hci_event.c 158.6 KB
Newer Older
1
/*
L
Linus Torvalds 已提交
2
   BlueZ - Bluetooth protocol stack for Linux
3
   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
L
Linus Torvalds 已提交
4 5 6 7 8 9 10 11 12 13 14

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 16 17
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
L
Linus Torvalds 已提交
18 19
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

20 21
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
L
Linus Torvalds 已提交
22 23 24 25 26 27 28 29 30
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI event handling. */

#include <asm/unaligned.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
31
#include <net/bluetooth/mgmt.h>
32

33
#include "hci_request.h"
34
#include "hci_debugfs.h"
35
#include "a2mp.h"
36
#include "amp.h"
37
#include "smp.h"
38
#include "msft.h"
39
#include "eir.h"
L
Linus Torvalds 已提交
40

41 42 43
#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
		 "\x00\x00\x00\x00\x00\x00\x00\x00"

44 45
#define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)

L
Linus Torvalds 已提交
46 47
/* Handle HCI Event packets */

48 49
static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
				  u8 *new_status)
L
Linus Torvalds 已提交
50
{
51
	__u8 status = *((__u8 *) skb->data);
L
Linus Torvalds 已提交
52

53
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
54

55 56 57 58 59 60 61 62 63 64 65 66 67 68
	/* It is possible that we receive Inquiry Complete event right
	 * before we receive Inquiry Cancel Command Complete event, in
	 * which case the latter event should have status of Command
	 * Disallowed (0x0c). This should not be treated as error, since
	 * we actually achieve what Inquiry Cancel wants to achieve,
	 * which is to end the last Inquiry session.
	 */
	if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
		status = 0x00;
	}

	*new_status = status;

69
	if (status)
70
		return;
L
Linus Torvalds 已提交
71

72
	clear_bit(HCI_INQUIRY, &hdev->flags);
73
	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
74
	wake_up_bit(&hdev->flags, HCI_INQUIRY);
75

76
	hci_dev_lock(hdev);
77 78 79 80 81 82
	/* Set discovery state to stopped if we're not doing LE active
	 * scanning.
	 */
	if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
	    hdev->le_scan_type != LE_SCAN_ACTIVE)
		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
83 84
	hci_dev_unlock(hdev);

85 86
	hci_conn_check_pending(hdev);
}
87

88 89 90 91
static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);

92
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
93 94 95 96

	if (status)
		return;

97
	hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
98 99
}

100 101 102
static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
103

104
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
105

106 107
	if (status)
		return;
L
Linus Torvalds 已提交
108

109
	hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
110

111 112 113
	hci_conn_check_pending(hdev);
}

114 115
static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
					  struct sk_buff *skb)
116 117 118 119 120 121 122 123 124
{
	BT_DBG("%s", hdev->name);
}

static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_role_discovery *rp = (void *) skb->data;
	struct hci_conn *conn;

125
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
126 127 128 129 130 131 132

	if (rp->status)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
133 134
	if (conn)
		conn->role = rp->role;
135 136

	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
137 138
}

139 140 141 142 143
static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_link_policy *rp = (void *) skb->data;
	struct hci_conn *conn;

144
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
145 146 147 148 149 150 151 152 153 154 155 156 157

	if (rp->status)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
	if (conn)
		conn->link_policy = __le16_to_cpu(rp->policy);

	hci_dev_unlock(hdev);
}

158
static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
159
{
160
	struct hci_rp_write_link_policy *rp = (void *) skb->data;
L
Linus Torvalds 已提交
161
	struct hci_conn *conn;
162
	void *sent;
L
Linus Torvalds 已提交
163

164
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
L
Linus Torvalds 已提交
165

166 167
	if (rp->status)
		return;
L
Linus Torvalds 已提交
168

169 170 171
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
	if (!sent)
		return;
L
Linus Torvalds 已提交
172

173
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
174

175
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
176
	if (conn)
177
		conn->link_policy = get_unaligned_le16(sent + 2);
L
Linus Torvalds 已提交
178

179 180
	hci_dev_unlock(hdev);
}
L
Linus Torvalds 已提交
181

182 183
static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
					struct sk_buff *skb)
184 185 186
{
	struct hci_rp_read_def_link_policy *rp = (void *) skb->data;

187
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
188 189 190 191 192 193 194

	if (rp->status)
		return;

	hdev->link_policy = __le16_to_cpu(rp->policy);
}

195 196
static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
					 struct sk_buff *skb)
197 198 199 200
{
	__u8 status = *((__u8 *) skb->data);
	void *sent;

201
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
202

203 204 205
	if (status)
		return;

206 207 208 209
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
	if (!sent)
		return;

210
	hdev->link_policy = get_unaligned_le16(sent);
211 212
}

213 214 215
static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
216

217
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
218

219 220
	clear_bit(HCI_RESET, &hdev->flags);

221 222 223
	if (status)
		return;

224
	/* Reset all non-persistent flags */
225
	hci_dev_clear_volatile_flags(hdev);
226

227 228
	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);

229 230
	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
231 232 233

	memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
	hdev->adv_data_len = 0;
234 235 236

	memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
	hdev->scan_rsp_data_len = 0;
237

238 239
	hdev->le_scan_type = LE_SCAN_PASSIVE;

240
	hdev->ssp_debug_mode = 0;
241

242
	hci_bdaddr_list_clear(&hdev->le_accept_list);
A
Ankit Navik 已提交
243
	hci_bdaddr_list_clear(&hdev->le_resolv_list);
244
}
245

246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263
static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
	struct hci_cp_read_stored_link_key *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
	if (!sent)
		return;

	if (!rp->status && sent->read_all == 0x01) {
		hdev->stored_max_keys = rp->max_keys;
		hdev->stored_num_keys = rp->num_keys;
	}
}

264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279
static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
					  struct sk_buff *skb)
{
	struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	if (rp->num_keys <= hdev->stored_num_keys)
		hdev->stored_num_keys -= rp->num_keys;
	else
		hdev->stored_num_keys = 0;
}

280 281 282 283
static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	void *sent;
284

285
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
286

287 288 289
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
	if (!sent)
		return;
290

291 292
	hci_dev_lock(hdev);

293
	if (hci_dev_test_flag(hdev, HCI_MGMT))
294
		mgmt_set_local_name_complete(hdev, sent, status);
295 296
	else if (!status)
		memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
297

298
	hci_dev_unlock(hdev);
299 300 301 302 303 304
}

static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_local_name *rp = (void *) skb->data;

305
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
306 307 308 309

	if (rp->status)
		return;

310 311
	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
	    hci_dev_test_flag(hdev, HCI_CONFIG))
312
		memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
313 314 315 316 317 318 319
}

static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	void *sent;

320
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
321 322 323 324 325

	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
	if (!sent)
		return;

326 327
	hci_dev_lock(hdev);

328 329 330 331 332 333 334
	if (!status) {
		__u8 param = *((__u8 *) sent);

		if (param == AUTH_ENABLED)
			set_bit(HCI_AUTH, &hdev->flags);
		else
			clear_bit(HCI_AUTH, &hdev->flags);
L
Linus Torvalds 已提交
335
	}
336

337
	if (hci_dev_test_flag(hdev, HCI_MGMT))
338
		mgmt_auth_enable_complete(hdev, status);
339 340

	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
341 342
}

343
static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
344
{
345
	__u8 status = *((__u8 *) skb->data);
346
	__u8 param;
L
Linus Torvalds 已提交
347 348
	void *sent;

349
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
350

351 352 353
	if (status)
		return;

354 355 356
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
	if (!sent)
		return;
L
Linus Torvalds 已提交
357

358
	param = *((__u8 *) sent);
359

360 361 362 363
	if (param)
		set_bit(HCI_ENCRYPT, &hdev->flags);
	else
		clear_bit(HCI_ENCRYPT, &hdev->flags);
364
}
L
Linus Torvalds 已提交
365

366 367
static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
368 369
	__u8 status = *((__u8 *) skb->data);
	__u8 param;
370
	void *sent;
L
Linus Torvalds 已提交
371

372
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
373

374 375 376
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
	if (!sent)
		return;
L
Linus Torvalds 已提交
377

378 379
	param = *((__u8 *) sent);

380 381
	hci_dev_lock(hdev);

382
	if (status) {
383 384 385 386
		hdev->discov_timeout = 0;
		goto done;
	}

387
	if (param & SCAN_INQUIRY)
388
		set_bit(HCI_ISCAN, &hdev->flags);
389 390
	else
		clear_bit(HCI_ISCAN, &hdev->flags);
391

392
	if (param & SCAN_PAGE)
393
		set_bit(HCI_PSCAN, &hdev->flags);
394
	else
395
		clear_bit(HCI_PSCAN, &hdev->flags);
L
Linus Torvalds 已提交
396

397
done:
398
	hci_dev_unlock(hdev);
399
}
L
Linus Torvalds 已提交
400

401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423
static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *)skb->data);
	struct hci_cp_set_event_filter *cp;
	void *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
	if (!sent)
		return;

	cp = (struct hci_cp_set_event_filter *)sent;

	if (cp->flt_type == HCI_FLT_CLEAR_ALL)
		hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
	else
		hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
}

424 425 426
static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
L
Linus Torvalds 已提交
427

428
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
L
Linus Torvalds 已提交
429

430 431
	if (rp->status)
		return;
L
Linus Torvalds 已提交
432

433
	memcpy(hdev->dev_class, rp->dev_class, 3);
L
Linus Torvalds 已提交
434

435
	BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
436
	       hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
437
}
L
Linus Torvalds 已提交
438

439 440 441 442
static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	void *sent;
L
Linus Torvalds 已提交
443

444
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
445

446 447 448
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
	if (!sent)
		return;
L
Linus Torvalds 已提交
449

450 451 452 453 454
	hci_dev_lock(hdev);

	if (status == 0)
		memcpy(hdev->dev_class, sent, 3);

455
	if (hci_dev_test_flag(hdev, HCI_MGMT))
456 457 458
		mgmt_set_class_of_dev_complete(hdev, sent, status);

	hci_dev_unlock(hdev);
459
}
L
Linus Torvalds 已提交
460

461 462 463 464 465
static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_voice_setting *rp = (void *) skb->data;
	__u16 setting;

466
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
467 468 469 470 471 472

	if (rp->status)
		return;

	setting = __le16_to_cpu(rp->voice_setting);

473
	if (hdev->voice_setting == setting)
474 475 476 477
		return;

	hdev->voice_setting = setting;

478
	BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
479

480
	if (hdev->notify)
481 482 483
		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
}

484 485
static void hci_cc_write_voice_setting(struct hci_dev *hdev,
				       struct sk_buff *skb)
486 487
{
	__u8 status = *((__u8 *) skb->data);
488
	__u16 setting;
489 490
	void *sent;

491
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
492

493 494 495
	if (status)
		return;

496 497 498
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
	if (!sent)
		return;
L
Linus Torvalds 已提交
499

500
	setting = get_unaligned_le16(sent);
L
Linus Torvalds 已提交
501

502 503 504 505
	if (hdev->voice_setting == setting)
		return;

	hdev->voice_setting = setting;
L
Linus Torvalds 已提交
506

507
	BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
L
Linus Torvalds 已提交
508

509
	if (hdev->notify)
510
		hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
L
Linus Torvalds 已提交
511 512
}

513 514 515 516 517 518 519 520 521 522 523 524 525 526 527
static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
					  struct sk_buff *skb)
{
	struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hdev->num_iac = rp->num_iac;

	BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
}

528 529 530
static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
531
	struct hci_cp_write_ssp_mode *sent;
532

533
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
534 535 536 537 538

	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
	if (!sent)
		return;

539 540
	hci_dev_lock(hdev);

541 542
	if (!status) {
		if (sent->mode)
543
			hdev->features[1][0] |= LMP_HOST_SSP;
544
		else
545
			hdev->features[1][0] &= ~LMP_HOST_SSP;
546 547
	}

548
	if (!status) {
549
		if (sent->mode)
550
			hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
551
		else
552
			hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
553
	}
554 555

	hci_dev_unlock(hdev);
556 557
}

558 559 560 561 562 563 564 565 566 567 568
static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
{
	u8 status = *((u8 *) skb->data);
	struct hci_cp_write_sc_support *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
	if (!sent)
		return;

569 570
	hci_dev_lock(hdev);

571 572 573 574 575 576 577
	if (!status) {
		if (sent->support)
			hdev->features[1][0] |= LMP_HOST_SC;
		else
			hdev->features[1][0] &= ~LMP_HOST_SC;
	}

578
	if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
579
		if (sent->support)
580
			hci_dev_set_flag(hdev, HCI_SC_ENABLED);
581
		else
582
			hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
583
	}
584 585

	hci_dev_unlock(hdev);
586 587
}

588 589 590
static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_local_version *rp = (void *) skb->data;
591

592
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
593

594
	if (rp->status)
595
		return;
596

597 598
	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
599 600 601 602 603 604
		hdev->hci_ver = rp->hci_ver;
		hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
		hdev->lmp_ver = rp->lmp_ver;
		hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
		hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
	}
605 606
}

607 608
static void hci_cc_read_local_commands(struct hci_dev *hdev,
				       struct sk_buff *skb)
609 610
{
	struct hci_rp_read_local_commands *rp = (void *) skb->data;
L
Linus Torvalds 已提交
611

612
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
L
Linus Torvalds 已提交
613

614 615 616
	if (rp->status)
		return;

617 618
	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
	    hci_dev_test_flag(hdev, HCI_CONFIG))
619
		memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
620
}
L
Linus Torvalds 已提交
621

622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666
static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
					     struct sk_buff *skb)
{
	struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
	if (conn)
		conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);

	hci_dev_unlock(hdev);
}

static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
					      struct sk_buff *skb)
{
	struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
	struct hci_conn *conn;
	void *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
	if (!sent)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
	if (conn)
		conn->auth_payload_timeout = get_unaligned_le16(sent + 2);

	hci_dev_unlock(hdev);
}

667 668
static void hci_cc_read_local_features(struct hci_dev *hdev,
				       struct sk_buff *skb)
669 670
{
	struct hci_rp_read_local_features *rp = (void *) skb->data;
671

672
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
L
Linus Torvalds 已提交
673

674 675
	if (rp->status)
		return;
676

677
	memcpy(hdev->features, rp->features, 8);
678

679 680
	/* Adjust default settings according to features
	 * supported by device. */
L
Linus Torvalds 已提交
681

682
	if (hdev->features[0][0] & LMP_3SLOT)
683
		hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
L
Linus Torvalds 已提交
684

685
	if (hdev->features[0][0] & LMP_5SLOT)
686
		hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
L
Linus Torvalds 已提交
687

688
	if (hdev->features[0][1] & LMP_HV2) {
689 690 691
		hdev->pkt_type  |= (HCI_HV2);
		hdev->esco_type |= (ESCO_HV2);
	}
L
Linus Torvalds 已提交
692

693
	if (hdev->features[0][1] & LMP_HV3) {
694 695 696
		hdev->pkt_type  |= (HCI_HV3);
		hdev->esco_type |= (ESCO_HV3);
	}
L
Linus Torvalds 已提交
697

698
	if (lmp_esco_capable(hdev))
699
		hdev->esco_type |= (ESCO_EV3);
700

701
	if (hdev->features[0][4] & LMP_EV4)
702
		hdev->esco_type |= (ESCO_EV4);
703

704
	if (hdev->features[0][4] & LMP_EV5)
705
		hdev->esco_type |= (ESCO_EV5);
L
Linus Torvalds 已提交
706

707
	if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
708 709
		hdev->esco_type |= (ESCO_2EV3);

710
	if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
711 712
		hdev->esco_type |= (ESCO_3EV3);

713
	if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
714
		hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
715
}
L
Linus Torvalds 已提交
716

717
static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
718
					   struct sk_buff *skb)
719 720 721
{
	struct hci_rp_read_local_ext_features *rp = (void *) skb->data;

722
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
723 724

	if (rp->status)
725
		return;
726

727 728
	if (hdev->max_page < rp->max_page)
		hdev->max_page = rp->max_page;
729

730 731
	if (rp->page < HCI_MAX_PAGES)
		memcpy(hdev->features[rp->page], rp->features, 8);
732 733
}

734
static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
735
					  struct sk_buff *skb)
736 737 738
{
	struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;

739
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
740

741 742 743 744
	if (rp->status)
		return;

	hdev->flow_ctl_mode = rp->mode;
745 746
}

747 748 749
static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_buffer_size *rp = (void *) skb->data;
L
Linus Torvalds 已提交
750

751
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
L
Linus Torvalds 已提交
752

753 754
	if (rp->status)
		return;
L
Linus Torvalds 已提交
755

756 757 758 759 760 761 762 763
	hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
	hdev->sco_mtu  = rp->sco_mtu;
	hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
	hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);

	if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
		hdev->sco_mtu  = 64;
		hdev->sco_pkts = 8;
L
Linus Torvalds 已提交
764
	}
765 766 767 768

	hdev->acl_cnt = hdev->acl_pkts;
	hdev->sco_cnt = hdev->sco_pkts;

769 770
	BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
	       hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
771 772 773 774 775 776
}

static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_bd_addr *rp = (void *) skb->data;

777
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
778

779 780 781 782
	if (rp->status)
		return;

	if (test_bit(HCI_INIT, &hdev->flags))
783
		bacpy(&hdev->bdaddr, &rp->bdaddr);
784

785
	if (hci_dev_test_flag(hdev, HCI_SETUP))
786
		bacpy(&hdev->setup_addr, &rp->bdaddr);
787 788
}

789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805
static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
					   struct sk_buff *skb)
{
	struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	if (hci_dev_test_flag(hdev, HCI_SETUP) ||
	    hci_dev_test_flag(hdev, HCI_CONFIG)) {
		hdev->pairing_opts = rp->pairing_opts;
		hdev->max_enc_key_size = rp->max_key_size;
	}
}

806 807 808 809 810 811 812
static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
					   struct sk_buff *skb)
{
	struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

813 814 815 816
	if (rp->status)
		return;

	if (test_bit(HCI_INIT, &hdev->flags)) {
817 818 819 820 821
		hdev->page_scan_interval = __le16_to_cpu(rp->interval);
		hdev->page_scan_window = __le16_to_cpu(rp->window);
	}
}

822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840
static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
					    struct sk_buff *skb)
{
	u8 status = *((u8 *) skb->data);
	struct hci_cp_write_page_scan_activity *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
	if (!sent)
		return;

	hdev->page_scan_interval = __le16_to_cpu(sent->interval);
	hdev->page_scan_window = __le16_to_cpu(sent->window);
}

841 842 843 844 845 846 847
static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
					   struct sk_buff *skb)
{
	struct hci_rp_read_page_scan_type *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

848 849 850 851
	if (rp->status)
		return;

	if (test_bit(HCI_INIT, &hdev->flags))
852 853 854
		hdev->page_scan_type = rp->type;
}

855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870
static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	u8 status = *((u8 *) skb->data);
	u8 *type;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
	if (type)
		hdev->page_scan_type = *type;
}

871
static void hci_cc_read_data_block_size(struct hci_dev *hdev,
872
					struct sk_buff *skb)
873 874 875
{
	struct hci_rp_read_data_block_size *rp = (void *) skb->data;

876
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
877 878 879 880 881 882 883 884 885 886 887

	if (rp->status)
		return;

	hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
	hdev->block_len = __le16_to_cpu(rp->block_len);
	hdev->num_blocks = __le16_to_cpu(rp->num_blocks);

	hdev->block_cnt = hdev->num_blocks;

	BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
888
	       hdev->block_cnt, hdev->block_len);
889 890
}

891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925
static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_clock *rp = (void *) skb->data;
	struct hci_cp_read_clock *cp;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	if (skb->len < sizeof(*rp))
		return;

	if (rp->status)
		return;

	hci_dev_lock(hdev);

	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
	if (!cp)
		goto unlock;

	if (cp->which == 0x00) {
		hdev->clock = le32_to_cpu(rp->clock);
		goto unlock;
	}

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
	if (conn) {
		conn->clock = le32_to_cpu(rp->clock);
		conn->clock_accuracy = le16_to_cpu(rp->accuracy);
	}

unlock:
	hci_dev_unlock(hdev);
}

926
static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
927
				       struct sk_buff *skb)
928 929 930
{
	struct hci_rp_read_local_amp_info *rp = (void *) skb->data;

931
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
932 933

	if (rp->status)
934
		return;
935 936 937 938 939 940 941 942 943 944 945 946 947

	hdev->amp_status = rp->amp_status;
	hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
	hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
	hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
	hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
	hdev->amp_type = rp->amp_type;
	hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
	hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
	hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
	hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
}

948
static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
949
					 struct sk_buff *skb)
950
{
951
	struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
952

953
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
954

955 956 957 958
	if (rp->status)
		return;

	hdev->inq_tx_power = rp->tx_power;
959 960
}

961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991
static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
					       struct sk_buff *skb)
{
	struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hdev->err_data_reporting = rp->err_data_reporting;
}

static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
						struct sk_buff *skb)
{
	__u8 status = *((__u8 *)skb->data);
	struct hci_cp_write_def_err_data_reporting *cp;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
	if (!cp)
		return;

	hdev->err_data_reporting = cp->err_data_reporting;
}

992 993 994 995 996 997
static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_pin_code_reply *rp = (void *) skb->data;
	struct hci_cp_pin_code_reply *cp;
	struct hci_conn *conn;

998
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
999

1000 1001
	hci_dev_lock(hdev);

1002
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1003
		mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1004

1005
	if (rp->status)
1006
		goto unlock;
1007 1008 1009

	cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
	if (!cp)
1010
		goto unlock;
1011 1012 1013 1014

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
	if (conn)
		conn->pin_length = cp->pin_len;
1015 1016 1017

unlock:
	hci_dev_unlock(hdev);
1018 1019 1020 1021 1022 1023
}

static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;

1024
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1025

1026 1027
	hci_dev_lock(hdev);

1028
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1029
		mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1030
						 rp->status);
1031 1032

	hci_dev_unlock(hdev);
1033
}
1034

1035 1036 1037 1038 1039
static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
				       struct sk_buff *skb)
{
	struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;

1040
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051

	if (rp->status)
		return;

	hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
	hdev->le_pkts = rp->le_max_pkt;

	hdev->le_cnt = hdev->le_pkts;

	BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
}
1052

1053 1054 1055 1056 1057 1058 1059
static void hci_cc_le_read_local_features(struct hci_dev *hdev,
					  struct sk_buff *skb)
{
	struct hci_rp_le_read_local_features *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

1060 1061 1062 1063
	if (rp->status)
		return;

	memcpy(hdev->le_features, rp->features, 8);
1064 1065
}

1066 1067 1068 1069 1070 1071 1072
static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

1073 1074 1075 1076
	if (rp->status)
		return;

	hdev->adv_tx_power = rp->tx_power;
1077 1078
}

1079 1080 1081 1082
static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

1083
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1084

1085 1086
	hci_dev_lock(hdev);

