hci_event.c 153 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342534353445345534653475348534953505351535253535354535553565357535853595360536153625363536453655366536753685369537053715372537353745375537653775378537953805381538253835384538553865387538853895390539153925393539453955396539753985399540054015402540354045405540654075408540954105411541254135414541554165417541854195420542154225423542454255426542754285429543054315432543354345435543654375438543954405441544254435444544554465447544854495450545154525453545454555456545754585459546054615462546354645465546654675468546954705471547254735474547554765477547854795480548154825483548454855486548754885489549054915492549354945495549654975498549955005501550255035504550555065507550855095510551155125513551455155516551755185519552055215522552355245525552655275528552955305531553255335534553555365537553855395540554155425543554455455546554755485549555055515552555355545555555655575558555955605561556255635564556555665567556855695570557155725573557455755576557755785579558055815582558355845585558655875588558955905591559255935594559555965597559855995600560156025603560456055606560756085609561056115612561356145615561656175618561956205621562256235624562556265627562856295630563156325633563456355636563756385639564056415642564356445645564656475648564956505651565256535654565556565657565856595660566156625663566456655666566756685669567056715672567356745675567656775678567956805681568256835684568556865687568856895690569156925693569456955696569756985699570057015702570357045705570657075708570957105711571257135714571557165717571857195720572157225723572457255726572757285729573057315732573357345735573657375738573957405741574257435744574557465747574857495750575157525753575457555756575757585759576057615762576357645765576657675768576957705771577257735774577557765777577857795780578157825783578457855786578757885789579057915792579357945795579657975798579958005801580258035804580558065807580858095810581158125813581458155816581758185819582058215822582358245825582658275828582958305831583258335834583558365837583858395840584158425843584458455846584758485849585058515852585358545855585658575858585958605861586258635864586558665867586858695870587158725873587458755876587758785879588058815882588358845885588658875888588958905891589258935894589558965897589858995900590159025903590459055906590759085909591059115912591359145915591659175918591959205921592259235924592559265927592859295930593159325933593459355936593759385939594059415942594359445945594659475948594959505951595259535954595559565957595859595960596159625963596459655966596759685969597059715972597359745975597659775978597959805981598259835984598559865987598859895990599159925993599459955996599759985999600060016002600360046005600660076008600960106011601260136014601560166017601860196020602160226023602460256026602760286029603060316032603360346035603660376038603960406041604260436044604560466047604860496050605160526053605460556056605760586059606060616062606360646065606660676068606960706071607260736074607560766077607860796080608160826083608460856086608760886089609060916092609360946095609660976098609961006101610261036104610561066107610861096110611161126113611461156116611761186119612061216122612361246125612661276128612961306131613261336134613561366137613861396140614161426143614461456146614761486149615061516152615361546155615661576158615961606161616261636164616561666167616861696170617161726173617461756176617761786179618061816182618361846185618661876188618961906191619261936194619561966197619861996200620162026203620462056206620762086209621062116212621362146215621662176218621962206221622262236224622562266227622862296230623162326233623462356236623762386239624062416242624362446245624662476248624962506251625262536254625562566257625862596260626162626263626462656266626762686269627062716272627362746275627662776278627962806281628262836284628562866287628862896290629162926293629462956296629762986299630063016302630363046305630663076308630963106311631263136314631563166317631863196320632163226323632463256326632763286329633063316332633363346335633663376338633963406341634263436344634563466347634863496350635163526353635463556356635763586359636063616362636363646365636663676368636963706371637263736374637563766377637863796380638163826383638463856386638763886389
  1. /*
  2. BlueZ - Bluetooth protocol stack for Linux
  3. Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
  4. Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  5. This program is free software; you can redistribute it and/or modify
  6. it under the terms of the GNU General Public License version 2 as
  7. published by the Free Software Foundation;
  8. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  9. OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  10. FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  11. IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  12. CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  13. WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  14. ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  15. OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  16. ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  17. COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  18. SOFTWARE IS DISCLAIMED.
  19. */
  20. /* Bluetooth HCI event handling. */
  21. #include <asm/unaligned.h>
  22. #include <net/bluetooth/bluetooth.h>
  23. #include <net/bluetooth/hci_core.h>
  24. #include <net/bluetooth/mgmt.h>
  25. #include "hci_request.h"
  26. #include "hci_debugfs.h"
  27. #include "a2mp.h"
  28. #include "amp.h"
  29. #include "smp.h"
  30. #include "msft.h"
  31. #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  32. "\x00\x00\x00\x00\x00\x00\x00\x00"
  33. /* Handle HCI Event packets */
  34. static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  35. u8 *new_status)
  36. {
  37. __u8 status = *((__u8 *) skb->data);
  38. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  39. /* It is possible that we receive Inquiry Complete event right
  40. * before we receive Inquiry Cancel Command Complete event, in
  41. * which case the latter event should have status of Command
  42. * Disallowed (0x0c). This should not be treated as error, since
  43. * we actually achieve what Inquiry Cancel wants to achieve,
  44. * which is to end the last Inquiry session.
  45. */
  46. if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  47. bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  48. status = 0x00;
  49. }
  50. *new_status = status;
  51. if (status)
  52. return;
  53. clear_bit(HCI_INQUIRY, &hdev->flags);
  54. smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55. wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56. hci_dev_lock(hdev);
  57. /* Set discovery state to stopped if we're not doing LE active
  58. * scanning.
