projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 86
[linux-block.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
0857dd3b 33#include "hci_request.h"
23b9ceb7 34#include "hci_debugfs.h"
7024728e 35#include "a2mp.h"
7ef9fbf0 36#include "amp.h"
2ceba539 37#include "smp.h"
1da177e4 38
aa5b0345
MH		 39#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
1da177e4
LT		 42/* Handle HCI Event packets */
43
a9de9248 44static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 45{
a9de9248 46 __u8 status = *((__u8 *) skb->data);
1da177e4 47
9f1db00c 48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 49
82f4785c 50 if (status)
a9de9248 51 return;
1da177e4 52
89352e7d 53 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 56
50143a43 57 hci_dev_lock(hdev);
168b8a25
JP		 58 /* Set discovery state to stopped if we're not doing LE active
59 * scanning.
60 */
61 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
62 hdev->le_scan_type != LE_SCAN_ACTIVE)
63 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
50143a43
JH		 64 hci_dev_unlock(hdev);
65
a9de9248
MH		 66 hci_conn_check_pending(hdev);
67}
6bd57416 68
4d93483b
AG		 69static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
70{
71 __u8 status = *((__u8 *) skb->data);
72
9f1db00c 73 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 74
75 if (status)
76 return;
77
a1536da2 78 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
4d93483b
AG		 79}
80
a9de9248
MH		 81static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
82{
83 __u8 status = *((__u8 *) skb->data);
6bd57416 84
9f1db00c 85 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 86
a9de9248
MH		 87 if (status)
88 return;
1da177e4 89
a358dc11 90 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
ae854a70 91
a9de9248
MH		 92 hci_conn_check_pending(hdev);
93}
94
807deac2
GP		 95static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
96 struct sk_buff *skb)
a9de9248
MH		 97{
98 BT_DBG("%s", hdev->name);
99}
100
101static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
102{
103 struct hci_rp_role_discovery *rp = (void *) skb->data;
104 struct hci_conn *conn;
105
9f1db00c 106 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 107
108 if (rp->status)
109 return;
110
111 hci_dev_lock(hdev);
112
113 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 114 if (conn)
115 conn->role = rp->role;
a9de9248
MH		 116
117 hci_dev_unlock(hdev);
1da177e4
LT		 118}
119
e4e8e37c
MH		 120static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
121{
122 struct hci_rp_read_link_policy *rp = (void *) skb->data;
123 struct hci_conn *conn;
124
9f1db00c 125 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 126
127 if (rp->status)
128 return;
129
130 hci_dev_lock(hdev);
131
132 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
133 if (conn)
134 conn->link_policy = __le16_to_cpu(rp->policy);
135
136 hci_dev_unlock(hdev);
137}
138
a9de9248 139static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 140{
a9de9248 141 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 142 struct hci_conn *conn;
04837f64 143 void *sent;
1da177e4 144
9f1db00c 145 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 146
a9de9248
MH		 147 if (rp->status)
148 return;
1da177e4 149
a9de9248
MH		 150 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
151 if (!sent)
152 return;
1da177e4 153
a9de9248 154 hci_dev_lock(hdev);
1da177e4 155
a9de9248 156 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 157 if (conn)
83985319 158 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 159
a9de9248
MH		 160 hci_dev_unlock(hdev);
161}
1da177e4 162
807deac2
GP		 163static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
164 struct sk_buff *skb)
e4e8e37c
MH		 165{
166 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
167
9f1db00c 168 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 169
170 if (rp->status)
171 return;
172
173 hdev->link_policy = __le16_to_cpu(rp->policy);
174}
175
807deac2
GP		 176static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
177 struct sk_buff *skb)
e4e8e37c
MH		 178{
179 __u8 status = *((__u8 *) skb->data);
180 void *sent;
181
9f1db00c 182 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 183
45296acd
MH		 184 if (status)
185 return;
186
e4e8e37c
MH		 187 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
188 if (!sent)
189 return;
190
45296acd 191 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 192}
193
a9de9248
MH		 194static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
195{
196 __u8 status = *((__u8 *) skb->data);
04837f64 197
9f1db00c 198 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 199
10572132
GP		 200 clear_bit(HCI_RESET, &hdev->flags);
201
8761f9d6
MH		 202 if (status)
203 return;
204
a297e97c 205 /* Reset all non-persistent flags */
eacb44df 206 hci_dev_clear_volatile_flags(hdev);
69775ff6 207
39c5d970
JH		 208 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
209
bbaf444a
JH		 210 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
211 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 212
213 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
214 hdev->adv_data_len = 0;
f8e808bd
MH		 215
216 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
217 hdev->scan_rsp_data_len = 0;
06f5b778 218
533553f8
MH		 219 hdev->le_scan_type = LE_SCAN_PASSIVE;
220
06f5b778 221 hdev->ssp_debug_mode = 0;
a4d5504d
MH		 222
223 hci_bdaddr_list_clear(&hdev->le_white_list);
cfdb0c2d 224 hci_bdaddr_list_clear(&hdev->le_resolv_list);
a9de9248 225}
04837f64 226
c2f0f979
MH		 227static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
228 struct sk_buff *skb)
229{
230 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
231 struct hci_cp_read_stored_link_key *sent;
232
233 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
234
235 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
236 if (!sent)
237 return;
238
239 if (!rp->status && sent->read_all == 0x01) {
240 hdev->stored_max_keys = rp->max_keys;
241 hdev->stored_num_keys = rp->num_keys;
242 }
243}
244
a9366120
MH		 245static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
246 struct sk_buff *skb)
247{
248 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
249
250 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
251
252 if (rp->status)
253 return;
254
255 if (rp->num_keys <= hdev->stored_num_keys)
256 hdev->stored_num_keys -= rp->num_keys;
257 else
258 hdev->stored_num_keys = 0;
259}
260
a9de9248
MH		 261static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
262{
263 __u8 status = *((__u8 *) skb->data);
264 void *sent;
04837f64 265
9f1db00c 266 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 267
a9de9248
MH		 268 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
269 if (!sent)
270 return;
04837f64 271
56e5cb86
JH		 272 hci_dev_lock(hdev);
273
d7a5a11d 274 if (hci_dev_test_flag(hdev, HCI_MGMT))
f51d5b24 275 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 276 else if (!status)
277 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 278
56e5cb86 279 hci_dev_unlock(hdev);
a9de9248
MH		 280}
281
282static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
283{
284 struct hci_rp_read_local_name *rp = (void *) skb->data;
285
9f1db00c 286 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 287
288 if (rp->status)
289 return;
290
d7a5a11d
MH		 291 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
292 hci_dev_test_flag(hdev, HCI_CONFIG))
db99b5fc 293 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 294}
295
296static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
297{
298 __u8 status = *((__u8 *) skb->data);
299 void *sent;
300
9f1db00c 301 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 302
303 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
304 if (!sent)
305 return;
306
5c1a4c8f
JK		 307 hci_dev_lock(hdev);
308
a9de9248
MH		 309 if (!status) {
310 __u8 param = *((__u8 *) sent);
311
312 if (param == AUTH_ENABLED)
313 set_bit(HCI_AUTH, &hdev->flags);
314 else
315 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 316 }
a9de9248 317
d7a5a11d 318 if (hci_dev_test_flag(hdev, HCI_MGMT))
33ef95ed 319 mgmt_auth_enable_complete(hdev, status);
5c1a4c8f
JK		 320
321 hci_dev_unlock(hdev);
1da177e4
LT		 322}
323
a9de9248 324static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 325{
a9de9248 326 __u8 status = *((__u8 *) skb->data);
45296acd 327 __u8 param;
1da177e4
LT		 328 void *sent;
329
9f1db00c 330 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 331
45296acd
MH		 332 if (status)
333 return;
334
a9de9248
MH		 335 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
336 if (!sent)
337 return;
1da177e4 338
45296acd 339 param = *((__u8 *) sent);
a9de9248 340
45296acd
MH		 341 if (param)
342 set_bit(HCI_ENCRYPT, &hdev->flags);
343 else
344 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 345}
1da177e4 346
a9de9248
MH		 347static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
348{
45296acd
MH		 349 __u8 status = *((__u8 *) skb->data);
350 __u8 param;
a9de9248 351 void *sent;
1da177e4 352
9f1db00c 353 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 354
a9de9248
MH		 355 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
356 if (!sent)
357 return;
1da177e4 358
36f7fc7e
JH		 359 param = *((__u8 *) sent);
360
56e5cb86
JH		 361 hci_dev_lock(hdev);
362
fa1bd918 363 if (status) {
2d7cee58
JH		 364 hdev->discov_timeout = 0;
365 goto done;
366 }
367
bc6d2d04 368 if (param & SCAN_INQUIRY)
36f7fc7e 369 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 370 else
371 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 372
031547d8 373 if (param & SCAN_PAGE)
36f7fc7e 374 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 375 else
204e3990 376 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 377
36f7fc7e 378done:
56e5cb86 379 hci_dev_unlock(hdev);
a9de9248 380}
1da177e4 381
a9de9248
MH		 382static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
383{
384 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 385
9f1db00c 386 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 387
a9de9248
MH		 388 if (rp->status)
389 return;
1da177e4 390
a9de9248 391 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 392
a9de9248 393 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 394 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 395}
1da177e4 396
a9de9248
MH		 397static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
398{
399 __u8 status = *((__u8 *) skb->data);
400 void *sent;
1da177e4 401
9f1db00c 402 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 403
a9de9248
MH		 404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
405 if (!sent)
406 return;
1da177e4 407
7f9a903c
MH		 408 hci_dev_lock(hdev);
409
410 if (status == 0)
411 memcpy(hdev->dev_class, sent, 3);
412
d7a5a11d 413 if (hci_dev_test_flag(hdev, HCI_MGMT))
7f9a903c
MH		 414 mgmt_set_class_of_dev_complete(hdev, sent, status);
415
416 hci_dev_unlock(hdev);
a9de9248 417}
1da177e4 418
a9de9248
MH		 419static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
420{
421 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
422 __u16 setting;
423
9f1db00c 424 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 425
426 if (rp->status)
427 return;
428
429 setting = __le16_to_cpu(rp->voice_setting);
430
f383f275 431 if (hdev->voice_setting == setting)
a9de9248
MH		 432 return;
433
434 hdev->voice_setting = setting;
435
9f1db00c 436 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 437
3c54711c 438 if (hdev->notify)
a9de9248 439 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 440}
441
8fc9ced3
GP		 442static void hci_cc_write_voice_setting(struct hci_dev *hdev,
443 struct sk_buff *skb)
a9de9248
MH		 444{
445 __u8 status = *((__u8 *) skb->data);
f383f275 446 __u16 setting;
a9de9248
MH		 447 void *sent;
448
9f1db00c 449 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 450
f383f275
MH		 451 if (status)
452 return;
453
a9de9248
MH		 454 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
455 if (!sent)
456 return;
1da177e4 457
f383f275 458 setting = get_unaligned_le16(sent);
1da177e4 459
f383f275
MH		 460 if (hdev->voice_setting == setting)
461 return;
462
463 hdev->voice_setting = setting;
1da177e4 464
9f1db00c 465 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 466
3c54711c 467 if (hdev->notify)
f383f275 468 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 469}
470
b4cb9fb2
MH		 471static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
472 struct sk_buff *skb)
473{
474 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
475
476 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
477
478 if (rp->status)
479 return;
480
481 hdev->num_iac = rp->num_iac;
482
483 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
484}
485
333140b5
MH		 486static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
487{
488 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 489 struct hci_cp_write_ssp_mode *sent;
333140b5 490
9f1db00c 491 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 492
333140b5
MH		 493 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
494 if (!sent)
495 return;
496
5c1a4c8f
JK		 497 hci_dev_lock(hdev);
498
5ed8eb2f
JH		 499 if (!status) {
500 if (sent->mode)
cad718ed 501 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 502 else
cad718ed 503 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 504 }
505
d7a5a11d 506 if (hci_dev_test_flag(hdev, HCI_MGMT))
5ed8eb2f 507 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 508 else if (!status) {
5ed8eb2f 509 if (sent->mode)
a1536da2 510 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 511 else
a358dc11 512 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 513 }
5c1a4c8f
JK		 514
515 hci_dev_unlock(hdev);
333140b5
MH		 516}
517
eac83dc6
MH		 518static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
519{
520 u8 status = *((u8 *) skb->data);
521 struct hci_cp_write_sc_support *sent;
522
523 BT_DBG("%s status 0x%2.2x", hdev->name, status);
524
525 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
526 if (!sent)
527 return;
528
5c1a4c8f
JK		 529 hci_dev_lock(hdev);
530
eac83dc6
MH		 531 if (!status) {
532 if (sent->support)
533 hdev->features[1][0] |= LMP_HOST_SC;
534 else
535 hdev->features[1][0] &= ~LMP_HOST_SC;
536 }
537
d7a5a11d 538 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
eac83dc6 539 if (sent->support)
a1536da2 540 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
eac83dc6 541 else
a358dc11 542 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
eac83dc6 543 }
5c1a4c8f
JK		 544
545 hci_dev_unlock(hdev);
eac83dc6
MH		 546}
547
a9de9248
MH		 548static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
549{
550 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 551
9f1db00c 552 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 553
a9de9248 554 if (rp->status)
42c6b129 555 return;
1143e5a6 556
d7a5a11d
MH		 557 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
558 hci_dev_test_flag(hdev, HCI_CONFIG)) {
0d5551f5
MH		 559 hdev->hci_ver = rp->hci_ver;
560 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
561 hdev->lmp_ver = rp->lmp_ver;
562 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
563 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
564 }
d5859e22
JH		 565}
566
8fc9ced3
GP		 567static void hci_cc_read_local_commands(struct hci_dev *hdev,
568 struct sk_buff *skb)
a9de9248
MH		 569{
570 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 571
9f1db00c 572 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 573
6a070e6e
MH		 574 if (rp->status)
575 return;
576
d7a5a11d
MH		 577 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
578 hci_dev_test_flag(hdev, HCI_CONFIG))
2177bab5 579 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 580}
1da177e4 581
8fc9ced3
GP		 582static void hci_cc_read_local_features(struct hci_dev *hdev,
583 struct sk_buff *skb)
a9de9248
MH		 584{
585 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 586
9f1db00c 587 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 588
a9de9248
MH		 589 if (rp->status)
590 return;
5b7f9909 591
a9de9248 592 memcpy(hdev->features, rp->features, 8);
5b7f9909 593
a9de9248
MH		 594 /* Adjust default settings according to features
595 * supported by device. */
1da177e4 596
cad718ed 597 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 598 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 599
cad718ed 600 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 601 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 602
cad718ed 603 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 604 hdev->pkt_type |= (HCI_HV2);
605 hdev->esco_type |= (ESCO_HV2);
606 }
1da177e4 607
cad718ed 608 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 609 hdev->pkt_type |= (HCI_HV3);
610 hdev->esco_type |= (ESCO_HV3);
611 }
1da177e4 612
45db810f 613 if (lmp_esco_capable(hdev))
a9de9248 614 hdev->esco_type |= (ESCO_EV3);
da1f5198 615
cad718ed 616 if (hdev->features[0][4] & LMP_EV4)
a9de9248 617 hdev->esco_type |= (ESCO_EV4);
da1f5198 618
cad718ed 619 if (hdev->features[0][4] & LMP_EV5)
a9de9248 620 hdev->esco_type |= (ESCO_EV5);
1da177e4 621
cad718ed 622 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 623 hdev->esco_type |= (ESCO_2EV3);
624
cad718ed 625 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 626 hdev->esco_type |= (ESCO_3EV3);
627
cad718ed 628 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 629 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 630}
1da177e4 631
971e3a4b 632static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 633 struct sk_buff *skb)
971e3a4b
AG		 634{
635 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
636
9f1db00c 637 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 638
639 if (rp->status)
42c6b129 640 return;
971e3a4b 641
57af75a8
MH		 642 if (hdev->max_page < rp->max_page)
643 hdev->max_page = rp->max_page;
d2c5d77f 644
cad718ed
JH		 645 if (rp->page < HCI_MAX_PAGES)
646 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 647}
648
1e89cffb 649static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 650 struct sk_buff *skb)
1e89cffb
AE		 651{
652 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
653
9f1db00c 654 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 655
45296acd
MH		 656 if (rp->status)
657 return;
658
659 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 660}
661
a9de9248
MH		 662static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
663{
664 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 665
9f1db00c 666 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 667
a9de9248
MH		 668 if (rp->status)
669 return;
1da177e4 670
a9de9248
MH		 671 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
672 hdev->sco_mtu = rp->sco_mtu;
673 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
674 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
675
676 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
677 hdev->sco_mtu = 64;
678 hdev->sco_pkts = 8;
1da177e4 679 }
a9de9248
MH		 680
681 hdev->acl_cnt = hdev->acl_pkts;
682 hdev->sco_cnt = hdev->sco_pkts;
683
807deac2
GP		 684 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
685 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 686}
687
688static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
689{
690 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
691
9f1db00c 692 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 693
e30d3f5f
MH		 694 if (rp->status)
695 return;
696
697 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 698 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f 699
d7a5a11d 700 if (hci_dev_test_flag(hdev, HCI_SETUP))
e30d3f5f 701 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 702}
703
f332ec66
JH		 704static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
705 struct sk_buff *skb)
706{
707 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
708
709 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
710
45296acd
MH		 711 if (rp->status)
712 return;
713
714 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 715 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
716 hdev->page_scan_window = __le16_to_cpu(rp->window);
717 }
718}
719
4a3ee763
JH		 720static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
721 struct sk_buff *skb)
722{
723 u8 status = *((u8 *) skb->data);
724 struct hci_cp_write_page_scan_activity *sent;
725
726 BT_DBG("%s status 0x%2.2x", hdev->name, status);
727
728 if (status)
729 return;
730
731 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
732 if (!sent)
733 return;
734
735 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
736 hdev->page_scan_window = __le16_to_cpu(sent->window);
737}
738
f332ec66
JH		 739static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
740 struct sk_buff *skb)
741{
742 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
743
744 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
745
45296acd
MH		 746 if (rp->status)
747 return;
748
749 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 750 hdev->page_scan_type = rp->type;
751}
752
4a3ee763
JH		 753static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
754 struct sk_buff *skb)
755{
756 u8 status = *((u8 *) skb->data);
757 u8 *type;
758
759 BT_DBG("%s status 0x%2.2x", hdev->name, status);
760
761 if (status)
762 return;
763
764 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
765 if (type)
766 hdev->page_scan_type = *type;
767}
768
350ee4cf 769static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 770 struct sk_buff *skb)
350ee4cf
AE		 771{
772 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
773
9f1db00c 774 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 775
776 if (rp->status)
777 return;
778
779 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
780 hdev->block_len = __le16_to_cpu(rp->block_len);
781 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
782
783 hdev->block_cnt = hdev->num_blocks;
784
785 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 786 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 787}
788
33f35721
JH		 789static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
790{
791 struct hci_rp_read_clock *rp = (void *) skb->data;
792 struct hci_cp_read_clock *cp;
793 struct hci_conn *conn;
794
795 BT_DBG("%s", hdev->name);
796
797 if (skb->len < sizeof(*rp))
798 return;
799
800 if (rp->status)
801 return;
802
803 hci_dev_lock(hdev);
804
805 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
806 if (!cp)
807 goto unlock;
808
809 if (cp->which == 0x00) {
810 hdev->clock = le32_to_cpu(rp->clock);
811 goto unlock;
812 }
813
814 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
815 if (conn) {
816 conn->clock = le32_to_cpu(rp->clock);
817 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
818 }
819
820unlock:
821 hci_dev_unlock(hdev);
822}
823
928abaa7 824static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 825 struct sk_buff *skb)
928abaa7
AE		 826{
827 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
828
9f1db00c 829 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 830
831 if (rp->status)
83927882 832 return;
928abaa7
AE		 833
834 hdev->amp_status = rp->amp_status;
835 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
836 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
837 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
838 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
839 hdev->amp_type = rp->amp_type;
840 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
841 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
842 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
843 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
928abaa7
AE		 844}
845
d5859e22 846static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 847 struct sk_buff *skb)
d5859e22 848{
91c4e9b1 849 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 850
9f1db00c 851 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 852
45296acd
MH		 853 if (rp->status)
854 return;
855
856 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 857}
858
980e1a53
JH		 859static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
860{
861 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
862 struct hci_cp_pin_code_reply *cp;
863 struct hci_conn *conn;
864
9f1db00c 865 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 866
56e5cb86
JH		 867 hci_dev_lock(hdev);
868
d7a5a11d 869 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 870 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 871
fa1bd918 872 if (rp->status)
56e5cb86 873 goto unlock;
980e1a53
JH		 874
875 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
876 if (!cp)
56e5cb86 877 goto unlock;
980e1a53
JH		 878
879 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
880 if (conn)
881 conn->pin_length = cp->pin_len;
56e5cb86
JH		 882
883unlock:
884 hci_dev_unlock(hdev);
980e1a53
JH		 885}
886
887static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
888{
889 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
890
9f1db00c 891 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 892
56e5cb86
JH		 893 hci_dev_lock(hdev);
894
d7a5a11d 895 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 896 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 897 rp->status);
56e5cb86
JH		 898
899 hci_dev_unlock(hdev);
980e1a53 900}
56e5cb86 901
6ed58ec5
VT		 902static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
903 struct sk_buff *skb)
904{
905 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
906
9f1db00c 907 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 908
909 if (rp->status)
910 return;
911
912 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
913 hdev->le_pkts = rp->le_max_pkt;
914
915 hdev->le_cnt = hdev->le_pkts;
916
917 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 918}
980e1a53 919
60e77321
JH		 920static void hci_cc_le_read_local_features(struct hci_dev *hdev,
921 struct sk_buff *skb)
922{
923 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
924
925 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
926
45296acd
MH		 927 if (rp->status)
928 return;
929
930 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 931}
932
8fa19098
JH		 933static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
934 struct sk_buff *skb)
935{
936 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
937
938 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
939
45296acd
MH		 940 if (rp->status)
941 return;
942
943 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 944}
945
a5c29683
JH		 946static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
947{
948 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
949
9f1db00c 950 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 951
56e5cb86
JH		 952 hci_dev_lock(hdev);
953
d7a5a11d 954 if (hci_dev_test_flag(hdev, HCI_MGMT))
04124681
GP		 955 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
956 rp->status);
56e5cb86
JH		 957
958 hci_dev_unlock(hdev);
a5c29683
JH		 959}
960
961static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 962 struct sk_buff *skb)
a5c29683
JH		 963{
964 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
965
9f1db00c 966 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 967
56e5cb86
JH		 968 hci_dev_lock(hdev);
969
d7a5a11d 970 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 971 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 972 ACL_LINK, 0, rp->status);
56e5cb86
JH		 973
974 hci_dev_unlock(hdev);
a5c29683
JH		 975}
976
1143d458
BG		 977static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
978{
979 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
980
9f1db00c 981 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 982
983 hci_dev_lock(hdev);
984
d7a5a11d 985 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 986 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 987 0, rp->status);
1143d458
BG		 988
989 hci_dev_unlock(hdev);
990}
991
992static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 993 struct sk_buff *skb)
1143d458
BG		 994{
995 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
996
9f1db00c 997 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 998
999 hci_dev_lock(hdev);
1000
d7a5a11d 1001 if (hci_dev_test_flag(hdev, HCI_MGMT))
1143d458 1002 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1003 ACL_LINK, 0, rp->status);
1143d458
BG		 1004
1005 hci_dev_unlock(hdev);
1006}
1007
4d2d2796
MH		 1008static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1009 struct sk_buff *skb)
c35938b2
SJ		 1010{
1011 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
9f1db00c 1013 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
4d2d2796
MH		 1014}
1015
1016static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1017 struct sk_buff *skb)
1018{
1019 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1020
1021 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2
SJ		 1022}
1023
7a4cd51d
MH		 1024static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1025{
1026 __u8 status = *((__u8 *) skb->data);
1027 bdaddr_t *sent;
1028
1029 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1030
45296acd
MH		 1031 if (status)
1032 return;
1033
7a4cd51d
MH		 1034 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1035 if (!sent)
1036 return;
1037
1038 hci_dev_lock(hdev);
1039
45296acd 1040 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1041
1042 hci_dev_unlock(hdev);
1043}
1044
0314f286
JK		 1045static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1046{
1047 __u8 status = *((__u8 *) skb->data);
1048 struct hci_cp_le_set_default_phy *cp;
1049
1050 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1051
1052 if (status)
1053 return;
1054
1055 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1056 if (!cp)
1057 return;
1058
1059 hci_dev_lock(hdev);
1060
1061 hdev->le_tx_def_phys = cp->tx_phys;
1062 hdev->le_rx_def_phys = cp->rx_phys;
1063
1064 hci_dev_unlock(hdev);
1065}
1066
a73c046a
JK		 1067static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1068 struct sk_buff *skb)
1069{
1070 __u8 status = *((__u8 *) skb->data);
1071 struct hci_cp_le_set_adv_set_rand_addr *cp;
1072 struct adv_info *adv_instance;
1073
1074 if (status)
1075 return;
1076
1077 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1078 if (!cp)
1079 return;
1080
1081 hci_dev_lock(hdev);
1082
1083 if (!hdev->cur_adv_instance) {
1084 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1085 bacpy(&hdev->random_addr, &cp->bdaddr);
1086 } else {
1087 adv_instance = hci_find_adv_instance(hdev,
1088 hdev->cur_adv_instance);
1089 if (adv_instance)
1090 bacpy(&adv_instance->random_addr, &cp->bdaddr);
1091 }
1092
1093 hci_dev_unlock(hdev);
1094}
1095
c1d5dc4a
JH		 1096static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1097{
1098 __u8 *sent, status = *((__u8 *) skb->data);
1099
1100 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1101
45296acd 1102 if (status)
c1d5dc4a
JH		 1103 return;
1104
45296acd
MH		 1105 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1106 if (!sent)
3c857757
JH		 1107 return;
1108
c1d5dc4a
JH		 1109 hci_dev_lock(hdev);
1110
49c922bb 1111 /* If we're doing connection initiation as peripheral. Set a
3c857757
JH		 1112 * timeout in case something goes wrong.