1087
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1088 1089
		mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
						 rp->status);
1090 1091

	hci_dev_unlock(hdev);
1092 1093 1094
}

static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1095
					  struct sk_buff *skb)
1096 1097 1098
{
	struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

1099
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1100

1101 1102
	hci_dev_lock(hdev);

1103
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1104
		mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1105
						     ACL_LINK, 0, rp->status);
1106 1107

	hci_dev_unlock(hdev);
1108 1109
}

1110 1111 1112 1113
static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

1114
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1115 1116 1117

	hci_dev_lock(hdev);

1118
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1119
		mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1120
						 0, rp->status);
1121 1122 1123 1124 1125

	hci_dev_unlock(hdev);
}

static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1126
					  struct sk_buff *skb)
1127 1128 1129
{
	struct hci_rp_user_confirm_reply *rp = (void *) skb->data;

1130
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1131 1132 1133

	hci_dev_lock(hdev);

1134
	if (hci_dev_test_flag(hdev, HCI_MGMT))
1135
		mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1136
						     ACL_LINK, 0, rp->status);
1137 1138 1139 1140

	hci_dev_unlock(hdev);
}

1141 1142
static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
				       struct sk_buff *skb)
1143 1144 1145
{
	struct hci_rp_read_local_oob_data *rp = (void *) skb->data;

1146
	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1147 1148 1149 1150 1151 1152 1153 1154
}

static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
					   struct sk_buff *skb)
{
	struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1155 1156
}

1157 1158 1159 1160 1161 1162 1163
static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	bdaddr_t *sent;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1164 1165 1166
	if (status)
		return;

1167 1168 1169 1170 1171 1172
	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
	if (!sent)
		return;

	hci_dev_lock(hdev);

1173
	bacpy(&hdev->random_addr, sent);
1174

1175 1176 1177 1178 1179 1180
	if (!bacmp(&hdev->rpa, sent)) {
		hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
				   secs_to_jiffies(hdev->rpa_timeout));
	}

1181 1182 1183
	hci_dev_unlock(hdev);
}

1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205
static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	struct hci_cp_le_set_default_phy *cp;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	hdev->le_tx_def_phys = cp->tx_phys;
	hdev->le_rx_def_phys = cp->rx_phys;

	hci_dev_unlock(hdev);
}

1206 1207 1208 1209 1210
static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
                                              struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);
	struct hci_cp_le_set_adv_set_rand_addr *cp;
1211
	struct adv_info *adv;
1212 1213 1214 1215 1216

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1217 1218 1219 1220 1221
	/* Update only in case the adv instance since handle 0x00 shall be using
	 * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
	 * non-extended adverting.
	 */
	if (!cp || !cp->handle)
1222 1223 1224 1225
		return;

	hci_dev_lock(hdev);

1226 1227 1228 1229 1230 1231 1232 1233 1234
	adv = hci_find_adv_instance(hdev, cp->handle);
	if (adv) {
		bacpy(&adv->random_addr, &cp->bdaddr);
		if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
			adv->rpa_expired = false;
			queue_delayed_work(hdev->workqueue,
					   &adv->rpa_expired_cb,
					   secs_to_jiffies(hdev->rpa_timeout));
		}
1235 1236 1237 1238 1239
	}

	hci_dev_unlock(hdev);
}

1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288
static void hci_cc_le_remove_adv_set(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *)skb->data);
	u8 *instance;
	int err;

	if (status)
		return;

	instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
	if (!instance)
		return;

	hci_dev_lock(hdev);

	err = hci_remove_adv_instance(hdev, *instance);
	if (!err)
		mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
					 *instance);

	hci_dev_unlock(hdev);
}

static void hci_cc_le_clear_adv_sets(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 status = *((__u8 *)skb->data);
	struct adv_info *adv, *n;
	int err;

	if (status)
		return;

	if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
		return;

	hci_dev_lock(hdev);

	list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
		u8 instance = adv->instance;

		err = hci_remove_adv_instance(hdev, instance);
		if (!err)
			mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
						 hdev, instance);
	}

	hci_dev_unlock(hdev);
}

1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302
static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
					  struct sk_buff *skb)
{
	struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hdev->min_le_tx_power = rp->min_le_tx_power;
	hdev->max_le_tx_power = rp->max_le_tx_power;
}

1303 1304 1305 1306 1307 1308
static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
{
	__u8 *sent, status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1309
	if (status)
1310 1311
		return;

1312 1313
	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
	if (!sent)
1314 1315
		return;

1316 1317
	hci_dev_lock(hdev);

S
Stephen Hemminger 已提交
1318
	/* If we're doing connection initiation as peripheral. Set a
1319 1320 1321 1322 1323
	 * timeout in case something goes wrong.
	 */
	if (*sent) {
		struct hci_conn *conn;

1324
		hci_dev_set_flag(hdev, HCI_LE_ADV);
1325

1326
		conn = hci_lookup_le_connect(hdev);
1327 1328 1329
		if (conn)
			queue_delayed_work(hdev->workqueue,
					   &conn->le_conn_timeout,
1330
					   conn->conn_timeout);
1331
	} else {
1332
		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1333 1334
	}

1335
	hci_dev_unlock(hdev);
1336 1337
}

1338 1339 1340 1341
static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_cp_le_set_ext_adv_enable *cp;
1342
	struct hci_cp_ext_adv_set *set;
1343
	__u8 status = *((__u8 *) skb->data);
1344
	struct adv_info *adv = NULL, *n;
1345 1346 1347 1348 1349 1350 1351 1352 1353 1354

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
	if (!cp)
		return;

1355 1356
	set = (void *)cp->data;

1357 1358
	hci_dev_lock(hdev);

1359 1360 1361
	if (cp->num_of_sets)
		adv = hci_find_adv_instance(hdev, set->handle);

1362 1363 1364 1365 1366
	if (cp->enable) {
		struct hci_conn *conn;

		hci_dev_set_flag(hdev, HCI_LE_ADV);

1367 1368 1369
		if (adv)
			adv->enabled = true;

1370 1371 1372 1373 1374
		conn = hci_lookup_le_connect(hdev);
		if (conn)
			queue_delayed_work(hdev->workqueue,
					   &conn->le_conn_timeout,
					   conn->conn_timeout);
1375
	} else {
1376 1377 1378 1379
		if (cp->num_of_sets) {
			if (adv)
				adv->enabled = false;

1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394
			/* If just one instance was disabled check if there are
			 * any other instance enabled before clearing HCI_LE_ADV
			 */
			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
						 list) {
				if (adv->enabled)
					goto unlock;
			}
		} else {
			/* All instances shall be considered disabled */
			list_for_each_entry_safe(adv, n, &hdev->adv_instances,
						 list)
				adv->enabled = false;
		}

1395
		hci_dev_clear_flag(hdev, HCI_LE_ADV);
1396 1397
	}

1398
unlock:
1399 1400 1401
	hci_dev_unlock(hdev);
}

1402 1403 1404 1405 1406 1407 1408
static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_cp_le_set_scan_param *cp;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1409 1410 1411
	if (status)
		return;

1412 1413 1414 1415 1416 1417
	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
	if (!cp)
		return;

	hci_dev_lock(hdev);

1418
	hdev->le_scan_type = cp->type;
1419 1420 1421 1422

	hci_dev_unlock(hdev);
}

1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447
static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_cp_le_set_ext_scan_params *cp;
	__u8 status = *((__u8 *) skb->data);
	struct hci_cp_le_scan_phy_params *phy_param;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
	if (!cp)
		return;

	phy_param = (void *)cp->data;

	hci_dev_lock(hdev);

	hdev->le_scan_type = phy_param->type;

	hci_dev_unlock(hdev);
}

1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463
static bool has_pending_adv_report(struct hci_dev *hdev)
{
	struct discovery_state *d = &hdev->discovery;

	return bacmp(&d->last_adv_addr, BDADDR_ANY);
}

static void clear_pending_adv_report(struct hci_dev *hdev)
{
	struct discovery_state *d = &hdev->discovery;

	bacpy(&d->last_adv_addr, BDADDR_ANY);
	d->last_adv_data_len = 0;
}

static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1464 1465
				     u8 bdaddr_type, s8 rssi, u32 flags,
				     u8 *data, u8 len)
1466 1467 1468
{
	struct discovery_state *d = &hdev->discovery;

1469 1470 1471
	if (len > HCI_MAX_AD_LENGTH)
		return;

1472 1473
	bacpy(&d->last_adv_addr, bdaddr);
	d->last_adv_addr_type = bdaddr_type;
1474
	d->last_adv_rssi = rssi;
1475
	d->last_adv_flags = flags;
1476 1477 1478 1479
	memcpy(d->last_adv_data, data, len);
	d->last_adv_data_len = len;
}

1480
static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1481
{
1482 1483
	hci_dev_lock(hdev);

1484
	switch (enable) {
1485
	case LE_SCAN_ENABLE:
1486
		hci_dev_set_flag(hdev, HCI_LE_SCAN);
1487 1488
		if (hdev->le_scan_type == LE_SCAN_ACTIVE)
			clear_pending_adv_report(hdev);
1489 1490
		break;

1491
	case LE_SCAN_DISABLE:
1492 1493 1494 1495 1496 1497 1498 1499
		/* We do this here instead of when setting DISCOVERY_STOPPED
		 * since the latter would potentially require waiting for
		 * inquiry to stop too.
		 */
		if (has_pending_adv_report(hdev)) {
			struct discovery_state *d = &hdev->discovery;

			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1500
					  d->last_adv_addr_type, NULL,
1501
					  d->last_adv_rssi, d->last_adv_flags,
1502
					  d->last_adv_data,
1503 1504 1505
					  d->last_adv_data_len, NULL, 0);
		}

1506 1507 1508 1509 1510
		/* Cancel this timer so that we don't try to disable scanning
		 * when it's already disabled.
		 */
		cancel_delayed_work(&hdev->le_scan_disable);

1511
		hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1512

1513 1514
		/* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
		 * interrupted scanning due to a connect request. Mark
1515
		 * therefore discovery as stopped.
1516
		 */
1517
		if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1518
			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1519

1520 1521 1522
		break;

	default:
1523
		bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1524
			   enable);
1525
		break;
1526
	}
1527 1528

	hci_dev_unlock(hdev);
1529 1530
}

1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548
static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
				      struct sk_buff *skb)
{
	struct hci_cp_le_set_scan_enable *cp;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
	if (!cp)
		return;

	le_set_scan_enable_complete(hdev, cp->enable);
}

1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566
static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
				      struct sk_buff *skb)
{
	struct hci_cp_le_set_ext_scan_enable *cp;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
	if (!cp)
		return;

	le_set_scan_enable_complete(hdev, cp->enable);
}

1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580
static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
				      struct sk_buff *skb)
{
	struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
	       rp->num_of_sets);

	if (rp->status)
		return;

	hdev->le_num_of_adv_sets = rp->num_of_sets;
}

1581 1582
static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
					    struct sk_buff *skb)
1583
{
1584
	struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1585 1586 1587

	BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);

1588 1589 1590
	if (rp->status)
		return;

1591
	hdev->le_accept_list_size = rp->size;
1592 1593
}

1594 1595
static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
					struct sk_buff *skb)
1596 1597 1598 1599 1600
{
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1601 1602 1603
	if (status)
		return;

1604
	hci_bdaddr_list_clear(&hdev->le_accept_list);
1605 1606
}

1607 1608
static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
					 struct sk_buff *skb)
1609
{
1610
	struct hci_cp_le_add_to_accept_list *sent;
1611 1612 1613 1614
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1615 1616 1617
	if (status)
		return;

1618
	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1619 1620 1621
	if (!sent)
		return;

1622 1623
	hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
			    sent->bdaddr_type);
1624 1625
}

1626 1627
static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
					   struct sk_buff *skb)
1628
{
1629
	struct hci_cp_le_del_from_accept_list *sent;
1630 1631 1632 1633
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

1634 1635 1636
	if (status)
		return;

1637
	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1638 1639 1640
	if (!sent)
		return;

1641
	hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1642
			    sent->bdaddr_type);
1643 1644
}

1645 1646 1647 1648 1649 1650 1651
static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
					    struct sk_buff *skb)
{
	struct hci_rp_le_read_supported_states *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

1652 1653 1654 1655
	if (rp->status)
		return;

	memcpy(hdev->le_states, rp->le_states, 8);
1656 1657
}

1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690
static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
	hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
}

static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_cp_le_write_def_data_len *sent;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
	if (!sent)
		return;

	hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
	hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
}

1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729
static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_cp_le_add_to_resolv_list *sent;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
	if (!sent)
		return;

	hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
				sent->bdaddr_type, sent->peer_irk,
				sent->local_irk);
}

static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
					  struct sk_buff *skb)
{
	struct hci_cp_le_del_from_resolv_list *sent;
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
	if (!sent)
		return;

	hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
			    sent->bdaddr_type);
}

1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742
static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
				       struct sk_buff *skb)
{
	__u8 status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	hci_bdaddr_list_clear(&hdev->le_resolv_list);
}

A
Ankit Navik 已提交
1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755
static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
					   struct sk_buff *skb)
{
	struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);

	if (rp->status)
		return;

	hdev->le_resolv_list_size = rp->size;
}

1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779
static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
						struct sk_buff *skb)
{
	__u8 *sent, status = *((__u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
	if (!sent)
		return;

	hci_dev_lock(hdev);

	if (*sent)
		hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
	else
		hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);

	hci_dev_unlock(hdev);
}

1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795
static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
	hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
	hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
	hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
}

1796 1797
static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
					   struct sk_buff *skb)
1798
{
1799
	struct hci_cp_write_le_host_supported *sent;
1800 1801
	__u8 status = *((__u8 *) skb->data);

1802
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
1803

1804 1805 1806
	if (status)
		return;

1807
	sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1808
	if (!sent)
1809 1810
		return;

1811 1812
	hci_dev_lock(hdev);

1813 1814
	if (sent->le) {
		hdev->features[1][0] |= LMP_HOST_LE;
1815
		hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1816 1817
	} else {
		hdev->features[1][0] &= ~LMP_HOST_LE;
1818 1819
		hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
		hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1820
	}
1821 1822 1823 1824 1825

	if (sent->simul)
		hdev->features[1][0] |= LMP_HOST_LE_BREDR;
	else
		hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1826 1827

	hci_dev_unlock(hdev);
1828 1829
}

1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848
static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_cp_le_set_adv_param *cp;
	u8 status = *((u8 *) skb->data);

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
	if (!cp)
		return;

	hci_dev_lock(hdev);
	hdev->adv_addr_type = cp->own_address_type;
	hci_dev_unlock(hdev);
}

1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865
static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
	struct hci_cp_le_set_ext_adv_params *cp;
	struct adv_info *adv_instance;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
	if (!cp)
		return;

	hci_dev_lock(hdev);
	hdev->adv_addr_type = cp->own_addr_type;
1866
	if (!cp->handle) {
1867 1868 1869
		/* Store in hdev for instance 0 */
		hdev->adv_tx_power = rp->tx_power;
	} else {
1870
		adv_instance = hci_find_adv_instance(hdev, cp->handle);
1871 1872 1873
		if (adv_instance)
			adv_instance->tx_power = rp->tx_power;
	}
1874
	/* Update adv data as tx power is known now */
1875
	hci_req_update_adv_data(hdev, cp->handle);
1876

1877 1878 1879
	hci_dev_unlock(hdev);
}

1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898
static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_rp_read_rssi *rp = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
	if (conn)
		conn->rssi = rp->rssi;

	hci_dev_unlock(hdev);
}

1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916
static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_cp_read_tx_power *sent;
	struct hci_rp_read_tx_power *rp = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);

	if (rp->status)
		return;

	sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
	if (!sent)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1917 1918 1919 1920 1921
	if (!conn)
		goto unlock;

	switch (sent->type) {
	case 0x00:
1922
		conn->tx_power = rp->tx_power;
1923 1924 1925 1926 1927
		break;
	case 0x01:
		conn->max_tx_power = rp->tx_power;
		break;
	}
1928

1929
unlock:
1930 1931 1932
	hci_dev_unlock(hdev);
}

1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947
static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
{
	u8 status = *((u8 *) skb->data);
	u8 *mode;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (status)
		return;

	mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
	if (mode)
		hdev->ssp_debug_mode = *mode;
}

1948
static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1949
{
1950
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
1951 1952 1953

	if (status) {
		hci_conn_check_pending(hdev);
1954 1955 1956
		return;
	}

1957
	set_bit(HCI_INQUIRY, &hdev->flags);
L
Linus Torvalds 已提交
1958 1959
}

1960
static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
L
Linus Torvalds 已提交
1961
{
1962
	struct hci_cp_create_conn *cp;
L
Linus Torvalds 已提交
1963 1964
	struct hci_conn *conn;

1965
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
1966 1967

	cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
L
Linus Torvalds 已提交
1968 1969 1970 1971 1972 1973 1974
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);

1975
	BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
L
Linus Torvalds 已提交
1976 1977 1978

	if (status) {
		if (conn && conn->state == BT_CONNECT) {
1979 1980
			if (status != 0x0c || conn->attempt > 2) {
				conn->state = BT_CLOSED;
1981
				hci_connect_cfm(conn, status);
1982 1983 1984
				hci_conn_del(conn);
			} else
				conn->state = BT_CONNECT2;
L
Linus Torvalds 已提交
1985 1986 1987
		}
	} else {
		if (!conn) {
1988 1989 1990
			conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
					    HCI_ROLE_MASTER);
			if (!conn)
1991
				bt_dev_err(hdev, "no memory for new connection");
L
Linus Torvalds 已提交
1992 1993 1994 1995 1996 1997
		}
	}

	hci_dev_unlock(hdev);
}

1998
static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
L
Linus Torvalds 已提交
1999
{
2000 2001 2002
	struct hci_cp_add_sco *cp;
	struct hci_conn *acl, *sco;
	__u16 handle;
L
Linus Torvalds 已提交
2003

2004
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2005

2006 2007
	if (!status)
		return;
L
Linus Torvalds 已提交
2008

2009 2010 2011
	cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
	if (!cp)
		return;
L
Linus Torvalds 已提交
2012

2013
	handle = __le16_to_cpu(cp->handle);
L
Linus Torvalds 已提交
2014

2015
	BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
L
Linus Torvalds 已提交
2016

2017
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
2018

2019
	acl = hci_conn_hash_lookup_handle(hdev, handle);
2020 2021 2022 2023
	if (acl) {
		sco = acl->link;
		if (sco) {
			sco->state = BT_CLOSED;
L
Linus Torvalds 已提交
2024

2025
			hci_connect_cfm(sco, status);
2026 2027
			hci_conn_del(sco);
		}
2028
	}
L
Linus Torvalds 已提交
2029

2030 2031
	hci_dev_unlock(hdev);
}
L
Linus Torvalds 已提交
2032

2033 2034 2035 2036 2037
static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_auth_requested *cp;
	struct hci_conn *conn;

2038
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (conn) {
		if (conn->state == BT_CONFIG) {
2052
			hci_connect_cfm(conn, status);
2053
			hci_conn_drop(conn);
2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064
		}
	}

	hci_dev_unlock(hdev);
}

static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_set_conn_encrypt *cp;
	struct hci_conn *conn;

2065
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (conn) {
		if (conn->state == BT_CONFIG) {
2079
			hci_connect_cfm(conn, status);
2080
			hci_conn_drop(conn);
2081 2082 2083 2084 2085 2086
		}
	}

	hci_dev_unlock(hdev);
}

2087
static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2088
				    struct hci_conn *conn)
2089 2090 2091 2092
{
	if (conn->state != BT_CONFIG || !conn->out)
		return 0;

2093
	if (conn->pending_sec_level == BT_SECURITY_SDP)
2094 2095 2096
		return 0;

	/* Only request authentication for SSP connections or non-SSP
2097 2098 2099
	 * devices with sec_level MEDIUM or HIGH or if MITM protection
	 * is requested.
	 */
2100
	if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2101
	    conn->pending_sec_level != BT_SECURITY_FIPS &&
2102 2103
	    conn->pending_sec_level != BT_SECURITY_HIGH &&
	    conn->pending_sec_level != BT_SECURITY_MEDIUM)
2104 2105 2106 2107 2108
		return 0;

	return 1;
}

2109
static int hci_resolve_name(struct hci_dev *hdev,
2110
				   struct inquiry_entry *e)
2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123
{
	struct hci_cp_remote_name_req cp;

	memset(&cp, 0, sizeof(cp));

	bacpy(&cp.bdaddr, &e->data.bdaddr);
	cp.pscan_rep_mode = e->data.pscan_rep_mode;
	cp.pscan_mode = e->data.pscan_mode;
	cp.clock_offset = e->data.clock_offset;

	return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
}

2124
static bool hci_resolve_next_name(struct hci_dev *hdev)
2125 2126 2127 2128
{
	struct discovery_state *discov = &hdev->discovery;
	struct inquiry_entry *e;

2129 2130 2131 2132
	if (list_empty(&discov->resolve))
		return false;

	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2133 2134 2135
	if (!e)
		return false;

2136 2137 2138 2139 2140 2141 2142 2143 2144
	if (hci_resolve_name(hdev, e) == 0) {
		e->name_state = NAME_PENDING;
		return true;
	}

	return false;
}

static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2145
				   bdaddr_t *bdaddr, u8 *name, u8 name_len)
2146 2147 2148 2149
{
	struct discovery_state *discov = &hdev->discovery;
	struct inquiry_entry *e;

2150 2151 2152 2153 2154 2155 2156
	/* Update the mgmt connected state if necessary. Be careful with
	 * conn objects that exist but are not (yet) connected however.
	 * Only those in BT_CONFIG or BT_CONNECTED states can be
	 * considered connected.
	 */
	if (conn &&
	    (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2157
	    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2158
		mgmt_device_connected(hdev, conn, name, name_len);
2159 2160 2161 2162

	if (discov->state == DISCOVERY_STOPPED)
		return;

2163 2164 2165 2166 2167 2168 2169
	if (discov->state == DISCOVERY_STOPPING)
		goto discov_complete;

	if (discov->state != DISCOVERY_RESOLVING)
		return;

	e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2170 2171 2172 2173 2174 2175 2176 2177 2178
	/* If the device was not found in a list of found devices names of which
	 * are pending. there is no need to continue resolving a next name as it
	 * will be done upon receiving another Remote Name Request Complete
	 * Event */
	if (!e)
		return;

	list_del(&e->list);
	if (name) {
2179
		e->name_state = NAME_KNOWN;
2180 2181
		mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
				 e->data.rssi, name, name_len);
2182 2183
	} else {
		e->name_state = NAME_NOT_KNOWN;
2184 2185
	}

2186
	if (hci_resolve_next_name(hdev))
2187 2188 2189 2190 2191 2192
		return;

discov_complete:
	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
}

2193 2194
static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
{
2195 2196 2197
	struct hci_cp_remote_name_req *cp;
	struct hci_conn *conn;

2198
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210

	/* If successful wait for the name req complete event before
	 * checking for the need to do authentication */
	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
	if (!cp)
		return;

	hci_dev_lock(hdev);

