projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Adding a bt_dev_warn_ratelimited macro.
[linux-2.6-block.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <asm/unaligned.h>
28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
f0d6a0ea 31#include <net/bluetooth/mgmt.h>
7ef9fbf0 32
0857dd3b 33#include "hci_request.h"
23b9ceb7 34#include "hci_debugfs.h"
7024728e 35#include "a2mp.h"
7ef9fbf0 36#include "amp.h"
2ceba539 37#include "smp.h"
1da177e4 38
aa5b0345
MH		 39#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
40 "\x00\x00\x00\x00\x00\x00\x00\x00"
41
1da177e4
LT		 42/* Handle HCI Event packets */
43
a9de9248 44static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 45{
a9de9248 46 __u8 status = *((__u8 *) skb->data);
1da177e4 47
9f1db00c 48 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 49
82f4785c 50 if (status)
a9de9248 51 return;
1da177e4 52
89352e7d 53 clear_bit(HCI_INQUIRY, &hdev->flags);
4e857c58 54 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e 55 wake_up_bit(&hdev->flags, HCI_INQUIRY);
89352e7d 56
50143a43 57 hci_dev_lock(hdev);
168b8a25
JP		 58 /* Set discovery state to stopped if we're not doing LE active
59 * scanning.
60 */
61 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
62 hdev->le_scan_type != LE_SCAN_ACTIVE)
63 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
50143a43
JH		 64 hci_dev_unlock(hdev);
65
a9de9248
MH		 66 hci_conn_check_pending(hdev);
67}
6bd57416 68
4d93483b
AG		 69static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
70{
71 __u8 status = *((__u8 *) skb->data);
72
9f1db00c 73 BT_DBG("%s status 0x%2.2x", hdev->name, status);
ae854a70
AG		 74
75 if (status)
76 return;
77
a1536da2 78 hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
4d93483b
AG		 79}
80
a9de9248
MH		 81static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
82{
83 __u8 status = *((__u8 *) skb->data);
6bd57416 84
9f1db00c 85 BT_DBG("%s status 0x%2.2x", hdev->name, status);
6bd57416 86
a9de9248
MH		 87 if (status)
88 return;
1da177e4 89
a358dc11 90 hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
ae854a70 91
a9de9248
MH		 92 hci_conn_check_pending(hdev);
93}
94
807deac2
GP		 95static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
96 struct sk_buff *skb)
a9de9248
MH		 97{
98 BT_DBG("%s", hdev->name);
99}
100
101static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
102{
103 struct hci_rp_role_discovery *rp = (void *) skb->data;
104 struct hci_conn *conn;
105
9f1db00c 106 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 107
108 if (rp->status)
109 return;
110
111 hci_dev_lock(hdev);
112
113 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
40bef302
JH		 114 if (conn)
115 conn->role = rp->role;
a9de9248
MH		 116
117 hci_dev_unlock(hdev);
1da177e4
LT		 118}
119
e4e8e37c
MH		 120static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
121{
122 struct hci_rp_read_link_policy *rp = (void *) skb->data;
123 struct hci_conn *conn;
124
9f1db00c 125 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 126
127 if (rp->status)
128 return;
129
130 hci_dev_lock(hdev);
131
132 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
133 if (conn)
134 conn->link_policy = __le16_to_cpu(rp->policy);
135
136 hci_dev_unlock(hdev);
137}
138
a9de9248 139static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 140{
a9de9248 141 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 142 struct hci_conn *conn;
04837f64 143 void *sent;
1da177e4 144
9f1db00c 145 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 146
a9de9248
MH		 147 if (rp->status)
148 return;
1da177e4 149
a9de9248
MH		 150 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
151 if (!sent)
152 return;
1da177e4 153
a9de9248 154 hci_dev_lock(hdev);
1da177e4 155
a9de9248 156 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 157 if (conn)
83985319 158 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 159
a9de9248
MH		 160 hci_dev_unlock(hdev);
161}
1da177e4 162
807deac2
GP		 163static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
164 struct sk_buff *skb)
e4e8e37c
MH		 165{
166 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
167
9f1db00c 168 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
e4e8e37c
MH		 169
170 if (rp->status)
171 return;
172
173 hdev->link_policy = __le16_to_cpu(rp->policy);
174}
175
807deac2
GP		 176static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
177 struct sk_buff *skb)
e4e8e37c
MH		 178{
179 __u8 status = *((__u8 *) skb->data);
180 void *sent;
181
9f1db00c 182 BT_DBG("%s status 0x%2.2x", hdev->name, status);
e4e8e37c 183
45296acd
MH		 184 if (status)
185 return;
186
e4e8e37c
MH		 187 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
188 if (!sent)
189 return;
190
45296acd 191 hdev->link_policy = get_unaligned_le16(sent);
e4e8e37c
MH		 192}
193
a9de9248
MH		 194static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
195{
196 __u8 status = *((__u8 *) skb->data);
04837f64 197
9f1db00c 198 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 199
10572132
GP		 200 clear_bit(HCI_RESET, &hdev->flags);
201
8761f9d6
MH		 202 if (status)
203 return;
204
a297e97c 205 /* Reset all non-persistent flags */
eacb44df 206 hci_dev_clear_volatile_flags(hdev);
69775ff6 207
39c5d970
JH		 208 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
209
bbaf444a
JH		 210 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
211 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3f0f524b
JH		 212
213 memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
214 hdev->adv_data_len = 0;
f8e808bd
MH		 215
216 memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
217 hdev->scan_rsp_data_len = 0;
06f5b778 218
533553f8
MH		 219 hdev->le_scan_type = LE_SCAN_PASSIVE;
220
06f5b778 221 hdev->ssp_debug_mode = 0;
a4d5504d
MH		 222
223 hci_bdaddr_list_clear(&hdev->le_white_list);
cfdb0c2d 224 hci_bdaddr_list_clear(&hdev->le_resolv_list);
a9de9248 225}
04837f64 226
c2f0f979
MH		 227static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
228 struct sk_buff *skb)
229{
230 struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
231 struct hci_cp_read_stored_link_key *sent;
232
233 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
234
235 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
236 if (!sent)
237 return;
238
239 if (!rp->status && sent->read_all == 0x01) {
240 hdev->stored_max_keys = rp->max_keys;
241 hdev->stored_num_keys = rp->num_keys;
242 }
243}
244
a9366120
MH		 245static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
246 struct sk_buff *skb)
247{
248 struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
249
250 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
251
252 if (rp->status)
253 return;
254
255 if (rp->num_keys <= hdev->stored_num_keys)
256 hdev->stored_num_keys -= rp->num_keys;
257 else
258 hdev->stored_num_keys = 0;
259}
260
a9de9248
MH		 261static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
262{
263 __u8 status = *((__u8 *) skb->data);
264 void *sent;
04837f64 265
9f1db00c 266 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 267
a9de9248
MH		 268 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
269 if (!sent)
270 return;
04837f64 271
56e5cb86
JH		 272 hci_dev_lock(hdev);
273
d7a5a11d 274 if (hci_dev_test_flag(hdev, HCI_MGMT))
f51d5b24 275 mgmt_set_local_name_complete(hdev, sent, status);
28cc7bde
JH		 276 else if (!status)
277 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
f51d5b24 278
56e5cb86 279 hci_dev_unlock(hdev);
a9de9248
MH		 280}
281
282static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
283{
284 struct hci_rp_read_local_name *rp = (void *) skb->data;
285
9f1db00c 286 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 287
288 if (rp->status)
289 return;
290
d7a5a11d
MH		 291 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
292 hci_dev_test_flag(hdev, HCI_CONFIG))
db99b5fc 293 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 294}
295
296static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
297{
298 __u8 status = *((__u8 *) skb->data);
299 void *sent;
300
9f1db00c 301 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 302
303 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
304 if (!sent)
305 return;
306
5c1a4c8f
JK		 307 hci_dev_lock(hdev);
308
a9de9248
MH		 309 if (!status) {
310 __u8 param = *((__u8 *) sent);
311
312 if (param == AUTH_ENABLED)
313 set_bit(HCI_AUTH, &hdev->flags);
314 else
315 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 316 }
a9de9248 317
d7a5a11d 318 if (hci_dev_test_flag(hdev, HCI_MGMT))
33ef95ed 319 mgmt_auth_enable_complete(hdev, status);
5c1a4c8f
JK		 320
321 hci_dev_unlock(hdev);
1da177e4
LT		 322}
323
a9de9248 324static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 325{
a9de9248 326 __u8 status = *((__u8 *) skb->data);
45296acd 327 __u8 param;
1da177e4
LT		 328 void *sent;
329
9f1db00c 330 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 331
45296acd
MH		 332 if (status)
333 return;
334
a9de9248
MH		 335 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
336 if (!sent)
337 return;
1da177e4 338
45296acd 339 param = *((__u8 *) sent);
a9de9248 340
45296acd
MH		 341 if (param)
342 set_bit(HCI_ENCRYPT, &hdev->flags);
343 else
344 clear_bit(HCI_ENCRYPT, &hdev->flags);
a9de9248 345}
1da177e4 346
a9de9248
MH		 347static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
348{
45296acd
MH		 349 __u8 status = *((__u8 *) skb->data);
350 __u8 param;
a9de9248 351 void *sent;
1da177e4 352
9f1db00c 353 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 354
a9de9248
MH		 355 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
356 if (!sent)
357 return;
1da177e4 358
36f7fc7e
JH		 359 param = *((__u8 *) sent);
360
56e5cb86
JH		 361 hci_dev_lock(hdev);
362
fa1bd918 363 if (status) {
2d7cee58
JH		 364 hdev->discov_timeout = 0;
365 goto done;
366 }
367
bc6d2d04 368 if (param & SCAN_INQUIRY)
36f7fc7e 369 set_bit(HCI_ISCAN, &hdev->flags);
bc6d2d04
JH		 370 else
371 clear_bit(HCI_ISCAN, &hdev->flags);
36f7fc7e 372
031547d8 373 if (param & SCAN_PAGE)
36f7fc7e 374 set_bit(HCI_PSCAN, &hdev->flags);
bc6d2d04 375 else
204e3990 376 clear_bit(HCI_PSCAN, &hdev->flags);
1da177e4 377
36f7fc7e 378done:
56e5cb86 379 hci_dev_unlock(hdev);
a9de9248 380}
1da177e4 381
a9de9248
MH		 382static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
383{
384 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 385
9f1db00c 386 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 387
a9de9248
MH		 388 if (rp->status)
389 return;
1da177e4 390
a9de9248 391 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 392
a9de9248 393 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
807deac2 394 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
a9de9248 395}
1da177e4 396
a9de9248
MH		 397static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
398{
399 __u8 status = *((__u8 *) skb->data);
400 void *sent;
1da177e4 401
9f1db00c 402 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 403
a9de9248
MH		 404 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
405 if (!sent)
406 return;
1da177e4 407
7f9a903c
MH		 408 hci_dev_lock(hdev);
409
410 if (status == 0)
411 memcpy(hdev->dev_class, sent, 3);
412
d7a5a11d 413 if (hci_dev_test_flag(hdev, HCI_MGMT))
7f9a903c
MH		 414 mgmt_set_class_of_dev_complete(hdev, sent, status);
415
416 hci_dev_unlock(hdev);
a9de9248 417}
1da177e4 418
a9de9248
MH		 419static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
420{
421 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
422 __u16 setting;
423
9f1db00c 424 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248
MH		 425
426 if (rp->status)
427 return;
428
429 setting = __le16_to_cpu(rp->voice_setting);
430
f383f275 431 if (hdev->voice_setting == setting)
a9de9248
MH		 432 return;
433
434 hdev->voice_setting = setting;
435
9f1db00c 436 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
a9de9248 437
3c54711c 438 if (hdev->notify)
a9de9248 439 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
a9de9248
MH		 440}
441
8fc9ced3
GP		 442static void hci_cc_write_voice_setting(struct hci_dev *hdev,
443 struct sk_buff *skb)
a9de9248
MH		 444{
445 __u8 status = *((__u8 *) skb->data);
f383f275 446 __u16 setting;
a9de9248
MH		 447 void *sent;
448
9f1db00c 449 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 450
f383f275
MH		 451 if (status)
452 return;
453
a9de9248
MH		 454 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
455 if (!sent)
456 return;
1da177e4 457
f383f275 458 setting = get_unaligned_le16(sent);
1da177e4 459
f383f275
MH		 460 if (hdev->voice_setting == setting)
461 return;
462
463 hdev->voice_setting = setting;
1da177e4 464
9f1db00c 465 BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
1da177e4 466
3c54711c 467 if (hdev->notify)
f383f275 468 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
1da177e4
LT		 469}
470
b4cb9fb2
MH		 471static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
472 struct sk_buff *skb)
473{
474 struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
475
476 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
477
478 if (rp->status)
479 return;
480
481 hdev->num_iac = rp->num_iac;
482
483 BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
484}
485
333140b5
MH		 486static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
487{
488 __u8 status = *((__u8 *) skb->data);
5ed8eb2f 489 struct hci_cp_write_ssp_mode *sent;
333140b5 490
9f1db00c 491 BT_DBG("%s status 0x%2.2x", hdev->name, status);
333140b5 492
333140b5
MH		 493 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
494 if (!sent)
495 return;
496
5c1a4c8f
JK		 497 hci_dev_lock(hdev);
498
5ed8eb2f
JH		 499 if (!status) {
500 if (sent->mode)
cad718ed 501 hdev->features[1][0] |= LMP_HOST_SSP;
5ed8eb2f 502 else
cad718ed 503 hdev->features[1][0] &= ~LMP_HOST_SSP;
5ed8eb2f
JH		 504 }
505
d7a5a11d 506 if (hci_dev_test_flag(hdev, HCI_MGMT))
5ed8eb2f 507 mgmt_ssp_enable_complete(hdev, sent->mode, status);
c0ecddc2 508 else if (!status) {
5ed8eb2f 509 if (sent->mode)
a1536da2 510 hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 511 else
a358dc11 512 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
c0ecddc2 513 }
5c1a4c8f
JK		 514
515 hci_dev_unlock(hdev);
333140b5
MH		 516}
517
eac83dc6
MH		 518static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
519{
520 u8 status = *((u8 *) skb->data);
521 struct hci_cp_write_sc_support *sent;
522
523 BT_DBG("%s status 0x%2.2x", hdev->name, status);
524
525 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
526 if (!sent)
527 return;
528
5c1a4c8f
JK		 529 hci_dev_lock(hdev);
530
eac83dc6
MH		 531 if (!status) {
532 if (sent->support)
533 hdev->features[1][0] |= LMP_HOST_SC;
534 else
535 hdev->features[1][0] &= ~LMP_HOST_SC;
536 }
537
d7a5a11d 538 if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
eac83dc6 539 if (sent->support)
a1536da2 540 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
eac83dc6 541 else
a358dc11 542 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
eac83dc6 543 }
5c1a4c8f
JK		 544
545 hci_dev_unlock(hdev);
eac83dc6
MH		 546}
547
a9de9248
MH		 548static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
549{
550 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 551
9f1db00c 552 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143e5a6 553
a9de9248 554 if (rp->status)
42c6b129 555 return;
1143e5a6 556
d7a5a11d
MH		 557 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
558 hci_dev_test_flag(hdev, HCI_CONFIG)) {
0d5551f5
MH		 559 hdev->hci_ver = rp->hci_ver;
560 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
561 hdev->lmp_ver = rp->lmp_ver;
562 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
563 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
564 }
d5859e22
JH		 565}
566
8fc9ced3
GP		 567static void hci_cc_read_local_commands(struct hci_dev *hdev,
568 struct sk_buff *skb)
a9de9248
MH		 569{
570 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 571
9f1db00c 572 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 573
6a070e6e
MH		 574 if (rp->status)
575 return;
576
d7a5a11d
MH		 577 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
578 hci_dev_test_flag(hdev, HCI_CONFIG))
2177bab5 579 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
a9de9248 580}
1da177e4 581
302975cb
SRK		 582static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
583 struct sk_buff *skb)
584{
585 struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
586 struct hci_conn *conn;
587
588 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
589
590 if (rp->status)
591 return;
592
593 hci_dev_lock(hdev);
594
595 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
596 if (conn)
597 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
598
599 hci_dev_unlock(hdev);
600}
601
602static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
603 struct sk_buff *skb)
604{
605 struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
606 struct hci_conn *conn;
607 void *sent;
608
609 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
610
611 if (rp->status)
612 return;
613
614 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
615 if (!sent)
616 return;
617
618 hci_dev_lock(hdev);
619
620 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
621 if (conn)
622 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
623
624 hci_dev_unlock(hdev);
625}
626
8fc9ced3
GP		 627static void hci_cc_read_local_features(struct hci_dev *hdev,
628 struct sk_buff *skb)
a9de9248
MH		 629{
630 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 631
9f1db00c 632 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 633
a9de9248
MH		 634 if (rp->status)
635 return;
5b7f9909 636
a9de9248 637 memcpy(hdev->features, rp->features, 8);
5b7f9909 638
a9de9248
MH		 639 /* Adjust default settings according to features
640 * supported by device. */
1da177e4 641
cad718ed 642 if (hdev->features[0][0] & LMP_3SLOT)
a9de9248 643 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 644
cad718ed 645 if (hdev->features[0][0] & LMP_5SLOT)
a9de9248 646 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 647
cad718ed 648 if (hdev->features[0][1] & LMP_HV2) {
a9de9248
MH		 649 hdev->pkt_type |= (HCI_HV2);
650 hdev->esco_type |= (ESCO_HV2);
651 }
1da177e4 652
cad718ed 653 if (hdev->features[0][1] & LMP_HV3) {
a9de9248
MH		 654 hdev->pkt_type |= (HCI_HV3);
655 hdev->esco_type |= (ESCO_HV3);
656 }
1da177e4 657
45db810f 658 if (lmp_esco_capable(hdev))
a9de9248 659 hdev->esco_type |= (ESCO_EV3);
da1f5198 660
cad718ed 661 if (hdev->features[0][4] & LMP_EV4)
a9de9248 662 hdev->esco_type |= (ESCO_EV4);
da1f5198 663
cad718ed 664 if (hdev->features[0][4] & LMP_EV5)
a9de9248 665 hdev->esco_type |= (ESCO_EV5);
1da177e4 666
cad718ed 667 if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
efc7688b
MH		 668 hdev->esco_type |= (ESCO_2EV3);
669
cad718ed 670 if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
efc7688b
MH		 671 hdev->esco_type |= (ESCO_3EV3);
672
cad718ed 673 if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
efc7688b 674 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
a9de9248 675}
1da177e4 676
971e3a4b 677static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
807deac2 678 struct sk_buff *skb)
971e3a4b
AG		 679{
680 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
681
9f1db00c 682 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971e3a4b
AG		 683
684 if (rp->status)
42c6b129 685 return;
971e3a4b 686
57af75a8
MH		 687 if (hdev->max_page < rp->max_page)
688 hdev->max_page = rp->max_page;
d2c5d77f 689
cad718ed
JH		 690 if (rp->page < HCI_MAX_PAGES)
691 memcpy(hdev->features[rp->page], rp->features, 8);
971e3a4b
AG		 692}
693
1e89cffb 694static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
807deac2 695 struct sk_buff *skb)
1e89cffb
AE		 696{
697 struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
698
9f1db00c 699 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1e89cffb 700
45296acd
MH		 701 if (rp->status)
702 return;
703
704 hdev->flow_ctl_mode = rp->mode;
1e89cffb
AE		 705}
706
a9de9248
MH		 707static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
708{
709 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 710
9f1db00c 711 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1da177e4 712
a9de9248
MH		 713 if (rp->status)
714 return;
1da177e4 715
a9de9248
MH		 716 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
717 hdev->sco_mtu = rp->sco_mtu;
718 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
719 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
720
721 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
722 hdev->sco_mtu = 64;
723 hdev->sco_pkts = 8;
1da177e4 724 }
a9de9248
MH		 725
726 hdev->acl_cnt = hdev->acl_pkts;
727 hdev->sco_cnt = hdev->sco_pkts;
728
807deac2
GP		 729 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
730 hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
a9de9248
MH		 731}
732
733static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
734{
735 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
736
9f1db00c 737 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a9de9248 738
e30d3f5f
MH		 739 if (rp->status)
740 return;
741
742 if (test_bit(HCI_INIT, &hdev->flags))
a9de9248 743 bacpy(&hdev->bdaddr, &rp->bdaddr);
e30d3f5f 744
d7a5a11d 745 if (hci_dev_test_flag(hdev, HCI_SETUP))
e30d3f5f 746 bacpy(&hdev->setup_addr, &rp->bdaddr);
23bb5763
JH		 747}
748
f332ec66
JH		 749static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
750 struct sk_buff *skb)
751{
752 struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
753
754 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
755
45296acd
MH		 756 if (rp->status)
757 return;
758
759 if (test_bit(HCI_INIT, &hdev->flags)) {
f332ec66
JH		 760 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
761 hdev->page_scan_window = __le16_to_cpu(rp->window);
762 }
763}
764
4a3ee763
JH		 765static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
766 struct sk_buff *skb)
767{
768 u8 status = *((u8 *) skb->data);
769 struct hci_cp_write_page_scan_activity *sent;
770
771 BT_DBG("%s status 0x%2.2x", hdev->name, status);
772
773 if (status)
774 return;
775
776 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
777 if (!sent)
778 return;
779
780 hdev->page_scan_interval = __le16_to_cpu(sent->interval);
781 hdev->page_scan_window = __le16_to_cpu(sent->window);
782}
783
f332ec66
JH		 784static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
785 struct sk_buff *skb)
786{
787 struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
788
789 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
790
45296acd
MH		 791 if (rp->status)
792 return;
793
794 if (test_bit(HCI_INIT, &hdev->flags))
f332ec66
JH		 795 hdev->page_scan_type = rp->type;
796}
797
4a3ee763
JH		 798static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
799 struct sk_buff *skb)
800{
801 u8 status = *((u8 *) skb->data);
802 u8 *type;
803
804 BT_DBG("%s status 0x%2.2x", hdev->name, status);
805
806 if (status)
807 return;
808
809 type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
810 if (type)
811 hdev->page_scan_type = *type;
812}
813
350ee4cf 814static void hci_cc_read_data_block_size(struct hci_dev *hdev,
807deac2 815 struct sk_buff *skb)
350ee4cf
AE		 816{
817 struct hci_rp_read_data_block_size *rp = (void *) skb->data;
818
9f1db00c 819 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
350ee4cf
AE		 820
821 if (rp->status)
822 return;
823
824 hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
825 hdev->block_len = __le16_to_cpu(rp->block_len);
826 hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
827
828 hdev->block_cnt = hdev->num_blocks;
829
830 BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
807deac2 831 hdev->block_cnt, hdev->block_len);
350ee4cf
AE		 832}
833
33f35721
JH		 834static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
835{
836 struct hci_rp_read_clock *rp = (void *) skb->data;
837 struct hci_cp_read_clock *cp;
838 struct hci_conn *conn;
839
840 BT_DBG("%s", hdev->name);
841
842 if (skb->len < sizeof(*rp))
843 return;
844
845 if (rp->status)
846 return;
847
848 hci_dev_lock(hdev);
849
850 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
851 if (!cp)
852 goto unlock;
853
854 if (cp->which == 0x00) {
855 hdev->clock = le32_to_cpu(rp->clock);
856 goto unlock;
857 }
858
859 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
860 if (conn) {
861 conn->clock = le32_to_cpu(rp->clock);
862 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
863 }
864
865unlock:
866 hci_dev_unlock(hdev);
867}
868
928abaa7 869static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
807deac2 870 struct sk_buff *skb)
928abaa7
AE		 871{
872 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
873
9f1db00c 874 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
928abaa7
AE		 875
876 if (rp->status)
83927882 877 return;
928abaa7
AE		 878
879 hdev->amp_status = rp->amp_status;
880 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
881 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
882 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
883 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
884 hdev->amp_type = rp->amp_type;
885 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
886 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
887 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
888 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
928abaa7
AE		 889}
890
d5859e22 891static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
807deac2 892 struct sk_buff *skb)
d5859e22 893{
91c4e9b1 894 struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
d5859e22 895
9f1db00c 896 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
91c4e9b1 897
45296acd
MH		 898 if (rp->status)
899 return;
900
901 hdev->inq_tx_power = rp->tx_power;
d5859e22
JH		 902}
903
980e1a53
JH		 904static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
905{
906 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
907 struct hci_cp_pin_code_reply *cp;
908 struct hci_conn *conn;
909
9f1db00c 910 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 911
56e5cb86
JH		 912 hci_dev_lock(hdev);
913
d7a5a11d 914 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 915 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53 916
fa1bd918 917 if (rp->status)
56e5cb86 918 goto unlock;
980e1a53
JH		 919
920 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
921 if (!cp)
56e5cb86 922 goto unlock;
980e1a53
JH		 923
924 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
925 if (conn)
926 conn->pin_length = cp->pin_len;
56e5cb86
JH		 927
928unlock:
929 hci_dev_unlock(hdev);
980e1a53
JH		 930}
931
932static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
933{
934 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
935
9f1db00c 936 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
980e1a53 937
56e5cb86
JH		 938 hci_dev_lock(hdev);
939
d7a5a11d 940 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 941 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
807deac2 942 rp->status);
56e5cb86
JH		 943
944 hci_dev_unlock(hdev);
980e1a53 945}
56e5cb86 946
6ed58ec5
VT		 947static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
948 struct sk_buff *skb)
949{
950 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
951
9f1db00c 952 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
6ed58ec5
VT		 953
954 if (rp->status)
955 return;
956
957 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
958 hdev->le_pkts = rp->le_max_pkt;
959
960 hdev->le_cnt = hdev->le_pkts;
961
962 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
6ed58ec5 963}
980e1a53 964
60e77321
JH		 965static void hci_cc_le_read_local_features(struct hci_dev *hdev,
966 struct sk_buff *skb)
967{
968 struct hci_rp_le_read_local_features *rp = (void *) skb->data;
969
970 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
971
45296acd
MH		 972 if (rp->status)
973 return;
974
975 memcpy(hdev->le_features, rp->features, 8);
60e77321
JH		 976}
977
8fa19098
JH		 978static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
979 struct sk_buff *skb)
980{
981 struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
982
983 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
984
45296acd
MH		 985 if (rp->status)
986 return;
987
988 hdev->adv_tx_power = rp->tx_power;
8fa19098
JH		 989}
990
a5c29683
JH		 991static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
992{
993 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
994
9f1db00c 995 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 996
56e5cb86
JH		 997 hci_dev_lock(hdev);
998
d7a5a11d 999 if (hci_dev_test_flag(hdev, HCI_MGMT))
04124681
GP		 1000 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1001 rp->status);
56e5cb86
JH		 1002
1003 hci_dev_unlock(hdev);
a5c29683
JH		 1004}
1005
1006static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
807deac2 1007 struct sk_buff *skb)
a5c29683
JH		 1008{
1009 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1010
9f1db00c 1011 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
a5c29683 1012
56e5cb86
JH		 1013 hci_dev_lock(hdev);
1014
d7a5a11d 1015 if (hci_dev_test_flag(hdev, HCI_MGMT))
744cf19e 1016 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1017 ACL_LINK, 0, rp->status);
56e5cb86
JH		 1018
1019 hci_dev_unlock(hdev);
a5c29683
JH		 1020}
1021
1143d458
BG		 1022static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1023{
1024 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1025
9f1db00c 1026 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1027
1028 hci_dev_lock(hdev);
1029
d7a5a11d 1030 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 1031 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
04124681 1032 0, rp->status);
1143d458
BG		 1033
1034 hci_dev_unlock(hdev);
1035}
1036
1037static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
807deac2 1038 struct sk_buff *skb)
1143d458
BG		 1039{
1040 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1041
9f1db00c 1042 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1143d458
BG		 1043
1044 hci_dev_lock(hdev);
1045
d7a5a11d 1046 if (hci_dev_test_flag(hdev, HCI_MGMT))
1143d458 1047 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
04124681 1048 ACL_LINK, 0, rp->status);
1143d458
BG		 1049
1050 hci_dev_unlock(hdev);
1051}
1052
4d2d2796
MH		 1053static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1054 struct sk_buff *skb)
c35938b2
SJ		 1055{
1056 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1057
9f1db00c 1058 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
4d2d2796
MH		 1059}
1060
1061static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1062 struct sk_buff *skb)
1063{
1064 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1065
1066 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
c35938b2
SJ		 1067}
1068
7a4cd51d
MH		 1069static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1070{
1071 __u8 status = *((__u8 *) skb->data);
1072 bdaddr_t *sent;
1073
1074 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1075
45296acd
MH		 1076 if (status)
1077 return;
1078
7a4cd51d
MH		 1079 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1080 if (!sent)
1081 return;
1082
1083 hci_dev_lock(hdev);
1084
45296acd 1085 bacpy(&hdev->random_addr, sent);
7a4cd51d
MH		 1086
1087 hci_dev_unlock(hdev);
1088}
1089
0314f286
JK		 1090static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1091{
1092 __u8 status = *((__u8 *) skb->data);
1093 struct hci_cp_le_set_default_phy *cp;
1094
1095 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1096
1097 if (status)
1098 return;
1099
1100 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1101 if (!cp)
1102 return;
1103
1104 hci_dev_lock(hdev);
1105
1106 hdev->le_tx_def_phys = cp->tx_phys;
1107 hdev->le_rx_def_phys = cp->rx_phys;
1108
1109 hci_dev_unlock(hdev);
1110}
1111
a73c046a
JK		 1112static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1113 struct sk_buff *skb)
1114{
1115 __u8 status = *((__u8 *) skb->data);
1116 struct hci_cp_le_set_adv_set_rand_addr *cp;
1117 struct adv_info *adv_instance;
1118
1119 if (status)
1120 return;
1121
1122 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1123 if (!cp)
1124 return;
1125
1126 hci_dev_lock(hdev);
1127
1128 if (!hdev->cur_adv_instance) {
1129 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1130 bacpy(&hdev->random_addr, &cp->bdaddr);
1131 } else {
1132 adv_instance = hci_find_adv_instance(hdev,
1133 hdev->cur_adv_instance);
1134 if (adv_instance)
1135 bacpy(&adv_instance->random_addr, &cp->bdaddr);
1136 }
1137
1138 hci_dev_unlock(hdev);
1139}
1140
c1d5dc4a
JH		 1141static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1142{
1143 __u8 *sent, status = *((__u8 *) skb->data);
1144
1145 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1146
45296acd 1147 if (status)
c1d5dc4a
JH		 1148 return;
1149
45296acd
MH		 1150 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1151 if (!sent)
3c857757
JH		 1152 return;
1153
c1d5dc4a
JH		 1154 hci_dev_lock(hdev);
1155
49c922bb 1156 /* If we're doing connection initiation as peripheral. Set a
3c857757
JH		 1157 * timeout in case something goes wrong.