1113 */
1114 if (*sent) {
1115 struct hci_conn *conn;
1116
a1536da2 1117 hci_dev_set_flag(hdev, HCI_LE_ADV);
66c417c1 1118
e7d9ab73 1119 conn = hci_lookup_le_connect(hdev);
3c857757
JH		 1120 if (conn)
1121 queue_delayed_work(hdev->workqueue,
1122 &conn->le_conn_timeout,
09ae260b 1123 conn->conn_timeout);
66c417c1 1124 } else {
a358dc11 1125 hci_dev_clear_flag(hdev, HCI_LE_ADV);
3c857757
JH		 1126 }
1127
04b4edcb 1128 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1129}
1130
de181e88
JK		 1131static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1132 struct sk_buff *skb)
1133{
1134 struct hci_cp_le_set_ext_adv_enable *cp;
de181e88
JK		 1135 __u8 status = *((__u8 *) skb->data);
1136
1137 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1138
1139 if (status)
1140 return;
1141
1142 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1143 if (!cp)
1144 return;
1145
de181e88
JK		 1146 hci_dev_lock(hdev);
1147
1148 if (cp->enable) {
1149 struct hci_conn *conn;
1150
1151 hci_dev_set_flag(hdev, HCI_LE_ADV);
1152
1153 conn = hci_lookup_le_connect(hdev);
1154 if (conn)
1155 queue_delayed_work(hdev->workqueue,
1156 &conn->le_conn_timeout,
1157 conn->conn_timeout);
45b7749f
JK		 1158 } else {
1159 hci_dev_clear_flag(hdev, HCI_LE_ADV);
de181e88
JK		 1160 }
1161
1162 hci_dev_unlock(hdev);
1163}
1164
533553f8
MH		 1165static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1166{
1167 struct hci_cp_le_set_scan_param *cp;
1168 __u8 status = *((__u8 *) skb->data);
1169
1170 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1171
45296acd
MH		 1172 if (status)
1173 return;
1174
533553f8
MH		 1175 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1176 if (!cp)
1177 return;
1178
1179 hci_dev_lock(hdev);
1180
45296acd 1181 hdev->le_scan_type = cp->type;
533553f8
MH		 1182
1183 hci_dev_unlock(hdev);
1184}
1185
a2344b9e
JK		 1186static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1187 struct sk_buff *skb)
1188{
1189 struct hci_cp_le_set_ext_scan_params *cp;
1190 __u8 status = *((__u8 *) skb->data);
1191 struct hci_cp_le_scan_phy_params *phy_param;
1192
1193 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1194
1195 if (status)
1196 return;
1197
1198 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1199 if (!cp)
1200 return;
1201
1202 phy_param = (void *)cp->data;
1203
1204 hci_dev_lock(hdev);
1205
1206 hdev->le_scan_type = phy_param->type;
1207
1208 hci_dev_unlock(hdev);
1209}
1210
b9a6328f
JH		 1211static bool has_pending_adv_report(struct hci_dev *hdev)
1212{
1213 struct discovery_state *d = &hdev->discovery;
1214
1215 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1216}
1217
1218static void clear_pending_adv_report(struct hci_dev *hdev)
1219{
1220 struct discovery_state *d = &hdev->discovery;
1221
1222 bacpy(&d->last_adv_addr, BDADDR_ANY);
1223 d->last_adv_data_len = 0;
1224}
1225
1226static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1227 u8 bdaddr_type, s8 rssi, u32 flags,
1228 u8 *data, u8 len)
b9a6328f
JH		 1229{
1230 struct discovery_state *d = &hdev->discovery;
1231
1232 bacpy(&d->last_adv_addr, bdaddr);
1233 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1234 d->last_adv_rssi = rssi;
c70a7e4c 1235 d->last_adv_flags = flags;
b9a6328f
JH		 1236 memcpy(d->last_adv_data, data, len);
1237 d->last_adv_data_len = len;
1238}
1239
3baef810 1240static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
eb9d91f5 1241{
5c1a4c8f
JK		 1242 hci_dev_lock(hdev);
1243
3baef810 1244 switch (enable) {
76a388be 1245 case LE_SCAN_ENABLE:
a1536da2 1246 hci_dev_set_flag(hdev, HCI_LE_SCAN);
b9a6328f
JH		 1247 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1248 clear_pending_adv_report(hdev);
68a8aea4
AE		 1249 break;
1250
76a388be 1251 case LE_SCAN_DISABLE:
b9a6328f
JH		 1252 /* We do this here instead of when setting DISCOVERY_STOPPED
1253 * since the latter would potentially require waiting for
1254 * inquiry to stop too.
1255 */
1256 if (has_pending_adv_report(hdev)) {
1257 struct discovery_state *d = &hdev->discovery;
1258
1259 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1260 d->last_adv_addr_type, NULL,
c70a7e4c 1261 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1262 d->last_adv_data,
b9a6328f
JH		 1263 d->last_adv_data_len, NULL, 0);
1264 }
1265
317ac8cb
JH		 1266 /* Cancel this timer so that we don't try to disable scanning
1267 * when it's already disabled.
1268 */
1269 cancel_delayed_work(&hdev->le_scan_disable);
1270
a358dc11 1271 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
e8bb6b97 1272
81ad6fd9
JH		 1273 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1274 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1275 * therefore discovery as stopped. If this was not
1276 * because of a connect request advertising might have
1277 * been disabled because of active scanning, so
1278 * re-enable it again if necessary.
81ad6fd9 1279 */
a69d8927 1280 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
81ad6fd9 1281 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
d7a5a11d 1282 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
34722277 1283 hdev->discovery.state == DISCOVERY_FINDING)
f2252570 1284 hci_req_reenable_advertising(hdev);
e8bb6b97 1285
68a8aea4
AE		 1286 break;
1287
1288 default:
2064ee33 1289 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
3baef810 1290 enable);
68a8aea4 1291 break;
35815085 1292 }
5c1a4c8f
JK		 1293
1294 hci_dev_unlock(hdev);
eb9d91f5
AG		 1295}
1296
3baef810
JK		 1297static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1298 struct sk_buff *skb)
1299{
1300 struct hci_cp_le_set_scan_enable *cp;
1301 __u8 status = *((__u8 *) skb->data);
1302
1303 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1304
1305 if (status)
1306 return;
1307
1308 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1309 if (!cp)
1310 return;
1311
1312 le_set_scan_enable_complete(hdev, cp->enable);
1313}
1314
a2344b9e
JK		 1315static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1316 struct sk_buff *skb)
1317{
1318 struct hci_cp_le_set_ext_scan_enable *cp;
1319 __u8 status = *((__u8 *) skb->data);
1320
1321 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1322
1323 if (status)
1324 return;
1325
1326 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1327 if (!cp)
1328 return;
1329
1330 le_set_scan_enable_complete(hdev, cp->enable);
1331}
1332
6b49bcb4
JK		 1333static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1334 struct sk_buff *skb)
1335{
1336 struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1337
1338 BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1339 rp->num_of_sets);
1340
1341 if (rp->status)
1342 return;
1343
1344 hdev->le_num_of_adv_sets = rp->num_of_sets;
1345}
1346
cf1d081f
JH		 1347static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1348 struct sk_buff *skb)
1349{
1350 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1351
1352 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1353
45296acd
MH		 1354 if (rp->status)
1355 return;
1356
1357 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1358}
1359
0f36b589
MH		 1360static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1361 struct sk_buff *skb)
1362{
1363 __u8 status = *((__u8 *) skb->data);
1364
1365 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1366
45296acd
MH		 1367 if (status)
1368 return;
1369
dcc36c16 1370 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1371}
1372
1373static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1374 struct sk_buff *skb)
1375{
1376 struct hci_cp_le_add_to_white_list *sent;
1377 __u8 status = *((__u8 *) skb->data);
1378
1379 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1380
45296acd
MH		 1381 if (status)
1382 return;
1383
0f36b589
MH		 1384 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1385 if (!sent)
1386 return;
1387
dcc36c16
JH		 1388 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1389 sent->bdaddr_type);
0f36b589
MH		 1390}
1391
1392static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1393 struct sk_buff *skb)
1394{
1395 struct hci_cp_le_del_from_white_list *sent;
1396 __u8 status = *((__u8 *) skb->data);
1397
1398 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
45296acd
MH		 1400 if (status)
1401 return;
1402
0f36b589
MH		 1403 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1404 if (!sent)
1405 return;
1406
dcc36c16
JH		 1407 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1408 sent->bdaddr_type);
0f36b589
MH		 1409}
1410
9b008c04
JH		 1411static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1412 struct sk_buff *skb)
1413{
1414 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1415
1416 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1417
45296acd
MH		 1418 if (rp->status)
1419 return;
1420
1421 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1422}
1423
a8e1bfaa
MH		 1424static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1425 struct sk_buff *skb)
1426{
1427 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1428
1429 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1430
1431 if (rp->status)
1432 return;
1433
1434 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1435 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1436}
1437
1438static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1439 struct sk_buff *skb)
1440{
1441 struct hci_cp_le_write_def_data_len *sent;
1442 __u8 status = *((__u8 *) skb->data);
1443
1444 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1445
1446 if (status)
1447 return;
1448
1449 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1450 if (!sent)
1451 return;
1452
1453 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1454 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1455}
1456
b950aa88
AN		 1457static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1458 struct sk_buff *skb)
1459{
1460 struct hci_cp_le_add_to_resolv_list *sent;
1461 __u8 status = *((__u8 *) skb->data);
1462
1463 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1464
1465 if (status)
1466 return;
1467
1468 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1469 if (!sent)
1470 return;
1471
1472 hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1473 sent->bdaddr_type, sent->peer_irk,
1474 sent->local_irk);
1475}
1476
1477static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1478 struct sk_buff *skb)
1479{
1480 struct hci_cp_le_del_from_resolv_list *sent;
1481 __u8 status = *((__u8 *) skb->data);
1482
1483 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1484
1485 if (status)
1486 return;
1487
1488 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1489 if (!sent)
1490 return;
1491
1492 hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1493 sent->bdaddr_type);
1494}
1495
545f2596
AN		 1496static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1497 struct sk_buff *skb)
1498{
1499 __u8 status = *((__u8 *) skb->data);
1500
1501 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1502
1503 if (status)
1504 return;
1505
1506 hci_bdaddr_list_clear(&hdev->le_resolv_list);
1507}
1508
cfdb0c2d
AN		 1509static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1510 struct sk_buff *skb)
1511{
1512 struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1513
1514 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1515
1516 if (rp->status)
1517 return;
1518
1519 hdev->le_resolv_list_size = rp->size;
1520}
1521
aa12af77
AN		 1522static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1523 struct sk_buff *skb)
1524{
1525 __u8 *sent, status = *((__u8 *) skb->data);
1526
1527 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1528
1529 if (status)
1530 return;
1531
1532 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1533 if (!sent)
1534 return;
1535
1536 hci_dev_lock(hdev);
1537
1538 if (*sent)
1539 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1540 else
1541 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1542
1543 hci_dev_unlock(hdev);
1544}
1545
a8e1bfaa
MH		 1546static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1547 struct sk_buff *skb)
1548{
1549 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1550
1551 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1552
1553 if (rp->status)
1554 return;
1555
1556 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1557 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1558 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1559 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1560}
1561
6039aa73
GP		 1562static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1563 struct sk_buff *skb)
f9b49306 1564{
06199cf8 1565 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1566 __u8 status = *((__u8 *) skb->data);
1567
9f1db00c 1568 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1569
45296acd
MH		 1570 if (status)
1571 return;
1572
06199cf8 1573 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1574 if (!sent)
f9b49306
AG		 1575 return;
1576
5c1a4c8f
JK		 1577 hci_dev_lock(hdev);
1578
45296acd
MH		 1579 if (sent->le) {
1580 hdev->features[1][0] |= LMP_HOST_LE;
a1536da2 1581 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
45296acd
MH		 1582 } else {
1583 hdev->features[1][0] &= ~LMP_HOST_LE;
a358dc11
MH		 1584 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1585 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
8f984dfa 1586 }
45296acd
MH		 1587
1588 if (sent->simul)
1589 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1590 else
1591 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
5c1a4c8f
JK		 1592
1593 hci_dev_unlock(hdev);
f9b49306
AG		 1594}
1595
56ed2cb8
JH		 1596static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1597{
1598 struct hci_cp_le_set_adv_param *cp;
1599 u8 status = *((u8 *) skb->data);
1600
1601 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1602
1603 if (status)
1604 return;
1605
1606 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1607 if (!cp)
1608 return;
1609
1610 hci_dev_lock(hdev);
1611 hdev->adv_addr_type = cp->own_address_type;
1612 hci_dev_unlock(hdev);
1613}
1614
de181e88
JK		 1615static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1616{
1617 struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1618 struct hci_cp_le_set_ext_adv_params *cp;
1619 struct adv_info *adv_instance;
1620
1621 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1622
1623 if (rp->status)
1624 return;
1625
1626 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1627 if (!cp)
1628 return;
1629
1630 hci_dev_lock(hdev);
1631 hdev->adv_addr_type = cp->own_addr_type;
1632 if (!hdev->cur_adv_instance) {
1633 /* Store in hdev for instance 0 */
1634 hdev->adv_tx_power = rp->tx_power;
1635 } else {
1636 adv_instance = hci_find_adv_instance(hdev,
1637 hdev->cur_adv_instance);
1638 if (adv_instance)
1639 adv_instance->tx_power = rp->tx_power;
1640 }
a0fb3726
JK		 1641 /* Update adv data as tx power is known now */
1642 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
de181e88
JK		 1643 hci_dev_unlock(hdev);
1644}
1645
5ae76a94
AK		 1646static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1647{
1648 struct hci_rp_read_rssi *rp = (void *) skb->data;
1649 struct hci_conn *conn;
1650
1651 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1652
1653 if (rp->status)
1654 return;
1655
1656 hci_dev_lock(hdev);
1657
1658 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1659 if (conn)
1660 conn->rssi = rp->rssi;
1661
1662 hci_dev_unlock(hdev);
1663}
1664
5a134fae
AK		 1665static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1666{
1667 struct hci_cp_read_tx_power *sent;
1668 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1669 struct hci_conn *conn;
1670
1671 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1672
1673 if (rp->status)
1674 return;
1675
1676 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1677 if (!sent)
1678 return;
1679
1680 hci_dev_lock(hdev);
1681
1682 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1683 if (!conn)
1684 goto unlock;
1685
1686 switch (sent->type) {
1687 case 0x00:
5a134fae 1688 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1689 break;
1690 case 0x01:
1691 conn->max_tx_power = rp->tx_power;
1692 break;
1693 }
5a134fae 1694
d0455ed9 1695unlock:
5a134fae
AK		 1696 hci_dev_unlock(hdev);
1697}
1698
c50b33c8
MH		 1699static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1700{
1701 u8 status = *((u8 *) skb->data);
1702 u8 *mode;
1703
1704 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1705
1706 if (status)
1707 return;
1708
1709 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1710 if (mode)
1711 hdev->ssp_debug_mode = *mode;
1712}
1713
6039aa73 1714static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1715{
9f1db00c 1716 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1717
1718 if (status) {
a9de9248 1719 hci_conn_check_pending(hdev);
314b2381
JH		 1720 return;
1721 }
1722
89352e7d 1723 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1724}
1725
6039aa73 1726static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1727{
a9de9248 1728 struct hci_cp_create_conn *cp;
1da177e4 1729 struct hci_conn *conn;
1da177e4 1730
9f1db00c 1731 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1732
1733 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1734 if (!cp)
1735 return;
1736
1737 hci_dev_lock(hdev);
1738
1739 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1740
6ed93dc6 1741 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1742
1743 if (status) {
1744 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1745 if (status != 0x0c || conn->attempt > 2) {
1746 conn->state = BT_CLOSED;
539c496d 1747 hci_connect_cfm(conn, status);
4c67bc74
MH		 1748 hci_conn_del(conn);
1749 } else
1750 conn->state = BT_CONNECT2;
1da177e4
LT		 1751 }
1752 } else {
1753 if (!conn) {
a5c4e309
JH		 1754 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1755 HCI_ROLE_MASTER);
1756 if (!conn)
2064ee33 1757 bt_dev_err(hdev, "no memory for new connection");
1da177e4
LT		 1758 }
1759 }
1760
1761 hci_dev_unlock(hdev);
1762}
1763
a9de9248 1764static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1765{
a9de9248
MH		 1766 struct hci_cp_add_sco *cp;
1767 struct hci_conn *acl, *sco;
1768 __u16 handle;
1da177e4 1769
9f1db00c 1770 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1771
a9de9248
MH		 1772 if (!status)
1773 return;
1da177e4 1774
a9de9248
MH		 1775 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1776 if (!cp)
1777 return;
1da177e4 1778
a9de9248 1779 handle = __le16_to_cpu(cp->handle);
1da177e4 1780
9f1db00c 1781 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1782
a9de9248 1783 hci_dev_lock(hdev);
1da177e4 1784
a9de9248 1785 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1786 if (acl) {
1787 sco = acl->link;
1788 if (sco) {
1789 sco->state = BT_CLOSED;
1da177e4 1790
539c496d 1791 hci_connect_cfm(sco, status);
5a08ecce
AE		 1792 hci_conn_del(sco);
1793 }
a9de9248 1794 }
1da177e4 1795
a9de9248
MH		 1796 hci_dev_unlock(hdev);
1797}
1da177e4 1798
f8558555
MH		 1799static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1800{
1801 struct hci_cp_auth_requested *cp;
1802 struct hci_conn *conn;
1803
9f1db00c 1804 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1805
1806 if (!status)
1807 return;
1808
1809 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1810 if (!cp)
1811 return;
1812
1813 hci_dev_lock(hdev);
1814
1815 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1816 if (conn) {
1817 if (conn->state == BT_CONFIG) {
539c496d 1818 hci_connect_cfm(conn, status);
76a68ba0 1819 hci_conn_drop(conn);
f8558555
MH		 1820 }
1821 }
1822
1823 hci_dev_unlock(hdev);
1824}
1825
1826static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1827{
1828 struct hci_cp_set_conn_encrypt *cp;
1829 struct hci_conn *conn;
1830
9f1db00c 1831 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1832
1833 if (!status)
1834 return;
1835
1836 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1837 if (!cp)
1838 return;
1839
1840 hci_dev_lock(hdev);
1841
1842 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1843 if (conn) {
1844 if (conn->state == BT_CONFIG) {
539c496d 1845 hci_connect_cfm(conn, status);
76a68ba0 1846 hci_conn_drop(conn);
f8558555
MH		 1847 }
1848 }
1849
1850 hci_dev_unlock(hdev);
1851}
1852
127178d2 1853static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1854 struct hci_conn *conn)
392599b9 1855{
392599b9
JH		 1856 if (conn->state != BT_CONFIG || !conn->out)
1857 return 0;
1858
765c2a96 1859 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1860 return 0;
1861
1862 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1863 * devices with sec_level MEDIUM or HIGH or if MITM protection
1864 * is requested.
