAN, &hdev->flags);
316 if (!old_iscan)
317 mgmt_discoverable(hdev, 1);
318 } else if (old_iscan)
319 mgmt_discoverable(hdev, 0);
320
321 if (param & SCAN_PAGE) {
322 set_bit(HCI_PSCAN, &hdev->flags);
323 if (!old_pscan)
324 mgmt_connectable(hdev, 1);
325 } else if (old_pscan)
326 mgmt_connectable(hdev, 0);
327
328 done:
329 hci_dev_unlock(hdev);
330 }
331
332 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
333 {
334 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
335
336 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
337
338 if (rp->status)
339 return;
340
341 memcpy(hdev->dev_class, rp->dev_class, 3);
342
343 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
344 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
345 }
346
347 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
348 {
349 __u8 status = *((__u8 *) skb->data);
350 void *sent;
351
352 BT_DBG("%s status 0x%2.2x", hdev->name, status);
353
354 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
355 if (!sent)
356 return;
357
358 hci_dev_lock(hdev);
359
360 if (status == 0)
361 memcpy(hdev->dev_class, sent, 3);
362
363 if (test_bit(HCI_MGMT, &hdev->dev_flags))
364 mgmt_set_class_of_dev_complete(hdev, sent, status);
365
366 hci_dev_unlock(hdev);
367 }
368
369 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
370 {
371 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
372 __u16 setting;
373
374 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
375
376 if (rp->status)
377 return;
378
379 setting = __le16_to_cpu(rp->voice_setting);
380
381 if (hdev->voice_setting == setting)
382 return;
383
384 hdev->voice_setting = setting;
385
386 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
387
388 if (hdev->notify)
389 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
390 }
391
392 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
393 struct sk_buff *skb)
394 {
395 __u8 status = *((__u8 *) skb->data);
396 __u16 setting;
397 void *sent;
398
399 BT_DBG("%s status 0x%2.2x", hdev->name, status);
400
401 if (status)
402 return;
403
404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
405 if (!sent)
406 return;
407
408 setting = get_unaligned_le16(sent);
409
410 if (hdev->voice_setting == setting)
411 return;
412
413 hdev->voice_setting = setting;
414
415 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
416
417 if (hdev->notify)
418 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
419 }
420
421 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
422 struct sk_buff *skb)
423 {
424 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
425
426 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
427
428 if (rp->status)
429 return;
430
431 hdev->num_iac = rp->num_iac;
432
433 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
434 }
435
436 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
437 {
438 __u8 status = *((__u8 *) skb->data);
439 struct hci_cp_write_ssp_mode *sent;
440
441 BT_DBG("%s status 0x%2.2x", hdev->name, status);
442
443 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
444 if (!sent)
445 return;
446
447 if (!status) {
448 if (sent->mode)
449 hdev->features[1][0] |= LMP_HOST_SSP;
450 else
451 hdev->features[1][0] &= ~LMP_HOST_SSP;
452 }
453
454 if (test_bit(HCI_MGMT, &hdev->dev_flags))
455 mgmt_ssp_enable_complete(hdev, sent->mode, status);
456 else if (!status) {
457 if (sent->mode)
458 set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
459 else
460 clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
461 }
462 }
463
464 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
465 {
466 struct hci_rp_read_local_version *rp = (void *) skb->data;
467
468 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
469
470 if (rp->status)
471 return;
472
473 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
474 hdev->hci_ver = rp->hci_ver;
475 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
476 hdev->lmp_ver = rp->lmp_ver;
477 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
478 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
479 }
480 }
481
482 static void hci_cc_read_local_commands(struct hci_dev *hdev,
483 struct sk_buff *skb)
484 {
485 struct hci_rp_read_local_commands *rp = (void *) skb->data;
486
487 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
488
489 if (rp->status)
490 return;
491
492 if (test_bit(HCI_SETUP, &hdev->dev_flags))
493 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
494 }
495
496 static void hci_cc_read_local_features(struct hci_dev *hdev,
497 struct sk_buff *skb)
498 {
499 struct hci_rp_read_local_features *rp = (void *) skb->data;
500
501 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
502
503 if (rp->status)
504 return;
505
506 memcpy(hdev->features, rp->features, 8);
507
508 /* Adjust default settings according to features
509 * supported by device. */
510
511 if (hdev->features[0][0] & LMP_3SLOT)
512 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
513
514 if (hdev->features[0][0] & LMP_5SLOT)
515 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
516
517 if (hdev->features[0][1] & LMP_HV2) {
518 hdev->pkt_type |= (HCI_HV2);
519 hdev->esco_type |= (ESCO_HV2);
520 }
521
522 if (hdev->features[0][1] & LMP_HV3) {
523 hdev->pkt_type |= (HCI_HV3);
524 hdev->esco_type |= (ESCO_HV3);
525 }
526
527 if (lmp_esco_capable(hdev))
528 hdev->esco_type |= (ESCO_EV3);
529
530 if (hdev->features[0][4] & LMP_EV4)
531 hdev->esco_type |= (ESCO_EV4);
532
533 if (hdev->features[0][4] & LMP_EV5)
534 hdev->esco_type |= (ESCO_EV5);
535
536 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
537 hdev->esco_type |= (ESCO_2EV3);
538
539 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
540 hdev->esco_type |= (ESCO_3EV3);
541
542 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
543 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
544 }
545
546 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
547 struct sk_buff *skb)
548 {
549 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
550
551 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
552
553 if (rp->status)
554 return;
555
556 if (hdev->max_page < rp->max_page)
557 hdev->max_page = rp->max_page;
558
559 if (rp->page < HCI_MAX_PAGES)
560 memcpy(hdev->features[rp->page], rp->features, 8);
561 }
562
563 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
564 struct sk_buff *skb)
565 {
566 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
567
568 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
569
570 if (!rp->status)
571 hdev->flow_ctl_mode = rp->mode;
572 }
573
574 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
575 {
576 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
577
578 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
579
580 if (rp->status)
581 return;
582
583 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
584 hdev->sco_mtu = rp->sco_mtu;
585 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
586 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
587
588 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
589 hdev->sco_mtu = 64;
590 hdev->sco_pkts = 8;
591 }
592
593 hdev->acl_cnt = hdev->acl_pkts;
594 hdev->sco_cnt = hdev->sco_pkts;
595
596 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
597 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
598 }
599
600 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
601 {
602 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
603
604 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
605
606 if (!rp->status)
607 bacpy(&hdev->bdaddr, &rp->bdaddr);
608 }
609
610 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
611 struct sk_buff *skb)
612 {
613 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
614
615 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
616
617 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
618 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
619 hdev->page_scan_window = __le16_to_cpu(rp->window);
620 }
621 }
622
623 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
624 struct sk_buff *skb)
625 {
626 u8 status = *((u8 *) skb->data);
627 struct hci_cp_write_page_scan_activity *sent;
628
629 BT_DBG("%s status 0x%2.2x", hdev->name, status);
630
631 if (status)
632 return;
633
634 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
635 if (!sent)
636 return;
637
638 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
639 hdev->page_scan_window = __le16_to_cpu(sent->window);
640 }
641
642 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
643 struct sk_buff *skb)
644 {
645 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
646
647 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
648
649 if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
650 hdev->page_scan_type = rp->type;
651 }
652
653 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
654 struct sk_buff *skb)
655 {
656 u8 status = *((u8 *) skb->data);
657 u8 *type;
658
659 BT_DBG("%s status 0x%2.2x", hdev->name, status);
660
661 if (status)
662 return;
663
664 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
665 if (type)
666 hdev->page_scan_type = *type;
667 }
668
669 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
670 struct sk_buff *skb)
671 {
672 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
673
674 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
675
676 if (rp->status)
677 return;
678
679 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
680 hdev->block_len = __le16_to_cpu(rp->block_len);
681 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
682
683 hdev->block_cnt = hdev->num_blocks;
684
685 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
686 hdev->block_cnt, hdev->block_len);
687 }
688
689 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
690 struct sk_buff *skb)
691 {
692 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
693
694 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
695
696 if (rp->status)
697 goto a2mp_rsp;
698
699 hdev->amp_status = rp->amp_status;
700 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
701 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
702 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
703 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
704 hdev->amp_type = rp->amp_type;
705 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
706 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
707 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
708 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
709
710 a2mp_rsp:
711 a2mp_send_getinfo_rsp(hdev);
712 }
713
714 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
715 struct sk_buff *skb)
716 {
717 struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
718 struct amp_assoc *assoc = &hdev->loc_assoc;
719 size_t rem_len, frag_len;
720
721 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
722
723 if (rp->status)
724 goto a2mp_rsp;
725
726 frag_len = skb->len - sizeof(*rp);
727 rem_len = __le16_to_cpu(rp->rem_len);
728
729 if (rem_len > frag_len) {
730 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
731
732 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
733 assoc->offset += frag_len;
734
735 /* Read other fragments */
736 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
737
738 return;
739 }
740
741 memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
742 assoc->len = assoc->offset + rem_len;
743 assoc->offset = 0;
744
745 a2mp_rsp:
746 /* Send A2MP Rsp when all fragments are received */
747 a2mp_send_getampassoc_rsp(hdev, rp->status);
748 a2mp_send_create_phy_link_req(hdev, rp->status);
749 }
750
751 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
752 struct sk_buff *skb)
753 {
754 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
755
756 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
757
758 if (!rp->status)
759 hdev->inq_tx_power = rp->tx_power;
760 }
761
762 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
763 {
764 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
765 struct hci_cp_pin_code_reply *cp;
766 struct hci_conn *conn;
767
768 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
769
770 hci_dev_lock(hdev);
771
772 if (test_bit(HCI_MGMT, &hdev->dev_flags))
773 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
774
775 if (rp->status)
776 goto unlock;
777
778 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
779 if (!cp)
780 goto unlock;
781
782 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
783 if (conn)
784 conn->pin_length = cp->pin_len;
785
786 unlock:
787 hci_dev_unlock(hdev);
788 }
789
790 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
791 {
792 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
793
794 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
795
796 hci_dev_lock(hdev);
797
798 if (test_bit(HCI_MGMT, &hdev->dev_flags))
799 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
800 rp->status);
801
802 hci_dev_unlock(hdev);
803 }
804
805 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
806 struct sk_buff *skb)
807 {
808 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