1158 */
1159 if (*sent) {
1160 struct hci_conn *conn;
1161
a1536da2 1162 hci_dev_set_flag(hdev, HCI_LE_ADV);
66c417c1 1163
e7d9ab73 1164 conn = hci_lookup_le_connect(hdev);
3c857757
JH		 1165 if (conn)
1166 queue_delayed_work(hdev->workqueue,
1167 &conn->le_conn_timeout,
09ae260b 1168 conn->conn_timeout);
66c417c1 1169 } else {
a358dc11 1170 hci_dev_clear_flag(hdev, HCI_LE_ADV);
3c857757
JH		 1171 }
1172
04b4edcb 1173 hci_dev_unlock(hdev);
c1d5dc4a
JH		 1174}
1175
de181e88
JK		 1176static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1177 struct sk_buff *skb)
1178{
1179 struct hci_cp_le_set_ext_adv_enable *cp;
de181e88
JK		 1180 __u8 status = *((__u8 *) skb->data);
1181
1182 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1183
1184 if (status)
1185 return;
1186
1187 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1188 if (!cp)
1189 return;
1190
de181e88
JK		 1191 hci_dev_lock(hdev);
1192
1193 if (cp->enable) {
1194 struct hci_conn *conn;
1195
1196 hci_dev_set_flag(hdev, HCI_LE_ADV);
1197
1198 conn = hci_lookup_le_connect(hdev);
1199 if (conn)
1200 queue_delayed_work(hdev->workqueue,
1201 &conn->le_conn_timeout,
1202 conn->conn_timeout);
45b7749f
JK		 1203 } else {
1204 hci_dev_clear_flag(hdev, HCI_LE_ADV);
de181e88
JK		 1205 }
1206
1207 hci_dev_unlock(hdev);
1208}
1209
533553f8
MH		 1210static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1211{
1212 struct hci_cp_le_set_scan_param *cp;
1213 __u8 status = *((__u8 *) skb->data);
1214
1215 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1216
45296acd
MH		 1217 if (status)
1218 return;
1219
533553f8
MH		 1220 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1221 if (!cp)
1222 return;
1223
1224 hci_dev_lock(hdev);
1225
45296acd 1226 hdev->le_scan_type = cp->type;
533553f8
MH		 1227
1228 hci_dev_unlock(hdev);
1229}
1230
a2344b9e
JK		 1231static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1232 struct sk_buff *skb)
1233{
1234 struct hci_cp_le_set_ext_scan_params *cp;
1235 __u8 status = *((__u8 *) skb->data);
1236 struct hci_cp_le_scan_phy_params *phy_param;
1237
1238 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1239
1240 if (status)
1241 return;
1242
1243 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1244 if (!cp)
1245 return;
1246
1247 phy_param = (void *)cp->data;
1248
1249 hci_dev_lock(hdev);
1250
1251 hdev->le_scan_type = phy_param->type;
1252
1253 hci_dev_unlock(hdev);
1254}
1255
b9a6328f
JH		 1256static bool has_pending_adv_report(struct hci_dev *hdev)
1257{
1258 struct discovery_state *d = &hdev->discovery;
1259
1260 return bacmp(&d->last_adv_addr, BDADDR_ANY);
1261}
1262
1263static void clear_pending_adv_report(struct hci_dev *hdev)
1264{
1265 struct discovery_state *d = &hdev->discovery;
1266
1267 bacpy(&d->last_adv_addr, BDADDR_ANY);
1268 d->last_adv_data_len = 0;
1269}
1270
1271static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
c70a7e4c
MH		 1272 u8 bdaddr_type, s8 rssi, u32 flags,
1273 u8 *data, u8 len)
b9a6328f
JH		 1274{
1275 struct discovery_state *d = &hdev->discovery;
1276
1277 bacpy(&d->last_adv_addr, bdaddr);
1278 d->last_adv_addr_type = bdaddr_type;
ff5cd29f 1279 d->last_adv_rssi = rssi;
c70a7e4c 1280 d->last_adv_flags = flags;
b9a6328f
JH		 1281 memcpy(d->last_adv_data, data, len);
1282 d->last_adv_data_len = len;
1283}
1284
3baef810 1285static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
eb9d91f5 1286{
5c1a4c8f
JK		 1287 hci_dev_lock(hdev);
1288
3baef810 1289 switch (enable) {
76a388be 1290 case LE_SCAN_ENABLE:
a1536da2 1291 hci_dev_set_flag(hdev, HCI_LE_SCAN);
b9a6328f
JH		 1292 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1293 clear_pending_adv_report(hdev);
68a8aea4
AE		 1294 break;
1295
76a388be 1296 case LE_SCAN_DISABLE:
b9a6328f
JH		 1297 /* We do this here instead of when setting DISCOVERY_STOPPED
1298 * since the latter would potentially require waiting for
1299 * inquiry to stop too.
1300 */
1301 if (has_pending_adv_report(hdev)) {
1302 struct discovery_state *d = &hdev->discovery;
1303
1304 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ab0aa433 1305 d->last_adv_addr_type, NULL,
c70a7e4c 1306 d->last_adv_rssi, d->last_adv_flags,
ab0aa433 1307 d->last_adv_data,
b9a6328f
JH		 1308 d->last_adv_data_len, NULL, 0);
1309 }
1310
317ac8cb
JH		 1311 /* Cancel this timer so that we don't try to disable scanning
1312 * when it's already disabled.
1313 */
1314 cancel_delayed_work(&hdev->le_scan_disable);
1315
a358dc11 1316 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
e8bb6b97 1317
81ad6fd9
JH		 1318 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1319 * interrupted scanning due to a connect request. Mark
e8bb6b97
JH		 1320 * therefore discovery as stopped. If this was not
1321 * because of a connect request advertising might have
1322 * been disabled because of active scanning, so
1323 * re-enable it again if necessary.
81ad6fd9 1324 */
a69d8927 1325 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
81ad6fd9 1326 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
d7a5a11d 1327 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
34722277 1328 hdev->discovery.state == DISCOVERY_FINDING)
f2252570 1329 hci_req_reenable_advertising(hdev);
e8bb6b97 1330
68a8aea4
AE		 1331 break;
1332
1333 default:
2064ee33 1334 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
3baef810 1335 enable);
68a8aea4 1336 break;
35815085 1337 }
5c1a4c8f
JK		 1338
1339 hci_dev_unlock(hdev);
eb9d91f5
AG		 1340}
1341
3baef810
JK		 1342static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1343 struct sk_buff *skb)
1344{
1345 struct hci_cp_le_set_scan_enable *cp;
1346 __u8 status = *((__u8 *) skb->data);
1347
1348 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1349
1350 if (status)
1351 return;
1352
1353 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1354 if (!cp)
1355 return;
1356
1357 le_set_scan_enable_complete(hdev, cp->enable);
1358}
1359
a2344b9e
JK		 1360static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1361 struct sk_buff *skb)
1362{
1363 struct hci_cp_le_set_ext_scan_enable *cp;
1364 __u8 status = *((__u8 *) skb->data);
1365
1366 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1367
1368 if (status)
1369 return;
1370
1371 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1372 if (!cp)
1373 return;
1374
1375 le_set_scan_enable_complete(hdev, cp->enable);
1376}
1377
6b49bcb4
JK		 1378static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1379 struct sk_buff *skb)
1380{
1381 struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1382
1383 BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1384 rp->num_of_sets);
1385
1386 if (rp->status)
1387 return;
1388
1389 hdev->le_num_of_adv_sets = rp->num_of_sets;
1390}
1391
cf1d081f
JH		 1392static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1393 struct sk_buff *skb)
1394{
1395 struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1396
1397 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1398
45296acd
MH		 1399 if (rp->status)
1400 return;
1401
1402 hdev->le_white_list_size = rp->size;
cf1d081f
JH		 1403}
1404
0f36b589
MH		 1405static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1406 struct sk_buff *skb)
1407{
1408 __u8 status = *((__u8 *) skb->data);
1409
1410 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1411
45296acd
MH		 1412 if (status)
1413 return;
1414
dcc36c16 1415 hci_bdaddr_list_clear(&hdev->le_white_list);
0f36b589
MH		 1416}
1417
1418static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1419 struct sk_buff *skb)
1420{
1421 struct hci_cp_le_add_to_white_list *sent;
1422 __u8 status = *((__u8 *) skb->data);
1423
1424 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1425
45296acd
MH		 1426 if (status)
1427 return;
1428
0f36b589
MH		 1429 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1430 if (!sent)
1431 return;
1432
dcc36c16
JH		 1433 hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1434 sent->bdaddr_type);
0f36b589
MH		 1435}
1436
1437static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1438 struct sk_buff *skb)
1439{
1440 struct hci_cp_le_del_from_white_list *sent;
1441 __u8 status = *((__u8 *) skb->data);
1442
1443 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1444
45296acd
MH		 1445 if (status)
1446 return;
1447
0f36b589
MH		 1448 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1449 if (!sent)
1450 return;
1451
dcc36c16
JH		 1452 hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1453 sent->bdaddr_type);
0f36b589
MH		 1454}
1455
9b008c04
JH		 1456static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1457 struct sk_buff *skb)
1458{
1459 struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1460
1461 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1462
45296acd
MH		 1463 if (rp->status)
1464 return;
1465
1466 memcpy(hdev->le_states, rp->le_states, 8);
9b008c04
JH		 1467}
1468
a8e1bfaa
MH		 1469static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1470 struct sk_buff *skb)
1471{
1472 struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1473
1474 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1475
1476 if (rp->status)
1477 return;
1478
1479 hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1480 hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1481}
1482
1483static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1484 struct sk_buff *skb)
1485{
1486 struct hci_cp_le_write_def_data_len *sent;
1487 __u8 status = *((__u8 *) skb->data);
1488
1489 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1490
1491 if (status)
1492 return;
1493
1494 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1495 if (!sent)
1496 return;
1497
1498 hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1499 hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1500}
1501
b950aa88
AN		 1502static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1503 struct sk_buff *skb)
1504{
1505 struct hci_cp_le_add_to_resolv_list *sent;
1506 __u8 status = *((__u8 *) skb->data);
1507
1508 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1509
1510 if (status)
1511 return;
1512
1513 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1514 if (!sent)
1515 return;
1516
1517 hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1518 sent->bdaddr_type, sent->peer_irk,
1519 sent->local_irk);
1520}
1521
1522static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1523 struct sk_buff *skb)
1524{
1525 struct hci_cp_le_del_from_resolv_list *sent;
1526 __u8 status = *((__u8 *) skb->data);
1527
1528 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1529
1530 if (status)
1531 return;
1532
1533 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1534 if (!sent)
1535 return;
1536
1537 hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1538 sent->bdaddr_type);
1539}
1540
545f2596
AN		 1541static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1542 struct sk_buff *skb)
1543{
1544 __u8 status = *((__u8 *) skb->data);
1545
1546 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1547
1548 if (status)
1549 return;
1550
1551 hci_bdaddr_list_clear(&hdev->le_resolv_list);
1552}
1553
cfdb0c2d
AN		 1554static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1555 struct sk_buff *skb)
1556{
1557 struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1558
1559 BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1560
1561 if (rp->status)
1562 return;
1563
1564 hdev->le_resolv_list_size = rp->size;
1565}
1566
aa12af77
AN		 1567static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1568 struct sk_buff *skb)
1569{
1570 __u8 *sent, status = *((__u8 *) skb->data);
1571
1572 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1573
1574 if (status)
1575 return;
1576
1577 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1578 if (!sent)
1579 return;
1580
1581 hci_dev_lock(hdev);
1582
1583 if (*sent)
1584 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1585 else
1586 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1587
1588 hci_dev_unlock(hdev);
1589}
1590
a8e1bfaa
MH		 1591static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1592 struct sk_buff *skb)
1593{
1594 struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1595
1596 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1597
1598 if (rp->status)
1599 return;
1600
1601 hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1602 hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1603 hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1604 hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1605}
1606
6039aa73
GP		 1607static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1608 struct sk_buff *skb)
f9b49306 1609{
06199cf8 1610 struct hci_cp_write_le_host_supported *sent;
f9b49306
AG		 1611 __u8 status = *((__u8 *) skb->data);
1612
9f1db00c 1613 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f9b49306 1614
45296acd
MH		 1615 if (status)
1616 return;
1617
06199cf8 1618 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
8f984dfa 1619 if (!sent)
f9b49306
AG		 1620 return;
1621
5c1a4c8f
JK		 1622 hci_dev_lock(hdev);
1623
45296acd
MH		 1624 if (sent->le) {
1625 hdev->features[1][0] |= LMP_HOST_LE;
a1536da2 1626 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
45296acd
MH		 1627 } else {
1628 hdev->features[1][0] &= ~LMP_HOST_LE;
a358dc11
MH		 1629 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1630 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
8f984dfa 1631 }
45296acd
MH		 1632
1633 if (sent->simul)
1634 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1635 else
1636 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
5c1a4c8f
JK		 1637
1638 hci_dev_unlock(hdev);
f9b49306
AG		 1639}
1640
56ed2cb8
JH		 1641static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1642{
1643 struct hci_cp_le_set_adv_param *cp;
1644 u8 status = *((u8 *) skb->data);
1645
1646 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1647
1648 if (status)
1649 return;
1650
1651 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1652 if (!cp)
1653 return;
1654
1655 hci_dev_lock(hdev);
1656 hdev->adv_addr_type = cp->own_address_type;
1657 hci_dev_unlock(hdev);
1658}
1659
de181e88
JK		 1660static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1661{
1662 struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1663 struct hci_cp_le_set_ext_adv_params *cp;
1664 struct adv_info *adv_instance;
1665
1666 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1667
1668 if (rp->status)
1669 return;
1670
1671 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1672 if (!cp)
1673 return;
1674
1675 hci_dev_lock(hdev);
1676 hdev->adv_addr_type = cp->own_addr_type;
1677 if (!hdev->cur_adv_instance) {
1678 /* Store in hdev for instance 0 */
1679 hdev->adv_tx_power = rp->tx_power;
1680 } else {
1681 adv_instance = hci_find_adv_instance(hdev,
1682 hdev->cur_adv_instance);
1683 if (adv_instance)
1684 adv_instance->tx_power = rp->tx_power;
1685 }
a0fb3726
JK		 1686 /* Update adv data as tx power is known now */
1687 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
de181e88
JK		 1688 hci_dev_unlock(hdev);
1689}
1690
5ae76a94
AK		 1691static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1692{
1693 struct hci_rp_read_rssi *rp = (void *) skb->data;
1694 struct hci_conn *conn;
1695
1696 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1697
1698 if (rp->status)
1699 return;
1700
1701 hci_dev_lock(hdev);
1702
1703 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1704 if (conn)
1705 conn->rssi = rp->rssi;
1706
1707 hci_dev_unlock(hdev);
1708}
1709
5a134fae
AK		 1710static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1711{
1712 struct hci_cp_read_tx_power *sent;
1713 struct hci_rp_read_tx_power *rp = (void *) skb->data;
1714 struct hci_conn *conn;
1715
1716 BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1717
1718 if (rp->status)
1719 return;
1720
1721 sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1722 if (!sent)
1723 return;
1724
1725 hci_dev_lock(hdev);
1726
1727 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
d0455ed9
AK		 1728 if (!conn)
1729 goto unlock;
1730
1731 switch (sent->type) {
1732 case 0x00:
5a134fae 1733 conn->tx_power = rp->tx_power;
d0455ed9
AK		 1734 break;
1735 case 0x01:
1736 conn->max_tx_power = rp->tx_power;
1737 break;
1738 }
5a134fae 1739
d0455ed9 1740unlock:
5a134fae
AK		 1741 hci_dev_unlock(hdev);
1742}
1743
c50b33c8
MH		 1744static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1745{
1746 u8 status = *((u8 *) skb->data);
1747 u8 *mode;
1748
1749 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1750
1751 if (status)
1752 return;
1753
1754 mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1755 if (mode)
1756 hdev->ssp_debug_mode = *mode;
1757}
1758
6039aa73 1759static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
a9de9248 1760{
9f1db00c 1761 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1762
1763 if (status) {
a9de9248 1764 hci_conn_check_pending(hdev);
314b2381
JH		 1765 return;
1766 }
1767
89352e7d 1768 set_bit(HCI_INQUIRY, &hdev->flags);
1da177e4
LT		 1769}
1770
6039aa73 1771static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1da177e4 1772{
a9de9248 1773 struct hci_cp_create_conn *cp;
1da177e4 1774 struct hci_conn *conn;
1da177e4 1775
9f1db00c 1776 BT_DBG("%s status 0x%2.2x", hdev->name, status);
a9de9248
MH		 1777
1778 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1779 if (!cp)
1780 return;
1781
1782 hci_dev_lock(hdev);
1783
1784 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1785
6ed93dc6 1786 BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1da177e4
LT		 1787
1788 if (status) {
1789 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1790 if (status != 0x0c || conn->attempt > 2) {
1791 conn->state = BT_CLOSED;
539c496d 1792 hci_connect_cfm(conn, status);
4c67bc74
MH		 1793 hci_conn_del(conn);
1794 } else
1795 conn->state = BT_CONNECT2;
1da177e4
LT		 1796 }
1797 } else {
1798 if (!conn) {
a5c4e309
JH		 1799 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1800 HCI_ROLE_MASTER);
1801 if (!conn)
2064ee33 1802 bt_dev_err(hdev, "no memory for new connection");
1da177e4
LT		 1803 }
1804 }
1805
1806 hci_dev_unlock(hdev);
1807}
1808
a9de9248 1809static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1810{
a9de9248
MH		 1811 struct hci_cp_add_sco *cp;
1812 struct hci_conn *acl, *sco;
1813 __u16 handle;
1da177e4 1814
9f1db00c 1815 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82 1816
a9de9248
MH		 1817 if (!status)
1818 return;
1da177e4 1819
a9de9248
MH		 1820 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1821 if (!cp)
1822 return;
1da177e4 1823
a9de9248 1824 handle = __le16_to_cpu(cp->handle);
1da177e4 1825
9f1db00c 1826 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1da177e4 1827
a9de9248 1828 hci_dev_lock(hdev);
1da177e4 1829
a9de9248 1830 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1831 if (acl) {
1832 sco = acl->link;
1833 if (sco) {
1834 sco->state = BT_CLOSED;
1da177e4 1835
539c496d 1836 hci_connect_cfm(sco, status);
5a08ecce
AE		 1837 hci_conn_del(sco);
1838 }
a9de9248 1839 }
1da177e4 1840
a9de9248
MH		 1841 hci_dev_unlock(hdev);
1842}
1da177e4 1843
f8558555
MH		 1844static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1845{
1846 struct hci_cp_auth_requested *cp;
1847 struct hci_conn *conn;
1848
9f1db00c 1849 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1850
1851 if (!status)
1852 return;
1853
1854 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1855 if (!cp)
1856 return;
1857
1858 hci_dev_lock(hdev);
1859
1860 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1861 if (conn) {
1862 if (conn->state == BT_CONFIG) {
539c496d 1863 hci_connect_cfm(conn, status);
76a68ba0 1864 hci_conn_drop(conn);
f8558555
MH		 1865 }
1866 }
1867
1868 hci_dev_unlock(hdev);
1869}
1870
1871static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1872{
1873 struct hci_cp_set_conn_encrypt *cp;
1874 struct hci_conn *conn;
1875
9f1db00c 1876 BT_DBG("%s status 0x%2.2x", hdev->name, status);
f8558555
MH		 1877
1878 if (!status)
1879 return;
1880
1881 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1882 if (!cp)
1883 return;
1884
1885 hci_dev_lock(hdev);
1886
1887 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1888 if (conn) {
1889 if (conn->state == BT_CONFIG) {
539c496d 1890 hci_connect_cfm(conn, status);
76a68ba0 1891 hci_conn_drop(conn);
f8558555
MH		 1892 }
1893 }
1894
1895 hci_dev_unlock(hdev);
1896}
1897
127178d2 1898static int hci_outgoing_auth_needed(struct hci_dev *hdev,
807deac2 1899 struct hci_conn *conn)
392599b9 1900{
392599b9
JH		 1901 if (conn->state != BT_CONFIG || !conn->out)
1902 return 0;
1903
765c2a96 1904 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1905 return 0;
1906
1907 /* Only request authentication for SSP connections or non-SSP
264b8b4e
JH		 1908 * devices with sec_level MEDIUM or HIGH or if MITM protection
1909 * is requested.