1865 */
807deac2 1866 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1867 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1868 conn->pending_sec_level != BT_SECURITY_HIGH &&
1869 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1870 return 0;
1871
392599b9
JH		 1872 return 1;
1873}
1874
6039aa73 1875static int hci_resolve_name(struct hci_dev *hdev,
04124681 1876 struct inquiry_entry *e)
30dc78e1
JH		 1877{
1878 struct hci_cp_remote_name_req cp;
1879
1880 memset(&cp, 0, sizeof(cp));
1881
1882 bacpy(&cp.bdaddr, &e->data.bdaddr);
1883 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1884 cp.pscan_mode = e->data.pscan_mode;
1885 cp.clock_offset = e->data.clock_offset;
1886
1887 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1888}
1889
b644ba33 1890static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1891{
1892 struct discovery_state *discov = &hdev->discovery;
1893 struct inquiry_entry *e;
1894
b644ba33
JH		 1895 if (list_empty(&discov->resolve))
1896 return false;
1897
1898 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1899 if (!e)
1900 return false;
1901
b644ba33
JH		 1902 if (hci_resolve_name(hdev, e) == 0) {
1903 e->name_state = NAME_PENDING;
1904 return true;
1905 }
1906
1907 return false;
1908}
1909
1910static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1911 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1912{
1913 struct discovery_state *discov = &hdev->discovery;
1914 struct inquiry_entry *e;
1915
60cb49d2
JH		 1916 /* Update the mgmt connected state if necessary. Be careful with
1917 * conn objects that exist but are not (yet) connected however.
1918 * Only those in BT_CONFIG or BT_CONNECTED states can be
1919 * considered connected.
1920 */
1921 if (conn &&
1922 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
cb77c3ec 1923 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1924 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1925
1926 if (discov->state == DISCOVERY_STOPPED)
1927 return;
1928
30dc78e1
JH		 1929 if (discov->state == DISCOVERY_STOPPING)
1930 goto discov_complete;
1931
1932 if (discov->state != DISCOVERY_RESOLVING)
1933 return;
1934
1935 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1936 /* If the device was not found in a list of found devices names of which
1937 * are pending. there is no need to continue resolving a next name as it
1938 * will be done upon receiving another Remote Name Request Complete
1939 * Event */
1940 if (!e)
1941 return;
1942
1943 list_del(&e->list);
1944 if (name) {
30dc78e1 1945 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1946 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1947 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1948 } else {
1949 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1950 }
1951
b644ba33 1952 if (hci_resolve_next_name(hdev))
30dc78e1 1953 return;
30dc78e1
JH		 1954
1955discov_complete:
1956 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1957}
1958
a9de9248
MH		 1959static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1960{
127178d2
JH		 1961 struct hci_cp_remote_name_req *cp;
1962 struct hci_conn *conn;
1963
9f1db00c 1964 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 1965
1966 /* If successful wait for the name req complete event before
1967 * checking for the need to do authentication */
1968 if (!status)
1969 return;
1970
1971 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1972 if (!cp)
1973 return;
1974
1975 hci_dev_lock(hdev);
1976
b644ba33
JH		 1977 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1978
d7a5a11d 1979 if (hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 1980 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 1981
79c6c70c
JH		 1982 if (!conn)
1983 goto unlock;
1984
1985 if (!hci_outgoing_auth_needed(hdev, conn))
1986 goto unlock;
1987
51a8efd7 1988 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 1989 struct hci_cp_auth_requested auth_cp;
1990
977f8fce
JH		 1991 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1992
c1f23a2b
JB		 1993 auth_cp.handle = __cpu_to_le16(conn->handle);
1994 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1995 sizeof(auth_cp), &auth_cp);
127178d2
JH		 1996 }
1997
79c6c70c 1998unlock:
127178d2 1999 hci_dev_unlock(hdev);
a9de9248 2000}
1da177e4 2001
769be974
MH		 2002static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2003{
2004 struct hci_cp_read_remote_features *cp;
2005 struct hci_conn *conn;
2006
9f1db00c 2007 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 2008
2009 if (!status)
2010 return;
2011
2012 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2013 if (!cp)
2014 return;
2015
2016 hci_dev_lock(hdev);
2017
2018 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2019 if (conn) {
2020 if (conn->state == BT_CONFIG) {
539c496d 2021 hci_connect_cfm(conn, status);
76a68ba0 2022 hci_conn_drop(conn);
769be974
MH		 2023 }
2024 }
2025
2026 hci_dev_unlock(hdev);
2027}
2028
2029static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2030{
2031 struct hci_cp_read_remote_ext_features *cp;
2032 struct hci_conn *conn;
2033
9f1db00c 2034 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 2035
2036 if (!status)
2037 return;
2038
2039 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2040 if (!cp)
2041 return;
2042
2043 hci_dev_lock(hdev);
2044
2045 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2046 if (conn) {
2047 if (conn->state == BT_CONFIG) {
539c496d 2048 hci_connect_cfm(conn, status);
76a68ba0 2049 hci_conn_drop(conn);
769be974
MH		 2050 }
2051 }
2052
2053 hci_dev_unlock(hdev);
2054}
2055
a9de9248
MH		 2056static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2057{
b6a0dc82
MH		 2058 struct hci_cp_setup_sync_conn *cp;
2059 struct hci_conn *acl, *sco;
2060 __u16 handle;
2061
9f1db00c 2062 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 2063
2064 if (!status)
2065 return;
2066
2067 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2068 if (!cp)
2069 return;
2070
2071 handle = __le16_to_cpu(cp->handle);
2072
9f1db00c 2073 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 2074
2075 hci_dev_lock(hdev);
2076
2077 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 2078 if (acl) {
2079 sco = acl->link;
2080 if (sco) {
2081 sco->state = BT_CLOSED;
b6a0dc82 2082
539c496d 2083 hci_connect_cfm(sco, status);
5a08ecce
AE		 2084 hci_conn_del(sco);
2085 }
b6a0dc82
MH		 2086 }
2087
2088 hci_dev_unlock(hdev);
1da177e4
LT		 2089}
2090
a9de9248 2091static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 2092{
a9de9248
MH		 2093 struct hci_cp_sniff_mode *cp;
2094 struct hci_conn *conn;
1da177e4 2095
9f1db00c 2096 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 2097
a9de9248
MH		 2098 if (!status)
2099 return;
04837f64 2100
a9de9248
MH		 2101 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2102 if (!cp)
2103 return;
04837f64 2104
a9de9248 2105 hci_dev_lock(hdev);
04837f64 2106
a9de9248 2107 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 2108 if (conn) {
51a8efd7 2109 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 2110
51a8efd7 2111 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 2112 hci_sco_setup(conn, status);
2113 }
2114
a9de9248
MH		 2115 hci_dev_unlock(hdev);
2116}
04837f64 2117
a9de9248
MH		 2118static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2119{
2120 struct hci_cp_exit_sniff_mode *cp;
2121 struct hci_conn *conn;
04837f64 2122
9f1db00c 2123 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 2124
a9de9248
MH		 2125 if (!status)
2126 return;
04837f64 2127
a9de9248
MH		 2128 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2129 if (!cp)
2130 return;
04837f64 2131
a9de9248 2132 hci_dev_lock(hdev);
1da177e4 2133
a9de9248 2134 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 2135 if (conn) {
51a8efd7 2136 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 2137
51a8efd7 2138 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 2139 hci_sco_setup(conn, status);
2140 }
2141
a9de9248 2142 hci_dev_unlock(hdev);
1da177e4
LT		 2143}
2144
88c3df13
JH		 2145static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2146{
2147 struct hci_cp_disconnect *cp;
2148 struct hci_conn *conn;
2149
2150 if (!status)
2151 return;
2152
2153 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2154 if (!cp)
2155 return;
2156
2157 hci_dev_lock(hdev);
2158
2159 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2160 if (conn)
2161 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 2162 conn->dst_type, status);
88c3df13
JH		 2163
2164 hci_dev_unlock(hdev);
2165}
2166
d12fb056
JK		 2167static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2168 u8 peer_addr_type, u8 own_address_type,
2169 u8 filter_policy)
cb1d68f7 2170{
cb1d68f7
JH		 2171 struct hci_conn *conn;
2172
d12fb056
JK		 2173 conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2174 peer_addr_type);
cb1d68f7 2175 if (!conn)
d12fb056 2176 return;
cb1d68f7
JH		 2177
2178 /* Store the initiator and responder address information which
2179 * is needed for SMP. These values will not change during the
2180 * lifetime of the connection.
2181 */
d12fb056
JK		 2182 conn->init_addr_type = own_address_type;
2183 if (own_address_type == ADDR_LE_DEV_RANDOM)
cb1d68f7
JH		 2184 bacpy(&conn->init_addr, &hdev->random_addr);
2185 else
2186 bacpy(&conn->init_addr, &hdev->bdaddr);
2187
d12fb056
JK		 2188 conn->resp_addr_type = peer_addr_type;
2189 bacpy(&conn->resp_addr, peer_addr);
cb1d68f7 2190
9489eca4
JH		 2191 /* We don't want the connection attempt to stick around
2192 * indefinitely since LE doesn't have a page timeout concept
2193 * like BR/EDR. Set a timer for any connection that doesn't use
2194 * the white list for connecting.
2195 */
d12fb056 2196 if (filter_policy == HCI_LE_USE_PEER_ADDR)
9489eca4
JH		 2197 queue_delayed_work(conn->hdev->workqueue,
2198 &conn->le_conn_timeout,
09ae260b 2199 conn->conn_timeout);
d12fb056
JK		 2200}
2201
2202static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2203{
2204 struct hci_cp_le_create_conn *cp;
2205
2206 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2207
2208 /* All connection failure handling is taken care of by the
2209 * hci_le_conn_failed function which is triggered by the HCI
2210 * request completion callbacks used for connecting.
2211 */
2212 if (status)
2213 return;
2214
2215 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2216 if (!cp)
2217 return;
2218
2219 hci_dev_lock(hdev);
2220
2221 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2222 cp->own_address_type, cp->filter_policy);
9489eca4 2223
cb1d68f7
JH		 2224 hci_dev_unlock(hdev);
2225}
2226
4d94f95d
JK		 2227static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2228{
2229 struct hci_cp_le_ext_create_conn *cp;
2230
2231 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2232
2233 /* All connection failure handling is taken care of by the
2234 * hci_le_conn_failed function which is triggered by the HCI
2235 * request completion callbacks used for connecting.
2236 */
2237 if (status)
2238 return;
2239
2240 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2241 if (!cp)
2242 return;
2243
2244 hci_dev_lock(hdev);
2245
2246 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2247 cp->own_addr_type, cp->filter_policy);
2248
2249 hci_dev_unlock(hdev);
2250}
2251
0fe29fd1
MH		 2252static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2253{
2254 struct hci_cp_le_read_remote_features *cp;
2255 struct hci_conn *conn;
2256
2257 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2258
2259 if (!status)
2260 return;
2261
2262 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2263 if (!cp)
2264 return;
2265
2266 hci_dev_lock(hdev);
2267
2268 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2269 if (conn) {
2270 if (conn->state == BT_CONFIG) {
2271 hci_connect_cfm(conn, status);
2272 hci_conn_drop(conn);
2273 }
2274 }
2275
2276 hci_dev_unlock(hdev);
2277}
2278
81d0c8ad
JH		 2279static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2280{
2281 struct hci_cp_le_start_enc *cp;
2282 struct hci_conn *conn;
2283
2284 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2285
2286 if (!status)
2287 return;
2288
2289 hci_dev_lock(hdev);
2290
2291 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2292 if (!cp)
2293 goto unlock;
2294
2295 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2296 if (!conn)
2297 goto unlock;
2298
2299 if (conn->state != BT_CONNECTED)
2300 goto unlock;
2301
2302 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2303 hci_conn_drop(conn);
2304
2305unlock:
2306 hci_dev_unlock(hdev);
2307}
2308
50fc85f1
KP		 2309static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2310{
2311 struct hci_cp_switch_role *cp;
2312 struct hci_conn *conn;
2313
2314 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2315
2316 if (!status)
2317 return;
2318
2319 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2320 if (!cp)
2321 return;
2322
2323 hci_dev_lock(hdev);
2324
2325 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2326 if (conn)
2327 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2328
2329 hci_dev_unlock(hdev);
2330}
2331
6039aa73 2332static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2333{
2334 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 2335 struct discovery_state *discov = &hdev->discovery;
2336 struct inquiry_entry *e;
1da177e4 2337
9f1db00c 2338 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 2339
a9de9248 2340 hci_conn_check_pending(hdev);
89352e7d
AG		 2341
2342 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2343 return;
2344
4e857c58 2345 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 2346 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2347
d7a5a11d 2348 if (!hci_dev_test_flag(hdev, HCI_MGMT))
30dc78e1
JH		 2349 return;
2350
56e5cb86 2351 hci_dev_lock(hdev);
30dc78e1 2352
343f935b 2353 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 2354 goto unlock;
2355
2356 if (list_empty(&discov->resolve)) {
07d2334a
JP		 2357 /* When BR/EDR inquiry is active and no LE scanning is in
2358 * progress, then change discovery state to indicate completion.
2359 *
2360 * When running LE scanning and BR/EDR inquiry simultaneously
2361 * and the LE scan already finished, then change the discovery
2362 * state to indicate completion.
2363 */
2364 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2365 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2366 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2367 goto unlock;
2368 }
2369
2370 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2371 if (e && hci_resolve_name(hdev, e) == 0) {
2372 e->name_state = NAME_PENDING;
2373 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2374 } else {
07d2334a
JP		 2375 /* When BR/EDR inquiry is active and no LE scanning is in
2376 * progress, then change discovery state to indicate completion.
2377 *
2378 * When running LE scanning and BR/EDR inquiry simultaneously
2379 * and the LE scan already finished, then change the discovery
2380 * state to indicate completion.
2381 */
2382 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2383 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2384 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2385 }
2386
2387unlock:
56e5cb86 2388 hci_dev_unlock(hdev);
1da177e4
LT		 2389}
2390
6039aa73 2391static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2392{
45bb4bf0 2393 struct inquiry_data data;
a9de9248 2394 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 2395 int num_rsp = *((__u8 *) skb->data);
2396
2397 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2398
45bb4bf0
MH		 2399 if (!num_rsp)
2400 return;
2401
d7a5a11d 2402 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 2403 return;
2404
1da177e4 2405 hci_dev_lock(hdev);
45bb4bf0 2406
e17acd40 2407 for (; num_rsp; num_rsp--, info++) {
af58925c 2408 u32 flags;
3175405b 2409
1da177e4
LT		 2410 bacpy(&data.bdaddr, &info->bdaddr);
2411 data.pscan_rep_mode = info->pscan_rep_mode;
2412 data.pscan_period_mode = info->pscan_period_mode;
2413 data.pscan_mode = info->pscan_mode;
2414 memcpy(data.dev_class, info->dev_class, 3);
2415 data.clock_offset = info->clock_offset;
efb2513f 2416 data.rssi = HCI_RSSI_INVALID;
41a96212 2417 data.ssp_mode = 0x00;
3175405b 2418
af58925c
MH		 2419 flags = hci_inquiry_cache_update(hdev, &data, false);
2420
48264f06 2421 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
efb2513f
MH		 2422 info->dev_class, HCI_RSSI_INVALID,
2423 flags, NULL, 0, NULL, 0);
1da177e4 2424 }
45bb4bf0 2425
1da177e4
LT		 2426 hci_dev_unlock(hdev);
2427}
2428
6039aa73 2429static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2430{
a9de9248
MH		 2431 struct hci_ev_conn_complete *ev = (void *) skb->data;
2432 struct hci_conn *conn;
1da177e4
LT		 2433
2434 BT_DBG("%s", hdev->name);
2435
2436 hci_dev_lock(hdev);
2437
2438 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2439 if (!conn) {
2440 if (ev->link_type != SCO_LINK)
2441 goto unlock;
2442
2443 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2444 if (!conn)
2445 goto unlock;
2446
2447 conn->type = SCO_LINK;
2448 }
1da177e4
LT		 2449
2450 if (!ev->status) {
2451 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2452
2453 if (conn->type == ACL_LINK) {
2454 conn->state = BT_CONFIG;
2455 hci_conn_hold(conn);
a9ea3ed9
SJ		 2456
2457 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2458 !hci_find_link_key(hdev, &ev->bdaddr))
2459 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2460 else
2461 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2462 } else
2463 conn->state = BT_CONNECTED;
1da177e4 2464
23b9ceb7 2465 hci_debugfs_create_conn(conn);
7d0db0a3
MH		 2466 hci_conn_add_sysfs(conn);
2467
1da177e4 2468 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2469 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2470
2471 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2472 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2473
04837f64
MH		 2474 /* Get remote features */
2475 if (conn->type == ACL_LINK) {
2476 struct hci_cp_read_remote_features cp;
2477 cp.handle = ev->handle;
769be974 2478 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2479 sizeof(cp), &cp);
22f433dc 2480
01b1cb87 2481 hci_req_update_scan(hdev);
04837f64
MH		 2482 }
2483
1da177e4 2484 /* Set packet type for incoming connection */
d095c1eb 2485 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2486 struct hci_cp_change_conn_ptype cp;
2487 cp.handle = ev->handle;
a8746417 2488 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2489 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2490 &cp);
1da177e4 2491 }
17d5c04c 2492 } else {
1da177e4 2493 conn->state = BT_CLOSED;
17d5c04c 2494 if (conn->type == ACL_LINK)
64c7b77c 2495 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2496 conn->dst_type, ev->status);
17d5c04c 2497 }
1da177e4 2498
e73439d8
MH		 2499 if (conn->type == ACL_LINK)
2500 hci_sco_setup(conn, ev->status);
1da177e4 2501
769be974 2502 if (ev->status) {
539c496d 2503 hci_connect_cfm(conn, ev->status);
1da177e4 2504 hci_conn_del(conn);
c89b6e6b 2505 } else if (ev->link_type != ACL_LINK)
539c496d 2506 hci_connect_cfm(conn, ev->status);
1da177e4 2507
a9de9248 2508unlock:
1da177e4 2509 hci_dev_unlock(hdev);
1da177e4 2510
a9de9248 2511 hci_conn_check_pending(hdev);
1da177e4
LT		 2512}
2513
70c46425
JH		 2514static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2515{
2516 struct hci_cp_reject_conn_req cp;
2517
2518 bacpy(&cp.bdaddr, bdaddr);
2519 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2520 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2521}
2522
6039aa73 2523static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2524{
a9de9248
MH		 2525 struct hci_ev_conn_request *ev = (void *) skb->data;
2526 int mask = hdev->link_mode;
70c46425
JH		 2527 struct inquiry_entry *ie;
2528 struct hci_conn *conn;
20714bfe 2529 __u8 flags = 0;
1da177e4 2530
6ed93dc6 2531 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2532 ev->link_type);
1da177e4 2533
20714bfe
FD		 2534 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2535 &flags);
1da177e4 2536
70c46425
JH		 2537 if (!(mask & HCI_LM_ACCEPT)) {
2538 hci_reject_conn(hdev, &ev->bdaddr);
2539 return;
2540 }
2541
46c4c941
JH		 2542 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2543 BDADDR_BREDR)) {
2544 hci_reject_conn(hdev, &ev->bdaddr);
2545 return;
2546 }
2547
6a8fc95c
JH		 2548 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2549 * connection. These features are only touched through mgmt so
2550 * only do the checks if HCI_MGMT is set.
