projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix logic in hci_pin_code_request_evt
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_event.c
CommitLineData
8e87d142 1/*
1da177e4 2 BlueZ - Bluetooth protocol stack for Linux
2d0a0346 3 Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
1da177e4
LT		 4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI event handling. */
26
1da177e4
LT		 27#include <linux/module.h>
28
29#include <linux/types.h>
30#include <linux/errno.h>
31#include <linux/kernel.h>
1da177e4
LT		 32#include <linux/slab.h>
33#include <linux/poll.h>
34#include <linux/fcntl.h>
35#include <linux/init.h>
36#include <linux/skbuff.h>
37#include <linux/interrupt.h>
38#include <linux/notifier.h>
39#include <net/sock.h>
40
41#include <asm/system.h>
70f23020 42#include <linux/uaccess.h>
1da177e4
LT		 43#include <asm/unaligned.h>
44
45#include <net/bluetooth/bluetooth.h>
46#include <net/bluetooth/hci_core.h>
47
1da177e4
LT		 48/* Handle HCI Event packets */
49
a9de9248 50static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 51{
a9de9248 52 __u8 status = *((__u8 *) skb->data);
1da177e4 53
a9de9248 54 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 55
a9de9248
MH		 56 if (status)
57 return;
1da177e4 58
314b2381
JH		 59 if (test_bit(HCI_MGMT, &hdev->flags) &&
60 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
61 mgmt_discovering(hdev->id, 0);
6bd57416 62
23bb5763 63 hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
a9de9248
MH		 64
65 hci_conn_check_pending(hdev);
66}
6bd57416 67
a9de9248
MH		 68static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
69{
70 __u8 status = *((__u8 *) skb->data);
6bd57416 71
a9de9248 72 BT_DBG("%s status 0x%x", hdev->name, status);
6bd57416 73
a9de9248
MH		 74 if (status)
75 return;
1da177e4 76
314b2381
JH		 77 if (test_bit(HCI_MGMT, &hdev->flags) &&
78 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
79 mgmt_discovering(hdev->id, 0);
a9de9248
MH		 80
81 hci_conn_check_pending(hdev);
82}
83
84static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
85{
86 BT_DBG("%s", hdev->name);
87}
88
89static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
90{
91 struct hci_rp_role_discovery *rp = (void *) skb->data;
92 struct hci_conn *conn;
93
94 BT_DBG("%s status 0x%x", hdev->name, rp->status);
95
96 if (rp->status)
97 return;
98
99 hci_dev_lock(hdev);
100
101 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
102 if (conn) {
103 if (rp->role)
104 conn->link_mode &= ~HCI_LM_MASTER;
105 else
106 conn->link_mode |= HCI_LM_MASTER;
1da177e4 107 }
a9de9248
MH		 108
109 hci_dev_unlock(hdev);
1da177e4
LT		 110}
111
e4e8e37c
MH		 112static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
113{
114 struct hci_rp_read_link_policy *rp = (void *) skb->data;
115 struct hci_conn *conn;
116
117 BT_DBG("%s status 0x%x", hdev->name, rp->status);
118
119 if (rp->status)
120 return;
121
122 hci_dev_lock(hdev);
123
124 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
125 if (conn)
126 conn->link_policy = __le16_to_cpu(rp->policy);
127
128 hci_dev_unlock(hdev);
129}
130
a9de9248 131static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 132{
a9de9248 133 struct hci_rp_write_link_policy *rp = (void *) skb->data;
1da177e4 134 struct hci_conn *conn;
04837f64 135 void *sent;
1da177e4 136
a9de9248 137 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 138
a9de9248
MH		 139 if (rp->status)
140 return;
1da177e4 141
a9de9248
MH		 142 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
143 if (!sent)
144 return;
1da177e4 145
a9de9248 146 hci_dev_lock(hdev);
1da177e4 147
a9de9248 148 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
e4e8e37c 149 if (conn)
83985319 150 conn->link_policy = get_unaligned_le16(sent + 2);
1da177e4 151
a9de9248
MH		 152 hci_dev_unlock(hdev);
153}
1da177e4 154
e4e8e37c
MH		 155static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
156{
157 struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
158
159 BT_DBG("%s status 0x%x", hdev->name, rp->status);
160
161 if (rp->status)
162 return;
163
164 hdev->link_policy = __le16_to_cpu(rp->policy);
165}
166
167static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
168{
169 __u8 status = *((__u8 *) skb->data);
170 void *sent;
171
172 BT_DBG("%s status 0x%x", hdev->name, status);
173
174 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
175 if (!sent)
176 return;
177
178 if (!status)
179 hdev->link_policy = get_unaligned_le16(sent);
180
23bb5763 181 hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
e4e8e37c
MH		 182}
183
a9de9248
MH		 184static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
185{
186 __u8 status = *((__u8 *) skb->data);
04837f64 187
a9de9248 188 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 189
10572132
GP		 190 clear_bit(HCI_RESET, &hdev->flags);
191
23bb5763 192 hci_req_complete(hdev, HCI_OP_RESET, status);
a9de9248 193}
04837f64 194
a9de9248
MH		 195static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
196{
197 __u8 status = *((__u8 *) skb->data);
198 void *sent;
04837f64 199
a9de9248 200 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 201
a9de9248
MH		 202 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
203 if (!sent)
204 return;
04837f64 205
b312b161
JH		 206 if (test_bit(HCI_MGMT, &hdev->flags))
207 mgmt_set_local_name_complete(hdev->id, sent, status);
208
209 if (status)
210 return;
211
1f6c6378 212 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 213}
214
215static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
216{
217 struct hci_rp_read_local_name *rp = (void *) skb->data;
218
219 BT_DBG("%s status 0x%x", hdev->name, rp->status);
220
221 if (rp->status)
222 return;
223
1f6c6378 224 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
a9de9248
MH		 225}
226
227static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
228{
229 __u8 status = *((__u8 *) skb->data);
230 void *sent;
231
232 BT_DBG("%s status 0x%x", hdev->name, status);
233
234 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
235 if (!sent)
236 return;
237
238 if (!status) {
239 __u8 param = *((__u8 *) sent);
240
241 if (param == AUTH_ENABLED)
242 set_bit(HCI_AUTH, &hdev->flags);
243 else
244 clear_bit(HCI_AUTH, &hdev->flags);
1da177e4 245 }
a9de9248 246
23bb5763 247 hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
1da177e4
LT		 248}
249
a9de9248 250static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 251{
a9de9248 252 __u8 status = *((__u8 *) skb->data);
1da177e4
LT		 253 void *sent;
254
a9de9248 255 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 256
a9de9248
MH		 257 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
258 if (!sent)
259 return;
1da177e4 260
a9de9248
MH		 261 if (!status) {
262 __u8 param = *((__u8 *) sent);
263
264 if (param)
265 set_bit(HCI_ENCRYPT, &hdev->flags);
266 else
267 clear_bit(HCI_ENCRYPT, &hdev->flags);
268 }
1da177e4 269
23bb5763 270 hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
a9de9248 271}
1da177e4 272
a9de9248
MH		 273static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
274{
275 __u8 status = *((__u8 *) skb->data);
276 void *sent;
1da177e4 277
a9de9248 278 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 279
a9de9248
MH		 280 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
281 if (!sent)
282 return;
1da177e4 283
a9de9248
MH		 284 if (!status) {
285 __u8 param = *((__u8 *) sent);
9fbcbb45 286 int old_pscan, old_iscan;
1da177e4 287
9fbcbb45
JH		 288 old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
289 old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
1da177e4 290
73f22f62 291 if (param & SCAN_INQUIRY) {
a9de9248 292 set_bit(HCI_ISCAN, &hdev->flags);
9fbcbb45
JH		 293 if (!old_iscan)
294 mgmt_discoverable(hdev->id, 1);
295 } else if (old_iscan)
73f22f62 296 mgmt_discoverable(hdev->id, 0);
1da177e4 297
9fbcbb45 298 if (param & SCAN_PAGE) {
a9de9248 299 set_bit(HCI_PSCAN, &hdev->flags);
9fbcbb45
JH		 300 if (!old_pscan)
301 mgmt_connectable(hdev->id, 1);
302 } else if (old_pscan)
303 mgmt_connectable(hdev->id, 0);
a9de9248 304 }
1da177e4 305
23bb5763 306 hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
a9de9248 307}
1da177e4 308
a9de9248
MH		 309static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
310{
311 struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
1da177e4 312
a9de9248 313 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 314
a9de9248
MH		 315 if (rp->status)
316 return;
1da177e4 317
a9de9248 318 memcpy(hdev->dev_class, rp->dev_class, 3);
1da177e4 319
a9de9248
MH		 320 BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
321 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
322}
1da177e4 323
a9de9248
MH		 324static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
325{
326 __u8 status = *((__u8 *) skb->data);
327 void *sent;
1da177e4 328
a9de9248 329 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 330
f383f275
MH		 331 if (status)
332 return;
333
a9de9248
MH		 334 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
335 if (!sent)
336 return;
1da177e4 337
f383f275 338 memcpy(hdev->dev_class, sent, 3);
a9de9248 339}
1da177e4 340
a9de9248
MH		 341static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
342{
343 struct hci_rp_read_voice_setting *rp = (void *) skb->data;
344 __u16 setting;
345
346 BT_DBG("%s status 0x%x", hdev->name, rp->status);
347
348 if (rp->status)
349 return;
350
351 setting = __le16_to_cpu(rp->voice_setting);
352
f383f275 353 if (hdev->voice_setting == setting)
a9de9248
MH		 354 return;
355
356 hdev->voice_setting = setting;
357
358 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
359
360 if (hdev->notify) {
361 tasklet_disable(&hdev->tx_task);
362 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
363 tasklet_enable(&hdev->tx_task);
364 }
365}
366
367static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
368{
369 __u8 status = *((__u8 *) skb->data);
f383f275 370 __u16 setting;
a9de9248
MH		 371 void *sent;
372
373 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 374
f383f275
MH		 375 if (status)
376 return;
377
a9de9248
MH		 378 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
379 if (!sent)
380 return;
1da177e4 381
f383f275 382 setting = get_unaligned_le16(sent);
1da177e4 383
f383f275
MH		 384 if (hdev->voice_setting == setting)
385 return;
386