1910 */
807deac2 1911 if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
7e3691e1 1912 conn->pending_sec_level != BT_SECURITY_FIPS &&
264b8b4e
JH		 1913 conn->pending_sec_level != BT_SECURITY_HIGH &&
1914 conn->pending_sec_level != BT_SECURITY_MEDIUM)
392599b9
JH		 1915 return 0;
1916
392599b9
JH		 1917 return 1;
1918}
1919
6039aa73 1920static int hci_resolve_name(struct hci_dev *hdev,
04124681 1921 struct inquiry_entry *e)
30dc78e1
JH		 1922{
1923 struct hci_cp_remote_name_req cp;
1924
1925 memset(&cp, 0, sizeof(cp));
1926
1927 bacpy(&cp.bdaddr, &e->data.bdaddr);
1928 cp.pscan_rep_mode = e->data.pscan_rep_mode;
1929 cp.pscan_mode = e->data.pscan_mode;
1930 cp.clock_offset = e->data.clock_offset;
1931
1932 return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1933}
1934
b644ba33 1935static bool hci_resolve_next_name(struct hci_dev *hdev)
30dc78e1
JH		 1936{
1937 struct discovery_state *discov = &hdev->discovery;
1938 struct inquiry_entry *e;
1939
b644ba33
JH		 1940 if (list_empty(&discov->resolve))
1941 return false;
1942
1943 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
c810089c
RM		 1944 if (!e)
1945 return false;
1946
b644ba33
JH		 1947 if (hci_resolve_name(hdev, e) == 0) {
1948 e->name_state = NAME_PENDING;
1949 return true;
1950 }
1951
1952 return false;
1953}
1954
1955static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
04124681 1956 bdaddr_t *bdaddr, u8 *name, u8 name_len)
b644ba33
JH		 1957{
1958 struct discovery_state *discov = &hdev->discovery;
1959 struct inquiry_entry *e;
1960
60cb49d2
JH		 1961 /* Update the mgmt connected state if necessary. Be careful with
1962 * conn objects that exist but are not (yet) connected however.
1963 * Only those in BT_CONFIG or BT_CONNECTED states can be
1964 * considered connected.
1965 */
1966 if (conn &&
1967 (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
cb77c3ec 1968 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 1969 mgmt_device_connected(hdev, conn, 0, name, name_len);
b644ba33
JH		 1970
1971 if (discov->state == DISCOVERY_STOPPED)
1972 return;
1973
30dc78e1
JH		 1974 if (discov->state == DISCOVERY_STOPPING)
1975 goto discov_complete;
1976
1977 if (discov->state != DISCOVERY_RESOLVING)
1978 return;
1979
1980 e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
7cc8380e
RM		 1981 /* If the device was not found in a list of found devices names of which
1982 * are pending. there is no need to continue resolving a next name as it
1983 * will be done upon receiving another Remote Name Request Complete
1984 * Event */
1985 if (!e)
1986 return;
1987
1988 list_del(&e->list);
1989 if (name) {
30dc78e1 1990 e->name_state = NAME_KNOWN;
7cc8380e
RM		 1991 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1992 e->data.rssi, name, name_len);
c3e7c0d9
RM		 1993 } else {
1994 e->name_state = NAME_NOT_KNOWN;
30dc78e1
JH		 1995 }
1996
b644ba33 1997 if (hci_resolve_next_name(hdev))
30dc78e1 1998 return;
30dc78e1
JH		 1999
2000discov_complete:
2001 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2002}
2003
a9de9248
MH		 2004static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2005{
127178d2
JH		 2006 struct hci_cp_remote_name_req *cp;
2007 struct hci_conn *conn;
2008
9f1db00c 2009 BT_DBG("%s status 0x%2.2x", hdev->name, status);
127178d2
JH		 2010
2011 /* If successful wait for the name req complete event before
2012 * checking for the need to do authentication */
2013 if (!status)
2014 return;
2015
2016 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2017 if (!cp)
2018 return;
2019
2020 hci_dev_lock(hdev);
2021
b644ba33
JH		 2022 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2023
d7a5a11d 2024 if (hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2025 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
30dc78e1 2026
79c6c70c
JH		 2027 if (!conn)
2028 goto unlock;
2029
2030 if (!hci_outgoing_auth_needed(hdev, conn))
2031 goto unlock;
2032
51a8efd7 2033 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
c1f23a2b
JB		 2034 struct hci_cp_auth_requested auth_cp;
2035
977f8fce
JH		 2036 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2037
c1f23a2b
JB		 2038 auth_cp.handle = __cpu_to_le16(conn->handle);
2039 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2040 sizeof(auth_cp), &auth_cp);
127178d2
JH		 2041 }
2042
79c6c70c 2043unlock:
127178d2 2044 hci_dev_unlock(hdev);
a9de9248 2045}
1da177e4 2046
769be974
MH		 2047static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2048{
2049 struct hci_cp_read_remote_features *cp;
2050 struct hci_conn *conn;
2051
9f1db00c 2052 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 2053
2054 if (!status)
2055 return;
2056
2057 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2058 if (!cp)
2059 return;
2060
2061 hci_dev_lock(hdev);
2062
2063 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2064 if (conn) {
2065 if (conn->state == BT_CONFIG) {
539c496d 2066 hci_connect_cfm(conn, status);
76a68ba0 2067 hci_conn_drop(conn);
769be974
MH		 2068 }
2069 }
2070
2071 hci_dev_unlock(hdev);
2072}
2073
2074static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2075{
2076 struct hci_cp_read_remote_ext_features *cp;
2077 struct hci_conn *conn;
2078
9f1db00c 2079 BT_DBG("%s status 0x%2.2x", hdev->name, status);
769be974
MH		 2080
2081 if (!status)
2082 return;
2083
2084 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2085 if (!cp)
2086 return;
2087
2088 hci_dev_lock(hdev);
2089
2090 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2091 if (conn) {
2092 if (conn->state == BT_CONFIG) {
539c496d 2093 hci_connect_cfm(conn, status);
76a68ba0 2094 hci_conn_drop(conn);
769be974
MH		 2095 }
2096 }
2097
2098 hci_dev_unlock(hdev);
2099}
2100
a9de9248
MH		 2101static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2102{
b6a0dc82
MH		 2103 struct hci_cp_setup_sync_conn *cp;
2104 struct hci_conn *acl, *sco;
2105 __u16 handle;
2106
9f1db00c 2107 BT_DBG("%s status 0x%2.2x", hdev->name, status);
b6a0dc82
MH		 2108
2109 if (!status)
2110 return;
2111
2112 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2113 if (!cp)
2114 return;
2115
2116 handle = __le16_to_cpu(cp->handle);
2117
9f1db00c 2118 BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
b6a0dc82
MH		 2119
2120 hci_dev_lock(hdev);
2121
2122 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 2123 if (acl) {
2124 sco = acl->link;
2125 if (sco) {
2126 sco->state = BT_CLOSED;
b6a0dc82 2127
539c496d 2128 hci_connect_cfm(sco, status);
5a08ecce
AE		 2129 hci_conn_del(sco);
2130 }
b6a0dc82
MH		 2131 }
2132
2133 hci_dev_unlock(hdev);
1da177e4
LT		 2134}
2135
a9de9248 2136static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 2137{
a9de9248
MH		 2138 struct hci_cp_sniff_mode *cp;
2139 struct hci_conn *conn;
1da177e4 2140
9f1db00c 2141 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 2142
a9de9248
MH		 2143 if (!status)
2144 return;
04837f64 2145
a9de9248
MH		 2146 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2147 if (!cp)
2148 return;
04837f64 2149
a9de9248 2150 hci_dev_lock(hdev);
04837f64 2151
a9de9248 2152 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 2153 if (conn) {
51a8efd7 2154 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
04837f64 2155
51a8efd7 2156 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 2157 hci_sco_setup(conn, status);
2158 }
2159
a9de9248
MH		 2160 hci_dev_unlock(hdev);
2161}
04837f64 2162
a9de9248
MH		 2163static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2164{
2165 struct hci_cp_exit_sniff_mode *cp;
2166 struct hci_conn *conn;
04837f64 2167
9f1db00c 2168 BT_DBG("%s status 0x%2.2x", hdev->name, status);
04837f64 2169
a9de9248
MH		 2170 if (!status)
2171 return;
04837f64 2172
a9de9248
MH		 2173 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2174 if (!cp)
2175 return;
04837f64 2176
a9de9248 2177 hci_dev_lock(hdev);
1da177e4 2178
a9de9248 2179 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 2180 if (conn) {
51a8efd7 2181 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1da177e4 2182
51a8efd7 2183 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8
MH		 2184 hci_sco_setup(conn, status);
2185 }
2186
a9de9248 2187 hci_dev_unlock(hdev);
1da177e4
LT		 2188}
2189
88c3df13
JH		 2190static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2191{
2192 struct hci_cp_disconnect *cp;
2193 struct hci_conn *conn;
2194
2195 if (!status)
2196 return;
2197
2198 cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2199 if (!cp)
2200 return;
2201
2202 hci_dev_lock(hdev);
2203
2204 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2205 if (conn)
2206 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
04124681 2207 conn->dst_type, status);
88c3df13
JH		 2208
2209 hci_dev_unlock(hdev);
2210}
2211
d12fb056
JK		 2212static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2213 u8 peer_addr_type, u8 own_address_type,
2214 u8 filter_policy)
cb1d68f7 2215{
cb1d68f7
JH		 2216 struct hci_conn *conn;
2217
d12fb056
JK		 2218 conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2219 peer_addr_type);
cb1d68f7 2220 if (!conn)
d12fb056 2221 return;
cb1d68f7
JH		 2222
2223 /* Store the initiator and responder address information which
2224 * is needed for SMP. These values will not change during the
2225 * lifetime of the connection.
2226 */
d12fb056
JK		 2227 conn->init_addr_type = own_address_type;
2228 if (own_address_type == ADDR_LE_DEV_RANDOM)
cb1d68f7
JH		 2229 bacpy(&conn->init_addr, &hdev->random_addr);
2230 else
2231 bacpy(&conn->init_addr, &hdev->bdaddr);
2232
d12fb056
JK		 2233 conn->resp_addr_type = peer_addr_type;
2234 bacpy(&conn->resp_addr, peer_addr);
cb1d68f7 2235
9489eca4
JH		 2236 /* We don't want the connection attempt to stick around
2237 * indefinitely since LE doesn't have a page timeout concept
2238 * like BR/EDR. Set a timer for any connection that doesn't use
2239 * the white list for connecting.
2240 */
d12fb056 2241 if (filter_policy == HCI_LE_USE_PEER_ADDR)
9489eca4
JH		 2242 queue_delayed_work(conn->hdev->workqueue,
2243 &conn->le_conn_timeout,
09ae260b 2244 conn->conn_timeout);
d12fb056
JK		 2245}
2246
2247static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2248{
2249 struct hci_cp_le_create_conn *cp;
2250
2251 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2252
2253 /* All connection failure handling is taken care of by the
2254 * hci_le_conn_failed function which is triggered by the HCI
2255 * request completion callbacks used for connecting.
2256 */
2257 if (status)
2258 return;
2259
2260 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2261 if (!cp)
2262 return;
2263
2264 hci_dev_lock(hdev);
2265
2266 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2267 cp->own_address_type, cp->filter_policy);
9489eca4 2268
cb1d68f7
JH		 2269 hci_dev_unlock(hdev);
2270}
2271
4d94f95d
JK		 2272static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2273{
2274 struct hci_cp_le_ext_create_conn *cp;
2275
2276 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2277
2278 /* All connection failure handling is taken care of by the
2279 * hci_le_conn_failed function which is triggered by the HCI
2280 * request completion callbacks used for connecting.
2281 */
2282 if (status)
2283 return;
2284
2285 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2286 if (!cp)
2287 return;
2288
2289 hci_dev_lock(hdev);
2290
2291 cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2292 cp->own_addr_type, cp->filter_policy);
2293
2294 hci_dev_unlock(hdev);
2295}
2296
0fe29fd1
MH		 2297static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2298{
2299 struct hci_cp_le_read_remote_features *cp;
2300 struct hci_conn *conn;
2301
2302 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2303
2304 if (!status)
2305 return;
2306
2307 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2308 if (!cp)
2309 return;
2310
2311 hci_dev_lock(hdev);
2312
2313 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2314 if (conn) {
2315 if (conn->state == BT_CONFIG) {
2316 hci_connect_cfm(conn, status);
2317 hci_conn_drop(conn);
2318 }
2319 }
2320
2321 hci_dev_unlock(hdev);
2322}
2323
81d0c8ad
JH		 2324static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2325{
2326 struct hci_cp_le_start_enc *cp;
2327 struct hci_conn *conn;
2328
2329 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2330
2331 if (!status)
2332 return;
2333
2334 hci_dev_lock(hdev);
2335
2336 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2337 if (!cp)
2338 goto unlock;
2339
2340 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2341 if (!conn)
2342 goto unlock;
2343
2344 if (conn->state != BT_CONNECTED)
2345 goto unlock;
2346
2347 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2348 hci_conn_drop(conn);
2349
2350unlock:
2351 hci_dev_unlock(hdev);
2352}
2353
50fc85f1
KP		 2354static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2355{
2356 struct hci_cp_switch_role *cp;
2357 struct hci_conn *conn;
2358
2359 BT_DBG("%s status 0x%2.2x", hdev->name, status);
2360
2361 if (!status)
2362 return;
2363
2364 cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2365 if (!cp)
2366 return;
2367
2368 hci_dev_lock(hdev);
2369
2370 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2371 if (conn)
2372 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2373
2374 hci_dev_unlock(hdev);
2375}
2376
6039aa73 2377static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2378{
2379 __u8 status = *((__u8 *) skb->data);
30dc78e1
JH		 2380 struct discovery_state *discov = &hdev->discovery;
2381 struct inquiry_entry *e;
1da177e4 2382
9f1db00c 2383 BT_DBG("%s status 0x%2.2x", hdev->name, status);
1da177e4 2384
a9de9248 2385 hci_conn_check_pending(hdev);
89352e7d
AG		 2386
2387 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2388 return;
2389
4e857c58 2390 smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3e13fa1e
AG		 2391 wake_up_bit(&hdev->flags, HCI_INQUIRY);
2392
d7a5a11d 2393 if (!hci_dev_test_flag(hdev, HCI_MGMT))
30dc78e1
JH		 2394 return;
2395
56e5cb86 2396 hci_dev_lock(hdev);
30dc78e1 2397
343f935b 2398 if (discov->state != DISCOVERY_FINDING)
30dc78e1
JH		 2399 goto unlock;
2400
2401 if (list_empty(&discov->resolve)) {
07d2334a
JP		 2402 /* When BR/EDR inquiry is active and no LE scanning is in
2403 * progress, then change discovery state to indicate completion.
2404 *
2405 * When running LE scanning and BR/EDR inquiry simultaneously
2406 * and the LE scan already finished, then change the discovery
2407 * state to indicate completion.
2408 */
2409 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2410 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2411 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2412 goto unlock;
2413 }
2414
2415 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2416 if (e && hci_resolve_name(hdev, e) == 0) {
2417 e->name_state = NAME_PENDING;
2418 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2419 } else {
07d2334a
JP		 2420 /* When BR/EDR inquiry is active and no LE scanning is in
2421 * progress, then change discovery state to indicate completion.
2422 *
2423 * When running LE scanning and BR/EDR inquiry simultaneously
2424 * and the LE scan already finished, then change the discovery
2425 * state to indicate completion.
2426 */
2427 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2428 !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2429 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
30dc78e1
JH		 2430 }
2431
2432unlock:
56e5cb86 2433 hci_dev_unlock(hdev);
1da177e4
LT		 2434}
2435
6039aa73 2436static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2437{
45bb4bf0 2438 struct inquiry_data data;
a9de9248 2439 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 2440 int num_rsp = *((__u8 *) skb->data);
2441
2442 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2443
45bb4bf0
MH		 2444 if (!num_rsp)
2445 return;
2446
d7a5a11d 2447 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 2448 return;
2449
1da177e4 2450 hci_dev_lock(hdev);
45bb4bf0 2451
e17acd40 2452 for (; num_rsp; num_rsp--, info++) {
af58925c 2453 u32 flags;
3175405b 2454
1da177e4
LT		 2455 bacpy(&data.bdaddr, &info->bdaddr);
2456 data.pscan_rep_mode = info->pscan_rep_mode;
2457 data.pscan_period_mode = info->pscan_period_mode;
2458 data.pscan_mode = info->pscan_mode;
2459 memcpy(data.dev_class, info->dev_class, 3);
2460 data.clock_offset = info->clock_offset;
efb2513f 2461 data.rssi = HCI_RSSI_INVALID;
41a96212 2462 data.ssp_mode = 0x00;
3175405b 2463
af58925c
MH		 2464 flags = hci_inquiry_cache_update(hdev, &data, false);
2465
48264f06 2466 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
efb2513f
MH		 2467 info->dev_class, HCI_RSSI_INVALID,
2468 flags, NULL, 0, NULL, 0);
1da177e4 2469 }
45bb4bf0 2470
1da177e4
LT		 2471 hci_dev_unlock(hdev);
2472}
2473
6039aa73 2474static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2475{
a9de9248
MH		 2476 struct hci_ev_conn_complete *ev = (void *) skb->data;
2477 struct hci_conn *conn;
1da177e4
LT		 2478
2479 BT_DBG("%s", hdev->name);
2480
2481 hci_dev_lock(hdev);
2482
2483 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 2484 if (!conn) {
2485 if (ev->link_type != SCO_LINK)
2486 goto unlock;
2487
2488 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2489 if (!conn)
2490 goto unlock;
2491
2492 conn->type = SCO_LINK;
2493 }
1da177e4
LT		 2494
2495 if (!ev->status) {
2496 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 2497
2498 if (conn->type == ACL_LINK) {
2499 conn->state = BT_CONFIG;
2500 hci_conn_hold(conn);
a9ea3ed9
SJ		 2501
2502 if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2503 !hci_find_link_key(hdev, &ev->bdaddr))
2504 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2505 else
2506 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
769be974
MH		 2507 } else
2508 conn->state = BT_CONNECTED;
1da177e4 2509
23b9ceb7 2510 hci_debugfs_create_conn(conn);
7d0db0a3
MH		 2511 hci_conn_add_sysfs(conn);
2512
1da177e4 2513 if (test_bit(HCI_AUTH, &hdev->flags))
4dae2798 2514 set_bit(HCI_CONN_AUTH, &conn->flags);
1da177e4
LT		 2515
2516 if (test_bit(HCI_ENCRYPT, &hdev->flags))
4dae2798 2517 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
1da177e4 2518
04837f64
MH		 2519 /* Get remote features */
2520 if (conn->type == ACL_LINK) {
2521 struct hci_cp_read_remote_features cp;
2522 cp.handle = ev->handle;
769be974 2523 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
04124681 2524 sizeof(cp), &cp);
22f433dc 2525
01b1cb87 2526 hci_req_update_scan(hdev);
04837f64
MH		 2527 }
2528
1da177e4 2529 /* Set packet type for incoming connection */
d095c1eb 2530 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1da177e4
LT		 2531 struct hci_cp_change_conn_ptype cp;
2532 cp.handle = ev->handle;
a8746417 2533 cp.pkt_type = cpu_to_le16(conn->pkt_type);
04124681
GP		 2534 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2535 &cp);
1da177e4 2536 }
17d5c04c 2537 } else {
1da177e4 2538 conn->state = BT_CLOSED;
17d5c04c 2539 if (conn->type == ACL_LINK)
64c7b77c 2540 mgmt_connect_failed(hdev, &conn->dst, conn->type,
04124681 2541 conn->dst_type, ev->status);
17d5c04c 2542 }
1da177e4 2543
e73439d8
MH		 2544 if (conn->type == ACL_LINK)
2545 hci_sco_setup(conn, ev->status);
1da177e4 2546
769be974 2547 if (ev->status) {
539c496d 2548 hci_connect_cfm(conn, ev->status);
1da177e4 2549 hci_conn_del(conn);
c89b6e6b 2550 } else if (ev->link_type != ACL_LINK)
539c496d 2551 hci_connect_cfm(conn, ev->status);
1da177e4 2552
a9de9248 2553unlock:
1da177e4 2554 hci_dev_unlock(hdev);
1da177e4 2555
a9de9248 2556 hci_conn_check_pending(hdev);
1da177e4
LT		 2557}
2558
70c46425
JH		 2559static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2560{
2561 struct hci_cp_reject_conn_req cp;
2562
2563 bacpy(&cp.bdaddr, bdaddr);
2564 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2565 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2566}
2567
6039aa73 2568static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2569{
a9de9248
MH		 2570 struct hci_ev_conn_request *ev = (void *) skb->data;
2571 int mask = hdev->link_mode;
70c46425
JH		 2572 struct inquiry_entry *ie;
2573 struct hci_conn *conn;
20714bfe 2574 __u8 flags = 0;
1da177e4 2575
6ed93dc6 2576 BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
807deac2 2577 ev->link_type);
1da177e4 2578
20714bfe
FD		 2579 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2580 &flags);
1da177e4 2581
70c46425
JH		 2582 if (!(mask & HCI_LM_ACCEPT)) {
2583 hci_reject_conn(hdev, &ev->bdaddr);
2584 return;
2585 }
2586
46c4c941
JH		 2587 if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2588 BDADDR_BREDR)) {
2589 hci_reject_conn(hdev, &ev->bdaddr);
2590 return;
2591 }
2592
6a8fc95c
JH		 2593 /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2594 * connection. These features are only touched through mgmt so
2595 * only do the checks if HCI_MGMT is set.