2551 */
d7a5a11d
MH		 2552 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2553 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
46c4c941
JH		 2554 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2555 BDADDR_BREDR)) {
2556 hci_reject_conn(hdev, &ev->bdaddr);
2557 return;
70c46425 2558 }
1da177e4 2559
70c46425 2560 /* Connection accepted */
b6a0dc82 2561
70c46425
JH		 2562 hci_dev_lock(hdev);
2563
2564 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2565 if (ie)
2566 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2567
70c46425
JH		 2568 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2569 &ev->bdaddr);
2570 if (!conn) {
a5c4e309
JH		 2571 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2572 HCI_ROLE_SLAVE);
a9de9248 2573 if (!conn) {
2064ee33 2574 bt_dev_err(hdev, "no memory for new connection");
70c46425
JH		 2575 hci_dev_unlock(hdev);
2576 return;
1da177e4 2577 }
70c46425 2578 }
b6a0dc82 2579
70c46425 2580 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2581
70c46425 2582 hci_dev_unlock(hdev);
1da177e4 2583
70c46425
JH		 2584 if (ev->link_type == ACL_LINK ||
2585 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2586 struct hci_cp_accept_conn_req cp;
2587 conn->state = BT_CONNECT;
1da177e4 2588
70c46425 2589 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2590
70c46425
JH		 2591 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2592 cp.role = 0x00; /* Become master */
2593 else
2594 cp.role = 0x01; /* Remain slave */
b6a0dc82 2595
70c46425
JH		 2596 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2597 } else if (!(flags & HCI_PROTO_DEFER)) {
2598 struct hci_cp_accept_sync_conn_req cp;
2599 conn->state = BT_CONNECT;
b6a0dc82 2600
70c46425
JH		 2601 bacpy(&cp.bdaddr, &ev->bdaddr);
2602 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2603
70c46425
JH		 2604 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2605 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2606 cp.max_latency = cpu_to_le16(0xffff);
2607 cp.content_format = cpu_to_le16(hdev->voice_setting);
2608 cp.retrans_effort = 0xff;
1da177e4 2609
70c46425
JH		 2610 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2611 &cp);
a9de9248 2612 } else {
70c46425 2613 conn->state = BT_CONNECT2;
539c496d 2614 hci_connect_cfm(conn, 0);
1da177e4 2615 }
1da177e4
LT		 2616}
2617
f0d6a0ea
MA		 2618static u8 hci_to_mgmt_reason(u8 err)
2619{
2620 switch (err) {
2621 case HCI_ERROR_CONNECTION_TIMEOUT:
2622 return MGMT_DEV_DISCONN_TIMEOUT;
2623 case HCI_ERROR_REMOTE_USER_TERM:
2624 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2625 case HCI_ERROR_REMOTE_POWER_OFF:
2626 return MGMT_DEV_DISCONN_REMOTE;
2627 case HCI_ERROR_LOCAL_HOST_TERM:
2628 return MGMT_DEV_DISCONN_LOCAL_HOST;
2629 default:
2630 return MGMT_DEV_DISCONN_UNKNOWN;
2631 }
2632}
2633
6039aa73 2634static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2635{
a9de9248 2636 struct hci_ev_disconn_complete *ev = (void *) skb->data;
160b9251 2637 u8 reason;
9fcb18ef 2638 struct hci_conn_params *params;
04837f64 2639 struct hci_conn *conn;
12d4a3b2 2640 bool mgmt_connected;
3846220b 2641 u8 type;
04837f64 2642
9f1db00c 2643 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2644
2645 hci_dev_lock(hdev);
2646
2647 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2648 if (!conn)
2649 goto unlock;
7d0db0a3 2650
abf54a50
AG		 2651 if (ev->status) {
2652 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2653 conn->dst_type, ev->status);
2654 goto unlock;
37d9ef76 2655 }
f7520543 2656
3846220b
AG		 2657 conn->state = BT_CLOSED;
2658
12d4a3b2 2659 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
160b9251
SJ		 2660
2661 if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2662 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2663 else
2664 reason = hci_to_mgmt_reason(ev->reason);
2665
12d4a3b2
JH		 2666 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2667 reason, mgmt_connected);
abf54a50 2668
22f433dc
JH		 2669 if (conn->type == ACL_LINK) {
2670 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2671 hci_remove_link_key(hdev, &conn->dst);
2672
01b1cb87 2673 hci_req_update_scan(hdev);
22f433dc 2674 }
2210246c 2675
9fcb18ef
AG		 2676 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2677 if (params) {
2678 switch (params->auto_connect) {
2679 case HCI_AUTO_CONN_LINK_LOSS:
2680 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2681 break;
2682 /* Fall through */
2683
4b9e7e75 2684 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2685 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2686 list_del_init(&params->action);
2687 list_add(&params->action, &hdev->pend_le_conns);
2688 hci_update_background_scan(hdev);
9fcb18ef
AG		 2689 break;
2690
2691 default:
2692 break;
2693 }
2694 }
2695
3846220b 2696 type = conn->type;
2210246c 2697
3a6d576b 2698 hci_disconn_cfm(conn, ev->reason);
3846220b
AG		 2699 hci_conn_del(conn);
2700
2701 /* Re-enable advertising if necessary, since it might
2702 * have been disabled by the connection. From the
2703 * HCI_LE_Set_Advertise_Enable command description in
2704 * the core specification (v4.0):
2705 * "The Controller shall continue advertising until the Host
2706 * issues an LE_Set_Advertise_Enable command with
2707 * Advertising_Enable set to 0x00 (Advertising is disabled)
2708 * or until a connection is created or until the Advertising
2709 * is timed out due to Directed Advertising."
2710 */
2711 if (type == LE_LINK)
f2252570 2712 hci_req_reenable_advertising(hdev);
f7520543
JH		 2713
2714unlock:
04837f64
MH		 2715 hci_dev_unlock(hdev);
2716}
2717
6039aa73 2718static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2719{
a9de9248 2720 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2721 struct hci_conn *conn;
1da177e4 2722
9f1db00c 2723 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2724
2725 hci_dev_lock(hdev);
2726
04837f64 2727 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2728 if (!conn)
2729 goto unlock;
2730
2731 if (!ev->status) {
160b9251
SJ		 2732 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2733
aa64a8b5 2734 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2735 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2064ee33 2736 bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2a611692 2737 } else {
4dae2798 2738 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2739 conn->sec_level = conn->pending_sec_level;
2a611692 2740 }
d7556e20 2741 } else {
160b9251
SJ		 2742 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2743 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2744
e1e930f5 2745 mgmt_auth_failed(conn, ev->status);
d7556e20 2746 }
1da177e4 2747
51a8efd7
JH		 2748 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2749 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2750
d7556e20 2751 if (conn->state == BT_CONFIG) {
aa64a8b5 2752 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2753 struct hci_cp_set_conn_encrypt cp;
2754 cp.handle = ev->handle;
2755 cp.encrypt = 0x01;
2756 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2757 &cp);
052b30b0 2758 } else {
d7556e20 2759 conn->state = BT_CONNECTED;
539c496d 2760 hci_connect_cfm(conn, ev->status);
76a68ba0 2761 hci_conn_drop(conn);
052b30b0 2762 }
d7556e20
WR		 2763 } else {
2764 hci_auth_cfm(conn, ev->status);
052b30b0 2765
d7556e20
WR		 2766 hci_conn_hold(conn);
2767 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2768 hci_conn_drop(conn);
d7556e20
WR		 2769 }
2770
51a8efd7 2771 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2772 if (!ev->status) {
2773 struct hci_cp_set_conn_encrypt cp;
2774 cp.handle = ev->handle;
2775 cp.encrypt = 0x01;
2776 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2777 &cp);
d7556e20 2778 } else {
51a8efd7 2779 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2780 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2781 }
2782 }
2783
d7556e20 2784unlock:
1da177e4
LT		 2785 hci_dev_unlock(hdev);
2786}
2787
6039aa73 2788static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2789{
127178d2
JH		 2790 struct hci_ev_remote_name *ev = (void *) skb->data;
2791 struct hci_conn *conn;
2792
a9de9248 2793 BT_DBG("%s", hdev->name);
1da177e4 2794
a9de9248 2795 hci_conn_check_pending(hdev);
127178d2
JH		 2796
2797 hci_dev_lock(hdev);
2798
b644ba33 2799 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2800
d7a5a11d 2801 if (!hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2802 goto check_auth;
a88a9652 2803
b644ba33
JH		 2804 if (ev->status == 0)
2805 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2806 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2807 else
2808 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2809
2810check_auth:
79c6c70c
JH		 2811 if (!conn)
2812 goto unlock;
2813
2814 if (!hci_outgoing_auth_needed(hdev, conn))
2815 goto unlock;
2816
51a8efd7 2817 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2818 struct hci_cp_auth_requested cp;
977f8fce
JH		 2819
2820 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2821
127178d2
JH		 2822 cp.handle = __cpu_to_le16(conn->handle);
2823 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2824 }
2825
79c6c70c 2826unlock:
127178d2 2827 hci_dev_unlock(hdev);
a9de9248
MH		 2828}
2829
821f3766
JH		 2830static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2831 u16 opcode, struct sk_buff *skb)
2832{
2833 const struct hci_rp_read_enc_key_size *rp;
2834 struct hci_conn *conn;
2835 u16 handle;
2836
2837 BT_DBG("%s status 0x%02x", hdev->name, status);
2838
2839 if (!skb || skb->len < sizeof(*rp)) {
2064ee33 2840 bt_dev_err(hdev, "invalid read key size response");
821f3766
JH		 2841 return;
2842 }
2843
2844 rp = (void *)skb->data;
2845 handle = le16_to_cpu(rp->handle);
2846
2847 hci_dev_lock(hdev);
2848
2849 conn = hci_conn_hash_lookup_handle(hdev, handle);
2850 if (!conn)
2851 goto unlock;
2852
2853 /* If we fail to read the encryption key size, assume maximum
2854 * (which is the same we do also when this HCI command isn't
2855 * supported.
2856 */
2857 if (rp->status) {
2064ee33
MH		 2858 bt_dev_err(hdev, "failed to read key size for handle %u",
2859 handle);
821f3766
JH		 2860 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2861 } else {
2862 conn->enc_key_size = rp->key_size;
2863 }
2864
2865 if (conn->state == BT_CONFIG) {
2866 conn->state = BT_CONNECTED;
2867 hci_connect_cfm(conn, 0);
2868 hci_conn_drop(conn);
2869 } else {
2870 u8 encrypt;
2871
2872 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2873 encrypt = 0x00;
5d667ef6 2874 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
821f3766
JH		 2875 encrypt = 0x02;
2876 else
2877 encrypt = 0x01;
2878
2879 hci_encrypt_cfm(conn, 0, encrypt);
2880 }
2881
2882unlock:
2883 hci_dev_unlock(hdev);
2884}
2885
6039aa73 2886static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2887{
2888 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2889 struct hci_conn *conn;
2890
9f1db00c 2891 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2892
2893 hci_dev_lock(hdev);
2894
04837f64 2895 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2896 if (!conn)
2897 goto unlock;
1da177e4 2898
dc8357cc
MH		 2899 if (!ev->status) {
2900 if (ev->encrypt) {
2901 /* Encryption implies authentication */
4dae2798
JH		 2902 set_bit(HCI_CONN_AUTH, &conn->flags);
2903 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2904 conn->sec_level = conn->pending_sec_level;
abf76bad 2905
914a6ffe
MH		 2906 /* P-256 authentication key implies FIPS */
2907 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2908 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2909
abf76bad
MH		 2910 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2911 conn->type == LE_LINK)
2912 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2913 } else {
4dae2798 2914 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2915 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2916 }
dc8357cc 2917 }
a7d7723a 2918
7ed3fa20
JH		 2919 /* We should disregard the current RPA and generate a new one
2920 * whenever the encryption procedure fails.
2921 */
a73c046a 2922 if (ev->status && conn->type == LE_LINK) {
a1536da2 2923 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
a73c046a
JK		 2924 hci_adv_instances_set_rpa_expired(hdev, true);
2925 }
7ed3fa20 2926
dc8357cc 2927 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2928
dc8357cc 2929 if (ev->status && conn->state == BT_CONNECTED) {
160b9251
SJ		 2930 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2931 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2932
dc8357cc
MH		 2933 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2934 hci_conn_drop(conn);
2935 goto unlock;
1da177e4
LT		 2936 }
2937
035ad621
JH		 2938 /* In Secure Connections Only mode, do not allow any connections
2939 * that are not encrypted with AES-CCM using a P-256 authenticated
2940 * combination key.
2941 */
2942 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2943 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2944 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2945 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2946 hci_conn_drop(conn);
2947 goto unlock;
2948 }
2949
821f3766
JH		 2950 /* Try reading the encryption key size for encrypted ACL links */
2951 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2952 struct hci_cp_read_enc_key_size cp;
2953 struct hci_request req;
2954
2955 /* Only send HCI_Read_Encryption_Key_Size if the
2956 * controller really supports it. If it doesn't, assume
2957 * the default size (16).
2958 */
2959 if (!(hdev->commands[20] & 0x10)) {
2960 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2961 goto notify;
2962 }
2963
2964 hci_req_init(&req, hdev);
2965
2966 cp.handle = cpu_to_le16(conn->handle);
2967 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2968
2969 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2064ee33 2970 bt_dev_err(hdev, "sending read key size failed");
821f3766
JH		 2971 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2972 goto notify;
2973 }
2974
2975 goto unlock;
2976 }
2977
2978notify:
dc8357cc
MH		 2979 if (conn->state == BT_CONFIG) {
2980 if (!ev->status)
2981 conn->state = BT_CONNECTED;
2982
539c496d 2983 hci_connect_cfm(conn, ev->status);
dc8357cc
MH		 2984 hci_conn_drop(conn);
2985 } else
2986 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2987
a7d7723a 2988unlock:
1da177e4
LT		 2989 hci_dev_unlock(hdev);
2990}
2991
6039aa73
GP		 2992static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2993 struct sk_buff *skb)
1da177e4 2994{
a9de9248 2995 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 2996 struct hci_conn *conn;
1da177e4 2997
9f1db00c 2998 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2999
3000 hci_dev_lock(hdev);
3001
04837f64 3002 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3003 if (conn) {
3004 if (!ev->status)
4dae2798 3005 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 3006
51a8efd7 3007 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 3008
3009 hci_key_change_cfm(conn, ev->status);
3010 }
3011
3012 hci_dev_unlock(hdev);
3013}
3014
6039aa73
GP		 3015static void hci_remote_features_evt(struct hci_dev *hdev,
3016 struct sk_buff *skb)
1da177e4 3017{
a9de9248
MH		 3018 struct hci_ev_remote_features *ev = (void *) skb->data;
3019 struct hci_conn *conn;
3020
9f1db00c 3021 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 3022
a9de9248
MH		 3023 hci_dev_lock(hdev);
3024
3025 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3026 if (!conn)
3027 goto unlock;
769be974 3028
ccd556fe 3029 if (!ev->status)
cad718ed 3030 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 3031
3032 if (conn->state != BT_CONFIG)
3033 goto unlock;
3034
ac363cf9
SJ		 3035 if (!ev->status && lmp_ext_feat_capable(hdev) &&
3036 lmp_ext_feat_capable(conn)) {
ccd556fe
JH		 3037 struct hci_cp_read_remote_ext_features cp;
3038 cp.handle = ev->handle;
3039 cp.page = 0x01;
3040 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 3041 sizeof(cp), &cp);
392599b9
JH		 3042 goto unlock;
3043 }
3044
671267bf 3045 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3046 struct hci_cp_remote_name_req cp;
3047 memset(&cp, 0, sizeof(cp));
3048 bacpy(&cp.bdaddr, &conn->dst);
3049 cp.pscan_rep_mode = 0x02;
3050 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3051 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3052 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3053
127178d2 3054 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 3055 conn->state = BT_CONNECTED;
539c496d 3056 hci_connect_cfm(conn, ev->status);
76a68ba0 3057 hci_conn_drop(conn);
769be974 3058 }
a9de9248 3059
ccd556fe 3060unlock:
a9de9248 3061 hci_dev_unlock(hdev);
1da177e4
LT		 3062}
3063
e6214487
JH		 3064static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3065 u16 *opcode, u8 *status,
3066 hci_req_complete_t *req_complete,
3067 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3068{
3069 struct hci_ev_cmd_complete *ev = (void *) skb->data;
a9de9248 3070
e6214487
JH		 3071 *opcode = __le16_to_cpu(ev->opcode);
3072 *status = skb->data[sizeof(*ev)];
a9de9248 3073
e6214487 3074 skb_pull(skb, sizeof(*ev));
a9de9248 3075
e6214487 3076 switch (*opcode) {
a9de9248
MH		 3077 case HCI_OP_INQUIRY_CANCEL:
3078 hci_cc_inquiry_cancel(hdev, skb);
3079 break;
3080
4d93483b
AG		 3081 case HCI_OP_PERIODIC_INQ:
3082 hci_cc_periodic_inq(hdev, skb);
3083 break;
3084
a9de9248
MH		 3085 case HCI_OP_EXIT_PERIODIC_INQ:
3086 hci_cc_exit_periodic_inq(hdev, skb);
3087 break;
3088
3089 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3090 hci_cc_remote_name_req_cancel(hdev, skb);
3091 break;
3092
3093 case HCI_OP_ROLE_DISCOVERY:
3094 hci_cc_role_discovery(hdev, skb);
3095 break;
3096
e4e8e37c
MH		 3097 case HCI_OP_READ_LINK_POLICY:
3098 hci_cc_read_link_policy(hdev, skb);
3099 break;
3100
a9de9248
MH		 3101 case HCI_OP_WRITE_LINK_POLICY:
3102 hci_cc_write_link_policy(hdev, skb);
3103 break;
3104
e4e8e37c
MH		 3105 case HCI_OP_READ_DEF_LINK_POLICY:
3106 hci_cc_read_def_link_policy(hdev, skb);
3107 break;
3108
3109 case HCI_OP_WRITE_DEF_LINK_POLICY:
3110 hci_cc_write_def_link_policy(hdev, skb);
3111 break;
3112
a9de9248
MH		 3113 case HCI_OP_RESET:
3114 hci_cc_reset(hdev, skb);
3115 break;
3116
c2f0f979
MH		 3117 case HCI_OP_READ_STORED_LINK_KEY:
3118 hci_cc_read_stored_link_key(hdev, skb);
3119 break;
3120
a9366120
MH		 3121 case HCI_OP_DELETE_STORED_LINK_KEY:
3122 hci_cc_delete_stored_link_key(hdev, skb);
3123 break;
3124
a9de9248
MH		 3125 case HCI_OP_WRITE_LOCAL_NAME:
3126 hci_cc_write_local_name(hdev, skb);
3127 break;
3128
3129 case HCI_OP_READ_LOCAL_NAME:
3130 hci_cc_read_local_name(hdev, skb);
3131 break;
3132
3133 case HCI_OP_WRITE_AUTH_ENABLE:
3134 hci_cc_write_auth_enable(hdev, skb);
3135 break;
3136
3137 case HCI_OP_WRITE_ENCRYPT_MODE:
3138 hci_cc_write_encrypt_mode(hdev, skb);
3139 break;
3140
3141 case HCI_OP_WRITE_SCAN_ENABLE:
3142 hci_cc_write_scan_enable(hdev, skb);
3143 break;
3144
3145 case HCI_OP_READ_CLASS_OF_DEV:
3146 hci_cc_read_class_of_dev(hdev, skb);
3147 break;
3148
3149 case HCI_OP_WRITE_CLASS_OF_DEV:
3150 hci_cc_write_class_of_dev(hdev, skb);
3151 break;
3152
3153 case HCI_OP_READ_VOICE_SETTING:
3154 hci_cc_read_voice_setting(hdev, skb);
3155 break;
3156
3157 case HCI_OP_WRITE_VOICE_SETTING:
3158 hci_cc_write_voice_setting(hdev, skb);
3159 break;
3160
b4cb9fb2
MH		 3161 case HCI_OP_READ_NUM_SUPPORTED_IAC:
3162 hci_cc_read_num_supported_iac(hdev, skb);
3163 break;
3164
333140b5
MH		 3165 case HCI_OP_WRITE_SSP_MODE:
3166 hci_cc_write_ssp_mode(hdev, skb);
3167 break;
3168
eac83dc6
MH		 3169 case HCI_OP_WRITE_SC_SUPPORT:
3170 hci_cc_write_sc_support(hdev, skb);
3171 break;
3172
a9de9248
MH		 3173 case HCI_OP_READ_LOCAL_VERSION:
3174 hci_cc_read_local_version(hdev, skb);
3175 break;
3176
3177 case HCI_OP_READ_LOCAL_COMMANDS:
3178 hci_cc_read_local_commands(hdev, skb);
3179 break;
3180
3181 case HCI_OP_READ_LOCAL_FEATURES:
3182 hci_cc_read_local_features(hdev, skb);
3183 break;
3184
971e3a4b
AG		 3185 case HCI_OP_READ_LOCAL_EXT_FEATURES:
3186 hci_cc_read_local_ext_features(hdev, skb);
3187 break;
3188
a9de9248
MH		 3189 case HCI_OP_READ_BUFFER_SIZE:
3190 hci_cc_read_buffer_size(hdev, skb);
3191 break;
3192
3193 case HCI_OP_READ_BD_ADDR:
3194 hci_cc_read_bd_addr(hdev, skb);
3195 break;
3196
f332ec66
JH		 3197 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3198 hci_cc_read_page_scan_activity(hdev, skb);
3199 break;
3200
4a3ee763
JH		 3201 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3202 hci_cc_write_page_scan_activity(hdev, skb);
3203 break;
3204
f332ec66
JH		 3205 case HCI_OP_READ_PAGE_SCAN_TYPE:
3206 hci_cc_read_page_scan_type(hdev, skb);
3207 break;
3208
4a3ee763
JH		 3209 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3210 hci_cc_write_page_scan_type(hdev, skb);
3211 break;
3212
350ee4cf