2211 2212
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);

2213
	if (hci_dev_test_flag(hdev, HCI_MGMT))
2214
		hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2215

2216 2217 2218 2219 2220 2221
	if (!conn)
		goto unlock;

	if (!hci_outgoing_auth_needed(hdev, conn))
		goto unlock;

2222
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2223 2224
		struct hci_cp_auth_requested auth_cp;

2225 2226
		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);

2227 2228 2229
		auth_cp.handle = __cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
			     sizeof(auth_cp), &auth_cp);
2230 2231
	}

2232
unlock:
2233
	hci_dev_unlock(hdev);
2234
}
L
Linus Torvalds 已提交
2235

2236 2237 2238 2239 2240
static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_read_remote_features *cp;
	struct hci_conn *conn;

2241
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (conn) {
		if (conn->state == BT_CONFIG) {
2255
			hci_connect_cfm(conn, status);
2256
			hci_conn_drop(conn);
2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267
		}
	}

	hci_dev_unlock(hdev);
}

static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_read_remote_ext_features *cp;
	struct hci_conn *conn;

2268
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (conn) {
		if (conn->state == BT_CONFIG) {
2282
			hci_connect_cfm(conn, status);
2283
			hci_conn_drop(conn);
2284 2285 2286 2287 2288 2289
		}
	}

	hci_dev_unlock(hdev);
}

2290 2291
static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
{
2292 2293 2294 2295
	struct hci_cp_setup_sync_conn *cp;
	struct hci_conn *acl, *sco;
	__u16 handle;

2296
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2297 2298 2299 2300 2301 2302 2303 2304 2305 2306

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
	if (!cp)
		return;

	handle = __le16_to_cpu(cp->handle);

2307
	BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2308 2309 2310 2311

	hci_dev_lock(hdev);

	acl = hci_conn_hash_lookup_handle(hdev, handle);
2312 2313 2314 2315
	if (acl) {
		sco = acl->link;
		if (sco) {
			sco->state = BT_CLOSED;
2316

2317
			hci_connect_cfm(sco, status);
2318 2319
			hci_conn_del(sco);
		}
2320 2321 2322
	}

	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2323 2324
}

2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359
static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_enhanced_setup_sync_conn *cp;
	struct hci_conn *acl, *sco;
	__u16 handle;

	bt_dev_dbg(hdev, "status 0x%2.2x", status);

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
	if (!cp)
		return;

	handle = __le16_to_cpu(cp->handle);

	bt_dev_dbg(hdev, "handle 0x%4.4x", handle);

	hci_dev_lock(hdev);

	acl = hci_conn_hash_lookup_handle(hdev, handle);
	if (acl) {
		sco = acl->link;
		if (sco) {
			sco->state = BT_CLOSED;

			hci_connect_cfm(sco, status);
			hci_conn_del(sco);
		}
	}

	hci_dev_unlock(hdev);
}

2360
static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
L
Linus Torvalds 已提交
2361
{
2362 2363
	struct hci_cp_sniff_mode *cp;
	struct hci_conn *conn;
L
Linus Torvalds 已提交
2364

2365
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2366

2367 2368
	if (!status)
		return;
2369

2370 2371 2372
	cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
	if (!cp)
		return;
2373

2374
	hci_dev_lock(hdev);
2375

2376
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2377
	if (conn) {
2378
		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2379

2380
		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2381 2382 2383
			hci_sco_setup(conn, status);
	}

2384 2385
	hci_dev_unlock(hdev);
}
2386

2387 2388 2389 2390
static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
{
	struct hci_cp_exit_sniff_mode *cp;
	struct hci_conn *conn;
2391

2392
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
2393

2394 2395
	if (!status)
		return;
2396

2397 2398 2399
	cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
	if (!cp)
		return;
2400

2401
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
2402

2403
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2404
	if (conn) {
2405
		clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
L
Linus Torvalds 已提交
2406

2407
		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2408 2409 2410
			hci_sco_setup(conn, status);
	}

2411
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2412 2413
}

2414 2415 2416
static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_disconnect *cp;
2417
	struct hci_conn_params *params;
2418
	struct hci_conn *conn;
2419
	bool mgmt_conn;
2420

2421 2422 2423 2424
	/* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
	 * otherwise cleanup the connection immediately.
	 */
	if (!status && !hdev->suspended)
2425 2426 2427 2428 2429 2430 2431 2432 2433
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2434 2435 2436 2437
	if (!conn)
		goto unlock;

	if (status) {
2438
		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2439
				       conn->dst_type, status);
2440

2441
		if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2442
			hdev->cur_adv_instance = conn->adv_instance;
2443
			hci_enable_advertising(hdev);
2444 2445
		}

2446
		goto done;
2447 2448
	}

2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487
	mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);

	if (conn->type == ACL_LINK) {
		if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
			hci_remove_link_key(hdev, &conn->dst);
	}

	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
	if (params) {
		switch (params->auto_connect) {
		case HCI_AUTO_CONN_LINK_LOSS:
			if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
				break;
			fallthrough;

		case HCI_AUTO_CONN_DIRECT:
		case HCI_AUTO_CONN_ALWAYS:
			list_del_init(&params->action);
			list_add(&params->action, &hdev->pend_le_conns);
			break;

		default:
			break;
		}
	}

	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
				 cp->reason, mgmt_conn);

	hci_disconn_cfm(conn, cp->reason);

done:
	/* If the disconnection failed for any reason, the upper layer
	 * does not retry to disconnect in current implementation.
	 * Hence, we need to do some basic cleanup here and re-enable
	 * advertising if necessary.
	 */
	hci_conn_del(conn);
unlock:
2488 2489 2490
	hci_dev_unlock(hdev);
}

2491
static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2492 2493 2494 2495 2496 2497 2498
{
	/* When using controller based address resolution, then the new
	 * address types 0x02 and 0x03 are used. These types need to be
	 * converted back into either public address or random address type
	 */
	switch (type) {
	case ADDR_LE_DEV_PUBLIC_RESOLVED:
2499 2500
		if (resolved)
			*resolved = true;
2501 2502
		return ADDR_LE_DEV_PUBLIC;
	case ADDR_LE_DEV_RANDOM_RESOLVED:
2503 2504
		if (resolved)
			*resolved = true;
2505 2506 2507
		return ADDR_LE_DEV_RANDOM;
	}

2508 2509
	if (resolved)
		*resolved = false;
2510 2511 2512
	return type;
}

2513 2514 2515
static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
			      u8 peer_addr_type, u8 own_address_type,
			      u8 filter_policy)
2516 2517 2518
{
	struct hci_conn *conn;

2519 2520
	conn = hci_conn_hash_lookup_le(hdev, peer_addr,
				       peer_addr_type);
2521
	if (!conn)
2522
		return;
2523

2524
	own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
2525

2526 2527 2528 2529
	/* Store the initiator and responder address information which
	 * is needed for SMP. These values will not change during the
	 * lifetime of the connection.
	 */
2530 2531
	conn->init_addr_type = own_address_type;
	if (own_address_type == ADDR_LE_DEV_RANDOM)
2532 2533 2534 2535
		bacpy(&conn->init_addr, &hdev->random_addr);
	else
		bacpy(&conn->init_addr, &hdev->bdaddr);

2536 2537
	conn->resp_addr_type = peer_addr_type;
	bacpy(&conn->resp_addr, peer_addr);
2538

2539 2540 2541
	/* We don't want the connection attempt to stick around
	 * indefinitely since LE doesn't have a page timeout concept
	 * like BR/EDR. Set a timer for any connection that doesn't use
2542
	 * the accept list for connecting.
2543
	 */
2544
	if (filter_policy == HCI_LE_USE_PEER_ADDR)
2545 2546
		queue_delayed_work(conn->hdev->workqueue,
				   &conn->le_conn_timeout,
2547
				   conn->conn_timeout);
2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570
}

static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_le_create_conn *cp;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	/* All connection failure handling is taken care of by the
	 * hci_le_conn_failed function which is triggered by the HCI
	 * request completion callbacks used for connecting.
	 */
	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
			  cp->own_address_type, cp->filter_policy);
2571

2572 2573 2574
	hci_dev_unlock(hdev);
}

2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 2586 2587 2588 2589 2590 2591 2592 2593 2594 2595 2596 2597 2598 2599
static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_le_ext_create_conn *cp;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	/* All connection failure handling is taken care of by the
	 * hci_le_conn_failed function which is triggered by the HCI
	 * request completion callbacks used for connecting.
	 */
	if (status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
			  cp->own_addr_type, cp->filter_policy);

	hci_dev_unlock(hdev);
}

2600 2601 2602 2603 2604 2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616 2617 2618 2619 2620 2621 2622 2623 2624 2625 2626
static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_le_read_remote_features *cp;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (conn) {
		if (conn->state == BT_CONFIG) {
			hci_connect_cfm(conn, status);
			hci_conn_drop(conn);
		}
	}

	hci_dev_unlock(hdev);
}

2627 2628 2629 2630 2631 2632 2633 2634 2635 2636 2637 2638 2639 2640 2641 2642 2643 2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656
static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_le_start_enc *cp;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (!status)
		return;

	hci_dev_lock(hdev);

	cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
	if (!cp)
		goto unlock;

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
	if (!conn)
		goto unlock;

	if (conn->state != BT_CONNECTED)
		goto unlock;

	hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
	hci_conn_drop(conn);

unlock:
	hci_dev_unlock(hdev);
}

2657 2658 2659 2660 2661 2662 2663 2664 2665 2666 2667 2668 2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679
static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
{
	struct hci_cp_switch_role *cp;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, status);

	if (!status)
		return;

	cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
	if (!cp)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
	if (conn)
		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);

	hci_dev_unlock(hdev);
}

2680
static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2681 2682
{
	__u8 status = *((__u8 *) skb->data);
2683 2684
	struct discovery_state *discov = &hdev->discovery;
	struct inquiry_entry *e;
L
Linus Torvalds 已提交
2685

2686
	BT_DBG("%s status 0x%2.2x", hdev->name, status);
L
Linus Torvalds 已提交
2687

2688
	hci_conn_check_pending(hdev);
2689 2690 2691 2692

	if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
		return;

2693
	smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2694 2695
	wake_up_bit(&hdev->flags, HCI_INQUIRY);

2696
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
2697 2698
		return;

2699
	hci_dev_lock(hdev);
2700

2701
	if (discov->state != DISCOVERY_FINDING)
2702 2703 2704
		goto unlock;

	if (list_empty(&discov->resolve)) {
2705 2706 2707 2708 2709 2710 2711 2712 2713 2714
		/* When BR/EDR inquiry is active and no LE scanning is in
		 * progress, then change discovery state to indicate completion.
		 *
		 * When running LE scanning and BR/EDR inquiry simultaneously
		 * and the LE scan already finished, then change the discovery
		 * state to indicate completion.
		 */
		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2715 2716 2717 2718 2719 2720 2721 2722
		goto unlock;
	}

	e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
	if (e && hci_resolve_name(hdev, e) == 0) {
		e->name_state = NAME_PENDING;
		hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
	} else {
2723 2724 2725 2726 2727 2728 2729 2730 2731 2732
		/* When BR/EDR inquiry is active and no LE scanning is in
		 * progress, then change discovery state to indicate completion.
		 *
		 * When running LE scanning and BR/EDR inquiry simultaneously
		 * and the LE scan already finished, then change the discovery
		 * state to indicate completion.
		 */
		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
		    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2733 2734 2735
	}

unlock:
2736
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2737 2738
}

2739
static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2740
{
2741
	struct inquiry_data data;
2742
	struct inquiry_info *info = (void *) (skb->data + 1);
L
Linus Torvalds 已提交
2743 2744 2745 2746
	int num_rsp = *((__u8 *) skb->data);

	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);

2747
	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2748 2749
		return;

2750
	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2751 2752
		return;

L
Linus Torvalds 已提交
2753
	hci_dev_lock(hdev);
2754

2755
	for (; num_rsp; num_rsp--, info++) {
2756
		u32 flags;
2757

L
Linus Torvalds 已提交
2758 2759 2760 2761 2762 2763
		bacpy(&data.bdaddr, &info->bdaddr);
		data.pscan_rep_mode	= info->pscan_rep_mode;
		data.pscan_period_mode	= info->pscan_period_mode;
		data.pscan_mode		= info->pscan_mode;
		memcpy(data.dev_class, info->dev_class, 3);
		data.clock_offset	= info->clock_offset;
2764
		data.rssi		= HCI_RSSI_INVALID;
2765
		data.ssp_mode		= 0x00;
2766

2767 2768
		flags = hci_inquiry_cache_update(hdev, &data, false);

2769
		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2770 2771
				  info->dev_class, HCI_RSSI_INVALID,
				  flags, NULL, 0, NULL, 0);
L
Linus Torvalds 已提交
2772
	}
2773

L
Linus Torvalds 已提交
2774 2775 2776
	hci_dev_unlock(hdev);
}

2777
static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2778
{
2779 2780
	struct hci_ev_conn_complete *ev = (void *) skb->data;
	struct hci_conn *conn;
L
Linus Torvalds 已提交
2781 2782 2783 2784 2785 2786

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2787
	if (!conn) {
2788 2789 2790
		/* Connection may not exist if auto-connected. Check the bredr
		 * allowlist to see if this device is allowed to auto connect.
		 * If link is an ACL type, create a connection class
2791
		 * automatically.
2792 2793 2794 2795
		 *
		 * Auto-connect will only occur if the event filter is
		 * programmed with a given address. Right now, event filter is
		 * only used during suspend.
2796
		 */
2797
		if (ev->link_type == ACL_LINK &&
2798
		    hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2799 2800
						      &ev->bdaddr,
						      BDADDR_BREDR)) {
2801 2802 2803 2804 2805 2806
			conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
					    HCI_ROLE_SLAVE);
			if (!conn) {
				bt_dev_err(hdev, "no memory for new conn");
				goto unlock;
			}
2807 2808 2809
		} else {
			if (ev->link_type != SCO_LINK)
				goto unlock;
2810

2811 2812 2813 2814
			conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
						       &ev->bdaddr);
			if (!conn)
				goto unlock;
2815

2816 2817
			conn->type = SCO_LINK;
		}
2818
	}
L
Linus Torvalds 已提交
2819 2820 2821

	if (!ev->status) {
		conn->handle = __le16_to_cpu(ev->handle);
2822 2823 2824 2825

		if (conn->type == ACL_LINK) {
			conn->state = BT_CONFIG;
			hci_conn_hold(conn);
2826 2827 2828 2829 2830 2831

			if (!conn->out && !hci_conn_ssp_enabled(conn) &&
			    !hci_find_link_key(hdev, &ev->bdaddr))
				conn->disc_timeout = HCI_PAIRING_TIMEOUT;
			else
				conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2832 2833
		} else
			conn->state = BT_CONNECTED;
L
Linus Torvalds 已提交
2834

2835
		hci_debugfs_create_conn(conn);
2836 2837
		hci_conn_add_sysfs(conn);

L
Linus Torvalds 已提交
2838
		if (test_bit(HCI_AUTH, &hdev->flags))
2839
			set_bit(HCI_CONN_AUTH, &conn->flags);
L
Linus Torvalds 已提交
2840 2841

		if (test_bit(HCI_ENCRYPT, &hdev->flags))
2842
			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
L
Linus Torvalds 已提交
2843

2844 2845 2846 2847
		/* Get remote features */
		if (conn->type == ACL_LINK) {
			struct hci_cp_read_remote_features cp;
			cp.handle = ev->handle;
2848
			hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2849
				     sizeof(cp), &cp);
2850

2851
			hci_req_update_scan(hdev);
2852 2853
		}

L
Linus Torvalds 已提交
2854
		/* Set packet type for incoming connection */
2855
		if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
L
Linus Torvalds 已提交
2856 2857
			struct hci_cp_change_conn_ptype cp;
			cp.handle = ev->handle;
2858
			cp.pkt_type = cpu_to_le16(conn->pkt_type);
2859 2860
			hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
				     &cp);
L
Linus Torvalds 已提交
2861
		}
2862
	} else {
L
Linus Torvalds 已提交
2863
		conn->state = BT_CLOSED;
2864
		if (conn->type == ACL_LINK)
2865
			mgmt_connect_failed(hdev, &conn->dst, conn->type,
2866
					    conn->dst_type, ev->status);
2867
	}
L
Linus Torvalds 已提交
2868

2869 2870
	if (conn->type == ACL_LINK)
		hci_sco_setup(conn, ev->status);
L
Linus Torvalds 已提交
2871

2872
	if (ev->status) {
2873
		hci_connect_cfm(conn, ev->status);
L
Linus Torvalds 已提交
2874
		hci_conn_del(conn);
2875 2876 2877 2878 2879 2880 2881 2882
	} else if (ev->link_type == SCO_LINK) {
		switch (conn->setting & SCO_AIRMODE_MASK) {
		case SCO_AIRMODE_CVSD:
			if (hdev->notify)
				hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
			break;
		}

2883
		hci_connect_cfm(conn, ev->status);
2884
	}
L
Linus Torvalds 已提交
2885

2886
unlock:
L
Linus Torvalds 已提交
2887 2888
	hci_dev_unlock(hdev);

2889
	hci_conn_check_pending(hdev);
L
Linus Torvalds 已提交
2890 2891
}

2892 2893 2894 2895 2896 2897 2898 2899 2900
static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct hci_cp_reject_conn_req cp;

	bacpy(&cp.bdaddr, bdaddr);
	cp.reason = HCI_ERROR_REJ_BAD_ADDR;
	hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
}

2901
static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2902
{
2903 2904
	struct hci_ev_conn_request *ev = (void *) skb->data;
	int mask = hdev->link_mode;
2905 2906
	struct inquiry_entry *ie;
	struct hci_conn *conn;
2907
	__u8 flags = 0;
L
Linus Torvalds 已提交
2908

2909
	BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2910
	       ev->link_type);
L
Linus Torvalds 已提交
2911

2912 2913
	mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
				      &flags);
L
Linus Torvalds 已提交
2914

2915 2916 2917 2918 2919
	if (!(mask & HCI_LM_ACCEPT)) {
		hci_reject_conn(hdev, &ev->bdaddr);
		return;
	}

2920
	if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2921 2922 2923 2924 2925
				   BDADDR_BREDR)) {
		hci_reject_conn(hdev, &ev->bdaddr);
		return;
	}

2926
	/* Require HCI_CONNECTABLE or an accept list entry to accept the
2927 2928 2929
	 * connection. These features are only touched through mgmt so
	 * only do the checks if HCI_MGMT is set.
	 */
2930 2931
	if (hci_dev_test_flag(hdev, HCI_MGMT) &&
	    !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2932
	    !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2933 2934 2935
					       BDADDR_BREDR)) {
		hci_reject_conn(hdev, &ev->bdaddr);
		return;
2936
	}
L
Linus Torvalds 已提交
2937

2938
	/* Connection accepted */
2939

2940 2941 2942 2943 2944
	hci_dev_lock(hdev);

	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
	if (ie)
		memcpy(ie->data.dev_class, ev->dev_class, 3);
2945

2946 2947 2948
	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
			&ev->bdaddr);
	if (!conn) {
2949 2950
		conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
				    HCI_ROLE_SLAVE);
2951
		if (!conn) {
2952
			bt_dev_err(hdev, "no memory for new connection");
2953 2954
			hci_dev_unlock(hdev);
			return;
L
Linus Torvalds 已提交
2955
		}
2956
	}
2957

2958
	memcpy(conn->dev_class, ev->dev_class, 3);
2959

2960
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2961

2962 2963 2964 2965
	if (ev->link_type == ACL_LINK ||
	    (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
		struct hci_cp_accept_conn_req cp;
		conn->state = BT_CONNECT;
L
Linus Torvalds 已提交
2966

2967
		bacpy(&cp.bdaddr, &ev->bdaddr);
2968

2969
		if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2970
			cp.role = 0x00; /* Become central */
2971
		else
2972
			cp.role = 0x01; /* Remain peripheral */
2973

2974 2975 2976 2977
		hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
	} else if (!(flags & HCI_PROTO_DEFER)) {
		struct hci_cp_accept_sync_conn_req cp;
		conn->state = BT_CONNECT;
2978

2979 2980
		bacpy(&cp.bdaddr, &ev->bdaddr);
		cp.pkt_type = cpu_to_le16(conn->pkt_type);
2981

2982 2983 2984 2985 2986
		cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
		cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
		cp.max_latency    = cpu_to_le16(0xffff);
		cp.content_format = cpu_to_le16(hdev->voice_setting);
		cp.retrans_effort = 0xff;
L
Linus Torvalds 已提交
2987

2988 2989
		hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
			     &cp);
2990
	} else {
2991
		conn->state = BT_CONNECT2;
2992
		hci_connect_cfm(conn, 0);
L
Linus Torvalds 已提交
2993 2994 2995
	}
}

2996 2997 2998 2999 3000 3001 3002 3003 3004 3005 3006 3007 3008 3009 3010 3011
static u8 hci_to_mgmt_reason(u8 err)
{
	switch (err) {
	case HCI_ERROR_CONNECTION_TIMEOUT:
		return MGMT_DEV_DISCONN_TIMEOUT;
	case HCI_ERROR_REMOTE_USER_TERM:
	case HCI_ERROR_REMOTE_LOW_RESOURCES:
	case HCI_ERROR_REMOTE_POWER_OFF:
		return MGMT_DEV_DISCONN_REMOTE;
	case HCI_ERROR_LOCAL_HOST_TERM:
		return MGMT_DEV_DISCONN_LOCAL_HOST;
	default:
		return MGMT_DEV_DISCONN_UNKNOWN;
	}
}

3012
static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3013
{
3014
	struct hci_ev_disconn_complete *ev = (void *) skb->data;
3015
	u8 reason;
3016
	struct hci_conn_params *params;
3017
	struct hci_conn *conn;
3018
	bool mgmt_connected;
3019

3020
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3021 3022 3023 3024

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3025 3026
	if (!conn)
		goto unlock;
3027

3028 3029 3030 3031
	if (ev->status) {
		mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
				       conn->dst_type, ev->status);
		goto unlock;
3032
	}
3033

3034 3035
	conn->state = BT_CLOSED;

3036
	mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3037 3038 3039 3040 3041 3042

	if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
		reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
	else
		reason = hci_to_mgmt_reason(ev->reason);

3043 3044
	mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
				reason, mgmt_connected);
3045

3046 3047 3048 3049
	if (conn->type == ACL_LINK) {
		if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
			hci_remove_link_key(hdev, &conn->dst);

3050
		hci_req_update_scan(hdev);
3051
	}
3052

3053 3054 3055 3056 3057 3058
	params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
	if (params) {
		switch (params->auto_connect) {
		case HCI_AUTO_CONN_LINK_LOSS:
			if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
				break;
3059
			fallthrough;
3060