809
810 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
811
812 if (rp->status)
813 return;
814
815 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
816 hdev->le_pkts = rp->le_max_pkt;
817
818 hdev->le_cnt = hdev->le_pkts;
819
820 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
821 }
822
823 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
824 struct sk_buff *skb)
825 {
826 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
827
828 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
829
830 if (!rp->status)
831 memcpy(hdev->le_features, rp->features, 8);
832 }
833
834 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
835 struct sk_buff *skb)
836 {
837 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
838
839 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
840
841 if (!rp->status)
842 hdev->adv_tx_power = rp->tx_power;
843 }
844
845 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
846 {
847 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
848
849 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
850
851 hci_dev_lock(hdev);
852
853 if (test_bit(HCI_MGMT, &hdev->dev_flags))
854 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
855 rp->status);
856
857 hci_dev_unlock(hdev);
858 }
859
860 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
861 struct sk_buff *skb)
862 {
863 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
864
865 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
866
867 hci_dev_lock(hdev);
868
869 if (test_bit(HCI_MGMT, &hdev->dev_flags))
870 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
871 ACL_LINK, 0, rp->status);
872
873 hci_dev_unlock(hdev);
874 }
875
876 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
877 {
878 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
879
880 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
881
882 hci_dev_lock(hdev);
883
884 if (test_bit(HCI_MGMT, &hdev->dev_flags))
885 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
886 0, rp->status);
887
888 hci_dev_unlock(hdev);
889 }
890
891 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
892 struct sk_buff *skb)
893 {
894 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
895
896 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
897
898 hci_dev_lock(hdev);
899
900 if (test_bit(HCI_MGMT, &hdev->dev_flags))
901 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
902 ACL_LINK, 0, rp->status);
903
904 hci_dev_unlock(hdev);
905 }
906
907 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
908 struct sk_buff *skb)
909 {
910 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
911
912 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
913
914 hci_dev_lock(hdev);
915 mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
916 rp->randomizer, rp->status);
917 hci_dev_unlock(hdev);
918 }
919
920 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
921 {
922 __u8 *sent, status = *((__u8 *) skb->data);
923
924 BT_DBG("%s status 0x%2.2x", hdev->name, status);
925
926 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
927 if (!sent)
928 return;
929
930 hci_dev_lock(hdev);
931
932 if (!status) {
933 if (*sent)
934 set_bit(HCI_ADVERTISING, &hdev->dev_flags);
935 else
936 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
937 }
938
939 hci_dev_unlock(hdev);
940 }
941
942 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
943 struct sk_buff *skb)
944 {
945 struct hci_cp_le_set_scan_enable *cp;
946 __u8 status = *((__u8 *) skb->data);
947
948 BT_DBG("%s status 0x%2.2x", hdev->name, status);
949
950 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
951 if (!cp)
952 return;
953
954 if (status)
955 return;
956
957 switch (cp->enable) {
958 case LE_SCAN_ENABLE:
959 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
960 break;
961
962 case LE_SCAN_DISABLE:
963 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
964 break;
965
966 default:
967 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
968 break;
969 }
970 }
971
972 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
973 struct sk_buff *skb)
974 {
975 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
976
977 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
978
979 if (!rp->status)
980 hdev->le_white_list_size = rp->size;
981 }
982
983 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
984 struct sk_buff *skb)
985 {
986 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
987
988 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
989
990 if (!rp->status)
991 memcpy(hdev->le_states, rp->le_states, 8);
992 }
993
994 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
995 struct sk_buff *skb)
996 {
997 struct hci_cp_write_le_host_supported *sent;
998 __u8 status = *((__u8 *) skb->data);
999
1000 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1001
1002 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1003 if (!sent)
1004 return;
1005
1006 if (!status) {
1007 if (sent->le) {
1008 hdev->features[1][0] |= LMP_HOST_LE;
1009 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1010 } else {
1011 hdev->features[1][0] &= ~LMP_HOST_LE;
1012 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1013 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1014 }
1015
1016 if (sent->simul)
1017 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1018 else
1019 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1020 }
1021 }
1022
1023 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1024 struct sk_buff *skb)
1025 {
1026 struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1027
1028 BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1029 hdev->name, rp->status, rp->phy_handle);
1030
1031 if (rp->status)
1032 return;
1033
1034 amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1035 }
1036
1037 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1038 {
1039 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1040
1041 if (status) {
1042 hci_conn_check_pending(hdev);
1043 return;
1044 }
1045
1046 set_bit(HCI_INQUIRY, &hdev->flags);
1047 }
1048
1049 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1050 {
1051 struct hci_cp_create_conn *cp;
1052 struct hci_conn *conn;
1053
1054 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1055
1056 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1057 if (!cp)
1058 return;
1059
1060 hci_dev_lock(hdev);
1061
1062 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1063
1064 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1065
1066 if (status) {
1067 if (conn && conn->state == BT_CONNECT) {
1068 if (status != 0x0c || conn->attempt > 2) {
1069 conn->state = BT_CLOSED;
1070 hci_proto_connect_cfm(conn, status);
1071 hci_conn_del(conn);
1072 } else
1073 conn->state = BT_CONNECT2;
1074 }
1075 } else {
1076 if (!conn) {
1077 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1078 if (conn) {
1079 conn->out = true;
1080 conn->link_mode |= HCI_LM_MASTER;
1081 } else
1082 BT_ERR("No memory for new connection");
1083 }
1084 }
1085
1086 hci_dev_unlock(hdev);
1087 }
1088
1089 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1090 {
1091 struct hci_cp_add_sco *cp;
1092 struct hci_conn *acl, *sco;
1093 __u16 handle;
1094
1095 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1096
1097 if (!status)
1098 return;
1099
1100 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1101 if (!cp)
1102 return;
1103
1104 handle = __le16_to_cpu(cp->handle);
1105
1106 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1107
1108 hci_dev_lock(hdev);
1109
1110 acl = hci_conn_hash_lookup_handle(hdev, handle);
1111 if (acl) {
1112 sco = acl->link;
1113 if (sco) {
1114 sco->state = BT_CLOSED;
1115
1116 hci_proto_connect_cfm(sco, status);
1117 hci_conn_del(sco);
1118 }
1119 }
1120
1121 hci_dev_unlock(hdev);
1122 }
1123
1124 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1125 {
1126 struct hci_cp_auth_requested *cp;
1127 struct hci_conn *conn;
1128
1129 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1130
1131 if (!status)
1132 return;
1133
1134 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1135 if (!cp)
1136 return;
1137
1138 hci_dev_lock(hdev);
1139
1140 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1141 if (conn) {
1142 if (conn->state == BT_CONFIG) {
1143 hci_proto_connect_cfm(conn, status);
1144 hci_conn_drop(conn);
1145 }
1146 }
1147
1148 hci_dev_unlock(hdev);
1149 }
1150
1151 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1152 {
1153 struct hci_cp_set_conn_encrypt *cp;
1154 struct hci_conn *conn;
1155
1156 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1157
1158 if (!status)
1159 return;
1160
1161 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1162 if (!cp)
1163 return;
1164
1165 hci_dev_lock(hdev);
1166
1167 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1168 if (conn) {
1169 if (conn->state == BT_CONFIG) {
1170 hci_proto_connect_cfm(conn, status);
1171 hci_conn_drop(conn);
1172 }
1173 }
1174
1175 hci_dev_unlock(hdev);
1176 }
1177
1178 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1179 struct hci_conn *conn)
1180 {
1181 if (conn->state != BT_CONFIG || !conn->out)
1182 return 0;
1183
1184 if (conn->pending_sec_level == BT_SECURITY_SDP)
1185 return 0;
1186
1187 /* Only request authentication for SSP connections or non-SSP
1188 * devices with sec_level HIGH or if MITM protection is requested */
1189 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1190 conn->pending_sec_level != BT_SECURITY_HIGH)
1191 return 0;
1192
1193 return 1;
1194 }
1195
1196 static int hci_resolve_name(struct hci_dev *hdev,
1197 struct inquiry_entry *e)
1198 {
1199 struct hci_cp_remote_name_req cp;
1200
1201 memset(&cp, 0, sizeof(cp));
1202
1203 bacpy(&cp.bdaddr, &e->data.bdaddr);
1204 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1205 cp.pscan_mode = e->data.pscan_mode;
1206 cp.clock_offset = e->data.clock_offset;
1207
1208 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1209 }
1210
1211 static bool hci_resolve_next_name(struct hci_dev *hdev)
1212 {
1213 struct discovery_state *discov = &hdev->discovery;
1214 struct inquiry_entry *e;
1215
1216 if (list_empty(&discov->resolve))
1217 return false;
1218
1219 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1220 if (!e)
1221 return false;
1222
1223 if (hci_resolve_name(hdev, e) == 0) {
1224 e->name_state = NAME_PENDING;
1225 return true;
1226 }
1227
1228 return false;
1229 }
1230
1231 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1232 bdaddr_t *bdaddr, u8 *name, u8 name_len)
1233 {
1234 struct discovery_state *discov = &hdev->discovery;
1235 struct inquiry_entry *e;
1236
1237 if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1238 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1239 name_len, conn->dev_class);
1240
1241 if (discov->state == DISCOVERY_STOPPED)
1242 return;
1243
1244 if (discov->state == DISCOVERY_STOPPING)
1245 goto discov_complete;
1246
1247 if (discov->state != DISCOVERY_RESOLVING)
1248 return;
1249
1250 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1251 /* If the device was not found in a list of found devices names of which
1252 * are pending. there is no need to continue resolving a next name as it
1253 * will be done upon receiving another Remote Name Request Complete
1254 * Event */
1255 if (!e)
1256 return;
1257
1258 list_del(&e->list);
1259 if (name) {
1260 e->name_state = NAME_KNOWN;
1261 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1262 e->data.rssi, name, name_len);
1263 } else {
1264 e->name_state = NAME_NOT_KNOWN;
1265 }
1266
1267 if (hci_resolve_next_name(hdev))
1268 return;
1269
1270 discov_complete:
1271 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1272 }
1273
1274 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1275 {
1276 struct hci_cp_remote_name_req *cp;
1277 struct hci_conn *conn;
1278
1279 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1280
1281 /* If successful wait for the name req complete event before
1282 * checking for the need to do authentication */
1283 if (!status)
1284 return;
1285
1286 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1287 if (!cp)
1288 return;
1289
1290 hci_dev_lock(hdev);
1291
1292 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1293
1294 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1295 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1296
1297 if (!conn)
1298 goto unlock;
1299
1300 if (!hci_outgoing_auth_needed(hdev, conn))
1301 goto unlock;
1302
1303 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1304 struct hci_cp_auth_requested auth_cp;
1305
1306 auth_cp.handle = __cpu_to_le16(conn->handle);
1307 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1308 sizeof(auth_cp), &auth_cp);
1309 }
1310
1311 unlock:
1312 hci_dev_unlock(hdev);
1313 }
1314
1315 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1316 {
1317 struct hci_cp_read_remote_features *cp;
1318 struct hci_conn *conn;
1319
1320 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1321
1322 if (!status)
1323 return;
1324
1325 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1326 if (!cp)
1327 return;