2596 */
d7a5a11d
MH		 2597 if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2598 !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
46c4c941
JH		 2599 !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2600 BDADDR_BREDR)) {
2601 hci_reject_conn(hdev, &ev->bdaddr);
2602 return;
70c46425 2603 }
1da177e4 2604
70c46425 2605 /* Connection accepted */
b6a0dc82 2606
70c46425
JH		 2607 hci_dev_lock(hdev);
2608
2609 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2610 if (ie)
2611 memcpy(ie->data.dev_class, ev->dev_class, 3);
c7bdd502 2612
70c46425
JH		 2613 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2614 &ev->bdaddr);
2615 if (!conn) {
a5c4e309
JH		 2616 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2617 HCI_ROLE_SLAVE);
a9de9248 2618 if (!conn) {
2064ee33 2619 bt_dev_err(hdev, "no memory for new connection");
70c46425
JH		 2620 hci_dev_unlock(hdev);
2621 return;
1da177e4 2622 }
70c46425 2623 }
b6a0dc82 2624
70c46425 2625 memcpy(conn->dev_class, ev->dev_class, 3);
b6a0dc82 2626
70c46425 2627 hci_dev_unlock(hdev);
1da177e4 2628
70c46425
JH		 2629 if (ev->link_type == ACL_LINK ||
2630 (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2631 struct hci_cp_accept_conn_req cp;
2632 conn->state = BT_CONNECT;
1da177e4 2633
70c46425 2634 bacpy(&cp.bdaddr, &ev->bdaddr);
b6a0dc82 2635
70c46425
JH		 2636 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2637 cp.role = 0x00; /* Become master */
2638 else
2639 cp.role = 0x01; /* Remain slave */
b6a0dc82 2640
70c46425
JH		 2641 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2642 } else if (!(flags & HCI_PROTO_DEFER)) {
2643 struct hci_cp_accept_sync_conn_req cp;
2644 conn->state = BT_CONNECT;
b6a0dc82 2645
70c46425
JH		 2646 bacpy(&cp.bdaddr, &ev->bdaddr);
2647 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82 2648
70c46425
JH		 2649 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
2650 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
2651 cp.max_latency = cpu_to_le16(0xffff);
2652 cp.content_format = cpu_to_le16(hdev->voice_setting);
2653 cp.retrans_effort = 0xff;
1da177e4 2654
70c46425
JH		 2655 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2656 &cp);
a9de9248 2657 } else {
70c46425 2658 conn->state = BT_CONNECT2;
539c496d 2659 hci_connect_cfm(conn, 0);
1da177e4 2660 }
1da177e4
LT		 2661}
2662
f0d6a0ea
MA		 2663static u8 hci_to_mgmt_reason(u8 err)
2664{
2665 switch (err) {
2666 case HCI_ERROR_CONNECTION_TIMEOUT:
2667 return MGMT_DEV_DISCONN_TIMEOUT;
2668 case HCI_ERROR_REMOTE_USER_TERM:
2669 case HCI_ERROR_REMOTE_LOW_RESOURCES:
2670 case HCI_ERROR_REMOTE_POWER_OFF:
2671 return MGMT_DEV_DISCONN_REMOTE;
2672 case HCI_ERROR_LOCAL_HOST_TERM:
2673 return MGMT_DEV_DISCONN_LOCAL_HOST;
2674 default:
2675 return MGMT_DEV_DISCONN_UNKNOWN;
2676 }
2677}
2678
6039aa73 2679static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2680{
a9de9248 2681 struct hci_ev_disconn_complete *ev = (void *) skb->data;
160b9251 2682 u8 reason;
9fcb18ef 2683 struct hci_conn_params *params;
04837f64 2684 struct hci_conn *conn;
12d4a3b2 2685 bool mgmt_connected;
3846220b 2686 u8 type;
04837f64 2687
9f1db00c 2688 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 2689
2690 hci_dev_lock(hdev);
2691
2692 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 2693 if (!conn)
2694 goto unlock;
7d0db0a3 2695
abf54a50
AG		 2696 if (ev->status) {
2697 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2698 conn->dst_type, ev->status);
2699 goto unlock;
37d9ef76 2700 }
f7520543 2701
3846220b
AG		 2702 conn->state = BT_CLOSED;
2703
12d4a3b2 2704 mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
160b9251
SJ		 2705
2706 if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2707 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2708 else
2709 reason = hci_to_mgmt_reason(ev->reason);
2710
12d4a3b2
JH		 2711 mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2712 reason, mgmt_connected);
abf54a50 2713
22f433dc
JH		 2714 if (conn->type == ACL_LINK) {
2715 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2716 hci_remove_link_key(hdev, &conn->dst);
2717
01b1cb87 2718 hci_req_update_scan(hdev);
22f433dc 2719 }
2210246c 2720
9fcb18ef
AG		 2721 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2722 if (params) {
2723 switch (params->auto_connect) {
2724 case HCI_AUTO_CONN_LINK_LOSS:
2725 if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2726 break;
2727 /* Fall through */
2728
4b9e7e75 2729 case HCI_AUTO_CONN_DIRECT:
9fcb18ef 2730 case HCI_AUTO_CONN_ALWAYS:
418025d1
JH		 2731 list_del_init(&params->action);
2732 list_add(&params->action, &hdev->pend_le_conns);
2733 hci_update_background_scan(hdev);
9fcb18ef
AG		 2734 break;
2735
2736 default:
2737 break;
2738 }
2739 }
2740
3846220b 2741 type = conn->type;
2210246c 2742
3a6d576b 2743 hci_disconn_cfm(conn, ev->reason);
3846220b
AG		 2744 hci_conn_del(conn);
2745
2746 /* Re-enable advertising if necessary, since it might
2747 * have been disabled by the connection. From the
2748 * HCI_LE_Set_Advertise_Enable command description in
2749 * the core specification (v4.0):
2750 * "The Controller shall continue advertising until the Host
2751 * issues an LE_Set_Advertise_Enable command with
2752 * Advertising_Enable set to 0x00 (Advertising is disabled)
2753 * or until a connection is created or until the Advertising
2754 * is timed out due to Directed Advertising."
2755 */
2756 if (type == LE_LINK)
f2252570 2757 hci_req_reenable_advertising(hdev);
f7520543
JH		 2758
2759unlock:
04837f64
MH		 2760 hci_dev_unlock(hdev);
2761}
2762
6039aa73 2763static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2764{
a9de9248 2765 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 2766 struct hci_conn *conn;
1da177e4 2767
9f1db00c 2768 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2769
2770 hci_dev_lock(hdev);
2771
04837f64 2772 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 2773 if (!conn)
2774 goto unlock;
2775
2776 if (!ev->status) {
160b9251
SJ		 2777 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2778
aa64a8b5 2779 if (!hci_conn_ssp_enabled(conn) &&
807deac2 2780 test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2064ee33 2781 bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2a611692 2782 } else {
4dae2798 2783 set_bit(HCI_CONN_AUTH, &conn->flags);
d7556e20 2784 conn->sec_level = conn->pending_sec_level;
2a611692 2785 }
d7556e20 2786 } else {
160b9251
SJ		 2787 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2788 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2789
e1e930f5 2790 mgmt_auth_failed(conn, ev->status);
d7556e20 2791 }
1da177e4 2792
51a8efd7
JH		 2793 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2794 clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
1da177e4 2795
d7556e20 2796 if (conn->state == BT_CONFIG) {
aa64a8b5 2797 if (!ev->status && hci_conn_ssp_enabled(conn)) {
d7556e20
WR		 2798 struct hci_cp_set_conn_encrypt cp;
2799 cp.handle = ev->handle;
2800 cp.encrypt = 0x01;
2801 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2802 &cp);
052b30b0 2803 } else {
d7556e20 2804 conn->state = BT_CONNECTED;
539c496d 2805 hci_connect_cfm(conn, ev->status);
76a68ba0 2806 hci_conn_drop(conn);
052b30b0 2807 }
d7556e20
WR		 2808 } else {
2809 hci_auth_cfm(conn, ev->status);
052b30b0 2810
d7556e20
WR		 2811 hci_conn_hold(conn);
2812 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 2813 hci_conn_drop(conn);
d7556e20
WR		 2814 }
2815
51a8efd7 2816 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
d7556e20
WR		 2817 if (!ev->status) {
2818 struct hci_cp_set_conn_encrypt cp;
2819 cp.handle = ev->handle;
2820 cp.encrypt = 0x01;
2821 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
807deac2 2822 &cp);
d7556e20 2823 } else {
51a8efd7 2824 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
d7556e20 2825 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 2826 }
2827 }
2828
d7556e20 2829unlock:
1da177e4
LT		 2830 hci_dev_unlock(hdev);
2831}
2832
6039aa73 2833static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2834{
127178d2
JH		 2835 struct hci_ev_remote_name *ev = (void *) skb->data;
2836 struct hci_conn *conn;
2837
a9de9248 2838 BT_DBG("%s", hdev->name);
1da177e4 2839
a9de9248 2840 hci_conn_check_pending(hdev);
127178d2
JH		 2841
2842 hci_dev_lock(hdev);
2843
b644ba33 2844 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
30dc78e1 2845
d7a5a11d 2846 if (!hci_dev_test_flag(hdev, HCI_MGMT))
b644ba33 2847 goto check_auth;
a88a9652 2848
b644ba33
JH		 2849 if (ev->status == 0)
2850 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
04124681 2851 strnlen(ev->name, HCI_MAX_NAME_LENGTH));
b644ba33
JH		 2852 else
2853 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2854
2855check_auth:
79c6c70c
JH		 2856 if (!conn)
2857 goto unlock;
2858
2859 if (!hci_outgoing_auth_needed(hdev, conn))
2860 goto unlock;
2861
51a8efd7 2862 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
127178d2 2863 struct hci_cp_auth_requested cp;
977f8fce
JH		 2864
2865 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2866
127178d2
JH		 2867 cp.handle = __cpu_to_le16(conn->handle);
2868 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2869 }
2870
79c6c70c 2871unlock:
127178d2 2872 hci_dev_unlock(hdev);
a9de9248
MH		 2873}
2874
821f3766
JH		 2875static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2876 u16 opcode, struct sk_buff *skb)
2877{
2878 const struct hci_rp_read_enc_key_size *rp;
2879 struct hci_conn *conn;
2880 u16 handle;
2881
2882 BT_DBG("%s status 0x%02x", hdev->name, status);
2883
2884 if (!skb || skb->len < sizeof(*rp)) {
2064ee33 2885 bt_dev_err(hdev, "invalid read key size response");
821f3766
JH		 2886 return;
2887 }
2888
2889 rp = (void *)skb->data;
2890 handle = le16_to_cpu(rp->handle);
2891
2892 hci_dev_lock(hdev);
2893
2894 conn = hci_conn_hash_lookup_handle(hdev, handle);
2895 if (!conn)
2896 goto unlock;
2897
2898 /* If we fail to read the encryption key size, assume maximum
2899 * (which is the same we do also when this HCI command isn't
2900 * supported.
2901 */
2902 if (rp->status) {
2064ee33
MH		 2903 bt_dev_err(hdev, "failed to read key size for handle %u",
2904 handle);
821f3766
JH		 2905 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2906 } else {
2907 conn->enc_key_size = rp->key_size;
2908 }
2909
2910 if (conn->state == BT_CONFIG) {
2911 conn->state = BT_CONNECTED;
2912 hci_connect_cfm(conn, 0);
2913 hci_conn_drop(conn);
2914 } else {
2915 u8 encrypt;
2916
2917 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2918 encrypt = 0x00;
5d667ef6 2919 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
821f3766
JH		 2920 encrypt = 0x02;
2921 else
2922 encrypt = 0x01;
2923
2924 hci_encrypt_cfm(conn, 0, encrypt);
2925 }
2926
2927unlock:
2928 hci_dev_unlock(hdev);
2929}
2930
6039aa73 2931static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 2932{
2933 struct hci_ev_encrypt_change *ev = (void *) skb->data;
2934 struct hci_conn *conn;
2935
9f1db00c 2936 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 2937
2938 hci_dev_lock(hdev);
2939
04837f64 2940 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
dc8357cc
MH		 2941 if (!conn)
2942 goto unlock;
1da177e4 2943
dc8357cc
MH		 2944 if (!ev->status) {
2945 if (ev->encrypt) {
2946 /* Encryption implies authentication */
4dae2798
JH		 2947 set_bit(HCI_CONN_AUTH, &conn->flags);
2948 set_bit(HCI_CONN_ENCRYPT, &conn->flags);
dc8357cc 2949 conn->sec_level = conn->pending_sec_level;
abf76bad 2950
914a6ffe
MH		 2951 /* P-256 authentication key implies FIPS */
2952 if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
4dae2798 2953 set_bit(HCI_CONN_FIPS, &conn->flags);
914a6ffe 2954
abf76bad
MH		 2955 if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2956 conn->type == LE_LINK)
2957 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2958 } else {
4dae2798 2959 clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
abf76bad
MH		 2960 clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2961 }
dc8357cc 2962 }
a7d7723a 2963
7ed3fa20
JH		 2964 /* We should disregard the current RPA and generate a new one
2965 * whenever the encryption procedure fails.
2966 */
a73c046a 2967 if (ev->status && conn->type == LE_LINK) {
a1536da2 2968 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
a73c046a
JK		 2969 hci_adv_instances_set_rpa_expired(hdev, true);
2970 }
7ed3fa20 2971
dc8357cc 2972 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
f8558555 2973
dc8357cc 2974 if (ev->status && conn->state == BT_CONNECTED) {
160b9251
SJ		 2975 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2976 set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2977
dc8357cc
MH		 2978 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2979 hci_conn_drop(conn);
2980 goto unlock;
1da177e4
LT		 2981 }
2982
035ad621
JH		 2983 /* In Secure Connections Only mode, do not allow any connections
2984 * that are not encrypted with AES-CCM using a P-256 authenticated
2985 * combination key.
2986 */
2987 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2988 (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2989 conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2990 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2991 hci_conn_drop(conn);
2992 goto unlock;
2993 }
2994
821f3766
JH		 2995 /* Try reading the encryption key size for encrypted ACL links */
2996 if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2997 struct hci_cp_read_enc_key_size cp;
2998 struct hci_request req;
2999
3000 /* Only send HCI_Read_Encryption_Key_Size if the
3001 * controller really supports it. If it doesn't, assume
3002 * the default size (16).
3003 */
3004 if (!(hdev->commands[20] & 0x10)) {
3005 conn->enc_key_size = HCI_LINK_KEY_SIZE;
3006 goto notify;
3007 }
3008
3009 hci_req_init(&req, hdev);
3010
3011 cp.handle = cpu_to_le16(conn->handle);
3012 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3013
3014 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2064ee33 3015 bt_dev_err(hdev, "sending read key size failed");
821f3766
JH		 3016 conn->enc_key_size = HCI_LINK_KEY_SIZE;
3017 goto notify;
3018 }
3019
3020 goto unlock;
3021 }
3022
302975cb
SRK		 3023 /* Set the default Authenticated Payload Timeout after
3024 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3025 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3026 * sent when the link is active and Encryption is enabled, the conn
3027 * type can be either LE or ACL and controller must support LMP Ping.
3028 * Ensure for AES-CCM encryption as well.
3029 */
3030 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3031 test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3032 ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3033 (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3034 struct hci_cp_write_auth_payload_to cp;
3035
3036 cp.handle = cpu_to_le16(conn->handle);
3037 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3038 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3039 sizeof(cp), &cp);
3040 }
3041
821f3766 3042notify:
dc8357cc
MH		 3043 if (conn->state == BT_CONFIG) {
3044 if (!ev->status)
3045 conn->state = BT_CONNECTED;
3046
539c496d 3047 hci_connect_cfm(conn, ev->status);
dc8357cc
MH		 3048 hci_conn_drop(conn);
3049 } else
3050 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
3051
a7d7723a 3052unlock:
1da177e4
LT		 3053 hci_dev_unlock(hdev);
3054}
3055
6039aa73
GP		 3056static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3057 struct sk_buff *skb)
1da177e4 3058{
a9de9248 3059 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 3060 struct hci_conn *conn;
1da177e4 3061
9f1db00c 3062 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3063
3064 hci_dev_lock(hdev);
3065
04837f64 3066 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 3067 if (conn) {
3068 if (!ev->status)
4dae2798 3069 set_bit(HCI_CONN_SECURE, &conn->flags);
1da177e4 3070
51a8efd7 3071 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
1da177e4
LT		 3072
3073 hci_key_change_cfm(conn, ev->status);
3074 }
3075
3076 hci_dev_unlock(hdev);
3077}
3078
6039aa73
GP		 3079static void hci_remote_features_evt(struct hci_dev *hdev,
3080 struct sk_buff *skb)
1da177e4 3081{
a9de9248
MH		 3082 struct hci_ev_remote_features *ev = (void *) skb->data;
3083 struct hci_conn *conn;
3084
9f1db00c 3085 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248 3086
a9de9248
MH		 3087 hci_dev_lock(hdev);
3088
3089 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 3090 if (!conn)
3091 goto unlock;
769be974 3092
ccd556fe 3093 if (!ev->status)
cad718ed 3094 memcpy(conn->features[0], ev->features, 8);
ccd556fe
JH		 3095
3096 if (conn->state != BT_CONFIG)
3097 goto unlock;
3098
ac363cf9
SJ		 3099 if (!ev->status && lmp_ext_feat_capable(hdev) &&
3100 lmp_ext_feat_capable(conn)) {
ccd556fe
JH		 3101 struct hci_cp_read_remote_ext_features cp;
3102 cp.handle = ev->handle;
3103 cp.page = 0x01;
3104 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
807deac2 3105 sizeof(cp), &cp);
392599b9
JH		 3106 goto unlock;
3107 }
3108
671267bf 3109 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 3110 struct hci_cp_remote_name_req cp;
3111 memset(&cp, 0, sizeof(cp));
3112 bacpy(&cp.bdaddr, &conn->dst);
3113 cp.pscan_rep_mode = 0x02;
3114 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 3115 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 3116 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 3117
127178d2 3118 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 3119 conn->state = BT_CONNECTED;
539c496d 3120 hci_connect_cfm(conn, ev->status);
76a68ba0 3121 hci_conn_drop(conn);
769be974 3122 }
a9de9248 3123
ccd556fe 3124unlock:
a9de9248 3125 hci_dev_unlock(hdev);
1da177e4
LT		 3126}
3127
e6214487
JH		 3128static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3129 u16 *opcode, u8 *status,
3130 hci_req_complete_t *req_complete,
3131 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3132{
3133 struct hci_ev_cmd_complete *ev = (void *) skb->data;
a9de9248 3134
e6214487
JH		 3135 *opcode = __le16_to_cpu(ev->opcode);
3136 *status = skb->data[sizeof(*ev)];
a9de9248 3137
e6214487 3138 skb_pull(skb, sizeof(*ev));
a9de9248 3139
e6214487 3140 switch (*opcode) {
a9de9248
MH		 3141 case HCI_OP_INQUIRY_CANCEL:
3142 hci_cc_inquiry_cancel(hdev, skb);
3143 break;
3144
4d93483b
AG		 3145 case HCI_OP_PERIODIC_INQ:
3146 hci_cc_periodic_inq(hdev, skb);
3147 break;
3148
a9de9248
MH		 3149 case HCI_OP_EXIT_PERIODIC_INQ:
3150 hci_cc_exit_periodic_inq(hdev, skb);
3151 break;
3152
3153 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3154 hci_cc_remote_name_req_cancel(hdev, skb);
3155 break;
3156
3157 case HCI_OP_ROLE_DISCOVERY:
3158 hci_cc_role_discovery(hdev, skb);
3159 break;
3160
e4e8e37c
MH		 3161 case HCI_OP_READ_LINK_POLICY:
3162 hci_cc_read_link_policy(hdev, skb);
3163 break;
3164
a9de9248
MH		 3165 case HCI_OP_WRITE_LINK_POLICY:
3166 hci_cc_write_link_policy(hdev, skb);
3167 break;
3168
e4e8e37c
MH		 3169 case HCI_OP_READ_DEF_LINK_POLICY:
3170 hci_cc_read_def_link_policy(hdev, skb);
3171 break;
3172
3173 case HCI_OP_WRITE_DEF_LINK_POLICY:
3174 hci_cc_write_def_link_policy(hdev, skb);
3175 break;
3176
a9de9248
MH		 3177 case HCI_OP_RESET:
3178 hci_cc_reset(hdev, skb);
3179 break;
3180
c2f0f979
MH		 3181 case HCI_OP_READ_STORED_LINK_KEY:
3182 hci_cc_read_stored_link_key(hdev, skb);
3183 break;
3184
a9366120
MH		 3185 case HCI_OP_DELETE_STORED_LINK_KEY:
3186 hci_cc_delete_stored_link_key(hdev, skb);
3187 break;
3188
a9de9248
MH		 3189 case HCI_OP_WRITE_LOCAL_NAME:
3190 hci_cc_write_local_name(hdev, skb);
3191 break;
3192
3193 case HCI_OP_READ_LOCAL_NAME:
3194 hci_cc_read_local_name(hdev, skb);
3195 break;
3196
3197 case HCI_OP_WRITE_AUTH_ENABLE:
3198 hci_cc_write_auth_enable(hdev, skb);
3199 break;
3200
3201 case HCI_OP_WRITE_ENCRYPT_MODE:
3202 hci_cc_write_encrypt_mode(hdev, skb);
3203 break;
3204
3205 case HCI_OP_WRITE_SCAN_ENABLE:
3206 hci_cc_write_scan_enable(hdev, skb);
3207 break;
3208
3209 case HCI_OP_READ_CLASS_OF_DEV:
3210 hci_cc_read_class_of_dev(hdev, skb);
3211 break;
3212
3213 case HCI_OP_WRITE_CLASS_OF_DEV:
3214 hci_cc_write_class_of_dev(hdev, skb);
3215 break;
3216
3217 case HCI_OP_READ_VOICE_SETTING:
3218 hci_cc_read_voice_setting(hdev, skb);
3219 break;
3220
3221 case HCI_OP_WRITE_VOICE_SETTING:
3222 hci_cc_write_voice_setting(hdev, skb);
3223 break;
3224
b4cb9fb2
MH		 3225 case HCI_OP_READ_NUM_SUPPORTED_IAC:
3226 hci_cc_read_num_supported_iac(hdev, skb);
3227 break;
3228
333140b5
MH		 3229 case HCI_OP_WRITE_SSP_MODE:
3230 hci_cc_write_ssp_mode(hdev, skb);
3231 break;
3232
eac83dc6
MH		 3233 case HCI_OP_WRITE_SC_SUPPORT:
3234 hci_cc_write_sc_support(hdev, skb);
3235 break;
3236
302975cb
SRK		 3237 case HCI_OP_READ_AUTH_PAYLOAD_TO:
3238 hci_cc_read_auth_payload_timeout(hdev, skb);
3239 break;
3240
3241 case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3242 hci_cc_write_auth_payload_timeout(hdev, skb);
3243 break;
3244
a9de9248
MH		 3245 case HCI_OP_READ_LOCAL_VERSION:
3246 hci_cc_read_local_version(hdev, skb);
3247 break;
3248
3249 case HCI_OP_READ_LOCAL_COMMANDS:
3250 hci_cc_read_local_commands(hdev, skb);
3251 break;
3252
3253 case HCI_OP_READ_LOCAL_FEATURES:
3254 hci_cc_read_local_features(hdev, skb);
3255 break;
3256
971e3a4b
AG		 3257 case HCI_OP_READ_LOCAL_EXT_FEATURES:
3258 hci_cc_read_local_ext_features(hdev, skb);
3259 break;
3260
a9de9248
MH		 3261 case HCI_OP_READ_BUFFER_SIZE:
3262 hci_cc_read_buffer_size(hdev, skb);
3263 break;
3264
3265 case HCI_OP_READ_BD_ADDR:
3266 hci_cc_read_bd_addr(hdev, skb);
3267 break;
3268
f332ec66
JH		 3269 case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3270 hci_cc_read_page_scan_activity(hdev, skb);
3271 break;
3272
4a3ee763
JH		 3273 case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3274 hci_cc_write_page_scan_activity(hdev, skb);
3275 break;
3276
f332ec66
JH		 3277 case HCI_OP_READ_PAGE_SCAN_TYPE:
3278 hci_cc_read_page_scan_type(hdev, skb);
3279 break;
3280
4a3ee763
JH		 3281 case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3282 hci_cc_write_page_scan_type(hdev, skb);
3283 break;
3284
350ee4cf
AE		 3285 case HCI_OP_READ_DATA_BLOCK_SIZE:
3286 hci_cc_read_data_block_size(hdev, skb);
3287 break;
3288
1e89cffb
AE		 3289 case HCI_OP_READ_FLOW_CONTROL_MODE:
3290 hci_cc_read_flow_control_mode(hdev, skb);
3291 break;
3292
928abaa7
AE		 3293 case HCI_OP_READ_LOCAL_AMP_INFO:
3294 hci_cc_read_local_amp_info(hdev, skb);
3295 break;
3296
33f35721
JH		 3297 case HCI_OP_READ_CLOCK:
3298 hci_cc_read_clock(hdev, skb);
3299 break;
3300
d5859e22
JH		 3301 case HCI_OP_READ_INQ_RSP_TX_POWER:
3302 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3303 break;
3304
980e1a53
JH		 3305 case HCI_OP_PIN_CODE_REPLY:
3306 hci_cc_pin_code_reply(hdev, skb);
3307 break;
3308
3309 case HCI_OP_PIN_CODE_NEG_REPLY:
3310 hci_cc_pin_code_neg_reply(hdev, skb);
3311 break;
3312
c35938b2 3313 case HCI_OP_READ_LOCAL_OOB_DATA:
4d2d2796
MH		 3314 hci_cc_read_local_oob_data(hdev, skb);
3315 break;
3316
3317 case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3318 hci_cc_read_local_oob_ext_data(hdev, skb);
c35938b2
SJ		 3319 break;
3320
6ed58ec5
VT		 3321 case HCI_OP_LE_READ_BUFFER_SIZE:
3322 hci_cc_le_read_buffer_size(hdev, skb);
3323 break;
3324
60e77321
JH		 3325 case HCI_OP_LE_READ_LOCAL_FEATURES:
3326 hci_cc_le_read_local_features(hdev, skb);
3327 break;
3328
8fa19098
JH		 3329 case HCI_OP_LE_READ_ADV_TX_POWER:
3330 hci_cc_le_read_adv_tx_power(hdev, skb);
3331 break;
3332
a5c29683
JH		 3333 case HCI_OP_USER_CONFIRM_REPLY:
3334 hci_cc_user_confirm_reply(hdev, skb);
3335 break;
3336
3337 case HCI_OP_USER_CONFIRM_NEG_REPLY:
3338 hci_cc_user_confirm_neg_reply(hdev, skb);
3339 break;
3340
1143d458
BG		 3341 case HCI_OP_USER_PASSKEY_REPLY:
3342 hci_cc_user_passkey_reply(hdev, skb);
3343 break;
3344
3345 case HCI_OP_USER_PASSKEY_NEG_REPLY:
3346 hci_cc_user_passkey_neg_reply(hdev, skb);
16cde993 3347 break;
07f7fa5d 3348
7a4cd51d
MH		 3349 case HCI_OP_LE_SET_RANDOM_ADDR:
3350 hci_cc_le_set_random_addr(hdev, skb);
3351 break;
3352
c1d5dc4a
JH		 3353 case HCI_OP_LE_SET_ADV_ENABLE:
3354 hci_cc_le_set_adv_enable(hdev, skb);
3355 break;
3356
533553f8
MH		 3357 case HCI_OP_LE_SET_SCAN_PARAM:
3358 hci_cc_le_set_scan_param(hdev, skb);
3359 break;
3360
eb9d91f5
AG		 3361 case HCI_OP_LE_SET_SCAN_ENABLE:
3362 hci_cc_le_set_scan_enable(hdev, skb);
3363 break;
3364
cf1d081f
JH		 3365 case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3366 hci_cc_le_read_white_list_size(hdev, skb);
3367 break;
3368
0f36b589
MH		 3369 case HCI_OP_LE_CLEAR_WHITE_LIST:
3370 hci_cc_le_clear_white_list(hdev, skb);
3371 break;
3372
3373 case HCI_OP_LE_ADD_TO_WHITE_LIST:
3374 hci_cc_le_add_to_white_list(hdev, skb);
3375 break;
3376
3377 case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3378 hci_cc_le_del_from_white_list(hdev, skb);
3379 break;
3380
9b008c04
JH		 3381 case HCI_OP_LE_READ_SUPPORTED_STATES:
3382 hci_cc_le_read_supported_states(hdev, skb);
3383 break;
3384
a8e1bfaa
MH		 3385 case HCI_OP_LE_READ_DEF_DATA_LEN:
3386 hci_cc_le_read_def_data_len(hdev, skb);
3387 break;
3388
3389 case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3390 hci_cc_le_write_def_data_len(hdev, skb);
3391 break;
3392
b950aa88
AN		 3393 case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3394 hci_cc_le_add_to_resolv_list(hdev, skb);
3395 break;
3396
3397 case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3398 hci_cc_le_del_from_resolv_list(hdev, skb);
3399 break;
3400
545f2596
AN		 3401 case HCI_OP_LE_CLEAR_RESOLV_LIST:
3402 hci_cc_le_clear_resolv_list(hdev, skb);
3403 break;
3404
cfdb0c2d
AN		 3405 case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3406 hci_cc_le_read_resolv_list_size(hdev, skb);
3407 break;
3408
aa12af77
AN		 3409 case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3410 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3411 break;
3412
a8e1bfaa
MH		 3413 case HCI_OP_LE_READ_MAX_DATA_LEN:
3414 hci_cc_le_read_max_data_len(hdev, skb);
3415 break;
3416
f9b49306
AG		 3417 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3418 hci_cc_write_le_host_supported(hdev, skb);
3419 break;
3420
56ed2cb8
JH		 3421 case HCI_OP_LE_SET_ADV_PARAM:
3422 hci_cc_set_adv_param(hdev, skb);
3423 break;
3424
5ae76a94
AK		 3425 case HCI_OP_READ_RSSI:
3426 hci_cc_read_rssi(hdev, skb);
3427 break;
3428
5a134fae
AK		 3429 case HCI_OP_READ_TX_POWER:
3430 hci_cc_read_tx_power(hdev, skb);
3431 break;
3432
c50b33c8
MH		 3433 case HCI_OP_WRITE_SSP_DEBUG_MODE:
3434 hci_cc_write_ssp_debug_mode(hdev, skb);
3435 break;
3436
a2344b9e
JK		 3437 case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3438 hci_cc_le_set_ext_scan_param(hdev, skb);
3439 break;
3440
3441 case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3442 hci_cc_le_set_ext_scan_enable(hdev, skb);
3443 break;
3444
0314f286
JK		 3445 case HCI_OP_LE_SET_DEFAULT_PHY:
3446 hci_cc_le_set_default_phy(hdev, skb);
3447 break;
3448
6b49bcb4
JK		 3449 case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3450 hci_cc_le_read_num_adv_sets(hdev, skb);
3451 break;
3452
de181e88
JK		 3453 case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3454 hci_cc_set_ext_adv_param(hdev, skb);
3455 break;
3456
3457 case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3458 hci_cc_le_set_ext_adv_enable(hdev, skb);
3459 break;
3460
a73c046a
JK		 3461 case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3462 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3463 break;
3464
a9de9248 3465 default:
e6214487 3466 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3467 break;
3468 }
3469
e6214487 3470 if (*opcode != HCI_OP_NOP)
65cc2b49 3471 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3472
600b2150
JH		 3473 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3474 atomic_set(&hdev->cmd_cnt, 1);
3475
e6214487
JH		 3476 hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3477 req_complete_skb);
9238f36a 3478
f80c5dad
JPRV		 3479 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3480 bt_dev_err(hdev,
3481 "unexpected event for opcode 0x%4.4x", *opcode);
3482 return;
3483 }
3484
600b2150
JH		 3485 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3486 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3487}
3488
e6214487
JH		 3489static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3490 u16 *opcode, u8 *status,
3491 hci_req_complete_t *req_complete,
3492 hci_req_complete_skb_t *req_complete_skb)
a9de9248
MH		 3493{
3494 struct hci_ev_cmd_status *ev = (void *) skb->data;
a9de9248
MH		 3495
3496 skb_pull(skb, sizeof(*ev));
3497
e6214487
JH		 3498 *opcode = __le16_to_cpu(ev->opcode);
3499 *status = ev->status;
a9de9248 3500
e6214487 3501 switch (*opcode) {
a9de9248
MH		 3502 case HCI_OP_INQUIRY:
3503 hci_cs_inquiry(hdev, ev->status);
3504 break;
3505
3506 case HCI_OP_CREATE_CONN:
3507 hci_cs_create_conn(hdev, ev->status);
3508 break;
3509
9645c76c
KP		 3510 case HCI_OP_DISCONNECT:
3511 hci_cs_disconnect(hdev, ev->status);
3512 break;
3513
a9de9248
MH		 3514 case HCI_OP_ADD_SCO:
3515 hci_cs_add_sco(hdev, ev->status);
3516 break;
3517
f8558555
MH		 3518 case HCI_OP_AUTH_REQUESTED:
3519 hci_cs_auth_requested(hdev, ev->status);
3520 break;
3521
3522 case HCI_OP_SET_CONN_ENCRYPT:
3523 hci_cs_set_conn_encrypt(hdev, ev->status);
3524 break;
3525
a9de9248
MH		 3526 case HCI_OP_REMOTE_NAME_REQ:
3527 hci_cs_remote_name_req(hdev, ev->status);
3528 break;
3529
769be974
MH		 3530 case HCI_OP_READ_REMOTE_FEATURES:
3531 hci_cs_read_remote_features(hdev, ev->status);
3532 break;
3533
3534 case HCI_OP_READ_REMOTE_EXT_FEATURES:
3535 hci_cs_read_remote_ext_features(hdev, ev->status);
3536 break;
3537
a9de9248
MH		 3538 case HCI_OP_SETUP_SYNC_CONN:
3539 hci_cs_setup_sync_conn(hdev, ev->status);
3540 break;
3541
3542 case HCI_OP_SNIFF_MODE:
3543 hci_cs_sniff_mode(hdev, ev->status);
3544 break;
3545
3546 case HCI_OP_EXIT_SNIFF_MODE:
3547 hci_cs_exit_sniff_mode(hdev, ev->status);
3548 break;
3549
50fc85f1
KP		 3550 case HCI_OP_SWITCH_ROLE:
3551 hci_cs_switch_role(hdev, ev->status);
3552 break;
3553
cb1d68f7
JH		 3554 case HCI_OP_LE_CREATE_CONN:
3555 hci_cs_le_create_conn(hdev, ev->status);
3556 break;
3557
0fe29fd1
MH		 3558 case HCI_OP_LE_READ_REMOTE_FEATURES:
3559 hci_cs_le_read_remote_features(hdev, ev->status);
3560 break;
3561
81d0c8ad
JH		 3562 case HCI_OP_LE_START_ENC:
3563 hci_cs_le_start_enc(hdev, ev->status);
3564 break;
3565
4d94f95d
JK		 3566 case HCI_OP_LE_EXT_CREATE_CONN:
3567 hci_cs_le_ext_create_conn(hdev, ev->status);
3568 break;
3569
a9de9248 3570 default:
e6214487 3571 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
a9de9248
MH		 3572 break;
3573 }
3574
e6214487 3575 if (*opcode != HCI_OP_NOP)
65cc2b49 3576 cancel_delayed_work(&hdev->cmd_timer);
6bd32326 3577
600b2150
JH		 3578 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3579 atomic_set(&hdev->cmd_cnt, 1);
3580
444c6dd5
JH		 3581 /* Indicate request completion if the command failed. Also, if
3582 * we're not waiting for a special event and we get a success
3583 * command status we should try to flag the request as completed
3584 * (since for this kind of commands there will not be a command
3585 * complete event).
3586 */
02350a72 3587 if (ev->status ||
242c0ebd 3588 (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
e6214487
JH		 3589 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3590 req_complete_skb);
9238f36a 3591
f80c5dad
JPRV		 3592 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3593 bt_dev_err(hdev,
3594 "unexpected event for opcode 0x%4.4x", *opcode);
3595 return;
3596 }
3597
600b2150
JH		 3598 if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3599 queue_work(hdev->workqueue, &hdev->cmd_work);
a9de9248
MH		 3600}
3601
24dfa343
MH		 3602static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3603{
3604 struct hci_ev_hardware_error *ev = (void *) skb->data;
3605
c7741d16
MH		 3606 hdev->hw_error_code = ev->code;
3607
3608 queue_work(hdev->req_workqueue, &hdev->error_reset);
24dfa343
MH		 3609}
3610
6039aa73 3611static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3612{
3613 struct hci_ev_role_change *ev = (void *) skb->data;
3614 struct hci_conn *conn;
3615
9f1db00c 3616 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a9de9248
MH		 3617
3618 hci_dev_lock(hdev);
3619
3620 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3621 if (conn) {
40bef302
JH		 3622 if (!ev->status)
3623 conn->role = ev->role;
a9de9248 3624
51a8efd7 3625 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
a9de9248
MH		 3626
3627 hci_role_switch_cfm(conn, ev->status, ev->role);
3628 }
3629
3630 hci_dev_unlock(hdev);
3631}
3632
6039aa73 3633static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248
MH		 3634{
3635 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
a9de9248
MH		 3636 int i;
3637
32ac5b9b 3638 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2064ee33 3639 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
32ac5b9b
AE		 3640 return;
3641 }
3642
16e18342
GS		 3643 if (skb->len < sizeof(*ev) ||
3644 skb->len < struct_size(ev, handles, ev->num_hndl)) {
a9de9248
MH		 3645 BT_DBG("%s bad parameters", hdev->name);
3646 return;
3647 }
3648
c5993de8
AE		 3649 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3650
613a1c0c
AE		 3651 for (i = 0; i < ev->num_hndl; i++) {
3652 struct hci_comp_pkts_info *info = &ev->handles[i];
a9de9248
MH		 3653 struct hci_conn *conn;
3654 __u16 handle, count;
3655
613a1c0c
AE		 3656 handle = __le16_to_cpu(info->handle);
3657 count = __le16_to_cpu(info->count);
a9de9248
MH		 3658
3659 conn = hci_conn_hash_lookup_handle(hdev, handle);
f4280918
AE		 3660 if (!conn)
3661 continue;
3662
3663 conn->sent -= count;
3664
3665 switch (conn->type) {
3666 case ACL_LINK:
3667 hdev->acl_cnt += count;
3668 if (hdev->acl_cnt > hdev->acl_pkts)
3669 hdev->acl_cnt = hdev->acl_pkts;
3670 break;
3671
3672 case LE_LINK:
3673 if (hdev->le_pkts) {
3674 hdev->le_cnt += count;
3675 if (hdev->le_cnt > hdev->le_pkts)
3676 hdev->le_cnt = hdev->le_pkts;
3677 } else {
70f23020
AE		 3678 hdev->acl_cnt += count;
3679 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 3680 hdev->acl_cnt = hdev->acl_pkts;
a9de9248 3681 }
f4280918
AE		 3682 break;
3683
3684 case SCO_LINK:
3685 hdev->sco_cnt += count;
3686 if (hdev->sco_cnt > hdev->sco_pkts)
3687 hdev->sco_cnt = hdev->sco_pkts;
3688 break;
3689
3690 default:
2064ee33
MH		 3691 bt_dev_err(hdev, "unknown type %d conn %p",
3692 conn->type, conn);
f4280918 3693 break;
a9de9248
MH		 3694 }
3695 }
3696
3eff45ea 3697 queue_work(hdev->workqueue, &hdev->tx_work);
a9de9248
MH		 3698}
3699
76ef7cf7
AE		 3700static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3701 __u16 handle)
3702{
3703 struct hci_chan *chan;
3704
3705 switch (hdev->dev_type) {
ca8bee5d 3706 case HCI_PRIMARY:
76ef7cf7
AE		 3707 return hci_conn_hash_lookup_handle(hdev, handle);
3708 case HCI_AMP:
3709 chan = hci_chan_lookup_handle(hdev, handle);
3710 if (chan)
3711 return chan->conn;
3712 break;
3713 default:
2064ee33 3714 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
76ef7cf7
AE		 3715 break;
3716 }
3717
3718 return NULL;
3719}
3720
6039aa73 3721static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
25e89e99
AE		 3722{
3723 struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3724 int i;
3725
3726 if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2064ee33 3727 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
25e89e99
AE		 3728 return;
3729 }
3730
16e18342
GS		 3731 if (skb->len < sizeof(*ev) ||
3732 skb->len < struct_size(ev, handles, ev->num_hndl)) {
25e89e99
AE		 3733 BT_DBG("%s bad parameters", hdev->name);
3734 return;
3735 }
3736
3737 BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
807deac2 3738 ev->num_hndl);
25e89e99
AE		 3739
3740 for (i = 0; i < ev->num_hndl; i++) {
3741 struct hci_comp_blocks_info *info = &ev->handles[i];
76ef7cf7 3742 struct hci_conn *conn = NULL;
25e89e99
AE		 3743 __u16 handle, block_count;
3744
3745 handle = __le16_to_cpu(info->handle);
3746 block_count = __le16_to_cpu(info->blocks);
3747
76ef7cf7 3748 conn = __hci_conn_lookup_handle(hdev, handle);
25e89e99
AE		 3749 if (!conn)
3750 continue;
3751
3752 conn->sent -= block_count;
3753
3754 switch (conn->type) {
3755 case ACL_LINK:
bd1eb66b 3756 case AMP_LINK:
25e89e99
AE		 3757 hdev->block_cnt += block_count;
3758 if (hdev->block_cnt > hdev->num_blocks)
3759 hdev->block_cnt = hdev->num_blocks;
3760 break;
3761
3762 default:
2064ee33
MH		 3763 bt_dev_err(hdev, "unknown type %d conn %p",
3764 conn->type, conn);
25e89e99
AE		 3765 break;
3766 }
3767 }
3768
3769 queue_work(hdev->workqueue, &hdev->tx_work);
3770}
3771
6039aa73 3772static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 3773{
a9de9248 3774 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 3775 struct hci_conn *conn;
3776
9f1db00c 3777 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
04837f64
MH		 3778
3779 hci_dev_lock(hdev);
3780
3781 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 3782 if (conn) {
3783 conn->mode = ev->mode;
a9de9248 3784
8fc9ced3
GP		 3785 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3786 &conn->flags)) {
a9de9248 3787 if (conn->mode == HCI_CM_ACTIVE)
58a681ef 3788 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3789 else
58a681ef 3790 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
a9de9248 3791 }
e73439d8 3792
51a8efd7 3793 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
e73439d8 3794 hci_sco_setup(conn, ev->status);
04837f64
MH		 3795 }
3796
3797 hci_dev_unlock(hdev);
3798}
3799
6039aa73 3800static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3801{
052b30b0
MH		 3802 struct hci_ev_pin_code_req *ev = (void *) skb->data;
3803 struct hci_conn *conn;
3804
a9de9248 3805 BT_DBG("%s", hdev->name);
052b30b0
MH		 3806
3807 hci_dev_lock(hdev);
3808
3809 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 3810 if (!conn)
3811 goto unlock;
3812
3813 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 3814 hci_conn_hold(conn);
3815 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
76a68ba0 3816 hci_conn_drop(conn);
052b30b0
MH		 3817 }
3818
d7a5a11d 3819 if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
2f407f0a 3820 !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
03b555e1 3821 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
807deac2 3822 sizeof(ev->bdaddr), &ev->bdaddr);
d7a5a11d 3823 } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
a770bb5a
WR		 3824 u8 secure;
3825
3826 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3827 secure = 1;
3828 else
3829 secure = 0;
3830
744cf19e 3831 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 3832 }
980e1a53 3833
b6f98044 3834unlock:
052b30b0 3835 hci_dev_unlock(hdev);
a9de9248
MH		 3836}
3837
cb6f3f7a
JH		 3838static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3839{
3840 if (key_type == HCI_LK_CHANGED_COMBINATION)
3841 return;
3842
3843 conn->pin_length = pin_len;
3844 conn->key_type = key_type;
3845
3846 switch (key_type) {
3847 case HCI_LK_LOCAL_UNIT:
3848 case HCI_LK_REMOTE_UNIT:
3849 case HCI_LK_DEBUG_COMBINATION:
3850 return;
3851 case HCI_LK_COMBINATION:
3852 if (pin_len == 16)
3853 conn->pending_sec_level = BT_SECURITY_HIGH;
3854 else
3855 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3856 break;
3857 case HCI_LK_UNAUTH_COMBINATION_P192:
3858 case HCI_LK_UNAUTH_COMBINATION_P256:
3859 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3860 break;
3861 case HCI_LK_AUTH_COMBINATION_P192:
3862 conn->pending_sec_level = BT_SECURITY_HIGH;
3863 break;
3864 case HCI_LK_AUTH_COMBINATION_P256:
3865 conn->pending_sec_level = BT_SECURITY_FIPS;
3866 break;
3867 }
3868}
3869
6039aa73 3870static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3871{
55ed8ca1
JH		 3872 struct hci_ev_link_key_req *ev = (void *) skb->data;
3873 struct hci_cp_link_key_reply cp;
3874 struct hci_conn *conn;
3875 struct link_key *key;
3876
a9de9248 3877 BT_DBG("%s", hdev->name);
55ed8ca1 3878
d7a5a11d 3879 if (!hci_dev_test_flag(hdev, HCI_MGMT))
55ed8ca1
JH		 3880 return;
3881
3882 hci_dev_lock(hdev);
3883
3884 key = hci_find_link_key(hdev, &ev->bdaddr);
3885 if (!key) {
6ed93dc6
AE		 3886 BT_DBG("%s link key not found for %pMR", hdev->name,
3887 &ev->bdaddr);
55ed8ca1
JH		 3888 goto not_found;
3889 }
3890
6ed93dc6
AE		 3891 BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3892 &ev->bdaddr);
55ed8ca1 3893
55ed8ca1 3894 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57 3895 if (conn) {
fe8bc5ac
JH		 3896 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3897
66138ce8
MH		 3898 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3899 key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
807deac2 3900 conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
60b83f57
WR		 3901 BT_DBG("%s ignoring unauthenticated key", hdev->name);
3902 goto not_found;
3903 }
55ed8ca1 3904
60b83f57 3905 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
f3fb0b58
JH		 3906 (conn->pending_sec_level == BT_SECURITY_HIGH ||
3907 conn->pending_sec_level == BT_SECURITY_FIPS)) {
8fc9ced3
GP		 3908 BT_DBG("%s ignoring key unauthenticated for high security",
3909 hdev->name);
60b83f57
WR		 3910 goto not_found;
3911 }
3912
cb6f3f7a 3913 conn_set_key(conn, key->type, key->pin_len);
55ed8ca1
JH		 3914 }
3915
3916 bacpy(&cp.bdaddr, &ev->bdaddr);
9b3b4460 3917 memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3918
3919 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3920
3921 hci_dev_unlock(hdev);
3922
3923 return;
3924
3925not_found:
3926 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3927 hci_dev_unlock(hdev);
a9de9248
MH		 3928}
3929
6039aa73 3930static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
a9de9248 3931{
052b30b0
MH		 3932 struct hci_ev_link_key_notify *ev = (void *) skb->data;
3933 struct hci_conn *conn;
7652ff6a
JH		 3934 struct link_key *key;
3935 bool persistent;
55ed8ca1 3936 u8 pin_len = 0;
052b30b0 3937
a9de9248 3938 BT_DBG("%s", hdev->name);
052b30b0
MH		 3939
3940 hci_dev_lock(hdev);
3941
3942 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
82c13d42
JH		 3943 if (!conn)
3944 goto unlock;
3945
3946 hci_conn_hold(conn);
3947 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3948 hci_conn_drop(conn);
3949
fe8bc5ac 3950 set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
82c13d42 3951 conn_set_key(conn, ev->key_type, conn->pin_length);
052b30b0 3952
d7a5a11d 3953 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7652ff6a
JH		 3954 goto unlock;
3955
3956 key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3957 ev->key_type, pin_len, &persistent);
3958 if (!key)
3959 goto unlock;
3960
cb6f3f7a
JH		 3961 /* Update connection information since adding the key will have
3962 * fixed up the type in the case of changed combination keys.