AE		 3213 case HCI_OP_READ_DATA_BLOCK_SIZE:
3214 hci_cc_read_data_block_size(hdev, skb);
3215 break;
3216
1e89cffb
AE		 3217 case HCI_OP_READ_FLOW_CONTROL_MODE:
3218 hci_cc_read_flow_control_mode(hdev, skb);
3219 break;
3220
928abaa7
AE		 3221 case HCI_OP_READ_LOCAL_AMP_INFO:
3222 hci_cc_read_local_amp_info(hdev, skb);
3223 break;
3224
33f35721
JH		 3225 case HCI_OP_READ_CLOCK:
3226 hci_cc_read_clock(hdev, skb);
3227 break;
3228
d5859e22
JH		 3229 case HCI_OP_READ_INQ_RSP_TX_POWER:
3230 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3231 break;
3232
980e1a53
JH		 3233 case HCI_OP_PIN_CODE_REPLY:
3234 hci_cc_pin_code_reply(hdev, skb);
3235 break;
3236
3237 case HCI_OP_PIN_CODE_NEG_REPLY:
3238 hci_cc_pin_code_neg_reply(hdev, skb);
3239 break;
3240
c35938b2 3241 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 3242 hci_cc_read_local_oob_data(hdev, skb);
3243 break;
3244
3245 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3246 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 3247 break;
3248
6ed58ec5
VT		 3249 case HCI_OP_LE_READ_BUFFER_SIZE:
3250 hci_cc_le_read_buffer_size(hdev, skb);
3251 break;
3252
60e77321
JH		 3253 case HCI_OP_LE_READ_LOCAL_FEATURES:
3254 hci_cc_le_read_local_features(hdev, skb);
3255 break;
3256
8fa19098
JH		 3257 case HCI_OP_LE_READ_ADV_TX_POWER:
3258 hci_cc_le_read_adv_tx_power(hdev, skb);
3259 break;
3260
a5c29683
JH		 3261 case HCI_OP_USER_CONFIRM_REPLY:
3262 hci_cc_user_confirm_reply(hdev, skb);
3263 break;
3264
3265 case HCI_OP_USER_CONFIRM_NEG_REPLY:
3266 hci_cc_user_confirm_neg_reply(hdev, skb);
3267 break;
3268
1143d458
BG		 3269 case HCI_OP_USER_PASSKEY_REPLY:
3270 hci_cc_user_passkey_reply(hdev, skb);
3271 break;
3272
3273 case HCI_OP_USER_PASSKEY_NEG_REPLY:
3274 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 3275 break;
07f7fa5d 3276
7a4cd51d
MH		 3277 case HCI_OP_LE_SET_RANDOM_ADDR:
3278 hci_cc_le_set_random_addr(hdev, skb);
3279 break;
3280
c1d5dc4a
JH		 3281 case HCI_OP_LE_SET_ADV_ENABLE:
3282 hci_cc_le_set_adv_enable(hdev, skb);
3283 break;
3284
533553f8
MH		 3285 case HCI_OP_LE_SET_SCAN_PARAM:
3286 hci_cc_le_set_scan_param(hdev, skb);
3287 break;
3288
eb9d91f5
AG		 3289 case HCI_OP_LE_SET_SCAN_ENABLE:
3290 hci_cc_le_set_scan_enable(hdev, skb);
3291 break;
3292
cf1d081f
JH		 3293 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3294 hci_cc_le_read_white_list_size(hdev, skb);
3295 break;
3296
0f36b589
MH		 3297 case HCI_OP_LE_CLEAR_WHITE_LIST:
3298 hci_cc_le_clear_white_list(hdev, skb);
3299 break;
3300
3301 case HCI_OP_LE_ADD_TO_WHITE_LIST:
3302 hci_cc_le_add_to_white_list(hdev, skb);
3303 break;
3304
3305 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3306 hci_cc_le_del_from_white_list(hdev, skb);
3307 break;
3308
9b008c04
JH		 3309 case HCI_OP_LE_READ_SUPPORTED_STATES:
3310 hci_cc_le_read_supported_states(hdev, skb);
3311 break;
3312
a8e1bfaa
MH		 3313 case HCI_OP_LE_READ_DEF_DATA_LEN:
3314 hci_cc_le_read_def_data_len(hdev, skb);
3315 break;
3316
3317 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3318 hci_cc_le_write_def_data_len(hdev, skb);
3319 break;
3320
b950aa88
AN		 3321 case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3322 hci_cc_le_add_to_resolv_list(hdev, skb);
3323 break;
3324
3325 case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3326 hci_cc_le_del_from_resolv_list(hdev, skb);
3327 break;
3328
545f2596
AN		 3329 case HCI_OP_LE_CLEAR_RESOLV_LIST:
3330 hci_cc_le_clear_resolv_list(hdev, skb);
3331 break;
3332
cfdb0c2d
AN		 3333 case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3334 hci_cc_le_read_resolv_list_size(hdev, skb);
3335 break;
3336
aa12af77
AN		 3337 case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3338 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3339 break;
3340
a8e1bfaa
MH		 3341 case HCI_OP_LE_READ_MAX_DATA_LEN:
3342 hci_cc_le_read_max_data_len(hdev, skb);
3343 break;
3344
f9b49306
AG		 3345 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3346 hci_cc_write_le_host_supported(hdev, skb);
3347 break;
3348
56ed2cb8
JH		 3349 case HCI_OP_LE_SET_ADV_PARAM:
3350 hci_cc_set_adv_param(hdev, skb);
3351 break;
3352
5ae76a94
AK		 3353 case HCI_OP_READ_RSSI:
3354 hci_cc_read_rssi(hdev, skb);
3355 break;
3356
5a134fae
AK		 3357 case HCI_OP_READ_TX_POWER:
3358 hci_cc_read_tx_power(hdev, skb);
3359 break;
3360
c50b33c8
MH		 3361 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3362 hci_cc_write_ssp_debug_mode(hdev, skb);
3363 break;
3364
a2344b9e
JK		 3365 case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3366 hci_cc_le_set_ext_scan_param(hdev, skb);
3367 break;
3368
3369 case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3370 hci_cc_le_set_ext_scan_enable(hdev, skb);
3371 break;
3372
0314f286
JK		 3373 case HCI_OP_LE_SET_DEFAULT_PHY:
3374 hci_cc_le_set_default_phy(hdev, skb);
3375 break;
3376
6b49bcb4
JK		 3377 case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3378 hci_cc_le_read_num_adv_sets(hdev, skb);
3379 break;
3380
de181e88
JK		 3381 case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3382 hci_cc_set_ext_adv_param(hdev, skb);
3383 break;
3384
3385 case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3386 hci_cc_le_set_ext_adv_enable(hdev, skb);
3387 break;
3388
a73c046a
JK		 3389 case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3390 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3391 break;
3392
a9de9248 3393 default:
e6214487 3394 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3395 break;
3396 }
3397
e6214487 3398 if (*opcode != HCI_OP_NOP)
65cc2b49 3399 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3400
600b2150
JH		 3401 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3402 atomic_set(&hdev->cmd_cnt, 1);
3403
e6214487
JH		 3404 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3405 req_complete_skb);
9238f36a 3406
f80c5dad
JPRV		 3407 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3408 bt_dev_err(hdev,
3409 "unexpected event for opcode 0x%4.4x", *opcode);
3410 return;
3411 }
3412
600b2150
JH		 3413 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3414 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3415}
3416
e6214487
JH		 3417static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3418 u16 *opcode, u8 *status,
3419 hci_req_complete_t *req_complete,
3420 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3421{
3422 struct hci_ev_cmd_status *ev = (void *) skb->data;
a9de9248
MH		 3423
3424 skb_pull(skb, sizeof(*ev));
3425
e6214487
JH		 3426 *opcode = __le16_to_cpu(ev->opcode);
3427 *status = ev->status;
a9de9248 3428
e6214487 3429 switch (*opcode) {
a9de9248
MH		 3430 case HCI_OP_INQUIRY:
3431 hci_cs_inquiry(hdev, ev->status);
3432 break;
3433
3434 case HCI_OP_CREATE_CONN:
3435 hci_cs_create_conn(hdev, ev->status);
3436 break;
3437
9645c76c
KP		 3438 case HCI_OP_DISCONNECT:
3439 hci_cs_disconnect(hdev, ev->status);
3440 break;
3441
a9de9248
MH		 3442 case HCI_OP_ADD_SCO:
3443 hci_cs_add_sco(hdev, ev->status);
3444 break;
3445
f8558555
MH		 3446 case HCI_OP_AUTH_REQUESTED:
3447 hci_cs_auth_requested(hdev, ev->status);
3448 break;
3449
3450 case HCI_OP_SET_CONN_ENCRYPT:
3451 hci_cs_set_conn_encrypt(hdev, ev->status);
3452 break;
3453
a9de9248
MH		 3454 case HCI_OP_REMOTE_NAME_REQ:
3455 hci_cs_remote_name_req(hdev, ev->status);
3456 break;
3457
769be974
MH		 3458 case HCI_OP_READ_REMOTE_FEATURES:
3459 hci_cs_read_remote_features(hdev, ev->status);
3460 break;
3461
3462 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3463 hci_cs_read_remote_ext_features(hdev, ev->status);
3464 break;
3465
a9de9248
MH		 3466 case HCI_OP_SETUP_SYNC_CONN:
3467 hci_cs_setup_sync_conn(hdev, ev->status);
3468 break;
3469
3470 case HCI_OP_SNIFF_MODE:
3471 hci_cs_sniff_mode(hdev, ev->status);
3472 break;
3473
3474 case HCI_OP_EXIT_SNIFF_MODE:
3475 hci_cs_exit_sniff_mode(hdev, ev->status);
3476 break;
3477
50fc85f1
KP		 3478 case HCI_OP_SWITCH_ROLE:
3479 hci_cs_switch_role(hdev, ev->status);
3480 break;
3481
cb1d68f7
JH		 3482 case HCI_OP_LE_CREATE_CONN:
3483 hci_cs_le_create_conn(hdev, ev->status);
3484 break;
3485
0fe29fd1
MH		 3486 case HCI_OP_LE_READ_REMOTE_FEATURES:
3487 hci_cs_le_read_remote_features(hdev, ev->status);
3488 break;
3489
81d0c8ad
JH		 3490 case HCI_OP_LE_START_ENC:
3491 hci_cs_le_start_enc(hdev, ev->status);
3492 break;
3493
4d94f95d
JK		 3494 case HCI_OP_LE_EXT_CREATE_CONN:
3495 hci_cs_le_ext_create_conn(hdev, ev->status);
3496 break;
3497
a9de9248 3498 default:
e6214487 3499 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3500 break;
3501 }
3502
e6214487 3503 if (*opcode != HCI_OP_NOP)
65cc2b49 3504 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3505
600b2150
JH		 3506 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3507 atomic_set(&hdev->cmd_cnt, 1);
3508
444c6dd5
JH		 3509 /* Indicate request completion if the command failed. Also, if
3510 * we're not waiting for a special event and we get a success
3511 * command status we should try to flag the request as completed
3512 * (since for this kind of commands there will not be a command
3513 * complete event).
3514 */
02350a72 3515 if (ev->status ||
242c0ebd 3516 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
e6214487
JH		 3517 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3518 req_complete_skb);
9238f36a 3519
f80c5dad
JPRV		 3520 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3521 bt_dev_err(hdev,
3522 "unexpected event for opcode 0x%4.4x", *opcode);
3523 return;
3524 }
3525
600b2150
JH		 3526 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3527 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3528}
3529
24dfa343
MH		 3530static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3531{
3532 struct hci_ev_hardware_error *ev = (void *) skb->data;
3533
c7741d16
MH		 3534 hdev->hw_error_code = ev->code;
3535
3536 queue_work(hdev->req_workqueue, &hdev->error_reset);
24dfa343
MH		 3537}
3538
6039aa73 3539static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3540{
3541 struct hci_ev_role_change *ev = (void *) skb->data;
3542 struct hci_conn *conn;
3543
9f1db00c 3544 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 3545
3546 hci_dev_lock(hdev);
3547
3548 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3549 if (conn) {
40bef302
JH		 3550 if (!ev->status)
3551 conn->role = ev->role;
a9de9248 3552
51a8efd7 3553 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 3554
3555 hci_role_switch_cfm(conn, ev->status, ev->role);
3556 }
3557
3558 hci_dev_unlock(hdev);
3559}
3560
6039aa73 3561static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3562{
3563 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 3564 int i;
3565
32ac5b9b 3566 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2064ee33 3567 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
32ac5b9b
AE		 3568 return;
3569 }
3570
16e18342
GS		 3571 if (skb->len < sizeof(*ev) ||
3572 skb->len < struct_size(ev, handles, ev->num_hndl)) {
a9de9248
MH		 3573 BT_DBG("%s bad parameters", hdev->name);
3574 return;
3575 }
3576
c5993de8
AE		 3577 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3578
613a1c0c
AE		 3579 for (i = 0; i < ev->num_hndl; i++) {
3580 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 3581 struct hci_conn *conn;
3582 __u16 handle, count;
3583
613a1c0c
AE		 3584 handle = __le16_to_cpu(info->handle);
3585 count = __le16_to_cpu(info->count);
a9de9248
MH		 3586
3587 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 3588 if (!conn)
3589 continue;
3590
3591 conn->sent -= count;
3592
3593 switch (conn->type) {
3594 case ACL_LINK:
3595 hdev->acl_cnt += count;
3596 if (hdev->acl_cnt > hdev->acl_pkts)
3597 hdev->acl_cnt = hdev->acl_pkts;
3598 break;
3599
3600 case LE_LINK:
3601 if (hdev->le_pkts) {
3602 hdev->le_cnt += count;
3603 if (hdev->le_cnt > hdev->le_pkts)
3604 hdev->le_cnt = hdev->le_pkts;
3605 } else {
70f23020
AE		 3606 hdev->acl_cnt += count;
3607 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 3608 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 3609 }
f4280918
AE		 3610 break;
3611
3612 case SCO_LINK:
3613 hdev->sco_cnt += count;
3614 if (hdev->sco_cnt > hdev->sco_pkts)
3615 hdev->sco_cnt = hdev->sco_pkts;
3616 break;
3617
3618 default:
2064ee33
MH		 3619 bt_dev_err(hdev, "unknown type %d conn %p",
3620 conn->type, conn);
f4280918 3621 break;
a9de9248
MH		 3622 }
3623 }
3624
3eff45ea 3625 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3626}
3627
76ef7cf7
AE		 3628static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3629 __u16 handle)
3630{
3631 struct hci_chan *chan;
3632
3633 switch (hdev->dev_type) {
ca8bee5d 3634 case HCI_PRIMARY:
76ef7cf7
AE		 3635 return hci_conn_hash_lookup_handle(hdev, handle);
3636 case HCI_AMP:
3637 chan = hci_chan_lookup_handle(hdev, handle);
3638 if (chan)
3639 return chan->conn;
3640 break;
3641 default:
2064ee33 3642 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
76ef7cf7
AE		 3643 break;
3644 }
3645
3646 return NULL;
3647}
3648
6039aa73 3649static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3650{
3651 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3652 int i;
3653
3654 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2064ee33 3655 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
25e89e99
AE		 3656 return;
3657 }
3658
16e18342
GS		 3659 if (skb->len < sizeof(*ev) ||
3660 skb->len < struct_size(ev, handles, ev->num_hndl)) {
25e89e99
AE		 3661 BT_DBG("%s bad parameters", hdev->name);
3662 return;
3663 }
3664
3665 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3666 ev->num_hndl);
25e89e99
AE		 3667
3668 for (i = 0; i < ev->num_hndl; i++) {
3669 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3670 struct hci_conn *conn = NULL;
25e89e99
AE		 3671 __u16 handle, block_count;
3672
3673 handle = __le16_to_cpu(info->handle);
3674 block_count = __le16_to_cpu(info->blocks);
3675
76ef7cf7 3676 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3677 if (!conn)
3678 continue;
3679
3680 conn->sent -= block_count;
3681
3682 switch (conn->type) {
3683 case ACL_LINK:
bd1eb66b 3684 case AMP_LINK:
25e89e99
AE		 3685 hdev->block_cnt += block_count;
3686 if (hdev->block_cnt > hdev->num_blocks)
3687 hdev->block_cnt = hdev->num_blocks;
3688 break;
3689
3690 default:
2064ee33
MH		 3691 bt_dev_err(hdev, "unknown type %d conn %p",
3692 conn->type, conn);
25e89e99
AE		 3693 break;
3694 }
3695 }
3696
3697 queue_work(hdev->workqueue, &hdev->tx_work);
3698}
3699
6039aa73 3700static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3701{
a9de9248 3702 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3703 struct hci_conn *conn;
3704
9f1db00c 3705 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3706
3707 hci_dev_lock(hdev);
3708
3709 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3710 if (conn) {
3711 conn->mode = ev->mode;
a9de9248 3712
8fc9ced3
GP		 3713 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3714 &conn->flags)) {
a9de9248 3715 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3716 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3717 else
58a681ef 3718 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3719 }
e73439d8 3720
51a8efd7 3721 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3722 hci_sco_setup(conn, ev->status);
04837f64
MH		 3723 }
3724
3725 hci_dev_unlock(hdev);
3726}
3727
6039aa73 3728static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3729{
052b30b0
MH		 3730 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3731 struct hci_conn *conn;
3732
a9de9248 3733 BT_DBG("%s", hdev->name);
052b30b0
MH		 3734
3735 hci_dev_lock(hdev);
3736
3737 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3738 if (!conn)
3739 goto unlock;
3740
3741 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3742 hci_conn_hold(conn);
3743 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3744 hci_conn_drop(conn);
052b30b0
MH		 3745 }
3746
d7a5a11d 3747 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2f407f0a 3748 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3749 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3750 sizeof(ev->bdaddr), &ev->bdaddr);
d7a5a11d 3751 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
a770bb5a
WR		 3752 u8 secure;
3753
3754 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3755 secure = 1;
3756 else
3757 secure = 0;
3758
744cf19e 3759 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3760 }
980e1a53 3761
b6f98044 3762unlock:
052b30b0 3763 hci_dev_unlock(hdev);
a9de9248
MH		 3764}
3765
cb6f3f7a
JH		 3766static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3767{
3768 if (key_type == HCI_LK_CHANGED_COMBINATION)
3769 return;
3770
3771 conn->pin_length = pin_len;
3772 conn->key_type = key_type;
3773
3774 switch (key_type) {
3775 case HCI_LK_LOCAL_UNIT:
3776 case HCI_LK_REMOTE_UNIT:
3777 case HCI_LK_DEBUG_COMBINATION:
3778 return;
3779 case HCI_LK_COMBINATION:
3780 if (pin_len == 16)
3781 conn->pending_sec_level = BT_SECURITY_HIGH;
3782 else
3783 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3784 break;
3785 case HCI_LK_UNAUTH_COMBINATION_P192:
3786 case HCI_LK_UNAUTH_COMBINATION_P256:
3787 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3788 break;
3789 case HCI_LK_AUTH_COMBINATION_P192:
3790 conn->pending_sec_level = BT_SECURITY_HIGH;
3791 break;
3792 case HCI_LK_AUTH_COMBINATION_P256:
3793 conn->pending_sec_level = BT_SECURITY_FIPS;
3794 break;
3795 }
3796}
3797
6039aa73 3798static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3799{
55ed8ca1
JH		 3800 struct hci_ev_link_key_req *ev = (void *) skb->data;
3801 struct hci_cp_link_key_reply cp;
3802 struct hci_conn *conn;
3803 struct link_key *key;
3804
a9de9248 3805 BT_DBG("%s", hdev->name);
55ed8ca1 3806
d7a5a11d 3807 if (!hci_dev_test_flag(hdev, HCI_MGMT))
55ed8ca1
JH		 3808 return;
3809
3810 hci_dev_lock(hdev);
3811
3812 key = hci_find_link_key(hdev, &ev->bdaddr);
3813 if (!key) {
6ed93dc6
AE		 3814 BT_DBG("%s link key not found for %pMR", hdev->name,
3815 &ev->bdaddr);
55ed8ca1
JH		 3816 goto not_found;
3817 }
3818
6ed93dc6
AE		 3819 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3820 &ev->bdaddr);
55ed8ca1 3821
55ed8ca1 3822 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3823 if (conn) {
fe8bc5ac
JH		 3824 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3825
66138ce8
MH		 3826 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3827 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3828 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3829 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3830 goto not_found;
3831 }
55ed8ca1 3832
60b83f57 3833 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3834 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3835 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3836 BT_DBG("%s ignoring key unauthenticated for high security",
3837 hdev->name);
60b83f57
WR		 3838 goto not_found;
3839 }
3840
cb6f3f7a 3841 conn_set_key(conn, key->type, key->pin_len);
55ed8ca1
JH		 3842 }
3843
3844 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3845 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3846
3847 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3848
3849 hci_dev_unlock(hdev);
3850
3851 return;
3852
3853not_found:
3854 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3855 hci_dev_unlock(hdev);
a9de9248
MH		 3856}
3857
6039aa73 3858static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3859{
052b30b0
MH		 3860 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3861 struct hci_conn *conn;
7652ff6a
JH		 3862 struct link_key *key;
3863 bool persistent;
55ed8ca1 3864 u8 pin_len = 0;
052b30b0 3865
a9de9248 3866 BT_DBG("%s", hdev->name);
052b30b0
MH		 3867
3868 hci_dev_lock(hdev);
3869
3870 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
82c13d42
JH		 3871 if (!conn)
3872 goto unlock;
3873
3874 hci_conn_hold(conn);
3875 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3876 hci_conn_drop(conn);
3877
fe8bc5ac 3878 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
82c13d42 3879 conn_set_key(conn, ev->key_type, conn->pin_length);
052b30b0 3880
d7a5a11d 3881 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7652ff6a
JH		 3882 goto unlock;
3883
3884 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3885 ev->key_type, pin_len, &persistent);
3886 if (!key)
3887 goto unlock;
3888
cb6f3f7a
JH		 3889 /* Update connection information since adding the key will have
3890 * fixed up the type in the case of changed combination keys.
3891 */
3892 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3893 conn_set_key(conn, key->type, key->pin_len);
3894
7652ff6a 3895 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3896
6d5650c4
JH		 3897 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3898 * is set. If it's not set simply remove the key from the kernel
3899 * list (we've still notified user space about it but with
3900 * store_hint being 0).