  59. */
  60. if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  61. hdev->le_scan_type != LE_SCAN_ACTIVE)
  62. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  63. hci_dev_unlock(hdev);
  64. hci_conn_check_pending(hdev);
  65. }
  66. static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67. {
  68. __u8 status = *((__u8 *) skb->data);
  69. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  70. if (status)
  71. return;
  72. hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  73. }
  74. static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  75. {
  76. __u8 status = *((__u8 *) skb->data);
  77. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  78. if (status)
  79. return;
  80. hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  81. hci_conn_check_pending(hdev);
  82. }
  83. static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  84. struct sk_buff *skb)
  85. {
  86. BT_DBG("%s", hdev->name);
  87. }
  88. static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  89. {
  90. struct hci_rp_role_discovery *rp = (void *) skb->data;
  91. struct hci_conn *conn;
  92. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  93. if (rp->status)
  94. return;
  95. hci_dev_lock(hdev);
  96. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  97. if (conn)
  98. conn->role = rp->role;
  99. hci_dev_unlock(hdev);
  100. }
  101. static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
  102. {
  103. struct hci_rp_read_link_policy *rp = (void *) skb->data;
  104. struct hci_conn *conn;
  105. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  106. if (rp->status)
  107. return;
  108. hci_dev_lock(hdev);
  109. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  110. if (conn)
  111. conn->link_policy = __le16_to_cpu(rp->policy);
  112. hci_dev_unlock(hdev);
  113. }
  114. static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
  115. {
  116. struct hci_rp_write_link_policy *rp = (void *) skb->data;
  117. struct hci_conn *conn;
  118. void *sent;
  119. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  120. if (rp->status)
  121. return;
  122. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
  123. if (!sent)
  124. return;
  125. hci_dev_lock(hdev);
  126. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  127. if (conn)
  128. conn->link_policy = get_unaligned_le16(sent + 2);
  129. hci_dev_unlock(hdev);
  130. }
  131. static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
  132. struct sk_buff *skb)
  133. {
  134. struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
  135. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  136. if (rp->status)
  137. return;
  138. hdev->link_policy = __le16_to_cpu(rp->policy);
  139. }
  140. static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
  141. struct sk_buff *skb)
  142. {
  143. __u8 status = *((__u8 *) skb->data);
  144. void *sent;
  145. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  146. if (status)
  147. return;
  148. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
  149. if (!sent)
  150. return;
  151. hdev->link_policy = get_unaligned_le16(sent);
  152. }
  153. static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
  154. {
  155. __u8 status = *((__u8 *) skb->data);
  156. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  157. clear_bit(HCI_RESET, &hdev->flags);
  158. if (status)
  159. return;
  160. /* Reset all non-persistent flags */
  161. hci_dev_clear_volatile_flags(hdev);
  162. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  163. hdev->inq_tx_power = HCI_TX_POWER_INVALID;
  164. hdev->adv_tx_power = HCI_TX_POWER_INVALID;
  165. memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
  166. hdev->adv_data_len = 0;
  167. memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
  168. hdev->scan_rsp_data_len = 0;
  169. hdev->le_scan_type = LE_SCAN_PASSIVE;
  170. hdev->ssp_debug_mode = 0;
  171. hci_bdaddr_list_clear(&hdev->le_white_list);
  172. hci_bdaddr_list_clear(&hdev->le_resolv_list);
  173. }
  174. static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
  175. struct sk_buff *skb)
  176. {
  177. struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
  178. struct hci_cp_read_stored_link_key *sent;
  179. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  180. sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
  181. if (!sent)
  182. return;
  183. if (!rp->status && sent->read_all == 0x01) {
  184. hdev->stored_max_keys = rp->max_keys;
  185. hdev->stored_num_keys = rp->num_keys;
  186. }
  187. }
  188. static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
  189. struct sk_buff *skb)
  190. {
  191. struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
  192. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  193. if (rp->status)
  194. return;
  195. if (rp->num_keys <= hdev->stored_num_keys)
  196. hdev->stored_num_keys -= rp->num_keys;
  197. else
  198. hdev->stored_num_keys = 0;
  199. }
  200. static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
  201. {
  202. __u8 status = *((__u8 *) skb->data);
  203. void *sent;
  204. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  205. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
  206. if (!sent)
  207. return;
  208. hci_dev_lock(hdev);
  209. if (hci_dev_test_flag(hdev, HCI_MGMT))
  210. mgmt_set_local_name_complete(hdev, sent, status);
  211. else if (!status)
  212. memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
  213. hci_dev_unlock(hdev);
  214. }
  215. static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
  216. {
  217. struct hci_rp_read_local_name *rp = (void *) skb->data;
  218. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  219. if (rp->status)
  220. return;
  221. if (hci_dev_test_flag(hdev, HCI_SETUP) ||
  222. hci_dev_test_flag(hdev, HCI_CONFIG))
  223. memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
  224. }
  225. static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
  226. {
  227. __u8 status = *((__u8 *) skb->data);
  228. void *sent;
  229. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  230. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
  231. if (!sent)
  232. return;
  233. hci_dev_lock(hdev);
  234. if (!status) {
  235. __u8 param = *((__u8 *) sent);
  236. if (param == AUTH_ENABLED)
  237. set_bit(HCI_AUTH, &hdev->flags);
  238. else
  239. clear_bit(HCI_AUTH, &hdev->flags);
  240. }
  241. if (hci_dev_test_flag(hdev, HCI_MGMT))
  242. mgmt_auth_enable_complete(hdev, status);
  243. hci_dev_unlock(hdev);
  244. }
  245. static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
  246. {
  247. __u8 status = *((__u8 *) skb->data);
  248. __u8 param;
  249. void *sent;
  250. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  251. if (status)
  252. return;
  253. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
  254. if (!sent)
  255. return;
  256. param = *((__u8 *) sent);
  257. if (param)
  258. set_bit(HCI_ENCRYPT, &hdev->flags);
  259. else
  260. clear_bit(HCI_ENCRYPT, &hdev->flags);
  261. }
  262. static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
  263. {
  264. __u8 status = *((__u8 *) skb->data);
  265. __u8 param;
  266. void *sent;
  267. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  268. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
  269. if (!sent)
  270. return;
  271. param = *((__u8 *) sent);
  272. hci_dev_lock(hdev);
  273. if (status) {
  274. hdev->discov_timeout = 0;
  275. goto done;
  276. }
  277. if (param & SCAN_INQUIRY)
  278. set_bit(HCI_ISCAN, &hdev->flags);
  279. else
  280. clear_bit(HCI_ISCAN, &hdev->flags);
  281. if (param & SCAN_PAGE)
  282. set_bit(HCI_PSCAN, &hdev->flags);
  283. else
  284. clear_bit(HCI_PSCAN, &hdev->flags);
  285. done:
  286. hci_dev_unlock(hdev);
  287. }
  288. static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
  289. {
  290. struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
  291. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  292. if (rp->status)
  293. return;
  294. memcpy(hdev->dev_class, rp->dev_class, 3);
  295. BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
  296. hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
  297. }
  298. static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
  299. {
  300. __u8 status = *((__u8 *) skb->data);
  301. void *sent;
  302. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  303. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
  304. if (!sent)
  305. return;
  306. hci_dev_lock(hdev);
  307. if (status == 0)
  308. memcpy(hdev->dev_class, sent, 3);
  309. if (hci_dev_test_flag(hdev, HCI_MGMT))
  310. mgmt_set_class_of_dev_complete(hdev, sent, status);
  311. hci_dev_unlock(hdev);
  312. }
  313. static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
  314. {
  315. struct hci_rp_read_voice_setting *rp = (void *) skb->data;
  316. __u16 setting;
  317. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  318. if (rp->status)
  319. return;
  320. setting = __le16_to_cpu(rp->voice_setting);
  321. if (hdev->voice_setting == setting)
  322. return;
  323. hdev->voice_setting = setting;
  324. BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
  325. if (hdev->notify)
  326. hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
  327. }
  328. static void hci_cc_write_voice_setting(struct hci_dev *hdev,
  329. struct sk_buff *skb)
  330. {
  331. __u8 status = *((__u8 *) skb->data);
  332. __u16 setting;
  333. void *sent;
  334. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  335. if (status)
  336. return;
  337. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
  338. if (!sent)
  339. return;
  340. setting = get_unaligned_le16(sent);
  341. if (hdev->voice_setting == setting)
  342. return;
  343. hdev->voice_setting = setting;
