projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Only set ack_timer if we didn't send and ack
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <linux/module.h>
28
29#include <linux/types.h>
30#include <linux/errno.h>
31#include <linux/kernel.h>
1da177e4
LT		 32#include <linux/slab.h>
33#include <linux/poll.h>
34#include <linux/fcntl.h>
35#include <linux/init.h>
36#include <linux/skbuff.h>
37#include <linux/interrupt.h>
38#include <linux/notifier.h>
39#include <net/sock.h>
40
41#include <asm/system.h>
70f23020 42#include <linux/uaccess.h>
1da177e4
LT		 43#include <asm/unaligned.h>
44
45#include <net/bluetooth/bluetooth.h>
46#include <net/bluetooth/hci_core.h>
47
e6100a25
AG		 48static int enable_le;
49
1da177e4
LT		 50/* Handle HCI Event packets */
51
a9de9248 52static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 53{
a9de9248 54 __u8 status = *((__u8 *) skb->data);
1da177e4 55
a9de9248 56 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 57
a9de9248
MH		 58 if (status)
59 return;
1da177e4 60
89352e7d
AG		 61 clear_bit(HCI_INQUIRY, &hdev->flags);
62
56e5cb86 63 hci_dev_lock(hdev);
744cf19e 64 mgmt_discovering(hdev, 0);
56e5cb86 65 hci_dev_unlock(hdev);
6bd57416 66
23bb5763 67 hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
a9de9248
MH		 68
69 hci_conn_check_pending(hdev);
70}
6bd57416 71
a9de9248
MH		 72static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
73{
74 __u8 status = *((__u8 *) skb->data);
6bd57416 75
a9de9248 76 BT_DBG("%s status 0x%x", hdev->name, status);
6bd57416 77
a9de9248
MH		 78 if (status)
79 return;
1da177e4 80
a9de9248
MH		 81 hci_conn_check_pending(hdev);
82}
83
84static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
85{
86 BT_DBG("%s", hdev->name);
87}
88
89static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
90{
91 struct hci_rp_role_discovery *rp = (void *) skb->data;
92 struct hci_conn *conn;
93
94 BT_DBG("%s status 0x%x", hdev->name, rp->status);
95
96 if (rp->status)
97 return;
98
99 hci_dev_lock(hdev);
100
101 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
102 if (conn) {
103 if (rp->role)
104 conn->link_mode &= ~HCI_LM_MASTER;
105 else
106 conn->link_mode |= HCI_LM_MASTER;
1da177e4 107 }
a9de9248
MH		 108
109 hci_dev_unlock(hdev);
1da177e4
LT		 110}
111
e4e8e37c
MH		 112static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
113{
114 struct hci_rp_read_link_policy *rp = (void *) skb->data;
115 struct hci_conn *conn;
116
117 BT_DBG("%s status 0x%x", hdev->name, rp->status);
118
119 if (rp->status)
120 return;
121
122 hci_dev_lock(hdev);
123
124 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
125 if (conn)
126 conn->link_policy = __le16_to_cpu(rp->policy);
127
128 hci_dev_unlock(hdev);
129}
130
a9de9248 131static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 132{
a9de9248 133 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 134 struct hci_conn *conn;
04837f64 135 void *sent;
1da177e4 136
a9de9248 137 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 138
a9de9248
MH		 139 if (rp->status)
140 return;
1da177e4 141
a9de9248
MH		 142 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
143 if (!sent)
144 return;
1da177e4 145
a9de9248 146 hci_dev_lock(hdev);
1da177e4 147
a9de9248 148 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 149 if (conn)
83985319 150 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 151
a9de9248
MH		 152 hci_dev_unlock(hdev);
153}
1da177e4 154
e4e8e37c
MH		 155static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
156{
157 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
158
159 BT_DBG("%s status 0x%x", hdev->name, rp->status);
160
161 if (rp->status)
162 return;
163
164 hdev->link_policy = __le16_to_cpu(rp->policy);
165}
166
167static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
168{
169 __u8 status = *((__u8 *) skb->data);
170 void *sent;
171
172 BT_DBG("%s status 0x%x", hdev->name, status);
173
174 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
175 if (!sent)
176 return;
177
178 if (!status)
179 hdev->link_policy = get_unaligned_le16(sent);
180
23bb5763 181 hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
e4e8e37c
MH		 182}
183
a9de9248
MH		 184static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
185{
186 __u8 status = *((__u8 *) skb->data);
04837f64 187
a9de9248 188 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 189
10572132
GP		 190 clear_bit(HCI_RESET, &hdev->flags);
191
23bb5763 192 hci_req_complete(hdev, HCI_OP_RESET, status);
a9de9248 193}
04837f64 194
a9de9248
MH		 195static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
196{
197 __u8 status = *((__u8 *) skb->data);
198 void *sent;
04837f64 199
a9de9248 200 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 201
a9de9248
MH		 202 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
203 if (!sent)
204 return;
04837f64 205
56e5cb86
JH		 206 hci_dev_lock(hdev);
207
b312b161 208 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 209 mgmt_set_local_name_complete(hdev, sent, status);
b312b161 210
56e5cb86
JH		 211 if (status == 0)
212 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
b312b161 213
56e5cb86 214 hci_dev_unlock(hdev);
a9de9248
MH		 215}
216
217static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
218{
219 struct hci_rp_read_local_name *rp = (void *) skb->data;
220
221 BT_DBG("%s status 0x%x", hdev->name, rp->status);
222
223 if (rp->status)
224 return;
225
1f6c6378 226 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 227}
228
229static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
230{
231 __u8 status = *((__u8 *) skb->data);
232 void *sent;
233
234 BT_DBG("%s status 0x%x", hdev->name, status);
235
236 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
237 if (!sent)
238 return;
239
240 if (!status) {
241 __u8 param = *((__u8 *) sent);
242
243 if (param == AUTH_ENABLED)
244 set_bit(HCI_AUTH, &hdev->flags);
245 else
246 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 247 }
a9de9248 248
23bb5763 249 hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
1da177e4
LT		 250}
251
a9de9248 252static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 253{
a9de9248 254 __u8 status = *((__u8 *) skb->data);
1da177e4
LT		 255 void *sent;
256
a9de9248 257 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 258
a9de9248
MH		 259 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
260 if (!sent)
261 return;
1da177e4 262
a9de9248
MH		 263 if (!status) {
264 __u8 param = *((__u8 *) sent);
265
266 if (param)
267 set_bit(HCI_ENCRYPT, &hdev->flags);
268 else
269 clear_bit(HCI_ENCRYPT, &hdev->flags);
270 }
1da177e4 271
23bb5763 272 hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
a9de9248 273}
1da177e4 274
a9de9248
MH		 275static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
276{
36f7fc7e
JH		 277 __u8 param, status = *((__u8 *) skb->data);
278 int old_pscan, old_iscan;
a9de9248 279 void *sent;
1da177e4 280
a9de9248 281 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 282
a9de9248
MH		 283 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
284 if (!sent)
285 return;
1da177e4 286
36f7fc7e
JH		 287 param = *((__u8 *) sent);
288
56e5cb86
JH		 289 hci_dev_lock(hdev);
290
2d7cee58 291 if (status != 0) {
744cf19e 292 mgmt_write_scan_failed(hdev, param, status);
2d7cee58
JH		 293 hdev->discov_timeout = 0;
294 goto done;
295 }
296
36f7fc7e
JH		 297 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
298 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
299
300 if (param & SCAN_INQUIRY) {
301 set_bit(HCI_ISCAN, &hdev->flags);
302 if (!old_iscan)
744cf19e 303 mgmt_discoverable(hdev, 1);
16ab91ab
JH		 304 if (hdev->discov_timeout > 0) {
305 int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
306 queue_delayed_work(hdev->workqueue, &hdev->discov_off,
307 to);
308 }
36f7fc7e 309 } else if (old_iscan)
744cf19e 310 mgmt_discoverable(hdev, 0);
36f7fc7e
JH		 311
312 if (param & SCAN_PAGE) {
313 set_bit(HCI_PSCAN, &hdev->flags);
314 if (!old_pscan)
744cf19e 315 mgmt_connectable(hdev, 1);
36f7fc7e 316 } else if (old_pscan)
744cf19e 317 mgmt_connectable(hdev, 0);
1da177e4 318
36f7fc7e 319done:
56e5cb86 320 hci_dev_unlock(hdev);
23bb5763 321 hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
a9de9248 322}
1da177e4 323
a9de9248
MH		 324static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
325{
326 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 327
a9de9248 328 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 329
a9de9248
MH		 330 if (rp->status)
331 return;
1da177e4 332
a9de9248 333 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 334
a9de9248
MH		 335 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
336 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
337}
1da177e4 338
a9de9248
MH		 339static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
340{
341 __u8 status = *((__u8 *) skb->data);
342 void *sent;
1da177e4 343
a9de9248 344 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 345
f383f275
MH		 346 if (status)
347 return;
348
a9de9248
MH		 349 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
350 if (!sent)
351 return;
1da177e4 352
f383f275 353 memcpy(hdev->dev_class, sent, 3);
a9de9248 354}
1da177e4 355
a9de9248
MH		 356static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
357{
358 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
359 __u16 setting;
360
361 BT_DBG("%s status 0x%x", hdev->name, rp->status);
362
363 if (rp->status)
364 return;
365
366 setting = __le16_to_cpu(rp->voice_setting);
367
f383f275 368 if (hdev->voice_setting == setting)
a9de9248
MH		 369 return;
370
371 hdev->voice_setting = setting;
372
373 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
374
375 if (hdev->notify) {
376 tasklet_disable(&hdev->tx_task);
377 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
378 tasklet_enable(&hdev->tx_task);
379 }
380}
381
382static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
383{
384 __u8 status = *((__u8 *) skb->data);
f383f275 385 __u16 setting;
a9de9248
MH		 386 void *sent;
387
388 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 389
f383f275
MH		 390 if (status)
391 return;
392
a9de9248
MH		 393 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
394 if (!sent)
395 return;
1da177e4 396
f383f275 397 setting = get_unaligned_le16(sent);
1da177e4 398
f383f275
MH		 399 if (hdev->voice_setting == setting)
400 return;
401
402 hdev->voice_setting = setting;
1da177e4 403
f383f275 404 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
1da177e4 405
f383f275
MH		 406 if (hdev->notify) {
407 tasklet_disable(&hdev->tx_task);
408 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
409 tasklet_enable(&hdev->tx_task);
1da177e4
LT		 410 }
411}
412
a9de9248 413static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 414{
a9de9248 415 __u8 status = *((__u8 *) skb->data);
1da177e4 416
a9de9248 417 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 418
23bb5763 419 hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
a9de9248 420}
1143e5a6 421
333140b5
MH		 422static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
423{
424 struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
425
426 BT_DBG("%s status 0x%x", hdev->name, rp->status);
427
428 if (rp->status)
429 return;
430
431 hdev->ssp_mode = rp->mode;
432}
433
434static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
435{