3901 */
3902 if (key->type == HCI_LK_DEBUG_COMBINATION &&
d7a5a11d 3903 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
0378b597
JH		 3904 list_del_rcu(&key->list);
3905 kfree_rcu(key, rcu);
82c13d42 3906 goto unlock;
6d5650c4 3907 }
7652ff6a 3908
82c13d42
JH		 3909 if (persistent)
3910 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3911 else
3912 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3913
7652ff6a 3914unlock:
052b30b0 3915 hci_dev_unlock(hdev);
a9de9248
MH		 3916}
3917
6039aa73 3918static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3919{
a9de9248 3920 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3921 struct hci_conn *conn;
1da177e4 3922
9f1db00c 3923 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3924
3925 hci_dev_lock(hdev);
3926
04837f64 3927 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3928 if (conn && !ev->status) {
3929 struct inquiry_entry *ie;
3930
cc11b9c1
AE		 3931 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3932 if (ie) {
1da177e4
LT		 3933 ie->data.clock_offset = ev->clock_offset;
3934 ie->timestamp = jiffies;
3935 }
3936 }
3937
3938 hci_dev_unlock(hdev);
3939}
3940
6039aa73 3941static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 3942{
3943 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3944 struct hci_conn *conn;
3945
9f1db00c 3946 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 3947
3948 hci_dev_lock(hdev);
3949
3950 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3951 if (conn && !ev->status)
3952 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3953
3954 hci_dev_unlock(hdev);
3955}
3956
6039aa73 3957static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 3958{
a9de9248 3959 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 3960 struct inquiry_entry *ie;
3961
3962 BT_DBG("%s", hdev->name);
3963
3964 hci_dev_lock(hdev);
3965
cc11b9c1
AE		 3966 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3967 if (ie) {
85a1e930
MH		 3968 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3969 ie->timestamp = jiffies;
3970 }
3971
3972 hci_dev_unlock(hdev);
3973}
3974
6039aa73
GP		 3975static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3976 struct sk_buff *skb)
a9de9248
MH		 3977{
3978 struct inquiry_data data;
3979 int num_rsp = *((__u8 *) skb->data);
3980
3981 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3982
3983 if (!num_rsp)
3984 return;
3985
d7a5a11d 3986 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 3987 return;
3988
a9de9248
MH		 3989 hci_dev_lock(hdev);
3990
3991 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 3992 struct inquiry_info_with_rssi_and_pscan_mode *info;
3993 info = (void *) (skb->data + 1);
a9de9248 3994
e17acd40 3995 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 3996 u32 flags;
3997
a9de9248
MH		 3998 bacpy(&data.bdaddr, &info->bdaddr);
3999 data.pscan_rep_mode = info->pscan_rep_mode;
4000 data.pscan_period_mode = info->pscan_period_mode;
4001 data.pscan_mode = info->pscan_mode;
4002 memcpy(data.dev_class, info->dev_class, 3);
4003 data.clock_offset = info->clock_offset;
4004 data.rssi = info->rssi;
41a96212 4005 data.ssp_mode = 0x00;
3175405b 4006
af58925c
MH		 4007 flags = hci_inquiry_cache_update(hdev, &data, false);
4008
48264f06 4009 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 4010 info->dev_class, info->rssi,
af58925c 4011 flags, NULL, 0, NULL, 0);
a9de9248
MH		 4012 }
4013 } else {
4014 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4015
e17acd40 4016 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 4017 u32 flags;
4018
a9de9248
MH		 4019 bacpy(&data.bdaddr, &info->bdaddr);
4020 data.pscan_rep_mode = info->pscan_rep_mode;
4021 data.pscan_period_mode = info->pscan_period_mode;
4022 data.pscan_mode = 0x00;
4023 memcpy(data.dev_class, info->dev_class, 3);
4024 data.clock_offset = info->clock_offset;
4025 data.rssi = info->rssi;
41a96212 4026 data.ssp_mode = 0x00;
af58925c
MH		 4027
4028 flags = hci_inquiry_cache_update(hdev, &data, false);
4029
48264f06 4030 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 4031 info->dev_class, info->rssi,
af58925c 4032 flags, NULL, 0, NULL, 0);
a9de9248
MH		 4033 }
4034 }
4035
4036 hci_dev_unlock(hdev);
4037}
4038
6039aa73
GP		 4039static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4040 struct sk_buff *skb)
a9de9248 4041{
41a96212
MH		 4042 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4043 struct hci_conn *conn;
4044
a9de9248 4045 BT_DBG("%s", hdev->name);
41a96212 4046
41a96212
MH		 4047 hci_dev_lock(hdev);
4048
4049 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 4050 if (!conn)
4051 goto unlock;
41a96212 4052
cad718ed
JH		 4053 if (ev->page < HCI_MAX_PAGES)
4054 memcpy(conn->features[ev->page], ev->features, 8);
4055
ccd556fe
JH		 4056 if (!ev->status && ev->page == 0x01) {
4057 struct inquiry_entry *ie;
41a96212 4058
cc11b9c1
AE		 4059 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4060 if (ie)
02b7cc62 4061 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 4062
bbb0eada 4063 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 4064 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 4065 } else {
4066 /* It is mandatory by the Bluetooth specification that
4067 * Extended Inquiry Results are only used when Secure
4068 * Simple Pairing is enabled, but some devices violate
4069 * this.
4070 *
4071 * To make these devices work, the internal SSP
4072 * enabled flag needs to be cleared if the remote host
4073 * features do not indicate SSP support */
4074 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4075 }
eb9a8f3f
MH		 4076
4077 if (ev->features[0] & LMP_HOST_SC)
4078 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 4079 }
4080
4081 if (conn->state != BT_CONFIG)
4082 goto unlock;
4083
671267bf 4084 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 4085 struct hci_cp_remote_name_req cp;
4086 memset(&cp, 0, sizeof(cp));
4087 bacpy(&cp.bdaddr, &conn->dst);
4088 cp.pscan_rep_mode = 0x02;
4089 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 4090 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4091 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 4092
127178d2 4093 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 4094 conn->state = BT_CONNECTED;
539c496d 4095 hci_connect_cfm(conn, ev->status);
76a68ba0 4096 hci_conn_drop(conn);
41a96212
MH		 4097 }
4098
ccd556fe 4099unlock:
41a96212 4100 hci_dev_unlock(hdev);
a9de9248
MH		 4101}
4102
6039aa73
GP		 4103static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4104 struct sk_buff *skb)
a9de9248 4105{
b6a0dc82
MH		 4106 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4107 struct hci_conn *conn;
4108
9f1db00c 4109 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 4110
4111 hci_dev_lock(hdev);
4112
4113 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 4114 if (!conn) {
4115 if (ev->link_type == ESCO_LINK)
4116 goto unlock;
4117
618353b1
KP		 4118 /* When the link type in the event indicates SCO connection
4119 * and lookup of the connection object fails, then check
4120 * if an eSCO connection object exists.
4121 *
4122 * The core limits the synchronous connections to either
4123 * SCO or eSCO. The eSCO connection is preferred and tried
4124 * to be setup first and until successfully established,
4125 * the link type will be hinted as eSCO.
4126 */
9dc0a3af
MH		 4127 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4128 if (!conn)
4129 goto unlock;
9dc0a3af 4130 }
b6a0dc82 4131
732547f9
MH		 4132 switch (ev->status) {
4133 case 0x00:
b6a0dc82
MH		 4134 conn->handle = __le16_to_cpu(ev->handle);
4135 conn->state = BT_CONNECTED;
618353b1 4136 conn->type = ev->link_type;
7d0db0a3 4137
23b9ceb7 4138 hci_debugfs_create_conn(conn);
7d0db0a3 4139 hci_conn_add_sysfs(conn);
732547f9
MH		 4140 break;
4141
81218d20 4142 case 0x10: /* Connection Accept Timeout */
1a4c958c 4143 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 4144 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 4145 case 0x1c: /* SCO interval rejected */
1038a00b 4146 case 0x1a: /* Unsupported Remote Feature */
732547f9 4147 case 0x1f: /* Unspecified error */
27539bc4 4148 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 4149 if (conn->out) {
732547f9
MH		 4150 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4151 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 4152 if (hci_setup_sync(conn, conn->link->handle))
4153 goto unlock;
732547f9
MH		 4154 }
4155 /* fall through */
4156
4157 default:
b6a0dc82 4158 conn->state = BT_CLOSED;
732547f9
MH		 4159 break;
4160 }
b6a0dc82 4161
539c496d 4162 hci_connect_cfm(conn, ev->status);
b6a0dc82
MH		 4163 if (ev->status)
4164 hci_conn_del(conn);
4165
4166unlock:
4167 hci_dev_unlock(hdev);
a9de9248
MH		 4168}
4169
efdcf8e3
MH		 4170static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4171{
4172 size_t parsed = 0;
4173
4174 while (parsed < eir_len) {
4175 u8 field_len = eir[0];
4176
4177 if (field_len == 0)
4178 return parsed;
4179
4180 parsed += field_len + 1;
4181 eir += field_len + 1;
4182 }
4183
4184 return eir_len;
4185}
4186
6039aa73
GP		 4187static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4188 struct sk_buff *skb)
1da177e4 4189{
a9de9248
MH		 4190 struct inquiry_data data;
4191 struct extended_inquiry_info *info = (void *) (skb->data + 1);
4192 int num_rsp = *((__u8 *) skb->data);
9d939d94 4193 size_t eir_len;
1da177e4 4194
a9de9248 4195 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 4196
a9de9248
MH		 4197 if (!num_rsp)
4198 return;
1da177e4 4199
d7a5a11d 4200 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 4201 return;
4202
a9de9248
MH		 4203 hci_dev_lock(hdev);
4204
e17acd40 4205 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 4206 u32 flags;
4207 bool name_known;
561aafbc 4208
a9de9248 4209 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 4210 data.pscan_rep_mode = info->pscan_rep_mode;
4211 data.pscan_period_mode = info->pscan_period_mode;
4212 data.pscan_mode = 0x00;
a9de9248 4213 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 4214 data.clock_offset = info->clock_offset;
4215 data.rssi = info->rssi;
41a96212 4216 data.ssp_mode = 0x01;
561aafbc 4217
d7a5a11d 4218 if (hci_dev_test_flag(hdev, HCI_MGMT))
0d3b7f64
JH		 4219 name_known = eir_get_data(info->data,
4220 sizeof(info->data),
4221 EIR_NAME_COMPLETE, NULL);
561aafbc
JH		 4222 else
4223 name_known = true;
4224
af58925c
MH		 4225 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4226
9d939d94 4227 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 4228
48264f06 4229 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 4230 info->dev_class, info->rssi,
4231 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 4232 }
4233
4234 hci_dev_unlock(hdev);
4235}
1da177e4 4236
1c2e0041
JH		 4237static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4238 struct sk_buff *skb)
4239{
4240 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4241 struct hci_conn *conn;
4242
9f1db00c 4243 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 4244 __le16_to_cpu(ev->handle));
4245
4246 hci_dev_lock(hdev);
4247
4248 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4249 if (!conn)
4250 goto unlock;
4251
9eb1fbfa
JH		 4252 /* For BR/EDR the necessary steps are taken through the
4253 * auth_complete event.
4254 */
4255 if (conn->type != LE_LINK)
4256 goto unlock;
4257
1c2e0041
JH		 4258 if (!ev->status)
4259 conn->sec_level = conn->pending_sec_level;
4260
4261 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4262
4263 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 4264 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 4265 hci_conn_drop(conn);
1c2e0041
JH		 4266 goto unlock;
4267 }
4268
4269 if (conn->state == BT_CONFIG) {
4270 if (!ev->status)
4271 conn->state = BT_CONNECTED;
4272
539c496d 4273 hci_connect_cfm(conn, ev->status);
76a68ba0 4274 hci_conn_drop(conn);
1c2e0041
JH		 4275 } else {
4276 hci_auth_cfm(conn, ev->status);
4277
4278 hci_conn_hold(conn);
4279 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4280 hci_conn_drop(conn);
1c2e0041
JH		 4281 }
4282
4283unlock:
4284 hci_dev_unlock(hdev);
4285}
4286
6039aa73 4287static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 4288{
17fa4b9d 4289 /* If remote requests no-bonding follow that lead */
acabae96
MA		 4290 if (conn->remote_auth == HCI_AT_NO_BONDING ||
4291 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 4292 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 4293
b7f94c88
MA		 4294 /* If both remote and local have enough IO capabilities, require
4295 * MITM protection
4296 */
4297 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4298 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4299 return conn->remote_auth | 0x01;
4300
7e74170a
TM		 4301 /* No MITM protection possible so ignore remote requirement */
4302 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 4303}
4304
a83ed81e
MH		 4305static u8 bredr_oob_data_present(struct hci_conn *conn)
4306{
4307 struct hci_dev *hdev = conn->hdev;
4308 struct oob_data *data;
4309
4310 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4311 if (!data)
4312 return 0x00;
4313
455c2ff0
MH		 4314 if (bredr_sc_enabled(hdev)) {
4315 /* When Secure Connections is enabled, then just
4316 * return the present value stored with the OOB
4317 * data. The stored value contains the right present
4318 * information. However it can only be trusted when
4319 * not in Secure Connection Only mode.
4320 */
4321 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4322 return data->present;
659c7fb0 4323
455c2ff0
MH		 4324 /* When Secure Connections Only mode is enabled, then
4325 * the P-256 values are required. If they are not
4326 * available, then do not declare that OOB data is
4327 * present.
659c7fb0 4328 */
455c2ff0
MH		 4329 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4330 !memcmp(data->hash256, ZERO_KEY, 16))
659c7fb0
MH		 4331 return 0x00;
4332
455c2ff0 4333 return 0x02;
659c7fb0 4334 }
a83ed81e 4335
455c2ff0
MH		 4336 /* When Secure Connections is not enabled or actually
4337 * not supported by the hardware, then check that if
4338 * P-192 data values are present.
4339 */
4340 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4341 !memcmp(data->hash192, ZERO_KEY, 16))
4342 return 0x00;
4343
4344 return 0x01;
a83ed81e
MH		 4345}
4346
6039aa73 4347static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 4348{
4349 struct hci_ev_io_capa_request *ev = (void *) skb->data;
4350 struct hci_conn *conn;
4351
4352 BT_DBG("%s", hdev->name);
4353
4354 hci_dev_lock(hdev);
4355
4356 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 4357 if (!conn)
4358 goto unlock;
4359
4360 hci_conn_hold(conn);
4361
d7a5a11d 4362 if (!hci_dev_test_flag(hdev, HCI_MGMT))
03b555e1
JH		 4363 goto unlock;
4364
2f407f0a
JH		 4365 /* Allow pairing if we're pairable, the initiators of the
4366 * pairing or if the remote is not requesting bonding.
4367 */
d7a5a11d 4368 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
2f407f0a 4369 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 4370 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 4371 struct hci_cp_io_capability_reply cp;
4372
4373 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 4374 /* Change the IO capability from KeyboardDisplay
4375 * to DisplayYesNo as it is not supported by BT spec. */
4376 cp.capability = (conn->io_capability == 0x04) ?
a767631a 4377 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 4378
4379 /* If we are initiators, there is no remote information yet */
4380 if (conn->remote_auth == 0xff) {
b16c6604 4381 /* Request MITM protection if our IO caps allow it
4ad51a75 4382 * except for the no-bonding case.
b16c6604 4383 */
6fd6b915 4384 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 4385 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 4386 conn->auth_type |= 0x01;
b7f94c88
MA		 4387 } else {
4388 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 4389 }
17fa4b9d 4390
82c295b1
JH		 4391 /* If we're not bondable, force one of the non-bondable
4392 * authentication requirement values.
4393 */
d7a5a11d 4394 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
82c295b1
JH		 4395 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4396
4397 cp.authentication = conn->auth_type;
a83ed81e 4398 cp.oob_data = bredr_oob_data_present(conn);
ce85ee13 4399
17fa4b9d 4400 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 4401 sizeof(cp), &cp);
03b555e1
JH		 4402 } else {
4403 struct hci_cp_io_capability_neg_reply cp;
4404
4405 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 4406 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 4407
03b555e1 4408 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 4409 sizeof(cp), &cp);
03b555e1
JH		 4410 }
4411
4412unlock:
4413 hci_dev_unlock(hdev);
4414}
4415
6039aa73 4416static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 4417{
4418 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4419 struct hci_conn *conn;
4420
4421 BT_DBG("%s", hdev->name);
4422
4423 hci_dev_lock(hdev);
4424
4425 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4426 if (!conn)
4427 goto unlock;
4428
03b555e1 4429 conn->remote_cap = ev->capability;
03b555e1
JH		 4430 conn->remote_auth = ev->authentication;
4431
4432unlock:
0493684e
MH		 4433 hci_dev_unlock(hdev);
4434}
4435
6039aa73
GP		 4436static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4437 struct sk_buff *skb)
a5c29683
JH		 4438{
4439 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 4440 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 4441 struct hci_conn *conn;
a5c29683
JH		 4442
4443 BT_DBG("%s", hdev->name);
4444
4445 hci_dev_lock(hdev);
4446
d7a5a11d 4447 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7a828908 4448 goto unlock;
a5c29683 4449
7a828908
JH		 4450 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4451 if (!conn)
4452 goto unlock;
4453
4454 loc_mitm = (conn->auth_type & 0x01);
4455 rem_mitm = (conn->remote_auth & 0x01);
4456
4457 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 4458 * (it has NoInputNoOutput) then reject the confirmation
4459 * request. We check the security level here since it doesn't
4460 * necessarily match conn->auth_type.