1328
1329 hci_dev_lock(hdev);
1330
1331 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1332 if (conn) {
1333 if (conn->state == BT_CONFIG) {
1334 hci_proto_connect_cfm(conn, status);
1335 hci_conn_drop(conn);
1336 }
1337 }
1338
1339 hci_dev_unlock(hdev);
1340 }
1341
1342 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1343 {
1344 struct hci_cp_read_remote_ext_features *cp;
1345 struct hci_conn *conn;
1346
1347 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1348
1349 if (!status)
1350 return;
1351
1352 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1353 if (!cp)
1354 return;
1355
1356 hci_dev_lock(hdev);
1357
1358 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1359 if (conn) {
1360 if (conn->state == BT_CONFIG) {
1361 hci_proto_connect_cfm(conn, status);
1362 hci_conn_drop(conn);
1363 }
1364 }
1365
1366 hci_dev_unlock(hdev);
1367 }
1368
1369 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1370 {
1371 struct hci_cp_setup_sync_conn *cp;
1372 struct hci_conn *acl, *sco;
1373 __u16 handle;
1374
1375 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1376
1377 if (!status)
1378 return;
1379
1380 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1381 if (!cp)
1382 return;
1383
1384 handle = __le16_to_cpu(cp->handle);
1385
1386 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1387
1388 hci_dev_lock(hdev);
1389
1390 acl = hci_conn_hash_lookup_handle(hdev, handle);
1391 if (acl) {
1392 sco = acl->link;
1393 if (sco) {
1394 sco->state = BT_CLOSED;
1395
1396 hci_proto_connect_cfm(sco, status);
1397 hci_conn_del(sco);
1398 }
1399 }
1400
1401 hci_dev_unlock(hdev);
1402 }
1403
1404 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1405 {
1406 struct hci_cp_sniff_mode *cp;
1407 struct hci_conn *conn;
1408
1409 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1410
1411 if (!status)
1412 return;
1413
1414 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1415 if (!cp)
1416 return;
1417
1418 hci_dev_lock(hdev);
1419
1420 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1421 if (conn) {
1422 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1423
1424 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1425 hci_sco_setup(conn, status);
1426 }
1427
1428 hci_dev_unlock(hdev);
1429 }
1430
1431 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1432 {
1433 struct hci_cp_exit_sniff_mode *cp;
1434 struct hci_conn *conn;
1435
1436 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1437
1438 if (!status)
1439 return;
1440
1441 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1442 if (!cp)
1443 return;
1444
1445 hci_dev_lock(hdev);
1446
1447 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1448 if (conn) {
1449 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1450
1451 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1452 hci_sco_setup(conn, status);
1453 }
1454
1455 hci_dev_unlock(hdev);
1456 }
1457
1458 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1459 {
1460 struct hci_cp_disconnect *cp;
1461 struct hci_conn *conn;
1462
1463 if (!status)
1464 return;
1465
1466 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1467 if (!cp)
1468 return;
1469
1470 hci_dev_lock(hdev);
1471
1472 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1473 if (conn)
1474 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1475 conn->dst_type, status);
1476
1477 hci_dev_unlock(hdev);
1478 }
1479
1480 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1481 {
1482 struct hci_cp_create_phy_link *cp;
1483
1484 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1485
1486 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1487 if (!cp)
1488 return;
1489
1490 hci_dev_lock(hdev);
1491
1492 if (status) {
1493 struct hci_conn *hcon;
1494
1495 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1496 if (hcon)
1497 hci_conn_del(hcon);
1498 } else {
1499 amp_write_remote_assoc(hdev, cp->phy_handle);
1500 }
1501
1502 hci_dev_unlock(hdev);
1503 }
1504
1505 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1506 {
1507 struct hci_cp_accept_phy_link *cp;
1508
1509 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1510
1511 if (status)
1512 return;
1513
1514 cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1515 if (!cp)
1516 return;
1517
1518 amp_write_remote_assoc(hdev, cp->phy_handle);
1519 }
1520
1521 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1522 {
1523 __u8 status = *((__u8 *) skb->data);
1524 struct discovery_state *discov = &hdev->discovery;
1525 struct inquiry_entry *e;
1526
1527 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1528
1529 hci_conn_check_pending(hdev);
1530
1531 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1532 return;
1533
1534 smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1535 wake_up_bit(&hdev->flags, HCI_INQUIRY);
1536
1537 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1538 return;
1539
1540 hci_dev_lock(hdev);
1541
1542 if (discov->state != DISCOVERY_FINDING)
1543 goto unlock;
1544
1545 if (list_empty(&discov->resolve)) {
1546 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1547 goto unlock;
1548 }
1549
1550 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1551 if (e && hci_resolve_name(hdev, e) == 0) {
1552 e->name_state = NAME_PENDING;
1553 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1554 } else {
1555 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1556 }
1557
1558 unlock:
1559 hci_dev_unlock(hdev);
1560 }
1561
1562 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1563 {
1564 struct inquiry_data data;
1565 struct inquiry_info *info = (void *) (skb->data + 1);
1566 int num_rsp = *((__u8 *) skb->data);
1567
1568 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1569
1570 if (!num_rsp)
1571 return;
1572
1573 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1574 return;
1575
1576 hci_dev_lock(hdev);
1577
1578 for (; num_rsp; num_rsp--, info++) {
1579 bool name_known, ssp;
1580
1581 bacpy(&data.bdaddr, &info->bdaddr);
1582 data.pscan_rep_mode = info->pscan_rep_mode;
1583 data.pscan_period_mode = info->pscan_period_mode;
1584 data.pscan_mode = info->pscan_mode;
1585 memcpy(data.dev_class, info->dev_class, 3);
1586 data.clock_offset = info->clock_offset;
1587 data.rssi = 0x00;
1588 data.ssp_mode = 0x00;
1589
1590 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1591 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1592 info->dev_class, 0, !name_known, ssp, NULL,
1593 0);
1594 }
1595
1596 hci_dev_unlock(hdev);
1597 }
1598
1599 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1600 {
1601 struct hci_ev_conn_complete *ev = (void *) skb->data;
1602 struct hci_conn *conn;
1603
1604 BT_DBG("%s", hdev->name);
1605
1606 hci_dev_lock(hdev);
1607
1608 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1609 if (!conn) {
1610 if (ev->link_type != SCO_LINK)
1611 goto unlock;
1612
1613 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1614 if (!conn)
1615 goto unlock;
1616
1617 conn->type = SCO_LINK;
1618 }
1619
1620 if (!ev->status) {
1621 conn->handle = __le16_to_cpu(ev->handle);
1622
1623 if (conn->type == ACL_LINK) {
1624 conn->state = BT_CONFIG;
1625 hci_conn_hold(conn);
1626
1627 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1628 !hci_find_link_key(hdev, &ev->bdaddr))
1629 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1630 else
1631 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1632 } else
1633 conn->state = BT_CONNECTED;
1634
1635 hci_conn_add_sysfs(conn);
1636
1637 if (test_bit(HCI_AUTH, &hdev->flags))
1638 conn->link_mode |= HCI_LM_AUTH;
1639
1640 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1641 conn->link_mode |= HCI_LM_ENCRYPT;
1642
1643 /* Get remote features */
1644 if (conn->type == ACL_LINK) {
1645 struct hci_cp_read_remote_features cp;
1646 cp.handle = ev->handle;
1647 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1648 sizeof(cp), &cp);
1649 }
1650
1651 /* Set packet type for incoming connection */
1652 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1653 struct hci_cp_change_conn_ptype cp;
1654 cp.handle = ev->handle;
1655 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1656 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1657 &cp);
1658 }
1659 } else {
1660 conn->state = BT_CLOSED;
1661 if (conn->type == ACL_LINK)
1662 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1663 conn->dst_type, ev->status);
1664 }
1665
1666 if (conn->type == ACL_LINK)
1667 hci_sco_setup(conn, ev->status);
1668
1669 if (ev->status) {
1670 hci_proto_connect_cfm(conn, ev->status);
1671 hci_conn_del(conn);
1672 } else if (ev->link_type != ACL_LINK)
1673 hci_proto_connect_cfm(conn, ev->status);
1674
1675 unlock:
1676 hci_dev_unlock(hdev);
1677
1678 hci_conn_check_pending(hdev);
1679 }
1680
1681 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1682 {
1683 struct hci_ev_conn_request *ev = (void *) skb->data;
1684 int mask = hdev->link_mode;
1685 __u8 flags = 0;
1686
1687 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1688 ev->link_type);
1689
1690 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1691 &flags);
1692
1693 if ((mask & HCI_LM_ACCEPT) &&
1694 !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1695 /* Connection accepted */
1696 struct inquiry_entry *ie;
1697 struct hci_conn *conn;
1698
1699 hci_dev_lock(hdev);
1700
1701 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1702 if (ie)
1703 memcpy(ie->data.dev_class, ev->dev_class, 3);
1704
1705 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1706 &ev->bdaddr);
1707 if (!conn) {
1708 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1709 if (!conn) {
1710 BT_ERR("No memory for new connection");
1711 hci_dev_unlock(hdev);
1712 return;
1713 }
1714 }
1715
1716 memcpy(conn->dev_class, ev->dev_class, 3);
1717
1718 hci_dev_unlock(hdev);
1719
1720 if (ev->link_type == ACL_LINK ||
1721 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1722 struct hci_cp_accept_conn_req cp;
1723 conn->state = BT_CONNECT;
1724
1725 bacpy(&cp.bdaddr, &ev->bdaddr);
1726
1727 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1728 cp.role = 0x00; /* Become master */
1729 else
1730 cp.role = 0x01; /* Remain slave */
1731
1732 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1733 &cp);
1734 } else if (!(flags & HCI_PROTO_DEFER)) {
1735 struct hci_cp_accept_sync_conn_req cp;
1736 conn->state = BT_CONNECT;
1737
1738 bacpy(&cp.bdaddr, &ev->bdaddr);
1739 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1740
1741 cp.tx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1742 cp.rx_bandwidth = __constant_cpu_to_le32(0x00001f40);
1743 cp.max_latency = __constant_cpu_to_le16(0xffff);
1744 cp.content_format = cpu_to_le16(hdev->voice_setting);
1745 cp.retrans_effort = 0xff;
1746
1747 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1748 sizeof(cp), &cp);
1749 } else {
1750 conn->state = BT_CONNECT2;
1751 hci_proto_connect_cfm(conn, 0);
1752 }
1753 } else {
1754 /* Connection rejected */
1755 struct hci_cp_reject_conn_req cp;
1756
1757 bacpy(&cp.bdaddr, &ev->bdaddr);
1758 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1759 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1760 }
1761 }
1762
1763 static u8 hci_to_mgmt_reason(u8 err)
1764 {
1765 switch (err) {
1766 case HCI_ERROR_CONNECTION_TIMEOUT:
1767 return MGMT_DEV_DISCONN_TIMEOUT;
1768 case HCI_ERROR_REMOTE_USER_TERM:
1769 case HCI_ERROR_REMOTE_LOW_RESOURCES:
1770 case HCI_ERROR_REMOTE_POWER_OFF:
1771 return MGMT_DEV_DISCONN_REMOTE;
1772 case HCI_ERROR_LOCAL_HOST_TERM:
1773 return MGMT_DEV_DISCONN_LOCAL_HOST;
1774 default:
1775 return MGMT_DEV_DISCONN_UNKNOWN;
1776 }
1777 }
1778
1779 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1780 {
1781 struct hci_ev_disconn_complete *ev = (void *) skb->data;
1782 u8 reason = hci_to_mgmt_reason(ev->reason);
1783 struct hci_conn *conn;
1784 u8 type;
1785
1786 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1787
1788 hci_dev_lock(hdev);
1789
1790 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1791 if (!conn)
1792 goto unlock;
1793
1794 if (ev->status) {
1795 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1796 conn->dst_type, ev->status);
1797 goto unlock;
1798 }
1799
1800 conn->state = BT_CLOSED;
1801
1802 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1803 mgmt_device_disconnected(hdev, &conn->dst, conn->type,
1804 conn->dst_type, reason);
1805
1806 if (conn->type == ACL_LINK && conn->flush_key)
1807 hci_remove_link_key(hdev, &conn->dst);
1808
1809 type = conn->type;
1810
1811 hci_proto_disconn_cfm(conn, ev->reason);
1812 hci_conn_del(conn);
1813
1814 /* Re-enable advertising if necessary, since it might
1815 * have been disabled by the connection. From the
1816 * HCI_LE_Set_Advertise_Enable command description in
1817 * the core specification (v4.0):
1818 * "The Controller shall continue advertising until the Host
1819 * issues an LE_Set_Advertise_Enable command with
1820 * Advertising_Enable set to 0x00 (Advertising is disabled)
1821 * or until a connection is created or until the Advertising
1822 * is timed out due to Directed Advertising."