436 __u8 status = *((__u8 *) skb->data);
437 void *sent;
438
439 BT_DBG("%s status 0x%x", hdev->name, status);
440
441 if (status)
442 return;
443
444 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
445 if (!sent)
446 return;
447
448 hdev->ssp_mode = *((__u8 *) sent);
449}
450
d5859e22
JH		 451static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
452{
453 if (hdev->features[6] & LMP_EXT_INQ)
454 return 2;
455
456 if (hdev->features[3] & LMP_RSSI_INQ)
457 return 1;
458
459 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
460 hdev->lmp_subver == 0x0757)
461 return 1;
462
463 if (hdev->manufacturer == 15) {
464 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
465 return 1;
466 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
467 return 1;
468 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
469 return 1;
470 }
471
472 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
473 hdev->lmp_subver == 0x1805)
474 return 1;
475
476 return 0;
477}
478
479static void hci_setup_inquiry_mode(struct hci_dev *hdev)
480{
481 u8 mode;
482
483 mode = hci_get_inquiry_mode(hdev);
484
485 hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
486}
487
488static void hci_setup_event_mask(struct hci_dev *hdev)
489{
490 /* The second byte is 0xff instead of 0x9f (two reserved bits
491 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
492 * command otherwise */
493 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
494
6de6c18d
VT		 495 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
496 * any event mask for pre 1.2 devices */
497 if (hdev->lmp_ver <= 1)
498 return;
499
500 events[4] |= 0x01; /* Flow Specification Complete */
501 events[4] |= 0x02; /* Inquiry Result with RSSI */
502 events[4] |= 0x04; /* Read Remote Extended Features Complete */
503 events[5] |= 0x08; /* Synchronous Connection Complete */
504 events[5] |= 0x10; /* Synchronous Connection Changed */
d5859e22
JH		 505
506 if (hdev->features[3] & LMP_RSSI_INQ)
507 events[4] |= 0x04; /* Inquiry Result with RSSI */
508
509 if (hdev->features[5] & LMP_SNIFF_SUBR)
510 events[5] |= 0x20; /* Sniff Subrating */
511
512 if (hdev->features[5] & LMP_PAUSE_ENC)
513 events[5] |= 0x80; /* Encryption Key Refresh Complete */
514
515 if (hdev->features[6] & LMP_EXT_INQ)
516 events[5] |= 0x40; /* Extended Inquiry Result */
517
518 if (hdev->features[6] & LMP_NO_FLUSH)
519 events[7] |= 0x01; /* Enhanced Flush Complete */
520
521 if (hdev->features[7] & LMP_LSTO)
522 events[6] |= 0x80; /* Link Supervision Timeout Changed */
523
524 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
525 events[6] |= 0x01; /* IO Capability Request */
526 events[6] |= 0x02; /* IO Capability Response */
527 events[6] |= 0x04; /* User Confirmation Request */
528 events[6] |= 0x08; /* User Passkey Request */
529 events[6] |= 0x10; /* Remote OOB Data Request */
530 events[6] |= 0x20; /* Simple Pairing Complete */
531 events[7] |= 0x04; /* User Passkey Notification */
532 events[7] |= 0x08; /* Keypress Notification */
533 events[7] |= 0x10; /* Remote Host Supported
534 * Features Notification */
535 }
536
537 if (hdev->features[4] & LMP_LE)
538 events[7] |= 0x20; /* LE Meta-Event */
539
540 hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
541}
542
e6100a25
AG		 543static void hci_set_le_support(struct hci_dev *hdev)
544{
545 struct hci_cp_write_le_host_supported cp;
546
547 memset(&cp, 0, sizeof(cp));
548
549 if (enable_le) {
550 cp.le = 1;
551 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
552 }
553
554 hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
555}
556
d5859e22
JH		 557static void hci_setup(struct hci_dev *hdev)
558{
559 hci_setup_event_mask(hdev);
560
561 if (hdev->lmp_ver > 1)
562 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
563
564 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
565 u8 mode = 0x01;
566 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
567 }
568
569 if (hdev->features[3] & LMP_RSSI_INQ)
570 hci_setup_inquiry_mode(hdev);
571
572 if (hdev->features[7] & LMP_INQ_TX_PWR)
573 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
971e3a4b
AG		 574
575 if (hdev->features[7] & LMP_EXTFEATURES) {
576 struct hci_cp_read_local_ext_features cp;
577
578 cp.page = 0x01;
579 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
580 sizeof(cp), &cp);
581 }
e6100a25
AG		 582
583 if (hdev->features[4] & LMP_LE)
584 hci_set_le_support(hdev);
d5859e22
JH		 585}
586
a9de9248
MH		 587static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
588{
589 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 590
a9de9248 591 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1143e5a6 592
a9de9248
MH		 593 if (rp->status)
594 return;
1143e5a6 595
a9de9248 596 hdev->hci_ver = rp->hci_ver;
e4e8e37c 597 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
d5859e22 598 hdev->lmp_ver = rp->lmp_ver;
e4e8e37c 599 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
d5859e22 600 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
1143e5a6 601
a9de9248
MH		 602 BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
603 hdev->manufacturer,
604 hdev->hci_ver, hdev->hci_rev);
d5859e22
JH		 605
606 if (test_bit(HCI_INIT, &hdev->flags))
607 hci_setup(hdev);
608}
609
610static void hci_setup_link_policy(struct hci_dev *hdev)
611{
612 u16 link_policy = 0;
613
614 if (hdev->features[0] & LMP_RSWITCH)
615 link_policy |= HCI_LP_RSWITCH;
616 if (hdev->features[0] & LMP_HOLD)
617 link_policy |= HCI_LP_HOLD;
618 if (hdev->features[0] & LMP_SNIFF)
619 link_policy |= HCI_LP_SNIFF;
620 if (hdev->features[1] & LMP_PARK)
621 link_policy |= HCI_LP_PARK;
622
623 link_policy = cpu_to_le16(link_policy);
624 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
625 sizeof(link_policy), &link_policy);
a9de9248 626}
1da177e4 627
a9de9248
MH		 628static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
629{
630 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 631
a9de9248 632 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 633
a9de9248 634 if (rp->status)
d5859e22 635 goto done;
1da177e4 636
a9de9248 637 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
d5859e22
JH		 638
639 if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
640 hci_setup_link_policy(hdev);
641
642done:
643 hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
a9de9248 644}
1da177e4 645
a9de9248
MH		 646static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
647{
648 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 649
a9de9248 650 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 651
a9de9248
MH		 652 if (rp->status)
653 return;
5b7f9909 654
a9de9248 655 memcpy(hdev->features, rp->features, 8);
5b7f9909 656
a9de9248
MH		 657 /* Adjust default settings according to features
658 * supported by device. */
1da177e4 659
a9de9248
MH		 660 if (hdev->features[0] & LMP_3SLOT)
661 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 662
a9de9248
MH		 663 if (hdev->features[0] & LMP_5SLOT)
664 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 665
a9de9248
MH		 666 if (hdev->features[1] & LMP_HV2) {
667 hdev->pkt_type |= (HCI_HV2);
668 hdev->esco_type |= (ESCO_HV2);
669 }
1da177e4 670
a9de9248
MH		 671 if (hdev->features[1] & LMP_HV3) {
672 hdev->pkt_type |= (HCI_HV3);
673 hdev->esco_type |= (ESCO_HV3);
674 }
1da177e4 675
a9de9248
MH		 676 if (hdev->features[3] & LMP_ESCO)
677 hdev->esco_type |= (ESCO_EV3);
da1f5198 678
a9de9248
MH		 679 if (hdev->features[4] & LMP_EV4)
680 hdev->esco_type |= (ESCO_EV4);
da1f5198 681
a9de9248
MH		 682 if (hdev->features[4] & LMP_EV5)
683 hdev->esco_type |= (ESCO_EV5);
1da177e4 684
efc7688b
MH		 685 if (hdev->features[5] & LMP_EDR_ESCO_2M)
686 hdev->esco_type |= (ESCO_2EV3);
687
688 if (hdev->features[5] & LMP_EDR_ESCO_3M)
689 hdev->esco_type |= (ESCO_3EV3);
690
691 if (hdev->features[5] & LMP_EDR_3S_ESCO)
692 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
693
a9de9248
MH		 694 BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
695 hdev->features[0], hdev->features[1],
696 hdev->features[2], hdev->features[3],
697 hdev->features[4], hdev->features[5],
698 hdev->features[6], hdev->features[7]);
699}
1da177e4 700
971e3a4b
AG		 701static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
702 struct sk_buff *skb)
703{
704 struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
705
706 BT_DBG("%s status 0x%x", hdev->name, rp->status);
707
708 if (rp->status)
709 return;
710
711 memcpy(hdev->extfeatures, rp->features, 8);
712
713 hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
714}
715
a9de9248
MH		 716static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
717{
718 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 719
a9de9248 720 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 721
a9de9248
MH		 722 if (rp->status)
723 return;
1da177e4 724
a9de9248
MH		 725 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
726 hdev->sco_mtu = rp->sco_mtu;
727 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
728 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
729
730 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
731 hdev->sco_mtu = 64;
732 hdev->sco_pkts = 8;
1da177e4 733 }
a9de9248
MH		 734
735 hdev->acl_cnt = hdev->acl_pkts;
736 hdev->sco_cnt = hdev->sco_pkts;
737
738 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
739 hdev->acl_mtu, hdev->acl_pkts,
740 hdev->sco_mtu, hdev->sco_pkts);
741}
742
743static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
744{
745 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
746
747 BT_DBG("%s status 0x%x", hdev->name, rp->status);
748
749 if (!rp->status)
750 bacpy(&hdev->bdaddr, &rp->bdaddr);
751
23bb5763
JH		 752 hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
753}
754
755static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
756{
757 __u8 status = *((__u8 *) skb->data);
758
759 BT_DBG("%s status 0x%x", hdev->name, status);
760
761 hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
a9de9248
MH		 762}
763
928abaa7
AE		 764static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
765 struct sk_buff *skb)
766{
767 struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
768
769 BT_DBG("%s status 0x%x", hdev->name, rp->status);
770
771 if (rp->status)
772 return;
773
774 hdev->amp_status = rp->amp_status;
775 hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
776 hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
777 hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
778 hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
779 hdev->amp_type = rp->amp_type;
780 hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
781 hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
782 hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
783 hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
784
785 hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
786}
787
b0916ea0
JH		 788static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
789 struct sk_buff *skb)
790{
791 __u8 status = *((__u8 *) skb->data);
792
793 BT_DBG("%s status 0x%x", hdev->name, status);
794
795 hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
796}
797
d5859e22
JH		 798static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
799{
800 __u8 status = *((__u8 *) skb->data);
801
802 BT_DBG("%s status 0x%x", hdev->name, status);
803
804 hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
805}