  344. BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
  345. if (hdev->notify)
  346. hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
  347. }
  348. static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
  349. struct sk_buff *skb)
  350. {
  351. struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
  352. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  353. if (rp->status)
  354. return;
  355. hdev->num_iac = rp->num_iac;
  356. BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
  357. }
  358. static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
  359. {
  360. __u8 status = *((__u8 *) skb->data);
  361. struct hci_cp_write_ssp_mode *sent;
  362. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  363. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
  364. if (!sent)
  365. return;
  366. hci_dev_lock(hdev);
  367. if (!status) {
  368. if (sent->mode)
  369. hdev->features[1][0] |= LMP_HOST_SSP;
  370. else
  371. hdev->features[1][0] &= ~LMP_HOST_SSP;
  372. }
  373. if (hci_dev_test_flag(hdev, HCI_MGMT))
  374. mgmt_ssp_enable_complete(hdev, sent->mode, status);
  375. else if (!status) {
  376. if (sent->mode)
  377. hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
  378. else
  379. hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
  380. }
  381. hci_dev_unlock(hdev);
  382. }
  383. static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
  384. {
  385. u8 status = *((u8 *) skb->data);
  386. struct hci_cp_write_sc_support *sent;
  387. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  388. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
  389. if (!sent)
  390. return;
  391. hci_dev_lock(hdev);
  392. if (!status) {
  393. if (sent->support)
  394. hdev->features[1][0] |= LMP_HOST_SC;
  395. else
  396. hdev->features[1][0] &= ~LMP_HOST_SC;
  397. }
  398. if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
  399. if (sent->support)
  400. hci_dev_set_flag(hdev, HCI_SC_ENABLED);
  401. else
  402. hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
  403. }
  404. hci_dev_unlock(hdev);
  405. }
  406. static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
  407. {
  408. struct hci_rp_read_local_version *rp = (void *) skb->data;
  409. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  410. if (rp->status)
  411. return;
  412. if (hci_dev_test_flag(hdev, HCI_SETUP) ||
  413. hci_dev_test_flag(hdev, HCI_CONFIG)) {
  414. hdev->hci_ver = rp->hci_ver;
  415. hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
  416. hdev->lmp_ver = rp->lmp_ver;
  417. hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
  418. hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
  419. }
  420. }
  421. static void hci_cc_read_local_commands(struct hci_dev *hdev,
  422. struct sk_buff *skb)
  423. {
  424. struct hci_rp_read_local_commands *rp = (void *) skb->data;
  425. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  426. if (rp->status)
  427. return;
  428. if (hci_dev_test_flag(hdev, HCI_SETUP) ||
  429. hci_dev_test_flag(hdev, HCI_CONFIG))
  430. memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
  431. }
  432. static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
  433. struct sk_buff *skb)
  434. {
  435. struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
  436. struct hci_conn *conn;
  437. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  438. if (rp->status)
  439. return;
  440. hci_dev_lock(hdev);
  441. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  442. if (conn)
  443. conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
  444. hci_dev_unlock(hdev);
  445. }
  446. static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
  447. struct sk_buff *skb)
  448. {
  449. struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
  450. struct hci_conn *conn;
  451. void *sent;
  452. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  453. if (rp->status)
  454. return;
  455. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
  456. if (!sent)
  457. return;
  458. hci_dev_lock(hdev);
  459. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  460. if (conn)
  461. conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
  462. hci_dev_unlock(hdev);
  463. }
  464. static void hci_cc_read_local_features(struct hci_dev *hdev,
  465. struct sk_buff *skb)
  466. {
  467. struct hci_rp_read_local_features *rp = (void *) skb->data;
  468. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  469. if (rp->status)
  470. return;
  471. memcpy(hdev->features, rp->features, 8);
  472. /* Adjust default settings according to features
  473. * supported by device. */
  474. if (hdev->features[0][0] & LMP_3SLOT)
  475. hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
  476. if (hdev->features[0][0] & LMP_5SLOT)
  477. hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
  478. if (hdev->features[0][1] & LMP_HV2) {
  479. hdev->pkt_type |= (HCI_HV2);
  480. hdev->esco_type |= (ESCO_HV2);
  481. }
  482. if (hdev->features[0][1] & LMP_HV3) {
  483. hdev->pkt_type |= (HCI_HV3);
  484. hdev->esco_type |= (ESCO_HV3);
  485. }
  486. if (lmp_esco_capable(hdev))
  487. hdev->esco_type |= (ESCO_EV3);
  488. if (hdev->features[0][4] & LMP_EV4)
  489. hdev->esco_type |= (ESCO_EV4);
  490. if (hdev->features[0][4] & LMP_EV5)
  491. hdev->esco_type |= (ESCO_EV5);
  492. if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
  493. hdev->esco_type |= (ESCO_2EV3);
  494. if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
  495. hdev->esco_type |= (ESCO_3EV3);
  496. if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
  497. hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
  498. }
  499. static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
  500. struct sk_buff *skb)
  501. {
  502. struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
  503. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  504. if (rp->status)
  505. return;
  506. if (hdev->max_page < rp->max_page)
  507. hdev->max_page = rp->max_page;
  508. if (rp->page < HCI_MAX_PAGES)
  509. memcpy(hdev->features[rp->page], rp->features, 8);
  510. }
  511. static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
  512. struct sk_buff *skb)
  513. {
  514. struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
  515. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  516. if (rp->status)
  517. return;
  518. hdev->flow_ctl_mode = rp->mode;
  519. }
  520. static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
  521. {
  522. struct hci_rp_read_buffer_size *rp = (void *) skb->data;
  523. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  524. if (rp->status)
  525. return;
  526. hdev->acl_mtu = __le16_to_cpu(rp->acl_mtu);
  527. hdev->sco_mtu = rp->sco_mtu;
  528. hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
  529. hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
  530. if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
  531. hdev->sco_mtu = 64;
  532. hdev->sco_pkts = 8;
  533. }
  534. hdev->acl_cnt = hdev->acl_pkts;
  535. hdev->sco_cnt = hdev->sco_pkts;
  536. BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
  537. hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
  538. }
  539. static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
  540. {
  541. struct hci_rp_read_bd_addr *rp = (void *) skb->data;
  542. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  543. if (rp->status)
  544. return;
  545. if (test_bit(HCI_INIT, &hdev->flags))
  546. bacpy(&hdev->bdaddr, &rp->bdaddr);
  547. if (hci_dev_test_flag(hdev, HCI_SETUP))
  548. bacpy(&hdev->setup_addr, &rp->bdaddr);
  549. }
  550. static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
  551. struct sk_buff *skb)
  552. {
  553. struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
  554. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  555. if (rp->status)
  556. return;
  557. if (hci_dev_test_flag(hdev, HCI_SETUP) ||
  558. hci_dev_test_flag(hdev, HCI_CONFIG)) {
  559. hdev->pairing_opts = rp->pairing_opts;
  560. hdev->max_enc_key_size = rp->max_key_size;
  561. }
  562. }
  563. static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
  564. struct sk_buff *skb)
  565. {
  566. struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
  567. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  568. if (rp->status)
  569. return;
  570. if (test_bit(HCI_INIT, &hdev->flags)) {
  571. hdev->page_scan_interval = __le16_to_cpu(rp->interval);
  572. hdev->page_scan_window = __le16_to_cpu(rp->window);
  573. }
  574. }
  575. static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
  576. struct sk_buff *skb)
  577. {
  578. u8 status = *((u8 *) skb->data);
  579. struct hci_cp_write_page_scan_activity *sent;
  580. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  581. if (status)
  582. return;
  583. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
  584. if (!sent)
  585. return;
  586. hdev->page_scan_interval = __le16_to_cpu(sent->interval);
  587. hdev->page_scan_window = __le16_to_cpu(sent->window);
  588. }
  589. static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
  590. struct sk_buff *skb)
  591. {
  592. struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
  593. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  594. if (rp->status)
  595. return;
  596. if (test_bit(HCI_INIT, &hdev->flags))
  597. hdev->page_scan_type = rp->type;
  598. }
  599. static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
  600. struct sk_buff *skb)
  601. {
  602. u8 status = *((u8 *) skb->data);
  603. u8 *type;
  604. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  605. if (status)
  606. return;
  607. type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
  608. if (type)
  609. hdev->page_scan_type = *type;