1823 */
1824 if (type == LE_LINK)
1825 mgmt_reenable_advertising(hdev);
1826
1827 unlock:
1828 hci_dev_unlock(hdev);
1829 }
1830
1831 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1832 {
1833 struct hci_ev_auth_complete *ev = (void *) skb->data;
1834 struct hci_conn *conn;
1835
1836 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1837
1838 hci_dev_lock(hdev);
1839
1840 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1841 if (!conn)
1842 goto unlock;
1843
1844 if (!ev->status) {
1845 if (!hci_conn_ssp_enabled(conn) &&
1846 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
1847 BT_INFO("re-auth of legacy device is not possible.");
1848 } else {
1849 conn->link_mode |= HCI_LM_AUTH;
1850 conn->sec_level = conn->pending_sec_level;
1851 }
1852 } else {
1853 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
1854 ev->status);
1855 }
1856
1857 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1858 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1859
1860 if (conn->state == BT_CONFIG) {
1861 if (!ev->status && hci_conn_ssp_enabled(conn)) {
1862 struct hci_cp_set_conn_encrypt cp;
1863 cp.handle = ev->handle;
1864 cp.encrypt = 0x01;
1865 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1866 &cp);
1867 } else {
1868 conn->state = BT_CONNECTED;
1869 hci_proto_connect_cfm(conn, ev->status);
1870 hci_conn_drop(conn);
1871 }
1872 } else {
1873 hci_auth_cfm(conn, ev->status);
1874
1875 hci_conn_hold(conn);
1876 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1877 hci_conn_drop(conn);
1878 }
1879
1880 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
1881 if (!ev->status) {
1882 struct hci_cp_set_conn_encrypt cp;
1883 cp.handle = ev->handle;
1884 cp.encrypt = 0x01;
1885 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1886 &cp);
1887 } else {
1888 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1889 hci_encrypt_cfm(conn, ev->status, 0x00);
1890 }
1891 }
1892
1893 unlock:
1894 hci_dev_unlock(hdev);
1895 }
1896
1897 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1898 {
1899 struct hci_ev_remote_name *ev = (void *) skb->data;
1900 struct hci_conn *conn;
1901
1902 BT_DBG("%s", hdev->name);
1903
1904 hci_conn_check_pending(hdev);
1905
1906 hci_dev_lock(hdev);
1907
1908 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1909
1910 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1911 goto check_auth;
1912
1913 if (ev->status == 0)
1914 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
1915 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
1916 else
1917 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
1918
1919 check_auth:
1920 if (!conn)
1921 goto unlock;
1922
1923 if (!hci_outgoing_auth_needed(hdev, conn))
1924 goto unlock;
1925
1926 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1927 struct hci_cp_auth_requested cp;
1928 cp.handle = __cpu_to_le16(conn->handle);
1929 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1930 }
1931
1932 unlock:
1933 hci_dev_unlock(hdev);
1934 }
1935
1936 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1937 {
1938 struct hci_ev_encrypt_change *ev = (void *) skb->data;
1939 struct hci_conn *conn;
1940
1941 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1942
1943 hci_dev_lock(hdev);
1944
1945 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1946 if (conn) {
1947 if (!ev->status) {
1948 if (ev->encrypt) {
1949 /* Encryption implies authentication */
1950 conn->link_mode |= HCI_LM_AUTH;
1951 conn->link_mode |= HCI_LM_ENCRYPT;
1952 conn->sec_level = conn->pending_sec_level;
1953 } else
1954 conn->link_mode &= ~HCI_LM_ENCRYPT;
1955 }
1956
1957 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
1958
1959 if (ev->status && conn->state == BT_CONNECTED) {
1960 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1961 hci_conn_drop(conn);
1962 goto unlock;
1963 }
1964
1965 if (conn->state == BT_CONFIG) {
1966 if (!ev->status)
1967 conn->state = BT_CONNECTED;
1968
1969 hci_proto_connect_cfm(conn, ev->status);
1970 hci_conn_drop(conn);
1971 } else
1972 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1973 }
1974
1975 unlock:
1976 hci_dev_unlock(hdev);
1977 }
1978
1979 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
1980 struct sk_buff *skb)
1981 {
1982 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1983 struct hci_conn *conn;
1984
1985 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1986
1987 hci_dev_lock(hdev);
1988
1989 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1990 if (conn) {
1991 if (!ev->status)
1992 conn->link_mode |= HCI_LM_SECURE;
1993
1994 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1995
1996 hci_key_change_cfm(conn, ev->status);
1997 }
1998
1999 hci_dev_unlock(hdev);
2000 }
2001
2002 static void hci_remote_features_evt(struct hci_dev *hdev,
2003 struct sk_buff *skb)
2004 {
2005 struct hci_ev_remote_features *ev = (void *) skb->data;
2006 struct hci_conn *conn;
2007
2008 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2009
2010 hci_dev_lock(hdev);
2011
2012 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2013 if (!conn)
2014 goto unlock;
2015
2016 if (!ev->status)
2017 memcpy(conn->features[0], ev->features, 8);
2018
2019 if (conn->state != BT_CONFIG)
2020 goto unlock;
2021
2022 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2023 struct hci_cp_read_remote_ext_features cp;
2024 cp.handle = ev->handle;
2025 cp.page = 0x01;
2026 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2027 sizeof(cp), &cp);
2028 goto unlock;
2029 }
2030
2031 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2032 struct hci_cp_remote_name_req cp;
2033 memset(&cp, 0, sizeof(cp));
2034 bacpy(&cp.bdaddr, &conn->dst);
2035 cp.pscan_rep_mode = 0x02;
2036 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2037 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2038 mgmt_device_connected(hdev, &conn->dst, conn->type,
2039 conn->dst_type, 0, NULL, 0,
2040 conn->dev_class);
2041
2042 if (!hci_outgoing_auth_needed(hdev, conn)) {
2043 conn->state = BT_CONNECTED;
2044 hci_proto_connect_cfm(conn, ev->status);
2045 hci_conn_drop(conn);
2046 }
2047
2048 unlock:
2049 hci_dev_unlock(hdev);
2050 }
2051
2052 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2053 {
2054 struct hci_ev_cmd_complete *ev = (void *) skb->data;
2055 u8 status = skb->data[sizeof(*ev)];
2056 __u16 opcode;
2057
2058 skb_pull(skb, sizeof(*ev));
2059
2060 opcode = __le16_to_cpu(ev->opcode);
2061
2062 switch (opcode) {
2063 case HCI_OP_INQUIRY_CANCEL:
2064 hci_cc_inquiry_cancel(hdev, skb);
2065 break;
2066
2067 case HCI_OP_PERIODIC_INQ:
2068 hci_cc_periodic_inq(hdev, skb);
2069 break;
2070
2071 case HCI_OP_EXIT_PERIODIC_INQ:
2072 hci_cc_exit_periodic_inq(hdev, skb);
2073 break;
2074
2075 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2076 hci_cc_remote_name_req_cancel(hdev, skb);
2077 break;
2078
2079 case HCI_OP_ROLE_DISCOVERY:
2080 hci_cc_role_discovery(hdev, skb);
2081 break;
2082
2083 case HCI_OP_READ_LINK_POLICY:
2084 hci_cc_read_link_policy(hdev, skb);
2085 break;
2086
2087 case HCI_OP_WRITE_LINK_POLICY:
2088 hci_cc_write_link_policy(hdev, skb);
2089 break;
2090
2091 case HCI_OP_READ_DEF_LINK_POLICY:
2092 hci_cc_read_def_link_policy(hdev, skb);
2093 break;
2094
2095 case HCI_OP_WRITE_DEF_LINK_POLICY:
2096 hci_cc_write_def_link_policy(hdev, skb);
2097 break;
2098
2099 case HCI_OP_RESET:
2100 hci_cc_reset(hdev, skb);
2101 break;
2102
2103 case HCI_OP_WRITE_LOCAL_NAME:
2104 hci_cc_write_local_name(hdev, skb);
2105 break;
2106
2107 case HCI_OP_READ_LOCAL_NAME:
2108 hci_cc_read_local_name(hdev, skb);
2109 break;
2110
2111 case HCI_OP_WRITE_AUTH_ENABLE:
2112 hci_cc_write_auth_enable(hdev, skb);
2113 break;
2114
2115 case HCI_OP_WRITE_ENCRYPT_MODE:
2116 hci_cc_write_encrypt_mode(hdev, skb);
2117 break;
2118
2119 case HCI_OP_WRITE_SCAN_ENABLE:
2120 hci_cc_write_scan_enable(hdev, skb);
2121 break;
2122
2123 case HCI_OP_READ_CLASS_OF_DEV:
2124 hci_cc_read_class_of_dev(hdev, skb);
2125 break;
2126
2127 case HCI_OP_WRITE_CLASS_OF_DEV:
2128 hci_cc_write_class_of_dev(hdev, skb);
2129 break;
2130
2131 case HCI_OP_READ_VOICE_SETTING:
2132 hci_cc_read_voice_setting(hdev, skb);
2133 break;
2134
2135 case HCI_OP_WRITE_VOICE_SETTING:
2136 hci_cc_write_voice_setting(hdev, skb);
2137 break;
2138
2139 case HCI_OP_READ_NUM_SUPPORTED_IAC:
2140 hci_cc_read_num_supported_iac(hdev, skb);
2141 break;
2142
2143 case HCI_OP_WRITE_SSP_MODE:
2144 hci_cc_write_ssp_mode(hdev, skb);
2145 break;
2146
2147 case HCI_OP_READ_LOCAL_VERSION:
2148 hci_cc_read_local_version(hdev, skb);
2149 break;
2150
2151 case HCI_OP_READ_LOCAL_COMMANDS:
2152 hci_cc_read_local_commands(hdev, skb);
2153 break;
2154
2155 case HCI_OP_READ_LOCAL_FEATURES:
2156 hci_cc_read_local_features(hdev, skb);
2157 break;
2158
2159 case HCI_OP_READ_LOCAL_EXT_FEATURES:
2160 hci_cc_read_local_ext_features(hdev, skb);
2161 break;
2162
2163 case HCI_OP_READ_BUFFER_SIZE:
2164 hci_cc_read_buffer_size(hdev, skb);
2165 break;
2166
2167 case HCI_OP_READ_BD_ADDR:
2168 hci_cc_read_bd_addr(hdev, skb);
2169 break;
2170
2171 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2172 hci_cc_read_page_scan_activity(hdev, skb);
2173 break;
2174
2175 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2176 hci_cc_write_page_scan_activity(hdev, skb);
2177 break;
2178
2179 case HCI_OP_READ_PAGE_SCAN_TYPE:
2180 hci_cc_read_page_scan_type(hdev, skb);
2181 break;
2182
2183 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2184 hci_cc_write_page_scan_type(hdev, skb);
2185 break;
2186
2187 case HCI_OP_READ_DATA_BLOCK_SIZE:
2188 hci_cc_read_data_block_size(hdev, skb);
2189 break;
2190
2191 case HCI_OP_READ_FLOW_CONTROL_MODE:
2192 hci_cc_read_flow_control_mode(hdev, skb);
2193 break;
2194
2195 case HCI_OP_READ_LOCAL_AMP_INFO:
2196 hci_cc_read_local_amp_info(hdev, skb);
2197 break;
2198
2199 case HCI_OP_READ_LOCAL_AMP_ASSOC:
2200 hci_cc_read_local_amp_assoc(hdev, skb);
2201 break;
2202
2203 case HCI_OP_READ_INQ_RSP_TX_POWER:
2204 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2205 break;
2206
2207 case HCI_OP_PIN_CODE_REPLY:
2208 hci_cc_pin_code_reply(hdev, skb);
2209 break;
2210
2211 case HCI_OP_PIN_CODE_NEG_REPLY:
2212 hci_cc_pin_code_neg_reply(hdev, skb);
2213 break;
2214
2215 case HCI_OP_READ_LOCAL_OOB_DATA:
2216 hci_cc_read_local_oob_data_reply(hdev, skb);
2217 break;
2218
2219 case HCI_OP_LE_READ_BUFFER_SIZE:
2220 hci_cc_le_read_buffer_size(hdev, skb);
2221 break;
2222
2223 case HCI_OP_LE_READ_LOCAL_FEATURES:
2224 hci_cc_le_read_local_features(hdev, skb);
2225 break;
2226
2227 case HCI_OP_LE_READ_ADV_TX_POWER:
2228 hci_cc_le_read_adv_tx_power(hdev, skb);
2229 break;
2230
2231 case HCI_OP_USER_CONFIRM_REPLY:
2232 hci_cc_user_confirm_reply(hdev, skb);
2233 break;
2234
2235 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2236 hci_cc_user_confirm_neg_reply(hdev, skb);
2237 break;
2238
2239 case HCI_OP_USER_PASSKEY_REPLY:
2240 hci_cc_user_passkey_reply(hdev, skb);
2241 break;
2242
2243 case HCI_OP_USER_PASSKEY_NEG_REPLY:
2244 hci_cc_user_passkey_neg_reply(hdev, skb);
2245 break;
2246
2247 case HCI_OP_LE_SET_ADV_ENABLE:
2248 hci_cc_le_set_adv_enable(hdev, skb);
2249 break;
2250
2251 case HCI_OP_LE_SET_SCAN_ENABLE:
2252 hci_cc_le_set_scan_enable(hdev, skb);
2253 break;
2254