806
807static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
808 struct sk_buff *skb)
809{
810 __u8 status = *((__u8 *) skb->data);
811
812 BT_DBG("%s status 0x%x", hdev->name, status);
813
814 hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
815}
816
817static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
818 struct sk_buff *skb)
819{
820 __u8 status = *((__u8 *) skb->data);
821
822 BT_DBG("%s status 0x%x", hdev->name, status);
823
824 hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
825}
826
827static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
828{
829 __u8 status = *((__u8 *) skb->data);
830
831 BT_DBG("%s status 0x%x", hdev->name, status);
832
833 hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
834}
835
980e1a53
JH		 836static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
837{
838 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
839 struct hci_cp_pin_code_reply *cp;
840 struct hci_conn *conn;
841
842 BT_DBG("%s status 0x%x", hdev->name, rp->status);
843
56e5cb86
JH		 844 hci_dev_lock(hdev);
845
980e1a53 846 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 847 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
980e1a53
JH		 848
849 if (rp->status != 0)
56e5cb86 850 goto unlock;
980e1a53
JH		 851
852 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
853 if (!cp)
56e5cb86 854 goto unlock;
980e1a53
JH		 855
856 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
857 if (conn)
858 conn->pin_length = cp->pin_len;
56e5cb86
JH		 859
860unlock:
861 hci_dev_unlock(hdev);
980e1a53
JH		 862}
863
864static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
865{
866 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
867
868 BT_DBG("%s status 0x%x", hdev->name, rp->status);
869
56e5cb86
JH		 870 hci_dev_lock(hdev);
871
980e1a53 872 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 873 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
980e1a53 874 rp->status);
56e5cb86
JH		 875
876 hci_dev_unlock(hdev);
980e1a53 877}
56e5cb86 878
6ed58ec5
VT		 879static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
880 struct sk_buff *skb)
881{
882 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
883
884 BT_DBG("%s status 0x%x", hdev->name, rp->status);
885
886 if (rp->status)
887 return;
888
889 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
890 hdev->le_pkts = rp->le_max_pkt;
891
892 hdev->le_cnt = hdev->le_pkts;
893
894 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
895
896 hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
897}
980e1a53 898
a5c29683
JH		 899static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
900{
901 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
902
903 BT_DBG("%s status 0x%x", hdev->name, rp->status);
904
56e5cb86
JH		 905 hci_dev_lock(hdev);
906
a5c29683 907 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 908 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
a5c29683 909 rp->status);
56e5cb86
JH		 910
911 hci_dev_unlock(hdev);
a5c29683
JH		 912}
913
914static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
915 struct sk_buff *skb)
916{
917 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
918
919 BT_DBG("%s status 0x%x", hdev->name, rp->status);
920
56e5cb86
JH		 921 hci_dev_lock(hdev);
922
a5c29683 923 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 924 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
a5c29683 925 rp->status);
56e5cb86
JH		 926
927 hci_dev_unlock(hdev);
a5c29683
JH		 928}
929
c35938b2
SJ		 930static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
931 struct sk_buff *skb)
932{
933 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
934
935 BT_DBG("%s status 0x%x", hdev->name, rp->status);
936
56e5cb86 937 hci_dev_lock(hdev);
744cf19e 938 mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
c35938b2 939 rp->randomizer, rp->status);
56e5cb86 940 hci_dev_unlock(hdev);
c35938b2
SJ		 941}
942
eb9d91f5
AG		 943static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
944 struct sk_buff *skb)
945{
946 struct hci_cp_le_set_scan_enable *cp;
947 __u8 status = *((__u8 *) skb->data);
948
949 BT_DBG("%s status 0x%x", hdev->name, status);
950
951 if (status)
952 return;
953
954 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
955 if (!cp)
956 return;
957
35815085
AG		 958 if (cp->enable == 0x01) {
959 del_timer(&hdev->adv_timer);
a8f13c8c
AG		 960
961 hci_dev_lock(hdev);
eb9d91f5 962 hci_adv_entries_clear(hdev);
a8f13c8c 963 hci_dev_unlock(hdev);
35815085
AG		 964 } else if (cp->enable == 0x00) {
965 mod_timer(&hdev->adv_timer, jiffies + ADV_CLEAR_TIMEOUT);
966 }
eb9d91f5
AG		 967}
968
a7a595f6
VCG		 969static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
970{
971 struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
972
973 BT_DBG("%s status 0x%x", hdev->name, rp->status);
974
975 if (rp->status)
976 return;
977
978 hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
979}
980
981static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
982{
983 struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
984
985 BT_DBG("%s status 0x%x", hdev->name, rp->status);
986
987 if (rp->status)
988 return;
989
990 hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
991}
992
f9b49306
AG		 993static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
994 struct sk_buff *skb)
995{
996 struct hci_cp_read_local_ext_features cp;
997 __u8 status = *((__u8 *) skb->data);
998
999 BT_DBG("%s status 0x%x", hdev->name, status);
1000
1001 if (status)
1002 return;
1003
1004 cp.page = 0x01;
1005 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1006}
1007
a9de9248
MH		 1008static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1009{
1010 BT_DBG("%s status 0x%x", hdev->name, status);
1011
1012 if (status) {
23bb5763 1013 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
a9de9248 1014 hci_conn_check_pending(hdev);
56e5cb86 1015 hci_dev_lock(hdev);
164a6e78 1016 if (test_bit(HCI_MGMT, &hdev->flags))
744cf19e 1017 mgmt_inquiry_failed(hdev, status);
56e5cb86 1018 hci_dev_unlock(hdev);
314b2381
JH		 1019 return;
1020 }
1021
89352e7d
AG		 1022 set_bit(HCI_INQUIRY, &hdev->flags);
1023
56e5cb86 1024 hci_dev_lock(hdev);
744cf19e 1025 mgmt_discovering(hdev, 1);
56e5cb86 1026 hci_dev_unlock(hdev);
1da177e4
LT		 1027}
1028
1da177e4
LT		 1029static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1030{
a9de9248 1031 struct hci_cp_create_conn *cp;
1da177e4 1032 struct hci_conn *conn;
1da177e4 1033
a9de9248
MH		 1034 BT_DBG("%s status 0x%x", hdev->name, status);
1035
1036 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 1037 if (!cp)
1038 return;
1039
1040 hci_dev_lock(hdev);
1041
1042 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1043
a9de9248 1044 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1da177e4
LT		 1045
1046 if (status) {
1047 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 1048 if (status != 0x0c || conn->attempt > 2) {
1049 conn->state = BT_CLOSED;
1050 hci_proto_connect_cfm(conn, status);
1051 hci_conn_del(conn);
1052 } else
1053 conn->state = BT_CONNECT2;
1da177e4
LT		 1054 }
1055 } else {
1056 if (!conn) {
1057 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1058 if (conn) {
1059 conn->out = 1;
1060 conn->link_mode |= HCI_LM_MASTER;
1061 } else
893ef971 1062 BT_ERR("No memory for new connection");
1da177e4
LT		 1063 }
1064 }
1065
1066 hci_dev_unlock(hdev);
1067}
1068
a9de9248 1069static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 1070{
a9de9248
MH		 1071 struct hci_cp_add_sco *cp;
1072 struct hci_conn *acl, *sco;
1073 __u16 handle;
1da177e4 1074
b6a0dc82
MH		 1075 BT_DBG("%s status 0x%x", hdev->name, status);
1076
a9de9248
MH		 1077 if (!status)
1078 return;
1da177e4 1079
a9de9248
MH		 1080 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1081 if (!cp)
1082 return;
1da177e4 1083
a9de9248 1084 handle = __le16_to_cpu(cp->handle);
1da177e4 1085
a9de9248 1086 BT_DBG("%s handle %d", hdev->name, handle);
1da177e4 1087
a9de9248 1088 hci_dev_lock(hdev);
1da177e4 1089
a9de9248 1090 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1091 if (acl) {
1092 sco = acl->link;
1093 if (sco) {
1094 sco->state = BT_CLOSED;
1da177e4 1095
5a08ecce
AE		 1096 hci_proto_connect_cfm(sco, status);
1097 hci_conn_del(sco);
1098 }
a9de9248 1099 }
1da177e4 1100
a9de9248
MH		 1101 hci_dev_unlock(hdev);
1102}
1da177e4 1103
f8558555
MH		 1104static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1105{
1106 struct hci_cp_auth_requested *cp;
1107 struct hci_conn *conn;
1108
1109 BT_DBG("%s status 0x%x", hdev->name, status);
1110
1111 if (!status)
1112 return;
1113
1114 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1115 if (!cp)
1116 return;
1117
1118 hci_dev_lock(hdev);
1119
1120 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1121 if (conn) {
1122 if (conn->state == BT_CONFIG) {
1123 hci_proto_connect_cfm(conn, status);
1124 hci_conn_put(conn);
1125 }
1126 }
1127
1128 hci_dev_unlock(hdev);
1129}
1130
1131static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1132{
1133 struct hci_cp_set_conn_encrypt *cp;
1134 struct hci_conn *conn;
1135
1136 BT_DBG("%s status 0x%x", hdev->name, status);
1137
1138 if (!status)
1139 return;
1140
1141 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1142 if (!cp)
1143 return;
1144
1145 hci_dev_lock(hdev);
1146
1147 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1148 if (conn) {
1149 if (conn->state == BT_CONFIG) {
1150 hci_proto_connect_cfm(conn, status);
1151 hci_conn_put(conn);
1152 }
1153 }
1154
1155 hci_dev_unlock(hdev);
1156}
1157
127178d2 1158static int hci_outgoing_auth_needed(struct hci_dev *hdev,
138d22ef 1159 struct hci_conn *conn)
392599b9 1160{
392599b9
JH		 1161 if (conn->state != BT_CONFIG || !conn->out)
1162 return 0;
1163
765c2a96 1164 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 1165 return 0;
1166
1167 /* Only request authentication for SSP connections or non-SSP
e9bf2bf0 1168 * devices with sec_level HIGH or if MITM protection is requested */
392599b9 1169 if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
e9bf2bf0
VCG		 1170 conn->pending_sec_level != BT_SECURITY_HIGH &&
1171 !(conn->auth_type & 0x01))
392599b9
JH		 1172 return 0;
1173
392599b9
JH		 1174 return 1;
1175}
1176
a9de9248
MH		 1177static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1178{
127178d2
JH		 1179 struct hci_cp_remote_name_req *cp;
1180 struct hci_conn *conn;
1181
a9de9248 1182 BT_DBG("%s status 0x%x", hdev->name, status);
127178d2
JH		 1183
1184 /* If successful wait for the name req complete event before
1185 * checking for the need to do authentication */
1186 if (!status)
1187 return;
1188
1189 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1190 if (!cp)
1191 return;
1192
1193 hci_dev_lock(hdev);
1194
1195 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
79c6c70c
JH		 1196 if (!conn)
1197 goto unlock;
1198
1199 if (!hci_outgoing_auth_needed(hdev, conn))
1200 goto unlock;
1201
1202 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
127178d2
JH		 1203 struct hci_cp_auth_requested cp;
1204 cp.handle = __cpu_to_le16(conn->handle);
1205 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1206 }
1207
79c6c70c 1208unlock:
127178d2 1209 hci_dev_unlock(hdev);
a9de9248 1210}
1da177e4 1211
769be974
MH		 1212static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1213{
1214 struct hci_cp_read_remote_features *cp;