3061
		case HCI_AUTO_CONN_DIRECT:
3062
		case HCI_AUTO_CONN_ALWAYS:
3063 3064
			list_del_init(&params->action);
			list_add(&params->action, &hdev->pend_le_conns);
3065
			hci_update_passive_scan(hdev);
3066 3067 3068 3069 3070 3071 3072
			break;

		default:
			break;
		}
	}

3073
	hci_disconn_cfm(conn, ev->reason);
3074 3075 3076 3077 3078 3079 3080 3081 3082 3083 3084

	/* Re-enable advertising if necessary, since it might
	 * have been disabled by the connection. From the
	 * HCI_LE_Set_Advertise_Enable command description in
	 * the core specification (v4.0):
	 * "The Controller shall continue advertising until the Host
	 * issues an LE_Set_Advertise_Enable command with
	 * Advertising_Enable set to 0x00 (Advertising is disabled)
	 * or until a connection is created or until the Advertising
	 * is timed out due to Directed Advertising."
	 */
3085
	if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3086
		hdev->cur_adv_instance = conn->adv_instance;
3087
		hci_enable_advertising(hdev);
3088 3089 3090
	}

	hci_conn_del(conn);
3091 3092

unlock:
3093 3094 3095
	hci_dev_unlock(hdev);
}

3096
static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
3097
{
3098
	struct hci_ev_auth_complete *ev = (void *) skb->data;
3099
	struct hci_conn *conn;
L
Linus Torvalds 已提交
3100

3101
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
L
Linus Torvalds 已提交
3102 3103 3104

	hci_dev_lock(hdev);

3105
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3106 3107 3108 3109
	if (!conn)
		goto unlock;

	if (!ev->status) {
3110 3111
		clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

3112
		if (!hci_conn_ssp_enabled(conn) &&
3113
		    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3114
			bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3115
		} else {
3116
			set_bit(HCI_CONN_AUTH, &conn->flags);
3117
			conn->sec_level = conn->pending_sec_level;
3118
		}
3119
	} else {
3120 3121 3122
		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

3123
		mgmt_auth_failed(conn, ev->status);
3124
	}
L
Linus Torvalds 已提交
3125

3126 3127
	clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
	clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
L
Linus Torvalds 已提交
3128

3129
	if (conn->state == BT_CONFIG) {
3130
		if (!ev->status && hci_conn_ssp_enabled(conn)) {
3131 3132 3133 3134
			struct hci_cp_set_conn_encrypt cp;
			cp.handle  = ev->handle;
			cp.encrypt = 0x01;
			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3135
				     &cp);
3136
		} else {
3137
			conn->state = BT_CONNECTED;
3138
			hci_connect_cfm(conn, ev->status);
3139
			hci_conn_drop(conn);
3140
		}
3141 3142
	} else {
		hci_auth_cfm(conn, ev->status);
3143

3144 3145
		hci_conn_hold(conn);
		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3146
		hci_conn_drop(conn);
3147 3148
	}

3149
	if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3150 3151 3152 3153 3154
		if (!ev->status) {
			struct hci_cp_set_conn_encrypt cp;
			cp.handle  = ev->handle;
			cp.encrypt = 0x01;
			hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3155
				     &cp);
3156
		} else {
3157
			clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3158
			hci_encrypt_cfm(conn, ev->status);
L
Linus Torvalds 已提交
3159 3160 3161
		}
	}

3162
unlock:
L
Linus Torvalds 已提交
3163 3164 3165
	hci_dev_unlock(hdev);
}

3166
static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
3167
{
3168 3169 3170
	struct hci_ev_remote_name *ev = (void *) skb->data;
	struct hci_conn *conn;

3171
	BT_DBG("%s", hdev->name);
L
Linus Torvalds 已提交
3172

3173
	hci_conn_check_pending(hdev);
3174 3175 3176

	hci_dev_lock(hdev);

3177
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3178

3179
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
3180
		goto check_auth;
3181

3182 3183
	if (ev->status == 0)
		hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3184
				       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3185 3186 3187 3188
	else
		hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);

check_auth:
3189 3190 3191 3192 3193 3194
	if (!conn)
		goto unlock;

	if (!hci_outgoing_auth_needed(hdev, conn))
		goto unlock;

3195
	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3196
		struct hci_cp_auth_requested cp;
3197 3198 3199

		set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);

3200 3201 3202 3203
		cp.handle = __cpu_to_le16(conn->handle);
		hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
	}

3204
unlock:
3205
	hci_dev_unlock(hdev);
3206 3207
}

3208 3209 3210 3211 3212 3213 3214 3215 3216 3217
static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
				       u16 opcode, struct sk_buff *skb)
{
	const struct hci_rp_read_enc_key_size *rp;
	struct hci_conn *conn;
	u16 handle;

	BT_DBG("%s status 0x%02x", hdev->name, status);

	if (!skb || skb->len < sizeof(*rp)) {
3218
		bt_dev_err(hdev, "invalid read key size response");
3219 3220 3221 3222 3223 3224 3225 3226 3227 3228 3229 3230
		return;
	}

	rp = (void *)skb->data;
	handle = le16_to_cpu(rp->handle);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, handle);
	if (!conn)
		goto unlock;

3231 3232 3233
	/* While unexpected, the read_enc_key_size command may fail. The most
	 * secure approach is to then assume the key size is 0 to force a
	 * disconnection.
3234 3235
	 */
	if (rp->status) {
3236 3237
		bt_dev_err(hdev, "failed to read key size for handle %u",
			   handle);
3238
		conn->enc_key_size = 0;
3239 3240 3241 3242
	} else {
		conn->enc_key_size = rp->key_size;
	}

3243
	hci_encrypt_cfm(conn, 0);
3244 3245 3246 3247 3248

unlock:
	hci_dev_unlock(hdev);
}

3249
static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3250 3251 3252 3253
{
	struct hci_ev_encrypt_change *ev = (void *) skb->data;
	struct hci_conn *conn;

3254
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
L
Linus Torvalds 已提交
3255 3256 3257

	hci_dev_lock(hdev);

3258
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3259 3260
	if (!conn)
		goto unlock;
L
Linus Torvalds 已提交
3261

3262 3263 3264
	if (!ev->status) {
		if (ev->encrypt) {
			/* Encryption implies authentication */
3265 3266
			set_bit(HCI_CONN_AUTH, &conn->flags);
			set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3267
			conn->sec_level = conn->pending_sec_level;
3268

3269 3270
			/* P-256 authentication key implies FIPS */
			if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3271
				set_bit(HCI_CONN_FIPS, &conn->flags);
3272

3273 3274 3275 3276
			if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
			    conn->type == LE_LINK)
				set_bit(HCI_CONN_AES_CCM, &conn->flags);
		} else {
3277
			clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3278 3279
			clear_bit(HCI_CONN_AES_CCM, &conn->flags);
		}
3280
	}
3281

3282 3283 3284
	/* We should disregard the current RPA and generate a new one
	 * whenever the encryption procedure fails.
	 */
3285
	if (ev->status && conn->type == LE_LINK) {
3286
		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3287 3288
		hci_adv_instances_set_rpa_expired(hdev, true);
	}
3289

3290
	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3291

3292 3293 3294 3295
	/* Check link security requirements are met */
	if (!hci_conn_check_link_mode(conn))
		ev->status = HCI_ERROR_AUTH_FAILURE;

3296
	if (ev->status && conn->state == BT_CONNECTED) {
3297 3298 3299
		if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
			set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);

3300 3301 3302 3303
		/* Notify upper layers so they can cleanup before
		 * disconnecting.
		 */
		hci_encrypt_cfm(conn, ev->status);
3304 3305 3306
		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
		hci_conn_drop(conn);
		goto unlock;
L
Linus Torvalds 已提交
3307 3308
	}

3309 3310 3311 3312 3313 3314 3315 3316 3317 3318 3319 3320 3321 3322 3323 3324 3325 3326 3327 3328
	/* Try reading the encryption key size for encrypted ACL links */
	if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
		struct hci_cp_read_enc_key_size cp;
		struct hci_request req;

		/* Only send HCI_Read_Encryption_Key_Size if the
		 * controller really supports it. If it doesn't, assume
		 * the default size (16).
		 */
		if (!(hdev->commands[20] & 0x10)) {
			conn->enc_key_size = HCI_LINK_KEY_SIZE;
			goto notify;
		}

		hci_req_init(&req, hdev);

		cp.handle = cpu_to_le16(conn->handle);
		hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);

		if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3329
			bt_dev_err(hdev, "sending read key size failed");
3330 3331 3332 3333 3334 3335 3336
			conn->enc_key_size = HCI_LINK_KEY_SIZE;
			goto notify;
		}

		goto unlock;
	}

3337 3338 3339 3340 3341 3342 3343 3344 3345 3346 3347 3348 3349 3350 3351 3352 3353 3354 3355
	/* Set the default Authenticated Payload Timeout after
	 * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
	 * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
	 * sent when the link is active and Encryption is enabled, the conn
	 * type can be either LE or ACL and controller must support LMP Ping.
	 * Ensure for AES-CCM encryption as well.
	 */
	if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
	    test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
	    ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
	     (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
		struct hci_cp_write_auth_payload_to cp;

		cp.handle = cpu_to_le16(conn->handle);
		cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
		hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
			     sizeof(cp), &cp);
	}

3356
notify:
3357
	hci_encrypt_cfm(conn, ev->status);
3358

3359
unlock:
L
Linus Torvalds 已提交
3360 3361 3362
	hci_dev_unlock(hdev);
}

3363 3364
static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
					     struct sk_buff *skb)
L
Linus Torvalds 已提交
3365
{
3366
	struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3367
	struct hci_conn *conn;
L
Linus Torvalds 已提交
3368

3369
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
L
Linus Torvalds 已提交
3370 3371 3372

	hci_dev_lock(hdev);

3373
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
L
Linus Torvalds 已提交
3374 3375
	if (conn) {
		if (!ev->status)
3376
			set_bit(HCI_CONN_SECURE, &conn->flags);
L
Linus Torvalds 已提交
3377

3378
		clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
L
Linus Torvalds 已提交
3379 3380 3381 3382 3383 3384 3385

		hci_key_change_cfm(conn, ev->status);
	}

	hci_dev_unlock(hdev);
}

3386 3387
static void hci_remote_features_evt(struct hci_dev *hdev,
				    struct sk_buff *skb)
L
Linus Torvalds 已提交
3388
{
3389 3390 3391
	struct hci_ev_remote_features *ev = (void *) skb->data;
	struct hci_conn *conn;

3392
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3393 3394 3395 3396

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3397 3398
	if (!conn)
		goto unlock;
3399

3400
	if (!ev->status)
3401
		memcpy(conn->features[0], ev->features, 8);
3402 3403 3404 3405

	if (conn->state != BT_CONFIG)
		goto unlock;

3406 3407
	if (!ev->status && lmp_ext_feat_capable(hdev) &&
	    lmp_ext_feat_capable(conn)) {
3408 3409 3410 3411
		struct hci_cp_read_remote_ext_features cp;
		cp.handle = ev->handle;
		cp.page = 0x01;
		hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3412
			     sizeof(cp), &cp);
3413 3414 3415
		goto unlock;
	}

3416
	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3417 3418 3419 3420 3421
		struct hci_cp_remote_name_req cp;
		memset(&cp, 0, sizeof(cp));
		bacpy(&cp.bdaddr, &conn->dst);
		cp.pscan_rep_mode = 0x02;
		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3422
	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3423
		mgmt_device_connected(hdev, conn, NULL, 0);
3424

3425
	if (!hci_outgoing_auth_needed(hdev, conn)) {
3426
		conn->state = BT_CONNECTED;
3427
		hci_connect_cfm(conn, ev->status);
3428
		hci_conn_drop(conn);
3429
	}
3430

3431
unlock:
3432
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
3433 3434
}

3435
static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3436
{
3437
	cancel_delayed_work(&hdev->cmd_timer);
3438 3439 3440 3441 3442 3443 3444 3445 3446 3447 3448 3449

	if (!test_bit(HCI_RESET, &hdev->flags)) {
		if (ncmd) {
			cancel_delayed_work(&hdev->ncmd_timer);
			atomic_set(&hdev->cmd_cnt, 1);
		} else {
			schedule_delayed_work(&hdev->ncmd_timer,
					      HCI_NCMD_TIMEOUT);
		}
	}
}

3450 3451 3452 3453
static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
				 u16 *opcode, u8 *status,
				 hci_req_complete_t *req_complete,
				 hci_req_complete_skb_t *req_complete_skb)
3454 3455 3456
{
	struct hci_ev_cmd_complete *ev = (void *) skb->data;

3457 3458
	*opcode = __le16_to_cpu(ev->opcode);
	*status = skb->data[sizeof(*ev)];
3459

3460
	skb_pull(skb, sizeof(*ev));
3461

3462
	switch (*opcode) {
3463
	case HCI_OP_INQUIRY_CANCEL:
3464
		hci_cc_inquiry_cancel(hdev, skb, status);
3465 3466
		break;

3467 3468 3469 3470
	case HCI_OP_PERIODIC_INQ:
		hci_cc_periodic_inq(hdev, skb);
		break;

3471 3472 3473 3474 3475 3476 3477 3478 3479 3480 3481 3482
	case HCI_OP_EXIT_PERIODIC_INQ:
		hci_cc_exit_periodic_inq(hdev, skb);
		break;

	case HCI_OP_REMOTE_NAME_REQ_CANCEL:
		hci_cc_remote_name_req_cancel(hdev, skb);
		break;

	case HCI_OP_ROLE_DISCOVERY:
		hci_cc_role_discovery(hdev, skb);
		break;

3483 3484 3485 3486
	case HCI_OP_READ_LINK_POLICY:
		hci_cc_read_link_policy(hdev, skb);
		break;

3487 3488 3489 3490
	case HCI_OP_WRITE_LINK_POLICY:
		hci_cc_write_link_policy(hdev, skb);
		break;

3491 3492 3493 3494 3495 3496 3497 3498
	case HCI_OP_READ_DEF_LINK_POLICY:
		hci_cc_read_def_link_policy(hdev, skb);
		break;

	case HCI_OP_WRITE_DEF_LINK_POLICY:
		hci_cc_write_def_link_policy(hdev, skb);
		break;

3499 3500 3501 3502
	case HCI_OP_RESET:
		hci_cc_reset(hdev, skb);
		break;

3503 3504 3505 3506
	case HCI_OP_READ_STORED_LINK_KEY:
		hci_cc_read_stored_link_key(hdev, skb);
		break;

3507 3508 3509 3510
	case HCI_OP_DELETE_STORED_LINK_KEY:
		hci_cc_delete_stored_link_key(hdev, skb);
		break;

3511 3512 3513 3514 3515 3516 3517 3518 3519 3520 3521 3522 3523 3524 3525 3526 3527 3528 3529 3530
	case HCI_OP_WRITE_LOCAL_NAME:
		hci_cc_write_local_name(hdev, skb);
		break;

	case HCI_OP_READ_LOCAL_NAME:
		hci_cc_read_local_name(hdev, skb);
		break;

	case HCI_OP_WRITE_AUTH_ENABLE:
		hci_cc_write_auth_enable(hdev, skb);
		break;

	case HCI_OP_WRITE_ENCRYPT_MODE:
		hci_cc_write_encrypt_mode(hdev, skb);
		break;

	case HCI_OP_WRITE_SCAN_ENABLE:
		hci_cc_write_scan_enable(hdev, skb);
		break;

3531 3532 3533 3534
	case HCI_OP_SET_EVENT_FLT:
		hci_cc_set_event_filter(hdev, skb);
		break;

3535 3536 3537 3538 3539 3540 3541 3542 3543 3544 3545 3546 3547 3548 3549 3550
	case HCI_OP_READ_CLASS_OF_DEV:
		hci_cc_read_class_of_dev(hdev, skb);
		break;

	case HCI_OP_WRITE_CLASS_OF_DEV:
		hci_cc_write_class_of_dev(hdev, skb);
		break;

	case HCI_OP_READ_VOICE_SETTING:
		hci_cc_read_voice_setting(hdev, skb);
		break;

	case HCI_OP_WRITE_VOICE_SETTING:
		hci_cc_write_voice_setting(hdev, skb);
		break;

3551 3552 3553 3554
	case HCI_OP_READ_NUM_SUPPORTED_IAC:
		hci_cc_read_num_supported_iac(hdev, skb);
		break;

3555 3556 3557 3558
	case HCI_OP_WRITE_SSP_MODE:
		hci_cc_write_ssp_mode(hdev, skb);
		break;

3559 3560 3561 3562
	case HCI_OP_WRITE_SC_SUPPORT:
		hci_cc_write_sc_support(hdev, skb);
		break;

3563 3564 3565 3566 3567 3568 3569 3570
	case HCI_OP_READ_AUTH_PAYLOAD_TO:
		hci_cc_read_auth_payload_timeout(hdev, skb);
		break;

	case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
		hci_cc_write_auth_payload_timeout(hdev, skb);
		break;

3571 3572 3573 3574 3575 3576 3577 3578 3579 3580 3581 3582
	case HCI_OP_READ_LOCAL_VERSION:
		hci_cc_read_local_version(hdev, skb);
		break;

	case HCI_OP_READ_LOCAL_COMMANDS:
		hci_cc_read_local_commands(hdev, skb);
		break;

	case HCI_OP_READ_LOCAL_FEATURES:
		hci_cc_read_local_features(hdev, skb);
		break;

3583 3584 3585 3586
	case HCI_OP_READ_LOCAL_EXT_FEATURES:
		hci_cc_read_local_ext_features(hdev, skb);
		break;

3587 3588 3589 3590 3591 3592 3593 3594
	case HCI_OP_READ_BUFFER_SIZE:
		hci_cc_read_buffer_size(hdev, skb);
		break;

	case HCI_OP_READ_BD_ADDR:
		hci_cc_read_bd_addr(hdev, skb);
		break;

3595 3596 3597 3598
	case HCI_OP_READ_LOCAL_PAIRING_OPTS:
		hci_cc_read_local_pairing_opts(hdev, skb);
		break;

3599 3600 3601 3602
	case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
		hci_cc_read_page_scan_activity(hdev, skb);
		break;

3603 3604 3605 3606
	case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
		hci_cc_write_page_scan_activity(hdev, skb);
		break;

3607 3608 3609 3610
	case HCI_OP_READ_PAGE_SCAN_TYPE:
		hci_cc_read_page_scan_type(hdev, skb);
		break;

3611 3612 3613 3614
	case HCI_OP_WRITE_PAGE_SCAN_TYPE:
		hci_cc_write_page_scan_type(hdev, skb);
		break;

3615 3616 3617 3618
	case HCI_OP_READ_DATA_BLOCK_SIZE:
		hci_cc_read_data_block_size(hdev, skb);
		break;

3619 3620 3621 3622
	case HCI_OP_READ_FLOW_CONTROL_MODE:
		hci_cc_read_flow_control_mode(hdev, skb);
		break;

3623 3624 3625 3626
	case HCI_OP_READ_LOCAL_AMP_INFO:
		hci_cc_read_local_amp_info(hdev, skb);
		break;

3627 3628 3629 3630
	case HCI_OP_READ_CLOCK:
		hci_cc_read_clock(hdev, skb);
		break;

3631 3632 3633 3634
	case HCI_OP_READ_INQ_RSP_TX_POWER:
		hci_cc_read_inq_rsp_tx_power(hdev, skb);
		break;

3635 3636 3637 3638 3639 3640 3641 3642
	case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
		hci_cc_read_def_err_data_reporting(hdev, skb);
		break;

	case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
		hci_cc_write_def_err_data_reporting(hdev, skb);
		break;

3643 3644 3645 3646 3647 3648 3649 3650
	case HCI_OP_PIN_CODE_REPLY:
		hci_cc_pin_code_reply(hdev, skb);
		break;

	case HCI_OP_PIN_CODE_NEG_REPLY:
		hci_cc_pin_code_neg_reply(hdev, skb);
		break;

3651
	case HCI_OP_READ_LOCAL_OOB_DATA:
3652 3653 3654 3655 3656
		hci_cc_read_local_oob_data(hdev, skb);
		break;

	case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
		hci_cc_read_local_oob_ext_data(hdev, skb);
3657 3658
		break;

3659 3660 3661 3662
	case HCI_OP_LE_READ_BUFFER_SIZE:
		hci_cc_le_read_buffer_size(hdev, skb);
		break;

3663 3664 3665 3666
	case HCI_OP_LE_READ_LOCAL_FEATURES:
		hci_cc_le_read_local_features(hdev, skb);
		break;

3667 3668 3669 3670
	case HCI_OP_LE_READ_ADV_TX_POWER:
		hci_cc_le_read_adv_tx_power(hdev, skb);
		break;

3671 3672 3673 3674 3675 3676 3677 3678
	case HCI_OP_USER_CONFIRM_REPLY:
		hci_cc_user_confirm_reply(hdev, skb);
		break;

	case HCI_OP_USER_CONFIRM_NEG_REPLY:
		hci_cc_user_confirm_neg_reply(hdev, skb);
		break;

3679 3680 3681 3682 3683 3684
	case HCI_OP_USER_PASSKEY_REPLY:
		hci_cc_user_passkey_reply(hdev, skb);
		break;

	case HCI_OP_USER_PASSKEY_NEG_REPLY:
		hci_cc_user_passkey_neg_reply(hdev, skb);
3685
		break;
3686

3687 3688 3689 3690
	case HCI_OP_LE_SET_RANDOM_ADDR:
		hci_cc_le_set_random_addr(hdev, skb);
		break;

3691 3692 3693 3694
	case HCI_OP_LE_SET_ADV_ENABLE:
		hci_cc_le_set_adv_enable(hdev, skb);
		break;

3695 3696 3697 3698
	case HCI_OP_LE_SET_SCAN_PARAM:
		hci_cc_le_set_scan_param(hdev, skb);
		break;

3699 3700 3701 3702
	case HCI_OP_LE_SET_SCAN_ENABLE:
		hci_cc_le_set_scan_enable(hdev, skb);
		break;

3703 3704
	case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
		hci_cc_le_read_accept_list_size(hdev, skb);
3705 3706
		break;

3707 3708
	case HCI_OP_LE_CLEAR_ACCEPT_LIST:
		hci_cc_le_clear_accept_list(hdev, skb);
3709 3710
		break;

3711 3712
	case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
		hci_cc_le_add_to_accept_list(hdev, skb);
3713 3714
		break;

3715 3716
	case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
		hci_cc_le_del_from_accept_list(hdev, skb);
3717 3718
		break;

3719 3720 3721 3722
	case HCI_OP_LE_READ_SUPPORTED_STATES:
		hci_cc_le_read_supported_states(hdev, skb);
		break;

3723 3724 3725 3726 3727 3728 3729 3730
	case HCI_OP_LE_READ_DEF_DATA_LEN:
		hci_cc_le_read_def_data_len(hdev, skb);
		break;

	case HCI_OP_LE_WRITE_DEF_DATA_LEN:
		hci_cc_le_write_def_data_len(hdev, skb);
		break;