2255 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2256 hci_cc_le_read_white_list_size(hdev, skb);
2257 break;
2258
2259 case HCI_OP_LE_READ_SUPPORTED_STATES:
2260 hci_cc_le_read_supported_states(hdev, skb);
2261 break;
2262
2263 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2264 hci_cc_write_le_host_supported(hdev, skb);
2265 break;
2266
2267 case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2268 hci_cc_write_remote_amp_assoc(hdev, skb);
2269 break;
2270
2271 default:
2272 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2273 break;
2274 }
2275
2276 if (opcode != HCI_OP_NOP)
2277 del_timer(&hdev->cmd_timer);
2278
2279 hci_req_cmd_complete(hdev, opcode, status);
2280
2281 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2282 atomic_set(&hdev->cmd_cnt, 1);
2283 if (!skb_queue_empty(&hdev->cmd_q))
2284 queue_work(hdev->workqueue, &hdev->cmd_work);
2285 }
2286 }
2287
2288 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2289 {
2290 struct hci_ev_cmd_status *ev = (void *) skb->data;
2291 __u16 opcode;
2292
2293 skb_pull(skb, sizeof(*ev));
2294
2295 opcode = __le16_to_cpu(ev->opcode);
2296
2297 switch (opcode) {
2298 case HCI_OP_INQUIRY:
2299 hci_cs_inquiry(hdev, ev->status);
2300 break;
2301
2302 case HCI_OP_CREATE_CONN:
2303 hci_cs_create_conn(hdev, ev->status);
2304 break;
2305
2306 case HCI_OP_ADD_SCO:
2307 hci_cs_add_sco(hdev, ev->status);
2308 break;
2309
2310 case HCI_OP_AUTH_REQUESTED:
2311 hci_cs_auth_requested(hdev, ev->status);
2312 break;
2313
2314 case HCI_OP_SET_CONN_ENCRYPT:
2315 hci_cs_set_conn_encrypt(hdev, ev->status);
2316 break;
2317
2318 case HCI_OP_REMOTE_NAME_REQ:
2319 hci_cs_remote_name_req(hdev, ev->status);
2320 break;
2321
2322 case HCI_OP_READ_REMOTE_FEATURES:
2323 hci_cs_read_remote_features(hdev, ev->status);
2324 break;
2325
2326 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2327 hci_cs_read_remote_ext_features(hdev, ev->status);
2328 break;
2329
2330 case HCI_OP_SETUP_SYNC_CONN:
2331 hci_cs_setup_sync_conn(hdev, ev->status);
2332 break;
2333
2334 case HCI_OP_SNIFF_MODE:
2335 hci_cs_sniff_mode(hdev, ev->status);
2336 break;
2337
2338 case HCI_OP_EXIT_SNIFF_MODE:
2339 hci_cs_exit_sniff_mode(hdev, ev->status);
2340 break;
2341
2342 case HCI_OP_DISCONNECT:
2343 hci_cs_disconnect(hdev, ev->status);
2344 break;
2345
2346 case HCI_OP_CREATE_PHY_LINK:
2347 hci_cs_create_phylink(hdev, ev->status);
2348 break;
2349
2350 case HCI_OP_ACCEPT_PHY_LINK:
2351 hci_cs_accept_phylink(hdev, ev->status);
2352 break;
2353
2354 default:
2355 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2356 break;
2357 }
2358
2359 if (opcode != HCI_OP_NOP)
2360 del_timer(&hdev->cmd_timer);
2361
2362 if (ev->status ||
2363 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2364 hci_req_cmd_complete(hdev, opcode, ev->status);
2365
2366 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2367 atomic_set(&hdev->cmd_cnt, 1);
2368 if (!skb_queue_empty(&hdev->cmd_q))
2369 queue_work(hdev->workqueue, &hdev->cmd_work);
2370 }
2371 }
2372
2373 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2374 {
2375 struct hci_ev_role_change *ev = (void *) skb->data;
2376 struct hci_conn *conn;
2377
2378 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2379
2380 hci_dev_lock(hdev);
2381
2382 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2383 if (conn) {
2384 if (!ev->status) {
2385 if (ev->role)
2386 conn->link_mode &= ~HCI_LM_MASTER;
2387 else
2388 conn->link_mode |= HCI_LM_MASTER;
2389 }
2390
2391 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2392
2393 hci_role_switch_cfm(conn, ev->status, ev->role);
2394 }
2395
2396 hci_dev_unlock(hdev);
2397 }
2398
2399 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2400 {
2401 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2402 int i;
2403
2404 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2405 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2406 return;
2407 }
2408
2409 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2410 ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2411 BT_DBG("%s bad parameters", hdev->name);
2412 return;
2413 }
2414
2415 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2416
2417 for (i = 0; i < ev->num_hndl; i++) {
2418 struct hci_comp_pkts_info *info = &ev->handles[i];
2419 struct hci_conn *conn;
2420 __u16 handle, count;
2421
2422 handle = __le16_to_cpu(info->handle);
2423 count = __le16_to_cpu(info->count);
2424
2425 conn = hci_conn_hash_lookup_handle(hdev, handle);
2426 if (!conn)
2427 continue;
2428
2429 conn->sent -= count;
2430
2431 switch (conn->type) {
2432 case ACL_LINK:
2433 hdev->acl_cnt += count;
2434 if (hdev->acl_cnt > hdev->acl_pkts)
2435 hdev->acl_cnt = hdev->acl_pkts;
2436 break;
2437
2438 case LE_LINK:
2439 if (hdev->le_pkts) {
2440 hdev->le_cnt += count;
2441 if (hdev->le_cnt > hdev->le_pkts)
2442 hdev->le_cnt = hdev->le_pkts;
2443 } else {
2444 hdev->acl_cnt += count;
2445 if (hdev->acl_cnt > hdev->acl_pkts)
2446 hdev->acl_cnt = hdev->acl_pkts;
2447 }
2448 break;
2449
2450 case SCO_LINK:
2451 hdev->sco_cnt += count;
2452 if (hdev->sco_cnt > hdev->sco_pkts)
2453 hdev->sco_cnt = hdev->sco_pkts;
2454 break;
2455
2456 default:
2457 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2458 break;
2459 }
2460 }
2461
2462 queue_work(hdev->workqueue, &hdev->tx_work);
2463 }
2464
2465 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2466 __u16 handle)
2467 {
2468 struct hci_chan *chan;
2469
2470 switch (hdev->dev_type) {
2471 case HCI_BREDR:
2472 return hci_conn_hash_lookup_handle(hdev, handle);
2473 case HCI_AMP:
2474 chan = hci_chan_lookup_handle(hdev, handle);
2475 if (chan)
2476 return chan->conn;
2477 break;
2478 default:
2479 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2480 break;
2481 }
2482
2483 return NULL;
2484 }
2485
2486 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2487 {
2488 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2489 int i;
2490
2491 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2492 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2493 return;
2494 }
2495
2496 if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2497 ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2498 BT_DBG("%s bad parameters", hdev->name);
2499 return;
2500 }
2501
2502 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2503 ev->num_hndl);
2504
2505 for (i = 0; i < ev->num_hndl; i++) {
2506 struct hci_comp_blocks_info *info = &ev->handles[i];
2507 struct hci_conn *conn = NULL;
2508 __u16 handle, block_count;
2509
2510 handle = __le16_to_cpu(info->handle);
2511 block_count = __le16_to_cpu(info->blocks);
2512
2513 conn = __hci_conn_lookup_handle(hdev, handle);
2514 if (!conn)
2515 continue;
2516
2517 conn->sent -= block_count;
2518
2519 switch (conn->type) {
2520 case ACL_LINK:
2521 case AMP_LINK:
2522 hdev->block_cnt += block_count;
2523 if (hdev->block_cnt > hdev->num_blocks)
2524 hdev->block_cnt = hdev->num_blocks;
2525 break;
2526
2527 default:
2528 BT_ERR("Unknown type %d conn %p", conn->type, conn);
2529 break;
2530 }
2531 }
2532
2533 queue_work(hdev->workqueue, &hdev->tx_work);
2534 }
2535
2536 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2537 {
2538 struct hci_ev_mode_change *ev = (void *) skb->data;
2539 struct hci_conn *conn;
2540
2541 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2542
2543 hci_dev_lock(hdev);
2544
2545 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2546 if (conn) {
2547 conn->mode = ev->mode;
2548
2549 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2550 &conn->flags)) {
2551 if (conn->mode == HCI_CM_ACTIVE)
2552 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2553 else
2554 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2555 }
2556
2557 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2558 hci_sco_setup(conn, ev->status);
2559 }
2560
2561 hci_dev_unlock(hdev);
2562 }
2563
2564 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2565 {
2566 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2567 struct hci_conn *conn;
2568
2569 BT_DBG("%s", hdev->name);
2570
2571 hci_dev_lock(hdev);
2572
2573 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2574 if (!conn)
2575 goto unlock;
2576
2577 if (conn->state == BT_CONNECTED) {
2578 hci_conn_hold(conn);
2579 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2580 hci_conn_drop(conn);
2581 }
2582
2583 if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2584 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2585 sizeof(ev->bdaddr), &ev->bdaddr);
2586 else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2587 u8 secure;
2588
2589 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2590 secure = 1;
2591 else
2592 secure = 0;
2593
2594 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2595 }
2596
2597 unlock:
2598 hci_dev_unlock(hdev);
2599 }
2600
2601 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2602 {
2603 struct hci_ev_link_key_req *ev = (void *) skb->data;
2604 struct hci_cp_link_key_reply cp;
2605 struct hci_conn *conn;
2606 struct link_key *key;
2607
2608 BT_DBG("%s", hdev->name);
2609
2610 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2611 return;
2612
2613 hci_dev_lock(hdev);
2614
2615 key = hci_find_link_key(hdev, &ev->bdaddr);
2616 if (!key) {
2617 BT_DBG("%s link key not found for %pMR", hdev->name,
2618 &ev->bdaddr);
2619 goto not_found;
2620 }
2621
2622 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2623 &ev->bdaddr);
2624
2625 if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2626 key->type == HCI_LK_DEBUG_COMBINATION) {
2627 BT_DBG("%s ignoring debug key", hdev->name);
2628 goto not_found;
2629 }
2630
2631 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2632 if (conn) {
2633 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2634 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2635 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2636 goto not_found;
2637 }
2638
2639 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2640 conn->pending_sec_level == BT_SECURITY_HIGH) {
2641 BT_DBG("%s ignoring key unauthenticated for high security",
2642 hdev->name);
2643 goto not_found;
2644 }
2645
2646 conn->key_type = key->type;
2647 conn->pin_length = key->pin_len;
2648 }
2649
2650 bacpy(&cp.bdaddr, &ev->bdaddr);
2651 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2652
2653 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2654
2655 hci_dev_unlock(hdev);
2656
2657 return;
2658
2659 not_found:
2660 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2661 hci_dev_unlock(hdev);
2662 }
2663
2664 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2665 {
2666 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2667 struct hci_conn *conn;
2668 u8 pin_len = 0;
2669
2670 BT_DBG("%s", hdev->name);
2671
2672 hci_dev_lock(hdev);
2673
2674 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2675 if (conn) {
2676 hci_conn_hold(conn);
2677 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2678 pin_len = conn->pin_length;
2679
2680 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2681 conn->key_type = ev->key_type;
2682
2683 hci_conn_drop(conn);
2684 }
2685
2686 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2687 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2688 ev->key_type, pin_len);