1215 struct hci_conn *conn;
1216
1217 BT_DBG("%s status 0x%x", hdev->name, status);
1218
1219 if (!status)
1220 return;
1221
1222 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1223 if (!cp)
1224 return;
1225
1226 hci_dev_lock(hdev);
1227
1228 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1229 if (conn) {
1230 if (conn->state == BT_CONFIG) {
769be974
MH		 1231 hci_proto_connect_cfm(conn, status);
1232 hci_conn_put(conn);
1233 }
1234 }
1235
1236 hci_dev_unlock(hdev);
1237}
1238
1239static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1240{
1241 struct hci_cp_read_remote_ext_features *cp;
1242 struct hci_conn *conn;
1243
1244 BT_DBG("%s status 0x%x", hdev->name, status);
1245
1246 if (!status)
1247 return;
1248
1249 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1250 if (!cp)
1251 return;
1252
1253 hci_dev_lock(hdev);
1254
1255 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1256 if (conn) {
1257 if (conn->state == BT_CONFIG) {
769be974
MH		 1258 hci_proto_connect_cfm(conn, status);
1259 hci_conn_put(conn);
1260 }
1261 }
1262
1263 hci_dev_unlock(hdev);
1264}
1265
a9de9248
MH		 1266static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1267{
b6a0dc82
MH		 1268 struct hci_cp_setup_sync_conn *cp;
1269 struct hci_conn *acl, *sco;
1270 __u16 handle;
1271
a9de9248 1272 BT_DBG("%s status 0x%x", hdev->name, status);
b6a0dc82
MH		 1273
1274 if (!status)
1275 return;
1276
1277 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1278 if (!cp)
1279 return;
1280
1281 handle = __le16_to_cpu(cp->handle);
1282
1283 BT_DBG("%s handle %d", hdev->name, handle);
1284
1285 hci_dev_lock(hdev);
1286
1287 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1288 if (acl) {
1289 sco = acl->link;
1290 if (sco) {
1291 sco->state = BT_CLOSED;
b6a0dc82 1292
5a08ecce
AE		 1293 hci_proto_connect_cfm(sco, status);
1294 hci_conn_del(sco);
1295 }
b6a0dc82
MH		 1296 }
1297
1298 hci_dev_unlock(hdev);
1da177e4
LT		 1299}
1300
a9de9248 1301static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1302{
a9de9248
MH		 1303 struct hci_cp_sniff_mode *cp;
1304 struct hci_conn *conn;
1da177e4 1305
a9de9248 1306 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 1307
a9de9248
MH		 1308 if (!status)
1309 return;
04837f64 1310
a9de9248
MH		 1311 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1312 if (!cp)
1313 return;
04837f64 1314
a9de9248 1315 hci_dev_lock(hdev);
04837f64 1316
a9de9248 1317 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1318 if (conn) {
a9de9248 1319 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
04837f64 1320
e73439d8
MH		 1321 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1322 hci_sco_setup(conn, status);
1323 }
1324
a9de9248
MH		 1325 hci_dev_unlock(hdev);
1326}
04837f64 1327
a9de9248
MH		 1328static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1329{
1330 struct hci_cp_exit_sniff_mode *cp;
1331 struct hci_conn *conn;
04837f64 1332
a9de9248 1333 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 1334
a9de9248
MH		 1335 if (!status)
1336 return;
04837f64 1337
a9de9248
MH		 1338 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1339 if (!cp)
1340 return;
04837f64 1341
a9de9248 1342 hci_dev_lock(hdev);
1da177e4 1343
a9de9248 1344 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1345 if (conn) {
a9de9248 1346 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1da177e4 1347
e73439d8
MH		 1348 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1349 hci_sco_setup(conn, status);
1350 }
1351
a9de9248 1352 hci_dev_unlock(hdev);
1da177e4
LT		 1353}
1354
fcd89c09
VT		 1355static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1356{
1357 struct hci_cp_le_create_conn *cp;
1358 struct hci_conn *conn;
1359
1360 BT_DBG("%s status 0x%x", hdev->name, status);
1361
1362 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1363 if (!cp)
1364 return;
1365
1366 hci_dev_lock(hdev);
1367
1368 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1369
1370 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1371 conn);
1372
1373 if (status) {
1374 if (conn && conn->state == BT_CONNECT) {
1375 conn->state = BT_CLOSED;
1376 hci_proto_connect_cfm(conn, status);
1377 hci_conn_del(conn);
1378 }
1379 } else {
1380 if (!conn) {
1381 conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
29b7988a
AG		 1382 if (conn) {
1383 conn->dst_type = cp->peer_addr_type;
fcd89c09 1384 conn->out = 1;
29b7988a 1385 } else {
fcd89c09 1386 BT_ERR("No memory for new connection");
29b7988a 1387 }
fcd89c09
VT		 1388 }
1389 }
1390
1391 hci_dev_unlock(hdev);
1392}
1393
a7a595f6
VCG		 1394static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1395{
1396 BT_DBG("%s status 0x%x", hdev->name, status);
1397}
1398
1da177e4
LT		 1399static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1400{
1401 __u8 status = *((__u8 *) skb->data);
1402
1403 BT_DBG("%s status %d", hdev->name, status);
1404
23bb5763 1405 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
6bd57416 1406
a9de9248 1407 hci_conn_check_pending(hdev);
89352e7d
AG		 1408
1409 if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1410 return;
1411
56e5cb86 1412 hci_dev_lock(hdev);
744cf19e 1413 mgmt_discovering(hdev, 0);
56e5cb86 1414 hci_dev_unlock(hdev);
1da177e4
LT		 1415}
1416
1da177e4
LT		 1417static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1418{
45bb4bf0 1419 struct inquiry_data data;
a9de9248 1420 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 1421 int num_rsp = *((__u8 *) skb->data);
1422
1423 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1424
45bb4bf0
MH		 1425 if (!num_rsp)
1426 return;
1427
1da177e4 1428 hci_dev_lock(hdev);
45bb4bf0 1429
e17acd40 1430 for (; num_rsp; num_rsp--, info++) {
1da177e4
LT		 1431 bacpy(&data.bdaddr, &info->bdaddr);
1432 data.pscan_rep_mode = info->pscan_rep_mode;
1433 data.pscan_period_mode = info->pscan_period_mode;
1434 data.pscan_mode = info->pscan_mode;
1435 memcpy(data.dev_class, info->dev_class, 3);
1436 data.clock_offset = info->clock_offset;
1437 data.rssi = 0x00;
41a96212 1438 data.ssp_mode = 0x00;
1da177e4 1439 hci_inquiry_cache_update(hdev, &data);
48264f06 1440 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4c659c39 1441 info->dev_class, 0, NULL);
1da177e4 1442 }
45bb4bf0 1443
1da177e4
LT		 1444 hci_dev_unlock(hdev);
1445}
1446
1da177e4
LT		 1447static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1448{
a9de9248
MH		 1449 struct hci_ev_conn_complete *ev = (void *) skb->data;
1450 struct hci_conn *conn;
1da177e4
LT		 1451
1452 BT_DBG("%s", hdev->name);
1453
1454 hci_dev_lock(hdev);
1455
1456 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 1457 if (!conn) {
1458 if (ev->link_type != SCO_LINK)
1459 goto unlock;
1460
1461 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1462 if (!conn)
1463 goto unlock;
1464
1465 conn->type = SCO_LINK;
1466 }
1da177e4
LT		 1467
1468 if (!ev->status) {
1469 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 1470
1471 if (conn->type == ACL_LINK) {
1472 conn->state = BT_CONFIG;
1473 hci_conn_hold(conn);
052b30b0 1474 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
48264f06
JH		 1475 mgmt_connected(hdev, &ev->bdaddr, conn->type,
1476 conn->dst_type);
769be974
MH		 1477 } else
1478 conn->state = BT_CONNECTED;
1da177e4 1479
9eba32b8 1480 hci_conn_hold_device(conn);
7d0db0a3
MH		 1481 hci_conn_add_sysfs(conn);
1482
1da177e4
LT		 1483 if (test_bit(HCI_AUTH, &hdev->flags))
1484 conn->link_mode |= HCI_LM_AUTH;
1485
1486 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1487 conn->link_mode |= HCI_LM_ENCRYPT;
1488
04837f64
MH		 1489 /* Get remote features */
1490 if (conn->type == ACL_LINK) {
1491 struct hci_cp_read_remote_features cp;
1492 cp.handle = ev->handle;
769be974
MH		 1493 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1494 sizeof(cp), &cp);
04837f64
MH		 1495 }
1496
1da177e4 1497 /* Set packet type for incoming connection */
a8746417 1498 if (!conn->out && hdev->hci_ver < 3) {
1da177e4
LT		 1499 struct hci_cp_change_conn_ptype cp;
1500 cp.handle = ev->handle;
a8746417
MH		 1501 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1502 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1503 sizeof(cp), &cp);
1da177e4 1504 }
17d5c04c 1505 } else {
1da177e4 1506 conn->state = BT_CLOSED;
17d5c04c 1507 if (conn->type == ACL_LINK)
744cf19e 1508 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
48264f06 1509 conn->dst_type, ev->status);
17d5c04c 1510 }
1da177e4 1511
e73439d8
MH		 1512 if (conn->type == ACL_LINK)
1513 hci_sco_setup(conn, ev->status);
1da177e4 1514
769be974
MH		 1515 if (ev->status) {
1516 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1517 hci_conn_del(conn);
c89b6e6b
MH		 1518 } else if (ev->link_type != ACL_LINK)
1519 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1520
a9de9248 1521unlock:
1da177e4 1522 hci_dev_unlock(hdev);
1da177e4 1523
a9de9248 1524 hci_conn_check_pending(hdev);
1da177e4
LT		 1525}
1526
a9de9248 1527static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1528{
a9de9248
MH		 1529 struct hci_ev_conn_request *ev = (void *) skb->data;
1530 int mask = hdev->link_mode;
1da177e4 1531
a9de9248
MH		 1532 BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1533 batostr(&ev->bdaddr), ev->link_type);
1da177e4 1534
a9de9248 1535 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1da177e4 1536
138d22ef
SJ		 1537 if ((mask & HCI_LM_ACCEPT) &&
1538 !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
a9de9248 1539 /* Connection accepted */
c7bdd502 1540 struct inquiry_entry *ie;
1da177e4 1541 struct hci_conn *conn;
1da177e4 1542
a9de9248 1543 hci_dev_lock(hdev);
b6a0dc82 1544
cc11b9c1
AE		 1545 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1546 if (ie)
c7bdd502
MH		 1547 memcpy(ie->data.dev_class, ev->dev_class, 3);
1548
a9de9248
MH		 1549 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1550 if (!conn) {
cc11b9c1
AE		 1551 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1552 if (!conn) {
893ef971 1553 BT_ERR("No memory for new connection");
a9de9248
MH		 1554 hci_dev_unlock(hdev);
1555 return;
1da177e4
LT		 1556 }
1557 }
b6a0dc82 1558
a9de9248
MH		 1559 memcpy(conn->dev_class, ev->dev_class, 3);
1560 conn->state = BT_CONNECT;
b6a0dc82 1561
a9de9248 1562 hci_dev_unlock(hdev);
1da177e4 1563
b6a0dc82
MH		 1564 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1565 struct hci_cp_accept_conn_req cp;
1da177e4 1566
b6a0dc82
MH		 1567 bacpy(&cp.bdaddr, &ev->bdaddr);
1568
1569 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1570 cp.role = 0x00; /* Become master */
1571 else
1572 cp.role = 0x01; /* Remain slave */
1573
1574 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1575 sizeof(cp), &cp);
1576 } else {
1577 struct hci_cp_accept_sync_conn_req cp;
1578
1579 bacpy(&cp.bdaddr, &ev->bdaddr);
a8746417 1580 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82
MH		 1581
1582 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
1583 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
1584 cp.max_latency = cpu_to_le16(0xffff);
1585 cp.content_format = cpu_to_le16(hdev->voice_setting);
1586 cp.retrans_effort = 0xff;
1da177e4 1587
b6a0dc82
MH		 1588 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1589 sizeof(cp), &cp);
1590 }
a9de9248
MH		 1591 } else {
1592 /* Connection rejected */
1593 struct hci_cp_reject_conn_req cp;
1da177e4 1594