  610. }
  611. static void hci_cc_read_data_block_size(struct hci_dev *hdev,
  612. struct sk_buff *skb)
  613. {
  614. struct hci_rp_read_data_block_size *rp = (void *) skb->data;
  615. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  616. if (rp->status)
  617. return;
  618. hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
  619. hdev->block_len = __le16_to_cpu(rp->block_len);
  620. hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
  621. hdev->block_cnt = hdev->num_blocks;
  622. BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
  623. hdev->block_cnt, hdev->block_len);
  624. }
  625. static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
  626. {
  627. struct hci_rp_read_clock *rp = (void *) skb->data;
  628. struct hci_cp_read_clock *cp;
  629. struct hci_conn *conn;
  630. BT_DBG("%s", hdev->name);
  631. if (skb->len < sizeof(*rp))
  632. return;
  633. if (rp->status)
  634. return;
  635. hci_dev_lock(hdev);
  636. cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
  637. if (!cp)
  638. goto unlock;
  639. if (cp->which == 0x00) {
  640. hdev->clock = le32_to_cpu(rp->clock);
  641. goto unlock;
  642. }
  643. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  644. if (conn) {
  645. conn->clock = le32_to_cpu(rp->clock);
  646. conn->clock_accuracy = le16_to_cpu(rp->accuracy);
  647. }
  648. unlock:
  649. hci_dev_unlock(hdev);
  650. }
  651. static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
  652. struct sk_buff *skb)
  653. {
  654. struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
  655. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  656. if (rp->status)
  657. return;
  658. hdev->amp_status = rp->amp_status;
  659. hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
  660. hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
  661. hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
  662. hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
  663. hdev->amp_type = rp->amp_type;
  664. hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
  665. hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
  666. hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
  667. hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
  668. }
  669. static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
  670. struct sk_buff *skb)
  671. {
  672. struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
  673. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  674. if (rp->status)
  675. return;
  676. hdev->inq_tx_power = rp->tx_power;
  677. }
  678. static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
  679. struct sk_buff *skb)
  680. {
  681. struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
  682. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  683. if (rp->status)
  684. return;
  685. hdev->err_data_reporting = rp->err_data_reporting;
  686. }
  687. static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
  688. struct sk_buff *skb)
  689. {
  690. __u8 status = *((__u8 *)skb->data);
  691. struct hci_cp_write_def_err_data_reporting *cp;
  692. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  693. if (status)
  694. return;
  695. cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
  696. if (!cp)
  697. return;
  698. hdev->err_data_reporting = cp->err_data_reporting;
  699. }
  700. static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
  701. {
  702. struct hci_rp_pin_code_reply *rp = (void *) skb->data;
  703. struct hci_cp_pin_code_reply *cp;
  704. struct hci_conn *conn;
  705. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  706. hci_dev_lock(hdev);
  707. if (hci_dev_test_flag(hdev, HCI_MGMT))
  708. mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
  709. if (rp->status)
  710. goto unlock;
  711. cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
  712. if (!cp)
  713. goto unlock;
  714. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
  715. if (conn)
  716. conn->pin_length = cp->pin_len;
  717. unlock:
  718. hci_dev_unlock(hdev);
  719. }
  720. static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
  721. {
  722. struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
  723. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  724. hci_dev_lock(hdev);
  725. if (hci_dev_test_flag(hdev, HCI_MGMT))
  726. mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
  727. rp->status);
  728. hci_dev_unlock(hdev);
  729. }
  730. static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
  731. struct sk_buff *skb)
  732. {
  733. struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
  734. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  735. if (rp->status)
  736. return;
  737. hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
  738. hdev->le_pkts = rp->le_max_pkt;
  739. hdev->le_cnt = hdev->le_pkts;
  740. BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
  741. }
  742. static void hci_cc_le_read_local_features(struct hci_dev *hdev,
  743. struct sk_buff *skb)
  744. {
  745. struct hci_rp_le_read_local_features *rp = (void *) skb->data;
  746. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  747. if (rp->status)
  748. return;
  749. memcpy(hdev->le_features, rp->features, 8);
  750. }
  751. static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
  752. struct sk_buff *skb)
  753. {
  754. struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
  755. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  756. if (rp->status)
  757. return;
  758. hdev->adv_tx_power = rp->tx_power;
  759. }
  760. static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
  761. {
  762. struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
  763. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  764. hci_dev_lock(hdev);
  765. if (hci_dev_test_flag(hdev, HCI_MGMT))
  766. mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
  767. rp->status);
  768. hci_dev_unlock(hdev);
  769. }
  770. static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
  771. struct sk_buff *skb)
  772. {
  773. struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
  774. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  775. hci_dev_lock(hdev);
  776. if (hci_dev_test_flag(hdev, HCI_MGMT))
  777. mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
  778. ACL_LINK, 0, rp->status);
  779. hci_dev_unlock(hdev);
  780. }
  781. static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
  782. {
  783. struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
  784. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  785. hci_dev_lock(hdev);
  786. if (hci_dev_test_flag(hdev, HCI_MGMT))
  787. mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
  788. 0, rp->status);
  789. hci_dev_unlock(hdev);
  790. }
  791. static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
  792. struct sk_buff *skb)
  793. {
  794. struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
  795. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  796. hci_dev_lock(hdev);
  797. if (hci_dev_test_flag(hdev, HCI_MGMT))
  798. mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
  799. ACL_LINK, 0, rp->status);
  800. hci_dev_unlock(hdev);
  801. }
  802. static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
  803. struct sk_buff *skb)
  804. {
  805. struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
  806. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  807. }
  808. static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
  809. struct sk_buff *skb)
  810. {
  811. struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
  812. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  813. }
  814. static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
  815. {
  816. __u8 status = *((__u8 *) skb->data);
  817. bdaddr_t *sent;
  818. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  819. if (status)
  820. return;
  821. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
  822. if (!sent)
  823. return;
  824. hci_dev_lock(hdev);
  825. bacpy(&hdev->random_addr, sent);
  826. hci_dev_unlock(hdev);
  827. }
  828. static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
  829. {
  830. __u8 status = *((__u8 *) skb->data);
  831. struct hci_cp_le_set_default_phy *cp;
  832. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  833. if (status)
  834. return;
  835. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
  836. if (!cp)
  837. return;
  838. hci_dev_lock(hdev);
  839. hdev->le_tx_def_phys = cp->tx_phys;
  840. hdev->le_rx_def_phys = cp->rx_phys;
  841. hci_dev_unlock(hdev);
  842. }
  843. static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
  844. struct sk_buff *skb)
  845. {
  846. __u8 status = *((__u8 *) skb->data);
  847. struct hci_cp_le_set_adv_set_rand_addr *cp;
  848. struct adv_info *adv_instance;
  849. if (status)
  850. return;
  851. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
  852. if (!cp)
  853. return;
  854. hci_dev_lock(hdev);
  855. if (!hdev->cur_adv_instance) {
  856. /* Store in hdev for instance 0 (Set adv and Directed advs) */
  857. bacpy(&hdev->random_addr, &cp->bdaddr);
  858. } else {
  859. adv_instance = hci_find_adv_instance(hdev,
  860. hdev->cur_adv_instance);
  861. if (adv_instance)
  862. bacpy(&adv_instance->random_addr, &cp->bdaddr);
  863. }
  864. hci_dev_unlock(hdev);
  865. }
  866. static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
  867. {
  868. __u8 *sent, status = *((__u8 *) skb->data);
  869. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  870. if (status)
  871. return;
  872. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
  873. if (!sent)
  874. return;
  875. hci_dev_lock(hdev);
  876. /* If we're doing connection initiation as peripheral. Set a
  877. * timeout in case something goes wrong.