3963 */
3964 if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3965 conn_set_key(conn, key->type, key->pin_len);
3966
7652ff6a 3967 mgmt_new_link_key(hdev, key, persistent);
55ed8ca1 3968
6d5650c4
JH		 3969 /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3970 * is set. If it's not set simply remove the key from the kernel
3971 * list (we've still notified user space about it but with
3972 * store_hint being 0).
3973 */
3974 if (key->type == HCI_LK_DEBUG_COMBINATION &&
d7a5a11d 3975 !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
0378b597
JH		 3976 list_del_rcu(&key->list);
3977 kfree_rcu(key, rcu);
82c13d42 3978 goto unlock;
6d5650c4 3979 }
7652ff6a 3980
82c13d42
JH		 3981 if (persistent)
3982 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3983 else
3984 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3985
7652ff6a 3986unlock:
052b30b0 3987 hci_dev_unlock(hdev);
a9de9248
MH		 3988}
3989
6039aa73 3990static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3991{
a9de9248 3992 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 3993 struct hci_conn *conn;
1da177e4 3994
9f1db00c 3995 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1da177e4
LT		 3996
3997 hci_dev_lock(hdev);
3998
04837f64 3999 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 4000 if (conn && !ev->status) {
4001 struct inquiry_entry *ie;
4002
cc11b9c1
AE		 4003 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4004 if (ie) {
1da177e4
LT		 4005 ie->data.clock_offset = ev->clock_offset;
4006 ie->timestamp = jiffies;
4007 }
4008 }
4009
4010 hci_dev_unlock(hdev);
4011}
4012
6039aa73 4013static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
a8746417
MH		 4014{
4015 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4016 struct hci_conn *conn;
4017
9f1db00c 4018 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
a8746417
MH		 4019
4020 hci_dev_lock(hdev);
4021
4022 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4023 if (conn && !ev->status)
4024 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4025
4026 hci_dev_unlock(hdev);
4027}
4028
6039aa73 4029static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
85a1e930 4030{
a9de9248 4031 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 4032 struct inquiry_entry *ie;
4033
4034 BT_DBG("%s", hdev->name);
4035
4036 hci_dev_lock(hdev);
4037
cc11b9c1
AE		 4038 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4039 if (ie) {
85a1e930
MH		 4040 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4041 ie->timestamp = jiffies;
4042 }
4043
4044 hci_dev_unlock(hdev);
4045}
4046
6039aa73
GP		 4047static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4048 struct sk_buff *skb)
a9de9248
MH		 4049{
4050 struct inquiry_data data;
4051 int num_rsp = *((__u8 *) skb->data);
4052
4053 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4054
4055 if (!num_rsp)
4056 return;
4057
d7a5a11d 4058 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 4059 return;
4060
a9de9248
MH		 4061 hci_dev_lock(hdev);
4062
4063 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 4064 struct inquiry_info_with_rssi_and_pscan_mode *info;
4065 info = (void *) (skb->data + 1);
a9de9248 4066
e17acd40 4067 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 4068 u32 flags;
4069
a9de9248
MH		 4070 bacpy(&data.bdaddr, &info->bdaddr);
4071 data.pscan_rep_mode = info->pscan_rep_mode;
4072 data.pscan_period_mode = info->pscan_period_mode;
4073 data.pscan_mode = info->pscan_mode;
4074 memcpy(data.dev_class, info->dev_class, 3);
4075 data.clock_offset = info->clock_offset;
4076 data.rssi = info->rssi;
41a96212 4077 data.ssp_mode = 0x00;
3175405b 4078
af58925c
MH		 4079 flags = hci_inquiry_cache_update(hdev, &data, false);
4080
48264f06 4081 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 4082 info->dev_class, info->rssi,
af58925c 4083 flags, NULL, 0, NULL, 0);
a9de9248
MH		 4084 }
4085 } else {
4086 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4087
e17acd40 4088 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 4089 u32 flags;
4090
a9de9248
MH		 4091 bacpy(&data.bdaddr, &info->bdaddr);
4092 data.pscan_rep_mode = info->pscan_rep_mode;
4093 data.pscan_period_mode = info->pscan_period_mode;
4094 data.pscan_mode = 0x00;
4095 memcpy(data.dev_class, info->dev_class, 3);
4096 data.clock_offset = info->clock_offset;
4097 data.rssi = info->rssi;
41a96212 4098 data.ssp_mode = 0x00;
af58925c
MH		 4099
4100 flags = hci_inquiry_cache_update(hdev, &data, false);
4101
48264f06 4102 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
04124681 4103 info->dev_class, info->rssi,
af58925c 4104 flags, NULL, 0, NULL, 0);
a9de9248
MH		 4105 }
4106 }
4107
4108 hci_dev_unlock(hdev);
4109}
4110
6039aa73
GP		 4111static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4112 struct sk_buff *skb)
a9de9248 4113{
41a96212
MH		 4114 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4115 struct hci_conn *conn;
4116
a9de9248 4117 BT_DBG("%s", hdev->name);
41a96212 4118
41a96212
MH		 4119 hci_dev_lock(hdev);
4120
4121 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 4122 if (!conn)
4123 goto unlock;
41a96212 4124
cad718ed
JH		 4125 if (ev->page < HCI_MAX_PAGES)
4126 memcpy(conn->features[ev->page], ev->features, 8);
4127
ccd556fe
JH		 4128 if (!ev->status && ev->page == 0x01) {
4129 struct inquiry_entry *ie;
41a96212 4130
cc11b9c1
AE		 4131 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4132 if (ie)
02b7cc62 4133 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
769be974 4134
bbb0eada 4135 if (ev->features[0] & LMP_HOST_SSP) {
58a681ef 4136 set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
bbb0eada
JK		 4137 } else {
4138 /* It is mandatory by the Bluetooth specification that
4139 * Extended Inquiry Results are only used when Secure
4140 * Simple Pairing is enabled, but some devices violate
4141 * this.
4142 *
4143 * To make these devices work, the internal SSP
4144 * enabled flag needs to be cleared if the remote host
4145 * features do not indicate SSP support */
4146 clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4147 }
eb9a8f3f
MH		 4148
4149 if (ev->features[0] & LMP_HOST_SC)
4150 set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
ccd556fe
JH		 4151 }
4152
4153 if (conn->state != BT_CONFIG)
4154 goto unlock;
4155
671267bf 4156 if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
127178d2
JH		 4157 struct hci_cp_remote_name_req cp;
4158 memset(&cp, 0, sizeof(cp));
4159 bacpy(&cp.bdaddr, &conn->dst);
4160 cp.pscan_rep_mode = 0x02;
4161 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
b644ba33 4162 } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 4163 mgmt_device_connected(hdev, conn, 0, NULL, 0);
392599b9 4164
127178d2 4165 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe 4166 conn->state = BT_CONNECTED;
539c496d 4167 hci_connect_cfm(conn, ev->status);
76a68ba0 4168 hci_conn_drop(conn);
41a96212
MH		 4169 }
4170
ccd556fe 4171unlock:
41a96212 4172 hci_dev_unlock(hdev);
a9de9248
MH		 4173}
4174
6039aa73
GP		 4175static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4176 struct sk_buff *skb)
a9de9248 4177{
b6a0dc82
MH		 4178 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4179 struct hci_conn *conn;
4180
9f1db00c 4181 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
b6a0dc82
MH		 4182
4183 hci_dev_lock(hdev);
4184
4185 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 4186 if (!conn) {
4187 if (ev->link_type == ESCO_LINK)
4188 goto unlock;
4189
618353b1
KP		 4190 /* When the link type in the event indicates SCO connection
4191 * and lookup of the connection object fails, then check
4192 * if an eSCO connection object exists.
4193 *
4194 * The core limits the synchronous connections to either
4195 * SCO or eSCO. The eSCO connection is preferred and tried
4196 * to be setup first and until successfully established,
4197 * the link type will be hinted as eSCO.
4198 */
9dc0a3af
MH		 4199 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4200 if (!conn)
4201 goto unlock;
9dc0a3af 4202 }
b6a0dc82 4203
732547f9
MH		 4204 switch (ev->status) {
4205 case 0x00:
b6a0dc82
MH		 4206 conn->handle = __le16_to_cpu(ev->handle);
4207 conn->state = BT_CONNECTED;
618353b1 4208 conn->type = ev->link_type;
7d0db0a3 4209
23b9ceb7 4210 hci_debugfs_create_conn(conn);
7d0db0a3 4211 hci_conn_add_sysfs(conn);
732547f9
MH		 4212 break;
4213
81218d20 4214 case 0x10: /* Connection Accept Timeout */
1a4c958c 4215 case 0x0d: /* Connection Rejected due to Limited Resources */
705e5711 4216 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 4217 case 0x1c: /* SCO interval rejected */
1038a00b 4218 case 0x1a: /* Unsupported Remote Feature */
732547f9 4219 case 0x1f: /* Unspecified error */
27539bc4 4220 case 0x20: /* Unsupported LMP Parameter value */
2dea632f 4221 if (conn->out) {
732547f9
MH		 4222 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4223 (hdev->esco_type & EDR_ESCO_MASK);
2dea632f
FD		 4224 if (hci_setup_sync(conn, conn->link->handle))
4225 goto unlock;
732547f9
MH		 4226 }
4227 /* fall through */
4228
4229 default:
b6a0dc82 4230 conn->state = BT_CLOSED;
732547f9
MH		 4231 break;
4232 }
b6a0dc82 4233
539c496d 4234 hci_connect_cfm(conn, ev->status);
b6a0dc82
MH		 4235 if (ev->status)
4236 hci_conn_del(conn);
4237
4238unlock:
4239 hci_dev_unlock(hdev);
a9de9248
MH		 4240}
4241
efdcf8e3
MH		 4242static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4243{
4244 size_t parsed = 0;
4245
4246 while (parsed < eir_len) {
4247 u8 field_len = eir[0];
4248
4249 if (field_len == 0)
4250 return parsed;
4251
4252 parsed += field_len + 1;
4253 eir += field_len + 1;
4254 }
4255
4256 return eir_len;
4257}
4258
6039aa73
GP		 4259static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4260 struct sk_buff *skb)
1da177e4 4261{
a9de9248
MH		 4262 struct inquiry_data data;
4263 struct extended_inquiry_info *info = (void *) (skb->data + 1);
4264 int num_rsp = *((__u8 *) skb->data);
9d939d94 4265 size_t eir_len;
1da177e4 4266
a9de9248 4267 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 4268
a9de9248
MH		 4269 if (!num_rsp)
4270 return;
1da177e4 4271
d7a5a11d 4272 if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
1519cc17
AG		 4273 return;
4274
a9de9248
MH		 4275 hci_dev_lock(hdev);
4276
e17acd40 4277 for (; num_rsp; num_rsp--, info++) {
af58925c
MH		 4278 u32 flags;
4279 bool name_known;
561aafbc 4280
a9de9248 4281 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 4282 data.pscan_rep_mode = info->pscan_rep_mode;
4283 data.pscan_period_mode = info->pscan_period_mode;
4284 data.pscan_mode = 0x00;
a9de9248 4285 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 4286 data.clock_offset = info->clock_offset;
4287 data.rssi = info->rssi;
41a96212 4288 data.ssp_mode = 0x01;
561aafbc 4289
d7a5a11d 4290 if (hci_dev_test_flag(hdev, HCI_MGMT))
0d3b7f64
JH		 4291 name_known = eir_get_data(info->data,
4292 sizeof(info->data),
4293 EIR_NAME_COMPLETE, NULL);
561aafbc
JH		 4294 else
4295 name_known = true;
4296
af58925c
MH		 4297 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4298
9d939d94 4299 eir_len = eir_get_length(info->data, sizeof(info->data));
af58925c 4300
48264f06 4301 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
af58925c
MH		 4302 info->dev_class, info->rssi,
4303 flags, info->data, eir_len, NULL, 0);
a9de9248
MH		 4304 }
4305
4306 hci_dev_unlock(hdev);
4307}
1da177e4 4308
1c2e0041
JH		 4309static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4310 struct sk_buff *skb)
4311{
4312 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4313 struct hci_conn *conn;
4314
9f1db00c 4315 BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
1c2e0041
JH		 4316 __le16_to_cpu(ev->handle));
4317
4318 hci_dev_lock(hdev);
4319
4320 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4321 if (!conn)
4322 goto unlock;
4323
9eb1fbfa
JH		 4324 /* For BR/EDR the necessary steps are taken through the
4325 * auth_complete event.
4326 */
4327 if (conn->type != LE_LINK)
4328 goto unlock;
4329
1c2e0041
JH		 4330 if (!ev->status)
4331 conn->sec_level = conn->pending_sec_level;
4332
4333 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4334
4335 if (ev->status && conn->state == BT_CONNECTED) {
bed71748 4336 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
76a68ba0 4337 hci_conn_drop(conn);
1c2e0041
JH		 4338 goto unlock;
4339 }
4340
4341 if (conn->state == BT_CONFIG) {
4342 if (!ev->status)
4343 conn->state = BT_CONNECTED;
4344
539c496d 4345 hci_connect_cfm(conn, ev->status);
76a68ba0 4346 hci_conn_drop(conn);
1c2e0041
JH		 4347 } else {
4348 hci_auth_cfm(conn, ev->status);
4349
4350 hci_conn_hold(conn);
4351 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4352 hci_conn_drop(conn);
1c2e0041
JH		 4353 }
4354
4355unlock:
4356 hci_dev_unlock(hdev);
4357}
4358
6039aa73 4359static u8 hci_get_auth_req(struct hci_conn *conn)
17fa4b9d 4360{
17fa4b9d 4361 /* If remote requests no-bonding follow that lead */
acabae96
MA		 4362 if (conn->remote_auth == HCI_AT_NO_BONDING ||
4363 conn->remote_auth == HCI_AT_NO_BONDING_MITM)
58797bf7 4364 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d 4365
b7f94c88
MA		 4366 /* If both remote and local have enough IO capabilities, require
4367 * MITM protection
4368 */
4369 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4370 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4371 return conn->remote_auth | 0x01;
4372
7e74170a
TM		 4373 /* No MITM protection possible so ignore remote requirement */
4374 return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
17fa4b9d
JH		 4375}
4376
a83ed81e
MH		 4377static u8 bredr_oob_data_present(struct hci_conn *conn)
4378{
4379 struct hci_dev *hdev = conn->hdev;
4380 struct oob_data *data;
4381
4382 data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4383 if (!data)
4384 return 0x00;
4385
455c2ff0
MH		 4386 if (bredr_sc_enabled(hdev)) {
4387 /* When Secure Connections is enabled, then just
4388 * return the present value stored with the OOB
4389 * data. The stored value contains the right present
4390 * information. However it can only be trusted when
4391 * not in Secure Connection Only mode.
4392 */
4393 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4394 return data->present;
659c7fb0 4395
455c2ff0
MH		 4396 /* When Secure Connections Only mode is enabled, then
4397 * the P-256 values are required. If they are not
4398 * available, then do not declare that OOB data is
4399 * present.
659c7fb0 4400 */
455c2ff0
MH		 4401 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4402 !memcmp(data->hash256, ZERO_KEY, 16))
659c7fb0
MH		 4403 return 0x00;
4404
455c2ff0 4405 return 0x02;
659c7fb0 4406 }
a83ed81e 4407
455c2ff0
MH		 4408 /* When Secure Connections is not enabled or actually
4409 * not supported by the hardware, then check that if
4410 * P-192 data values are present.
4411 */
4412 if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4413 !memcmp(data->hash192, ZERO_KEY, 16))
4414 return 0x00;
4415
4416 return 0x01;
a83ed81e
MH		 4417}
4418
6039aa73 4419static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
0493684e
MH		 4420{
4421 struct hci_ev_io_capa_request *ev = (void *) skb->data;
4422 struct hci_conn *conn;
4423
4424 BT_DBG("%s", hdev->name);
4425
4426 hci_dev_lock(hdev);
4427
4428 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 4429 if (!conn)
4430 goto unlock;
4431
4432 hci_conn_hold(conn);
4433
d7a5a11d 4434 if (!hci_dev_test_flag(hdev, HCI_MGMT))
03b555e1
JH		 4435 goto unlock;
4436
2f407f0a
JH		 4437 /* Allow pairing if we're pairable, the initiators of the
4438 * pairing or if the remote is not requesting bonding.
4439 */
d7a5a11d 4440 if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
2f407f0a 4441 test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
807deac2 4442 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 4443 struct hci_cp_io_capability_reply cp;
4444
4445 bacpy(&cp.bdaddr, &ev->bdaddr);
7a7f1e7c
HG		 4446 /* Change the IO capability from KeyboardDisplay
4447 * to DisplayYesNo as it is not supported by BT spec. */
4448 cp.capability = (conn->io_capability == 0x04) ?
a767631a 4449 HCI_IO_DISPLAY_YESNO : conn->io_capability;
b7f94c88
MA		 4450
4451 /* If we are initiators, there is no remote information yet */
4452 if (conn->remote_auth == 0xff) {
b16c6604 4453 /* Request MITM protection if our IO caps allow it
4ad51a75 4454 * except for the no-bonding case.
b16c6604 4455 */
6fd6b915 4456 if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
9f743d74 4457 conn->auth_type != HCI_AT_NO_BONDING)
6c53823a 4458 conn->auth_type |= 0x01;
b7f94c88
MA		 4459 } else {
4460 conn->auth_type = hci_get_auth_req(conn);
b7f94c88 4461 }
17fa4b9d 4462
82c295b1
JH		 4463 /* If we're not bondable, force one of the non-bondable
4464 * authentication requirement values.
4465 */
d7a5a11d 4466 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
82c295b1
JH		 4467 conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4468
4469 cp.authentication = conn->auth_type;
a83ed81e 4470 cp.oob_data = bredr_oob_data_present(conn);
ce85ee13 4471
17fa4b9d 4472 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
807deac2 4473 sizeof(cp), &cp);
03b555e1
JH		 4474 } else {
4475 struct hci_cp_io_capability_neg_reply cp;
4476
4477 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 4478 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 4479
03b555e1 4480 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
807deac2 4481 sizeof(cp), &cp);
03b555e1
JH		 4482 }
4483
4484unlock:
4485 hci_dev_unlock(hdev);
4486}
4487
6039aa73 4488static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
03b555e1
JH		 4489{
4490 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4491 struct hci_conn *conn;
4492
4493 BT_DBG("%s", hdev->name);
4494
4495 hci_dev_lock(hdev);
4496
4497 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4498 if (!conn)
4499 goto unlock;
4500
03b555e1 4501 conn->remote_cap = ev->capability;
03b555e1
JH		 4502 conn->remote_auth = ev->authentication;
4503
4504unlock:
0493684e
MH		 4505 hci_dev_unlock(hdev);
4506}
4507
6039aa73
GP		 4508static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4509 struct sk_buff *skb)
a5c29683
JH		 4510{
4511 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 4512 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 4513 struct hci_conn *conn;
a5c29683
JH		 4514
4515 BT_DBG("%s", hdev->name);
4516
4517 hci_dev_lock(hdev);
4518
d7a5a11d 4519 if (!hci_dev_test_flag(hdev, HCI_MGMT))
7a828908 4520 goto unlock;
a5c29683 4521
7a828908
JH		 4522 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4523 if (!conn)
4524 goto unlock;
4525
4526 loc_mitm = (conn->auth_type & 0x01);
4527 rem_mitm = (conn->remote_auth & 0x01);
4528
4529 /* If we require MITM but the remote device can't provide that
6c53823a
JH		 4530 * (it has NoInputNoOutput) then reject the confirmation
4531 * request. We check the security level here since it doesn't
4532 * necessarily match conn->auth_type.