a9de9248 1595 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 1596 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
a9de9248 1597 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1da177e4 1598 }
1da177e4
LT		 1599}
1600
a9de9248 1601static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 1602{
a9de9248 1603 struct hci_ev_disconn_complete *ev = (void *) skb->data;
04837f64
MH		 1604 struct hci_conn *conn;
1605
1606 BT_DBG("%s status %d", hdev->name, ev->status);
1607
1608 hci_dev_lock(hdev);
1609
1610 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 1611 if (!conn)
1612 goto unlock;
7d0db0a3 1613
37d9ef76
JH		 1614 if (ev->status == 0)
1615 conn->state = BT_CLOSED;
04837f64 1616
37d9ef76
JH		 1617 if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1618 if (ev->status != 0)
1619 mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1620 else
1621 mgmt_disconnected(hdev, &conn->dst, conn->type,
48264f06 1622 conn->dst_type);
37d9ef76 1623 }
f7520543 1624
37d9ef76
JH		 1625 if (ev->status == 0) {
1626 hci_proto_disconn_cfm(conn, ev->reason);
1627 hci_conn_del(conn);
1628 }
f7520543
JH		 1629
1630unlock:
04837f64
MH		 1631 hci_dev_unlock(hdev);
1632}
1633
1da177e4
LT		 1634static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1635{
a9de9248 1636 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 1637 struct hci_conn *conn;
1da177e4
LT		 1638
1639 BT_DBG("%s status %d", hdev->name, ev->status);
1640
1641 hci_dev_lock(hdev);
1642
04837f64 1643 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
d7556e20
WR		 1644 if (!conn)
1645 goto unlock;
1646
1647 if (!ev->status) {
1648 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1649 test_bit(HCI_CONN_REAUTH_PEND, &conn->pend)) {
1650 BT_INFO("re-auth of legacy device is not possible.");
2a611692 1651 } else {
d7556e20
WR		 1652 conn->link_mode |= HCI_LM_AUTH;
1653 conn->sec_level = conn->pending_sec_level;
2a611692 1654 }
d7556e20 1655 } else {
744cf19e 1656 mgmt_auth_failed(hdev, &conn->dst, ev->status);
d7556e20 1657 }
1da177e4 1658
d7556e20
WR		 1659 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1660 clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1da177e4 1661
d7556e20
WR		 1662 if (conn->state == BT_CONFIG) {
1663 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1664 struct hci_cp_set_conn_encrypt cp;
1665 cp.handle = ev->handle;
1666 cp.encrypt = 0x01;
1667 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1668 &cp);
052b30b0 1669 } else {
d7556e20
WR		 1670 conn->state = BT_CONNECTED;
1671 hci_proto_connect_cfm(conn, ev->status);
052b30b0
MH		 1672 hci_conn_put(conn);
1673 }
d7556e20
WR		 1674 } else {
1675 hci_auth_cfm(conn, ev->status);
052b30b0 1676
d7556e20
WR		 1677 hci_conn_hold(conn);
1678 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1679 hci_conn_put(conn);
1680 }
1681
1682 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1683 if (!ev->status) {
1684 struct hci_cp_set_conn_encrypt cp;
1685 cp.handle = ev->handle;
1686 cp.encrypt = 0x01;
1687 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1688 &cp);
1689 } else {
1690 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1691 hci_encrypt_cfm(conn, ev->status, 0x00);
1da177e4
LT		 1692 }
1693 }
1694
d7556e20 1695unlock:
1da177e4
LT		 1696 hci_dev_unlock(hdev);
1697}
1698
a9de9248 1699static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1700{
127178d2
JH		 1701 struct hci_ev_remote_name *ev = (void *) skb->data;
1702 struct hci_conn *conn;
1703
a9de9248 1704 BT_DBG("%s", hdev->name);
1da177e4 1705
a9de9248 1706 hci_conn_check_pending(hdev);
127178d2
JH		 1707
1708 hci_dev_lock(hdev);
1709
a88a9652 1710 if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
744cf19e 1711 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
a88a9652 1712
127178d2 1713 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
79c6c70c
JH		 1714 if (!conn)
1715 goto unlock;
1716
1717 if (!hci_outgoing_auth_needed(hdev, conn))
1718 goto unlock;
1719
1720 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
127178d2
JH		 1721 struct hci_cp_auth_requested cp;
1722 cp.handle = __cpu_to_le16(conn->handle);
1723 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1724 }
1725
79c6c70c 1726unlock:
127178d2 1727 hci_dev_unlock(hdev);
a9de9248
MH		 1728}
1729
1730static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1731{
1732 struct hci_ev_encrypt_change *ev = (void *) skb->data;
1733 struct hci_conn *conn;
1734
1735 BT_DBG("%s status %d", hdev->name, ev->status);
1da177e4
LT		 1736
1737 hci_dev_lock(hdev);
1738
04837f64 1739 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 1740 if (conn) {
1741 if (!ev->status) {
ae293196
MH		 1742 if (ev->encrypt) {
1743 /* Encryption implies authentication */
1744 conn->link_mode |= HCI_LM_AUTH;
1da177e4 1745 conn->link_mode |= HCI_LM_ENCRYPT;
da85e5e5 1746 conn->sec_level = conn->pending_sec_level;
ae293196 1747 } else
1da177e4
LT		 1748 conn->link_mode &= ~HCI_LM_ENCRYPT;
1749 }
1750
1751 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1752
f8558555
MH		 1753 if (conn->state == BT_CONFIG) {
1754 if (!ev->status)
1755 conn->state = BT_CONNECTED;
1756
1757 hci_proto_connect_cfm(conn, ev->status);
1758 hci_conn_put(conn);
1759 } else
1760 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1da177e4
LT		 1761 }
1762
1763 hci_dev_unlock(hdev);
1764}
1765
a9de9248 1766static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1767{
a9de9248 1768 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 1769 struct hci_conn *conn;
1da177e4
LT		 1770
1771 BT_DBG("%s status %d", hdev->name, ev->status);
1772
1773 hci_dev_lock(hdev);
1774
04837f64 1775 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 1776 if (conn) {
1777 if (!ev->status)
1778 conn->link_mode |= HCI_LM_SECURE;
1779
1780 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1781
1782 hci_key_change_cfm(conn, ev->status);
1783 }
1784
1785 hci_dev_unlock(hdev);
1786}
1787
a9de9248 1788static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1789{
a9de9248
MH		 1790 struct hci_ev_remote_features *ev = (void *) skb->data;
1791 struct hci_conn *conn;
1792
1793 BT_DBG("%s status %d", hdev->name, ev->status);
1794
a9de9248
MH		 1795 hci_dev_lock(hdev);
1796
1797 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 1798 if (!conn)
1799 goto unlock;
769be974 1800
ccd556fe
JH		 1801 if (!ev->status)
1802 memcpy(conn->features, ev->features, 8);
1803
1804 if (conn->state != BT_CONFIG)
1805 goto unlock;
1806
1807 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1808 struct hci_cp_read_remote_ext_features cp;
1809 cp.handle = ev->handle;
1810 cp.page = 0x01;
1811 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
bdb7524a 1812 sizeof(cp), &cp);
392599b9
JH		 1813 goto unlock;
1814 }
1815
127178d2
JH		 1816 if (!ev->status) {
1817 struct hci_cp_remote_name_req cp;
1818 memset(&cp, 0, sizeof(cp));
1819 bacpy(&cp.bdaddr, &conn->dst);
1820 cp.pscan_rep_mode = 0x02;
1821 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1822 }
392599b9 1823
127178d2 1824 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 1825 conn->state = BT_CONNECTED;
1826 hci_proto_connect_cfm(conn, ev->status);
1827 hci_conn_put(conn);
769be974 1828 }
a9de9248 1829
ccd556fe 1830unlock:
a9de9248 1831 hci_dev_unlock(hdev);
1da177e4
LT		 1832}
1833
a9de9248 1834static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1835{
a9de9248 1836 BT_DBG("%s", hdev->name);
1da177e4
LT		 1837}
1838
a9de9248 1839static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1840{
a9de9248 1841 BT_DBG("%s", hdev->name);
1da177e4
LT		 1842}
1843
a9de9248
MH		 1844static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1845{
1846 struct hci_ev_cmd_complete *ev = (void *) skb->data;
1847 __u16 opcode;
1848
1849 skb_pull(skb, sizeof(*ev));
1850
1851 opcode = __le16_to_cpu(ev->opcode);
1852
1853 switch (opcode) {
1854 case HCI_OP_INQUIRY_CANCEL:
1855 hci_cc_inquiry_cancel(hdev, skb);
1856 break;
1857
1858 case HCI_OP_EXIT_PERIODIC_INQ:
1859 hci_cc_exit_periodic_inq(hdev, skb);
1860 break;
1861
1862 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1863 hci_cc_remote_name_req_cancel(hdev, skb);
1864 break;
1865
1866 case HCI_OP_ROLE_DISCOVERY:
1867 hci_cc_role_discovery(hdev, skb);
1868 break;
1869
e4e8e37c
MH		 1870 case HCI_OP_READ_LINK_POLICY:
1871 hci_cc_read_link_policy(hdev, skb);
1872 break;
1873
a9de9248
MH		 1874 case HCI_OP_WRITE_LINK_POLICY:
1875 hci_cc_write_link_policy(hdev, skb);
1876 break;
1877
e4e8e37c
MH		 1878 case HCI_OP_READ_DEF_LINK_POLICY:
1879 hci_cc_read_def_link_policy(hdev, skb);
1880 break;
1881
1882 case HCI_OP_WRITE_DEF_LINK_POLICY:
1883 hci_cc_write_def_link_policy(hdev, skb);
1884 break;
1885
a9de9248
MH		 1886 case HCI_OP_RESET:
1887 hci_cc_reset(hdev, skb);
1888 break;
1889
1890 case HCI_OP_WRITE_LOCAL_NAME:
1891 hci_cc_write_local_name(hdev, skb);
1892 break;
1893
1894 case HCI_OP_READ_LOCAL_NAME:
1895 hci_cc_read_local_name(hdev, skb);
1896 break;
1897
1898 case HCI_OP_WRITE_AUTH_ENABLE:
1899 hci_cc_write_auth_enable(hdev, skb);
1900 break;
1901
1902 case HCI_OP_WRITE_ENCRYPT_MODE:
1903 hci_cc_write_encrypt_mode(hdev, skb);
1904 break;
1905
1906 case HCI_OP_WRITE_SCAN_ENABLE:
1907 hci_cc_write_scan_enable(hdev, skb);
1908 break;
1909
1910 case HCI_OP_READ_CLASS_OF_DEV:
1911 hci_cc_read_class_of_dev(hdev, skb);
1912 break;
1913
1914 case HCI_OP_WRITE_CLASS_OF_DEV:
1915 hci_cc_write_class_of_dev(hdev, skb);
1916 break;
1917
1918 case HCI_OP_READ_VOICE_SETTING:
1919 hci_cc_read_voice_setting(hdev, skb);
1920 break;
1921
1922 case HCI_OP_WRITE_VOICE_SETTING:
1923 hci_cc_write_voice_setting(hdev, skb);
1924 break;
1925
1926 case HCI_OP_HOST_BUFFER_SIZE:
1927 hci_cc_host_buffer_size(hdev, skb);
1928 break;
1929
333140b5
MH		 1930 case HCI_OP_READ_SSP_MODE:
1931 hci_cc_read_ssp_mode(hdev, skb);
1932 break;
1933
1934 case HCI_OP_WRITE_SSP_MODE:
1935 hci_cc_write_ssp_mode(hdev, skb);
1936 break;
1937
a9de9248
MH		 1938 case HCI_OP_READ_LOCAL_VERSION:
1939 hci_cc_read_local_version(hdev, skb);
1940 break;
1941
1942 case HCI_OP_READ_LOCAL_COMMANDS:
1943 hci_cc_read_local_commands(hdev, skb);
1944 break;
1945
1946 case HCI_OP_READ_LOCAL_FEATURES:
1947 hci_cc_read_local_features(hdev, skb);
1948 break;
1949
971e3a4b
AG		 1950 case HCI_OP_READ_LOCAL_EXT_FEATURES:
1951 hci_cc_read_local_ext_features(hdev, skb);
1952 break;
1953
a9de9248
MH		 1954 case HCI_OP_READ_BUFFER_SIZE:
1955 hci_cc_read_buffer_size(hdev, skb);
1956 break;
1957
1958 case HCI_OP_READ_BD_ADDR:
1959 hci_cc_read_bd_addr(hdev, skb);
1960 break;
1961
23bb5763
JH		 1962 case HCI_OP_WRITE_CA_TIMEOUT:
1963 hci_cc_write_ca_timeout(hdev, skb);
1964 break;
1965
928abaa7
AE		 1966 case HCI_OP_READ_LOCAL_AMP_INFO:
1967 hci_cc_read_local_amp_info(hdev, skb);
1968 break;
1969
b0916ea0
JH		 1970 case HCI_OP_DELETE_STORED_LINK_KEY:
1971 hci_cc_delete_stored_link_key(hdev, skb);
1972 break;
1973
d5859e22
JH		 1974 case HCI_OP_SET_EVENT_MASK:
1975 hci_cc_set_event_mask(hdev, skb);
1976 break;
1977
1978 case HCI_OP_WRITE_INQUIRY_MODE:
1979 hci_cc_write_inquiry_mode(hdev, skb);
1980 break;
1981
1982 case HCI_OP_READ_INQ_RSP_TX_POWER:
1983 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1984 break;
1985
1986 case HCI_OP_SET_EVENT_FLT:
1987 hci_cc_set_event_flt(hdev, skb);
1988 break;
1989
980e1a53
JH		 1990 case HCI_OP_PIN_CODE_REPLY:
1991 hci_cc_pin_code_reply(hdev, skb);
1992 break;
1993