387 hdev->voice_setting = setting;
1da177e4 388
f383f275 389 BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
1da177e4 390
f383f275
MH		 391 if (hdev->notify) {
392 tasklet_disable(&hdev->tx_task);
393 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
394 tasklet_enable(&hdev->tx_task);
1da177e4
LT		 395 }
396}
397
a9de9248 398static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 399{
a9de9248 400 __u8 status = *((__u8 *) skb->data);
1da177e4 401
a9de9248 402 BT_DBG("%s status 0x%x", hdev->name, status);
1da177e4 403
23bb5763 404 hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
a9de9248 405}
1143e5a6 406
333140b5
MH		 407static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
408{
409 struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
410
411 BT_DBG("%s status 0x%x", hdev->name, rp->status);
412
413 if (rp->status)
414 return;
415
416 hdev->ssp_mode = rp->mode;
417}
418
419static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
420{
421 __u8 status = *((__u8 *) skb->data);
422 void *sent;
423
424 BT_DBG("%s status 0x%x", hdev->name, status);
425
426 if (status)
427 return;
428
429 sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
430 if (!sent)
431 return;
432
433 hdev->ssp_mode = *((__u8 *) sent);
434}
435
d5859e22
JH		 436static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
437{
438 if (hdev->features[6] & LMP_EXT_INQ)
439 return 2;
440
441 if (hdev->features[3] & LMP_RSSI_INQ)
442 return 1;
443
444 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
445 hdev->lmp_subver == 0x0757)
446 return 1;
447
448 if (hdev->manufacturer == 15) {
449 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
450 return 1;
451 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
452 return 1;
453 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
454 return 1;
455 }
456
457 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
458 hdev->lmp_subver == 0x1805)
459 return 1;
460
461 return 0;
462}
463
464static void hci_setup_inquiry_mode(struct hci_dev *hdev)
465{
466 u8 mode;
467
468 mode = hci_get_inquiry_mode(hdev);
469
470 hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
471}
472
473static void hci_setup_event_mask(struct hci_dev *hdev)
474{
475 /* The second byte is 0xff instead of 0x9f (two reserved bits
476 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
477 * command otherwise */
478 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
479
480 /* Events for 1.2 and newer controllers */
481 if (hdev->lmp_ver > 1) {
482 events[4] |= 0x01; /* Flow Specification Complete */
483 events[4] |= 0x02; /* Inquiry Result with RSSI */
484 events[4] |= 0x04; /* Read Remote Extended Features Complete */
485 events[5] |= 0x08; /* Synchronous Connection Complete */
486 events[5] |= 0x10; /* Synchronous Connection Changed */
487 }
488
489 if (hdev->features[3] & LMP_RSSI_INQ)
490 events[4] |= 0x04; /* Inquiry Result with RSSI */
491
492 if (hdev->features[5] & LMP_SNIFF_SUBR)
493 events[5] |= 0x20; /* Sniff Subrating */
494
495 if (hdev->features[5] & LMP_PAUSE_ENC)
496 events[5] |= 0x80; /* Encryption Key Refresh Complete */
497
498 if (hdev->features[6] & LMP_EXT_INQ)
499 events[5] |= 0x40; /* Extended Inquiry Result */
500
501 if (hdev->features[6] & LMP_NO_FLUSH)
502 events[7] |= 0x01; /* Enhanced Flush Complete */
503
504 if (hdev->features[7] & LMP_LSTO)
505 events[6] |= 0x80; /* Link Supervision Timeout Changed */
506
507 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
508 events[6] |= 0x01; /* IO Capability Request */
509 events[6] |= 0x02; /* IO Capability Response */
510 events[6] |= 0x04; /* User Confirmation Request */
511 events[6] |= 0x08; /* User Passkey Request */
512 events[6] |= 0x10; /* Remote OOB Data Request */
513 events[6] |= 0x20; /* Simple Pairing Complete */
514 events[7] |= 0x04; /* User Passkey Notification */
515 events[7] |= 0x08; /* Keypress Notification */
516 events[7] |= 0x10; /* Remote Host Supported
517 * Features Notification */
518 }
519
520 if (hdev->features[4] & LMP_LE)
521 events[7] |= 0x20; /* LE Meta-Event */
522
523 hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
524}
525
526static void hci_setup(struct hci_dev *hdev)
527{
528 hci_setup_event_mask(hdev);
529
530 if (hdev->lmp_ver > 1)
531 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
532
533 if (hdev->features[6] & LMP_SIMPLE_PAIR) {
534 u8 mode = 0x01;
535 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
536 }
537
538 if (hdev->features[3] & LMP_RSSI_INQ)
539 hci_setup_inquiry_mode(hdev);
540
541 if (hdev->features[7] & LMP_INQ_TX_PWR)
542 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
543}
544
a9de9248
MH		 545static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
546{
547 struct hci_rp_read_local_version *rp = (void *) skb->data;
1143e5a6 548
a9de9248 549 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1143e5a6 550
a9de9248
MH		 551 if (rp->status)
552 return;
1143e5a6 553
a9de9248 554 hdev->hci_ver = rp->hci_ver;
e4e8e37c 555 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
d5859e22 556 hdev->lmp_ver = rp->lmp_ver;
e4e8e37c 557 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
d5859e22 558 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
1143e5a6 559
a9de9248
MH		 560 BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
561 hdev->manufacturer,
562 hdev->hci_ver, hdev->hci_rev);
d5859e22
JH		 563
564 if (test_bit(HCI_INIT, &hdev->flags))
565 hci_setup(hdev);
566}
567
568static void hci_setup_link_policy(struct hci_dev *hdev)
569{
570 u16 link_policy = 0;
571
572 if (hdev->features[0] & LMP_RSWITCH)
573 link_policy |= HCI_LP_RSWITCH;
574 if (hdev->features[0] & LMP_HOLD)
575 link_policy |= HCI_LP_HOLD;
576 if (hdev->features[0] & LMP_SNIFF)
577 link_policy |= HCI_LP_SNIFF;
578 if (hdev->features[1] & LMP_PARK)
579 link_policy |= HCI_LP_PARK;
580
581 link_policy = cpu_to_le16(link_policy);
582 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
583 sizeof(link_policy), &link_policy);
a9de9248 584}
1da177e4 585
a9de9248
MH		 586static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
587{
588 struct hci_rp_read_local_commands *rp = (void *) skb->data;
1da177e4 589
a9de9248 590 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 591
a9de9248 592 if (rp->status)
d5859e22 593 goto done;
1da177e4 594
a9de9248 595 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
d5859e22
JH		 596
597 if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
598 hci_setup_link_policy(hdev);
599
600done:
601 hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
a9de9248 602}
1da177e4 603
a9de9248
MH		 604static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
605{
606 struct hci_rp_read_local_features *rp = (void *) skb->data;
5b7f9909 607
a9de9248 608 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 609
a9de9248
MH		 610 if (rp->status)
611 return;
5b7f9909 612
a9de9248 613 memcpy(hdev->features, rp->features, 8);
5b7f9909 614
a9de9248
MH		 615 /* Adjust default settings according to features
616 * supported by device. */
1da177e4 617
a9de9248
MH		 618 if (hdev->features[0] & LMP_3SLOT)
619 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
1da177e4 620
a9de9248
MH		 621 if (hdev->features[0] & LMP_5SLOT)
622 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
1da177e4 623
a9de9248
MH		 624 if (hdev->features[1] & LMP_HV2) {
625 hdev->pkt_type |= (HCI_HV2);
626 hdev->esco_type |= (ESCO_HV2);
627 }
1da177e4 628
a9de9248
MH		 629 if (hdev->features[1] & LMP_HV3) {
630 hdev->pkt_type |= (HCI_HV3);
631 hdev->esco_type |= (ESCO_HV3);
632 }
1da177e4 633
a9de9248
MH		 634 if (hdev->features[3] & LMP_ESCO)
635 hdev->esco_type |= (ESCO_EV3);
da1f5198 636
a9de9248
MH		 637 if (hdev->features[4] & LMP_EV4)
638 hdev->esco_type |= (ESCO_EV4);
da1f5198 639
a9de9248
MH		 640 if (hdev->features[4] & LMP_EV5)
641 hdev->esco_type |= (ESCO_EV5);
1da177e4 642
efc7688b
MH		 643 if (hdev->features[5] & LMP_EDR_ESCO_2M)
644 hdev->esco_type |= (ESCO_2EV3);
645
646 if (hdev->features[5] & LMP_EDR_ESCO_3M)
647 hdev->esco_type |= (ESCO_3EV3);
648
649 if (hdev->features[5] & LMP_EDR_3S_ESCO)
650 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
651
a9de9248
MH		 652 BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
653 hdev->features[0], hdev->features[1],
654 hdev->features[2], hdev->features[3],
655 hdev->features[4], hdev->features[5],
656 hdev->features[6], hdev->features[7]);
657}
1da177e4 658
a9de9248
MH		 659static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
660{
661 struct hci_rp_read_buffer_size *rp = (void *) skb->data;
1da177e4 662
a9de9248 663 BT_DBG("%s status 0x%x", hdev->name, rp->status);
1da177e4 664
a9de9248
MH		 665 if (rp->status)
666 return;
1da177e4 667
a9de9248
MH		 668 hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
669 hdev->sco_mtu = rp->sco_mtu;
670 hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
671 hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
672
673 if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
674 hdev->sco_mtu = 64;
675 hdev->sco_pkts = 8;
1da177e4 676 }
a9de9248
MH		 677
678 hdev->acl_cnt = hdev->acl_pkts;
679 hdev->sco_cnt = hdev->sco_pkts;
680
681 BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
682 hdev->acl_mtu, hdev->acl_pkts,
683 hdev->sco_mtu, hdev->sco_pkts);
684}
685
686static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
687{
688 struct hci_rp_read_bd_addr *rp = (void *) skb->data;
689
690 BT_DBG("%s status 0x%x", hdev->name, rp->status);
691
692 if (!rp->status)
693 bacpy(&hdev->bdaddr, &rp->bdaddr);
694
23bb5763
JH		 695 hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
696}
697
698static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
699{
700 __u8 status = *((__u8 *) skb->data);
701
702 BT_DBG("%s status 0x%x", hdev->name, status);
703
704 hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
a9de9248
MH		 705}
706
b0916ea0
JH		 707static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
708 struct sk_buff *skb)
709{
710 __u8 status = *((__u8 *) skb->data);
711
712 BT_DBG("%s status 0x%x", hdev->name, status);
713
714 hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
715}
716
d5859e22
JH		 717static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
718{
719 __u8 status = *((__u8 *) skb->data);
720
721 BT_DBG("%s status 0x%x", hdev->name, status);