2689
2690 hci_dev_unlock(hdev);
2691 }
2692
2693 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2694 {
2695 struct hci_ev_clock_offset *ev = (void *) skb->data;
2696 struct hci_conn *conn;
2697
2698 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2699
2700 hci_dev_lock(hdev);
2701
2702 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2703 if (conn && !ev->status) {
2704 struct inquiry_entry *ie;
2705
2706 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2707 if (ie) {
2708 ie->data.clock_offset = ev->clock_offset;
2709 ie->timestamp = jiffies;
2710 }
2711 }
2712
2713 hci_dev_unlock(hdev);
2714 }
2715
2716 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2717 {
2718 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2719 struct hci_conn *conn;
2720
2721 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2722
2723 hci_dev_lock(hdev);
2724
2725 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2726 if (conn && !ev->status)
2727 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2728
2729 hci_dev_unlock(hdev);
2730 }
2731
2732 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2733 {
2734 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2735 struct inquiry_entry *ie;
2736
2737 BT_DBG("%s", hdev->name);
2738
2739 hci_dev_lock(hdev);
2740
2741 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2742 if (ie) {
2743 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2744 ie->timestamp = jiffies;
2745 }
2746
2747 hci_dev_unlock(hdev);
2748 }
2749
2750 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
2751 struct sk_buff *skb)
2752 {
2753 struct inquiry_data data;
2754 int num_rsp = *((__u8 *) skb->data);
2755 bool name_known, ssp;
2756
2757 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2758
2759 if (!num_rsp)
2760 return;
2761
2762 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2763 return;
2764
2765 hci_dev_lock(hdev);
2766
2767 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2768 struct inquiry_info_with_rssi_and_pscan_mode *info;
2769 info = (void *) (skb->data + 1);
2770
2771 for (; num_rsp; num_rsp--, info++) {
2772 bacpy(&data.bdaddr, &info->bdaddr);
2773 data.pscan_rep_mode = info->pscan_rep_mode;
2774 data.pscan_period_mode = info->pscan_period_mode;
2775 data.pscan_mode = info->pscan_mode;
2776 memcpy(data.dev_class, info->dev_class, 3);
2777 data.clock_offset = info->clock_offset;
2778 data.rssi = info->rssi;
2779 data.ssp_mode = 0x00;
2780
2781 name_known = hci_inquiry_cache_update(hdev, &data,
2782 false, &ssp);
2783 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2784 info->dev_class, info->rssi,
2785 !name_known, ssp, NULL, 0);
2786 }
2787 } else {
2788 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2789
2790 for (; num_rsp; num_rsp--, info++) {
2791 bacpy(&data.bdaddr, &info->bdaddr);
2792 data.pscan_rep_mode = info->pscan_rep_mode;
2793 data.pscan_period_mode = info->pscan_period_mode;
2794 data.pscan_mode = 0x00;
2795 memcpy(data.dev_class, info->dev_class, 3);
2796 data.clock_offset = info->clock_offset;
2797 data.rssi = info->rssi;
2798 data.ssp_mode = 0x00;
2799 name_known = hci_inquiry_cache_update(hdev, &data,
2800 false, &ssp);
2801 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2802 info->dev_class, info->rssi,
2803 !name_known, ssp, NULL, 0);
2804 }
2805 }
2806
2807 hci_dev_unlock(hdev);
2808 }
2809
2810 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
2811 struct sk_buff *skb)
2812 {
2813 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2814 struct hci_conn *conn;
2815
2816 BT_DBG("%s", hdev->name);
2817
2818 hci_dev_lock(hdev);
2819
2820 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2821 if (!conn)
2822 goto unlock;
2823
2824 if (ev->page < HCI_MAX_PAGES)
2825 memcpy(conn->features[ev->page], ev->features, 8);
2826
2827 if (!ev->status && ev->page == 0x01) {
2828 struct inquiry_entry *ie;
2829
2830 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2831 if (ie)
2832 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
2833
2834 if (ev->features[0] & LMP_HOST_SSP) {
2835 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2836 } else {
2837 /* It is mandatory by the Bluetooth specification that
2838 * Extended Inquiry Results are only used when Secure
2839 * Simple Pairing is enabled, but some devices violate
2840 * this.
2841 *
2842 * To make these devices work, the internal SSP
2843 * enabled flag needs to be cleared if the remote host
2844 * features do not indicate SSP support */
2845 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
2846 }
2847 }
2848
2849 if (conn->state != BT_CONFIG)
2850 goto unlock;
2851
2852 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2853 struct hci_cp_remote_name_req cp;
2854 memset(&cp, 0, sizeof(cp));
2855 bacpy(&cp.bdaddr, &conn->dst);
2856 cp.pscan_rep_mode = 0x02;
2857 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2858 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2859 mgmt_device_connected(hdev, &conn->dst, conn->type,
2860 conn->dst_type, 0, NULL, 0,
2861 conn->dev_class);
2862
2863 if (!hci_outgoing_auth_needed(hdev, conn)) {
2864 conn->state = BT_CONNECTED;
2865 hci_proto_connect_cfm(conn, ev->status);
2866 hci_conn_drop(conn);
2867 }
2868
2869 unlock:
2870 hci_dev_unlock(hdev);
2871 }
2872
2873 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
2874 struct sk_buff *skb)
2875 {
2876 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2877 struct hci_conn *conn;
2878
2879 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2880
2881 hci_dev_lock(hdev);
2882
2883 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2884 if (!conn) {
2885 if (ev->link_type == ESCO_LINK)
2886 goto unlock;
2887
2888 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2889 if (!conn)
2890 goto unlock;
2891
2892 conn->type = SCO_LINK;
2893 }
2894
2895 switch (ev->status) {
2896 case 0x00:
2897 conn->handle = __le16_to_cpu(ev->handle);
2898 conn->state = BT_CONNECTED;
2899
2900 hci_conn_add_sysfs(conn);
2901 break;
2902
2903 case 0x0d: /* Connection Rejected due to Limited Resources */
2904 case 0x11: /* Unsupported Feature or Parameter Value */
2905 case 0x1c: /* SCO interval rejected */
2906 case 0x1a: /* Unsupported Remote Feature */
2907 case 0x1f: /* Unspecified error */
2908 if (conn->out) {
2909 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2910 (hdev->esco_type & EDR_ESCO_MASK);
2911 if (hci_setup_sync(conn, conn->link->handle))
2912 goto unlock;
2913 }
2914 /* fall through */
2915
2916 default:
2917 conn->state = BT_CLOSED;
2918 break;
2919 }
2920
2921 hci_proto_connect_cfm(conn, ev->status);
2922 if (ev->status)
2923 hci_conn_del(conn);
2924
2925 unlock:
2926 hci_dev_unlock(hdev);
2927 }
2928
2929 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
2930 {
2931 size_t parsed = 0;
2932
2933 while (parsed < eir_len) {
2934 u8 field_len = eir[0];
2935
2936 if (field_len == 0)
2937 return parsed;
2938
2939 parsed += field_len + 1;
2940 eir += field_len + 1;
2941 }
2942
2943 return eir_len;
2944 }
2945
2946 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
2947 struct sk_buff *skb)
2948 {
2949 struct inquiry_data data;
2950 struct extended_inquiry_info *info = (void *) (skb->data + 1);
2951 int num_rsp = *((__u8 *) skb->data);
2952 size_t eir_len;
2953
2954 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2955
2956 if (!num_rsp)
2957 return;
2958
2959 if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2960 return;
2961
2962 hci_dev_lock(hdev);
2963
2964 for (; num_rsp; num_rsp--, info++) {
2965 bool name_known, ssp;
2966
2967 bacpy(&data.bdaddr, &info->bdaddr);
2968 data.pscan_rep_mode = info->pscan_rep_mode;
2969 data.pscan_period_mode = info->pscan_period_mode;
2970 data.pscan_mode = 0x00;
2971 memcpy(data.dev_class, info->dev_class, 3);
2972 data.clock_offset = info->clock_offset;
2973 data.rssi = info->rssi;
2974 data.ssp_mode = 0x01;
2975
2976 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2977 name_known = eir_has_data_type(info->data,
2978 sizeof(info->data),
2979 EIR_NAME_COMPLETE);
2980 else
2981 name_known = true;
2982
2983 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
2984 &ssp);
2985 eir_len = eir_get_length(info->data, sizeof(info->data));
2986 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2987 info->dev_class, info->rssi, !name_known,
2988 ssp, info->data, eir_len);
2989 }
2990
2991 hci_dev_unlock(hdev);
2992 }
2993
2994 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
2995 struct sk_buff *skb)
2996 {
2997 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
2998 struct hci_conn *conn;
2999
3000 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3001 __le16_to_cpu(ev->handle));
3002
3003 hci_dev_lock(hdev);
3004
3005 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3006 if (!conn)
3007 goto unlock;
3008
3009 if (!ev->status)
3010 conn->sec_level = conn->pending_sec_level;
3011
3012 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3013
3014 if (ev->status && conn->state == BT_CONNECTED) {
3015 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3016 hci_conn_drop(conn);
3017 goto unlock;
3018 }
3019
3020 if (conn->state == BT_CONFIG) {
3021 if (!ev->status)
3022 conn->state = BT_CONNECTED;
3023
3024 hci_proto_connect_cfm(conn, ev->status);
3025 hci_conn_drop(conn);
3026 } else {
3027 hci_auth_cfm(conn, ev->status);
3028
3029 hci_conn_hold(conn);
3030 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3031 hci_conn_drop(conn);
3032 }
3033
3034 unlock:
3035 hci_dev_unlock(hdev);
3036 }
3037
3038 static u8 hci_get_auth_req(struct hci_conn *conn)
3039 {
3040 /* If remote requests dedicated bonding follow that lead */
3041 if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3042 conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3043 /* If both remote and local IO capabilities allow MITM
3044 * protection then require it, otherwise don't */
3045 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3046 conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3047 return HCI_AT_DEDICATED_BONDING;
3048 else
3049 return HCI_AT_DEDICATED_BONDING_MITM;
3050 }
3051
3052 /* If remote requests no-bonding follow that lead */
3053 if (conn->remote_auth == HCI_AT_NO_BONDING ||
3054 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3055 return conn->remote_auth | (conn->auth_type & 0x01);
3056
3057 return conn->auth_type;
3058 }
3059
3060 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3061 {
3062 struct hci_ev_io_capa_request *ev = (void *) skb->data;
3063 struct hci_conn *conn;
3064
3065 BT_DBG("%s", hdev->name);
3066
3067 hci_dev_lock(hdev);
3068
3069 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3070 if (!conn)
3071 goto unlock;
3072
3073 hci_conn_hold(conn);
3074
3075 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3076 goto unlock;
3077
3078 if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3079 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3080 struct hci_cp_io_capability_reply cp;
3081
3082 bacpy(&cp.bdaddr, &ev->bdaddr);
3083 /* Change the IO capability from KeyboardDisplay
3084 * to DisplayYesNo as it is not supported by BT spec. */
3085 cp.capability = (conn->io_capability == 0x04) ?