1994 case HCI_OP_PIN_CODE_NEG_REPLY:
1995 hci_cc_pin_code_neg_reply(hdev, skb);
1996 break;
1997
c35938b2
SJ		 1998 case HCI_OP_READ_LOCAL_OOB_DATA:
1999 hci_cc_read_local_oob_data_reply(hdev, skb);
2000 break;
2001
6ed58ec5
VT		 2002 case HCI_OP_LE_READ_BUFFER_SIZE:
2003 hci_cc_le_read_buffer_size(hdev, skb);
2004 break;
2005
a5c29683
JH		 2006 case HCI_OP_USER_CONFIRM_REPLY:
2007 hci_cc_user_confirm_reply(hdev, skb);
2008 break;
2009
2010 case HCI_OP_USER_CONFIRM_NEG_REPLY:
2011 hci_cc_user_confirm_neg_reply(hdev, skb);
2012 break;
2013
eb9d91f5
AG		 2014 case HCI_OP_LE_SET_SCAN_ENABLE:
2015 hci_cc_le_set_scan_enable(hdev, skb);
2016 break;
2017
a7a595f6
VCG		 2018 case HCI_OP_LE_LTK_REPLY:
2019 hci_cc_le_ltk_reply(hdev, skb);
2020 break;
2021
2022 case HCI_OP_LE_LTK_NEG_REPLY:
2023 hci_cc_le_ltk_neg_reply(hdev, skb);
2024 break;
2025
f9b49306
AG		 2026 case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2027 hci_cc_write_le_host_supported(hdev, skb);
2028 break;
2029
a9de9248
MH		 2030 default:
2031 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2032 break;
2033 }
2034
6bd32326
VT		 2035 if (ev->opcode != HCI_OP_NOP)
2036 del_timer(&hdev->cmd_timer);
2037
a9de9248
MH		 2038 if (ev->ncmd) {
2039 atomic_set(&hdev->cmd_cnt, 1);
2040 if (!skb_queue_empty(&hdev->cmd_q))
c78ae283 2041 tasklet_schedule(&hdev->cmd_task);
a9de9248
MH		 2042 }
2043}
2044
2045static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2046{
2047 struct hci_ev_cmd_status *ev = (void *) skb->data;
2048 __u16 opcode;
2049
2050 skb_pull(skb, sizeof(*ev));
2051
2052 opcode = __le16_to_cpu(ev->opcode);
2053
2054 switch (opcode) {
2055 case HCI_OP_INQUIRY:
2056 hci_cs_inquiry(hdev, ev->status);
2057 break;
2058
2059 case HCI_OP_CREATE_CONN:
2060 hci_cs_create_conn(hdev, ev->status);
2061 break;
2062
2063 case HCI_OP_ADD_SCO:
2064 hci_cs_add_sco(hdev, ev->status);
2065 break;
2066
f8558555
MH		 2067 case HCI_OP_AUTH_REQUESTED:
2068 hci_cs_auth_requested(hdev, ev->status);
2069 break;
2070
2071 case HCI_OP_SET_CONN_ENCRYPT:
2072 hci_cs_set_conn_encrypt(hdev, ev->status);
2073 break;
2074
a9de9248
MH		 2075 case HCI_OP_REMOTE_NAME_REQ:
2076 hci_cs_remote_name_req(hdev, ev->status);
2077 break;
2078
769be974
MH		 2079 case HCI_OP_READ_REMOTE_FEATURES:
2080 hci_cs_read_remote_features(hdev, ev->status);
2081 break;
2082
2083 case HCI_OP_READ_REMOTE_EXT_FEATURES:
2084 hci_cs_read_remote_ext_features(hdev, ev->status);
2085 break;
2086
a9de9248
MH		 2087 case HCI_OP_SETUP_SYNC_CONN:
2088 hci_cs_setup_sync_conn(hdev, ev->status);
2089 break;
2090
2091 case HCI_OP_SNIFF_MODE:
2092 hci_cs_sniff_mode(hdev, ev->status);
2093 break;
2094
2095 case HCI_OP_EXIT_SNIFF_MODE:
2096 hci_cs_exit_sniff_mode(hdev, ev->status);
2097 break;
2098
8962ee74
JH		 2099 case HCI_OP_DISCONNECT:
2100 if (ev->status != 0)
37d9ef76 2101 mgmt_disconnect_failed(hdev, NULL, ev->status);
8962ee74
JH		 2102 break;
2103
fcd89c09
VT		 2104 case HCI_OP_LE_CREATE_CONN:
2105 hci_cs_le_create_conn(hdev, ev->status);
2106 break;
2107
a7a595f6
VCG		 2108 case HCI_OP_LE_START_ENC:
2109 hci_cs_le_start_enc(hdev, ev->status);
2110 break;
2111
a9de9248
MH		 2112 default:
2113 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2114 break;
2115 }
2116
6bd32326
VT		 2117 if (ev->opcode != HCI_OP_NOP)
2118 del_timer(&hdev->cmd_timer);
2119
10572132 2120 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 2121 atomic_set(&hdev->cmd_cnt, 1);
2122 if (!skb_queue_empty(&hdev->cmd_q))
c78ae283 2123 tasklet_schedule(&hdev->cmd_task);
a9de9248
MH		 2124 }
2125}
2126
2127static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2128{
2129 struct hci_ev_role_change *ev = (void *) skb->data;
2130 struct hci_conn *conn;
2131
2132 BT_DBG("%s status %d", hdev->name, ev->status);
2133
2134 hci_dev_lock(hdev);
2135
2136 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2137 if (conn) {
2138 if (!ev->status) {
2139 if (ev->role)
2140 conn->link_mode &= ~HCI_LM_MASTER;
2141 else
2142 conn->link_mode |= HCI_LM_MASTER;
2143 }
2144
2145 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2146
2147 hci_role_switch_cfm(conn, ev->status, ev->role);
2148 }
2149
2150 hci_dev_unlock(hdev);
2151}
2152
2153static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2154{
2155 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2156 __le16 *ptr;
2157 int i;
2158
2159 skb_pull(skb, sizeof(*ev));
2160
2161 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2162
2163 if (skb->len < ev->num_hndl * 4) {
2164 BT_DBG("%s bad parameters", hdev->name);
2165 return;
2166 }
2167
2168 tasklet_disable(&hdev->tx_task);
2169
2170 for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2171 struct hci_conn *conn;
2172 __u16 handle, count;
2173
83985319
HH		 2174 handle = get_unaligned_le16(ptr++);
2175 count = get_unaligned_le16(ptr++);
a9de9248
MH		 2176
2177 conn = hci_conn_hash_lookup_handle(hdev, handle);
2178 if (conn) {
2179 conn->sent -= count;
2180
2181 if (conn->type == ACL_LINK) {
70f23020
AE		 2182 hdev->acl_cnt += count;
2183 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 2184 hdev->acl_cnt = hdev->acl_pkts;
6ed58ec5
VT		 2185 } else if (conn->type == LE_LINK) {
2186 if (hdev->le_pkts) {
2187 hdev->le_cnt += count;
2188 if (hdev->le_cnt > hdev->le_pkts)
2189 hdev->le_cnt = hdev->le_pkts;
2190 } else {
2191 hdev->acl_cnt += count;
2192 if (hdev->acl_cnt > hdev->acl_pkts)
2193 hdev->acl_cnt = hdev->acl_pkts;
2194 }
a9de9248 2195 } else {
70f23020
AE		 2196 hdev->sco_cnt += count;
2197 if (hdev->sco_cnt > hdev->sco_pkts)
a9de9248
MH		 2198 hdev->sco_cnt = hdev->sco_pkts;
2199 }
2200 }
2201 }
2202
c78ae283 2203 tasklet_schedule(&hdev->tx_task);
a9de9248
MH		 2204
2205 tasklet_enable(&hdev->tx_task);
2206}
2207
2208static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 2209{
a9de9248 2210 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 2211 struct hci_conn *conn;
2212
2213 BT_DBG("%s status %d", hdev->name, ev->status);
2214
2215 hci_dev_lock(hdev);
2216
2217 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 2218 if (conn) {
2219 conn->mode = ev->mode;
2220 conn->interval = __le16_to_cpu(ev->interval);
2221
2222 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2223 if (conn->mode == HCI_CM_ACTIVE)
2224 conn->power_save = 1;
2225 else
2226 conn->power_save = 0;
2227 }
e73439d8
MH		 2228
2229 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2230 hci_sco_setup(conn, ev->status);
04837f64
MH		 2231 }
2232
2233 hci_dev_unlock(hdev);
2234}
2235
a9de9248
MH		 2236static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2237{
052b30b0
MH		 2238 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2239 struct hci_conn *conn;
2240
a9de9248 2241 BT_DBG("%s", hdev->name);
052b30b0
MH		 2242
2243 hci_dev_lock(hdev);
2244
2245 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
b6f98044
WR		 2246 if (!conn)
2247 goto unlock;
2248
2249 if (conn->state == BT_CONNECTED) {
052b30b0
MH		 2250 hci_conn_hold(conn);
2251 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2252 hci_conn_put(conn);
2253 }
2254
03b555e1
JH		 2255 if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2256 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2257 sizeof(ev->bdaddr), &ev->bdaddr);
582fbe9e 2258 else if (test_bit(HCI_MGMT, &hdev->flags)) {
a770bb5a
WR		 2259 u8 secure;
2260
2261 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2262 secure = 1;
2263 else
2264 secure = 0;
2265
744cf19e 2266 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
a770bb5a 2267 }
980e1a53 2268
b6f98044 2269unlock:
052b30b0 2270 hci_dev_unlock(hdev);
a9de9248
MH		 2271}
2272
2273static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2274{
55ed8ca1
JH		 2275 struct hci_ev_link_key_req *ev = (void *) skb->data;
2276 struct hci_cp_link_key_reply cp;
2277 struct hci_conn *conn;
2278 struct link_key *key;
2279
a9de9248 2280 BT_DBG("%s", hdev->name);
55ed8ca1
JH		 2281
2282 if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2283 return;
2284
2285 hci_dev_lock(hdev);
2286
2287 key = hci_find_link_key(hdev, &ev->bdaddr);
2288 if (!key) {
2289 BT_DBG("%s link key not found for %s", hdev->name,
2290 batostr(&ev->bdaddr));
2291 goto not_found;
2292 }
2293
2294 BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2295 batostr(&ev->bdaddr));
2296
b6020ba0
WR		 2297 if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2298 key->type == HCI_LK_DEBUG_COMBINATION) {
55ed8ca1
JH		 2299 BT_DBG("%s ignoring debug key", hdev->name);
2300 goto not_found;
2301 }
2302
2303 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57
WR		 2304 if (conn) {
2305 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2306 conn->auth_type != 0xff &&
2307 (conn->auth_type & 0x01)) {
2308 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2309 goto not_found;
2310 }
55ed8ca1 2311
60b83f57
WR		 2312 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2313 conn->pending_sec_level == BT_SECURITY_HIGH) {
2314 BT_DBG("%s ignoring key unauthenticated for high \
2315 security", hdev->name);
2316 goto not_found;
2317 }
2318
2319 conn->key_type = key->type;
2320 conn->pin_length = key->pin_len;
55ed8ca1
JH		 2321 }
2322
2323 bacpy(&cp.bdaddr, &ev->bdaddr);
2324 memcpy(cp.link_key, key->val, 16);
2325
2326 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2327
2328 hci_dev_unlock(hdev);
2329
2330 return;
2331
2332not_found:
2333 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2334 hci_dev_unlock(hdev);
a9de9248
MH		 2335}
2336
2337static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2338{
052b30b0
MH		 2339 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2340 struct hci_conn *conn;
55ed8ca1 2341 u8 pin_len = 0;
052b30b0 2342
a9de9248 2343 BT_DBG("%s", hdev->name);
052b30b0
MH		 2344
2345 hci_dev_lock(hdev);
2346
2347 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2348 if (conn) {
2349 hci_conn_hold(conn);
2350 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
980e1a53 2351 pin_len = conn->pin_length;
13d39315
WR		 2352
2353 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2354 conn->key_type = ev->key_type;
2355
052b30b0
MH		 2356 hci_conn_put(conn);
2357 }
2358
55ed8ca1 2359 if (test_bit(HCI_LINK_KEYS, &hdev->flags))
d25e28ab 2360 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
55ed8ca1
JH		 2361 ev->key_type, pin_len);
2362
052b30b0 2363 hci_dev_unlock(hdev);
a9de9248
MH		 2364}
2365
1da177e4
LT		 2366static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2367{
a9de9248 2368 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 2369 struct hci_conn *conn;
1da177e4
LT		 2370
2371 BT_DBG("%s status %d", hdev->name, ev->status);
2372
2373 hci_dev_lock(hdev);
2374
04837f64 2375 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2376 if (conn && !ev->status) {
2377 struct inquiry_entry *ie;
2378
cc11b9c1
AE		 2379 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2380 if (ie) {
1da177e4
LT		 2381 ie->data.clock_offset = ev->clock_offset;
2382 ie->timestamp = jiffies;
2383 }
2384 }
2385
2386 hci_dev_unlock(hdev);
2387}
2388
a8746417
MH		 2389static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2390{
2391 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2392 struct hci_conn *conn;
2393
2394 BT_DBG("%s status %d", hdev->name, ev->status);
2395
2396 hci_dev_lock(hdev);
2397
2398 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2399 if (conn && !ev->status)