6fd6b915 4533 */
6c53823a
JH		 4534 if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4535 conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
7a828908
JH		 4536 BT_DBG("Rejecting request: remote device can't provide MITM");
4537 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
807deac2 4538 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4539 goto unlock;
4540 }
4541
4542 /* If no side requires MITM protection; auto-accept */
a767631a
MA		 4543 if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4544 (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
55bc1a37
JH		 4545
4546 /* If we're not the initiators request authorization to
4547 * proceed from user space (mgmt_user_confirm with
ba15a58b 4548 * confirm_hint set to 1). The exception is if neither
02f3e254
JH		 4549 * side had MITM or if the local IO capability is
4550 * NoInputNoOutput, in which case we do auto-accept
ba15a58b
JH		 4551 */
4552 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
02f3e254 4553 conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
ba15a58b 4554 (loc_mitm || rem_mitm)) {
55bc1a37
JH		 4555 BT_DBG("Confirming auto-accept as acceptor");
4556 confirm_hint = 1;
4557 goto confirm;
4558 }
4559
9f61656a 4560 BT_DBG("Auto-accept of user confirmation with %ums delay",
807deac2 4561 hdev->auto_accept_delay);
9f61656a
JH		 4562
4563 if (hdev->auto_accept_delay > 0) {
4564 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
7bc18d9d
JH		 4565 queue_delayed_work(conn->hdev->workqueue,
4566 &conn->auto_accept_work, delay);
9f61656a
JH		 4567 goto unlock;
4568 }
4569
7a828908 4570 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
807deac2 4571 sizeof(ev->bdaddr), &ev->bdaddr);
7a828908
JH		 4572 goto unlock;
4573 }
4574
55bc1a37 4575confirm:
39adbffe
JH		 4576 mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4577 le32_to_cpu(ev->passkey), confirm_hint);
7a828908
JH		 4578
4579unlock:
a5c29683
JH		 4580 hci_dev_unlock(hdev);
4581}
4582
6039aa73
GP		 4583static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4584 struct sk_buff *skb)
1143d458
BG		 4585{
4586 struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4587
4588 BT_DBG("%s", hdev->name);
4589
d7a5a11d 4590 if (hci_dev_test_flag(hdev, HCI_MGMT))
272d90df 4591 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
1143d458
BG		 4592}
4593
92a25256
JH		 4594static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4595 struct sk_buff *skb)
4596{
4597 struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4598 struct hci_conn *conn;
4599
4600 BT_DBG("%s", hdev->name);
4601
4602 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4603 if (!conn)
4604 return;
4605
4606 conn->passkey_notify = __le32_to_cpu(ev->passkey);
4607 conn->passkey_entered = 0;
4608
d7a5a11d 4609 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4610 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4611 conn->dst_type, conn->passkey_notify,
4612 conn->passkey_entered);
4613}
4614
4615static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4616{
4617 struct hci_ev_keypress_notify *ev = (void *) skb->data;
4618 struct hci_conn *conn;
4619
4620 BT_DBG("%s", hdev->name);
4621
4622 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4623 if (!conn)
4624 return;
4625
4626 switch (ev->type) {
4627 case HCI_KEYPRESS_STARTED:
4628 conn->passkey_entered = 0;
4629 return;
4630
4631 case HCI_KEYPRESS_ENTERED:
4632 conn->passkey_entered++;
4633 break;
4634
4635 case HCI_KEYPRESS_ERASED:
4636 conn->passkey_entered--;
4637 break;
4638
4639 case HCI_KEYPRESS_CLEARED:
4640 conn->passkey_entered = 0;
4641 break;
4642
4643 case HCI_KEYPRESS_COMPLETED:
4644 return;
4645 }
4646
d7a5a11d 4647 if (hci_dev_test_flag(hdev, HCI_MGMT))
92a25256
JH		 4648 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4649 conn->dst_type, conn->passkey_notify,
4650 conn->passkey_entered);
4651}
4652
6039aa73
GP		 4653static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4654 struct sk_buff *skb)
0493684e
MH		 4655{
4656 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4657 struct hci_conn *conn;
4658
4659 BT_DBG("%s", hdev->name);
4660
4661 hci_dev_lock(hdev);
4662
4663 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 4664 if (!conn)
4665 goto unlock;
4666
c1d4fa7a
JH		 4667 /* Reset the authentication requirement to unknown */
4668 conn->remote_auth = 0xff;
4669
2a611692
JH		 4670 /* To avoid duplicate auth_failed events to user space we check
4671 * the HCI_CONN_AUTH_PEND flag which will be set if we
4672 * initiated the authentication. A traditional auth_complete
4673 * event gets always produced as initiator and is also mapped to
4674 * the mgmt_auth_failed event */
fa1bd918 4675 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
e1e930f5 4676 mgmt_auth_failed(conn, ev->status);
0493684e 4677
76a68ba0 4678 hci_conn_drop(conn);
2a611692
JH		 4679
4680unlock:
0493684e
MH		 4681 hci_dev_unlock(hdev);
4682}
4683
6039aa73
GP		 4684static void hci_remote_host_features_evt(struct hci_dev *hdev,
4685 struct sk_buff *skb)
41a96212
MH		 4686{
4687 struct hci_ev_remote_host_features *ev = (void *) skb->data;
4688 struct inquiry_entry *ie;
cad718ed 4689 struct hci_conn *conn;
41a96212
MH		 4690
4691 BT_DBG("%s", hdev->name);
4692
4693 hci_dev_lock(hdev);
4694
cad718ed
JH		 4695 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4696 if (conn)
4697 memcpy(conn->features[1], ev->features, 8);
4698
cc11b9c1
AE		 4699 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4700 if (ie)
02b7cc62 4701 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
41a96212
MH		 4702
4703 hci_dev_unlock(hdev);
4704}
4705
6039aa73
GP		 4706static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4707 struct sk_buff *skb)
2763eda6
SJ		 4708{
4709 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4710 struct oob_data *data;
4711
4712 BT_DBG("%s", hdev->name);
4713
4714 hci_dev_lock(hdev);
4715
d7a5a11d 4716 if (!hci_dev_test_flag(hdev, HCI_MGMT))
e1ba1f15
SJ		 4717 goto unlock;
4718
6928a924 4719 data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
6665d057
MH		 4720 if (!data) {
4721 struct hci_cp_remote_oob_data_neg_reply cp;
519ca9d0 4722
6665d057
MH		 4723 bacpy(&cp.bdaddr, &ev->bdaddr);
4724 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4725 sizeof(cp), &cp);
4726 goto unlock;
4727 }
2763eda6 4728
6665d057
MH		 4729 if (bredr_sc_enabled(hdev)) {
4730 struct hci_cp_remote_oob_ext_data_reply cp;
519ca9d0 4731
6665d057 4732 bacpy(&cp.bdaddr, &ev->bdaddr);
d7a5a11d 4733 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
6665d057
MH		 4734 memset(cp.hash192, 0, sizeof(cp.hash192));
4735 memset(cp.rand192, 0, sizeof(cp.rand192));
4736 } else {
4737 memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4738 memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
519ca9d0 4739 }
6665d057
MH		 4740 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4741 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4742
4743 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4744 sizeof(cp), &cp);
2763eda6 4745 } else {
6665d057 4746 struct hci_cp_remote_oob_data_reply cp;
2763eda6
SJ		 4747
4748 bacpy(&cp.bdaddr, &ev->bdaddr);
6665d057
MH		 4749 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4750 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4751
4752 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
519ca9d0 4753 sizeof(cp), &cp);
2763eda6
SJ		 4754 }
4755
e1ba1f15 4756unlock:
2763eda6
SJ		 4757 hci_dev_unlock(hdev);
4758}
4759
a77a6a14
AW		 4760#if IS_ENABLED(CONFIG_BT_HS)
4761static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4762{
4763 struct hci_ev_channel_selected *ev = (void *)skb->data;
4764 struct hci_conn *hcon;
4765
4766 BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4767
4768 skb_pull(skb, sizeof(*ev));
4769
4770 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4771 if (!hcon)
4772 return;
4773
4774 amp_read_loc_assoc_final_data(hdev, hcon);
4775}
4776
d5e91192
AE		 4777static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4778 struct sk_buff *skb)
4779{
4780 struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4781 struct hci_conn *hcon, *bredr_hcon;
4782
4783 BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4784 ev->status);
4785
4786 hci_dev_lock(hdev);
4787
4788 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4789 if (!hcon) {
4790 hci_dev_unlock(hdev);
4791 return;
4792 }
4793
4794 if (ev->status) {
4795 hci_conn_del(hcon);
4796 hci_dev_unlock(hdev);
4797 return;
4798 }
4799
4800 bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4801
4802 hcon->state = BT_CONNECTED;
4803 bacpy(&hcon->dst, &bredr_hcon->dst);
4804
4805 hci_conn_hold(hcon);
4806 hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
76a68ba0 4807 hci_conn_drop(hcon);
d5e91192 4808
23b9ceb7 4809 hci_debugfs_create_conn(hcon);
d5e91192
AE		 4810 hci_conn_add_sysfs(hcon);
4811
cf70ff22 4812 amp_physical_cfm(bredr_hcon, hcon);
d5e91192 4813
cf70ff22 4814 hci_dev_unlock(hdev);
d5e91192
AE		 4815}
4816
27695fb4
AE		 4817static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4818{
4819 struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4820 struct hci_conn *hcon;
4821 struct hci_chan *hchan;
4822 struct amp_mgr *mgr;
4823
4824 BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4825 hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4826 ev->status);
4827
4828 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4829 if (!hcon)
4830 return;
4831
4832 /* Create AMP hchan */
4833 hchan = hci_chan_create(hcon);
4834 if (!hchan)
4835 return;
4836
4837 hchan->handle = le16_to_cpu(ev->handle);
4838
4839 BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4840
4841 mgr = hcon->amp_mgr;
4842 if (mgr && mgr->bredr_chan) {
4843 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4844
4845 l2cap_chan_lock(bredr_chan);
4846
4847 bredr_chan->conn->mtu = hdev->block_mtu;
4848 l2cap_logical_cfm(bredr_chan, hchan, 0);
4849 hci_conn_hold(hcon);
4850
4851 l2cap_chan_unlock(bredr_chan);
4852 }
4853}
4854
606e2a10
AE		 4855static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4856 struct sk_buff *skb)
4857{
4858 struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4859 struct hci_chan *hchan;
4860
4861 BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4862 le16_to_cpu(ev->handle), ev->status);
4863
4864 if (ev->status)
4865 return;
4866
4867 hci_dev_lock(hdev);
4868
4869 hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4870 if (!hchan)
4871 goto unlock;
4872
4873 amp_destroy_logical_link(hchan, ev->reason);
4874
4875unlock:
4876 hci_dev_unlock(hdev);
4877}
4878
9eef6b3a
AE		 4879static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4880 struct sk_buff *skb)
4881{
4882 struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4883 struct hci_conn *hcon;
4884
4885 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4886
4887 if (ev->status)
4888 return;
4889
4890 hci_dev_lock(hdev);
4891
4892 hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4893 if (hcon) {
4894 hcon->state = BT_CLOSED;
4895 hci_conn_del(hcon);
4896 }
4897
4898 hci_dev_unlock(hdev);
4899}
a77a6a14 4900#endif
9eef6b3a 4901
d12fb056
JK		 4902static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4903 bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4904 u16 interval, u16 latency, u16 supervision_timeout)
fcd89c09 4905{
912b42ef 4906 struct hci_conn_params *params;
fcd89c09 4907 struct hci_conn *conn;
68d6f6de 4908 struct smp_irk *irk;
837d502e 4909 u8 addr_type;
fcd89c09 4910
fcd89c09
VT		 4911 hci_dev_lock(hdev);
4912
fbd96c15
JH		 4913 /* All controllers implicitly stop advertising in the event of a
4914 * connection, so ensure that the state bit is cleared.
4915 */
a358dc11 4916 hci_dev_clear_flag(hdev, HCI_LE_ADV);
fbd96c15 4917
e7d9ab73 4918 conn = hci_lookup_le_connect(hdev);
b62f328b 4919 if (!conn) {
d12fb056 4920 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
b62f328b 4921 if (!conn) {
2064ee33 4922 bt_dev_err(hdev, "no memory for new connection");
230fd16a 4923 goto unlock;
b62f328b 4924 }
29b7988a 4925
d12fb056 4926 conn->dst_type = bdaddr_type;
b9b343d2 4927
cb1d68f7
JH		 4928 /* If we didn't have a hci_conn object previously
4929 * but we're in master role this must be something
4930 * initiated using a white list. Since white list based
4931 * connections are not "first class citizens" we don't
4932 * have full tracking of them. Therefore, we go ahead
4933 * with a "best effort" approach of determining the
4934 * initiator address based on the HCI_PRIVACY flag.
4935 */
4936 if (conn->out) {
d12fb056
JK		 4937 conn->resp_addr_type = bdaddr_type;
4938 bacpy(&conn->resp_addr, bdaddr);
d7a5a11d 4939 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
cb1d68f7
JH		 4940 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4941 bacpy(&conn->init_addr, &hdev->rpa);
4942 } else {
4943 hci_copy_identity_address(hdev,
4944 &conn->init_addr,
4945 &conn->init_addr_type);
4946 }
cb1d68f7 4947 }
9489eca4
JH		 4948 } else {
4949 cancel_delayed_work(&conn->le_conn_timeout);
b62f328b 4950 }
fcd89c09 4951
80c24ab8
JH		 4952 if (!conn->out) {
4953 /* Set the responder (our side) address type based on
4954 * the advertising address type.
4955 */
4956 conn->resp_addr_type = hdev->adv_addr_type;
acf0aeae
JK		 4957 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4958 /* In case of ext adv, resp_addr will be updated in
4959 * Adv Terminated event.
4960 */
4961 if (!ext_adv_capable(hdev))
4962 bacpy(&conn->resp_addr, &hdev->random_addr);
4963 } else {
80c24ab8 4964 bacpy(&conn->resp_addr, &hdev->bdaddr);
acf0aeae 4965 }
80c24ab8 4966
d12fb056
JK		 4967 conn->init_addr_type = bdaddr_type;
4968 bacpy(&conn->init_addr, bdaddr);
a720d735
MH		 4969
4970 /* For incoming connections, set the default minimum
4971 * and maximum connection interval. They will be used
4972 * to check if the parameters are in range and if not
4973 * trigger the connection update procedure.
4974 */
4975 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4976 conn->le_conn_max_interval = hdev->le_conn_max_interval;
80c24ab8 4977 }
7be2edbb 4978
edb4b466
MH		 4979 /* Lookup the identity address from the stored connection
4980 * address and address type.
4981 *
4982 * When establishing connections to an identity address, the
4983 * connection procedure will store the resolvable random
4984 * address first. Now if it can be converted back into the
4985 * identity address, start using the identity address from
4986 * now on.
4987 */
4988 irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
68d6f6de
JH		 4989 if (irk) {
4990 bacpy(&conn->dst, &irk->bdaddr);
4991 conn->dst_type = irk->addr_type;
4992 }
4993
d12fb056
JK		 4994 if (status) {
4995 hci_le_conn_failed(conn, status);
837d502e
JH		 4996 goto unlock;
4997 }
4998
08853f18
JH		 4999 if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5000 addr_type = BDADDR_LE_PUBLIC;
5001 else
5002 addr_type = BDADDR_LE_RANDOM;
5003
2d3c2260
JH		 5004 /* Drop the connection if the device is blocked */
5005 if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5006 hci_conn_drop(conn);
cd17decb
AG		 5007 goto unlock;
5008 }
5009
b644ba33 5010 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
48ec92fa 5011 mgmt_device_connected(hdev, conn, 0, NULL, 0);
83bc71b4 5012
7b5c0d52 5013 conn->sec_level = BT_SECURITY_LOW;
d12fb056 5014 conn->handle = handle;
0fe29fd1 5015 conn->state = BT_CONFIG;
fcd89c09 5016
d12fb056
JK		 5017 conn->le_conn_interval = interval;
5018 conn->le_conn_latency = latency;
5019 conn->le_supv_timeout = supervision_timeout;
e04fde60 5020
23b9ceb7 5021 hci_debugfs_create_conn(conn);
fcd89c09
VT		 5022 hci_conn_add_sysfs(conn);
5023
d17010bf
CIK		 5024 /* The remote features procedure is defined for master
5025 * role only. So only in case of an initiated connection
5026 * request the remote features.
5027 *
5028 * If the local controller supports slave-initiated features
5029 * exchange, then requesting the remote features in slave
5030 * role is possible. Otherwise just transition into the
5031 * connected state without requesting the remote features.
5032 */
5033 if (conn->out ||
5034 (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5035 struct hci_cp_le_read_remote_features cp;
0fe29fd1 5036
d17010bf 5037 cp.handle = __cpu_to_le16(conn->handle);
0fe29fd1 5038
d17010bf
CIK		 5039 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5040 sizeof(cp), &cp);
0fe29fd1 5041
d17010bf 5042 hci_conn_hold(conn);
0fe29fd1 5043 } else {
d17010bf 5044 conn->state = BT_CONNECTED;
d12fb056 5045 hci_connect_cfm(conn, status);
0fe29fd1 5046 }
fcd89c09 5047
5477610f
JH		 5048 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5049 conn->dst_type);
f161dd41 5050 if (params) {
95305baa 5051 list_del_init(&params->action);
f161dd41
JH		 5052 if (params->conn) {
5053 hci_conn_drop(params->conn);
f8aaf9b6 5054 hci_conn_put(params->conn);
f161dd41
JH		 5055 params->conn = NULL;
5056 }
5057 }
a4790dbd 5058
fcd89c09 5059unlock:
223683a5 5060 hci_update_background_scan(hdev);
fcd89c09
VT		 5061 hci_dev_unlock(hdev);
5062}
5063
d12fb056
JK		 5064static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5065{
5066 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5067
5068 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5069
5070 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5071 ev->role, le16_to_cpu(ev->handle),
5072 le16_to_cpu(ev->interval),
5073 le16_to_cpu(ev->latency),
5074 le16_to_cpu(ev->supervision_timeout));
5075}
5076
4d94f95d
JK		 5077static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5078 struct sk_buff *skb)
5079{
5080 struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5081
5082 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5083
5084 le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5085 ev->role, le16_to_cpu(ev->handle),
5086 le16_to_cpu(ev->interval),
5087 le16_to_cpu(ev->latency),
5088 le16_to_cpu(ev->supervision_timeout));
5089}
5090
acf0aeae
JK		 5091static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5092{
5093 struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5094 struct hci_conn *conn;
5095
5096 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5097
5098 if (ev->status)
5099 return;
5100
5101 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5102 if (conn) {
5103 struct adv_info *adv_instance;
5104
5105 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5106 return;
5107
5108 if (!hdev->cur_adv_instance) {
5109 bacpy(&conn->resp_addr, &hdev->random_addr);
5110 return;
5111 }
5112
5113 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5114 if (adv_instance)
5115 bacpy(&conn->resp_addr, &adv_instance->random_addr);
5116 }
5117}
5118
1855d92d
MH		 5119static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5120 struct sk_buff *skb)
5121{
5122 struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5123 struct hci_conn *conn;
5124
5125 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5126
5127 if (ev->status)
5128 return;
5129
5130 hci_dev_lock(hdev);
5131
5132 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5133 if (conn) {
5134 conn->le_conn_interval = le16_to_cpu(ev->interval);
5135 conn->le_conn_latency = le16_to_cpu(ev->latency);
5136 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5137 }
5138
5139 hci_dev_unlock(hdev);
5140}
5141
a4790dbd 5142/* This function requires the caller holds hdev->lock */
fd45ada9
AA		 5143static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5144 bdaddr_t *addr,
082f2300
SJ		 5145 u8 addr_type, u8 adv_type,
5146 bdaddr_t *direct_rpa)
a4790dbd
AG		 5147{
5148 struct hci_conn *conn;
4b9e7e75 5149 struct hci_conn_params *params;
a4790dbd 5150
1c1abcab
JH		 5151 /* If the event is not connectable don't proceed further */
5152 if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
fd45ada9 5153 return NULL;
1c1abcab
JH		 5154
5155 /* Ignore if the device is blocked */
dcc36c16 5156 if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
fd45ada9 5157 return NULL;
1c1abcab 5158
f99353cf
JH		 5159 /* Most controller will fail if we try to create new connections
5160 * while we have an existing one in slave role.
5161 */
5162 if (hdev->conn_hash.le_num_slave > 0)
fd45ada9 5163 return NULL;
f99353cf 5164
1c1abcab
JH		 5165 /* If we're not connectable only connect devices that we have in
5166 * our pend_le_conns list.
5167 */
49c50922
JH		 5168 params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5169 addr_type);
4b9e7e75 5170 if (!params)
fd45ada9 5171 return NULL;
4b9e7e75 5172
28a667c9
JP		 5173 if (!params->explicit_connect) {
5174 switch (params->auto_connect) {
5175 case HCI_AUTO_CONN_DIRECT:
5176 /* Only devices advertising with ADV_DIRECT_IND are
5177 * triggering a connection attempt. This is allowing
5178 * incoming connections from slave devices.
5179 */
5180 if (adv_type != LE_ADV_DIRECT_IND)
5181 return NULL;
5182 break;
5183 case HCI_AUTO_CONN_ALWAYS:
5184 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5185 * are triggering a connection attempt. This means
5186 * that incoming connectioms from slave device are
5187 * accepted and also outgoing connections to slave
5188 * devices are established when found.
5189 */
5190 break;
5191 default:
fd45ada9 5192 return NULL;
28a667c9 5193 }
4b9e7e75 5194 }
a4790dbd
AG		 5195
5196 conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
082f2300
SJ		 5197 HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5198 direct_rpa);
f161dd41 5199 if (!IS_ERR(conn)) {
28a667c9
JP		 5200 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5201 * by higher layer that tried to connect, if no then
5202 * store the pointer since we don't really have any
f161dd41
JH		 5203 * other owner of the object besides the params that
5204 * triggered it. This way we can abort the connection if
5205 * the parameters get removed and keep the reference
5206 * count consistent once the connection is established.
5207 */
28a667c9
JP		 5208
5209 if (!params->explicit_connect)
5210 params->conn = hci_conn_get(conn);
5211
fd45ada9 5212 return conn;
f161dd41 5213 }
a4790dbd
AG		 5214
5215 switch (PTR_ERR(conn)) {
5216 case -EBUSY:
5217 /* If hci_connect() returns -EBUSY it means there is already
5218 * an LE connection attempt going on. Since controllers don't
5219 * support more than one connection attempt at the time, we
5220 * don't consider this an error case.
5221 */
5222 break;
5223 default:
5224 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
fd45ada9 5225 return NULL;
a4790dbd 5226 }
fd45ada9
AA		 5227
5228 return NULL;
a4790dbd
AG		 5229}
5230
4af605d8 5231static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
2f010b55
MH		 5232 u8 bdaddr_type, bdaddr_t *direct_addr,
5233 u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4af605d8 5234{
b9a6328f 5235 struct discovery_state *d = &hdev->discovery;
1c1abcab 5236 struct smp_irk *irk;
fd45ada9 5237 struct hci_conn *conn;
474ee066 5238 bool match;
c70a7e4c 5239 u32 flags;
6818375e
SJ		 5240 u8 *ptr, real_len;
5241
56b40fbf
JH		 5242 switch (type) {
5243 case LE_ADV_IND:
5244 case LE_ADV_DIRECT_IND:
5245 case LE_ADV_SCAN_IND:
5246 case LE_ADV_NONCONN_IND:
5247 case LE_ADV_SCAN_RSP:
5248 break;
5249 default:
2064ee33
MH		 5250 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5251 "type: 0x%02x", type);
56b40fbf
JH		 5252 return;
5253 }
5254
6818375e
SJ		 5255 /* Find the end of the data in case the report contains padded zero
5256 * bytes at the end causing an invalid length value.
5257 *
5258 * When data is NULL, len is 0 so there is no need for extra ptr
5259 * check as 'ptr < data + 0' is already false in such case.
5260 */
5261 for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5262 if (ptr + 1 + *ptr > data + len)
5263 break;
5264 }
5265
5266 real_len = ptr - data;
5267
5268 /* Adjust for actual length */
5269 if (len != real_len) {
2064ee33 5270 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
6818375e
SJ		 5271 len = real_len;
5272 }
b9a6328f 5273
2f010b55
MH		 5274 /* If the direct address is present, then this report is from
5275 * a LE Direct Advertising Report event. In that case it is
5276 * important to see if the address is matching the local
5277 * controller address.
5278 */
5279 if (direct_addr) {
5280 /* Only resolvable random addresses are valid for these
5281 * kind of reports and others can be ignored.
5282 */
5283 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5284 return;
5285
5286 /* If the controller is not using resolvable random
5287 * addresses, then this report can be ignored.
5288 */
d7a5a11d 5289 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2f010b55
MH		 5290 return;
5291
5292 /* If the local IRK of the controller does not match
5293 * with the resolvable random address provided, then
5294 * this report can be ignored.
5295 */
5296 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5297 return;
5298 }
5299
1c1abcab
JH		 5300 /* Check if we need to convert to identity address */
5301 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5302 if (irk) {
5303 bdaddr = &irk->bdaddr;
5304 bdaddr_type = irk->addr_type;
5305 }
5306
082f2300
SJ		 5307 /* Check if we have been requested to connect to this device.
5308 *
5309 * direct_addr is set only for directed advertising reports (it is NULL
5310 * for advertising reports) and is already verified to be RPA above.
5311 */
5312 conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5313 direct_addr);
fd45ada9
AA		 5314 if (conn && type == LE_ADV_IND) {
5315 /* Store report for later inclusion by
5316 * mgmt_device_connected
5317 */
5318 memcpy(conn->le_adv_data, data, len);
5319 conn->le_adv_data_len = len;
5320 }
1c1abcab 5321
0d2bf134
JH		 5322 /* Passive scanning shouldn't trigger any device found events,
5323 * except for devices marked as CONN_REPORT for which we do send
5324 * device found events.
5325 */
ca5c4be7 5326 if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
0d2bf134
JH		 5327 if (type == LE_ADV_DIRECT_IND)
5328 return;
5329
3a19b6fe
JH		 5330 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5331 bdaddr, bdaddr_type))
0d2bf134
JH		 5332 return;
5333
5334 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5335 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5336 else
5337 flags = 0;
5338 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5339 rssi, flags, data, len, NULL, 0);
97bf2e99 5340 return;
ca5c4be7 5341 }
4af605d8 5342
c70a7e4c
MH		 5343 /* When receiving non-connectable or scannable undirected
5344 * advertising reports, this means that the remote device is
5345 * not connectable and then clearly indicate this in the
5346 * device found event.
5347 *
5348 * When receiving a scan response, then there is no way to
5349 * know if the remote device is connectable or not. However
5350 * since scan responses are merged with a previously seen
5351 * advertising report, the flags field from that report
5352 * will be used.
5353 *
5354 * In the really unlikely case that a controller get confused
5355 * and just sends a scan response event, then it is marked as
5356 * not connectable as well.
5357 */
5358 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5359 type == LE_ADV_SCAN_RSP)
5360 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5361 else
5362 flags = 0;
5363
b9a6328f
JH		 5364 /* If there's nothing pending either store the data from this
5365 * event or send an immediate device found event if the data
5366 * should not be stored for later.
5367 */
5368 if (!has_pending_adv_report(hdev)) {
5369 /* If the report will trigger a SCAN_REQ store it for
5370 * later merging.