722
723 hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
724}
725
726static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
727 struct sk_buff *skb)
728{
729 __u8 status = *((__u8 *) skb->data);
730
731 BT_DBG("%s status 0x%x", hdev->name, status);
732
733 hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
734}
735
736static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
737 struct sk_buff *skb)
738{
739 __u8 status = *((__u8 *) skb->data);
740
741 BT_DBG("%s status 0x%x", hdev->name, status);
742
743 hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
744}
745
746static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
747{
748 __u8 status = *((__u8 *) skb->data);
749
750 BT_DBG("%s status 0x%x", hdev->name, status);
751
752 hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
753}
754
980e1a53
JH		 755static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
756{
757 struct hci_rp_pin_code_reply *rp = (void *) skb->data;
758 struct hci_cp_pin_code_reply *cp;
759 struct hci_conn *conn;
760
761 BT_DBG("%s status 0x%x", hdev->name, rp->status);
762
763 if (test_bit(HCI_MGMT, &hdev->flags))
764 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
765
766 if (rp->status != 0)
767 return;
768
769 cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
770 if (!cp)
771 return;
772
773 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
774 if (conn)
775 conn->pin_length = cp->pin_len;
776}
777
778static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
779{
780 struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
781
782 BT_DBG("%s status 0x%x", hdev->name, rp->status);
783
784 if (test_bit(HCI_MGMT, &hdev->flags))
785 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
786 rp->status);
787}
6ed58ec5
VT		 788static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
789 struct sk_buff *skb)
790{
791 struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
792
793 BT_DBG("%s status 0x%x", hdev->name, rp->status);
794
795 if (rp->status)
796 return;
797
798 hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
799 hdev->le_pkts = rp->le_max_pkt;
800
801 hdev->le_cnt = hdev->le_pkts;
802
803 BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
804
805 hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
806}
980e1a53 807
a5c29683
JH		 808static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
809{
810 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
811
812 BT_DBG("%s status 0x%x", hdev->name, rp->status);
813
814 if (test_bit(HCI_MGMT, &hdev->flags))
815 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
816 rp->status);
817}
818
819static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
820 struct sk_buff *skb)
821{
822 struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
823
824 BT_DBG("%s status 0x%x", hdev->name, rp->status);
825
826 if (test_bit(HCI_MGMT, &hdev->flags))
827 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
828 rp->status);
829}
830
c35938b2
SJ		 831static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
832 struct sk_buff *skb)
833{
834 struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
835
836 BT_DBG("%s status 0x%x", hdev->name, rp->status);
837
838 mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
839 rp->randomizer, rp->status);
840}
841
a9de9248
MH		 842static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
843{
844 BT_DBG("%s status 0x%x", hdev->name, status);
845
846 if (status) {
23bb5763 847 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
a9de9248 848 hci_conn_check_pending(hdev);
314b2381
JH		 849 return;
850 }
851
852 if (test_bit(HCI_MGMT, &hdev->flags) &&
853 !test_and_set_bit(HCI_INQUIRY,
854 &hdev->flags))
855 mgmt_discovering(hdev->id, 1);
1da177e4
LT		 856}
857
1da177e4
LT		 858static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
859{
a9de9248 860 struct hci_cp_create_conn *cp;
1da177e4 861 struct hci_conn *conn;
1da177e4 862
a9de9248
MH		 863 BT_DBG("%s status 0x%x", hdev->name, status);
864
865 cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1da177e4
LT		 866 if (!cp)
867 return;
868
869 hci_dev_lock(hdev);
870
871 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
872
a9de9248 873 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1da177e4
LT		 874
875 if (status) {
876 if (conn && conn->state == BT_CONNECT) {
4c67bc74
MH		 877 if (status != 0x0c || conn->attempt > 2) {
878 conn->state = BT_CLOSED;
879 hci_proto_connect_cfm(conn, status);
880 hci_conn_del(conn);
881 } else
882 conn->state = BT_CONNECT2;
1da177e4
LT		 883 }
884 } else {
885 if (!conn) {
886 conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
887 if (conn) {
888 conn->out = 1;
889 conn->link_mode |= HCI_LM_MASTER;
890 } else
893ef971 891 BT_ERR("No memory for new connection");
1da177e4
LT		 892 }
893 }
894
895 hci_dev_unlock(hdev);
896}
897
a9de9248 898static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1da177e4 899{
a9de9248
MH		 900 struct hci_cp_add_sco *cp;
901 struct hci_conn *acl, *sco;
902 __u16 handle;
1da177e4 903
b6a0dc82
MH		 904 BT_DBG("%s status 0x%x", hdev->name, status);
905
a9de9248
MH		 906 if (!status)
907 return;
1da177e4 908
a9de9248
MH		 909 cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
910 if (!cp)
911 return;
1da177e4 912
a9de9248 913 handle = __le16_to_cpu(cp->handle);
1da177e4 914
a9de9248 915 BT_DBG("%s handle %d", hdev->name, handle);
1da177e4 916
a9de9248 917 hci_dev_lock(hdev);
1da177e4 918
a9de9248 919 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 920 if (acl) {
921 sco = acl->link;
922 if (sco) {
923 sco->state = BT_CLOSED;
1da177e4 924
5a08ecce
AE		 925 hci_proto_connect_cfm(sco, status);
926 hci_conn_del(sco);
927 }
a9de9248 928 }
1da177e4 929
a9de9248
MH		 930 hci_dev_unlock(hdev);
931}
1da177e4 932
f8558555
MH		 933static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
934{
935 struct hci_cp_auth_requested *cp;
936 struct hci_conn *conn;
937
938 BT_DBG("%s status 0x%x", hdev->name, status);
939
940 if (!status)
941 return;
942
943 cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
944 if (!cp)
945 return;
946
947 hci_dev_lock(hdev);
948
949 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
950 if (conn) {
951 if (conn->state == BT_CONFIG) {
952 hci_proto_connect_cfm(conn, status);
953 hci_conn_put(conn);
954 }
955 }
956
957 hci_dev_unlock(hdev);
958}
959
960static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
961{
962 struct hci_cp_set_conn_encrypt *cp;
963 struct hci_conn *conn;
964
965 BT_DBG("%s status 0x%x", hdev->name, status);
966
967 if (!status)
968 return;
969
970 cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
971 if (!cp)
972 return;
973
974 hci_dev_lock(hdev);
975
976 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
977 if (conn) {
978 if (conn->state == BT_CONFIG) {
979 hci_proto_connect_cfm(conn, status);
980 hci_conn_put(conn);
981 }
982 }
983
984 hci_dev_unlock(hdev);
985}
986
127178d2 987static int hci_outgoing_auth_needed(struct hci_dev *hdev,
138d22ef 988 struct hci_conn *conn)
392599b9 989{
392599b9
JH		 990 if (conn->state != BT_CONFIG || !conn->out)
991 return 0;
992
765c2a96 993 if (conn->pending_sec_level == BT_SECURITY_SDP)
392599b9
JH		 994 return 0;
995
996 /* Only request authentication for SSP connections or non-SSP
997 * devices with sec_level HIGH */
998 if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
765c2a96 999 conn->pending_sec_level != BT_SECURITY_HIGH)
392599b9
JH		 1000 return 0;
1001
392599b9
JH		 1002 return 1;
1003}
1004
a9de9248
MH		 1005static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1006{
127178d2
JH		 1007 struct hci_cp_remote_name_req *cp;
1008 struct hci_conn *conn;
1009
a9de9248 1010 BT_DBG("%s status 0x%x", hdev->name, status);
127178d2
JH		 1011
1012 /* If successful wait for the name req complete event before
1013 * checking for the need to do authentication */
1014 if (!status)
1015 return;
1016
1017 cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1018 if (!cp)
1019 return;
1020
1021 hci_dev_lock(hdev);
1022
1023 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
79c6c70c
JH		 1024 if (!conn)
1025 goto unlock;
1026
1027 if (!hci_outgoing_auth_needed(hdev, conn))
1028 goto unlock;
1029
1030 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
127178d2
JH		 1031 struct hci_cp_auth_requested cp;
1032 cp.handle = __cpu_to_le16(conn->handle);
1033 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1034 }
1035
79c6c70c 1036unlock:
127178d2 1037 hci_dev_unlock(hdev);
a9de9248 1038}
1da177e4 1039
769be974
MH		 1040static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1041{
1042 struct hci_cp_read_remote_features *cp;
1043 struct hci_conn *conn;
1044
1045 BT_DBG("%s status 0x%x", hdev->name, status);
1046
1047 if (!status)
1048 return;
1049
1050 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1051 if (!cp)
1052 return;
1053
1054 hci_dev_lock(hdev);
1055
1056 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1057 if (conn) {
1058 if (conn->state == BT_CONFIG) {
769be974
MH		 1059 hci_proto_connect_cfm(conn, status);
1060 hci_conn_put(conn);
1061 }
1062 }
1063
1064 hci_dev_unlock(hdev);
1065}
1066
1067static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1068{
1069 struct hci_cp_read_remote_ext_features *cp;
1070 struct hci_conn *conn;
1071
1072 BT_DBG("%s status 0x%x", hdev->name, status);
1073
1074 if (!status)
1075 return;
1076
1077 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1078 if (!cp)
1079 return;
1080
1081 hci_dev_lock(hdev);
1082
1083 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1084 if (conn) {
1085 if (conn->state == BT_CONFIG) {
769be974
MH		 1086 hci_proto_connect_cfm(conn, status);
1087 hci_conn_put(conn);
1088 }
1089 }
1090
1091 hci_dev_unlock(hdev);
1092}
1093
a9de9248
MH		 1094static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1095{
b6a0dc82
MH		 1096 struct hci_cp_setup_sync_conn *cp;
1097 struct hci_conn *acl, *sco;
1098 __u16 handle;
1099
a9de9248 1100 BT_DBG("%s status 0x%x", hdev->name, status);
b6a0dc82
MH		 1101
1102 if (!status)
1103 return;
1104
1105 cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1106 if (!cp)
1107 return;
1108
1109 handle = __le16_to_cpu(cp->handle);
1110
1111 BT_DBG("%s handle %d", hdev->name, handle);
1112
1113 hci_dev_lock(hdev);
1114