2400 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2401
2402 hci_dev_unlock(hdev);
2403}
2404
85a1e930
MH		 2405static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2406{
a9de9248 2407 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 2408 struct inquiry_entry *ie;
2409
2410 BT_DBG("%s", hdev->name);
2411
2412 hci_dev_lock(hdev);
2413
cc11b9c1
AE		 2414 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2415 if (ie) {
85a1e930
MH		 2416 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2417 ie->timestamp = jiffies;
2418 }
2419
2420 hci_dev_unlock(hdev);
2421}
2422
a9de9248
MH		 2423static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2424{
2425 struct inquiry_data data;
2426 int num_rsp = *((__u8 *) skb->data);
2427
2428 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2429
2430 if (!num_rsp)
2431 return;
2432
2433 hci_dev_lock(hdev);
2434
2435 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 2436 struct inquiry_info_with_rssi_and_pscan_mode *info;
2437 info = (void *) (skb->data + 1);
a9de9248 2438
e17acd40 2439 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 2440 bacpy(&data.bdaddr, &info->bdaddr);
2441 data.pscan_rep_mode = info->pscan_rep_mode;
2442 data.pscan_period_mode = info->pscan_period_mode;
2443 data.pscan_mode = info->pscan_mode;
2444 memcpy(data.dev_class, info->dev_class, 3);
2445 data.clock_offset = info->clock_offset;
2446 data.rssi = info->rssi;
41a96212 2447 data.ssp_mode = 0x00;
a9de9248 2448 hci_inquiry_cache_update(hdev, &data);
48264f06 2449 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
e17acd40
JH		 2450 info->dev_class, info->rssi,
2451 NULL);
a9de9248
MH		 2452 }
2453 } else {
2454 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2455
e17acd40 2456 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 2457 bacpy(&data.bdaddr, &info->bdaddr);
2458 data.pscan_rep_mode = info->pscan_rep_mode;
2459 data.pscan_period_mode = info->pscan_period_mode;
2460 data.pscan_mode = 0x00;
2461 memcpy(data.dev_class, info->dev_class, 3);
2462 data.clock_offset = info->clock_offset;
2463 data.rssi = info->rssi;
41a96212 2464 data.ssp_mode = 0x00;
a9de9248 2465 hci_inquiry_cache_update(hdev, &data);
48264f06 2466 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
e17acd40
JH		 2467 info->dev_class, info->rssi,
2468 NULL);
a9de9248
MH		 2469 }
2470 }
2471
2472 hci_dev_unlock(hdev);
2473}
2474
2475static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2476{
41a96212
MH		 2477 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2478 struct hci_conn *conn;
2479
a9de9248 2480 BT_DBG("%s", hdev->name);
41a96212 2481
41a96212
MH		 2482 hci_dev_lock(hdev);
2483
2484 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2485 if (!conn)
2486 goto unlock;
41a96212 2487
ccd556fe
JH		 2488 if (!ev->status && ev->page == 0x01) {
2489 struct inquiry_entry *ie;
41a96212 2490
cc11b9c1
AE		 2491 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2492 if (ie)
ccd556fe 2493 ie->data.ssp_mode = (ev->features[0] & 0x01);
769be974 2494
ccd556fe
JH		 2495 conn->ssp_mode = (ev->features[0] & 0x01);
2496 }
2497
2498 if (conn->state != BT_CONFIG)
2499 goto unlock;
2500
127178d2
JH		 2501 if (!ev->status) {
2502 struct hci_cp_remote_name_req cp;
2503 memset(&cp, 0, sizeof(cp));
2504 bacpy(&cp.bdaddr, &conn->dst);
2505 cp.pscan_rep_mode = 0x02;
2506 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2507 }
392599b9 2508
127178d2 2509 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 2510 conn->state = BT_CONNECTED;
2511 hci_proto_connect_cfm(conn, ev->status);
2512 hci_conn_put(conn);
41a96212
MH		 2513 }
2514
ccd556fe 2515unlock:
41a96212 2516 hci_dev_unlock(hdev);
a9de9248
MH		 2517}
2518
2519static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2520{
b6a0dc82
MH		 2521 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2522 struct hci_conn *conn;
2523
2524 BT_DBG("%s status %d", hdev->name, ev->status);
2525
2526 hci_dev_lock(hdev);
2527
2528 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 2529 if (!conn) {
2530 if (ev->link_type == ESCO_LINK)
2531 goto unlock;
2532
2533 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2534 if (!conn)
2535 goto unlock;
2536
2537 conn->type = SCO_LINK;
2538 }
b6a0dc82 2539
732547f9
MH		 2540 switch (ev->status) {
2541 case 0x00:
b6a0dc82
MH		 2542 conn->handle = __le16_to_cpu(ev->handle);
2543 conn->state = BT_CONNECTED;
7d0db0a3 2544
9eba32b8 2545 hci_conn_hold_device(conn);
7d0db0a3 2546 hci_conn_add_sysfs(conn);
732547f9
MH		 2547 break;
2548
705e5711 2549 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 2550 case 0x1c: /* SCO interval rejected */
1038a00b 2551 case 0x1a: /* Unsupported Remote Feature */
732547f9
MH		 2552 case 0x1f: /* Unspecified error */
2553 if (conn->out && conn->attempt < 2) {
2554 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2555 (hdev->esco_type & EDR_ESCO_MASK);
2556 hci_setup_sync(conn, conn->link->handle);
2557 goto unlock;
2558 }
2559 /* fall through */
2560
2561 default:
b6a0dc82 2562 conn->state = BT_CLOSED;
732547f9
MH		 2563 break;
2564 }
b6a0dc82
MH		 2565
2566 hci_proto_connect_cfm(conn, ev->status);
2567 if (ev->status)
2568 hci_conn_del(conn);
2569
2570unlock:
2571 hci_dev_unlock(hdev);
a9de9248
MH		 2572}
2573
2574static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2575{
2576 BT_DBG("%s", hdev->name);
2577}
2578
04837f64
MH		 2579static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2580{
a9de9248 2581 struct hci_ev_sniff_subrate *ev = (void *) skb->data;
04837f64
MH		 2582
2583 BT_DBG("%s status %d", hdev->name, ev->status);
04837f64
MH		 2584}
2585
a9de9248 2586static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2587{
a9de9248
MH		 2588 struct inquiry_data data;
2589 struct extended_inquiry_info *info = (void *) (skb->data + 1);
2590 int num_rsp = *((__u8 *) skb->data);
1da177e4 2591
a9de9248 2592 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 2593
a9de9248
MH		 2594 if (!num_rsp)
2595 return;
1da177e4 2596
a9de9248
MH		 2597 hci_dev_lock(hdev);
2598
e17acd40 2599 for (; num_rsp; num_rsp--, info++) {
a9de9248 2600 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 2601 data.pscan_rep_mode = info->pscan_rep_mode;
2602 data.pscan_period_mode = info->pscan_period_mode;
2603 data.pscan_mode = 0x00;
a9de9248 2604 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 2605 data.clock_offset = info->clock_offset;
2606 data.rssi = info->rssi;
41a96212 2607 data.ssp_mode = 0x01;
a9de9248 2608 hci_inquiry_cache_update(hdev, &data);
48264f06 2609 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4c659c39 2610 info->dev_class, info->rssi, info->data);
a9de9248
MH		 2611 }
2612
2613 hci_dev_unlock(hdev);
2614}
1da177e4 2615
17fa4b9d
JH		 2616static inline u8 hci_get_auth_req(struct hci_conn *conn)
2617{
2618 /* If remote requests dedicated bonding follow that lead */
2619 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2620 /* If both remote and local IO capabilities allow MITM
2621 * protection then require it, otherwise don't */
2622 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2623 return 0x02;
2624 else
2625 return 0x03;
2626 }
2627
2628 /* If remote requests no-bonding follow that lead */
2629 if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
58797bf7 2630 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d
JH		 2631
2632 return conn->auth_type;
2633}
2634
0493684e
MH		 2635static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2636{
2637 struct hci_ev_io_capa_request *ev = (void *) skb->data;
2638 struct hci_conn *conn;
2639
2640 BT_DBG("%s", hdev->name);
2641
2642 hci_dev_lock(hdev);
2643
2644 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 2645 if (!conn)
2646 goto unlock;
2647
2648 hci_conn_hold(conn);
2649
2650 if (!test_bit(HCI_MGMT, &hdev->flags))
2651 goto unlock;
2652
2653 if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2654 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 2655 struct hci_cp_io_capability_reply cp;
2656
2657 bacpy(&cp.bdaddr, &ev->bdaddr);
2658 cp.capability = conn->io_capability;
7cbc9bd9
JH		 2659 conn->auth_type = hci_get_auth_req(conn);
2660 cp.authentication = conn->auth_type;
17fa4b9d 2661
ce85ee13
SJ		 2662 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2663 hci_find_remote_oob_data(hdev, &conn->dst))
2664 cp.oob_data = 0x01;
2665 else
2666 cp.oob_data = 0x00;
2667
17fa4b9d
JH		 2668 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2669 sizeof(cp), &cp);
03b555e1
JH		 2670 } else {
2671 struct hci_cp_io_capability_neg_reply cp;
2672
2673 bacpy(&cp.bdaddr, &ev->bdaddr);
9f5a0d7b 2674 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
0493684e 2675
03b555e1
JH		 2676 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2677 sizeof(cp), &cp);
2678 }
2679
2680unlock:
2681 hci_dev_unlock(hdev);
2682}
2683
2684static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2685{
2686 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2687 struct hci_conn *conn;
2688
2689 BT_DBG("%s", hdev->name);
2690
2691 hci_dev_lock(hdev);
2692
2693 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2694 if (!conn)
2695 goto unlock;
2696
03b555e1
JH		 2697 conn->remote_cap = ev->capability;
2698 conn->remote_oob = ev->oob_data;
2699 conn->remote_auth = ev->authentication;
2700
2701unlock:
0493684e
MH		 2702 hci_dev_unlock(hdev);
2703}
2704
a5c29683
JH		 2705static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2706 struct sk_buff *skb)
2707{
2708 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 2709 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 2710 struct hci_conn *conn;
a5c29683
JH		 2711
2712 BT_DBG("%s", hdev->name);
2713
2714 hci_dev_lock(hdev);
2715
7a828908
JH		 2716 if (!test_bit(HCI_MGMT, &hdev->flags))
2717 goto unlock;
a5c29683 2718
7a828908
JH		 2719 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2720 if (!conn)
2721 goto unlock;
2722
2723 loc_mitm = (conn->auth_type & 0x01);
2724 rem_mitm = (conn->remote_auth & 0x01);
2725
2726 /* If we require MITM but the remote device can't provide that
2727 * (it has NoInputNoOutput) then reject the confirmation
2728 * request. The only exception is when we're dedicated bonding
2729 * initiators (connect_cfm_cb set) since then we always have the MITM
2730 * bit set. */
2731 if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2732 BT_DBG("Rejecting request: remote device can't provide MITM");
2733 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2734 sizeof(ev->bdaddr), &ev->bdaddr);
2735 goto unlock;
2736 }
2737
2738 /* If no side requires MITM protection; auto-accept */
2739 if ((!loc_mitm || conn->remote_cap == 0x03) &&
2740 (!rem_mitm || conn->io_capability == 0x03)) {
55bc1a37
JH		 2741
2742 /* If we're not the initiators request authorization to
2743 * proceed from user space (mgmt_user_confirm with
2744 * confirm_hint set to 1). */
2745 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2746 BT_DBG("Confirming auto-accept as acceptor");
2747 confirm_hint = 1;
2748 goto confirm;
2749 }
2750
9f61656a
JH		 2751 BT_DBG("Auto-accept of user confirmation with %ums delay",
2752 hdev->auto_accept_delay);
2753
2754 if (hdev->auto_accept_delay > 0) {
2755 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2756 mod_timer(&conn->auto_accept_timer, jiffies + delay);
2757 goto unlock;
2758 }
2759
7a828908