  878. */
  879. if (*sent) {
  880. struct hci_conn *conn;
  881. hci_dev_set_flag(hdev, HCI_LE_ADV);
  882. conn = hci_lookup_le_connect(hdev);
  883. if (conn)
  884. queue_delayed_work(hdev->workqueue,
  885. &conn->le_conn_timeout,
  886. conn->conn_timeout);
  887. } else {
  888. hci_dev_clear_flag(hdev, HCI_LE_ADV);
  889. }
  890. hci_dev_unlock(hdev);
  891. }
  892. static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
  893. struct sk_buff *skb)
  894. {
  895. struct hci_cp_le_set_ext_adv_enable *cp;
  896. __u8 status = *((__u8 *) skb->data);
  897. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  898. if (status)
  899. return;
  900. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
  901. if (!cp)
  902. return;
  903. hci_dev_lock(hdev);
  904. if (cp->enable) {
  905. struct hci_conn *conn;
  906. hci_dev_set_flag(hdev, HCI_LE_ADV);
  907. conn = hci_lookup_le_connect(hdev);
  908. if (conn)
  909. queue_delayed_work(hdev->workqueue,
  910. &conn->le_conn_timeout,
  911. conn->conn_timeout);
  912. } else {
  913. hci_dev_clear_flag(hdev, HCI_LE_ADV);
  914. }
  915. hci_dev_unlock(hdev);
  916. }
  917. static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
  918. {
  919. struct hci_cp_le_set_scan_param *cp;
  920. __u8 status = *((__u8 *) skb->data);
  921. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  922. if (status)
  923. return;
  924. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
  925. if (!cp)
  926. return;
  927. hci_dev_lock(hdev);
  928. hdev->le_scan_type = cp->type;
  929. hci_dev_unlock(hdev);
  930. }
  931. static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
  932. struct sk_buff *skb)
  933. {
  934. struct hci_cp_le_set_ext_scan_params *cp;
  935. __u8 status = *((__u8 *) skb->data);
  936. struct hci_cp_le_scan_phy_params *phy_param;
  937. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  938. if (status)
  939. return;
  940. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
  941. if (!cp)
  942. return;
  943. phy_param = (void *)cp->data;
  944. hci_dev_lock(hdev);
  945. hdev->le_scan_type = phy_param->type;
  946. hci_dev_unlock(hdev);
  947. }
  948. static bool has_pending_adv_report(struct hci_dev *hdev)
  949. {
  950. struct discovery_state *d = &hdev->discovery;
  951. return bacmp(&d->last_adv_addr, BDADDR_ANY);
  952. }
  953. static void clear_pending_adv_report(struct hci_dev *hdev)
  954. {
  955. struct discovery_state *d = &hdev->discovery;
  956. bacpy(&d->last_adv_addr, BDADDR_ANY);
  957. d->last_adv_data_len = 0;
  958. }
  959. static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
  960. u8 bdaddr_type, s8 rssi, u32 flags,
  961. u8 *data, u8 len)
  962. {
  963. struct discovery_state *d = &hdev->discovery;
  964. if (len > HCI_MAX_AD_LENGTH)
  965. return;
  966. bacpy(&d->last_adv_addr, bdaddr);
  967. d->last_adv_addr_type = bdaddr_type;
  968. d->last_adv_rssi = rssi;
  969. d->last_adv_flags = flags;
  970. memcpy(d->last_adv_data, data, len);
  971. d->last_adv_data_len = len;
  972. }
  973. static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
  974. {
  975. hci_dev_lock(hdev);
  976. switch (enable) {
  977. case LE_SCAN_ENABLE:
  978. hci_dev_set_flag(hdev, HCI_LE_SCAN);
  979. if (hdev->le_scan_type == LE_SCAN_ACTIVE)
  980. clear_pending_adv_report(hdev);
  981. break;
  982. case LE_SCAN_DISABLE:
  983. /* We do this here instead of when setting DISCOVERY_STOPPED
  984. * since the latter would potentially require waiting for
  985. * inquiry to stop too.
  986. */
  987. if (has_pending_adv_report(hdev)) {
  988. struct discovery_state *d = &hdev->discovery;
  989. mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
  990. d->last_adv_addr_type, NULL,
  991. d->last_adv_rssi, d->last_adv_flags,
  992. d->last_adv_data,
  993. d->last_adv_data_len, NULL, 0);
  994. }
  995. /* Cancel this timer so that we don't try to disable scanning
  996. * when it's already disabled.
  997. */
  998. cancel_delayed_work(&hdev->le_scan_disable);
  999. hci_dev_clear_flag(hdev, HCI_LE_SCAN);
  1000. /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
  1001. * interrupted scanning due to a connect request. Mark
  1002. * therefore discovery as stopped. If this was not
  1003. * because of a connect request advertising might have
  1004. * been disabled because of active scanning, so
  1005. * re-enable it again if necessary.