1115 acl = hci_conn_hash_lookup_handle(hdev, handle);
5a08ecce
AE		 1116 if (acl) {
1117 sco = acl->link;
1118 if (sco) {
1119 sco->state = BT_CLOSED;
b6a0dc82 1120
5a08ecce
AE		 1121 hci_proto_connect_cfm(sco, status);
1122 hci_conn_del(sco);
1123 }
b6a0dc82
MH		 1124 }
1125
1126 hci_dev_unlock(hdev);
1da177e4
LT		 1127}
1128
a9de9248 1129static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1da177e4 1130{
a9de9248
MH		 1131 struct hci_cp_sniff_mode *cp;
1132 struct hci_conn *conn;
1da177e4 1133
a9de9248 1134 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 1135
a9de9248
MH		 1136 if (!status)
1137 return;
04837f64 1138
a9de9248
MH		 1139 cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1140 if (!cp)
1141 return;
04837f64 1142
a9de9248 1143 hci_dev_lock(hdev);
04837f64 1144
a9de9248 1145 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1146 if (conn) {
a9de9248 1147 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
04837f64 1148
e73439d8
MH		 1149 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1150 hci_sco_setup(conn, status);
1151 }
1152
a9de9248
MH		 1153 hci_dev_unlock(hdev);
1154}
04837f64 1155
a9de9248
MH		 1156static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1157{
1158 struct hci_cp_exit_sniff_mode *cp;
1159 struct hci_conn *conn;
04837f64 1160
a9de9248 1161 BT_DBG("%s status 0x%x", hdev->name, status);
04837f64 1162
a9de9248
MH		 1163 if (!status)
1164 return;
04837f64 1165
a9de9248
MH		 1166 cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1167 if (!cp)
1168 return;
04837f64 1169
a9de9248 1170 hci_dev_lock(hdev);
1da177e4 1171
a9de9248 1172 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
e73439d8 1173 if (conn) {
a9de9248 1174 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1da177e4 1175
e73439d8
MH		 1176 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1177 hci_sco_setup(conn, status);
1178 }
1179
a9de9248 1180 hci_dev_unlock(hdev);
1da177e4
LT		 1181}
1182
fcd89c09
VT		 1183static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1184{
1185 struct hci_cp_le_create_conn *cp;
1186 struct hci_conn *conn;
1187
1188 BT_DBG("%s status 0x%x", hdev->name, status);
1189
1190 cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1191 if (!cp)
1192 return;
1193
1194 hci_dev_lock(hdev);
1195
1196 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1197
1198 BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1199 conn);
1200
1201 if (status) {
1202 if (conn && conn->state == BT_CONNECT) {
1203 conn->state = BT_CLOSED;
1204 hci_proto_connect_cfm(conn, status);
1205 hci_conn_del(conn);
1206 }
1207 } else {
1208 if (!conn) {
1209 conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1210 if (conn)
1211 conn->out = 1;
1212 else
1213 BT_ERR("No memory for new connection");
1214 }
1215 }
1216
1217 hci_dev_unlock(hdev);
1218}
1219
1da177e4
LT		 1220static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1221{
1222 __u8 status = *((__u8 *) skb->data);
1223
1224 BT_DBG("%s status %d", hdev->name, status);
1225
314b2381
JH		 1226 if (test_bit(HCI_MGMT, &hdev->flags) &&
1227 test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1228 mgmt_discovering(hdev->id, 0);
6bd57416 1229
23bb5763 1230 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
6bd57416 1231
a9de9248 1232 hci_conn_check_pending(hdev);
1da177e4
LT		 1233}
1234
1da177e4
LT		 1235static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1236{
45bb4bf0 1237 struct inquiry_data data;
a9de9248 1238 struct inquiry_info *info = (void *) (skb->data + 1);
1da177e4
LT		 1239 int num_rsp = *((__u8 *) skb->data);
1240
1241 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1242
45bb4bf0
MH		 1243 if (!num_rsp)
1244 return;
1245
1da177e4 1246 hci_dev_lock(hdev);
45bb4bf0 1247
314b2381
JH		 1248 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
1249
1250 if (test_bit(HCI_MGMT, &hdev->flags))
1251 mgmt_discovering(hdev->id, 1);
1252 }
1253
e17acd40 1254 for (; num_rsp; num_rsp--, info++) {
1da177e4
LT		 1255 bacpy(&data.bdaddr, &info->bdaddr);
1256 data.pscan_rep_mode = info->pscan_rep_mode;
1257 data.pscan_period_mode = info->pscan_period_mode;
1258 data.pscan_mode = info->pscan_mode;
1259 memcpy(data.dev_class, info->dev_class, 3);
1260 data.clock_offset = info->clock_offset;
1261 data.rssi = 0x00;
41a96212 1262 data.ssp_mode = 0x00;
1da177e4 1263 hci_inquiry_cache_update(hdev, &data);
e17acd40
JH		 1264 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
1265 NULL);
1da177e4 1266 }
45bb4bf0 1267
1da177e4
LT		 1268 hci_dev_unlock(hdev);
1269}
1270
1da177e4
LT		 1271static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1272{
a9de9248
MH		 1273 struct hci_ev_conn_complete *ev = (void *) skb->data;
1274 struct hci_conn *conn;
1da177e4
LT		 1275
1276 BT_DBG("%s", hdev->name);
1277
1278 hci_dev_lock(hdev);
1279
1280 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9499237a
MH		 1281 if (!conn) {
1282 if (ev->link_type != SCO_LINK)
1283 goto unlock;
1284
1285 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1286 if (!conn)
1287 goto unlock;
1288
1289 conn->type = SCO_LINK;
1290 }
1da177e4
LT		 1291
1292 if (!ev->status) {
1293 conn->handle = __le16_to_cpu(ev->handle);
769be974
MH		 1294
1295 if (conn->type == ACL_LINK) {
1296 conn->state = BT_CONFIG;
1297 hci_conn_hold(conn);
052b30b0 1298 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
f7520543 1299 mgmt_connected(hdev->id, &ev->bdaddr);
769be974
MH		 1300 } else
1301 conn->state = BT_CONNECTED;
1da177e4 1302
9eba32b8 1303 hci_conn_hold_device(conn);
7d0db0a3
MH		 1304 hci_conn_add_sysfs(conn);
1305
1da177e4
LT		 1306 if (test_bit(HCI_AUTH, &hdev->flags))
1307 conn->link_mode |= HCI_LM_AUTH;
1308
1309 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1310 conn->link_mode |= HCI_LM_ENCRYPT;
1311
04837f64
MH		 1312 /* Get remote features */
1313 if (conn->type == ACL_LINK) {
1314 struct hci_cp_read_remote_features cp;
1315 cp.handle = ev->handle;
769be974
MH		 1316 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1317 sizeof(cp), &cp);
04837f64
MH		 1318 }
1319
1da177e4 1320 /* Set packet type for incoming connection */
a8746417 1321 if (!conn->out && hdev->hci_ver < 3) {
1da177e4
LT		 1322 struct hci_cp_change_conn_ptype cp;
1323 cp.handle = ev->handle;
a8746417
MH		 1324 cp.pkt_type = cpu_to_le16(conn->pkt_type);
1325 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1326 sizeof(cp), &cp);
1da177e4 1327 }
17d5c04c 1328 } else {
1da177e4 1329 conn->state = BT_CLOSED;
17d5c04c
JH		 1330 if (conn->type == ACL_LINK)
1331 mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1332 }
1da177e4 1333
e73439d8
MH		 1334 if (conn->type == ACL_LINK)
1335 hci_sco_setup(conn, ev->status);
1da177e4 1336
769be974
MH		 1337 if (ev->status) {
1338 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1339 hci_conn_del(conn);
c89b6e6b
MH		 1340 } else if (ev->link_type != ACL_LINK)
1341 hci_proto_connect_cfm(conn, ev->status);
1da177e4 1342
a9de9248 1343unlock:
1da177e4 1344 hci_dev_unlock(hdev);
1da177e4 1345
a9de9248 1346 hci_conn_check_pending(hdev);
1da177e4
LT		 1347}
1348
a9de9248 1349static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1350{
a9de9248
MH		 1351 struct hci_ev_conn_request *ev = (void *) skb->data;
1352 int mask = hdev->link_mode;
1da177e4 1353
a9de9248
MH		 1354 BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1355 batostr(&ev->bdaddr), ev->link_type);
1da177e4 1356
a9de9248 1357 mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1da177e4 1358
138d22ef
SJ		 1359 if ((mask & HCI_LM_ACCEPT) &&
1360 !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
a9de9248 1361 /* Connection accepted */
c7bdd502 1362 struct inquiry_entry *ie;
1da177e4 1363 struct hci_conn *conn;
1da177e4 1364
a9de9248 1365 hci_dev_lock(hdev);
b6a0dc82 1366
cc11b9c1
AE		 1367 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1368 if (ie)
c7bdd502
MH		 1369 memcpy(ie->data.dev_class, ev->dev_class, 3);
1370
a9de9248
MH		 1371 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1372 if (!conn) {
cc11b9c1
AE		 1373 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1374 if (!conn) {
893ef971 1375 BT_ERR("No memory for new connection");
a9de9248
MH		 1376 hci_dev_unlock(hdev);
1377 return;
1da177e4
LT		 1378 }
1379 }
b6a0dc82 1380
a9de9248
MH		 1381 memcpy(conn->dev_class, ev->dev_class, 3);
1382 conn->state = BT_CONNECT;
b6a0dc82 1383
a9de9248 1384 hci_dev_unlock(hdev);
1da177e4 1385
b6a0dc82
MH		 1386 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1387 struct hci_cp_accept_conn_req cp;
1da177e4 1388
b6a0dc82
MH		 1389 bacpy(&cp.bdaddr, &ev->bdaddr);
1390
1391 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1392 cp.role = 0x00; /* Become master */
1393 else
1394 cp.role = 0x01; /* Remain slave */
1395
1396 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1397 sizeof(cp), &cp);
1398 } else {
1399 struct hci_cp_accept_sync_conn_req cp;
1400
1401 bacpy(&cp.bdaddr, &ev->bdaddr);
a8746417 1402 cp.pkt_type = cpu_to_le16(conn->pkt_type);
b6a0dc82
MH		 1403
1404 cp.tx_bandwidth = cpu_to_le32(0x00001f40);
1405 cp.rx_bandwidth = cpu_to_le32(0x00001f40);
1406 cp.max_latency = cpu_to_le16(0xffff);
1407 cp.content_format = cpu_to_le16(hdev->voice_setting);
1408 cp.retrans_effort = 0xff;
1da177e4 1409
b6a0dc82
MH		 1410 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1411 sizeof(cp), &cp);
1412 }
a9de9248
MH		 1413 } else {
1414 /* Connection rejected */
1415 struct hci_cp_reject_conn_req cp;
1da177e4 1416
a9de9248
MH		 1417 bacpy(&cp.bdaddr, &ev->bdaddr);
1418 cp.reason = 0x0f;
1419 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1da177e4 1420 }
1da177e4
LT		 1421}
1422
a9de9248 1423static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 1424{
a9de9248 1425 struct hci_ev_disconn_complete *ev = (void *) skb->data;
04837f64
MH		 1426 struct hci_conn *conn;
1427
1428 BT_DBG("%s status %d", hdev->name, ev->status);
1429
8962ee74
JH		 1430 if (ev->status) {
1431 mgmt_disconnect_failed(hdev->id);
a9de9248 1432 return;
8962ee74 1433 }
a9de9248 1434
04837f64
MH		 1435 hci_dev_lock(hdev);
1436
1437 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
f7520543
JH		 1438 if (!conn)
1439 goto unlock;
7d0db0a3 1440
f7520543 1441 conn->state = BT_CLOSED;
04837f64 1442
f7520543
JH		 1443 if (conn->type == ACL_LINK)
1444 mgmt_disconnected(hdev->id, &conn->dst);
1445