3086 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3087 conn->auth_type = hci_get_auth_req(conn);
3088 cp.authentication = conn->auth_type;
3089
3090 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3091 (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3092 cp.oob_data = 0x01;
3093 else
3094 cp.oob_data = 0x00;
3095
3096 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3097 sizeof(cp), &cp);
3098 } else {
3099 struct hci_cp_io_capability_neg_reply cp;
3100
3101 bacpy(&cp.bdaddr, &ev->bdaddr);
3102 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3103
3104 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3105 sizeof(cp), &cp);
3106 }
3107
3108 unlock:
3109 hci_dev_unlock(hdev);
3110 }
3111
3112 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3113 {
3114 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3115 struct hci_conn *conn;
3116
3117 BT_DBG("%s", hdev->name);
3118
3119 hci_dev_lock(hdev);
3120
3121 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3122 if (!conn)
3123 goto unlock;
3124
3125 conn->remote_cap = ev->capability;
3126 conn->remote_auth = ev->authentication;
3127 if (ev->oob_data)
3128 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3129
3130 unlock:
3131 hci_dev_unlock(hdev);
3132 }
3133
3134 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3135 struct sk_buff *skb)
3136 {
3137 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3138 int loc_mitm, rem_mitm, confirm_hint = 0;
3139 struct hci_conn *conn;
3140
3141 BT_DBG("%s", hdev->name);
3142
3143 hci_dev_lock(hdev);
3144
3145 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3146 goto unlock;
3147
3148 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3149 if (!conn)
3150 goto unlock;
3151
3152 loc_mitm = (conn->auth_type & 0x01);
3153 rem_mitm = (conn->remote_auth & 0x01);
3154
3155 /* If we require MITM but the remote device can't provide that
3156 * (it has NoInputNoOutput) then reject the confirmation
3157 * request. The only exception is when we're dedicated bonding
3158 * initiators (connect_cfm_cb set) since then we always have the MITM
3159 * bit set. */
3160 if (!conn->connect_cfm_cb && loc_mitm &&
3161 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3162 BT_DBG("Rejecting request: remote device can't provide MITM");
3163 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3164 sizeof(ev->bdaddr), &ev->bdaddr);
3165 goto unlock;
3166 }
3167
3168 /* If no side requires MITM protection; auto-accept */
3169 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3170 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3171
3172 /* If we're not the initiators request authorization to
3173 * proceed from user space (mgmt_user_confirm with
3174 * confirm_hint set to 1). */
3175 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3176 BT_DBG("Confirming auto-accept as acceptor");
3177 confirm_hint = 1;
3178 goto confirm;
3179 }
3180
3181 BT_DBG("Auto-accept of user confirmation with %ums delay",
3182 hdev->auto_accept_delay);
3183
3184 if (hdev->auto_accept_delay > 0) {
3185 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3186 queue_delayed_work(conn->hdev->workqueue,
3187 &conn->auto_accept_work, delay);
3188 goto unlock;
3189 }
3190
3191 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3192 sizeof(ev->bdaddr), &ev->bdaddr);
3193 goto unlock;
3194 }
3195
3196 confirm:
3197 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0, ev->passkey,
3198 confirm_hint);
3199
3200 unlock:
3201 hci_dev_unlock(hdev);
3202 }
3203
3204 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3205 struct sk_buff *skb)
3206 {
3207 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3208
3209 BT_DBG("%s", hdev->name);
3210
3211 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3212 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3213 }
3214
3215 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3216 struct sk_buff *skb)
3217 {
3218 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3219 struct hci_conn *conn;
3220
3221 BT_DBG("%s", hdev->name);
3222
3223 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3224 if (!conn)
3225 return;
3226
3227 conn->passkey_notify = __le32_to_cpu(ev->passkey);
3228 conn->passkey_entered = 0;
3229
3230 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3231 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3232 conn->dst_type, conn->passkey_notify,
3233 conn->passkey_entered);
3234 }
3235
3236 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3237 {
3238 struct hci_ev_keypress_notify *ev = (void *) skb->data;
3239 struct hci_conn *conn;
3240
3241 BT_DBG("%s", hdev->name);
3242
3243 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3244 if (!conn)
3245 return;
3246
3247 switch (ev->type) {
3248 case HCI_KEYPRESS_STARTED:
3249 conn->passkey_entered = 0;
3250 return;
3251
3252 case HCI_KEYPRESS_ENTERED:
3253 conn->passkey_entered++;
3254 break;
3255
3256 case HCI_KEYPRESS_ERASED:
3257 conn->passkey_entered--;
3258 break;
3259
3260 case HCI_KEYPRESS_CLEARED:
3261 conn->passkey_entered = 0;
3262 break;
3263
3264 case HCI_KEYPRESS_COMPLETED:
3265 return;
3266 }
3267
3268 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3269 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3270 conn->dst_type, conn->passkey_notify,
3271 conn->passkey_entered);
3272 }
3273
3274 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3275 struct sk_buff *skb)
3276 {
3277 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3278 struct hci_conn *conn;
3279
3280 BT_DBG("%s", hdev->name);
3281
3282 hci_dev_lock(hdev);
3283
3284 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3285 if (!conn)
3286 goto unlock;
3287
3288 /* To avoid duplicate auth_failed events to user space we check
3289 * the HCI_CONN_AUTH_PEND flag which will be set if we
3290 * initiated the authentication. A traditional auth_complete
3291 * event gets always produced as initiator and is also mapped to
3292 * the mgmt_auth_failed event */
3293 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3294 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3295 ev->status);
3296
3297 hci_conn_drop(conn);
3298
3299 unlock:
3300 hci_dev_unlock(hdev);
3301 }
3302
3303 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3304 struct sk_buff *skb)
3305 {
3306 struct hci_ev_remote_host_features *ev = (void *) skb->data;
3307 struct inquiry_entry *ie;
3308 struct hci_conn *conn;
3309
3310 BT_DBG("%s", hdev->name);
3311
3312 hci_dev_lock(hdev);
3313
3314 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3315 if (conn)
3316 memcpy(conn->features[1], ev->features, 8);
3317
3318 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3319 if (ie)
3320 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3321
3322 hci_dev_unlock(hdev);
3323 }
3324
3325 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3326 struct sk_buff *skb)
3327 {
3328 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3329 struct oob_data *data;
3330
3331 BT_DBG("%s", hdev->name);
3332
3333 hci_dev_lock(hdev);
3334
3335 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3336 goto unlock;
3337
3338 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3339 if (data) {
3340 struct hci_cp_remote_oob_data_reply cp;
3341
3342 bacpy(&cp.bdaddr, &ev->bdaddr);
3343 memcpy(cp.hash, data->hash, sizeof(cp.hash));
3344 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
3345
3346 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
3347 &cp);
3348 } else {
3349 struct hci_cp_remote_oob_data_neg_reply cp;
3350
3351 bacpy(&cp.bdaddr, &ev->bdaddr);
3352 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
3353 &cp);
3354 }
3355
3356 unlock:
3357 hci_dev_unlock(hdev);
3358 }
3359
3360 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3361 struct sk_buff *skb)
3362 {
3363 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3364 struct hci_conn *hcon, *bredr_hcon;
3365
3366 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3367 ev->status);
3368
3369 hci_dev_lock(hdev);
3370
3371 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3372 if (!hcon) {
3373 hci_dev_unlock(hdev);
3374 return;
3375 }
3376
3377 if (ev->status) {
3378 hci_conn_del(hcon);
3379 hci_dev_unlock(hdev);
3380 return;
3381 }
3382
3383 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3384
3385 hcon->state = BT_CONNECTED;
3386 bacpy(&hcon->dst, &bredr_hcon->dst);
3387
3388 hci_conn_hold(hcon);
3389 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3390 hci_conn_drop(hcon);
3391
3392 hci_conn_add_sysfs(hcon);
3393
3394 amp_physical_cfm(bredr_hcon, hcon);
3395
3396 hci_dev_unlock(hdev);
3397 }
3398
3399 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3400 {
3401 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3402 struct hci_conn *hcon;
3403 struct hci_chan *hchan;
3404 struct amp_mgr *mgr;
3405
3406 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3407 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3408 ev->status);
3409
3410 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3411 if (!hcon)
3412 return;
3413
3414 /* Create AMP hchan */
3415 hchan = hci_chan_create(hcon);
3416 if (!hchan)
3417 return;
3418
3419 hchan->handle = le16_to_cpu(ev->handle);
3420
3421 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3422
3423 mgr = hcon->amp_mgr;
3424 if (mgr && mgr->bredr_chan) {
3425 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3426
3427 l2cap_chan_lock(bredr_chan);
3428
3429 bredr_chan->conn->mtu = hdev->block_mtu;
3430 l2cap_logical_cfm(bredr_chan, hchan, 0);
3431 hci_conn_hold(hcon);
3432
3433 l2cap_chan_unlock(bredr_chan);
3434 }
3435 }
3436
3437 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3438 struct sk_buff *skb)
3439 {
3440 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3441 struct hci_chan *hchan;
3442
3443 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3444 le16_to_cpu(ev->handle), ev->status);
3445
3446 if (ev->status)
3447 return;
3448
3449 hci_dev_lock(hdev);
3450
3451 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3452 if (!hchan)
3453 goto unlock;
3454
3455 amp_destroy_logical_link(hchan, ev->reason);
3456
3457 unlock:
3458 hci_dev_unlock(hdev);
3459 }
3460
3461 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3462 struct sk_buff *skb)
3463 {
3464 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3465 struct hci_conn *hcon;
3466
3467 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3468
3469 if (ev->status)
3470 return;
3471
3472 hci_dev_lock(hdev);
3473
3474 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3475 if (hcon) {
3476 hcon->state = BT_CLOSED;
3477 hci_conn_del(hcon);
3478 }
3479
3480 hci_dev_unlock(hdev);
3481 }
3482
3483 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3484 {
3485 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3486 struct hci_conn *conn;
3487
3488 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3489
3490 hci_dev_lock(hdev);
3491
3492 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3493 if (!conn) {
3494 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3495 if (!conn) {
3496 BT_ERR("No memory for new connection");
3497 goto unlock;
3498 }
3499
3500 conn->dst_type = ev->bdaddr_type;
3501
3502 /* The advertising parameters for own address type
3503 * define which source address and source address
3504 * type this connections has.