5371 */
5372 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5373 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 5374 rssi, flags, data, len);
b9a6328f
JH		 5375 return;
5376 }
5377
5378 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 5379 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 5380 return;
5381 }
5382
474ee066
JH		 5383 /* Check if the pending report is for the same device as the new one */
5384 match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5385 bdaddr_type == d->last_adv_addr_type);
5386
b9a6328f
JH		 5387 /* If the pending data doesn't match this report or this isn't a
5388 * scan response (e.g. we got a duplicate ADV_IND) then force
5389 * sending of the pending data.
5390 */
474ee066
JH		 5391 if (type != LE_ADV_SCAN_RSP || !match) {
5392 /* Send out whatever is in the cache, but skip duplicates */
5393 if (!match)
5394 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
ff5cd29f 5395 d->last_adv_addr_type, NULL,
c70a7e4c 5396 d->last_adv_rssi, d->last_adv_flags,
ff5cd29f 5397 d->last_adv_data,
474ee066 5398 d->last_adv_data_len, NULL, 0);
b9a6328f
JH		 5399
5400 /* If the new report will trigger a SCAN_REQ store it for
5401 * later merging.
5402 */
5403 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5404 store_pending_adv_report(hdev, bdaddr, bdaddr_type,
c70a7e4c 5405 rssi, flags, data, len);
b9a6328f
JH		 5406 return;
5407 }
5408
5409 /* The advertising reports cannot be merged, so clear
5410 * the pending report and send out a device found event.
5411 */
5412 clear_pending_adv_report(hdev);
5c5b93e4 5413 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
c70a7e4c 5414 rssi, flags, data, len, NULL, 0);
b9a6328f
JH		 5415 return;
5416 }
5417
5418 /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5419 * the new event is a SCAN_RSP. We can therefore proceed with
5420 * sending a merged device found event.
5421 */
5422 mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
c70a7e4c 5423 d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
42bd6a56 5424 d->last_adv_data, d->last_adv_data_len, data, len);
b9a6328f 5425 clear_pending_adv_report(hdev);
4af605d8
JH		 5426}
5427
6039aa73 5428static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
9aa04c91 5429{
e95beb41
AG		 5430 u8 num_reports = skb->data[0];
5431 void *ptr = &skb->data[1];
9aa04c91 5432
a4790dbd
AG		 5433 hci_dev_lock(hdev);
5434
e95beb41
AG		 5435 while (num_reports--) {
5436 struct hci_ev_le_advertising_info *ev = ptr;
4af605d8 5437 s8 rssi;
a4790dbd 5438
ee649346
CC		 5439 if (ev->length <= HCI_MAX_AD_LENGTH) {
5440 rssi = ev->data[ev->length];
5441 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5442 ev->bdaddr_type, NULL, 0, rssi,
5443 ev->data, ev->length);
5444 } else {
5445 bt_dev_err(hdev, "Dropping invalid advertising data");
5446 }
3c9e9195 5447
e95beb41 5448 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91 5449 }
a4790dbd
AG		 5450
5451 hci_dev_unlock(hdev);
9aa04c91
AG		 5452}
5453
b2cc9761
JK		 5454static u8 ext_evt_type_to_legacy(u16 evt_type)
5455{
5456 if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5457 switch (evt_type) {
5458 case LE_LEGACY_ADV_IND:
5459 return LE_ADV_IND;
5460 case LE_LEGACY_ADV_DIRECT_IND:
5461 return LE_ADV_DIRECT_IND;
5462 case LE_LEGACY_ADV_SCAN_IND:
5463 return LE_ADV_SCAN_IND;
5464 case LE_LEGACY_NONCONN_IND:
5465 return LE_ADV_NONCONN_IND;
5466 case LE_LEGACY_SCAN_RSP_ADV:
5467 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5468 return LE_ADV_SCAN_RSP;
5469 }
5470
5471 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5472 evt_type);
5473
5474 return LE_ADV_INVALID;
5475 }
5476
5477 if (evt_type & LE_EXT_ADV_CONN_IND) {
5478 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5479 return LE_ADV_DIRECT_IND;
5480
c215e939 5481 return LE_ADV_IND;
b2cc9761
JK		 5482 }
5483
5484 if (evt_type & LE_EXT_ADV_SCAN_RSP)
5485 return LE_ADV_SCAN_RSP;
5486
5487 if (evt_type & LE_EXT_ADV_SCAN_IND)
c215e939 5488 return LE_ADV_SCAN_IND;
b2cc9761
JK		 5489
5490 if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5491 evt_type & LE_EXT_ADV_DIRECT_IND)
c215e939 5492 return LE_ADV_NONCONN_IND;
c215e939
JK		 5493
5494 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5495 evt_type);
5496
5497 return LE_ADV_INVALID;
5498}
5499
5500static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5501{
5502 u8 num_reports = skb->data[0];
5503 void *ptr = &skb->data[1];
5504
5505 hci_dev_lock(hdev);
5506
5507 while (num_reports--) {
5508 struct hci_ev_le_ext_adv_report *ev = ptr;
5509 u8 legacy_evt_type;
5510 u16 evt_type;
5511
5512 evt_type = __le16_to_cpu(ev->evt_type);
b2cc9761 5513 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
c215e939
JK		 5514 if (legacy_evt_type != LE_ADV_INVALID) {
5515 process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5516 ev->bdaddr_type, NULL, 0, ev->rssi,
5517 ev->data, ev->length);
5518 }
5519
cd9151b6 5520 ptr += sizeof(*ev) + ev->length;
c215e939
JK		 5521 }
5522
5523 hci_dev_unlock(hdev);
5524}
5525
0fe29fd1
MH		 5526static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5527 struct sk_buff *skb)
5528{
5529 struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5530 struct hci_conn *conn;
5531
5532 BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5533
5534 hci_dev_lock(hdev);
5535
5536 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5537 if (conn) {
5538 if (!ev->status)
5539 memcpy(conn->features[0], ev->features, 8);
5540
5541 if (conn->state == BT_CONFIG) {
5542 __u8 status;
5543
5544 /* If the local controller supports slave-initiated
5545 * features exchange, but the remote controller does
5546 * not, then it is possible that the error code 0x1a
5547 * for unsupported remote feature gets returned.
5548 *
5549 * In this specific case, allow the connection to
5550 * transition into connected state and mark it as
5551 * successful.
5552 */
5553 if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5554 !conn->out && ev->status == 0x1a)
5555 status = 0x00;
5556 else
5557 status = ev->status;
5558
5559 conn->state = BT_CONNECTED;
5560 hci_connect_cfm(conn, status);
5561 hci_conn_drop(conn);
5562 }
5563 }
5564
5565 hci_dev_unlock(hdev);
5566}
5567
6039aa73 5568static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
a7a595f6
VCG		 5569{
5570 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5571 struct hci_cp_le_ltk_reply cp;
bea710fe 5572 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 5573 struct hci_conn *conn;
c9839a11 5574 struct smp_ltk *ltk;
a7a595f6 5575
9f1db00c 5576 BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
a7a595f6
VCG		 5577
5578 hci_dev_lock(hdev);
5579
5580 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 5581 if (conn == NULL)
5582 goto not_found;
a7a595f6 5583
f3a73d97 5584 ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5378bc56 5585 if (!ltk)
bea710fe
VCG		 5586 goto not_found;
5587
5378bc56
JH		 5588 if (smp_ltk_is_sc(ltk)) {
5589 /* With SC both EDiv and Rand are set to zero */
5590 if (ev->ediv || ev->rand)
5591 goto not_found;
5592 } else {
5593 /* For non-SC keys check that EDiv and Rand match */
5594 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5595 goto not_found;
5596 }
5597
8b76ce34
JH		 5598 memcpy(cp.ltk, ltk->val, ltk->enc_size);
5599 memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
a7a595f6 5600 cp.handle = cpu_to_le16(conn->handle);
c9839a11 5601
a6f7833c 5602 conn->pending_sec_level = smp_ltk_sec_level(ltk);
a7a595f6 5603
89cbb4da 5604 conn->enc_key_size = ltk->enc_size;
a7a595f6
VCG		 5605
5606 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5607
5981a882
CT		 5608 /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5609 * temporary key used to encrypt a connection following
5610 * pairing. It is used during the Encrypted Session Setup to
5611 * distribute the keys. Later, security can be re-established
5612 * using a distributed LTK.
5613 */
2ceba539 5614 if (ltk->type == SMP_STK) {
fe59a05f 5615 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
970d0f1b
JH		 5616 list_del_rcu(&ltk->list);
5617 kfree_rcu(ltk, rcu);
fe59a05f
JH		 5618 } else {
5619 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
c9839a11
VCG		 5620 }
5621
a7a595f6 5622 hci_dev_unlock(hdev);
bea710fe
VCG		 5623
5624 return;
5625
5626not_found:
5627 neg.handle = ev->handle;
5628 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5629 hci_dev_unlock(hdev);
a7a595f6
VCG		 5630}
5631
8e75b46a
AG		 5632static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5633 u8 reason)
5634{
5635 struct hci_cp_le_conn_param_req_neg_reply cp;
5636
5637 cp.handle = cpu_to_le16(handle);
5638 cp.reason = reason;
5639
5640 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5641 &cp);
5642}
5643
5644static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5645 struct sk_buff *skb)
5646{
5647 struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5648 struct hci_cp_le_conn_param_req_reply cp;
5649 struct hci_conn *hcon;
5650 u16 handle, min, max, latency, timeout;
5651
5652 handle = le16_to_cpu(ev->handle);
5653 min = le16_to_cpu(ev->interval_min);
5654 max = le16_to_cpu(ev->interval_max);
5655 latency = le16_to_cpu(ev->latency);
5656 timeout = le16_to_cpu(ev->timeout);
5657
5658 hcon = hci_conn_hash_lookup_handle(hdev, handle);
5659 if (!hcon || hcon->state != BT_CONNECTED)
5660 return send_conn_param_neg_reply(hdev, handle,
5661 HCI_ERROR_UNKNOWN_CONN_ID);
5662
5663 if (hci_check_conn_params(min, max, latency, timeout))
5664 return send_conn_param_neg_reply(hdev, handle,
5665 HCI_ERROR_INVALID_LL_PARAMS);
5666
40bef302 5667 if (hcon->role == HCI_ROLE_MASTER) {
348d50b8 5668 struct hci_conn_params *params;
f4869e2a 5669 u8 store_hint;
348d50b8
JH		 5670
5671 hci_dev_lock(hdev);
5672
5673 params = hci_conn_params_lookup(hdev, &hcon->dst,
5674 hcon->dst_type);
5675 if (params) {
5676 params->conn_min_interval = min;
5677 params->conn_max_interval = max;
5678 params->conn_latency = latency;
5679 params->supervision_timeout = timeout;
f4869e2a
JH		 5680 store_hint = 0x01;
5681 } else{
5682 store_hint = 0x00;
348d50b8
JH		 5683 }
5684
5685 hci_dev_unlock(hdev);
5686
f4869e2a
JH		 5687 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5688 store_hint, min, max, latency, timeout);
348d50b8 5689 }
ffb5a827 5690
8e75b46a
AG		 5691 cp.handle = ev->handle;
5692 cp.interval_min = ev->interval_min;
5693 cp.interval_max = ev->interval_max;
5694 cp.latency = ev->latency;
5695 cp.timeout = ev->timeout;
5696 cp.min_ce_len = 0;
5697 cp.max_ce_len = 0;
5698
5699 hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5700}
5701
2f010b55
MH		 5702static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5703 struct sk_buff *skb)
5704{
5705 u8 num_reports = skb->data[0];
5706 void *ptr = &skb->data[1];
5707
5708 hci_dev_lock(hdev);
5709
5710 while (num_reports--) {
5711 struct hci_ev_le_direct_adv_info *ev = ptr;
5712
5713 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5714 ev->bdaddr_type, &ev->direct_addr,
5715 ev->direct_addr_type, ev->rssi, NULL, 0);
5716
5717 ptr += sizeof(*ev);
5718 }
5719
5720 hci_dev_unlock(hdev);
5721}
5722
6039aa73 5723static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
fcd89c09
VT		 5724{
5725 struct hci_ev_le_meta *le_ev = (void *) skb->data;
5726
5727 skb_pull(skb, sizeof(*le_ev));
5728
5729 switch (le_ev->subevent) {
5730 case HCI_EV_LE_CONN_COMPLETE:
5731 hci_le_conn_complete_evt(hdev, skb);
5732 break;
5733
1855d92d
MH		 5734 case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5735 hci_le_conn_update_complete_evt(hdev, skb);
5736 break;
5737
9aa04c91
AG		 5738 case HCI_EV_LE_ADVERTISING_REPORT:
5739 hci_le_adv_report_evt(hdev, skb);
5740 break;
5741
0fe29fd1
MH		 5742 case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5743 hci_le_remote_feat_complete_evt(hdev, skb);
5744 break;
5745
a7a595f6
VCG		 5746 case HCI_EV_LE_LTK_REQ:
5747 hci_le_ltk_request_evt(hdev, skb);
5748 break;
5749
8e75b46a
AG		 5750 case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5751 hci_le_remote_conn_param_req_evt(hdev, skb);
5752 break;
5753
2f010b55
MH		 5754 case HCI_EV_LE_DIRECT_ADV_REPORT:
5755 hci_le_direct_adv_report_evt(hdev, skb);
5756 break;
5757
c215e939
JK		 5758 case HCI_EV_LE_EXT_ADV_REPORT:
5759 hci_le_ext_adv_report_evt(hdev, skb);
5760 break;
5761
4d94f95d
JK		 5762 case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5763 hci_le_enh_conn_complete_evt(hdev, skb);
5764 break;
5765
acf0aeae
JK		 5766 case HCI_EV_LE_EXT_ADV_SET_TERM:
5767 hci_le_ext_adv_term_evt(hdev, skb);
5768 break;
5769
fcd89c09
VT		 5770 default:
5771 break;
5772 }
5773}
5774
757aa0b5
JH		 5775static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5776 u8 event, struct sk_buff *skb)
5777{
5778 struct hci_ev_cmd_complete *ev;
5779 struct hci_event_hdr *hdr;
5780
5781 if (!skb)
5782 return false;
5783
5784 if (skb->len < sizeof(*hdr)) {
2064ee33 5785 bt_dev_err(hdev, "too short HCI event");
757aa0b5
JH		 5786 return false;
5787 }
5788
5789 hdr = (void *) skb->data;
5790 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5791
5792 if (event) {
5793 if (hdr->evt != event)
5794 return false;
5795 return true;
5796 }
5797
1629db9c
JH		 5798 /* Check if request ended in Command Status - no way to retreive
5799 * any extra parameters in this case.
5800 */
5801 if (hdr->evt == HCI_EV_CMD_STATUS)
5802 return false;
5803
757aa0b5 5804 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
2064ee33
MH		 5805 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5806 hdr->evt);
757aa0b5
JH		 5807 return false;
5808 }
5809
5810 if (skb->len < sizeof(*ev)) {
2064ee33 5811 bt_dev_err(hdev, "too short cmd_complete event");
757aa0b5
JH		 5812 return false;
5813 }
5814
5815 ev = (void *) skb->data;
5816 skb_pull(skb, sizeof(*ev));
5817
5818 if (opcode != __le16_to_cpu(ev->opcode)) {
5819 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5820 __le16_to_cpu(ev->opcode));
5821 return false;
5822 }
5823
5824 return true;
5825}
5826
a9de9248
MH		 5827void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5828{
5829 struct hci_event_hdr *hdr = (void *) skb->data;
e6214487
JH		 5830 hci_req_complete_t req_complete = NULL;
5831 hci_req_complete_skb_t req_complete_skb = NULL;
5832 struct sk_buff *orig_skb = NULL;
757aa0b5 5833 u8 status = 0, event = hdr->evt, req_evt = 0;
e6214487 5834 u16 opcode = HCI_OP_NOP;
a9de9248 5835
242c0ebd 5836 if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
c1f23a2b 5837 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
e6214487
JH		 5838 opcode = __le16_to_cpu(cmd_hdr->opcode);
5839 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5840 &req_complete_skb);
757aa0b5 5841 req_evt = event;
02350a72
JH		 5842 }
5843
e6214487
JH		 5844 /* If it looks like we might end up having to call
5845 * req_complete_skb, store a pristine copy of the skb since the
5846 * various handlers may modify the original one through
5847 * skb_pull() calls, etc.
5848 */
5849 if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5850 event == HCI_EV_CMD_COMPLETE)
5851 orig_skb = skb_clone(skb, GFP_KERNEL);
5852
5853 skb_pull(skb, HCI_EVENT_HDR_SIZE);
5854
a9de9248 5855 switch (event) {
1da177e4
LT		 5856 case HCI_EV_INQUIRY_COMPLETE:
5857 hci_inquiry_complete_evt(hdev, skb);
5858 break;
5859
5860 case HCI_EV_INQUIRY_RESULT:
5861 hci_inquiry_result_evt(hdev, skb);
5862 break;
5863
a9de9248
MH		 5864 case HCI_EV_CONN_COMPLETE:
5865 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 5866 break;
5867
1da177e4
LT		 5868 case HCI_EV_CONN_REQUEST:
5869 hci_conn_request_evt(hdev, skb);
5870 break;
5871
1da177e4
LT		 5872 case HCI_EV_DISCONN_COMPLETE:
5873 hci_disconn_complete_evt(hdev, skb);
5874 break;
5875
1da177e4
LT		 5876 case HCI_EV_AUTH_COMPLETE:
5877 hci_auth_complete_evt(hdev, skb);
5878 break;
5879
a9de9248
MH		 5880 case HCI_EV_REMOTE_NAME:
5881 hci_remote_name_evt(hdev, skb);
5882 break;
5883
1da177e4
LT		 5884 case HCI_EV_ENCRYPT_CHANGE:
5885 hci_encrypt_change_evt(hdev, skb);
5886 break;
5887
a9de9248
MH		 5888 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5889 hci_change_link_key_complete_evt(hdev, skb);
5890 break;
5891
5892 case HCI_EV_REMOTE_FEATURES:
5893 hci_remote_features_evt(hdev, skb);
5894 break;
5895
a9de9248 5896 case HCI_EV_CMD_COMPLETE:
e6214487
JH		 5897 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5898 &req_complete, &req_complete_skb);
a9de9248
MH		 5899 break;
5900
5901 case HCI_EV_CMD_STATUS:
e6214487
JH		 5902 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5903 &req_complete_skb);
a9de9248
MH		 5904 break;
5905
24dfa343
MH		 5906 case HCI_EV_HARDWARE_ERROR:
5907 hci_hardware_error_evt(hdev, skb);
5908 break;
5909
a9de9248
MH		 5910 case HCI_EV_ROLE_CHANGE:
5911 hci_role_change_evt(hdev, skb);
5912 break;
5913
5914 case HCI_EV_NUM_COMP_PKTS:
5915 hci_num_comp_pkts_evt(hdev, skb);
5916 break;
5917
5918 case HCI_EV_MODE_CHANGE:
5919 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 5920 break;
5921
5922 case HCI_EV_PIN_CODE_REQ:
5923 hci_pin_code_request_evt(hdev, skb);
5924 break;
5925
5926 case HCI_EV_LINK_KEY_REQ:
5927 hci_link_key_request_evt(hdev, skb);
5928 break;
5929
5930 case HCI_EV_LINK_KEY_NOTIFY:
5931 hci_link_key_notify_evt(hdev, skb);
5932 break;
5933
5934 case HCI_EV_CLOCK_OFFSET:
5935 hci_clock_offset_evt(hdev, skb);
5936 break;
5937
a8746417
MH		 5938 case HCI_EV_PKT_TYPE_CHANGE:
5939 hci_pkt_type_change_evt(hdev, skb);
5940 break;
5941
85a1e930
MH		 5942 case HCI_EV_PSCAN_REP_MODE:
5943 hci_pscan_rep_mode_evt(hdev, skb);
5944 break;
5945
a9de9248
MH		 5946 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5947 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 5948 break;
5949
a9de9248
MH		 5950 case HCI_EV_REMOTE_EXT_FEATURES:
5951 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 5952 break;
5953
a9de9248
MH		 5954 case HCI_EV_SYNC_CONN_COMPLETE:
5955 hci_sync_conn_complete_evt(hdev, skb);
5956 break;
1da177e4 5957
a9de9248
MH		 5958 case HCI_EV_EXTENDED_INQUIRY_RESULT:
5959 hci_extended_inquiry_result_evt(hdev, skb);
5960 break;
1da177e4 5961
1c2e0041
JH		 5962 case HCI_EV_KEY_REFRESH_COMPLETE:
5963 hci_key_refresh_complete_evt(hdev, skb);
5964 break;
5965
0493684e
MH		 5966 case HCI_EV_IO_CAPA_REQUEST:
5967 hci_io_capa_request_evt(hdev, skb);
5968 break;
5969
03b555e1
JH		 5970 case HCI_EV_IO_CAPA_REPLY:
5971 hci_io_capa_reply_evt(hdev, skb);
5972 break;
5973
a5c29683
JH		 5974 case HCI_EV_USER_CONFIRM_REQUEST:
5975 hci_user_confirm_request_evt(hdev, skb);
5976 break;
5977
1143d458
BG		 5978 case HCI_EV_USER_PASSKEY_REQUEST:
5979 hci_user_passkey_request_evt(hdev, skb);
5980 break;
5981
92a25256
JH		 5982 case HCI_EV_USER_PASSKEY_NOTIFY:
5983 hci_user_passkey_notify_evt(hdev, skb);
5984 break;
5985
5986 case HCI_EV_KEYPRESS_NOTIFY:
5987 hci_keypress_notify_evt(hdev, skb);
5988 break;
5989
0493684e
MH		 5990 case HCI_EV_SIMPLE_PAIR_COMPLETE:
5991 hci_simple_pair_complete_evt(hdev, skb);
5992 break;
5993
41a96212
MH		 5994 case HCI_EV_REMOTE_HOST_FEATURES:
5995 hci_remote_host_features_evt(hdev, skb);
5996 break;
5997
fcd89c09
VT		 5998 case HCI_EV_LE_META:
5999 hci_le_meta_evt(hdev, skb);
6000 break;
6001
2763eda6
SJ		 6002 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6003 hci_remote_oob_data_request_evt(hdev, skb);
6004 break;
6005
a77a6a14
AW		 6006#if IS_ENABLED(CONFIG_BT_HS)
6007 case HCI_EV_CHANNEL_SELECTED:
6008 hci_chan_selected_evt(hdev, skb);
6009 break;
6010
d5e91192
AE		 6011 case HCI_EV_PHY_LINK_COMPLETE:
6012 hci_phy_link_complete_evt(hdev, skb);
6013 break;
6014
27695fb4
AE		 6015 case HCI_EV_LOGICAL_LINK_COMPLETE:
6016 hci_loglink_complete_evt(hdev, skb);
6017 break;
6018
606e2a10
AE		 6019 case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6020 hci_disconn_loglink_complete_evt(hdev, skb);
6021 break;
6022
9eef6b3a
AE		 6023 case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6024 hci_disconn_phylink_complete_evt(hdev, skb);
6025 break;
a77a6a14 6026#endif
9eef6b3a 6027
25e89e99
AE		 6028 case HCI_EV_NUM_COMP_BLOCKS:
6029 hci_num_comp_blocks_evt(hdev, skb);
6030 break;
6031
a9de9248 6032 default:
9f1db00c 6033 BT_DBG("%s event 0x%2.2x", hdev->name, event);
1da177e4
LT		 6034 break;
6035 }
6036
757aa0b5 6037 if (req_complete) {
e6214487 6038 req_complete(hdev, status, opcode);
757aa0b5
JH		 6039 } else if (req_complete_skb) {
6040 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6041 kfree_skb(orig_skb);
6042 orig_skb = NULL;
6043 }
e6214487 6044 req_complete_skb(hdev, status, opcode, orig_skb);
757aa0b5 6045 }
e6214487
JH		 6046
6047 kfree_skb(orig_skb);
1da177e4
LT		 6048 kfree_skb(skb);
6049 hdev->stat.evt_rx++;
6050}
Linux 6.x block layer and io_uring tree(s)