1446 hci_proto_disconn_cfm(conn, ev->reason);
1447 hci_conn_del(conn);
1448
1449unlock:
04837f64
MH		 1450 hci_dev_unlock(hdev);
1451}
1452
1da177e4
LT		 1453static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1454{
a9de9248 1455 struct hci_ev_auth_complete *ev = (void *) skb->data;
04837f64 1456 struct hci_conn *conn;
1da177e4
LT		 1457
1458 BT_DBG("%s status %d", hdev->name, ev->status);
1459
1460 hci_dev_lock(hdev);
1461
04837f64 1462 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4 1463 if (conn) {
765c2a96 1464 if (!ev->status) {
1da177e4 1465 conn->link_mode |= HCI_LM_AUTH;
765c2a96 1466 conn->sec_level = conn->pending_sec_level;
2a611692
JH		 1467 } else {
1468 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
2a611692 1469 }
1da177e4
LT		 1470
1471 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1472
f8558555
MH		 1473 if (conn->state == BT_CONFIG) {
1474 if (!ev->status && hdev->ssp_mode > 0 &&
1475 conn->ssp_mode > 0) {
1476 struct hci_cp_set_conn_encrypt cp;
1477 cp.handle = ev->handle;
1478 cp.encrypt = 0x01;
1479 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1480 sizeof(cp), &cp);
1481 } else {
1482 conn->state = BT_CONNECTED;
1483 hci_proto_connect_cfm(conn, ev->status);
1484 hci_conn_put(conn);
1485 }
052b30b0 1486 } else {
f8558555 1487 hci_auth_cfm(conn, ev->status);
1da177e4 1488
052b30b0
MH		 1489 hci_conn_hold(conn);
1490 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1491 hci_conn_put(conn);
1492 }
1493
1da177e4
LT		 1494 if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1495 if (!ev->status) {
1496 struct hci_cp_set_conn_encrypt cp;
f8558555
MH		 1497 cp.handle = ev->handle;
1498 cp.encrypt = 0x01;
1499 hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
1500 sizeof(cp), &cp);
1da177e4
LT		 1501 } else {
1502 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1503 hci_encrypt_cfm(conn, ev->status, 0x00);
1504 }
1505 }
1506 }
1507
1508 hci_dev_unlock(hdev);
1509}
1510
a9de9248 1511static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1512{
127178d2
JH		 1513 struct hci_ev_remote_name *ev = (void *) skb->data;
1514 struct hci_conn *conn;
1515
a9de9248 1516 BT_DBG("%s", hdev->name);
1da177e4 1517
a9de9248 1518 hci_conn_check_pending(hdev);
127178d2
JH		 1519
1520 hci_dev_lock(hdev);
1521
a88a9652
JH		 1522 if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1523 mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
1524
127178d2 1525 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
79c6c70c
JH		 1526 if (!conn)
1527 goto unlock;
1528
1529 if (!hci_outgoing_auth_needed(hdev, conn))
1530 goto unlock;
1531
1532 if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
127178d2
JH		 1533 struct hci_cp_auth_requested cp;
1534 cp.handle = __cpu_to_le16(conn->handle);
1535 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1536 }
1537
79c6c70c 1538unlock:
127178d2 1539 hci_dev_unlock(hdev);
a9de9248
MH		 1540}
1541
1542static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1543{
1544 struct hci_ev_encrypt_change *ev = (void *) skb->data;
1545 struct hci_conn *conn;
1546
1547 BT_DBG("%s status %d", hdev->name, ev->status);
1da177e4
LT		 1548
1549 hci_dev_lock(hdev);
1550
04837f64 1551 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 1552 if (conn) {
1553 if (!ev->status) {
ae293196
MH		 1554 if (ev->encrypt) {
1555 /* Encryption implies authentication */
1556 conn->link_mode |= HCI_LM_AUTH;
1da177e4 1557 conn->link_mode |= HCI_LM_ENCRYPT;
ae293196 1558 } else
1da177e4
LT		 1559 conn->link_mode &= ~HCI_LM_ENCRYPT;
1560 }
1561
1562 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1563
f8558555
MH		 1564 if (conn->state == BT_CONFIG) {
1565 if (!ev->status)
1566 conn->state = BT_CONNECTED;
1567
1568 hci_proto_connect_cfm(conn, ev->status);
1569 hci_conn_put(conn);
1570 } else
1571 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1da177e4
LT		 1572 }
1573
1574 hci_dev_unlock(hdev);
1575}
1576
a9de9248 1577static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1578{
a9de9248 1579 struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
04837f64 1580 struct hci_conn *conn;
1da177e4
LT		 1581
1582 BT_DBG("%s status %d", hdev->name, ev->status);
1583
1584 hci_dev_lock(hdev);
1585
04837f64 1586 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 1587 if (conn) {
1588 if (!ev->status)
1589 conn->link_mode |= HCI_LM_SECURE;
1590
1591 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1592
1593 hci_key_change_cfm(conn, ev->status);
1594 }
1595
1596 hci_dev_unlock(hdev);
1597}
1598
a9de9248 1599static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1600{
a9de9248
MH		 1601 struct hci_ev_remote_features *ev = (void *) skb->data;
1602 struct hci_conn *conn;
1603
1604 BT_DBG("%s status %d", hdev->name, ev->status);
1605
a9de9248
MH		 1606 hci_dev_lock(hdev);
1607
1608 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 1609 if (!conn)
1610 goto unlock;
769be974 1611
ccd556fe
JH		 1612 if (!ev->status)
1613 memcpy(conn->features, ev->features, 8);
1614
1615 if (conn->state != BT_CONFIG)
1616 goto unlock;
1617
1618 if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1619 struct hci_cp_read_remote_ext_features cp;
1620 cp.handle = ev->handle;
1621 cp.page = 0x01;
1622 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
bdb7524a 1623 sizeof(cp), &cp);
392599b9
JH		 1624 goto unlock;
1625 }
1626
127178d2
JH		 1627 if (!ev->status) {
1628 struct hci_cp_remote_name_req cp;
1629 memset(&cp, 0, sizeof(cp));
1630 bacpy(&cp.bdaddr, &conn->dst);
1631 cp.pscan_rep_mode = 0x02;
1632 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1633 }
392599b9 1634
127178d2 1635 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 1636 conn->state = BT_CONNECTED;
1637 hci_proto_connect_cfm(conn, ev->status);
1638 hci_conn_put(conn);
769be974 1639 }
a9de9248 1640
ccd556fe 1641unlock:
a9de9248 1642 hci_dev_unlock(hdev);
1da177e4
LT		 1643}
1644
a9de9248 1645static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1646{
a9de9248 1647 BT_DBG("%s", hdev->name);
1da177e4
LT		 1648}
1649
a9de9248 1650static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 1651{
a9de9248 1652 BT_DBG("%s", hdev->name);
1da177e4
LT		 1653}
1654
a9de9248
MH		 1655static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1656{
1657 struct hci_ev_cmd_complete *ev = (void *) skb->data;
1658 __u16 opcode;
1659
1660 skb_pull(skb, sizeof(*ev));
1661
1662 opcode = __le16_to_cpu(ev->opcode);
1663
1664 switch (opcode) {
1665 case HCI_OP_INQUIRY_CANCEL:
1666 hci_cc_inquiry_cancel(hdev, skb);
1667 break;
1668
1669 case HCI_OP_EXIT_PERIODIC_INQ:
1670 hci_cc_exit_periodic_inq(hdev, skb);
1671 break;
1672
1673 case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1674 hci_cc_remote_name_req_cancel(hdev, skb);
1675 break;
1676
1677 case HCI_OP_ROLE_DISCOVERY:
1678 hci_cc_role_discovery(hdev, skb);
1679 break;
1680
e4e8e37c
MH		 1681 case HCI_OP_READ_LINK_POLICY:
1682 hci_cc_read_link_policy(hdev, skb);
1683 break;
1684
a9de9248
MH		 1685 case HCI_OP_WRITE_LINK_POLICY:
1686 hci_cc_write_link_policy(hdev, skb);
1687 break;
1688
e4e8e37c
MH		 1689 case HCI_OP_READ_DEF_LINK_POLICY:
1690 hci_cc_read_def_link_policy(hdev, skb);
1691 break;
1692
1693 case HCI_OP_WRITE_DEF_LINK_POLICY:
1694 hci_cc_write_def_link_policy(hdev, skb);
1695 break;
1696
a9de9248
MH		 1697 case HCI_OP_RESET:
1698 hci_cc_reset(hdev, skb);
1699 break;
1700
1701 case HCI_OP_WRITE_LOCAL_NAME:
1702 hci_cc_write_local_name(hdev, skb);
1703 break;
1704
1705 case HCI_OP_READ_LOCAL_NAME:
1706 hci_cc_read_local_name(hdev, skb);
1707 break;
1708
1709 case HCI_OP_WRITE_AUTH_ENABLE:
1710 hci_cc_write_auth_enable(hdev, skb);
1711 break;
1712
1713 case HCI_OP_WRITE_ENCRYPT_MODE:
1714 hci_cc_write_encrypt_mode(hdev, skb);
1715 break;
1716
1717 case HCI_OP_WRITE_SCAN_ENABLE:
1718 hci_cc_write_scan_enable(hdev, skb);
1719 break;
1720
1721 case HCI_OP_READ_CLASS_OF_DEV:
1722 hci_cc_read_class_of_dev(hdev, skb);
1723 break;
1724
1725 case HCI_OP_WRITE_CLASS_OF_DEV:
1726 hci_cc_write_class_of_dev(hdev, skb);
1727 break;
1728
1729 case HCI_OP_READ_VOICE_SETTING:
1730 hci_cc_read_voice_setting(hdev, skb);
1731 break;
1732
1733 case HCI_OP_WRITE_VOICE_SETTING:
1734 hci_cc_write_voice_setting(hdev, skb);
1735 break;
1736
1737 case HCI_OP_HOST_BUFFER_SIZE:
1738 hci_cc_host_buffer_size(hdev, skb);
1739 break;
1740
333140b5
MH		 1741 case HCI_OP_READ_SSP_MODE:
1742 hci_cc_read_ssp_mode(hdev, skb);
1743 break;
1744
1745 case HCI_OP_WRITE_SSP_MODE:
1746 hci_cc_write_ssp_mode(hdev, skb);
1747 break;
1748
a9de9248
MH		 1749 case HCI_OP_READ_LOCAL_VERSION:
1750 hci_cc_read_local_version(hdev, skb);
1751 break;
1752
1753 case HCI_OP_READ_LOCAL_COMMANDS:
1754 hci_cc_read_local_commands(hdev, skb);
1755 break;
1756
1757 case HCI_OP_READ_LOCAL_FEATURES:
1758 hci_cc_read_local_features(hdev, skb);
1759 break;
1760
1761 case HCI_OP_READ_BUFFER_SIZE:
1762 hci_cc_read_buffer_size(hdev, skb);
1763 break;
1764
1765 case HCI_OP_READ_BD_ADDR:
1766 hci_cc_read_bd_addr(hdev, skb);
1767 break;
1768
23bb5763
JH		 1769 case HCI_OP_WRITE_CA_TIMEOUT:
1770 hci_cc_write_ca_timeout(hdev, skb);
1771 break;
1772
b0916ea0
JH		 1773 case HCI_OP_DELETE_STORED_LINK_KEY:
1774 hci_cc_delete_stored_link_key(hdev, skb);
1775 break;
1776
d5859e22
JH		 1777 case HCI_OP_SET_EVENT_MASK:
1778 hci_cc_set_event_mask(hdev, skb);
1779 break;
1780
1781 case HCI_OP_WRITE_INQUIRY_MODE:
1782 hci_cc_write_inquiry_mode(hdev, skb);
1783 break;
1784
1785 case HCI_OP_READ_INQ_RSP_TX_POWER:
1786 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1787 break;
1788
1789 case HCI_OP_SET_EVENT_FLT:
1790 hci_cc_set_event_flt(hdev, skb);
1791 break;
1792
980e1a53
JH		 1793 case HCI_OP_PIN_CODE_REPLY:
1794 hci_cc_pin_code_reply(hdev, skb);
1795 break;
1796
1797 case HCI_OP_PIN_CODE_NEG_REPLY:
1798 hci_cc_pin_code_neg_reply(hdev, skb);
1799 break;
1800
c35938b2
SJ		 1801 case HCI_OP_READ_LOCAL_OOB_DATA:
1802 hci_cc_read_local_oob_data_reply(hdev, skb);
1803 break;
1804
6ed58ec5
VT		 1805 case HCI_OP_LE_READ_BUFFER_SIZE:
1806 hci_cc_le_read_buffer_size(hdev, skb);
1807 break;
1808
a5c29683
JH		 1809 case HCI_OP_USER_CONFIRM_REPLY:
1810 hci_cc_user_confirm_reply(hdev, skb);
1811 break;
1812
1813 case HCI_OP_USER_CONFIRM_NEG_REPLY:
1814 hci_cc_user_confirm_neg_reply(hdev, skb);
1815 break;
1816
a9de9248
MH		 1817 default:
1818 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1819 break;
1820 }
1821
6bd32326
VT		 1822 if (ev->opcode != HCI_OP_NOP)
1823 del_timer(&hdev->cmd_timer);
1824
a9de9248
MH		 1825 if (ev->ncmd) {
1826 atomic_set(&hdev->cmd_cnt, 1);
1827 if (!skb_queue_empty(&hdev->cmd_q))
c78ae283 1828 tasklet_schedule(&hdev->cmd_task);
a9de9248
MH		 1829 }
1830}
1831
1832static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
1833{
1834 struct hci_ev_cmd_status *ev = (void *) skb->data;
1835 __u16 opcode;
1836
1837 skb_pull(skb, sizeof(*ev));
1838
1839 opcode = __le16_to_cpu(ev->opcode);
1840
1841 switch (opcode) {
1842 case HCI_OP_INQUIRY:
1843 hci_cs_inquiry(hdev, ev->status);
1844 break;
1845
1846 case HCI_OP_CREATE_CONN:
1847 hci_cs_create_conn(hdev, ev->status);
1848 break;
1849
1850 case HCI_OP_ADD_SCO:
1851 hci_cs_add_sco(hdev, ev->status);
1852 break;
1853
f8558555
MH		 1854 case HCI_OP_AUTH_REQUESTED:
1855 hci_cs_auth_requested(hdev, ev->status);
1856 break;
1857
1858 case HCI_OP_SET_CONN_ENCRYPT:
1859 hci_cs_set_conn_encrypt(hdev, ev->status);
1860 break;
1861
a9de9248
MH		 1862 case HCI_OP_REMOTE_NAME_REQ:
1863 hci_cs_remote_name_req(hdev, ev->status);
1864 break;
1865
769be974
MH		 1866 case HCI_OP_READ_REMOTE_FEATURES:
1867 hci_cs_read_remote_features(hdev, ev->status);
1868 break;
1869
1870 case HCI_OP_READ_REMOTE_EXT_FEATURES:
1871 hci_cs_read_remote_ext_features(hdev, ev->status);
1872 break;
1873
a9de9248
MH		 1874 case HCI_OP_SETUP_SYNC_CONN:
1875 hci_cs_setup_sync_conn(hdev, ev->status);
1876 break;
1877
1878 case HCI_OP_SNIFF_MODE:
1879 hci_cs_sniff_mode(hdev, ev->status);
1880 break;
1881
1882 case HCI_OP_EXIT_SNIFF_MODE:
1883 hci_cs_exit_sniff_mode(hdev, ev->status);
1884 break;
1885
8962ee74
JH		 1886 case HCI_OP_DISCONNECT:
1887 if (ev->status != 0)
1888 mgmt_disconnect_failed(hdev->id);
1889 break;
1890
fcd89c09
VT		 1891 case HCI_OP_LE_CREATE_CONN:
1892 hci_cs_le_create_conn(hdev, ev->status);
1893 break;
1894
a9de9248
MH		 1895 default:
1896 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1897 break;
1898 }
1899
6bd32326
VT		 1900 if (ev->opcode != HCI_OP_NOP)
1901 del_timer(&hdev->cmd_timer);
1902
10572132 1903 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
a9de9248
MH		 1904 atomic_set(&hdev->cmd_cnt, 1);
1905 if (!skb_queue_empty(&hdev->cmd_q))
c78ae283 1906 tasklet_schedule(&hdev->cmd_task);
a9de9248
MH		 1907 }
1908}
1909
1910static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1911{
1912 struct hci_ev_role_change *ev = (void *) skb->data;
1913 struct hci_conn *conn;
1914
1915 BT_DBG("%s status %d", hdev->name, ev->status);
1916
1917 hci_dev_lock(hdev);
1918
1919 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1920 if (conn) {
1921 if (!ev->status) {
1922 if (ev->role)
1923 conn->link_mode &= ~HCI_LM_MASTER;
1924 else
1925 conn->link_mode |= HCI_LM_MASTER;
1926 }
1927
1928 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
1929
1930 hci_role_switch_cfm(conn, ev->status, ev->role);
1931 }
1932
1933 hci_dev_unlock(hdev);
1934}
1935
1936static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
1937{
1938 struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
1939 __le16 *ptr;
1940 int i;
1941
1942 skb_pull(skb, sizeof(*ev));
1943
1944 BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
1945
1946 if (skb->len < ev->num_hndl * 4) {
1947 BT_DBG("%s bad parameters", hdev->name);
1948 return;
1949 }
1950
1951 tasklet_disable(&hdev->tx_task);
1952
1953 for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
1954 struct hci_conn *conn;
1955 __u16 handle, count;
1956
83985319
HH		 1957 handle = get_unaligned_le16(ptr++);
1958 count = get_unaligned_le16(ptr++);
a9de9248
MH		 1959
1960 conn = hci_conn_hash_lookup_handle(hdev, handle);
1961 if (conn) {
1962 conn->sent -= count;
1963
1964 if (conn->type == ACL_LINK) {
70f23020
AE		 1965 hdev->acl_cnt += count;
1966 if (hdev->acl_cnt > hdev->acl_pkts)
a9de9248 1967 hdev->acl_cnt = hdev->acl_pkts;
6ed58ec5
VT		 1968 } else if (conn->type == LE_LINK) {
1969 if (hdev->le_pkts) {
1970 hdev->le_cnt += count;
1971 if (hdev->le_cnt > hdev->le_pkts)
1972 hdev->le_cnt = hdev->le_pkts;
1973 } else {
1974 hdev->acl_cnt += count;
1975 if (hdev->acl_cnt > hdev->acl_pkts)
1976 hdev->acl_cnt = hdev->acl_pkts;
1977 }
a9de9248 1978 } else {
70f23020
AE		 1979 hdev->sco_cnt += count;
1980 if (hdev->sco_cnt > hdev->sco_pkts)
a9de9248
MH		 1981 hdev->sco_cnt = hdev->sco_pkts;
1982 }
1983 }
1984 }
1985
c78ae283 1986 tasklet_schedule(&hdev->tx_task);
a9de9248
MH		 1987
1988 tasklet_enable(&hdev->tx_task);
1989}
1990
1991static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
04837f64 1992{
a9de9248 1993 struct hci_ev_mode_change *ev = (void *) skb->data;
04837f64
MH		 1994 struct hci_conn *conn;
1995
1996 BT_DBG("%s status %d", hdev->name, ev->status);
1997
1998 hci_dev_lock(hdev);
1999
2000 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
a9de9248
MH		 2001 if (conn) {
2002 conn->mode = ev->mode;
2003 conn->interval = __le16_to_cpu(ev->interval);
2004
2005 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2006 if (conn->mode == HCI_CM_ACTIVE)
2007 conn->power_save = 1;
2008 else
2009 conn->power_save = 0;
2010 }
e73439d8
MH		 2011
2012 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2013 hci_sco_setup(conn, ev->status);
04837f64
MH		 2014 }
2015
2016 hci_dev_unlock(hdev);
2017}
2018
a9de9248
MH		 2019static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2020{
052b30b0
MH		 2021 struct hci_ev_pin_code_req *ev = (void *) skb->data;
2022 struct hci_conn *conn;
2023
a9de9248 2024 BT_DBG("%s", hdev->name);
052b30b0
MH		 2025
2026 hci_dev_lock(hdev);
2027
2028 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3d7a9d1c 2029 if (conn && conn->state == BT_CONNECTED) {
052b30b0
MH		 2030 hci_conn_hold(conn);
2031 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2032 hci_conn_put(conn);
2033 }
2034
03b555e1
JH		 2035 if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2036 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2037 sizeof(ev->bdaddr), &ev->bdaddr);
582fbe9e 2038 else if (test_bit(HCI_MGMT, &hdev->flags)) {
a770bb5a
WR		 2039 u8 secure;
2040
2041 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2042 secure = 1;
2043 else
2044 secure = 0;
2045
2046 mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
2047 }
980e1a53 2048
052b30b0 2049 hci_dev_unlock(hdev);
a9de9248
MH		 2050}
2051
2052static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2053{
55ed8ca1
JH		 2054 struct hci_ev_link_key_req *ev = (void *) skb->data;
2055 struct hci_cp_link_key_reply cp;
2056 struct hci_conn *conn;
2057 struct link_key *key;
2058
a9de9248 2059 BT_DBG("%s", hdev->name);
55ed8ca1
JH		 2060
2061 if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2062 return;
2063
2064 hci_dev_lock(hdev);
2065
2066 key = hci_find_link_key(hdev, &ev->bdaddr);
2067 if (!key) {
2068 BT_DBG("%s link key not found for %s", hdev->name,
2069 batostr(&ev->bdaddr));
2070 goto not_found;
2071 }
2072
2073 BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2074 batostr(&ev->bdaddr));
2075
b6020ba0
WR		 2076 if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2077 key->type == HCI_LK_DEBUG_COMBINATION) {
55ed8ca1
JH		 2078 BT_DBG("%s ignoring debug key", hdev->name);
2079 goto not_found;
2080 }
2081
2082 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
60b83f57
WR		 2083 if (conn) {
2084 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2085 conn->auth_type != 0xff &&
2086 (conn->auth_type & 0x01)) {
2087 BT_DBG("%s ignoring unauthenticated key", hdev->name);
2088 goto not_found;
2089 }
55ed8ca1 2090
60b83f57
WR		 2091 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2092 conn->pending_sec_level == BT_SECURITY_HIGH) {
2093 BT_DBG("%s ignoring key unauthenticated for high \
2094 security", hdev->name);
2095 goto not_found;
2096 }
2097
2098 conn->key_type = key->type;
2099 conn->pin_length = key->pin_len;
55ed8ca1
JH		 2100 }
2101
2102 bacpy(&cp.bdaddr, &ev->bdaddr);
2103 memcpy(cp.link_key, key->val, 16);
2104
2105 hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2106
2107 hci_dev_unlock(hdev);
2108
2109 return;
2110
2111not_found:
2112 hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2113 hci_dev_unlock(hdev);
a9de9248
MH		 2114}
2115
2116static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2117{
052b30b0
MH		 2118 struct hci_ev_link_key_notify *ev = (void *) skb->data;
2119 struct hci_conn *conn;
55ed8ca1 2120 u8 pin_len = 0;
052b30b0 2121
a9de9248 2122 BT_DBG("%s", hdev->name);
052b30b0
MH		 2123
2124 hci_dev_lock(hdev);
2125
2126 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2127 if (conn) {
2128 hci_conn_hold(conn);
2129 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
980e1a53 2130 pin_len = conn->pin_length;
13d39315
WR		 2131
2132 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2133 conn->key_type = ev->key_type;
2134
052b30b0
MH		 2135 hci_conn_put(conn);
2136 }
2137
55ed8ca1
JH		 2138 if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2139 hci_add_link_key(hdev, 1, &ev->bdaddr, ev->link_key,
2140 ev->key_type, pin_len);
2141
052b30b0 2142 hci_dev_unlock(hdev);
a9de9248
MH		 2143}
2144
1da177e4
LT		 2145static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2146{
a9de9248 2147 struct hci_ev_clock_offset *ev = (void *) skb->data;
04837f64 2148 struct hci_conn *conn;
1da177e4
LT		 2149
2150 BT_DBG("%s status %d", hdev->name, ev->status);
2151
2152 hci_dev_lock(hdev);
2153
04837f64 2154 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1da177e4
LT		 2155 if (conn && !ev->status) {
2156 struct inquiry_entry *ie;
2157
cc11b9c1
AE		 2158 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2159 if (ie) {
1da177e4
LT		 2160 ie->data.clock_offset = ev->clock_offset;
2161 ie->timestamp = jiffies;
2162 }
2163 }
2164
2165 hci_dev_unlock(hdev);
2166}
2167
a8746417
MH		 2168static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2169{
2170 struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2171 struct hci_conn *conn;
2172
2173 BT_DBG("%s status %d", hdev->name, ev->status);
2174
2175 hci_dev_lock(hdev);
2176
2177 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2178 if (conn && !ev->status)
2179 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2180
2181 hci_dev_unlock(hdev);
2182}
2183