3731 3732 3733 3734 3735 3736 3737 3738
	case HCI_OP_LE_ADD_TO_RESOLV_LIST:
		hci_cc_le_add_to_resolv_list(hdev, skb);
		break;

	case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
		hci_cc_le_del_from_resolv_list(hdev, skb);
		break;

3739 3740 3741 3742
	case HCI_OP_LE_CLEAR_RESOLV_LIST:
		hci_cc_le_clear_resolv_list(hdev, skb);
		break;

A
Ankit Navik 已提交
3743 3744 3745 3746
	case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
		hci_cc_le_read_resolv_list_size(hdev, skb);
		break;

3747 3748 3749 3750
	case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
		hci_cc_le_set_addr_resolution_enable(hdev, skb);
		break;

3751 3752 3753 3754
	case HCI_OP_LE_READ_MAX_DATA_LEN:
		hci_cc_le_read_max_data_len(hdev, skb);
		break;

3755 3756 3757 3758
	case HCI_OP_WRITE_LE_HOST_SUPPORTED:
		hci_cc_write_le_host_supported(hdev, skb);
		break;

3759 3760 3761 3762
	case HCI_OP_LE_SET_ADV_PARAM:
		hci_cc_set_adv_param(hdev, skb);
		break;

3763 3764 3765 3766
	case HCI_OP_READ_RSSI:
		hci_cc_read_rssi(hdev, skb);
		break;

3767 3768 3769 3770
	case HCI_OP_READ_TX_POWER:
		hci_cc_read_tx_power(hdev, skb);
		break;

3771 3772 3773 3774
	case HCI_OP_WRITE_SSP_DEBUG_MODE:
		hci_cc_write_ssp_debug_mode(hdev, skb);
		break;

3775 3776 3777 3778 3779 3780 3781 3782
	case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
		hci_cc_le_set_ext_scan_param(hdev, skb);
		break;

	case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
		hci_cc_le_set_ext_scan_enable(hdev, skb);
		break;

3783 3784 3785 3786
	case HCI_OP_LE_SET_DEFAULT_PHY:
		hci_cc_le_set_default_phy(hdev, skb);
		break;

3787 3788 3789 3790
	case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
		hci_cc_le_read_num_adv_sets(hdev, skb);
		break;

3791 3792 3793 3794 3795 3796 3797 3798
	case HCI_OP_LE_SET_EXT_ADV_PARAMS:
		hci_cc_set_ext_adv_param(hdev, skb);
		break;

	case HCI_OP_LE_SET_EXT_ADV_ENABLE:
		hci_cc_le_set_ext_adv_enable(hdev, skb);
		break;

3799 3800 3801 3802
	case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
		hci_cc_le_set_adv_set_random_addr(hdev, skb);
		break;

3803 3804 3805 3806 3807 3808 3809 3810
	case HCI_OP_LE_REMOVE_ADV_SET:
		hci_cc_le_remove_adv_set(hdev, skb);
		break;

	case HCI_OP_LE_CLEAR_ADV_SETS:
		hci_cc_le_clear_adv_sets(hdev, skb);
		break;

3811 3812 3813 3814
	case HCI_OP_LE_READ_TRANSMIT_POWER:
		hci_cc_le_read_transmit_power(hdev, skb);
		break;

3815
	default:
3816
		BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3817 3818 3819
		break;
	}

3820
	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3821

3822 3823
	hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
			     req_complete_skb);
3824

3825 3826 3827 3828 3829 3830
	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
		bt_dev_err(hdev,
			   "unexpected event for opcode 0x%4.4x", *opcode);
		return;
	}

3831 3832
	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
		queue_work(hdev->workqueue, &hdev->cmd_work);
3833 3834
}

3835 3836 3837 3838
static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
			       u16 *opcode, u8 *status,
			       hci_req_complete_t *req_complete,
			       hci_req_complete_skb_t *req_complete_skb)
3839 3840 3841 3842 3843
{
	struct hci_ev_cmd_status *ev = (void *) skb->data;

	skb_pull(skb, sizeof(*ev));

3844 3845
	*opcode = __le16_to_cpu(ev->opcode);
	*status = ev->status;
3846

3847
	switch (*opcode) {
3848 3849 3850 3851 3852 3853 3854 3855
	case HCI_OP_INQUIRY:
		hci_cs_inquiry(hdev, ev->status);
		break;

	case HCI_OP_CREATE_CONN:
		hci_cs_create_conn(hdev, ev->status);
		break;

3856 3857 3858 3859
	case HCI_OP_DISCONNECT:
		hci_cs_disconnect(hdev, ev->status);
		break;

3860 3861 3862 3863
	case HCI_OP_ADD_SCO:
		hci_cs_add_sco(hdev, ev->status);
		break;

3864 3865 3866 3867 3868 3869 3870 3871
	case HCI_OP_AUTH_REQUESTED:
		hci_cs_auth_requested(hdev, ev->status);
		break;

	case HCI_OP_SET_CONN_ENCRYPT:
		hci_cs_set_conn_encrypt(hdev, ev->status);
		break;

3872 3873 3874 3875
	case HCI_OP_REMOTE_NAME_REQ:
		hci_cs_remote_name_req(hdev, ev->status);
		break;

3876 3877 3878 3879 3880 3881 3882 3883
	case HCI_OP_READ_REMOTE_FEATURES:
		hci_cs_read_remote_features(hdev, ev->status);
		break;

	case HCI_OP_READ_REMOTE_EXT_FEATURES:
		hci_cs_read_remote_ext_features(hdev, ev->status);
		break;

3884 3885 3886 3887
	case HCI_OP_SETUP_SYNC_CONN:
		hci_cs_setup_sync_conn(hdev, ev->status);
		break;

3888 3889 3890 3891
	case HCI_OP_ENHANCED_SETUP_SYNC_CONN:
		hci_cs_enhanced_setup_sync_conn(hdev, ev->status);
		break;

3892 3893 3894 3895 3896 3897 3898 3899
	case HCI_OP_SNIFF_MODE:
		hci_cs_sniff_mode(hdev, ev->status);
		break;

	case HCI_OP_EXIT_SNIFF_MODE:
		hci_cs_exit_sniff_mode(hdev, ev->status);
		break;

3900 3901 3902 3903
	case HCI_OP_SWITCH_ROLE:
		hci_cs_switch_role(hdev, ev->status);
		break;

3904 3905 3906 3907
	case HCI_OP_LE_CREATE_CONN:
		hci_cs_le_create_conn(hdev, ev->status);
		break;

3908 3909 3910 3911
	case HCI_OP_LE_READ_REMOTE_FEATURES:
		hci_cs_le_read_remote_features(hdev, ev->status);
		break;

3912 3913 3914 3915
	case HCI_OP_LE_START_ENC:
		hci_cs_le_start_enc(hdev, ev->status);
		break;

3916 3917 3918 3919
	case HCI_OP_LE_EXT_CREATE_CONN:
		hci_cs_le_ext_create_conn(hdev, ev->status);
		break;

3920
	default:
3921
		BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3922 3923 3924
		break;
	}

3925
	handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3926

3927 3928 3929 3930 3931 3932
	/* Indicate request completion if the command failed. Also, if
	 * we're not waiting for a special event and we get a success
	 * command status we should try to flag the request as completed
	 * (since for this kind of commands there will not be a command
	 * complete event).
	 */
3933
	if (ev->status ||
3934
	    (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3935 3936
		hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
				     req_complete_skb);
3937

3938 3939 3940 3941 3942 3943
	if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
		bt_dev_err(hdev,
			   "unexpected event for opcode 0x%4.4x", *opcode);
		return;
	}

3944 3945
	if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
		queue_work(hdev->workqueue, &hdev->cmd_work);
3946 3947
}

3948 3949 3950 3951
static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_hardware_error *ev = (void *) skb->data;

3952 3953 3954
	hdev->hw_error_code = ev->code;

	queue_work(hdev->req_workqueue, &hdev->error_reset);
3955 3956
}

3957
static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3958 3959 3960 3961
{
	struct hci_ev_role_change *ev = (void *) skb->data;
	struct hci_conn *conn;

3962
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3963 3964 3965 3966 3967

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (conn) {
3968 3969
		if (!ev->status)
			conn->role = ev->role;
3970

3971
		clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3972 3973 3974 3975 3976 3977 3978

		hci_role_switch_cfm(conn, ev->status, ev->role);
	}

	hci_dev_unlock(hdev);
}

3979
static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3980 3981 3982 3983
{
	struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
	int i;

3984
	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3985
		bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3986 3987 3988
		return;
	}

3989 3990
	if (skb->len < sizeof(*ev) ||
	    skb->len < struct_size(ev, handles, ev->num_hndl)) {
3991 3992 3993 3994
		BT_DBG("%s bad parameters", hdev->name);
		return;
	}

3995 3996
	BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);

3997 3998
	for (i = 0; i < ev->num_hndl; i++) {
		struct hci_comp_pkts_info *info = &ev->handles[i];
3999 4000 4001
		struct hci_conn *conn;
		__u16  handle, count;

4002 4003
		handle = __le16_to_cpu(info->handle);
		count  = __le16_to_cpu(info->count);
4004 4005

		conn = hci_conn_hash_lookup_handle(hdev, handle);
4006 4007 4008 4009 4010 4011 4012 4013 4014 4015 4016 4017 4018 4019 4020 4021 4022 4023
		if (!conn)
			continue;

		conn->sent -= count;

		switch (conn->type) {
		case ACL_LINK:
			hdev->acl_cnt += count;
			if (hdev->acl_cnt > hdev->acl_pkts)
				hdev->acl_cnt = hdev->acl_pkts;
			break;

		case LE_LINK:
			if (hdev->le_pkts) {
				hdev->le_cnt += count;
				if (hdev->le_cnt > hdev->le_pkts)
					hdev->le_cnt = hdev->le_pkts;
			} else {
A
Andrei Emeltchenko 已提交
4024 4025
				hdev->acl_cnt += count;
				if (hdev->acl_cnt > hdev->acl_pkts)
4026 4027
					hdev->acl_cnt = hdev->acl_pkts;
			}
4028 4029 4030 4031 4032 4033 4034 4035 4036
			break;

		case SCO_LINK:
			hdev->sco_cnt += count;
			if (hdev->sco_cnt > hdev->sco_pkts)
				hdev->sco_cnt = hdev->sco_pkts;
			break;

		default:
4037 4038
			bt_dev_err(hdev, "unknown type %d conn %p",
				   conn->type, conn);
4039
			break;
4040 4041 4042
		}
	}

4043
	queue_work(hdev->workqueue, &hdev->tx_work);
4044 4045
}

4046 4047 4048 4049 4050 4051
static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
						 __u16 handle)
{
	struct hci_chan *chan;

	switch (hdev->dev_type) {
4052
	case HCI_PRIMARY:
4053 4054 4055 4056 4057 4058 4059
		return hci_conn_hash_lookup_handle(hdev, handle);
	case HCI_AMP:
		chan = hci_chan_lookup_handle(hdev, handle);
		if (chan)
			return chan->conn;
		break;
	default:
4060
		bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4061 4062 4063 4064 4065 4066
		break;
	}

	return NULL;
}

4067
static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
4068 4069 4070 4071 4072
{
	struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
	int i;

	if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4073
		bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4074 4075 4076
		return;
	}

4077 4078
	if (skb->len < sizeof(*ev) ||
	    skb->len < struct_size(ev, handles, ev->num_hndl)) {
4079 4080 4081 4082 4083
		BT_DBG("%s bad parameters", hdev->name);
		return;
	}

	BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
4084
	       ev->num_hndl);
4085 4086 4087

	for (i = 0; i < ev->num_hndl; i++) {
		struct hci_comp_blocks_info *info = &ev->handles[i];
4088
		struct hci_conn *conn = NULL;
4089 4090 4091 4092 4093
		__u16  handle, block_count;

		handle = __le16_to_cpu(info->handle);
		block_count = __le16_to_cpu(info->blocks);

4094
		conn = __hci_conn_lookup_handle(hdev, handle);
4095 4096 4097 4098 4099 4100 4101
		if (!conn)
			continue;

		conn->sent -= block_count;

		switch (conn->type) {
		case ACL_LINK:
4102
		case AMP_LINK:
4103 4104 4105 4106 4107 4108
			hdev->block_cnt += block_count;
			if (hdev->block_cnt > hdev->num_blocks)
				hdev->block_cnt = hdev->num_blocks;
			break;

		default:
4109 4110
			bt_dev_err(hdev, "unknown type %d conn %p",
				   conn->type, conn);
4111 4112 4113 4114 4115 4116 4117
			break;
		}
	}

	queue_work(hdev->workqueue, &hdev->tx_work);
}

4118
static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4119
{
4120
	struct hci_ev_mode_change *ev = (void *) skb->data;
4121 4122
	struct hci_conn *conn;

4123
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4124 4125 4126 4127

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4128 4129 4130
	if (conn) {
		conn->mode = ev->mode;

4131 4132
		if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
					&conn->flags)) {
4133
			if (conn->mode == HCI_CM_ACTIVE)
4134
				set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4135
			else
4136
				clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4137
		}
4138

4139
		if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4140
			hci_sco_setup(conn, ev->status);
4141 4142 4143 4144 4145
	}

	hci_dev_unlock(hdev);
}

4146
static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4147
{
4148 4149 4150
	struct hci_ev_pin_code_req *ev = (void *) skb->data;
	struct hci_conn *conn;

4151
	BT_DBG("%s", hdev->name);
4152 4153 4154 4155

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4156 4157 4158 4159
	if (!conn)
		goto unlock;

	if (conn->state == BT_CONNECTED) {
4160 4161
		hci_conn_hold(conn);
		conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4162
		hci_conn_drop(conn);
4163 4164
	}

4165
	if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4166
	    !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4167
		hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4168
			     sizeof(ev->bdaddr), &ev->bdaddr);
4169
	} else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4170 4171 4172 4173 4174 4175 4176
		u8 secure;

		if (conn->pending_sec_level == BT_SECURITY_HIGH)
			secure = 1;
		else
			secure = 0;

4177
		mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4178
	}
4179

4180
unlock:
4181
	hci_dev_unlock(hdev);
4182 4183
}

4184 4185 4186 4187 4188 4189 4190 4191 4192 4193 4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212 4213 4214 4215
static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
{
	if (key_type == HCI_LK_CHANGED_COMBINATION)
		return;

	conn->pin_length = pin_len;
	conn->key_type = key_type;

	switch (key_type) {
	case HCI_LK_LOCAL_UNIT:
	case HCI_LK_REMOTE_UNIT:
	case HCI_LK_DEBUG_COMBINATION:
		return;
	case HCI_LK_COMBINATION:
		if (pin_len == 16)
			conn->pending_sec_level = BT_SECURITY_HIGH;
		else
			conn->pending_sec_level = BT_SECURITY_MEDIUM;
		break;
	case HCI_LK_UNAUTH_COMBINATION_P192:
	case HCI_LK_UNAUTH_COMBINATION_P256:
		conn->pending_sec_level = BT_SECURITY_MEDIUM;
		break;
	case HCI_LK_AUTH_COMBINATION_P192:
		conn->pending_sec_level = BT_SECURITY_HIGH;
		break;
	case HCI_LK_AUTH_COMBINATION_P256:
		conn->pending_sec_level = BT_SECURITY_FIPS;
		break;
	}
}

4216
static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4217
{
4218 4219 4220 4221 4222
	struct hci_ev_link_key_req *ev = (void *) skb->data;
	struct hci_cp_link_key_reply cp;
	struct hci_conn *conn;
	struct link_key *key;

4223
	BT_DBG("%s", hdev->name);
4224

4225
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4226 4227 4228 4229 4230 4231
		return;

	hci_dev_lock(hdev);

	key = hci_find_link_key(hdev, &ev->bdaddr);
	if (!key) {
4232 4233
		BT_DBG("%s link key not found for %pMR", hdev->name,
		       &ev->bdaddr);
4234 4235 4236
		goto not_found;
	}

4237 4238
	BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
	       &ev->bdaddr);
4239 4240

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4241
	if (conn) {
4242 4243
		clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);

4244 4245
		if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
		     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4246
		    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4247 4248 4249
			BT_DBG("%s ignoring unauthenticated key", hdev->name);
			goto not_found;
		}
4250

4251
		if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4252 4253
		    (conn->pending_sec_level == BT_SECURITY_HIGH ||
		     conn->pending_sec_level == BT_SECURITY_FIPS)) {
4254 4255
			BT_DBG("%s ignoring key unauthenticated for high security",
			       hdev->name);
4256 4257 4258
			goto not_found;
		}

4259
		conn_set_key(conn, key->type, key->pin_len);
4260 4261 4262
	}

	bacpy(&cp.bdaddr, &ev->bdaddr);
4263
	memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4264 4265 4266 4267 4268 4269 4270 4271 4272 4273

	hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);

	hci_dev_unlock(hdev);

	return;

not_found:
	hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
	hci_dev_unlock(hdev);
4274 4275
}

4276
static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4277
{
4278 4279
	struct hci_ev_link_key_notify *ev = (void *) skb->data;
	struct hci_conn *conn;
4280 4281
	struct link_key *key;
	bool persistent;
4282
	u8 pin_len = 0;
4283

4284
	BT_DBG("%s", hdev->name);
4285 4286 4287 4288

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4289 4290 4291 4292 4293 4294 4295
	if (!conn)
		goto unlock;

	hci_conn_hold(conn);
	conn->disc_timeout = HCI_DISCONN_TIMEOUT;
	hci_conn_drop(conn);

4296
	set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4297
	conn_set_key(conn, ev->key_type, conn->pin_length);
4298

4299
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4300 4301 4302 4303 4304 4305 4306
		goto unlock;

	key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
			        ev->key_type, pin_len, &persistent);
	if (!key)
		goto unlock;

4307 4308 4309 4310 4311 4312
	/* Update connection information since adding the key will have
	 * fixed up the type in the case of changed combination keys.
	 */
	if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
		conn_set_key(conn, key->type, key->pin_len);

4313
	mgmt_new_link_key(hdev, key, persistent);
4314

4315 4316 4317 4318 4319 4320
	/* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
	 * is set. If it's not set simply remove the key from the kernel
	 * list (we've still notified user space about it but with
	 * store_hint being 0).
	 */
	if (key->type == HCI_LK_DEBUG_COMBINATION &&
4321
	    !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4322 4323
		list_del_rcu(&key->list);
		kfree_rcu(key, rcu);
4324
		goto unlock;
4325
	}
4326

4327 4328 4329 4330 4331
	if (persistent)
		clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
	else
		set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);

4332
unlock:
4333
	hci_dev_unlock(hdev);
4334 4335
}

4336
static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
4337
{
4338
	struct hci_ev_clock_offset *ev = (void *) skb->data;
4339
	struct hci_conn *conn;
L
Linus Torvalds 已提交
4340

4341
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
L
Linus Torvalds 已提交
4342 4343 4344

	hci_dev_lock(hdev);

4345
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
L
Linus Torvalds 已提交
4346 4347 4348
	if (conn && !ev->status) {
		struct inquiry_entry *ie;

4349 4350
		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
		if (ie) {
L
Linus Torvalds 已提交
4351 4352 4353 4354 4355 4356 4357 4358
			ie->data.clock_offset = ev->clock_offset;
			ie->timestamp = jiffies;
		}
	}

	hci_dev_unlock(hdev);
}

4359
static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4360 4361 4362 4363
{
	struct hci_ev_pkt_type_change *ev = (void *) skb->data;
	struct hci_conn *conn;

4364
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4365 4366 4367 4368 4369 4370 4371 4372 4373 4374

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
	if (conn && !ev->status)
		conn->pkt_type = __le16_to_cpu(ev->pkt_type);

	hci_dev_unlock(hdev);
}

4375
static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4376
{
4377
	struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4378 4379 4380 4381 4382 4383
	struct inquiry_entry *ie;

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

4384 4385
	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
	if (ie) {
4386 4387 4388 4389 4390 4391 4392
		ie->data.pscan_rep_mode = ev->pscan_rep_mode;
		ie->timestamp = jiffies;
	}

	hci_dev_unlock(hdev);
}

4393 4394
static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
					     struct sk_buff *skb)
4395 4396 4397 4398 4399 4400 4401 4402 4403
{
	struct inquiry_data data;
	int num_rsp = *((__u8 *) skb->data);

	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);

	if (!num_rsp)
		return;

4404
	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4405 4406
		return;

4407 4408 4409
	hci_dev_lock(hdev);

	if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4410 4411
		struct inquiry_info_with_rssi_and_pscan_mode *info;
		info = (void *) (skb->data + 1);
4412

4413 4414 4415
		if (skb->len < num_rsp * sizeof(*info) + 1)
			goto unlock;

4416
		for (; num_rsp; num_rsp--, info++) {
4417 4418
			u32 flags;

4419 4420 4421 4422 4423 4424 4425
			bacpy(&data.bdaddr, &info->bdaddr);
			data.pscan_rep_mode	= info->pscan_rep_mode;
			data.pscan_period_mode	= info->pscan_period_mode;
			data.pscan_mode		= info->pscan_mode;
			memcpy(data.dev_class, info->dev_class, 3);
			data.clock_offset	= info->clock_offset;
			data.rssi		= info->rssi;
4426
			data.ssp_mode		= 0x00;
4427

4428 4429
			flags = hci_inquiry_cache_update(hdev, &data, false);

4430
			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4431
					  info->dev_class, info->rssi,
4432
					  flags, NULL, 0, NULL, 0);
4433 4434 4435 4436
		}
	} else {
		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);

4437 4438 4439
		if (skb->len < num_rsp * sizeof(*info) + 1)
			goto unlock;

4440
		for (; num_rsp; num_rsp--, info++) {
4441 4442
			u32 flags;

4443 4444 4445 4446 4447 4448 4449
			bacpy(&data.bdaddr, &info->bdaddr);
			data.pscan_rep_mode	= info->pscan_rep_mode;
			data.pscan_period_mode	= info->pscan_period_mode;
			data.pscan_mode		= 0x00;
			memcpy(data.dev_class, info->dev_class, 3);
			data.clock_offset	= info->clock_offset;
			data.rssi		= info->rssi;
4450
			data.ssp_mode		= 0x00;
4451 4452 4453

			flags = hci_inquiry_cache_update(hdev, &data, false);

4454
			mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4455
					  info->dev_class, info->rssi,
4456
					  flags, NULL, 0, NULL, 0);
4457 4458 4459
		}
	}

4460
unlock:
4461 4462 4463
	hci_dev_unlock(hdev);
}

4464 4465
static void hci_remote_ext_features_evt(struct hci_dev *hdev,
					struct sk_buff *skb)
4466
{
4467 4468 4469
	struct hci_ev_remote_ext_features *ev = (void *) skb->data;
	struct hci_conn *conn;

4470
	BT_DBG("%s", hdev->name);
4471 4472 4473 4474

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4475 4476
	if (!conn)
		goto unlock;
4477

4478 4479 4480
	if (ev->page < HCI_MAX_PAGES)
		memcpy(conn->features[ev->page], ev->features, 8);