  1006. */
  1007. if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
  1008. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  1009. else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
  1010. hdev->discovery.state == DISCOVERY_FINDING)
  1011. hci_req_reenable_advertising(hdev);
  1012. break;
  1013. default:
  1014. bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
  1015. enable);
  1016. break;
  1017. }
  1018. hci_dev_unlock(hdev);
  1019. }
  1020. static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
  1021. struct sk_buff *skb)
  1022. {
  1023. struct hci_cp_le_set_scan_enable *cp;
  1024. __u8 status = *((__u8 *) skb->data);
  1025. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1026. if (status)
  1027. return;
  1028. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
  1029. if (!cp)
  1030. return;
  1031. le_set_scan_enable_complete(hdev, cp->enable);
  1032. }
  1033. static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
  1034. struct sk_buff *skb)
  1035. {
  1036. struct hci_cp_le_set_ext_scan_enable *cp;
  1037. __u8 status = *((__u8 *) skb->data);
  1038. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1039. if (status)
  1040. return;
  1041. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
  1042. if (!cp)
  1043. return;
  1044. le_set_scan_enable_complete(hdev, cp->enable);
  1045. }
  1046. static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
  1047. struct sk_buff *skb)
  1048. {
  1049. struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
  1050. BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
  1051. rp->num_of_sets);
  1052. if (rp->status)
  1053. return;
  1054. hdev->le_num_of_adv_sets = rp->num_of_sets;
  1055. }
  1056. static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
  1057. struct sk_buff *skb)
  1058. {
  1059. struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
  1060. BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
  1061. if (rp->status)
  1062. return;
  1063. hdev->le_white_list_size = rp->size;
  1064. }
  1065. static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
  1066. struct sk_buff *skb)
  1067. {
  1068. __u8 status = *((__u8 *) skb->data);
  1069. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1070. if (status)
  1071. return;
  1072. hci_bdaddr_list_clear(&hdev->le_white_list);
  1073. }
  1074. static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
  1075. struct sk_buff *skb)
  1076. {
  1077. struct hci_cp_le_add_to_white_list *sent;
  1078. __u8 status = *((__u8 *) skb->data);
  1079. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1080. if (status)
  1081. return;
  1082. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
  1083. if (!sent)
  1084. return;
  1085. hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
  1086. sent->bdaddr_type);
  1087. }
  1088. static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
  1089. struct sk_buff *skb)
  1090. {
  1091. struct hci_cp_le_del_from_white_list *sent;
  1092. __u8 status = *((__u8 *) skb->data);
  1093. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1094. if (status)
  1095. return;
  1096. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
  1097. if (!sent)
  1098. return;
  1099. hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
  1100. sent->bdaddr_type);
  1101. }
  1102. static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
  1103. struct sk_buff *skb)
  1104. {
  1105. struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
  1106. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1107. if (rp->status)
  1108. return;
  1109. memcpy(hdev->le_states, rp->le_states, 8);
  1110. }
  1111. static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
  1112. struct sk_buff *skb)
  1113. {
  1114. struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
  1115. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1116. if (rp->status)
  1117. return;
  1118. hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
  1119. hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
  1120. }
  1121. static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
  1122. struct sk_buff *skb)
  1123. {
  1124. struct hci_cp_le_write_def_data_len *sent;
  1125. __u8 status = *((__u8 *) skb->data);
  1126. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1127. if (status)
  1128. return;
  1129. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
  1130. if (!sent)
  1131. return;
  1132. hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
  1133. hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
  1134. }
  1135. static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
  1136. struct sk_buff *skb)
  1137. {
  1138. struct hci_cp_le_add_to_resolv_list *sent;
  1139. __u8 status = *((__u8 *) skb->data);
  1140. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1141. if (status)
  1142. return;
  1143. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
  1144. if (!sent)
  1145. return;
  1146. hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
  1147. sent->bdaddr_type, sent->peer_irk,
  1148. sent->local_irk);
  1149. }
  1150. static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
  1151. struct sk_buff *skb)
  1152. {
  1153. struct hci_cp_le_del_from_resolv_list *sent;
  1154. __u8 status = *((__u8 *) skb->data);
  1155. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1156. if (status)
  1157. return;
  1158. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
  1159. if (!sent)
  1160. return;
  1161. hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
  1162. sent->bdaddr_type);
  1163. }
  1164. static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
  1165. struct sk_buff *skb)
  1166. {
  1167. __u8 status = *((__u8 *) skb->data);
  1168. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1169. if (status)
  1170. return;
  1171. hci_bdaddr_list_clear(&hdev->le_resolv_list);
  1172. }
  1173. static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
  1174. struct sk_buff *skb)
  1175. {
  1176. struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
  1177. BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
  1178. if (rp->status)
  1179. return;
  1180. hdev->le_resolv_list_size = rp->size;
  1181. }
  1182. static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
  1183. struct sk_buff *skb)
  1184. {
  1185. __u8 *sent, status = *((__u8 *) skb->data);
  1186. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1187. if (status)
  1188. return;
  1189. sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
  1190. if (!sent)
  1191. return;
  1192. hci_dev_lock(hdev);
  1193. if (*sent)
  1194. hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
  1195. else
  1196. hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
  1197. hci_dev_unlock(hdev);
  1198. }
  1199. static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
  1200. struct sk_buff *skb)
  1201. {
  1202. struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
  1203. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1204. if (rp->status)
  1205. return;
  1206. hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
  1207. hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
  1208. hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
  1209. hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
  1210. }
  1211. static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
  1212. struct sk_buff *skb)
  1213. {
  1214. struct hci_cp_write_le_host_supported *sent;
  1215. __u8 status = *((__u8 *) skb->data);
  1216. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1217. if (status)
  1218. return;
  1219. sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
  1220. if (!sent)
  1221. return;
  1222. hci_dev_lock(hdev);
  1223. if (sent->le) {
  1224. hdev->features[1][0] |= LMP_HOST_LE;
  1225. hci_dev_set_flag(hdev, HCI_LE_ENABLED);
  1226. } else {
  1227. hdev->features[1][0] &= ~LMP_HOST_LE;
  1228. hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
  1229. hci_dev_clear_flag(hdev, HCI_ADVERTISING);
  1230. }
  1231. if (sent->simul)
  1232. hdev->features[1][0] |= LMP_HOST_LE_BREDR;
  1233. else
  1234. hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
  1235. hci_dev_unlock(hdev);
  1236. }