85a1e930
MH		 2184static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2185{
a9de9248 2186 struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
85a1e930
MH		 2187 struct inquiry_entry *ie;
2188
2189 BT_DBG("%s", hdev->name);
2190
2191 hci_dev_lock(hdev);
2192
cc11b9c1
AE		 2193 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2194 if (ie) {
85a1e930
MH		 2195 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2196 ie->timestamp = jiffies;
2197 }
2198
2199 hci_dev_unlock(hdev);
2200}
2201
a9de9248
MH		 2202static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2203{
2204 struct inquiry_data data;
2205 int num_rsp = *((__u8 *) skb->data);
2206
2207 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2208
2209 if (!num_rsp)
2210 return;
2211
2212 hci_dev_lock(hdev);
2213
314b2381
JH		 2214 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2215
2216 if (test_bit(HCI_MGMT, &hdev->flags))
2217 mgmt_discovering(hdev->id, 1);
2218 }
2219
a9de9248 2220 if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
138d22ef
SJ		 2221 struct inquiry_info_with_rssi_and_pscan_mode *info;
2222 info = (void *) (skb->data + 1);
a9de9248 2223
e17acd40 2224 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 2225 bacpy(&data.bdaddr, &info->bdaddr);
2226 data.pscan_rep_mode = info->pscan_rep_mode;
2227 data.pscan_period_mode = info->pscan_period_mode;
2228 data.pscan_mode = info->pscan_mode;
2229 memcpy(data.dev_class, info->dev_class, 3);
2230 data.clock_offset = info->clock_offset;
2231 data.rssi = info->rssi;
41a96212 2232 data.ssp_mode = 0x00;
a9de9248 2233 hci_inquiry_cache_update(hdev, &data);
e17acd40
JH		 2234 mgmt_device_found(hdev->id, &info->bdaddr,
2235 info->dev_class, info->rssi,
2236 NULL);
a9de9248
MH		 2237 }
2238 } else {
2239 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2240
e17acd40 2241 for (; num_rsp; num_rsp--, info++) {
a9de9248
MH		 2242 bacpy(&data.bdaddr, &info->bdaddr);
2243 data.pscan_rep_mode = info->pscan_rep_mode;
2244 data.pscan_period_mode = info->pscan_period_mode;
2245 data.pscan_mode = 0x00;
2246 memcpy(data.dev_class, info->dev_class, 3);
2247 data.clock_offset = info->clock_offset;
2248 data.rssi = info->rssi;
41a96212 2249 data.ssp_mode = 0x00;
a9de9248 2250 hci_inquiry_cache_update(hdev, &data);
e17acd40
JH		 2251 mgmt_device_found(hdev->id, &info->bdaddr,
2252 info->dev_class, info->rssi,
2253 NULL);
a9de9248
MH		 2254 }
2255 }
2256
2257 hci_dev_unlock(hdev);
2258}
2259
2260static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2261{
41a96212
MH		 2262 struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2263 struct hci_conn *conn;
2264
a9de9248 2265 BT_DBG("%s", hdev->name);
41a96212 2266
41a96212
MH		 2267 hci_dev_lock(hdev);
2268
2269 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
ccd556fe
JH		 2270 if (!conn)
2271 goto unlock;
41a96212 2272
ccd556fe
JH		 2273 if (!ev->status && ev->page == 0x01) {
2274 struct inquiry_entry *ie;
41a96212 2275
cc11b9c1
AE		 2276 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2277 if (ie)
ccd556fe 2278 ie->data.ssp_mode = (ev->features[0] & 0x01);
769be974 2279
ccd556fe
JH		 2280 conn->ssp_mode = (ev->features[0] & 0x01);
2281 }
2282
2283 if (conn->state != BT_CONFIG)
2284 goto unlock;
2285
127178d2
JH		 2286 if (!ev->status) {
2287 struct hci_cp_remote_name_req cp;
2288 memset(&cp, 0, sizeof(cp));
2289 bacpy(&cp.bdaddr, &conn->dst);
2290 cp.pscan_rep_mode = 0x02;
2291 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2292 }
392599b9 2293
127178d2 2294 if (!hci_outgoing_auth_needed(hdev, conn)) {
ccd556fe
JH		 2295 conn->state = BT_CONNECTED;
2296 hci_proto_connect_cfm(conn, ev->status);
2297 hci_conn_put(conn);
41a96212
MH		 2298 }
2299
ccd556fe 2300unlock:
41a96212 2301 hci_dev_unlock(hdev);
a9de9248
MH		 2302}
2303
2304static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2305{
b6a0dc82
MH		 2306 struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2307 struct hci_conn *conn;
2308
2309 BT_DBG("%s status %d", hdev->name, ev->status);
2310
2311 hci_dev_lock(hdev);
2312
2313 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
9dc0a3af
MH		 2314 if (!conn) {
2315 if (ev->link_type == ESCO_LINK)
2316 goto unlock;
2317
2318 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2319 if (!conn)
2320 goto unlock;
2321
2322 conn->type = SCO_LINK;
2323 }
b6a0dc82 2324
732547f9
MH		 2325 switch (ev->status) {
2326 case 0x00:
b6a0dc82
MH		 2327 conn->handle = __le16_to_cpu(ev->handle);
2328 conn->state = BT_CONNECTED;
7d0db0a3 2329
9eba32b8 2330 hci_conn_hold_device(conn);
7d0db0a3 2331 hci_conn_add_sysfs(conn);
732547f9
MH		 2332 break;
2333
705e5711 2334 case 0x11: /* Unsupported Feature or Parameter Value */
732547f9 2335 case 0x1c: /* SCO interval rejected */
1038a00b 2336 case 0x1a: /* Unsupported Remote Feature */
732547f9
MH		 2337 case 0x1f: /* Unspecified error */
2338 if (conn->out && conn->attempt < 2) {
2339 conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2340 (hdev->esco_type & EDR_ESCO_MASK);
2341 hci_setup_sync(conn, conn->link->handle);
2342 goto unlock;
2343 }
2344 /* fall through */
2345
2346 default:
b6a0dc82 2347 conn->state = BT_CLOSED;
732547f9
MH		 2348 break;
2349 }
b6a0dc82
MH		 2350
2351 hci_proto_connect_cfm(conn, ev->status);
2352 if (ev->status)
2353 hci_conn_del(conn);
2354
2355unlock:
2356 hci_dev_unlock(hdev);
a9de9248
MH		 2357}
2358
2359static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2360{
2361 BT_DBG("%s", hdev->name);
2362}
2363
04837f64
MH		 2364static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2365{
a9de9248 2366 struct hci_ev_sniff_subrate *ev = (void *) skb->data;
04837f64
MH		 2367
2368 BT_DBG("%s status %d", hdev->name, ev->status);
04837f64
MH		 2369}
2370
a9de9248 2371static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2372{
a9de9248
MH		 2373 struct inquiry_data data;
2374 struct extended_inquiry_info *info = (void *) (skb->data + 1);
2375 int num_rsp = *((__u8 *) skb->data);
1da177e4 2376
a9de9248 2377 BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1da177e4 2378
a9de9248
MH		 2379 if (!num_rsp)
2380 return;
1da177e4 2381
314b2381
JH		 2382 if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags)) {
2383
2384 if (test_bit(HCI_MGMT, &hdev->flags))
2385 mgmt_discovering(hdev->id, 1);
2386 }
2387
a9de9248
MH		 2388 hci_dev_lock(hdev);
2389
e17acd40 2390 for (; num_rsp; num_rsp--, info++) {
a9de9248 2391 bacpy(&data.bdaddr, &info->bdaddr);
138d22ef
SJ		 2392 data.pscan_rep_mode = info->pscan_rep_mode;
2393 data.pscan_period_mode = info->pscan_period_mode;
2394 data.pscan_mode = 0x00;
a9de9248 2395 memcpy(data.dev_class, info->dev_class, 3);
138d22ef
SJ		 2396 data.clock_offset = info->clock_offset;
2397 data.rssi = info->rssi;
41a96212 2398 data.ssp_mode = 0x01;
a9de9248 2399 hci_inquiry_cache_update(hdev, &data);
e17acd40
JH		 2400 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
2401 info->rssi, info->data);
a9de9248
MH		 2402 }
2403
2404 hci_dev_unlock(hdev);
2405}
1da177e4 2406
17fa4b9d
JH		 2407static inline u8 hci_get_auth_req(struct hci_conn *conn)
2408{
2409 /* If remote requests dedicated bonding follow that lead */
2410 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2411 /* If both remote and local IO capabilities allow MITM
2412 * protection then require it, otherwise don't */
2413 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2414 return 0x02;
2415 else
2416 return 0x03;
2417 }
2418
2419 /* If remote requests no-bonding follow that lead */
2420 if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
58797bf7 2421 return conn->remote_auth | (conn->auth_type & 0x01);
17fa4b9d
JH		 2422
2423 return conn->auth_type;
2424}
2425
0493684e
MH		 2426static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2427{
2428 struct hci_ev_io_capa_request *ev = (void *) skb->data;
2429 struct hci_conn *conn;
2430
2431 BT_DBG("%s", hdev->name);
2432
2433 hci_dev_lock(hdev);
2434
2435 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
03b555e1
JH		 2436 if (!conn)
2437 goto unlock;
2438
2439 hci_conn_hold(conn);
2440
2441 if (!test_bit(HCI_MGMT, &hdev->flags))
2442 goto unlock;
2443
2444 if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2445 (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
17fa4b9d
JH		 2446 struct hci_cp_io_capability_reply cp;
2447
2448 bacpy(&cp.bdaddr, &ev->bdaddr);
2449 cp.capability = conn->io_capability;
17fa4b9d
JH		 2450 cp.authentication = hci_get_auth_req(conn);
2451
ce85ee13
SJ		 2452 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2453 hci_find_remote_oob_data(hdev, &conn->dst))
2454 cp.oob_data = 0x01;
2455 else
2456 cp.oob_data = 0x00;
2457
17fa4b9d
JH		 2458 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2459 sizeof(cp), &cp);
03b555e1
JH		 2460 } else {
2461 struct hci_cp_io_capability_neg_reply cp;
2462
2463 bacpy(&cp.bdaddr, &ev->bdaddr);
be77159c 2464 cp.reason = 0x18; /* Pairing not allowed */
0493684e 2465
03b555e1
JH		 2466 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2467 sizeof(cp), &cp);
2468 }
2469
2470unlock:
2471 hci_dev_unlock(hdev);
2472}
2473
2474static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2475{
2476 struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2477 struct hci_conn *conn;
2478
2479 BT_DBG("%s", hdev->name);
2480
2481 hci_dev_lock(hdev);
2482
2483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2484 if (!conn)
2485 goto unlock;
2486
03b555e1
JH		 2487 conn->remote_cap = ev->capability;
2488 conn->remote_oob = ev->oob_data;
2489 conn->remote_auth = ev->authentication;
2490
2491unlock:
0493684e
MH		 2492 hci_dev_unlock(hdev);
2493}
2494
a5c29683
JH		 2495static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2496 struct sk_buff *skb)
2497{
2498 struct hci_ev_user_confirm_req *ev = (void *) skb->data;
55bc1a37 2499 int loc_mitm, rem_mitm, confirm_hint = 0;
7a828908 2500 struct hci_conn *conn;
a5c29683
JH		 2501
2502 BT_DBG("%s", hdev->name);
2503
2504 hci_dev_lock(hdev);
2505
7a828908
JH		 2506 if (!test_bit(HCI_MGMT, &hdev->flags))
2507 goto unlock;
a5c29683 2508
7a828908
JH		 2509 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2510 if (!conn)
2511 goto unlock;
2512
2513 loc_mitm = (conn->auth_type & 0x01);
2514 rem_mitm = (conn->remote_auth & 0x01);
2515
2516 /* If we require MITM but the remote device can't provide that