4481 4482
	if (!ev->status && ev->page == 0x01) {
		struct inquiry_entry *ie;
4483

4484 4485
		ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
		if (ie)
4486
			ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4487

4488
		if (ev->features[0] & LMP_HOST_SSP) {
4489
			set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4490 4491 4492 4493 4494 4495 4496 4497 4498 4499 4500
		} else {
			/* It is mandatory by the Bluetooth specification that
			 * Extended Inquiry Results are only used when Secure
			 * Simple Pairing is enabled, but some devices violate
			 * this.
			 *
			 * To make these devices work, the internal SSP
			 * enabled flag needs to be cleared if the remote host
			 * features do not indicate SSP support */
			clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
		}
4501 4502 4503

		if (ev->features[0] & LMP_HOST_SC)
			set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4504 4505 4506 4507 4508
	}

	if (conn->state != BT_CONFIG)
		goto unlock;

4509
	if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4510 4511 4512 4513 4514
		struct hci_cp_remote_name_req cp;
		memset(&cp, 0, sizeof(cp));
		bacpy(&cp.bdaddr, &conn->dst);
		cp.pscan_rep_mode = 0x02;
		hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4515
	} else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4516
		mgmt_device_connected(hdev, conn, NULL, 0);
4517

4518
	if (!hci_outgoing_auth_needed(hdev, conn)) {
4519
		conn->state = BT_CONNECTED;
4520
		hci_connect_cfm(conn, ev->status);
4521
		hci_conn_drop(conn);
4522 4523
	}

4524
unlock:
4525
	hci_dev_unlock(hdev);
4526 4527
}

4528 4529
static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
				       struct sk_buff *skb)
4530
{
4531 4532 4533
	struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
	struct hci_conn *conn;

4534
	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4535 4536 4537 4538

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4539 4540 4541 4542
	if (!conn) {
		if (ev->link_type == ESCO_LINK)
			goto unlock;

4543 4544 4545 4546 4547 4548 4549 4550 4551
		/* When the link type in the event indicates SCO connection
		 * and lookup of the connection object fails, then check
		 * if an eSCO connection object exists.
		 *
		 * The core limits the synchronous connections to either
		 * SCO or eSCO. The eSCO connection is preferred and tried
		 * to be setup first and until successfully established,
		 * the link type will be hinted as eSCO.
		 */
4552 4553 4554 4555
		conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
		if (!conn)
			goto unlock;
	}
4556

4557 4558
	switch (ev->status) {
	case 0x00:
4559 4560 4561 4562 4563 4564 4565 4566 4567 4568 4569 4570 4571 4572 4573
		/* The synchronous connection complete event should only be
		 * sent once per new connection. Receiving a successful
		 * complete event when the connection status is already
		 * BT_CONNECTED means that the device is misbehaving and sent
		 * multiple complete event packets for the same new connection.
		 *
		 * Registering the device more than once can corrupt kernel
		 * memory, hence upon detecting this invalid event, we report
		 * an error and ignore the packet.
		 */
		if (conn->state == BT_CONNECTED) {
			bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
			goto unlock;
		}

4574 4575
		conn->handle = __le16_to_cpu(ev->handle);
		conn->state  = BT_CONNECTED;
4576
		conn->type   = ev->link_type;
4577

4578
		hci_debugfs_create_conn(conn);
4579
		hci_conn_add_sysfs(conn);
4580 4581
		break;

4582
	case 0x10:	/* Connection Accept Timeout */
4583
	case 0x0d:	/* Connection Rejected due to Limited Resources */
4584
	case 0x11:	/* Unsupported Feature or Parameter Value */
4585
	case 0x1c:	/* SCO interval rejected */
4586
	case 0x1a:	/* Unsupported Remote Feature */
4587
	case 0x1e:	/* Invalid LMP Parameters */
4588
	case 0x1f:	/* Unspecified error */
4589
	case 0x20:	/* Unsupported LMP Parameter value */
4590
		if (conn->out) {
4591 4592
			conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
					(hdev->esco_type & EDR_ESCO_MASK);
4593 4594
			if (hci_setup_sync(conn, conn->link->handle))
				goto unlock;
4595
		}
4596
		fallthrough;
4597 4598

	default:
4599
		conn->state = BT_CLOSED;
4600 4601
		break;
	}
4602

4603
	bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4604 4605 4606
	/* Notify only in case of SCO over HCI transport data path which
	 * is zero and non-zero value shall be non-HCI transport data path
	 */
4607 4608 4609 4610 4611 4612 4613 4614 4615
	if (conn->codec.data_path == 0 && hdev->notify) {
		switch (ev->air_mode) {
		case 0x02:
			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
			break;
		case 0x03:
			hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
			break;
		}
4616 4617
	}

4618
	hci_connect_cfm(conn, ev->status);
4619 4620 4621 4622 4623
	if (ev->status)
		hci_conn_del(conn);

unlock:
	hci_dev_unlock(hdev);
4624 4625
}

4626 4627 4628 4629 4630 4631 4632 4633 4634 4635 4636 4637 4638 4639 4640 4641 4642
static inline size_t eir_get_length(u8 *eir, size_t eir_len)
{
	size_t parsed = 0;

	while (parsed < eir_len) {
		u8 field_len = eir[0];

		if (field_len == 0)
			return parsed;

		parsed += field_len + 1;
		eir += field_len + 1;
	}

	return eir_len;
}

4643 4644
static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
					    struct sk_buff *skb)
L
Linus Torvalds 已提交
4645
{
4646 4647 4648
	struct inquiry_data data;
	struct extended_inquiry_info *info = (void *) (skb->data + 1);
	int num_rsp = *((__u8 *) skb->data);
4649
	size_t eir_len;
L
Linus Torvalds 已提交
4650

4651
	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
L
Linus Torvalds 已提交
4652

4653
	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4654
		return;
L
Linus Torvalds 已提交
4655

4656
	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4657 4658
		return;

4659 4660
	hci_dev_lock(hdev);

4661
	for (; num_rsp; num_rsp--, info++) {
4662 4663
		u32 flags;
		bool name_known;
4664

4665
		bacpy(&data.bdaddr, &info->bdaddr);
4666 4667 4668
		data.pscan_rep_mode	= info->pscan_rep_mode;
		data.pscan_period_mode	= info->pscan_period_mode;
		data.pscan_mode		= 0x00;
4669
		memcpy(data.dev_class, info->dev_class, 3);
4670 4671
		data.clock_offset	= info->clock_offset;
		data.rssi		= info->rssi;
4672
		data.ssp_mode		= 0x01;
4673

4674
		if (hci_dev_test_flag(hdev, HCI_MGMT))
4675 4676 4677
			name_known = eir_get_data(info->data,
						  sizeof(info->data),
						  EIR_NAME_COMPLETE, NULL);
4678 4679 4680
		else
			name_known = true;

4681 4682
		flags = hci_inquiry_cache_update(hdev, &data, name_known);

4683
		eir_len = eir_get_length(info->data, sizeof(info->data));
4684

4685
		mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4686 4687
				  info->dev_class, info->rssi,
				  flags, info->data, eir_len, NULL, 0);
4688 4689 4690 4691
	}

	hci_dev_unlock(hdev);
}
L
Linus Torvalds 已提交
4692

4693 4694 4695 4696 4697 4698
static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
	struct hci_conn *conn;

4699
	BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4700 4701 4702 4703 4704 4705 4706 4707
	       __le16_to_cpu(ev->handle));

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
	if (!conn)
		goto unlock;

4708 4709 4710 4711 4712 4713
	/* For BR/EDR the necessary steps are taken through the
	 * auth_complete event.
	 */
	if (conn->type != LE_LINK)
		goto unlock;

4714 4715 4716 4717 4718 4719
	if (!ev->status)
		conn->sec_level = conn->pending_sec_level;

	clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);

	if (ev->status && conn->state == BT_CONNECTED) {
A
Andre Guedes 已提交
4720
		hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4721
		hci_conn_drop(conn);
4722 4723 4724 4725 4726 4727 4728
		goto unlock;
	}

	if (conn->state == BT_CONFIG) {
		if (!ev->status)
			conn->state = BT_CONNECTED;

4729
		hci_connect_cfm(conn, ev->status);
4730
		hci_conn_drop(conn);
4731 4732 4733 4734 4735
	} else {
		hci_auth_cfm(conn, ev->status);

		hci_conn_hold(conn);
		conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4736
		hci_conn_drop(conn);
4737 4738 4739 4740 4741 4742
	}

unlock:
	hci_dev_unlock(hdev);
}

4743
static u8 hci_get_auth_req(struct hci_conn *conn)
4744 4745
{
	/* If remote requests no-bonding follow that lead */
4746 4747
	if (conn->remote_auth == HCI_AT_NO_BONDING ||
	    conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4748
		return conn->remote_auth | (conn->auth_type & 0x01);
4749

4750 4751 4752 4753 4754 4755 4756
	/* If both remote and local have enough IO capabilities, require
	 * MITM protection
	 */
	if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
	    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
		return conn->remote_auth | 0x01;

4757 4758
	/* No MITM protection possible so ignore remote requirement */
	return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4759 4760
}

4761 4762 4763 4764 4765 4766 4767 4768 4769
static u8 bredr_oob_data_present(struct hci_conn *conn)
{
	struct hci_dev *hdev = conn->hdev;
	struct oob_data *data;

	data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
	if (!data)
		return 0x00;

4770 4771 4772 4773 4774 4775 4776 4777 4778
	if (bredr_sc_enabled(hdev)) {
		/* When Secure Connections is enabled, then just
		 * return the present value stored with the OOB
		 * data. The stored value contains the right present
		 * information. However it can only be trusted when
		 * not in Secure Connection Only mode.
		 */
		if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
			return data->present;
4779

4780 4781 4782 4783
		/* When Secure Connections Only mode is enabled, then
		 * the P-256 values are required. If they are not
		 * available, then do not declare that OOB data is
		 * present.
4784
		 */
4785 4786
		if (!memcmp(data->rand256, ZERO_KEY, 16) ||
		    !memcmp(data->hash256, ZERO_KEY, 16))
4787 4788
			return 0x00;

4789
		return 0x02;
4790
	}
4791

4792 4793 4794 4795 4796 4797 4798 4799 4800
	/* When Secure Connections is not enabled or actually
	 * not supported by the hardware, then check that if
	 * P-192 data values are present.
	 */
	if (!memcmp(data->rand192, ZERO_KEY, 16) ||
	    !memcmp(data->hash192, ZERO_KEY, 16))
		return 0x00;

	return 0x01;
4801 4802
}

4803
static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4804 4805 4806 4807 4808 4809 4810 4811 4812
{
	struct hci_ev_io_capa_request *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4813 4814 4815 4816 4817
	if (!conn)
		goto unlock;

	hci_conn_hold(conn);

4818
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4819 4820
		goto unlock;

4821 4822 4823
	/* Allow pairing if we're pairable, the initiators of the
	 * pairing or if the remote is not requesting bonding.
	 */
4824
	if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4825
	    test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4826
	    (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4827 4828 4829
		struct hci_cp_io_capability_reply cp;

		bacpy(&cp.bdaddr, &ev->bdaddr);
4830 4831 4832
		/* Change the IO capability from KeyboardDisplay
		 * to DisplayYesNo as it is not supported by BT spec. */
		cp.capability = (conn->io_capability == 0x04) ?
4833
				HCI_IO_DISPLAY_YESNO : conn->io_capability;
4834 4835 4836

		/* If we are initiators, there is no remote information yet */
		if (conn->remote_auth == 0xff) {
4837
			/* Request MITM protection if our IO caps allow it
4838
			 * except for the no-bonding case.
4839
			 */
4840
			if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4841
			    conn->auth_type != HCI_AT_NO_BONDING)
4842
				conn->auth_type |= 0x01;
4843 4844 4845
		} else {
			conn->auth_type = hci_get_auth_req(conn);
		}
4846

4847 4848 4849
		/* If we're not bondable, force one of the non-bondable
		 * authentication requirement values.
		 */
4850
		if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4851 4852 4853
			conn->auth_type &= HCI_AT_NO_BONDING_MITM;

		cp.authentication = conn->auth_type;
4854
		cp.oob_data = bredr_oob_data_present(conn);
4855

4856
		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4857
			     sizeof(cp), &cp);
4858 4859 4860 4861
	} else {
		struct hci_cp_io_capability_neg_reply cp;

		bacpy(&cp.bdaddr, &ev->bdaddr);
4862
		cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4863

4864
		hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4865
			     sizeof(cp), &cp);
4866 4867 4868 4869 4870 4871
	}

unlock:
	hci_dev_unlock(hdev);
}

4872
static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4873 4874 4875 4876 4877 4878 4879 4880 4881 4882 4883 4884 4885 4886 4887 4888
{
	struct hci_ev_io_capa_reply *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (!conn)
		goto unlock;

	conn->remote_cap = ev->capability;
	conn->remote_auth = ev->authentication;

unlock:
4889 4890 4891
	hci_dev_unlock(hdev);
}

4892 4893
static void hci_user_confirm_request_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
4894 4895
{
	struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4896
	int loc_mitm, rem_mitm, confirm_hint = 0;
4897
	struct hci_conn *conn;
4898 4899 4900 4901 4902

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

4903
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
4904
		goto unlock;
4905

4906 4907 4908 4909 4910 4911 4912 4913
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (!conn)
		goto unlock;

	loc_mitm = (conn->auth_type & 0x01);
	rem_mitm = (conn->remote_auth & 0x01);

	/* If we require MITM but the remote device can't provide that
4914 4915 4916
	 * (it has NoInputNoOutput) then reject the confirmation
	 * request. We check the security level here since it doesn't
	 * necessarily match conn->auth_type.
4917
	 */
4918 4919
	if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
	    conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4920 4921
		BT_DBG("Rejecting request: remote device can't provide MITM");
		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4922
			     sizeof(ev->bdaddr), &ev->bdaddr);
4923 4924 4925 4926
		goto unlock;
	}

	/* If no side requires MITM protection; auto-accept */
4927 4928
	if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
	    (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4929 4930 4931

		/* If we're not the initiators request authorization to
		 * proceed from user space (mgmt_user_confirm with
4932
		 * confirm_hint set to 1). The exception is if neither
4933 4934
		 * side had MITM or if the local IO capability is
		 * NoInputNoOutput, in which case we do auto-accept
4935 4936
		 */
		if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4937
		    conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4938
		    (loc_mitm || rem_mitm)) {
4939 4940 4941 4942 4943
			BT_DBG("Confirming auto-accept as acceptor");
			confirm_hint = 1;
			goto confirm;
		}

4944 4945 4946 4947 4948 4949 4950 4951 4952 4953
		/* If there already exists link key in local host, leave the
		 * decision to user space since the remote device could be
		 * legitimate or malicious.
		 */
		if (hci_find_link_key(hdev, &ev->bdaddr)) {
			bt_dev_dbg(hdev, "Local host already has link key");
			confirm_hint = 1;
			goto confirm;
		}

4954
		BT_DBG("Auto-accept of user confirmation with %ums delay",
4955
		       hdev->auto_accept_delay);
4956 4957 4958

		if (hdev->auto_accept_delay > 0) {
			int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4959 4960
			queue_delayed_work(conn->hdev->workqueue,
					   &conn->auto_accept_work, delay);
4961 4962 4963
			goto unlock;
		}

4964
		hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4965
			     sizeof(ev->bdaddr), &ev->bdaddr);
4966 4967 4968
		goto unlock;
	}

4969
confirm:
4970 4971
	mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
				  le32_to_cpu(ev->passkey), confirm_hint);
4972 4973

unlock:
4974 4975 4976
	hci_dev_unlock(hdev);
}

4977 4978
static void hci_user_passkey_request_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
4979 4980 4981 4982 4983
{
	struct hci_ev_user_passkey_req *ev = (void *) skb->data;

	BT_DBG("%s", hdev->name);

4984
	if (hci_dev_test_flag(hdev, HCI_MGMT))
4985
		mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4986 4987
}

4988 4989 4990 4991 4992 4993 4994 4995 4996 4997 4998 4999 5000 5001 5002
static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
					struct sk_buff *skb)
{
	struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (!conn)
		return;

	conn->passkey_notify = __le32_to_cpu(ev->passkey);
	conn->passkey_entered = 0;

5003
	if (hci_dev_test_flag(hdev, HCI_MGMT))
5004 5005 5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016 5017 5018 5019 5020 5021 5022 5023 5024 5025 5026 5027 5028 5029 5030 5031 5032 5033 5034 5035 5036 5037 5038 5039 5040
		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
					 conn->dst_type, conn->passkey_notify,
					 conn->passkey_entered);
}

static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_keypress_notify *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (!conn)
		return;

	switch (ev->type) {
	case HCI_KEYPRESS_STARTED:
		conn->passkey_entered = 0;
		return;

	case HCI_KEYPRESS_ENTERED:
		conn->passkey_entered++;
		break;

	case HCI_KEYPRESS_ERASED:
		conn->passkey_entered--;
		break;

	case HCI_KEYPRESS_CLEARED:
		conn->passkey_entered = 0;
		break;

	case HCI_KEYPRESS_COMPLETED:
		return;
	}

5041
	if (hci_dev_test_flag(hdev, HCI_MGMT))
5042 5043 5044 5045 5046
		mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
					 conn->dst_type, conn->passkey_notify,
					 conn->passkey_entered);
}

5047 5048
static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
5049 5050 5051 5052 5053 5054 5055 5056 5057
{
	struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5058 5059 5060
	if (!conn)
		goto unlock;

5061 5062 5063
	/* Reset the authentication requirement to unknown */
	conn->remote_auth = 0xff;

5064 5065 5066 5067 5068
	/* To avoid duplicate auth_failed events to user space we check
	 * the HCI_CONN_AUTH_PEND flag which will be set if we
	 * initiated the authentication. A traditional auth_complete
	 * event gets always produced as initiator and is also mapped to
	 * the mgmt_auth_failed event */
5069
	if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5070
		mgmt_auth_failed(conn, ev->status);
5071

5072
	hci_conn_drop(conn);
5073 5074

unlock:
5075 5076 5077
	hci_dev_unlock(hdev);
}

5078 5079
static void hci_remote_host_features_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
5080 5081 5082
{
	struct hci_ev_remote_host_features *ev = (void *) skb->data;
	struct inquiry_entry *ie;
5083
	struct hci_conn *conn;
5084 5085 5086 5087 5088

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

5089 5090 5091 5092
	conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
	if (conn)
		memcpy(conn->features[1], ev->features, 8);

5093 5094
	ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
	if (ie)
5095
		ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5096 5097 5098 5099

	hci_dev_unlock(hdev);
}

5100 5101
static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
					    struct sk_buff *skb)
5102 5103 5104 5105 5106 5107 5108 5109
{
	struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
	struct oob_data *data;

	BT_DBG("%s", hdev->name);

	hci_dev_lock(hdev);

5110
	if (!hci_dev_test_flag(hdev, HCI_MGMT))
5111 5112
		goto unlock;

5113
	data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5114 5115
	if (!data) {
		struct hci_cp_remote_oob_data_neg_reply cp;
5116

5117 5118 5119 5120 5121
		bacpy(&cp.bdaddr, &ev->bdaddr);
		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
			     sizeof(cp), &cp);
		goto unlock;
	}
5122

5123 5124
	if (bredr_sc_enabled(hdev)) {
		struct hci_cp_remote_oob_ext_data_reply cp;
5125

5126
		bacpy(&cp.bdaddr, &ev->bdaddr);
5127
		if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5128 5129 5130 5131 5132
			memset(cp.hash192, 0, sizeof(cp.hash192));
			memset(cp.rand192, 0, sizeof(cp.rand192));
		} else {
			memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
			memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5133
		}
5134 5135 5136 5137 5138
		memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
		memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));

		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
			     sizeof(cp), &cp);
5139
	} else {
5140
		struct hci_cp_remote_oob_data_reply cp;
5141 5142

		bacpy(&cp.bdaddr, &ev->bdaddr);
5143 5144 5145 5146
		memcpy(cp.hash, data->hash192, sizeof(cp.hash));
		memcpy(cp.rand, data->rand192, sizeof(cp.rand));

		hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5147
			     sizeof(cp), &cp);
5148 5149
	}

5150
unlock:
5151 5152 5153
	hci_dev_unlock(hdev);
}

5154 5155 5156 5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169 5170
#if IS_ENABLED(CONFIG_BT_HS)
static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_channel_selected *ev = (void *)skb->data;
	struct hci_conn *hcon;

	BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);

	skb_pull(skb, sizeof(*ev));

	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
	if (!hcon)
		return;

	amp_read_loc_assoc_final_data(hdev, hcon);
}

5171 5172 5173 5174 5175 5176 5177 5178 5179 5180 5181 5182
static void hci_phy_link_complete_evt(struct hci_dev *hdev,
				      struct sk_buff *skb)
{
	struct hci_ev_phy_link_complete *ev = (void *) skb->data;
	struct hci_conn *hcon, *bredr_hcon;

	BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
	       ev->status);

	hci_dev_lock(hdev);

	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5183 5184
	if (!hcon)
		goto unlock;
5185

5186 5187
	if (!hcon->amp_mgr)
		goto unlock;
5188

5189 5190
	if (ev->status) {
		hci_conn_del(hcon);
5191
		goto unlock;
5192 5193 5194 5195 5196 5197 5198 5199 5200
	}

	bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;

	hcon->state = BT_CONNECTED;
	bacpy(&hcon->dst, &bredr_hcon->dst);

	hci_conn_hold(hcon);
	hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5201
	hci_conn_drop(hcon);
5202

5203
	hci_debugfs_create_conn(hcon);
5204 5205
	hci_conn_add_sysfs(hcon);

5206
	amp_physical_cfm(bredr_hcon, hcon);
5207

5208
unlock:
5209
	hci_dev_unlock(hdev);
5210 5211
}

5212 5213 5214 5215 5216 5217 5218 5219 5220 5221 5222 5223 5224 5225 5226 5227 5228 5229 5230 5231 5232
static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_logical_link_complete *ev = (void *) skb->data;
	struct hci_conn *hcon;
	struct hci_chan *hchan;
	struct amp_mgr *mgr;

	BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
	       hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
	       ev->status);

	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
	if (!hcon)
		return;

	/* Create AMP hchan */
	hchan = hci_chan_create(hcon);
	if (!hchan)
		return;

	hchan->handle = le16_to_cpu(ev->handle);
5233
	hchan->amp = true;
5234 5235 5236 5237 5238 5239 5240 5241 5242 5243 5244 5245 5246 5247 5248 5249 5250

	BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);

	mgr = hcon->amp_mgr;
	if (mgr && mgr->bredr_chan) {
		struct l2cap_chan *bredr_chan = mgr->bredr_chan;

		l2cap_chan_lock(bredr_chan);

		bredr_chan->conn->mtu = hdev->block_mtu;
		l2cap_logical_cfm(bredr_chan, hchan, 0);
		hci_conn_hold(hcon);

		l2cap_chan_unlock(bredr_chan);
	}
}

5251 5252 5253 5254 5255 5256 5257 5258 5259 5260 5261 5262 5263 5264 5265
static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
					     struct sk_buff *skb)
{
	struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
	struct hci_chan *hchan;

	BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
	       le16_to_cpu(ev->handle), ev->status);

	if (ev->status)
		return;

	hci_dev_lock(hdev);

	hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5266
	if (!hchan || !hchan->amp)
5267 5268 5269 5270 5271 5272 5273 5274
		goto unlock;

	amp_destroy_logical_link(hchan, ev->reason);

unlock:
	hci_dev_unlock(hdev);
}

5275 5276 5277 5278 5279 5280 5281 5282 5283 5284 5285 5286 5287 5288 5289 5290 5291 5292 5293 5294 5295
static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
					     struct sk_buff *skb)
{
	struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
	struct hci_conn *hcon;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

	if (ev->status)
		return;

	hci_dev_lock(hdev);

	hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
	if (hcon) {
		hcon->state = BT_CLOSED;
		hci_conn_del(hcon);
	}

	hci_dev_unlock(hdev);
}
5296
#endif
5297

5298 5299 5300 5301 5302 5303 5304 5305 5306 5307 5308 5309 5310 5311 5312 5313 5314 5315 5316 5317 5318 5319 5320 5321 5322 5323 5324 5325 5326 5327 5328 5329 5330 5331 5332 5333 5334 5335 5336 5337 5338 5339 5340 5341 5342 5343 5344 5345 5346 5347 5348 5349 5350
static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
				u8 bdaddr_type, bdaddr_t *local_rpa)
{
	if (conn->out) {
		conn->dst_type = bdaddr_type;
		conn->resp_addr_type = bdaddr_type;
		bacpy(&conn->resp_addr, bdaddr);

		/* Check if the controller has set a Local RPA then it must be
		 * used instead or hdev->rpa.
		 */
		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
			bacpy(&conn->init_addr, local_rpa);
		} else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
			conn->init_addr_type = ADDR_LE_DEV_RANDOM;
			bacpy(&conn->init_addr, &conn->hdev->rpa);
		} else {
			hci_copy_identity_address(conn->hdev, &conn->init_addr,
						  &conn->init_addr_type);
		}
	} else {
		conn->resp_addr_type = conn->hdev->adv_addr_type;
		/* Check if the controller has set a Local RPA then it must be
		 * used instead or hdev->rpa.
		 */
		if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
			conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
			bacpy(&conn->resp_addr, local_rpa);
		} else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
			/* In case of ext adv, resp_addr will be updated in
			 * Adv Terminated event.
			 */
			if (!ext_adv_capable(conn->hdev))
				bacpy(&conn->resp_addr,
				      &conn->hdev->random_addr);
		} else {
			bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
		}

		conn->init_addr_type = bdaddr_type;
		bacpy(&conn->init_addr, bdaddr);

		/* For incoming connections, set the default minimum
		 * and maximum connection interval. They will be used
		 * to check if the parameters are in range and if not
		 * trigger the connection update procedure.
		 */
		conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
		conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
	}
}

5351
static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5352 5353 5354 5355
				 bdaddr_t *bdaddr, u8 bdaddr_type,
				 bdaddr_t *local_rpa, u8 role, u16 handle,
				 u16 interval, u16 latency,
				 u16 supervision_timeout)
V
Ville Tervo 已提交
5356
{
5357
	struct hci_conn_params *params;
V
Ville Tervo 已提交
5358
	struct hci_conn *conn;
5359
	struct smp_irk *irk;
5360
	u8 addr_type;
V
Ville Tervo 已提交
5361 5362 5363

	hci_dev_lock(hdev);

5364 5365 5366
	/* All controllers implicitly stop advertising in the event of a
	 * connection, so ensure that the state bit is cleared.
	 */
5367
	hci_dev_clear_flag(hdev, HCI_LE_ADV);
5368

5369
	conn = hci_lookup_le_connect(hdev);
5370
	if (!conn) {
5371
		conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5372
		if (!conn) {
5373
			bt_dev_err(hdev, "no memory for new connection");
A
Andre Guedes 已提交
5374
			goto unlock;
5375
		}
5376

5377
		conn->dst_type = bdaddr_type;
5378

5379
		/* If we didn't have a hci_conn object previously
5380
		 * but we're in central role this must be something
5381
		 * initiated using an accept list. Since accept list based
5382 5383 5384 5385 5386 5387
		 * connections are not "first class citizens" we don't
		 * have full tracking of them. Therefore, we go ahead
		 * with a "best effort" approach of determining the
		 * initiator address based on the HCI_PRIVACY flag.
		 */
		if (conn->out) {
5388 5389
			conn->resp_addr_type = bdaddr_type;
			bacpy(&conn->resp_addr, bdaddr);
5390
			if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5391 5392 5393 5394 5395 5396 5397 5398
				conn->init_addr_type = ADDR_LE_DEV_RANDOM;
				bacpy(&conn->init_addr, &hdev->rpa);
			} else {
				hci_copy_identity_address(hdev,
							  &conn->init_addr,
							  &conn->init_addr_type);
			}
		}
5399 5400
	} else {
		cancel_delayed_work(&conn->le_conn_timeout);
5401
	}
V
Ville Tervo 已提交
5402

5403
	le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5404

5405 5406 5407 5408 5409 5410 5411 5412 5413 5414
	/* Lookup the identity address from the stored connection
	 * address and address type.
	 *
	 * When establishing connections to an identity address, the
	 * connection procedure will store the resolvable random
	 * address first. Now if it can be converted back into the
	 * identity address, start using the identity address from
	 * now on.
	 */
	irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5415 5416 5417 5418 5419
	if (irk) {
		bacpy(&conn->dst, &irk->bdaddr);
		conn->dst_type = irk->addr_type;
	}

5420
	conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
5421

5422 5423
	if (status) {
		hci_le_conn_failed(conn, status);
5424 5425 5426
		goto unlock;
	}

5427 5428 5429 5430 5431
	if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
		addr_type = BDADDR_LE_PUBLIC;
	else
		addr_type = BDADDR_LE_RANDOM;

5432
	/* Drop the connection if the device is blocked */
5433
	if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5434
		hci_conn_drop(conn);
5435 5436 5437
		goto unlock;
	}

5438
	if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5439
		mgmt_device_connected(hdev, conn, NULL, 0);
5440

5441
	conn->sec_level = BT_SECURITY_LOW;
5442
	conn->handle = handle;
5443
	conn->state = BT_CONFIG;
V
Ville Tervo 已提交
5444

5445 5446 5447 5448 5449 5450 5451
	/* Store current advertising instance as connection advertising instance
	 * when sotfware rotation is in use so it can be re-enabled when
	 * disconnected.
	 */
	if (!ext_adv_capable(hdev))
		conn->adv_instance = hdev->cur_adv_instance;

5452 5453 5454
	conn->le_conn_interval = interval;
	conn->le_conn_latency = latency;
	conn->le_supv_timeout = supervision_timeout;
5455

5456
	hci_debugfs_create_conn(conn);
V
Ville Tervo 已提交
5457 5458
	hci_conn_add_sysfs(conn);

5459
	/* The remote features procedure is defined for central
5460 5461 5462
	 * role only. So only in case of an initiated connection
	 * request the remote features.
	 *
5463 5464
	 * If the local controller supports peripheral-initiated features
	 * exchange, then requesting the remote features in peripheral
5465 5466 5467 5468
	 * role is possible. Otherwise just transition into the
	 * connected state without requesting the remote features.
	 */
	if (conn->out ||
5469
	    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5470
		struct hci_cp_le_read_remote_features cp;
5471

5472
		cp.handle = __cpu_to_le16(conn->handle);
5473

5474 5475
		hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
			     sizeof(cp), &cp);
5476

5477
		hci_conn_hold(conn);
5478
	} else {
5479
		conn->state = BT_CONNECTED;
5480
		hci_connect_cfm(conn, status);
5481
	}
V
Ville Tervo 已提交
5482

5483 5484
	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
					   conn->dst_type);
5485
	if (params) {
5486
		list_del_init(&params->action);
5487 5488
		if (params->conn) {
			hci_conn_drop(params->conn);
5489
			hci_conn_put(params->conn);
5490 5491 5492
			params->conn = NULL;
		}
	}
5493

V
Ville Tervo 已提交
5494
unlock:
5495
	hci_update_passive_scan(hdev);
V
Ville Tervo 已提交
5496 5497 5498
	hci_dev_unlock(hdev);
}

5499 5500 5501 5502 5503 5504 5505
static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_le_conn_complete *ev = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5506
			     NULL, ev->role, le16_to_cpu(ev->handle),
5507 5508 5509 5510 5511
			     le16_to_cpu(ev->interval),
			     le16_to_cpu(ev->latency),
			     le16_to_cpu(ev->supervision_timeout));
}

5512 5513 5514 5515 5516 5517 5518 5519
static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

	le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5520
			     &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5521 5522 5523 5524 5525
			     le16_to_cpu(ev->interval),
			     le16_to_cpu(ev->latency),
			     le16_to_cpu(ev->supervision_timeout));
}

5526 5527 5528 5529
static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
	struct hci_conn *conn;
5530
	struct adv_info *adv;
5531 5532 5533

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

5534
	adv = hci_find_adv_instance(hdev, ev->handle);
5535

5536
	if (ev->status) {
5537 5538 5539 5540 5541 5542 5543
		if (!adv)
			return;

		/* Remove advertising as it has been terminated */
		hci_remove_adv_instance(hdev, ev->handle);
		mgmt_advertising_removed(NULL, hdev, ev->handle);

5544
		return;
5545
	}
5546

5547 5548 5549
	if (adv)
		adv->enabled = false;

5550 5551
	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
	if (conn) {
5552 5553 5554 5555
		/* Store handle in the connection so the correct advertising
		 * instance can be re-enabled when disconnected.
		 */
		conn->adv_instance = ev->handle;
5556

5557 5558
		if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
		    bacmp(&conn->resp_addr, BDADDR_ANY))
5559 5560
			return;

5561
		if (!ev->handle) {
5562 5563 5564 5565
			bacpy(&conn->resp_addr, &hdev->random_addr);
			return;
		}

5566 5567
		if (adv)
			bacpy(&conn->resp_addr, &adv->random_addr);
5568 5569 5570
	}
}

5571 5572 5573 5574 5575 5576 5577 5578 5579 5580 5581 5582 5583 5584 5585 5586 5587 5588 5589 5590 5591 5592 5593
static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
					    struct sk_buff *skb)
{
	struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

	if (ev->status)
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
	if (conn) {
		conn->le_conn_interval = le16_to_cpu(ev->interval);
		conn->le_conn_latency = le16_to_cpu(ev->latency);
		conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
	}

	hci_dev_unlock(hdev);
}

5594
/* This function requires the caller holds hdev->lock */
5595 5596
static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
					      bdaddr_t *addr,
5597 5598
					      u8 addr_type, bool addr_resolved,
					      u8 adv_type, bdaddr_t *direct_rpa)
5599 5600
{
	struct hci_conn *conn;
5601
	struct hci_conn_params *params;
5602

5603 5604
	/* If the event is not connectable don't proceed further */
	if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5605
		return NULL;
5606

5607 5608 5609
	/* Ignore if the device is blocked or hdev is suspended */
	if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
	    hdev->suspended)
5610
		return NULL;
5611

5612
	/* Most controller will fail if we try to create new connections
5613
	 * while we have an existing one in peripheral role.
5614
	 */
5615
	if (hdev->conn_hash.le_num_peripheral > 0 &&
5616 5617
	    (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
	     !(hdev->le_states[3] & 0x10)))
5618
		return NULL;
5619

5620 5621 5622
	/* If we're not connectable only connect devices that we have in
	 * our pend_le_conns list.
	 */
5623 5624
	params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
					   addr_type);
5625
	if (!params)
5626
		return NULL;
5627

5628 5629 5630 5631 5632
	if (!params->explicit_connect) {
		switch (params->auto_connect) {
		case HCI_AUTO_CONN_DIRECT:
			/* Only devices advertising with ADV_DIRECT_IND are
			 * triggering a connection attempt. This is allowing
5633
			 * incoming connections from peripheral devices.
5634 5635 5636 5637 5638 5639 5640
			 */
			if (adv_type != LE_ADV_DIRECT_IND)
				return NULL;
			break;
		case HCI_AUTO_CONN_ALWAYS:
			/* Devices advertising with ADV_IND or ADV_DIRECT_IND
			 * are triggering a connection attempt. This means
5641 5642
			 * that incoming connections from peripheral device are
			 * accepted and also outgoing connections to peripheral
5643 5644 5645 5646
			 * devices are established when found.
			 */
			break;
		default:
5647
			return NULL;
5648
		}
5649
	}
5650

5651 5652 5653
	conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
			      BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
			      HCI_ROLE_MASTER, direct_rpa);
5654
	if (!IS_ERR(conn)) {
5655 5656 5657
		/* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
		 * by higher layer that tried to connect, if no then
		 * store the pointer since we don't really have any
5658 5659 5660 5661 5662
		 * other owner of the object besides the params that
		 * triggered it. This way we can abort the connection if
		 * the parameters get removed and keep the reference
		 * count consistent once the connection is established.
		 */
5663 5664 5665 5666

		if (!params->explicit_connect)
			params->conn = hci_conn_get(conn);

5667
		return conn;
5668
	}
5669 5670 5671 5672 5673 5674 5675 5676 5677 5678 5679

	switch (PTR_ERR(conn)) {
	case -EBUSY:
		/* If hci_connect() returns -EBUSY it means there is already
		 * an LE connection attempt going on. Since controllers don't
		 * support more than one connection attempt at the time, we
		 * don't consider this an error case.
		 */
		break;
	default:
		BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5680
		return NULL;
5681
	}
5682 5683

	return NULL;
5684 5685
}

5686
static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5687
			       u8 bdaddr_type, bdaddr_t *direct_addr,
5688 5689
			       u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
			       bool ext_adv)
5690
{
5691
	struct discovery_state *d = &hdev->discovery;
5692
	struct smp_irk *irk;
5693
	struct hci_conn *conn;
5694
	bool match, bdaddr_resolved;
5695
	u32 flags;
5696
	u8 *ptr;
5697

5698 5699 5700 5701 5702 5703 5704 5705
	switch (type) {
	case LE_ADV_IND:
	case LE_ADV_DIRECT_IND:
	case LE_ADV_SCAN_IND:
	case LE_ADV_NONCONN_IND:
	case LE_ADV_SCAN_RSP:
		break;
	default:
5706 5707
		bt_dev_err_ratelimited(hdev, "unknown advertising packet "
				       "type: 0x%02x", type);
5708 5709 5710
		return;
	}

5711 5712 5713 5714 5715
	if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
		bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
		return;
	}

5716 5717 5718 5719 5720 5721 5722 5723 5724 5725 5726
	/* Find the end of the data in case the report contains padded zero
	 * bytes at the end causing an invalid length value.
	 *
	 * When data is NULL, len is 0 so there is no need for extra ptr
	 * check as 'ptr < data + 0' is already false in such case.
	 */
	for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
		if (ptr + 1 + *ptr > data + len)
			break;
	}

5727 5728 5729 5730
	/* Adjust for actual length. This handles the case when remote
	 * device is advertising with incorrect data length.
	 */
	len = ptr - data;
5731

5732 5733 5734 5735 5736 5737
	/* If the direct address is present, then this report is from
	 * a LE Direct Advertising Report event. In that case it is
	 * important to see if the address is matching the local
	 * controller address.
	 */
	if (direct_addr) {
5738 5739
		direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
						  &bdaddr_resolved);
5740

5741 5742 5743 5744 5745 5746 5747 5748 5749
		/* Only resolvable random addresses are valid for these
		 * kind of reports and others can be ignored.
		 */
		if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
			return;

		/* If the controller is not using resolvable random
		 * addresses, then this report can be ignored.
		 */
5750
		if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5751 5752 5753 5754 5755 5756 5757 5758 5759 5760
			return;

		/* If the local IRK of the controller does not match
		 * with the resolvable random address provided, then
		 * this report can be ignored.
		 */
		if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
			return;
	}

5761 5762 5763 5764 5765 5766 5767
	/* Check if we need to convert to identity address */
	irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
	if (irk) {
		bdaddr = &irk->bdaddr;
		bdaddr_type = irk->addr_type;
	}

5768
	bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
5769

5770 5771 5772 5773 5774
	/* Check if we have been requested to connect to this device.
	 *
	 * direct_addr is set only for directed advertising reports (it is NULL
	 * for advertising reports) and is already verified to be RPA above.
	 */
5775 5776
	conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
				     type, direct_addr);
5777
	if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5778 5779 5780 5781 5782 5783
		/* Store report for later inclusion by
		 * mgmt_device_connected
		 */
		memcpy(conn->le_adv_data, data, len);
		conn->le_adv_data_len = len;
	}
5784

5785 5786
	/* Passive scanning shouldn't trigger any device found events,
	 * except for devices marked as CONN_REPORT for which we do send
5787
	 * device found events, or advertisement monitoring requested.
5788
	 */
5789
	if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5790 5791 5792
		if (type == LE_ADV_DIRECT_IND)
			return;

5793
		if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5794 5795
					       bdaddr, bdaddr_type) &&
		    idr_is_empty(&hdev->adv_monitors_idr))
5796 5797 5798 5799 5800 5801 5802 5803
			return;

		if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
			flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
		else
			flags = 0;
		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
				  rssi, flags, data, len, NULL, 0);
5804
		return;
5805
	}
5806

5807 5808 5809 5810 5811 5812 5813 5814 5815 5816 5817 5818 5819 5820 5821 5822 5823 5824 5825 5826 5827
	/* When receiving non-connectable or scannable undirected
	 * advertising reports, this means that the remote device is
	 * not connectable and then clearly indicate this in the
	 * device found event.
	 *
	 * When receiving a scan response, then there is no way to
	 * know if the remote device is connectable or not. However
	 * since scan responses are merged with a previously seen
	 * advertising report, the flags field from that report
	 * will be used.
	 *
	 * In the really unlikely case that a controller get confused
	 * and just sends a scan response event, then it is marked as
	 * not connectable as well.
	 */
	if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
	    type == LE_ADV_SCAN_RSP)
		flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
	else
		flags = 0;

5828 5829 5830 5831
	/* If there's nothing pending either store the data from this
	 * event or send an immediate device found event if the data
	 * should not be stored for later.
	 */
5832
	if (!ext_adv &&	!has_pending_adv_report(hdev)) {
5833 5834 5835 5836 5837
		/* If the report will trigger a SCAN_REQ store it for
		 * later merging.
		 */
		if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5838
						 rssi, flags, data, len);
5839 5840 5841 5842
			return;
		}

		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5843
				  rssi, flags, data, len, NULL, 0);
5844 5845 5846
		return;
	}

5847 5848 5849 5850
	/* Check if the pending report is for the same device as the new one */
	match = (!bacmp(bdaddr, &d->last_adv_addr) &&
		 bdaddr_type == d->last_adv_addr_type);

5851 5852 5853 5854
	/* If the pending data doesn't match this report or this isn't a
	 * scan response (e.g. we got a duplicate ADV_IND) then force
	 * sending of the pending data.
	 */
5855 5856 5857 5858
	if (type != LE_ADV_SCAN_RSP || !match) {
		/* Send out whatever is in the cache, but skip duplicates */
		if (!match)
			mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5859
					  d->last_adv_addr_type, NULL,
5860
					  d->last_adv_rssi, d->last_adv_flags,
5861
					  d->last_adv_data,
5862
					  d->last_adv_data_len, NULL, 0);
5863 5864 5865 5866

		/* If the new report will trigger a SCAN_REQ store it for
		 * later merging.
		 */
5867 5868
		if (!ext_adv && (type == LE_ADV_IND ||
				 type == LE_ADV_SCAN_IND)) {
5869
			store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5870
						 rssi, flags, data, len);
5871 5872 5873 5874 5875 5876 5877
			return;
		}

		/* The advertising reports cannot be merged, so clear
		 * the pending report and send out a device found event.
		 */
		clear_pending_adv_report(hdev);
5878
		mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5879
				  rssi, flags, data, len, NULL, 0);
5880 5881 5882 5883 5884 5885 5886 5887
		return;
	}

	/* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
	 * the new event is a SCAN_RSP. We can therefore proceed with
	 * sending a merged device found event.
	 */
	mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5888
			  d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5889
			  d->last_adv_data, d->last_adv_data_len, data, len);
5890
	clear_pending_adv_report(hdev);
5891 5892
}

5893
static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5894
{
5895 5896
	u8 num_reports = skb->data[0];
	void *ptr = &skb->data[1];
5897

5898 5899
	hci_dev_lock(hdev);

5900 5901
	while (num_reports--) {
		struct hci_ev_le_advertising_info *ev = ptr;
5902
		s8 rssi;
5903

5904 5905
		if (ev->length <= HCI_MAX_AD_LENGTH &&
		    ev->data + ev->length <= skb_tail_pointer(skb)) {
5906 5907 5908
			rssi = ev->data[ev->length];
			process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
					   ev->bdaddr_type, NULL, 0, rssi,
5909
					   ev->data, ev->length, false);
5910 5911 5912
		} else {
			bt_dev_err(hdev, "Dropping invalid advertising data");
		}
A
Andre Guedes 已提交
5913

5914
		ptr += sizeof(*ev) + ev->length + 1;
5915 5916 5917 5918 5919

		if (ptr > (void *) skb_tail_pointer(skb) - sizeof(*ev)) {
			bt_dev_err(hdev, "Malicious advertising data. Stopping processing");
			break;
		}
5920
	}
5921 5922

	hci_dev_unlock(hdev);
5923 5924
}

5925
static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5926 5927 5928 5929 5930 5931 5932 5933 5934 5935 5936 5937 5938 5939 5940 5941
{
	if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
		switch (evt_type) {
		case LE_LEGACY_ADV_IND:
			return LE_ADV_IND;
		case LE_LEGACY_ADV_DIRECT_IND:
			return LE_ADV_DIRECT_IND;
		case LE_LEGACY_ADV_SCAN_IND:
			return LE_ADV_SCAN_IND;
		case LE_LEGACY_NONCONN_IND:
			return LE_ADV_NONCONN_IND;
		case LE_LEGACY_SCAN_RSP_ADV:
		case LE_LEGACY_SCAN_RSP_ADV_SCAN:
			return LE_ADV_SCAN_RSP;
		}

5942
		goto invalid;
5943 5944 5945 5946 5947 5948
	}

	if (evt_type & LE_EXT_ADV_CONN_IND) {
		if (evt_type & LE_EXT_ADV_DIRECT_IND)
			return LE_ADV_DIRECT_IND;

5949
		return LE_ADV_IND;
5950 5951 5952 5953 5954 5955
	}

	if (evt_type & LE_EXT_ADV_SCAN_RSP)
		return LE_ADV_SCAN_RSP;

	if (evt_type & LE_EXT_ADV_SCAN_IND)
5956
		return LE_ADV_SCAN_IND;
5957 5958 5959

	if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
	    evt_type & LE_EXT_ADV_DIRECT_IND)
5960 5961
		return LE_ADV_NONCONN_IND;