  1237. static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
  1238. {
  1239. struct hci_cp_le_set_adv_param *cp;
  1240. u8 status = *((u8 *) skb->data);
  1241. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1242. if (status)
  1243. return;
  1244. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
  1245. if (!cp)
  1246. return;
  1247. hci_dev_lock(hdev);
  1248. hdev->adv_addr_type = cp->own_address_type;
  1249. hci_dev_unlock(hdev);
  1250. }
  1251. static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
  1252. {
  1253. struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
  1254. struct hci_cp_le_set_ext_adv_params *cp;
  1255. struct adv_info *adv_instance;
  1256. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1257. if (rp->status)
  1258. return;
  1259. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
  1260. if (!cp)
  1261. return;
  1262. hci_dev_lock(hdev);
  1263. hdev->adv_addr_type = cp->own_addr_type;
  1264. if (!hdev->cur_adv_instance) {
  1265. /* Store in hdev for instance 0 */
  1266. hdev->adv_tx_power = rp->tx_power;
  1267. } else {
  1268. adv_instance = hci_find_adv_instance(hdev,
  1269. hdev->cur_adv_instance);
  1270. if (adv_instance)
  1271. adv_instance->tx_power = rp->tx_power;
  1272. }
  1273. /* Update adv data as tx power is known now */
  1274. hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
  1275. hci_dev_unlock(hdev);
  1276. }
  1277. static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
  1278. {
  1279. struct hci_rp_read_rssi *rp = (void *) skb->data;
  1280. struct hci_conn *conn;
  1281. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1282. if (rp->status)
  1283. return;
  1284. hci_dev_lock(hdev);
  1285. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  1286. if (conn)
  1287. conn->rssi = rp->rssi;
  1288. hci_dev_unlock(hdev);
  1289. }
  1290. static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
  1291. {
  1292. struct hci_cp_read_tx_power *sent;
  1293. struct hci_rp_read_tx_power *rp = (void *) skb->data;
  1294. struct hci_conn *conn;
  1295. BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  1296. if (rp->status)
  1297. return;
  1298. sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
  1299. if (!sent)
  1300. return;
  1301. hci_dev_lock(hdev);
  1302. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  1303. if (!conn)
  1304. goto unlock;
  1305. switch (sent->type) {
  1306. case 0x00:
  1307. conn->tx_power = rp->tx_power;
  1308. break;
  1309. case 0x01:
  1310. conn->max_tx_power = rp->tx_power;
  1311. break;
  1312. }
  1313. unlock:
  1314. hci_dev_unlock(hdev);
  1315. }
  1316. static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
  1317. {
  1318. u8 status = *((u8 *) skb->data);
  1319. u8 *mode;
  1320. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1321. if (status)
  1322. return;
  1323. mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
  1324. if (mode)
  1325. hdev->ssp_debug_mode = *mode;
  1326. }
  1327. static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
  1328. {
  1329. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1330. if (status) {
  1331. hci_conn_check_pending(hdev);
  1332. return;
  1333. }
  1334. set_bit(HCI_INQUIRY, &hdev->flags);
  1335. }
  1336. static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
  1337. {
  1338. struct hci_cp_create_conn *cp;
  1339. struct hci_conn *conn;
  1340. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1341. cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
  1342. if (!cp)
  1343. return;
  1344. hci_dev_lock(hdev);
  1345. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
  1346. BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
  1347. if (status) {
  1348. if (conn && conn->state == BT_CONNECT) {
  1349. if (status != 0x0c || conn->attempt > 2) {
  1350. conn->state = BT_CLOSED;
  1351. hci_connect_cfm(conn, status);
  1352. hci_conn_del(conn);
  1353. } else
  1354. conn->state = BT_CONNECT2;
  1355. }
  1356. } else {
  1357. if (!conn) {
  1358. conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
  1359. HCI_ROLE_MASTER);
  1360. if (!conn)
  1361. bt_dev_err(hdev, "no memory for new connection");
  1362. }
  1363. }
  1364. hci_dev_unlock(hdev);
  1365. }
  1366. static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
  1367. {
  1368. struct hci_cp_add_sco *cp;
  1369. struct hci_conn *acl, *sco;
  1370. __u16 handle;
  1371. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1372. if (!status)
  1373. return;
  1374. cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
  1375. if (!cp)
  1376. return;
  1377. handle = __le16_to_cpu(cp->handle);
  1378. BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
  1379. hci_dev_lock(hdev);
  1380. acl = hci_conn_hash_lookup_handle(hdev, handle);
  1381. if (acl) {
  1382. sco = acl->link;
  1383. if (sco) {
  1384. sco->state = BT_CLOSED;
  1385. hci_connect_cfm(sco, status);
  1386. hci_conn_del(sco);
  1387. }
  1388. }
  1389. hci_dev_unlock(hdev);
  1390. }
  1391. static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
  1392. {
  1393. struct hci_cp_auth_requested *cp;
  1394. struct hci_conn *conn;
  1395. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1396. if (!status)
  1397. return;
  1398. cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
  1399. if (!cp)
  1400. return;
  1401. hci_dev_lock(hdev);
  1402. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1403. if (conn) {
  1404. if (conn->state == BT_CONFIG) {
  1405. hci_connect_cfm(conn, status);
  1406. hci_conn_drop(conn);
  1407. }
  1408. }
  1409. hci_dev_unlock(hdev);
  1410. }
  1411. static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
  1412. {
  1413. struct hci_cp_set_conn_encrypt *cp;
  1414. struct hci_conn *conn;
  1415. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1416. if (!status)
  1417. return;
  1418. cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
  1419. if (!cp)
  1420. return;
  1421. hci_dev_lock(hdev);
  1422. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1423. if (conn) {
  1424. if (conn->state == BT_CONFIG) {
  1425. hci_connect_cfm(conn, status);
  1426. hci_conn_drop(conn);
  1427. }
  1428. }
  1429. hci_dev_unlock(hdev);
  1430. }
  1431. static int hci_outgoing_auth_needed(struct hci_dev *hdev,
  1432. struct hci_conn *conn)
  1433. {
  1434. if (conn->state != BT_CONFIG || !conn->out)
  1435. return 0;
  1436. if (conn->pending_sec_level == BT_SECURITY_SDP)
  1437. return 0;
  1438. /* Only request authentication for SSP connections or non-SSP
  1439. * devices with sec_level MEDIUM or HIGH or if MITM protection
  1440. * is requested.
  1441. */
  1442. if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
  1443. conn->pending_sec_level != BT_SECURITY_FIPS &&
  1444. conn->pending_sec_level != BT_SECURITY_HIGH &&
  1445. conn->pending_sec_level != BT_SECURITY_MEDIUM)
  1446. return 0;
  1447. return 1;
  1448. }
  1449. static int hci_resolve_name(struct hci_dev *hdev,
  1450. struct inquiry_entry *e)
  1451. {
  1452. struct hci_cp_remote_name_req cp;
  1453. memset(&cp, 0, sizeof(cp));
  1454. bacpy(&cp.bdaddr, &e->data.bdaddr);
  1455. cp.pscan_rep_mode = e->data.pscan_rep_mode;
  1456. cp.pscan_mode = e->data.pscan_mode;
  1457. cp.clock_offset = e->data.clock_offset;
  1458. return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
  1459. }
  1460. static bool hci_resolve_next_name(struct hci_dev *hdev)
  1461. {
  1462. struct discovery_state *discov = &hdev->discovery;
  1463. struct inquiry_entry *e;
  1464. if (list_empty(&discov->resolve))
  1465. return false;
  1466. e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
  1467. if (!e)
  1468. return false;
  1469. if (hci_resolve_name(hdev, e) == 0) {
  1470. e->name_state = NAME_PENDING;
  1471. return true;
  1472. }
  1473. return false;
  1474. }
  1475. static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
  1476. bdaddr_t *bdaddr, u8 *name, u8 name_len)
  1477. {
  1478. struct discovery_state *discov = &hdev->discovery;
  1479. struct inquiry_entry *e;
  1480. /* Update the mgmt connected state if necessary. Be careful with
  1481. * conn objects that exist but are not (yet) connected however.
  1482. * Only those in BT_CONFIG or BT_CONNECTED states can be
  1483. * considered connected.