JH		 2760 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2761 sizeof(ev->bdaddr), &ev->bdaddr);
2762 goto unlock;
2763 }
2764
55bc1a37 2765confirm:
744cf19e 2766 mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
55bc1a37 2767 confirm_hint);
7a828908
JH		 2768
2769unlock:
a5c29683
JH		 2770 hci_dev_unlock(hdev);
2771}
2772
0493684e
MH		 2773static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2774{
2775 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2776 struct hci_conn *conn;
2777
2778 BT_DBG("%s", hdev->name);
2779
2780 hci_dev_lock(hdev);
2781
2782 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 2783 if (!conn)
2784 goto unlock;
2785
2786 /* To avoid duplicate auth_failed events to user space we check
2787 * the HCI_CONN_AUTH_PEND flag which will be set if we
2788 * initiated the authentication. A traditional auth_complete
2789 * event gets always produced as initiator and is also mapped to
2790 * the mgmt_auth_failed event */
2791 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
744cf19e 2792 mgmt_auth_failed(hdev, &conn->dst, ev->status);
0493684e 2793
2a611692
JH		 2794 hci_conn_put(conn);
2795
2796unlock:
0493684e
MH		 2797 hci_dev_unlock(hdev);
2798}
2799
41a96212
MH		 2800static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2801{
2802 struct hci_ev_remote_host_features *ev = (void *) skb->data;
2803 struct inquiry_entry *ie;
2804
2805 BT_DBG("%s", hdev->name);
2806
2807 hci_dev_lock(hdev);
2808
cc11b9c1
AE		 2809 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2810 if (ie)
41a96212
MH		 2811 ie->data.ssp_mode = (ev->features[0] & 0x01);
2812
2813 hci_dev_unlock(hdev);
2814}
2815
2763eda6
SJ		 2816static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2817 struct sk_buff *skb)
2818{
2819 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2820 struct oob_data *data;
2821
2822 BT_DBG("%s", hdev->name);
2823
2824 hci_dev_lock(hdev);
2825
e1ba1f15
SJ		 2826 if (!test_bit(HCI_MGMT, &hdev->flags))
2827 goto unlock;
2828
2763eda6
SJ		 2829 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2830 if (data) {
2831 struct hci_cp_remote_oob_data_reply cp;
2832
2833 bacpy(&cp.bdaddr, &ev->bdaddr);
2834 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2835 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2836
2837 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2838 &cp);
2839 } else {
2840 struct hci_cp_remote_oob_data_neg_reply cp;
2841
2842 bacpy(&cp.bdaddr, &ev->bdaddr);
2843 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2844 &cp);
2845 }
2846
e1ba1f15 2847unlock:
2763eda6
SJ		 2848 hci_dev_unlock(hdev);
2849}
2850
fcd89c09
VT		 2851static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2852{
2853 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2854 struct hci_conn *conn;
2855
2856 BT_DBG("%s status %d", hdev->name, ev->status);
2857
2858 hci_dev_lock(hdev);
2859
2860 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
b62f328b
VT		 2861 if (!conn) {
2862 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2863 if (!conn) {
2864 BT_ERR("No memory for new connection");
2865 hci_dev_unlock(hdev);
2866 return;
2867 }
29b7988a
AG		 2868
2869 conn->dst_type = ev->bdaddr_type;
b62f328b 2870 }
fcd89c09
VT		 2871
2872 if (ev->status) {
48264f06
JH		 2873 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
2874 conn->dst_type, ev->status);
fcd89c09
VT		 2875 hci_proto_connect_cfm(conn, ev->status);
2876 conn->state = BT_CLOSED;
2877 hci_conn_del(conn);
2878 goto unlock;
2879 }
2880
48264f06 2881 mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
83bc71b4 2882
7b5c0d52 2883 conn->sec_level = BT_SECURITY_LOW;
fcd89c09
VT		 2884 conn->handle = __le16_to_cpu(ev->handle);
2885 conn->state = BT_CONNECTED;
2886
2887 hci_conn_hold_device(conn);
2888 hci_conn_add_sysfs(conn);
2889
2890 hci_proto_connect_cfm(conn, ev->status);
2891
2892unlock:
2893 hci_dev_unlock(hdev);
2894}
2895
9aa04c91
AG		 2896static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
2897 struct sk_buff *skb)
2898{
e95beb41
AG		 2899 u8 num_reports = skb->data[0];
2900 void *ptr = &skb->data[1];
9aa04c91
AG		 2901
2902 hci_dev_lock(hdev);
2903
e95beb41
AG		 2904 while (num_reports--) {
2905 struct hci_ev_le_advertising_info *ev = ptr;
9aa04c91 2906
9aa04c91 2907 hci_add_adv_entry(hdev, ev);
e95beb41
AG		 2908
2909 ptr += sizeof(*ev) + ev->length + 1;
9aa04c91
AG		 2910 }
2911
2912 hci_dev_unlock(hdev);
2913}
2914
a7a595f6
VCG		 2915static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
2916 struct sk_buff *skb)
2917{
2918 struct hci_ev_le_ltk_req *ev = (void *) skb->data;
2919 struct hci_cp_le_ltk_reply cp;
bea710fe 2920 struct hci_cp_le_ltk_neg_reply neg;
a7a595f6 2921 struct hci_conn *conn;
bea710fe 2922 struct link_key *ltk;
a7a595f6
VCG		 2923
2924 BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
2925
2926 hci_dev_lock(hdev);
2927
2928 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
bea710fe
VCG		 2929 if (conn == NULL)
2930 goto not_found;
a7a595f6 2931
bea710fe
VCG		 2932 ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
2933 if (ltk == NULL)
2934 goto not_found;
2935
2936 memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
a7a595f6 2937 cp.handle = cpu_to_le16(conn->handle);
726b4ffc 2938 conn->pin_length = ltk->pin_len;
a7a595f6
VCG		 2939
2940 hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
2941
2942 hci_dev_unlock(hdev);
bea710fe
VCG		 2943
2944 return;
2945
2946not_found:
2947 neg.handle = ev->handle;
2948 hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
2949 hci_dev_unlock(hdev);
a7a595f6
VCG		 2950}
2951
fcd89c09
VT		 2952static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2953{
2954 struct hci_ev_le_meta *le_ev = (void *) skb->data;
2955
2956 skb_pull(skb, sizeof(*le_ev));
2957
2958 switch (le_ev->subevent) {
2959 case HCI_EV_LE_CONN_COMPLETE:
2960 hci_le_conn_complete_evt(hdev, skb);
2961 break;
2962
9aa04c91
AG		 2963 case HCI_EV_LE_ADVERTISING_REPORT:
2964 hci_le_adv_report_evt(hdev, skb);
2965 break;
2966
a7a595f6
VCG		 2967 case HCI_EV_LE_LTK_REQ:
2968 hci_le_ltk_request_evt(hdev, skb);
2969 break;
2970
fcd89c09
VT		 2971 default:
2972 break;
2973 }
2974}
2975
a9de9248
MH		 2976void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2977{
2978 struct hci_event_hdr *hdr = (void *) skb->data;
2979 __u8 event = hdr->evt;
2980
2981 skb_pull(skb, HCI_EVENT_HDR_SIZE);
2982
2983 switch (event) {
1da177e4
LT		 2984 case HCI_EV_INQUIRY_COMPLETE:
2985 hci_inquiry_complete_evt(hdev, skb);
2986 break;
2987
2988 case HCI_EV_INQUIRY_RESULT:
2989 hci_inquiry_result_evt(hdev, skb);
2990 break;
2991
a9de9248
MH		 2992 case HCI_EV_CONN_COMPLETE:
2993 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 2994 break;
2995
1da177e4
LT		 2996 case HCI_EV_CONN_REQUEST:
2997 hci_conn_request_evt(hdev, skb);
2998 break;
2999
1da177e4
LT		 3000 case HCI_EV_DISCONN_COMPLETE:
3001 hci_disconn_complete_evt(hdev, skb);
3002 break;
3003
1da177e4
LT		 3004 case HCI_EV_AUTH_COMPLETE:
3005 hci_auth_complete_evt(hdev, skb);
3006 break;
3007
a9de9248
MH		 3008 case HCI_EV_REMOTE_NAME:
3009 hci_remote_name_evt(hdev, skb);
3010 break;
3011
1da177e4
LT		 3012 case HCI_EV_ENCRYPT_CHANGE:
3013 hci_encrypt_change_evt(hdev, skb);
3014 break;
3015
a9de9248
MH		 3016 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3017 hci_change_link_key_complete_evt(hdev, skb);
3018 break;
3019
3020 case HCI_EV_REMOTE_FEATURES:
3021 hci_remote_features_evt(hdev, skb);
3022 break;
3023
3024 case HCI_EV_REMOTE_VERSION:
3025 hci_remote_version_evt(hdev, skb);
3026 break;
3027
3028 case HCI_EV_QOS_SETUP_COMPLETE:
3029 hci_qos_setup_complete_evt(hdev, skb);
3030 break;
3031
3032 case HCI_EV_CMD_COMPLETE:
3033 hci_cmd_complete_evt(hdev, skb);
3034 break;
3035
3036 case HCI_EV_CMD_STATUS:
3037 hci_cmd_status_evt(hdev, skb);
3038 break;
3039
3040 case HCI_EV_ROLE_CHANGE:
3041 hci_role_change_evt(hdev, skb);
3042 break;
3043
3044 case HCI_EV_NUM_COMP_PKTS:
3045 hci_num_comp_pkts_evt(hdev, skb);
3046 break;
3047
3048 case HCI_EV_MODE_CHANGE:
3049 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 3050 break;
3051
3052 case HCI_EV_PIN_CODE_REQ:
3053 hci_pin_code_request_evt(hdev, skb);
3054 break;
3055
3056 case HCI_EV_LINK_KEY_REQ:
3057 hci_link_key_request_evt(hdev, skb);
3058 break;
3059
3060 case HCI_EV_LINK_KEY_NOTIFY:
3061 hci_link_key_notify_evt(hdev, skb);
3062 break;
3063
3064 case HCI_EV_CLOCK_OFFSET:
3065 hci_clock_offset_evt(hdev, skb);
3066 break;
3067
a8746417
MH		 3068 case HCI_EV_PKT_TYPE_CHANGE:
3069 hci_pkt_type_change_evt(hdev, skb);
3070 break;
3071
85a1e930
MH		 3072 case HCI_EV_PSCAN_REP_MODE:
3073 hci_pscan_rep_mode_evt(hdev, skb);
3074 break;
3075
a9de9248
MH		 3076 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3077 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 3078 break;
3079
a9de9248
MH		 3080 case HCI_EV_REMOTE_EXT_FEATURES:
3081 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 3082 break;
3083
a9de9248
MH		 3084 case HCI_EV_SYNC_CONN_COMPLETE:
3085 hci_sync_conn_complete_evt(hdev, skb);
3086 break;
1da177e4 3087
a9de9248
MH		 3088 case HCI_EV_SYNC_CONN_CHANGED:
3089 hci_sync_conn_changed_evt(hdev, skb);
3090 break;
1da177e4 3091
a9de9248
MH		 3092 case HCI_EV_SNIFF_SUBRATE:
3093 hci_sniff_subrate_evt(hdev, skb);
3094 break;
1da177e4 3095
a9de9248
MH		 3096 case HCI_EV_EXTENDED_INQUIRY_RESULT:
3097 hci_extended_inquiry_result_evt(hdev, skb);
3098 break;
1da177e4 3099
0493684e
MH		 3100 case HCI_EV_IO_CAPA_REQUEST:
3101 hci_io_capa_request_evt(hdev, skb);
3102 break;
3103
03b555e1
JH		 3104 case HCI_EV_IO_CAPA_REPLY:
3105 hci_io_capa_reply_evt(hdev, skb);
3106 break;
3107
a5c29683
JH		 3108 case HCI_EV_USER_CONFIRM_REQUEST:
3109 hci_user_confirm_request_evt(hdev, skb);
3110 break;
3111
0493684e
MH		 3112 case HCI_EV_SIMPLE_PAIR_COMPLETE:
3113 hci_simple_pair_complete_evt(hdev, skb);
3114 break;
3115
41a96212
MH		 3116 case HCI_EV_REMOTE_HOST_FEATURES:
3117 hci_remote_host_features_evt(hdev, skb);
3118 break;
3119
fcd89c09
VT		 3120 case HCI_EV_LE_META:
3121 hci_le_meta_evt(hdev, skb);
3122 break;
3123
2763eda6
SJ		 3124 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3125 hci_remote_oob_data_request_evt(hdev, skb);
3126 break;
3127
a9de9248
MH		 3128 default:
3129 BT_DBG("%s event 0x%x", hdev->name, event);
1da177e4
LT		 3130 break;
3131 }
3132
3133 kfree_skb(skb);
3134 hdev->stat.evt_rx++;
3135}
3136
3137/* Generate internal stack event */
3138void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3139{
3140 struct hci_event_hdr *hdr;
3141 struct hci_ev_stack_internal *ev;
3142 struct sk_buff *skb;
3143
3144 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3145 if (!skb)
3146 return;
3147
3148 hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3149 hdr->evt = HCI_EV_STACK_INTERNAL;
3150 hdr->plen = sizeof(*ev) + dlen;
3151
3152 ev = (void *) skb_put(skb, sizeof(*ev) + dlen);
3153 ev->type = type;
3154 memcpy(ev->data, data, dlen);
3155
576c7d85 3156 bt_cb(skb)->incoming = 1;
a61bbcf2 3157 __net_timestamp(skb);
576c7d85 3158
0d48d939 3159 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1da177e4 3160 skb->dev = (void *) hdev;
eec8d2bc 3161 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 3162 kfree_skb(skb);
3163}
e6100a25 3164
669bb396 3165module_param(enable_le, bool, 0644);
e6100a25 3166MODULE_PARM_DESC(enable_le, "Enable LE support");
kernel source for telekom puls (alcatel/mediatek)