5962 5963 5964
invalid:
	bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
			       evt_type);
5965 5966 5967 5968 5969 5970 5971 5972 5973 5974 5975 5976 5977 5978 5979 5980 5981

	return LE_ADV_INVALID;
}

static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	u8 num_reports = skb->data[0];
	void *ptr = &skb->data[1];

	hci_dev_lock(hdev);

	while (num_reports--) {
		struct hci_ev_le_ext_adv_report *ev = ptr;
		u8 legacy_evt_type;
		u16 evt_type;

		evt_type = __le16_to_cpu(ev->evt_type);
5982
		legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5983 5984 5985
		if (legacy_evt_type != LE_ADV_INVALID) {
			process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
					   ev->bdaddr_type, NULL, 0, ev->rssi,
5986 5987
					   ev->data, ev->length,
					   !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5988 5989
		}

5990
		ptr += sizeof(*ev) + ev->length;
5991 5992 5993 5994 5995
	}

	hci_dev_unlock(hdev);
}

5996 5997 5998 5999 6000 6001 6002 6003 6004 6005 6006 6007 6008 6009 6010 6011 6012 6013
static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
					    struct sk_buff *skb)
{
	struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
	if (conn) {
		if (!ev->status)
			memcpy(conn->features[0], ev->features, 8);

		if (conn->state == BT_CONFIG) {
			__u8 status;

6014
			/* If the local controller supports peripheral-initiated
6015 6016 6017 6018 6019 6020 6021 6022
			 * features exchange, but the remote controller does
			 * not, then it is possible that the error code 0x1a
			 * for unsupported remote feature gets returned.
			 *
			 * In this specific case, allow the connection to
			 * transition into connected state and mark it as
			 * successful.
			 */
6023 6024
			if (!conn->out && ev->status == 0x1a &&
			    (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6025 6026 6027 6028 6029 6030 6031 6032 6033 6034 6035 6036 6037
				status = 0x00;
			else
				status = ev->status;

			conn->state = BT_CONNECTED;
			hci_connect_cfm(conn, status);
			hci_conn_drop(conn);
		}
	}

	hci_dev_unlock(hdev);
}

6038
static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
6039 6040 6041
{
	struct hci_ev_le_ltk_req *ev = (void *) skb->data;
	struct hci_cp_le_ltk_reply cp;
6042
	struct hci_cp_le_ltk_neg_reply neg;
6043
	struct hci_conn *conn;
6044
	struct smp_ltk *ltk;
6045

6046
	BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
6047 6048 6049 6050

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6051 6052
	if (conn == NULL)
		goto not_found;
6053

6054
	ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6055
	if (!ltk)
6056 6057
		goto not_found;

6058 6059 6060 6061 6062 6063 6064 6065 6066 6067
	if (smp_ltk_is_sc(ltk)) {
		/* With SC both EDiv and Rand are set to zero */
		if (ev->ediv || ev->rand)
			goto not_found;
	} else {
		/* For non-SC keys check that EDiv and Rand match */
		if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
			goto not_found;
	}

6068 6069
	memcpy(cp.ltk, ltk->val, ltk->enc_size);
	memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6070
	cp.handle = cpu_to_le16(conn->handle);
6071

6072
	conn->pending_sec_level = smp_ltk_sec_level(ltk);
6073

6074
	conn->enc_key_size = ltk->enc_size;
6075 6076 6077

	hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);

6078 6079 6080 6081 6082 6083
	/* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
	 * temporary key used to encrypt a connection following
	 * pairing. It is used during the Encrypted Session Setup to
	 * distribute the keys. Later, security can be re-established
	 * using a distributed LTK.
	 */
6084
	if (ltk->type == SMP_STK) {
6085
		set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
J
Johan Hedberg 已提交
6086 6087
		list_del_rcu(&ltk->list);
		kfree_rcu(ltk, rcu);
6088 6089
	} else {
		clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6090 6091
	}

6092
	hci_dev_unlock(hdev);
6093 6094 6095 6096 6097 6098 6099

	return;

not_found:
	neg.handle = ev->handle;
	hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
	hci_dev_unlock(hdev);
6100 6101
}

6102 6103 6104 6105 6106 6107 6108 6109 6110 6111 6112 6113 6114 6115 6116 6117 6118 6119 6120 6121 6122 6123 6124 6125 6126 6127 6128 6129 6130 6131 6132 6133 6134 6135 6136
static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
				      u8 reason)
{
	struct hci_cp_le_conn_param_req_neg_reply cp;

	cp.handle = cpu_to_le16(handle);
	cp.reason = reason;

	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
		     &cp);
}

static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
					     struct sk_buff *skb)
{
	struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
	struct hci_cp_le_conn_param_req_reply cp;
	struct hci_conn *hcon;
	u16 handle, min, max, latency, timeout;

	handle = le16_to_cpu(ev->handle);
	min = le16_to_cpu(ev->interval_min);
	max = le16_to_cpu(ev->interval_max);
	latency = le16_to_cpu(ev->latency);
	timeout = le16_to_cpu(ev->timeout);

	hcon = hci_conn_hash_lookup_handle(hdev, handle);
	if (!hcon || hcon->state != BT_CONNECTED)
		return send_conn_param_neg_reply(hdev, handle,
						 HCI_ERROR_UNKNOWN_CONN_ID);

	if (hci_check_conn_params(min, max, latency, timeout))
		return send_conn_param_neg_reply(hdev, handle,
						 HCI_ERROR_INVALID_LL_PARAMS);

6137
	if (hcon->role == HCI_ROLE_MASTER) {
6138
		struct hci_conn_params *params;
6139
		u8 store_hint;
6140 6141 6142 6143 6144 6145 6146 6147 6148 6149

		hci_dev_lock(hdev);

		params = hci_conn_params_lookup(hdev, &hcon->dst,
						hcon->dst_type);
		if (params) {
			params->conn_min_interval = min;
			params->conn_max_interval = max;
			params->conn_latency = latency;
			params->supervision_timeout = timeout;
6150
			store_hint = 0x01;
M
Meng Yu 已提交
6151
		} else {
6152
			store_hint = 0x00;
6153 6154 6155 6156
		}

		hci_dev_unlock(hdev);

6157 6158
		mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
				    store_hint, min, max, latency, timeout);
6159
	}
6160

6161 6162 6163 6164 6165 6166 6167 6168 6169 6170 6171
	cp.handle = ev->handle;
	cp.interval_min = ev->interval_min;
	cp.interval_max = ev->interval_max;
	cp.latency = ev->latency;
	cp.timeout = ev->timeout;
	cp.min_ce_len = 0;
	cp.max_ce_len = 0;

	hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
}

6172 6173 6174 6175
static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
					 struct sk_buff *skb)
{
	u8 num_reports = skb->data[0];
6176
	struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6177

6178 6179
	if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
		return;
6180

6181
	hci_dev_lock(hdev);
6182

6183
	for (; num_reports; num_reports--, ev++)
6184 6185
		process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
				   ev->bdaddr_type, &ev->direct_addr,
6186 6187
				   ev->direct_addr_type, ev->rssi, NULL, 0,
				   false);
6188 6189 6190 6191

	hci_dev_unlock(hdev);
}

6192 6193 6194 6195 6196 6197 6198
static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
	struct hci_conn *conn;

	BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);

6199
	if (ev->status)
6200 6201 6202 6203 6204 6205 6206 6207 6208 6209 6210 6211 6212 6213 6214
		return;

	hci_dev_lock(hdev);

	conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
	if (!conn)
		goto unlock;

	conn->le_tx_phy = ev->tx_phy;
	conn->le_rx_phy = ev->rx_phy;

unlock:
	hci_dev_unlock(hdev);
}

6215
static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
V
Ville Tervo 已提交
6216 6217 6218 6219 6220 6221 6222 6223 6224 6225
{
	struct hci_ev_le_meta *le_ev = (void *) skb->data;

	skb_pull(skb, sizeof(*le_ev));

	switch (le_ev->subevent) {
	case HCI_EV_LE_CONN_COMPLETE:
		hci_le_conn_complete_evt(hdev, skb);
		break;

6226 6227 6228 6229
	case HCI_EV_LE_CONN_UPDATE_COMPLETE:
		hci_le_conn_update_complete_evt(hdev, skb);
		break;

6230 6231 6232 6233
	case HCI_EV_LE_ADVERTISING_REPORT:
		hci_le_adv_report_evt(hdev, skb);
		break;

6234 6235 6236 6237
	case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
		hci_le_remote_feat_complete_evt(hdev, skb);
		break;

6238 6239 6240 6241
	case HCI_EV_LE_LTK_REQ:
		hci_le_ltk_request_evt(hdev, skb);
		break;

6242 6243 6244 6245
	case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
		hci_le_remote_conn_param_req_evt(hdev, skb);
		break;

6246 6247 6248 6249
	case HCI_EV_LE_DIRECT_ADV_REPORT:
		hci_le_direct_adv_report_evt(hdev, skb);
		break;

6250 6251 6252 6253
	case HCI_EV_LE_PHY_UPDATE_COMPLETE:
		hci_le_phy_update_evt(hdev, skb);
		break;

6254 6255 6256 6257
	case HCI_EV_LE_EXT_ADV_REPORT:
		hci_le_ext_adv_report_evt(hdev, skb);
		break;

6258 6259 6260 6261
	case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
		hci_le_enh_conn_complete_evt(hdev, skb);
		break;

6262 6263 6264 6265
	case HCI_EV_LE_EXT_ADV_SET_TERM:
		hci_le_ext_adv_term_evt(hdev, skb);
		break;

V
Ville Tervo 已提交
6266 6267 6268 6269 6270
	default:
		break;
	}
}

6271 6272 6273 6274 6275 6276 6277 6278 6279 6280
static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
				 u8 event, struct sk_buff *skb)
{
	struct hci_ev_cmd_complete *ev;
	struct hci_event_hdr *hdr;

	if (!skb)
		return false;

	if (skb->len < sizeof(*hdr)) {
6281
		bt_dev_err(hdev, "too short HCI event");
6282 6283 6284 6285 6286 6287 6288 6289 6290 6291 6292 6293
		return false;
	}

	hdr = (void *) skb->data;
	skb_pull(skb, HCI_EVENT_HDR_SIZE);

	if (event) {
		if (hdr->evt != event)
			return false;
		return true;
	}

Z
Zheng Yongjun 已提交
6294
	/* Check if request ended in Command Status - no way to retrieve
6295 6296 6297 6298 6299
	 * any extra parameters in this case.
	 */
	if (hdr->evt == HCI_EV_CMD_STATUS)
		return false;

6300
	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6301 6302
		bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
			   hdr->evt);
6303 6304 6305 6306
		return false;
	}

	if (skb->len < sizeof(*ev)) {
6307
		bt_dev_err(hdev, "too short cmd_complete event");
6308 6309 6310 6311 6312 6313 6314 6315 6316 6317 6318 6319 6320 6321 6322
		return false;
	}

	ev = (void *) skb->data;
	skb_pull(skb, sizeof(*ev));

	if (opcode != __le16_to_cpu(ev->opcode)) {
		BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
		       __le16_to_cpu(ev->opcode));
		return false;
	}

	return true;
}

6323 6324 6325 6326 6327 6328 6329 6330 6331 6332 6333 6334 6335 6336 6337 6338 6339 6340 6341 6342 6343 6344 6345 6346 6347 6348 6349 6350 6351 6352 6353 6354 6355 6356 6357 6358 6359 6360 6361 6362 6363 6364 6365 6366 6367 6368 6369 6370 6371 6372 6373 6374 6375 6376 6377 6378 6379 6380 6381 6382 6383 6384 6385 6386 6387 6388 6389 6390 6391
static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
				  struct sk_buff *skb)
{
	struct hci_ev_le_advertising_info *adv;
	struct hci_ev_le_direct_adv_info *direct_adv;
	struct hci_ev_le_ext_adv_report *ext_adv;
	const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
	const struct hci_ev_conn_request *conn_request = (void *)skb->data;

	hci_dev_lock(hdev);

	/* If we are currently suspended and this is the first BT event seen,
	 * save the wake reason associated with the event.
	 */
	if (!hdev->suspended || hdev->wake_reason)
		goto unlock;

	/* Default to remote wake. Values for wake_reason are documented in the
	 * Bluez mgmt api docs.
	 */
	hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;

	/* Once configured for remote wakeup, we should only wake up for
	 * reconnections. It's useful to see which device is waking us up so
	 * keep track of the bdaddr of the connection event that woke us up.
	 */
	if (event == HCI_EV_CONN_REQUEST) {
		bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
		hdev->wake_addr_type = BDADDR_BREDR;
	} else if (event == HCI_EV_CONN_COMPLETE) {
		bacpy(&hdev->wake_addr, &conn_request->bdaddr);
		hdev->wake_addr_type = BDADDR_BREDR;
	} else if (event == HCI_EV_LE_META) {
		struct hci_ev_le_meta *le_ev = (void *)skb->data;
		u8 subevent = le_ev->subevent;
		u8 *ptr = &skb->data[sizeof(*le_ev)];
		u8 num_reports = *ptr;

		if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
		     subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
		     subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
		    num_reports) {
			adv = (void *)(ptr + 1);
			direct_adv = (void *)(ptr + 1);
			ext_adv = (void *)(ptr + 1);

			switch (subevent) {
			case HCI_EV_LE_ADVERTISING_REPORT:
				bacpy(&hdev->wake_addr, &adv->bdaddr);
				hdev->wake_addr_type = adv->bdaddr_type;
				break;
			case HCI_EV_LE_DIRECT_ADV_REPORT:
				bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
				hdev->wake_addr_type = direct_adv->bdaddr_type;
				break;
			case HCI_EV_LE_EXT_ADV_REPORT:
				bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
				hdev->wake_addr_type = ext_adv->bdaddr_type;
				break;
			}
		}
	} else {
		hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
	}

unlock:
	hci_dev_unlock(hdev);
}

6392 6393 6394
void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
{
	struct hci_event_hdr *hdr = (void *) skb->data;
6395 6396 6397
	hci_req_complete_t req_complete = NULL;
	hci_req_complete_skb_t req_complete_skb = NULL;
	struct sk_buff *orig_skb = NULL;
6398
	u8 status = 0, event = hdr->evt, req_evt = 0;
6399
	u16 opcode = HCI_OP_NOP;
6400

6401 6402 6403 6404 6405
	if (!event) {
		bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
		goto done;
	}

6406
	if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6407
		struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6408 6409 6410
		opcode = __le16_to_cpu(cmd_hdr->opcode);
		hci_req_cmd_complete(hdev, opcode, status, &req_complete,
				     &req_complete_skb);
6411
		req_evt = event;
6412 6413
	}

6414 6415 6416 6417 6418 6419 6420 6421 6422 6423 6424
	/* If it looks like we might end up having to call
	 * req_complete_skb, store a pristine copy of the skb since the
	 * various handlers may modify the original one through
	 * skb_pull() calls, etc.
	 */
	if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
	    event == HCI_EV_CMD_COMPLETE)
		orig_skb = skb_clone(skb, GFP_KERNEL);

	skb_pull(skb, HCI_EVENT_HDR_SIZE);

6425 6426 6427
	/* Store wake reason if we're suspended */
	hci_store_wake_reason(hdev, event, skb);

6428
	switch (event) {
L
Linus Torvalds 已提交
6429 6430 6431 6432 6433 6434 6435 6436
	case HCI_EV_INQUIRY_COMPLETE:
		hci_inquiry_complete_evt(hdev, skb);
		break;

	case HCI_EV_INQUIRY_RESULT:
		hci_inquiry_result_evt(hdev, skb);
		break;

6437 6438
	case HCI_EV_CONN_COMPLETE:
		hci_conn_complete_evt(hdev, skb);
6439 6440
		break;

L
Linus Torvalds 已提交
6441 6442 6443 6444 6445 6446 6447 6448 6449 6450 6451 6452
	case HCI_EV_CONN_REQUEST:
		hci_conn_request_evt(hdev, skb);
		break;

	case HCI_EV_DISCONN_COMPLETE:
		hci_disconn_complete_evt(hdev, skb);
		break;

	case HCI_EV_AUTH_COMPLETE:
		hci_auth_complete_evt(hdev, skb);
		break;

6453 6454 6455 6456
	case HCI_EV_REMOTE_NAME:
		hci_remote_name_evt(hdev, skb);
		break;

L
Linus Torvalds 已提交
6457 6458 6459 6460
	case HCI_EV_ENCRYPT_CHANGE:
		hci_encrypt_change_evt(hdev, skb);
		break;

6461 6462 6463 6464 6465 6466 6467 6468 6469
	case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
		hci_change_link_key_complete_evt(hdev, skb);
		break;

	case HCI_EV_REMOTE_FEATURES:
		hci_remote_features_evt(hdev, skb);
		break;

	case HCI_EV_CMD_COMPLETE:
6470 6471
		hci_cmd_complete_evt(hdev, skb, &opcode, &status,
				     &req_complete, &req_complete_skb);
6472 6473 6474
		break;

	case HCI_EV_CMD_STATUS:
6475 6476
		hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
				   &req_complete_skb);
6477 6478
		break;

6479 6480 6481 6482
	case HCI_EV_HARDWARE_ERROR:
		hci_hardware_error_evt(hdev, skb);
		break;

6483 6484 6485 6486 6487 6488 6489 6490 6491 6492
	case HCI_EV_ROLE_CHANGE:
		hci_role_change_evt(hdev, skb);
		break;

	case HCI_EV_NUM_COMP_PKTS:
		hci_num_comp_pkts_evt(hdev, skb);
		break;

	case HCI_EV_MODE_CHANGE:
		hci_mode_change_evt(hdev, skb);
L
Linus Torvalds 已提交
6493 6494 6495 6496 6497 6498 6499 6500 6501 6502 6503 6504 6505 6506 6507 6508 6509 6510
		break;

	case HCI_EV_PIN_CODE_REQ:
		hci_pin_code_request_evt(hdev, skb);
		break;

	case HCI_EV_LINK_KEY_REQ:
		hci_link_key_request_evt(hdev, skb);
		break;

	case HCI_EV_LINK_KEY_NOTIFY:
		hci_link_key_notify_evt(hdev, skb);
		break;

	case HCI_EV_CLOCK_OFFSET:
		hci_clock_offset_evt(hdev, skb);
		break;

6511 6512 6513 6514
	case HCI_EV_PKT_TYPE_CHANGE:
		hci_pkt_type_change_evt(hdev, skb);
		break;

6515 6516 6517 6518
	case HCI_EV_PSCAN_REP_MODE:
		hci_pscan_rep_mode_evt(hdev, skb);
		break;

6519 6520
	case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
		hci_inquiry_result_with_rssi_evt(hdev, skb);
6521 6522
		break;

6523 6524
	case HCI_EV_REMOTE_EXT_FEATURES:
		hci_remote_ext_features_evt(hdev, skb);
L
Linus Torvalds 已提交
6525 6526
		break;

6527 6528 6529
	case HCI_EV_SYNC_CONN_COMPLETE:
		hci_sync_conn_complete_evt(hdev, skb);
		break;
L
Linus Torvalds 已提交
6530

6531 6532 6533
	case HCI_EV_EXTENDED_INQUIRY_RESULT:
		hci_extended_inquiry_result_evt(hdev, skb);
		break;
L
Linus Torvalds 已提交
6534

6535 6536 6537 6538
	case HCI_EV_KEY_REFRESH_COMPLETE:
		hci_key_refresh_complete_evt(hdev, skb);
		break;

6539 6540 6541 6542
	case HCI_EV_IO_CAPA_REQUEST:
		hci_io_capa_request_evt(hdev, skb);
		break;

6543 6544 6545 6546
	case HCI_EV_IO_CAPA_REPLY:
		hci_io_capa_reply_evt(hdev, skb);
		break;

6547 6548 6549 6550
	case HCI_EV_USER_CONFIRM_REQUEST:
		hci_user_confirm_request_evt(hdev, skb);
		break;

6551 6552 6553 6554
	case HCI_EV_USER_PASSKEY_REQUEST:
		hci_user_passkey_request_evt(hdev, skb);
		break;

6555 6556 6557 6558 6559 6560 6561 6562
	case HCI_EV_USER_PASSKEY_NOTIFY:
		hci_user_passkey_notify_evt(hdev, skb);
		break;

	case HCI_EV_KEYPRESS_NOTIFY:
		hci_keypress_notify_evt(hdev, skb);
		break;

6563 6564 6565 6566
	case HCI_EV_SIMPLE_PAIR_COMPLETE:
		hci_simple_pair_complete_evt(hdev, skb);
		break;

6567 6568 6569 6570
	case HCI_EV_REMOTE_HOST_FEATURES:
		hci_remote_host_features_evt(hdev, skb);
		break;

V
Ville Tervo 已提交
6571 6572 6573 6574
	case HCI_EV_LE_META:
		hci_le_meta_evt(hdev, skb);
		break;

6575 6576 6577 6578
	case HCI_EV_REMOTE_OOB_DATA_REQUEST:
		hci_remote_oob_data_request_evt(hdev, skb);
		break;

6579 6580 6581 6582 6583
#if IS_ENABLED(CONFIG_BT_HS)
	case HCI_EV_CHANNEL_SELECTED:
		hci_chan_selected_evt(hdev, skb);
		break;

6584 6585 6586 6587
	case HCI_EV_PHY_LINK_COMPLETE:
		hci_phy_link_complete_evt(hdev, skb);
		break;

6588 6589 6590 6591
	case HCI_EV_LOGICAL_LINK_COMPLETE:
		hci_loglink_complete_evt(hdev, skb);
		break;

6592 6593 6594 6595
	case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
		hci_disconn_loglink_complete_evt(hdev, skb);
		break;

6596 6597 6598
	case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
		hci_disconn_phylink_complete_evt(hdev, skb);
		break;
6599
#endif
6600

6601 6602 6603 6604
	case HCI_EV_NUM_COMP_BLOCKS:
		hci_num_comp_blocks_evt(hdev, skb);
		break;

6605 6606 6607 6608
	case HCI_EV_VENDOR:
		msft_vendor_evt(hdev, skb);
		break;

6609
	default:
6610
		BT_DBG("%s event 0x%2.2x", hdev->name, event);
L
Linus Torvalds 已提交
6611 6612 6613
		break;
	}

6614
	if (req_complete) {
6615
		req_complete(hdev, status, opcode);
6616 6617 6618 6619 6620
	} else if (req_complete_skb) {
		if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
			kfree_skb(orig_skb);
			orig_skb = NULL;
		}
6621
		req_complete_skb(hdev, status, opcode, orig_skb);
6622
	}
6623

6624
done:
6625
	kfree_skb(orig_skb);
L
Linus Torvalds 已提交
6626 6627 6628
	kfree_skb(skb);
	hdev->stat.evt_rx++;
}