6fd6b915 4461 */
6c53823a
JH		 4462 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4463 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 4464 BT_DBG("Rejecting request: remote device can't provide MITM");
4465 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 4466 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4467 goto unlock;
4468 }
4469
4470 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 4471 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4472 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 4473
4474 /* If we're not the initiators request authorization to
4475 * proceed from user space (mgmt_user_confirm with
ba15a58b 4476 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 4477 * side had MITM or if the local IO capability is
4478 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 4479 */
4480 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 4481 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 4482 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 4483 BT_DBG("Confirming auto-accept as acceptor");
4484 confirm_hint = 1;
4485 goto confirm;
4486 }
4487
9f61656a 4488 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 4489 hdev->auto_accept_delay);
9f61656a
JH		 4490
4491 if (hdev->auto_accept_delay > 0) {
4492 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 4493 queue_delayed_work(conn->hdev->workqueue,
4494 &conn->auto_accept_work, delay);
9f61656a
JH		 4495 goto unlock;
4496 }
4497
7a828908 4498 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 4499 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4500 goto unlock;
4501 }
4502
55bc1a37 4503confirm:
39adbffe
JH		 4504 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4505 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 4506
4507unlock:
a5c29683
JH		 4508 hci_dev_unlock(hdev);
4509}
4510
6039aa73
GP		 4511static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4512 struct sk_buff *skb)
1143d458
BG		 4513{
4514 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4515
4516 BT_DBG("%s", hdev->name);
4517
d7a5a11d 4518 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 4519 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 4520}
4521
92a25256
JH		 4522static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4523 struct sk_buff *skb)
4524{
4525 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4526 struct hci_conn *conn;
4527
4528 BT_DBG("%s", hdev->name);
4529
4530 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4531 if (!conn)
4532 return;
4533
4534 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4535 conn->passkey_entered = 0;
4536
d7a5a11d 4537 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4538 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4539 conn->dst_type, conn->passkey_notify,
4540 conn->passkey_entered);
4541}
4542
4543static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4544{
4545 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4546 struct hci_conn *conn;
4547
4548 BT_DBG("%s", hdev->name);
4549
4550 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4551 if (!conn)
4552 return;
4553
4554 switch (ev->type) {
4555 case HCI_KEYPRESS_STARTED:
4556 conn->passkey_entered = 0;
4557 return;
4558
4559 case HCI_KEYPRESS_ENTERED:
4560 conn->passkey_entered++;
4561 break;
4562
4563 case HCI_KEYPRESS_ERASED:
4564 conn->passkey_entered--;
4565 break;
4566
4567 case HCI_KEYPRESS_CLEARED:
4568 conn->passkey_entered = 0;
4569 break;
4570
4571 case HCI_KEYPRESS_COMPLETED:
4572 return;
4573 }
4574
d7a5a11d 4575 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4576 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4577 conn->dst_type, conn->passkey_notify,
4578 conn->passkey_entered);
4579}
4580
6039aa73
GP		 4581static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4582 struct sk_buff *skb)
0493684e
MH		 4583{
4584 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4585 struct hci_conn *conn;
4586
4587 BT_DBG("%s", hdev->name);
4588
4589 hci_dev_lock(hdev);
4590
4591 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 4592 if (!conn)
4593 goto unlock;
4594
c1d4fa7a
JH		 4595 /* Reset the authentication requirement to unknown */
4596 conn->remote_auth = 0xff;
4597
2a611692
JH		 4598 /* To avoid duplicate auth_failed events to user space we check
4599 * the HCI_CONN_AUTH_PEND flag which will be set if we
4600 * initiated the authentication. A traditional auth_complete
4601 * event gets always produced as initiator and is also mapped to
4602 * the mgmt_auth_failed event */
fa1bd918 4603 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 4604 mgmt_auth_failed(conn, ev->status);
0493684e 4605
76a68ba0 4606 hci_conn_drop(conn);
2a611692
JH		 4607
4608unlock:
0493684e
MH		 4609 hci_dev_unlock(hdev);
4610}
4611
6039aa73
GP		 4612static void hci_remote_host_features_evt(struct hci_dev *hdev,
4613 struct sk_buff *skb)
41a96212
MH		 4614{
4615 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4616 struct inquiry_entry *ie;
cad718ed 4617 struct hci_conn *conn;
41a96212
MH		 4618
4619 BT_DBG("%s", hdev->name);
4620
4621 hci_dev_lock(hdev);
4622
cad718ed
JH		 4623 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4624 if (conn)
4625 memcpy(conn->features[1], ev->features, 8);
4626
cc11b9c1
AE		 4627 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4628 if (ie)
02b7cc62 4629 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 4630
4631 hci_dev_unlock(hdev);
4632}
4633
6039aa73
GP		 4634static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4635 struct sk_buff *skb)
2763eda6
SJ		 4636{
4637 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4638 struct oob_data *data;
4639
4640 BT_DBG("%s", hdev->name);
4641
4642 hci_dev_lock(hdev);
4643
d7a5a11d 4644 if (!hci_dev_test_flag(hdev, HCI_MGMT))
e1ba1f15
SJ		 4645 goto unlock;
4646
6928a924 4647 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
6665d057
MH		 4648 if (!data) {
4649 struct hci_cp_remote_oob_data_neg_reply cp;
519ca9d0 4650
6665d057
MH		 4651 bacpy(&cp.bdaddr, &ev->bdaddr);
4652 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4653 sizeof(cp), &cp);
4654 goto unlock;
4655 }
2763eda6 4656
6665d057
MH		 4657 if (bredr_sc_enabled(hdev)) {
4658 struct hci_cp_remote_oob_ext_data_reply cp;
519ca9d0 4659
6665d057 4660 bacpy(&cp.bdaddr, &ev->bdaddr);
d7a5a11d 4661 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6665d057
MH		 4662 memset(cp.hash192, 0, sizeof(cp.hash192));
4663 memset(cp.rand192, 0, sizeof(cp.rand192));
4664 } else {
4665 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4666 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
519ca9d0 4667 }
6665d057
MH		 4668 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4669 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4670
4671 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4672 sizeof(cp), &cp);
2763eda6 4673 } else {
6665d057 4674 struct hci_cp_remote_oob_data_reply cp;
2763eda6
SJ		 4675
4676 bacpy(&cp.bdaddr, &ev->bdaddr);
6665d057
MH		 4677 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4678 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4679
4680 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
519ca9d0 4681 sizeof(cp), &cp);
2763eda6
SJ		 4682 }
4683
e1ba1f15 4684unlock:
2763eda6
SJ		 4685 hci_dev_unlock(hdev);
4686}
4687
a77a6a14
AW		 4688#if IS_ENABLED(CONFIG_BT_HS)
4689static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4690{
4691 struct hci_ev_channel_selected *ev = (void *)skb->data;
4692 struct hci_conn *hcon;
4693
4694 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4695
4696 skb_pull(skb, sizeof(*ev));
4697
4698 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4699 if (!hcon)
4700 return;
4701
4702 amp_read_loc_assoc_final_data(hdev, hcon);
4703}
4704
d5e91192
AE		 4705static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4706 struct sk_buff *skb)
4707{
4708 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4709 struct hci_conn *hcon, *bredr_hcon;
4710
4711 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4712 ev->status);
4713
4714 hci_dev_lock(hdev);
4715
4716 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4717 if (!hcon) {
4718 hci_dev_unlock(hdev);
4719 return;
4720 }
4721
4722 if (ev->status) {
4723 hci_conn_del(hcon);
4724 hci_dev_unlock(hdev);
4725 return;
4726 }
4727
4728 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4729
4730 hcon->state = BT_CONNECTED;
4731 bacpy(&hcon->dst, &bredr_hcon->dst);
4732
4733 hci_conn_hold(hcon);
4734 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4735 hci_conn_drop(hcon);
d5e91192 4736
23b9ceb7 4737 hci_debugfs_create_conn(hcon);
d5e91192
AE		 4738 hci_conn_add_sysfs(hcon);
4739
cf70ff22 4740 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4741
cf70ff22 4742 hci_dev_unlock(hdev);
d5e91192
AE		 4743}
4744
27695fb4
AE		 4745static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4746{
4747 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4748 struct hci_conn *hcon;
4749 struct hci_chan *hchan;
4750 struct amp_mgr *mgr;
4751
4752 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4753 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4754 ev->status);
4755
4756 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4757 if (!hcon)
4758 return;
4759
4760 /* Create AMP hchan */
4761 hchan = hci_chan_create(hcon);
4762 if (!hchan)
4763 return;
4764
4765 hchan->handle = le16_to_cpu(ev->handle);
4766
4767 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4768
4769 mgr = hcon->amp_mgr;
4770 if (mgr && mgr->bredr_chan) {
4771 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4772
4773 l2cap_chan_lock(bredr_chan);
4774
4775 bredr_chan->conn->mtu = hdev->block_mtu;
4776 l2cap_logical_cfm(bredr_chan, hchan, 0);
4777 hci_conn_hold(hcon);
4778
4779 l2cap_chan_unlock(bredr_chan);
4780 }
4781}
4782
606e2a10
AE		 4783static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4784 struct sk_buff *skb)
4785{
4786 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4787 struct hci_chan *hchan;
4788
4789 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4790 le16_to_cpu(ev->handle), ev->status);
4791
4792 if (ev->status)
4793 return;
4794
4795 hci_dev_lock(hdev);
4796
4797 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4798 if (!hchan)
4799 goto unlock;
4800
4801 amp_destroy_logical_link(hchan, ev->reason);
4802
4803unlock:
4804 hci_dev_unlock(hdev);
4805}
4806
9eef6b3a
AE		 4807static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4808 struct sk_buff *skb)
4809{
4810 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4811 struct hci_conn *hcon;
4812
4813 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4814
4815 if (ev->status)
4816 return;
4817
4818 hci_dev_lock(hdev);
4819
4820 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4821 if (hcon) {
4822 hcon->state = BT_CLOSED;
4823 hci_conn_del(hcon);
4824 }
4825
4826 hci_dev_unlock(hdev);
4827}
a77a6a14 4828#endif
9eef6b3a 4829
d12fb056
JK		 4830static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4831 bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4832 u16 interval, u16 latency, u16 supervision_timeout)
fcd89c09 4833{
912b42ef 4834 struct hci_conn_params *params;
fcd89c09 4835 struct hci_conn *conn;
68d6f6de 4836 struct smp_irk *irk;
837d502e 4837 u8 addr_type;
fcd89c09 4838
fcd89c09
VT		 4839 hci_dev_lock(hdev);
4840
fbd96c15
JH		 4841 /* All controllers implicitly stop advertising in the event of a
4842 * connection, so ensure that the state bit is cleared.
4843 */
a358dc11 4844 hci_dev_clear_flag(hdev, HCI_LE_ADV);
fbd96c15 4845
e7d9ab73 4846 conn = hci_lookup_le_connect(hdev);
b62f328b 4847 if (!conn) {
d12fb056 4848 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
b62f328b 4849 if (!conn) {
2064ee33 4850 bt_dev_err(hdev, "no memory for new connection");
230fd16a 4851 goto unlock;
b62f328b 4852 }
29b7988a 4853
d12fb056 4854 conn->dst_type = bdaddr_type;
b9b343d2 4855
cb1d68f7
JH		 4856 /* If we didn't have a hci_conn object previously
4857 * but we're in master role this must be something
4858 * initiated using a white list. Since white list based
4859 * connections are not "first class citizens" we don't
4860 * have full tracking of them. Therefore, we go ahead
4861 * with a "best effort" approach of determining the
4862 * initiator address based on the HCI_PRIVACY flag.
4863 */
4864 if (conn->out) {
d12fb056
JK		 4865 conn->resp_addr_type = bdaddr_type;
4866 bacpy(&conn->resp_addr, bdaddr);
d7a5a11d 4867 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
cb1d68f7
JH		 4868 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4869 bacpy(&conn->init_addr, &hdev->rpa);
4870 } else {
4871 hci_copy_identity_address(hdev,
4872 &conn->init_addr,
4873 &conn->init_addr_type);
4874 }
cb1d68f7 4875 }
9489eca4
JH		 4876 } else {
4877 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4878 }
fcd89c09 4879
80c24ab8
JH		 4880 if (!conn->out) {
4881 /* Set the responder (our side) address type based on
4882 * the advertising address type.
4883 */
4884 conn->resp_addr_type = hdev->adv_addr_type;
acf0aeae
JK		 4885 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4886 /* In case of ext adv, resp_addr will be updated in
4887 * Adv Terminated event.
4888 */
4889 if (!ext_adv_capable(hdev))
4890 bacpy(&conn->resp_addr, &hdev->random_addr);
4891 } else {
80c24ab8 4892 bacpy(&conn->resp_addr, &hdev->bdaddr);
acf0aeae 4893 }
80c24ab8 4894
d12fb056
JK		 4895 conn->init_addr_type = bdaddr_type;
4896 bacpy(&conn->init_addr, bdaddr);
a720d735
MH		 4897
4898 /* For incoming connections, set the default minimum
4899 * and maximum connection interval. They will be used
4900 * to check if the parameters are in range and if not
4901 * trigger the connection update procedure.
4902 */
4903 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4904 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4905 }
7be2edbb 4906
edb4b466
MH		 4907 /* Lookup the identity address from the stored connection
4908 * address and address type.
4909 *
4910 * When establishing connections to an identity address, the
4911 * connection procedure will store the resolvable random
4912 * address first. Now if it can be converted back into the
4913 * identity address, start using the identity address from
4914 * now on.
4915 */
4916 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4917 if (irk) {
4918 bacpy(&conn->dst, &irk->bdaddr);
4919 conn->dst_type = irk->addr_type;
4920 }
4921
d12fb056
JK		 4922 if (status) {
4923 hci_le_conn_failed(conn, status);
837d502e
JH		 4924 goto unlock;
4925 }
4926
08853f18
JH		 4927 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4928 addr_type = BDADDR_LE_PUBLIC;
4929 else
4930 addr_type = BDADDR_LE_RANDOM;
4931
2d3c2260
JH		 4932 /* Drop the connection if the device is blocked */
4933 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4934 hci_conn_drop(conn);
cd17decb
AG		 4935 goto unlock;
4936 }
4937
b644ba33 4938 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4939 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 4940
7b5c0d52 4941 conn->sec_level = BT_SECURITY_LOW;
d12fb056 4942 conn->handle = handle;
0fe29fd1 4943 conn->state = BT_CONFIG;
fcd89c09 4944
d12fb056
JK		 4945 conn->le_conn_interval = interval;
4946 conn->le_conn_latency = latency;
4947 conn->le_supv_timeout = supervision_timeout;
e04fde60 4948
23b9ceb7 4949 hci_debugfs_create_conn(conn);
fcd89c09
VT		 4950 hci_conn_add_sysfs(conn);
4951
d17010bf
CIK		 4952 /* The remote features procedure is defined for master
4953 * role only. So only in case of an initiated connection
4954 * request the remote features.
4955 *
4956 * If the local controller supports slave-initiated features
4957 * exchange, then requesting the remote features in slave
4958 * role is possible. Otherwise just transition into the
4959 * connected state without requesting the remote features.
4960 */
4961 if (conn->out ||
4962 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4963 struct hci_cp_le_read_remote_features cp;
0fe29fd1 4964
d17010bf 4965 cp.handle = __cpu_to_le16(conn->handle);
0fe29fd1 4966
d17010bf
CIK		 4967 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4968 sizeof(cp), &cp);
0fe29fd1 4969
d17010bf 4970 hci_conn_hold(conn);
0fe29fd1 4971 } else {
d17010bf 4972 conn->state = BT_CONNECTED;
d12fb056 4973 hci_connect_cfm(conn, status);
0fe29fd1 4974 }
fcd89c09 4975
5477610f
JH		 4976 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4977 conn->dst_type);
f161dd41 4978 if (params) {
95305baa 4979 list_del_init(&params->action);
f161dd41
JH		 4980 if (params->conn) {
4981 hci_conn_drop(params->conn);
f8aaf9b6 4982 hci_conn_put(params->conn);
f161dd41
JH		 4983 params->conn = NULL;
4984 }
4985 }
a4790dbd 4986
fcd89c09 4987unlock:
223683a5 4988 hci_update_background_scan(hdev);
fcd89c09
VT		 4989 hci_dev_unlock(hdev);
4990}
4991
d12fb056
JK		 4992static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4993{
4994 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4995
4996 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4997
4998 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
4999 ev->role, le16_to_cpu(ev->handle),
5000 le16_to_cpu(ev->interval),
5001 le16_to_cpu(ev->latency),
5002 le16_to_cpu(ev->supervision_timeout));
5003}
5004
4d94f95d
JK		 5005static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5006 struct sk_buff *skb)
5007{
5008 struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5009
5010 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5011
5012 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5013 ev->role, le16_to_cpu(ev->handle),
5014 le16_to_cpu(ev->interval),
5015 le16_to_cpu(ev->latency),
5016 le16_to_cpu(ev->supervision_timeout));
5017}
5018
acf0aeae
JK		 5019static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5020{
5021 struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5022 struct hci_conn *conn;
5023
5024 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5025
5026 if (ev->status)
5027 return;
5028
5029 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5030 if (conn) {
5031 struct adv_info *adv_instance;
5032
5033 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5034 return;
5035
5036 if (!hdev->cur_adv_instance) {
5037 bacpy(&conn->resp_addr, &hdev->random_addr);
5038 return;
5039 }
5040
5041 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5042 if (adv_instance)
5043 bacpy(&conn->resp_addr, &adv_instance->random_addr);
5044 }
5045}
5046
1855d92d
MH		 5047static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5048 struct sk_buff *skb)
5049{
5050 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5051 struct hci_conn *conn;
5052
5053 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5054
5055 if (ev->status)
5056 return;
5057
5058 hci_dev_lock(hdev);
5059
5060 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5061 if (conn) {
5062 conn->le_conn_interval = le16_to_cpu(ev->interval);
5063 conn->le_conn_latency = le16_to_cpu(ev->latency);
5064 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5065 }
5066
5067 hci_dev_unlock(hdev);
5068}
5069
a4790dbd 5070/* This function requires the caller holds hdev->lock */
fd45ada9
AA		 5071static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5072 bdaddr_t *addr,
082f2300
SJ		 5073 u8 addr_type, u8 adv_type,
5074 bdaddr_t *direct_rpa)
a4790dbd
AG		 5075{
5076 struct hci_conn *conn;
4b9e7e75 5077 struct hci_conn_params *params;
a4790dbd 5078
1c1abcab
JH		 5079 /* If the event is not connectable don't proceed further */
5080 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
fd45ada9 5081 return NULL;
1c1abcab
JH		 5082
5083 /* Ignore if the device is blocked */
dcc36c16 5084 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
fd45ada9 5085 return NULL;
1c1abcab 5086
f99353cf
JH		 5087 /* Most controller will fail if we try to create new connections
5088 * while we have an existing one in slave role.
5089 */
5090 if (hdev->conn_hash.le_num_slave > 0)
fd45ada9 5091 return NULL;
f99353cf 5092
1c1abcab
JH		 5093 /* If we're not connectable only connect devices that we have in
5094 * our pend_le_conns list.
5095 */
49c50922
JH		 5096 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5097 addr_type);
4b9e7e75 5098 if (!params)
fd45ada9 5099 return NULL;
4b9e7e75 5100
28a667c9
JP		 5101 if (!params->explicit_connect) {
5102 switch (params->auto_connect) {
5103 case HCI_AUTO_CONN_DIRECT:
5104 /* Only devices advertising with ADV_DIRECT_IND are
5105 * triggering a connection attempt. This is allowing
5106 * incoming connections from slave devices.
5107 */
5108 if (adv_type != LE_ADV_DIRECT_IND)
5109 return NULL;
5110 break;
5111 case HCI_AUTO_CONN_ALWAYS:
5112 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5113 * are triggering a connection attempt. This means
5114 * that incoming connectioms from slave device are
5115 * accepted and also outgoing connections to slave
5116 * devices are established when found.
5117 */
5118 break;
5119 default:
fd45ada9 5120 return NULL;
28a667c9 5121 }
4b9e7e75 5122 }
a4790dbd
AG		 5123
5124 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
082f2300
SJ		 5125 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5126 direct_rpa);
f161dd41 5127 if (!IS_ERR(conn)) {
28a667c9
JP		 5128 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5129 * by higher layer that tried to connect, if no then
5130 * store the pointer since we don't really have any
f161dd41
JH		 5131 * other owner of the object besides the params that
5132 * triggered it. This way we can abort the connection if
5133 * the parameters get removed and keep the reference
5134 * count consistent once the connection is established.
5135 */
28a667c9
JP		 5136
5137 if (!params->explicit_connect)
5138 params->conn = hci_conn_get(conn);
5139
fd45ada9 5140 return conn;
f161dd41 5141 }
a4790dbd
AG		 5142
5143 switch (PTR_ERR(conn)) {
5144 case -EBUSY:
5145 /* If hci_connect() returns -EBUSY it means there is already
5146 * an LE connection attempt going on. Since controllers don't
5147 * support more than one connection attempt at the time, we
5148 * don't consider this an error case.
5149 */
5150 break;
5151 default:
5152 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
fd45ada9 5153 return NULL;
a4790dbd 5154 }
fd45ada9
AA		 5155
5156 return NULL;
a4790dbd
AG		 5157}
5158
4af605d8 5159static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
2f010b55
MH		 5160 u8 bdaddr_type, bdaddr_t *direct_addr,
5161 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4af605d8 5162{
b9a6328f 5163 struct discovery_state *d = &hdev->discovery;
1c1abcab 5164 struct smp_irk *irk;
fd45ada9 5165 struct hci_conn *conn;
474ee066 5166 bool match;
c70a7e4c 5167 u32 flags;
6818375e
SJ		 5168 u8 *ptr, real_len;
5169
56b40fbf
JH		 5170 switch (type) {
5171 case LE_ADV_IND:
5172 case LE_ADV_DIRECT_IND:
5173 case LE_ADV_SCAN_IND:
5174 case LE_ADV_NONCONN_IND:
5175 case LE_ADV_SCAN_RSP:
5176 break;
5177 default:
2064ee33
MH		 5178 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5179 "type: 0x%02x", type);
56b40fbf
JH		 5180 return;
5181 }
5182
6818375e
SJ		 5183 /* Find the end of the data in case the report contains padded zero
5184 * bytes at the end causing an invalid length value.
5185 *
5186 * When data is NULL, len is 0 so there is no need for extra ptr
5187 * check as 'ptr < data + 0' is already false in such case.
5188 */
5189 for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5190 if (ptr + 1 + *ptr > data + len)
5191 break;
5192 }
5193
5194 real_len = ptr - data;
5195
5196 /* Adjust for actual length */
5197 if (len != real_len) {
2064ee33 5198 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
6818375e
SJ		 5199 len = real_len;
5200 }
b9a6328f 5201
2f010b55
MH		 5202 /* If the direct address is present, then this report is from
5203 * a LE Direct Advertising Report event. In that case it is
5204 * important to see if the address is matching the local
5205 * controller address.
5206 */
5207 if (direct_addr) {
5208 /* Only resolvable random addresses are valid for these
5209 * kind of reports and others can be ignored.
5210 */
5211 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5212 return;
5213
5214 /* If the controller is not using resolvable random
5215 * addresses, then this report can be ignored.
5216 */
d7a5a11d 5217 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2f010b55
MH		 5218 return;
5219
5220 /* If the local IRK of the controller does not match
5221 * with the resolvable random address provided, then
5222 * this report can be ignored.
5223 */
5224 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5225 return;
5226 }
5227
1c1abcab
JH		 5228 /* Check if we need to convert to identity address */
5229 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5230 if (irk) {
5231 bdaddr = &irk->bdaddr;
5232 bdaddr_type = irk->addr_type;
5233 }
5234
082f2300
SJ		 5235 /* Check if we have been requested to connect to this device.
5236 *
5237 * direct_addr is set only for directed advertising reports (it is NULL
5238 * for advertising reports) and is already verified to be RPA above.
5239 */
5240 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5241 direct_addr);
fd45ada9
AA		 5242 if (conn && type == LE_ADV_IND) {
5243 /* Store report for later inclusion by
5244 * mgmt_device_connected
5245 */
5246 memcpy(conn->le_adv_data, data, len);
5247 conn->le_adv_data_len = len;
5248 }
1c1abcab 5249
0d2bf134
JH		 5250 /* Passive scanning shouldn't trigger any device found events,
5251 * except for devices marked as CONN_REPORT for which we do send
5252 * device found events.
5253 */
ca5c4be7 5254 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 5255 if (type == LE_ADV_DIRECT_IND)
5256 return;
5257
3a19b6fe
JH		 5258 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5259 bdaddr, bdaddr_type))
0d2bf134
JH		 5260 return;
5261
5262 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5263 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5264 else
5265 flags = 0;
5266 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5267 rssi, flags, data, len, NULL, 0);
97bf2e99 5268 return;
ca5c4be7 5269 }
4af605d8 5270
c70a7e4c
MH		 5271 /* When receiving non-connectable or scannable undirected
5272 * advertising reports, this means that the remote device is
5273 * not connectable and then clearly indicate this in the
5274 * device found event.
5275 *
5276 * When receiving a scan response, then there is no way to
5277 * know if the remote device is connectable or not. However
5278 * since scan responses are merged with a previously seen
5279 * advertising report, the flags field from that report
5280 * will be used.
5281 *
5282 * In the really unlikely case that a controller get confused
5283 * and just sends a scan response event, then it is marked as
5284 * not connectable as well.
5285 */
5286 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5287 type == LE_ADV_SCAN_RSP)
5288 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5289 else
5290 flags = 0;
5291
b9a6328f
JH		 5292 /* If there's nothing pending either store the data from this
5293 * event or send an immediate device found event if the data
5294 * should not be stored for later.
5295 */
5296 if (!has_pending_adv_report(hdev)) {
5297 /* If the report will trigger a SCAN_REQ store it for
5298 * later merging.
5299 */
5300 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5301 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 5302 rssi, flags, data, len);
b9a6328f
JH		 5303 return;
5304 }
5305
5306 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 5307 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 5308 return;
5309 }
5310
474ee066
JH		 5311 /* Check if the pending report is for the same device as the new one */
5312 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5313 bdaddr_type == d->last_adv_addr_type);
5314
b9a6328f
JH		 5315 /* If the pending data doesn't match this report or this isn't a
5316 * scan response (e.g. we got a duplicate ADV_IND) then force
5317 * sending of the pending data.
5318 */
474ee066
JH		 5319 if (type != LE_ADV_SCAN_RSP || !match) {
5320 /* Send out whatever is in the cache, but skip duplicates */
5321 if (!match)
5322 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 5323 d->last_adv_addr_type, NULL,
c70a7e4c 5324 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 5325 d->last_adv_data,
474ee066 5326 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 5327
5328 /* If the new report will trigger a SCAN_REQ store it for
5329 * later merging.