2517 * (it has NoInputNoOutput) then reject the confirmation
2518 * request. The only exception is when we're dedicated bonding
2519 * initiators (connect_cfm_cb set) since then we always have the MITM
2520 * bit set. */
2521 if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2522 BT_DBG("Rejecting request: remote device can't provide MITM");
2523 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2524 sizeof(ev->bdaddr), &ev->bdaddr);
2525 goto unlock;
2526 }
2527
2528 /* If no side requires MITM protection; auto-accept */
2529 if ((!loc_mitm || conn->remote_cap == 0x03) &&
2530 (!rem_mitm || conn->io_capability == 0x03)) {
55bc1a37
JH		 2531
2532 /* If we're not the initiators request authorization to
2533 * proceed from user space (mgmt_user_confirm with
2534 * confirm_hint set to 1). */
2535 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2536 BT_DBG("Confirming auto-accept as acceptor");
2537 confirm_hint = 1;
2538 goto confirm;
2539 }
2540
9f61656a
JH		 2541 BT_DBG("Auto-accept of user confirmation with %ums delay",
2542 hdev->auto_accept_delay);
2543
2544 if (hdev->auto_accept_delay > 0) {
2545 int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2546 mod_timer(&conn->auto_accept_timer, jiffies + delay);
2547 goto unlock;
2548 }
2549
7a828908
JH		 2550 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2551 sizeof(ev->bdaddr), &ev->bdaddr);
2552 goto unlock;
2553 }
2554
55bc1a37
JH		 2555confirm:
2556 mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
2557 confirm_hint);
7a828908
JH		 2558
2559unlock:
a5c29683
JH		 2560 hci_dev_unlock(hdev);
2561}
2562
0493684e
MH		 2563static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2564{
2565 struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2566 struct hci_conn *conn;
2567
2568 BT_DBG("%s", hdev->name);
2569
2570 hci_dev_lock(hdev);
2571
2572 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2a611692
JH		 2573 if (!conn)
2574 goto unlock;
2575
2576 /* To avoid duplicate auth_failed events to user space we check
2577 * the HCI_CONN_AUTH_PEND flag which will be set if we
2578 * initiated the authentication. A traditional auth_complete
2579 * event gets always produced as initiator and is also mapped to
2580 * the mgmt_auth_failed event */
2581 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2582 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
0493684e 2583
2a611692
JH		 2584 hci_conn_put(conn);
2585
2586unlock:
0493684e
MH		 2587 hci_dev_unlock(hdev);
2588}
2589
41a96212
MH		 2590static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2591{
2592 struct hci_ev_remote_host_features *ev = (void *) skb->data;
2593 struct inquiry_entry *ie;
2594
2595 BT_DBG("%s", hdev->name);
2596
2597 hci_dev_lock(hdev);
2598
cc11b9c1
AE		 2599 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2600 if (ie)
41a96212
MH		 2601 ie->data.ssp_mode = (ev->features[0] & 0x01);
2602
2603 hci_dev_unlock(hdev);
2604}
2605
2763eda6
SJ		 2606static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2607 struct sk_buff *skb)
2608{
2609 struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2610 struct oob_data *data;
2611
2612 BT_DBG("%s", hdev->name);
2613
2614 hci_dev_lock(hdev);
2615
e1ba1f15
SJ		 2616 if (!test_bit(HCI_MGMT, &hdev->flags))
2617 goto unlock;
2618
2763eda6
SJ		 2619 data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2620 if (data) {
2621 struct hci_cp_remote_oob_data_reply cp;
2622
2623 bacpy(&cp.bdaddr, &ev->bdaddr);
2624 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2625 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2626
2627 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2628 &cp);
2629 } else {
2630 struct hci_cp_remote_oob_data_neg_reply cp;
2631
2632 bacpy(&cp.bdaddr, &ev->bdaddr);
2633 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2634 &cp);
2635 }
2636
e1ba1f15 2637unlock:
2763eda6
SJ		 2638 hci_dev_unlock(hdev);
2639}
2640
fcd89c09
VT		 2641static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2642{
2643 struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2644 struct hci_conn *conn;
2645
2646 BT_DBG("%s status %d", hdev->name, ev->status);
2647
2648 hci_dev_lock(hdev);
2649
2650 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
b62f328b
VT		 2651 if (!conn) {
2652 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2653 if (!conn) {
2654 BT_ERR("No memory for new connection");
2655 hci_dev_unlock(hdev);
2656 return;
2657 }
2658 }
fcd89c09
VT		 2659
2660 if (ev->status) {
2661 hci_proto_connect_cfm(conn, ev->status);
2662 conn->state = BT_CLOSED;
2663 hci_conn_del(conn);
2664 goto unlock;
2665 }
2666
2667 conn->handle = __le16_to_cpu(ev->handle);
2668 conn->state = BT_CONNECTED;
2669
2670 hci_conn_hold_device(conn);
2671 hci_conn_add_sysfs(conn);
2672
2673 hci_proto_connect_cfm(conn, ev->status);
2674
2675unlock:
2676 hci_dev_unlock(hdev);
2677}
2678
2679static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2680{
2681 struct hci_ev_le_meta *le_ev = (void *) skb->data;
2682
2683 skb_pull(skb, sizeof(*le_ev));
2684
2685 switch (le_ev->subevent) {
2686 case HCI_EV_LE_CONN_COMPLETE:
2687 hci_le_conn_complete_evt(hdev, skb);
2688 break;
2689
2690 default:
2691 break;
2692 }
2693}
2694
a9de9248
MH		 2695void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2696{
2697 struct hci_event_hdr *hdr = (void *) skb->data;
2698 __u8 event = hdr->evt;
2699
2700 skb_pull(skb, HCI_EVENT_HDR_SIZE);
2701
2702 switch (event) {
1da177e4
LT		 2703 case HCI_EV_INQUIRY_COMPLETE:
2704 hci_inquiry_complete_evt(hdev, skb);
2705 break;
2706
2707 case HCI_EV_INQUIRY_RESULT:
2708 hci_inquiry_result_evt(hdev, skb);
2709 break;
2710
a9de9248
MH		 2711 case HCI_EV_CONN_COMPLETE:
2712 hci_conn_complete_evt(hdev, skb);
21d9e30e
MH		 2713 break;
2714
1da177e4
LT		 2715 case HCI_EV_CONN_REQUEST:
2716 hci_conn_request_evt(hdev, skb);
2717 break;
2718
1da177e4
LT		 2719 case HCI_EV_DISCONN_COMPLETE:
2720 hci_disconn_complete_evt(hdev, skb);
2721 break;
2722
1da177e4
LT		 2723 case HCI_EV_AUTH_COMPLETE:
2724 hci_auth_complete_evt(hdev, skb);
2725 break;
2726
a9de9248
MH		 2727 case HCI_EV_REMOTE_NAME:
2728 hci_remote_name_evt(hdev, skb);
2729 break;
2730
1da177e4
LT		 2731 case HCI_EV_ENCRYPT_CHANGE:
2732 hci_encrypt_change_evt(hdev, skb);
2733 break;
2734
a9de9248
MH		 2735 case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2736 hci_change_link_key_complete_evt(hdev, skb);
2737 break;
2738
2739 case HCI_EV_REMOTE_FEATURES:
2740 hci_remote_features_evt(hdev, skb);
2741 break;
2742
2743 case HCI_EV_REMOTE_VERSION:
2744 hci_remote_version_evt(hdev, skb);
2745 break;
2746
2747 case HCI_EV_QOS_SETUP_COMPLETE:
2748 hci_qos_setup_complete_evt(hdev, skb);
2749 break;
2750
2751 case HCI_EV_CMD_COMPLETE:
2752 hci_cmd_complete_evt(hdev, skb);
2753 break;
2754
2755 case HCI_EV_CMD_STATUS:
2756 hci_cmd_status_evt(hdev, skb);
2757 break;
2758
2759 case HCI_EV_ROLE_CHANGE:
2760 hci_role_change_evt(hdev, skb);
2761 break;
2762
2763 case HCI_EV_NUM_COMP_PKTS:
2764 hci_num_comp_pkts_evt(hdev, skb);
2765 break;
2766
2767 case HCI_EV_MODE_CHANGE:
2768 hci_mode_change_evt(hdev, skb);
1da177e4
LT		 2769 break;
2770
2771 case HCI_EV_PIN_CODE_REQ:
2772 hci_pin_code_request_evt(hdev, skb);
2773 break;
2774
2775 case HCI_EV_LINK_KEY_REQ:
2776 hci_link_key_request_evt(hdev, skb);
2777 break;
2778
2779 case HCI_EV_LINK_KEY_NOTIFY:
2780 hci_link_key_notify_evt(hdev, skb);
2781 break;
2782
2783 case HCI_EV_CLOCK_OFFSET:
2784 hci_clock_offset_evt(hdev, skb);
2785 break;
2786
a8746417
MH		 2787 case HCI_EV_PKT_TYPE_CHANGE:
2788 hci_pkt_type_change_evt(hdev, skb);
2789 break;
2790
85a1e930
MH		 2791 case HCI_EV_PSCAN_REP_MODE:
2792 hci_pscan_rep_mode_evt(hdev, skb);
2793 break;
2794
a9de9248
MH		 2795 case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
2796 hci_inquiry_result_with_rssi_evt(hdev, skb);
04837f64
MH		 2797 break;
2798
a9de9248
MH		 2799 case HCI_EV_REMOTE_EXT_FEATURES:
2800 hci_remote_ext_features_evt(hdev, skb);
1da177e4
LT		 2801 break;
2802
a9de9248
MH		 2803 case HCI_EV_SYNC_CONN_COMPLETE:
2804 hci_sync_conn_complete_evt(hdev, skb);
2805 break;
1da177e4 2806
a9de9248
MH		 2807 case HCI_EV_SYNC_CONN_CHANGED:
2808 hci_sync_conn_changed_evt(hdev, skb);
2809 break;
1da177e4 2810
a9de9248
MH		 2811 case HCI_EV_SNIFF_SUBRATE:
2812 hci_sniff_subrate_evt(hdev, skb);
2813 break;
1da177e4 2814
a9de9248
MH		 2815 case HCI_EV_EXTENDED_INQUIRY_RESULT:
2816 hci_extended_inquiry_result_evt(hdev, skb);
2817 break;
1da177e4 2818
0493684e
MH		 2819 case HCI_EV_IO_CAPA_REQUEST:
2820 hci_io_capa_request_evt(hdev, skb);
2821 break;
2822
03b555e1
JH		 2823 case HCI_EV_IO_CAPA_REPLY:
2824 hci_io_capa_reply_evt(hdev, skb);
2825 break;
2826
a5c29683
JH		 2827 case HCI_EV_USER_CONFIRM_REQUEST:
2828 hci_user_confirm_request_evt(hdev, skb);
2829 break;
2830
0493684e
MH		 2831 case HCI_EV_SIMPLE_PAIR_COMPLETE:
2832 hci_simple_pair_complete_evt(hdev, skb);
2833 break;
2834
41a96212
MH		 2835 case HCI_EV_REMOTE_HOST_FEATURES:
2836 hci_remote_host_features_evt(hdev, skb);
2837 break;
2838
fcd89c09
VT		 2839 case HCI_EV_LE_META:
2840 hci_le_meta_evt(hdev, skb);
2841 break;
2842
2763eda6
SJ		 2843 case HCI_EV_REMOTE_OOB_DATA_REQUEST:
2844 hci_remote_oob_data_request_evt(hdev, skb);
2845 break;
2846
a9de9248
MH		 2847 default:
2848 BT_DBG("%s event 0x%x", hdev->name, event);
1da177e4
LT		 2849 break;
2850 }
2851
2852 kfree_skb(skb);
2853 hdev->stat.evt_rx++;
2854}
2855
2856/* Generate internal stack event */
2857void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
2858{
2859 struct hci_event_hdr *hdr;
2860 struct hci_ev_stack_internal *ev;
2861 struct sk_buff *skb;
2862
2863 skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
2864 if (!skb)
2865 return;
2866
2867 hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
2868 hdr->evt = HCI_EV_STACK_INTERNAL;
2869 hdr->plen = sizeof(*ev) + dlen;
2870
2871 ev = (void *) skb_put(skb, sizeof(*ev) + dlen);
2872 ev->type = type;
2873 memcpy(ev->data, data, dlen);
2874
576c7d85 2875 bt_cb(skb)->incoming = 1;
a61bbcf2 2876 __net_timestamp(skb);
576c7d85 2877
0d48d939 2878 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1da177e4 2879 skb->dev = (void *) hdev;
eec8d2bc 2880 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2881 kfree_skb(skb);
2882}
kernel source for telekom puls (alcatel/mediatek)