3505 */
3506 if (bacmp(&conn->src, BDADDR_ANY)) {
3507 conn->src_type = ADDR_LE_DEV_PUBLIC;
3508 } else {
3509 bacpy(&conn->src, &hdev->static_addr);
3510 conn->src_type = ADDR_LE_DEV_RANDOM;
3511 }
3512
3513 if (ev->role == LE_CONN_ROLE_MASTER) {
3514 conn->out = true;
3515 conn->link_mode |= HCI_LM_MASTER;
3516 }
3517 }
3518
3519 if (ev->status) {
3520 mgmt_connect_failed(hdev, &conn->dst, conn->type,
3521 conn->dst_type, ev->status);
3522 hci_proto_connect_cfm(conn, ev->status);
3523 conn->state = BT_CLOSED;
3524 hci_conn_del(conn);
3525 goto unlock;
3526 }
3527
3528 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3529 mgmt_device_connected(hdev, &ev->bdaddr, conn->type,
3530 conn->dst_type, 0, NULL, 0, NULL);
3531
3532 conn->sec_level = BT_SECURITY_LOW;
3533 conn->handle = __le16_to_cpu(ev->handle);
3534 conn->state = BT_CONNECTED;
3535
3536 if (test_bit(HCI_6LOWPAN_ENABLED, &hdev->dev_flags))
3537 set_bit(HCI_CONN_6LOWPAN, &conn->flags);
3538
3539 hci_conn_add_sysfs(conn);
3540
3541 hci_proto_connect_cfm(conn, ev->status);
3542
3543 unlock:
3544 hci_dev_unlock(hdev);
3545 }
3546
3547 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3548 {
3549 u8 num_reports = skb->data[0];
3550 void *ptr = &skb->data[1];
3551 s8 rssi;
3552
3553 while (num_reports--) {
3554 struct hci_ev_le_advertising_info *ev = ptr;
3555
3556 rssi = ev->data[ev->length];
3557 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3558 NULL, rssi, 0, 1, ev->data, ev->length);
3559
3560 ptr += sizeof(*ev) + ev->length + 1;
3561 }
3562 }
3563
3564 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3565 {
3566 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3567 struct hci_cp_le_ltk_reply cp;
3568 struct hci_cp_le_ltk_neg_reply neg;
3569 struct hci_conn *conn;
3570 struct smp_ltk *ltk;
3571
3572 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3573
3574 hci_dev_lock(hdev);
3575
3576 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3577 if (conn == NULL)
3578 goto not_found;
3579
3580 ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3581 if (ltk == NULL)
3582 goto not_found;
3583
3584 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3585 cp.handle = cpu_to_le16(conn->handle);
3586
3587 if (ltk->authenticated)
3588 conn->pending_sec_level = BT_SECURITY_HIGH;
3589 else
3590 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3591
3592 conn->enc_key_size = ltk->enc_size;
3593
3594 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3595
3596 if (ltk->type & HCI_SMP_STK) {
3597 list_del(&ltk->list);
3598 kfree(ltk);
3599 }
3600
3601 hci_dev_unlock(hdev);
3602
3603 return;
3604
3605 not_found:
3606 neg.handle = ev->handle;
3607 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3608 hci_dev_unlock(hdev);
3609 }
3610
3611 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3612 {
3613 struct hci_ev_le_meta *le_ev = (void *) skb->data;
3614
3615 skb_pull(skb, sizeof(*le_ev));
3616
3617 switch (le_ev->subevent) {
3618 case HCI_EV_LE_CONN_COMPLETE:
3619 hci_le_conn_complete_evt(hdev, skb);
3620 break;
3621
3622 case HCI_EV_LE_ADVERTISING_REPORT:
3623 hci_le_adv_report_evt(hdev, skb);
3624 break;
3625
3626 case HCI_EV_LE_LTK_REQ:
3627 hci_le_ltk_request_evt(hdev, skb);
3628 break;
3629
3630 default:
3631 break;
3632 }
3633 }
3634
3635 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
3636 {
3637 struct hci_ev_channel_selected *ev = (void *) skb->data;
3638 struct hci_conn *hcon;
3639
3640 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
3641
3642 skb_pull(skb, sizeof(*ev));
3643
3644 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3645 if (!hcon)
3646 return;
3647
3648 amp_read_loc_assoc_final_data(hdev, hcon);
3649 }
3650
3651 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3652 {
3653 struct hci_event_hdr *hdr = (void *) skb->data;
3654 __u8 event = hdr->evt;
3655
3656 hci_dev_lock(hdev);
3657
3658 /* Received events are (currently) only needed when a request is
3659 * ongoing so avoid unnecessary memory allocation.
3660 */
3661 if (hdev->req_status == HCI_REQ_PEND) {
3662 kfree_skb(hdev->recv_evt);
3663 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
3664 }
3665
3666 hci_dev_unlock(hdev);
3667
3668 skb_pull(skb, HCI_EVENT_HDR_SIZE);
3669
3670 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
3671 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
3672 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
3673
3674 hci_req_cmd_complete(hdev, opcode, 0);
3675 }
3676
3677 switch (event) {
3678 case HCI_EV_INQUIRY_COMPLETE:
3679 hci_inquiry_complete_evt(hdev, skb);
3680 break;
3681
3682 case HCI_EV_INQUIRY_RESULT:
3683 hci_inquiry_result_evt(hdev, skb);
3684 break;
3685
3686 case HCI_EV_CONN_COMPLETE:
3687 hci_conn_complete_evt(hdev, skb);
3688 break;
3689
3690 case HCI_EV_CONN_REQUEST:
3691 hci_conn_request_evt(hdev, skb);
3692 break;
3693
3694 case HCI_EV_DISCONN_COMPLETE:
3695 hci_disconn_complete_evt(hdev, skb);
3696 break;
3697
3698 case HCI_EV_AUTH_COMPLETE:
3699 hci_auth_complete_evt(hdev, skb);
3700 break;
3701
3702 case HCI_EV_REMOTE_NAME:
3703 hci_remote_name_evt(hdev, skb);
3704 break;
3705
3706 case HCI_EV_ENCRYPT_CHANGE:
3707 hci_encrypt_change_evt(hdev, skb);
3708 break;
3709
3710 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3711 hci_change_link_key_complete_evt(hdev, skb);
3712 break;
3713
3714 case HCI_EV_REMOTE_FEATURES:
3715 hci_remote_features_evt(hdev, skb);
3716 break;
3717
3718 case HCI_EV_CMD_COMPLETE:
3719 hci_cmd_complete_evt(hdev, skb);
3720 break;
3721
3722 case HCI_EV_CMD_STATUS:
3723 hci_cmd_status_evt(hdev, skb);
3724 break;
3725
3726 case HCI_EV_ROLE_CHANGE:
3727 hci_role_change_evt(hdev, skb);
3728 break;
3729
3730 case HCI_EV_NUM_COMP_PKTS:
3731 hci_num_comp_pkts_evt(hdev, skb);
3732 break;
3733
3734 case HCI_EV_MODE_CHANGE:
3735 hci_mode_change_evt(hdev, skb);
3736 break;
3737
3738 case HCI_EV_PIN_CODE_REQ:
3739 hci_pin_code_request_evt(hdev, skb);
3740 break;
3741
3742 case HCI_EV_LINK_KEY_REQ:
3743 hci_link_key_request_evt(hdev, skb);
3744 break;
3745
3746 case HCI_EV_LINK_KEY_NOTIFY:
3747 hci_link_key_notify_evt(hdev, skb);
3748 break;
3749
3750 case HCI_EV_CLOCK_OFFSET:
3751 hci_clock_offset_evt(hdev, skb);
3752 break;
3753
3754 case HCI_EV_PKT_TYPE_CHANGE:
3755 hci_pkt_type_change_evt(hdev, skb);
3756 break;
3757
3758 case HCI_EV_PSCAN_REP_MODE:
3759 hci_pscan_rep_mode_evt(hdev, skb);
3760 break;
3761
3762 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3763 hci_inquiry_result_with_rssi_evt(hdev, skb);
3764 break;
3765
3766 case HCI_EV_REMOTE_EXT_FEATURES:
3767 hci_remote_ext_features_evt(hdev, skb);
3768 break;
3769
3770 case HCI_EV_SYNC_CONN_COMPLETE:
3771 hci_sync_conn_complete_evt(hdev, skb);
3772 break;
3773
3774 case HCI_EV_EXTENDED_INQUIRY_RESULT:
3775 hci_extended_inquiry_result_evt(hdev, skb);
3776 break;
3777
3778 case HCI_EV_KEY_REFRESH_COMPLETE:
3779 hci_key_refresh_complete_evt(hdev, skb);
3780 break;
3781
3782 case HCI_EV_IO_CAPA_REQUEST:
3783 hci_io_capa_request_evt(hdev, skb);
3784 break;
3785
3786 case HCI_EV_IO_CAPA_REPLY:
3787 hci_io_capa_reply_evt(hdev, skb);
3788 break;
3789
3790 case HCI_EV_USER_CONFIRM_REQUEST:
3791 hci_user_confirm_request_evt(hdev, skb);
3792 break;
3793
3794 case HCI_EV_USER_PASSKEY_REQUEST:
3795 hci_user_passkey_request_evt(hdev, skb);
3796 break;
3797
3798 case HCI_EV_USER_PASSKEY_NOTIFY:
3799 hci_user_passkey_notify_evt(hdev, skb);
3800 break;
3801
3802 case HCI_EV_KEYPRESS_NOTIFY:
3803 hci_keypress_notify_evt(hdev, skb);
3804 break;
3805
3806 case HCI_EV_SIMPLE_PAIR_COMPLETE:
3807 hci_simple_pair_complete_evt(hdev, skb);
3808 break;
3809
3810 case HCI_EV_REMOTE_HOST_FEATURES:
3811 hci_remote_host_features_evt(hdev, skb);
3812 break;
3813
3814 case HCI_EV_LE_META:
3815 hci_le_meta_evt(hdev, skb);
3816 break;
3817
3818 case HCI_EV_CHANNEL_SELECTED:
3819 hci_chan_selected_evt(hdev, skb);
3820 break;
3821
3822 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3823 hci_remote_oob_data_request_evt(hdev, skb);
3824 break;
3825
3826 case HCI_EV_PHY_LINK_COMPLETE:
3827 hci_phy_link_complete_evt(hdev, skb);
3828 break;
3829
3830 case HCI_EV_LOGICAL_LINK_COMPLETE:
3831 hci_loglink_complete_evt(hdev, skb);
3832 break;
3833
3834 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
3835 hci_disconn_loglink_complete_evt(hdev, skb);
3836 break;
3837
3838 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
3839 hci_disconn_phylink_complete_evt(hdev, skb);
3840 break;
3841
3842 case HCI_EV_NUM_COMP_BLOCKS:
3843 hci_num_comp_blocks_evt(hdev, skb);
3844 break;
3845
3846 default:
3847 BT_DBG("%s event 0x%2.2x", hdev->name, event);
3848 break;
3849 }
3850
3851 kfree_skb(skb);
3852 hdev->stat.evt_rx++;
3853 }
Linux with added FPC-III support