5330 */
5331 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5332 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 5333 rssi, flags, data, len);
b9a6328f
JH		 5334 return;
5335 }
5336
5337 /* The advertising reports cannot be merged, so clear
5338 * the pending report and send out a device found event.
5339 */
5340 clear_pending_adv_report(hdev);
5c5b93e4 5341 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 5342 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 5343 return;
5344 }
5345
5346 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5347 * the new event is a SCAN_RSP. We can therefore proceed with
5348 * sending a merged device found event.
5349 */
5350 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 5351 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 5352 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 5353 clear_pending_adv_report(hdev);
4af605d8
JH		 5354}
5355
6039aa73 5356static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 5357{
e95beb41
AG		 5358 u8 num_reports = skb->data[0];
5359 void *ptr = &skb->data[1];
9aa04c91 5360
a4790dbd
AG		 5361 hci_dev_lock(hdev);
5362
e95beb41
AG		 5363 while (num_reports--) {
5364 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 5365 s8 rssi;
a4790dbd 5366
ee649346
CC		 5367 if (ev->length <= HCI_MAX_AD_LENGTH) {
5368 rssi = ev->data[ev->length];
5369 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5370 ev->bdaddr_type, NULL, 0, rssi,
5371 ev->data, ev->length);
5372 } else {
5373 bt_dev_err(hdev, "Dropping invalid advertising data");
5374 }
3c9e9195 5375
e95beb41 5376 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 5377 }
a4790dbd
AG		 5378
5379 hci_dev_unlock(hdev);
9aa04c91
AG		 5380}
5381
b2cc9761
JK		 5382static u8 ext_evt_type_to_legacy(u16 evt_type)
5383{
5384 if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5385 switch (evt_type) {
5386 case LE_LEGACY_ADV_IND:
5387 return LE_ADV_IND;
5388 case LE_LEGACY_ADV_DIRECT_IND:
5389 return LE_ADV_DIRECT_IND;
5390 case LE_LEGACY_ADV_SCAN_IND:
5391 return LE_ADV_SCAN_IND;
5392 case LE_LEGACY_NONCONN_IND:
5393 return LE_ADV_NONCONN_IND;
5394 case LE_LEGACY_SCAN_RSP_ADV:
5395 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5396 return LE_ADV_SCAN_RSP;
5397 }
5398
5399 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5400 evt_type);
5401
5402 return LE_ADV_INVALID;
5403 }
5404
5405 if (evt_type & LE_EXT_ADV_CONN_IND) {
5406 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5407 return LE_ADV_DIRECT_IND;
5408
c215e939 5409 return LE_ADV_IND;
b2cc9761
JK		 5410 }
5411
5412 if (evt_type & LE_EXT_ADV_SCAN_RSP)
5413 return LE_ADV_SCAN_RSP;
5414
5415 if (evt_type & LE_EXT_ADV_SCAN_IND)
c215e939 5416 return LE_ADV_SCAN_IND;
b2cc9761
JK		 5417
5418 if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5419 evt_type & LE_EXT_ADV_DIRECT_IND)
c215e939 5420 return LE_ADV_NONCONN_IND;
c215e939
JK		 5421
5422 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5423 evt_type);
5424
5425 return LE_ADV_INVALID;
5426}
5427
5428static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5429{
5430 u8 num_reports = skb->data[0];
5431 void *ptr = &skb->data[1];
5432
5433 hci_dev_lock(hdev);
5434
5435 while (num_reports--) {
5436 struct hci_ev_le_ext_adv_report *ev = ptr;
5437 u8 legacy_evt_type;
5438 u16 evt_type;
5439
5440 evt_type = __le16_to_cpu(ev->evt_type);
b2cc9761 5441 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
c215e939
JK		 5442 if (legacy_evt_type != LE_ADV_INVALID) {
5443 process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5444 ev->bdaddr_type, NULL, 0, ev->rssi,
5445 ev->data, ev->length);
5446 }
5447
cd9151b6 5448 ptr += sizeof(*ev) + ev->length;
c215e939
JK		 5449 }
5450
5451 hci_dev_unlock(hdev);
5452}
5453
0fe29fd1
MH		 5454static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5455 struct sk_buff *skb)
5456{
5457 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5458 struct hci_conn *conn;
5459
5460 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5461
5462 hci_dev_lock(hdev);
5463
5464 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5465 if (conn) {
5466 if (!ev->status)
5467 memcpy(conn->features[0], ev->features, 8);
5468
5469 if (conn->state == BT_CONFIG) {
5470 __u8 status;
5471
5472 /* If the local controller supports slave-initiated
5473 * features exchange, but the remote controller does
5474 * not, then it is possible that the error code 0x1a
5475 * for unsupported remote feature gets returned.
5476 *
5477 * In this specific case, allow the connection to
5478 * transition into connected state and mark it as
5479 * successful.
5480 */
5481 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5482 !conn->out && ev->status == 0x1a)
5483 status = 0x00;
5484 else
5485 status = ev->status;
5486
5487 conn->state = BT_CONNECTED;
5488 hci_connect_cfm(conn, status);
5489 hci_conn_drop(conn);
5490 }
5491 }
5492
5493 hci_dev_unlock(hdev);
5494}
5495
6039aa73 5496static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 5497{
5498 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5499 struct hci_cp_le_ltk_reply cp;
bea710fe 5500 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 5501 struct hci_conn *conn;
c9839a11 5502 struct smp_ltk *ltk;
a7a595f6 5503
9f1db00c 5504 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 5505
5506 hci_dev_lock(hdev);
5507
5508 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 5509 if (conn == NULL)
5510 goto not_found;
a7a595f6 5511
f3a73d97 5512 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5378bc56 5513 if (!ltk)
bea710fe
VCG		 5514 goto not_found;
5515
5378bc56
JH		 5516 if (smp_ltk_is_sc(ltk)) {
5517 /* With SC both EDiv and Rand are set to zero */
5518 if (ev->ediv || ev->rand)
5519 goto not_found;
5520 } else {
5521 /* For non-SC keys check that EDiv and Rand match */
5522 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5523 goto not_found;
5524 }
5525
8b76ce34
JH		 5526 memcpy(cp.ltk, ltk->val, ltk->enc_size);
5527 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
a7a595f6 5528 cp.handle = cpu_to_le16(conn->handle);
c9839a11 5529
a6f7833c 5530 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 5531
89cbb4da 5532 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 5533
5534 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5535
5981a882
CT		 5536 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5537 * temporary key used to encrypt a connection following
5538 * pairing. It is used during the Encrypted Session Setup to
5539 * distribute the keys. Later, security can be re-established
5540 * using a distributed LTK.
5541 */
2ceba539 5542 if (ltk->type == SMP_STK) {
fe59a05f 5543 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
970d0f1b
JH		 5544 list_del_rcu(&ltk->list);
5545 kfree_rcu(ltk, rcu);
fe59a05f
JH		 5546 } else {
5547 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 5548 }
5549
a7a595f6 5550 hci_dev_unlock(hdev);
bea710fe
VCG		 5551
5552 return;
5553
5554not_found:
5555 neg.handle = ev->handle;
5556 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5557 hci_dev_unlock(hdev);
a7a595f6
VCG		 5558}
5559
8e75b46a
AG		 5560static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5561 u8 reason)
5562{
5563 struct hci_cp_le_conn_param_req_neg_reply cp;
5564
5565 cp.handle = cpu_to_le16(handle);
5566 cp.reason = reason;
5567
5568 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5569 &cp);
5570}
5571
5572static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5573 struct sk_buff *skb)
5574{
5575 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5576 struct hci_cp_le_conn_param_req_reply cp;
5577 struct hci_conn *hcon;
5578 u16 handle, min, max, latency, timeout;
5579
5580 handle = le16_to_cpu(ev->handle);
5581 min = le16_to_cpu(ev->interval_min);
5582 max = le16_to_cpu(ev->interval_max);
5583 latency = le16_to_cpu(ev->latency);
5584 timeout = le16_to_cpu(ev->timeout);
5585
5586 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5587 if (!hcon || hcon->state != BT_CONNECTED)
5588 return send_conn_param_neg_reply(hdev, handle,
5589 HCI_ERROR_UNKNOWN_CONN_ID);
5590
5591 if (hci_check_conn_params(min, max, latency, timeout))
5592 return send_conn_param_neg_reply(hdev, handle,
5593 HCI_ERROR_INVALID_LL_PARAMS);
5594
40bef302 5595 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 5596 struct hci_conn_params *params;
f4869e2a 5597 u8 store_hint;
348d50b8
JH		 5598
5599 hci_dev_lock(hdev);
5600
5601 params = hci_conn_params_lookup(hdev, &hcon->dst,
5602 hcon->dst_type);
5603 if (params) {
5604 params->conn_min_interval = min;
5605 params->conn_max_interval = max;
5606 params->conn_latency = latency;
5607 params->supervision_timeout = timeout;
f4869e2a
JH		 5608 store_hint = 0x01;
5609 } else{
5610 store_hint = 0x00;
348d50b8
JH		 5611 }
5612
5613 hci_dev_unlock(hdev);
5614
f4869e2a
JH		 5615 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5616 store_hint, min, max, latency, timeout);
348d50b8 5617 }
ffb5a827 5618
8e75b46a
AG		 5619 cp.handle = ev->handle;
5620 cp.interval_min = ev->interval_min;
5621 cp.interval_max = ev->interval_max;
5622 cp.latency = ev->latency;
5623 cp.timeout = ev->timeout;
5624 cp.min_ce_len = 0;
5625 cp.max_ce_len = 0;
5626
5627 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5628}
5629
2f010b55
MH		 5630static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5631 struct sk_buff *skb)
5632{
5633 u8 num_reports = skb->data[0];
5634 void *ptr = &skb->data[1];
5635
5636 hci_dev_lock(hdev);
5637
5638 while (num_reports--) {
5639 struct hci_ev_le_direct_adv_info *ev = ptr;
5640
5641 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5642 ev->bdaddr_type, &ev->direct_addr,
5643 ev->direct_addr_type, ev->rssi, NULL, 0);
5644
5645 ptr += sizeof(*ev);
5646 }
5647
5648 hci_dev_unlock(hdev);
5649}
5650
6039aa73 5651static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 5652{
5653 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5654
5655 skb_pull(skb, sizeof(*le_ev));
5656
5657 switch (le_ev->subevent) {
5658 case HCI_EV_LE_CONN_COMPLETE:
5659 hci_le_conn_complete_evt(hdev, skb);
5660 break;
5661
1855d92d
MH		 5662 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5663 hci_le_conn_update_complete_evt(hdev, skb);
5664 break;
5665
9aa04c91
AG		 5666 case HCI_EV_LE_ADVERTISING_REPORT:
5667 hci_le_adv_report_evt(hdev, skb);
5668 break;
5669
0fe29fd1
MH		 5670 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5671 hci_le_remote_feat_complete_evt(hdev, skb);
5672 break;
5673
a7a595f6
VCG		 5674 case HCI_EV_LE_LTK_REQ:
5675 hci_le_ltk_request_evt(hdev, skb);
5676 break;
5677
8e75b46a
AG		 5678 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5679 hci_le_remote_conn_param_req_evt(hdev, skb);
5680 break;
5681
2f010b55
MH		 5682 case HCI_EV_LE_DIRECT_ADV_REPORT:
5683 hci_le_direct_adv_report_evt(hdev, skb);
5684 break;
5685
c215e939
JK		 5686 case HCI_EV_LE_EXT_ADV_REPORT:
5687 hci_le_ext_adv_report_evt(hdev, skb);
5688 break;
5689
4d94f95d
JK		 5690 case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5691 hci_le_enh_conn_complete_evt(hdev, skb);
5692 break;
5693
acf0aeae
JK		 5694 case HCI_EV_LE_EXT_ADV_SET_TERM:
5695 hci_le_ext_adv_term_evt(hdev, skb);
5696 break;
5697
fcd89c09
VT		 5698 default:
5699 break;
5700 }
5701}
5702
757aa0b5
JH		 5703static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5704 u8 event, struct sk_buff *skb)
5705{
5706 struct hci_ev_cmd_complete *ev;
5707 struct hci_event_hdr *hdr;
5708
5709 if (!skb)
5710 return false;
5711
5712 if (skb->len < sizeof(*hdr)) {
2064ee33 5713 bt_dev_err(hdev, "too short HCI event");
757aa0b5
JH		 5714 return false;
5715 }
5716
5717 hdr = (void *) skb->data;
5718 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5719
5720 if (event) {
5721 if (hdr->evt != event)
5722 return false;
5723 return true;
5724 }
5725
1629db9c
JH		 5726 /* Check if request ended in Command Status - no way to retreive
5727 * any extra parameters in this case.
5728 */
5729 if (hdr->evt == HCI_EV_CMD_STATUS)
5730 return false;
5731
757aa0b5 5732 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
2064ee33
MH		 5733 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5734 hdr->evt);
757aa0b5
JH		 5735 return false;
5736 }
5737
5738 if (skb->len < sizeof(*ev)) {
2064ee33 5739 bt_dev_err(hdev, "too short cmd_complete event");
757aa0b5
JH		 5740 return false;
5741 }
5742
5743 ev = (void *) skb->data;
5744 skb_pull(skb, sizeof(*ev));
5745
5746 if (opcode != __le16_to_cpu(ev->opcode)) {
5747 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5748 __le16_to_cpu(ev->opcode));
5749 return false;
5750 }
5751
5752 return true;
5753}
5754
a9de9248
MH		 5755void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5756{
5757 struct hci_event_hdr *hdr = (void *) skb->data;
e6214487
JH		 5758 hci_req_complete_t req_complete = NULL;
5759 hci_req_complete_skb_t req_complete_skb = NULL;
5760 struct sk_buff *orig_skb = NULL;
757aa0b5 5761 u8 status = 0, event = hdr->evt, req_evt = 0;
e6214487 5762 u16 opcode = HCI_OP_NOP;
a9de9248 5763
242c0ebd 5764 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
c1f23a2b 5765 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
e6214487
JH		 5766 opcode = __le16_to_cpu(cmd_hdr->opcode);
5767 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5768 &req_complete_skb);
757aa0b5 5769 req_evt = event;
02350a72
JH		 5770 }
5771
e6214487
JH		 5772 /* If it looks like we might end up having to call
5773 * req_complete_skb, store a pristine copy of the skb since the
5774 * various handlers may modify the original one through
5775 * skb_pull() calls, etc.
5776 */
5777 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5778 event == HCI_EV_CMD_COMPLETE)
5779 orig_skb = skb_clone(skb, GFP_KERNEL);
5780
5781 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5782
a9de9248 5783 switch (event) {
1da177e4
LT		 5784 case HCI_EV_INQUIRY_COMPLETE:
5785 hci_inquiry_complete_evt(hdev, skb);
5786 break;
5787
5788 case HCI_EV_INQUIRY_RESULT:
5789 hci_inquiry_result_evt(hdev, skb);
5790 break;
5791
a9de9248
MH		 5792 case HCI_EV_CONN_COMPLETE:
5793 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 5794 break;
5795
1da177e4
LT		 5796 case HCI_EV_CONN_REQUEST:
5797 hci_conn_request_evt(hdev, skb);
5798 break;
5799
1da177e4
LT		 5800 case HCI_EV_DISCONN_COMPLETE:
5801 hci_disconn_complete_evt(hdev, skb);
5802 break;
5803
1da177e4
LT		 5804 case HCI_EV_AUTH_COMPLETE:
5805 hci_auth_complete_evt(hdev, skb);
5806 break;
5807
a9de9248
MH		 5808 case HCI_EV_REMOTE_NAME:
5809 hci_remote_name_evt(hdev, skb);
5810 break;
5811
1da177e4
LT		 5812 case HCI_EV_ENCRYPT_CHANGE:
5813 hci_encrypt_change_evt(hdev, skb);
5814 break;
5815
a9de9248
MH		 5816 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5817 hci_change_link_key_complete_evt(hdev, skb);
5818 break;
5819
5820 case HCI_EV_REMOTE_FEATURES:
5821 hci_remote_features_evt(hdev, skb);
5822 break;
5823
a9de9248 5824 case HCI_EV_CMD_COMPLETE:
e6214487
JH		 5825 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5826 &req_complete, &req_complete_skb);
a9de9248
MH		 5827 break;
5828
5829 case HCI_EV_CMD_STATUS:
e6214487
JH		 5830 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5831 &req_complete_skb);
a9de9248
MH		 5832 break;
5833
24dfa343
MH		 5834 case HCI_EV_HARDWARE_ERROR:
5835 hci_hardware_error_evt(hdev, skb);
5836 break;
5837
a9de9248
MH		 5838 case HCI_EV_ROLE_CHANGE:
5839 hci_role_change_evt(hdev, skb);
5840 break;
5841
5842 case HCI_EV_NUM_COMP_PKTS:
5843 hci_num_comp_pkts_evt(hdev, skb);
5844 break;
5845
5846 case HCI_EV_MODE_CHANGE:
5847 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 5848 break;
5849
5850 case HCI_EV_PIN_CODE_REQ:
5851 hci_pin_code_request_evt(hdev, skb);
5852 break;
5853
5854 case HCI_EV_LINK_KEY_REQ:
5855 hci_link_key_request_evt(hdev, skb);
5856 break;
5857
5858 case HCI_EV_LINK_KEY_NOTIFY:
5859 hci_link_key_notify_evt(hdev, skb);
5860 break;
5861
5862 case HCI_EV_CLOCK_OFFSET:
5863 hci_clock_offset_evt(hdev, skb);
5864 break;
5865
a8746417
MH		 5866 case HCI_EV_PKT_TYPE_CHANGE:
5867 hci_pkt_type_change_evt(hdev, skb);
5868 break;
5869
85a1e930
MH		 5870 case HCI_EV_PSCAN_REP_MODE:
5871 hci_pscan_rep_mode_evt(hdev, skb);
5872 break;
5873
a9de9248
MH		 5874 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5875 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 5876 break;
5877
a9de9248
MH		 5878 case HCI_EV_REMOTE_EXT_FEATURES:
5879 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 5880 break;
5881
a9de9248
MH		 5882 case HCI_EV_SYNC_CONN_COMPLETE:
5883 hci_sync_conn_complete_evt(hdev, skb);
5884 break;
1da177e4 5885
a9de9248
MH		 5886 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5887 hci_extended_inquiry_result_evt(hdev, skb);
5888 break;
1da177e4 5889
1c2e0041
JH		 5890 case HCI_EV_KEY_REFRESH_COMPLETE:
5891 hci_key_refresh_complete_evt(hdev, skb);
5892 break;
5893
0493684e
MH		 5894 case HCI_EV_IO_CAPA_REQUEST:
5895 hci_io_capa_request_evt(hdev, skb);
5896 break;
5897
03b555e1
JH		 5898 case HCI_EV_IO_CAPA_REPLY:
5899 hci_io_capa_reply_evt(hdev, skb);
5900 break;
5901
a5c29683
JH		 5902 case HCI_EV_USER_CONFIRM_REQUEST:
5903 hci_user_confirm_request_evt(hdev, skb);
5904 break;
5905
1143d458
BG		 5906 case HCI_EV_USER_PASSKEY_REQUEST:
5907 hci_user_passkey_request_evt(hdev, skb);
5908 break;
5909
92a25256
JH		 5910 case HCI_EV_USER_PASSKEY_NOTIFY:
5911 hci_user_passkey_notify_evt(hdev, skb);
5912 break;
5913
5914 case HCI_EV_KEYPRESS_NOTIFY:
5915 hci_keypress_notify_evt(hdev, skb);
5916 break;
5917
0493684e
MH		 5918 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5919 hci_simple_pair_complete_evt(hdev, skb);
5920 break;
5921
41a96212
MH		 5922 case HCI_EV_REMOTE_HOST_FEATURES:
5923 hci_remote_host_features_evt(hdev, skb);
5924 break;
5925
fcd89c09
VT		 5926 case HCI_EV_LE_META:
5927 hci_le_meta_evt(hdev, skb);
5928 break;
5929
2763eda6
SJ		 5930 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5931 hci_remote_oob_data_request_evt(hdev, skb);
5932 break;
5933
a77a6a14
AW		 5934#if IS_ENABLED(CONFIG_BT_HS)
5935 case HCI_EV_CHANNEL_SELECTED:
5936 hci_chan_selected_evt(hdev, skb);
5937 break;
5938
d5e91192
AE		 5939 case HCI_EV_PHY_LINK_COMPLETE:
5940 hci_phy_link_complete_evt(hdev, skb);
5941 break;
5942
27695fb4
AE		 5943 case HCI_EV_LOGICAL_LINK_COMPLETE:
5944 hci_loglink_complete_evt(hdev, skb);
5945 break;
5946
606e2a10
AE		 5947 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5948 hci_disconn_loglink_complete_evt(hdev, skb);
5949 break;
5950
9eef6b3a
AE		 5951 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5952 hci_disconn_phylink_complete_evt(hdev, skb);
5953 break;
a77a6a14 5954#endif
9eef6b3a 5955
25e89e99
AE		 5956 case HCI_EV_NUM_COMP_BLOCKS:
5957 hci_num_comp_blocks_evt(hdev, skb);
5958 break;
5959
a9de9248 5960 default:
9f1db00c 5961 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 5962 break;
5963 }
5964
757aa0b5 5965 if (req_complete) {
e6214487 5966 req_complete(hdev, status, opcode);
757aa0b5
JH		 5967 } else if (req_complete_skb) {
5968 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5969 kfree_skb(orig_skb);
5970 orig_skb = NULL;
5971 }
e6214487 5972 req_complete_skb(hdev, status, opcode, orig_skb);
757aa0b5 5973 }
e6214487
JH		 5974
5975 kfree_skb(orig_skb);
1da177e4
LT		 5976 kfree_skb(skb);
5977 hdev->stat.evt_rx++;
5978}
Linux 6.x block layer and io_uring tree(s)