  1484. */
  1485. if (conn &&
  1486. (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
  1487. !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
  1488. mgmt_device_connected(hdev, conn, 0, name, name_len);
  1489. if (discov->state == DISCOVERY_STOPPED)
  1490. return;
  1491. if (discov->state == DISCOVERY_STOPPING)
  1492. goto discov_complete;
  1493. if (discov->state != DISCOVERY_RESOLVING)
  1494. return;
  1495. e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
  1496. /* If the device was not found in a list of found devices names of which
  1497. * are pending. there is no need to continue resolving a next name as it
  1498. * will be done upon receiving another Remote Name Request Complete
  1499. * Event */
  1500. if (!e)
  1501. return;
  1502. list_del(&e->list);
  1503. if (name) {
  1504. e->name_state = NAME_KNOWN;
  1505. mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
  1506. e->data.rssi, name, name_len);
  1507. } else {
  1508. e->name_state = NAME_NOT_KNOWN;
  1509. }
  1510. if (hci_resolve_next_name(hdev))
  1511. return;
  1512. discov_complete:
  1513. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  1514. }
  1515. static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
  1516. {
  1517. struct hci_cp_remote_name_req *cp;
  1518. struct hci_conn *conn;
  1519. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1520. /* If successful wait for the name req complete event before
  1521. * checking for the need to do authentication */
  1522. if (!status)
  1523. return;
  1524. cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
  1525. if (!cp)
  1526. return;
  1527. hci_dev_lock(hdev);
  1528. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
  1529. if (hci_dev_test_flag(hdev, HCI_MGMT))
  1530. hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
  1531. if (!conn)
  1532. goto unlock;
  1533. if (!hci_outgoing_auth_needed(hdev, conn))
  1534. goto unlock;
  1535. if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
  1536. struct hci_cp_auth_requested auth_cp;
  1537. set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
  1538. auth_cp.handle = __cpu_to_le16(conn->handle);
  1539. hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
  1540. sizeof(auth_cp), &auth_cp);
  1541. }
  1542. unlock:
  1543. hci_dev_unlock(hdev);
  1544. }
  1545. static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
  1546. {
  1547. struct hci_cp_read_remote_features *cp;
  1548. struct hci_conn *conn;
  1549. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1550. if (!status)
  1551. return;
  1552. cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
  1553. if (!cp)
  1554. return;
  1555. hci_dev_lock(hdev);
  1556. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1557. if (conn) {
  1558. if (conn->state == BT_CONFIG) {
  1559. hci_connect_cfm(conn, status);
  1560. hci_conn_drop(conn);
  1561. }
  1562. }
  1563. hci_dev_unlock(hdev);
  1564. }
  1565. static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
  1566. {
  1567. struct hci_cp_read_remote_ext_features *cp;
  1568. struct hci_conn *conn;
  1569. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1570. if (!status)
  1571. return;
  1572. cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
  1573. if (!cp)
  1574. return;
  1575. hci_dev_lock(hdev);
  1576. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1577. if (conn) {
  1578. if (conn->state == BT_CONFIG) {
  1579. hci_connect_cfm(conn, status);
  1580. hci_conn_drop(conn);
  1581. }
  1582. }
  1583. hci_dev_unlock(hdev);
  1584. }
  1585. static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
  1586. {
  1587. struct hci_cp_setup_sync_conn *cp;
  1588. struct hci_conn *acl, *sco;
  1589. __u16 handle;
  1590. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1591. if (!status)
  1592. return;
  1593. cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
  1594. if (!cp)
  1595. return;
  1596. handle = __le16_to_cpu(cp->handle);
  1597. BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
  1598. hci_dev_lock(hdev);
  1599. acl = hci_conn_hash_lookup_handle(hdev, handle);
  1600. if (acl) {
  1601. sco = acl->link;
  1602. if (sco) {
  1603. sco->state = BT_CLOSED;
  1604. hci_connect_cfm(sco, status);
  1605. hci_conn_del(sco);
  1606. }
  1607. }
  1608. hci_dev_unlock(hdev);
  1609. }
  1610. static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
  1611. {
  1612. struct hci_cp_sniff_mode *cp;
  1613. struct hci_conn *conn;
  1614. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1615. if (!status)
  1616. return;
  1617. cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
  1618. if (!cp)
  1619. return;
  1620. hci_dev_lock(hdev);
  1621. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1622. if (conn) {
  1623. clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
  1624. if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
  1625. hci_sco_setup(conn, status);
  1626. }
  1627. hci_dev_unlock(hdev);
  1628. }
  1629. static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
  1630. {
  1631. struct hci_cp_exit_sniff_mode *cp;
  1632. struct hci_conn *conn;
  1633. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1634. if (!status)
  1635. return;
  1636. cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
  1637. if (!cp)
  1638. return;
  1639. hci_dev_lock(hdev);
  1640. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1641. if (conn) {
  1642. clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
  1643. if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
  1644. hci_sco_setup(conn, status);
  1645. }
  1646. hci_dev_unlock(hdev);
  1647. }
  1648. static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
  1649. {
  1650. struct hci_cp_disconnect *cp;
  1651. struct hci_conn *conn;
  1652. if (!status)
  1653. return;
  1654. cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
  1655. if (!cp)
  1656. return;
  1657. hci_dev_lock(hdev);
  1658. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1659. if (conn) {
  1660. u8 type = conn->type;
  1661. mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
  1662. conn->dst_type, status);
  1663. /* If the disconnection failed for any reason, the upper layer
  1664. * does not retry to disconnect in current implementation.
  1665. * Hence, we need to do some basic cleanup here and re-enable
  1666. * advertising if necessary.
  1667. */
  1668. hci_conn_del(conn);
  1669. if (type == LE_LINK)
  1670. hci_req_reenable_advertising(hdev);
  1671. }
  1672. hci_dev_unlock(hdev);
  1673. }
  1674. static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
  1675. u8 peer_addr_type, u8 own_address_type,
  1676. u8 filter_policy)
  1677. {
  1678. struct hci_conn *conn;
  1679. conn = hci_conn_hash_lookup_le(hdev, peer_addr,
  1680. peer_addr_type);
  1681. if (!conn)
  1682. return;
  1683. /* When using controller based address resolution, then the new
  1684. * address types 0x02 and 0x03 are used. These types need to be
  1685. * converted back into either public address or random address type
  1686. */
  1687. if (use_ll_privacy(hdev) &&
  1688. hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
  1689. switch (own_address_type) {
  1690. case ADDR_LE_DEV_PUBLIC_RESOLVED:
  1691. own_address_type = ADDR_LE_DEV_PUBLIC;
  1692. break;
  1693. case ADDR_LE_DEV_RANDOM_RESOLVED:
  1694. own_address_type = ADDR_LE_DEV_RANDOM;
  1695. break;
  1696. }
  1697. }
  1698. /* Store the initiator and responder address information which
  1699. * is needed for SMP. These values will not change during the
  1700. * lifetime of the connection.
  1701. */
  1702. conn->init_addr_type = own_address_type;
  1703. if (own_address_type == ADDR_LE_DEV_RANDOM)
  1704. bacpy(&conn->init_addr, &hdev->random_addr);
  1705. else
  1706. bacpy(&conn->init_addr, &hdev->bdaddr);
  1707. conn->resp_addr_type = peer_addr_type;
  1708. bacpy(&conn->resp_addr, peer_addr);
  1709. /* We don't want the connection attempt to stick around
  1710. * indefinitely since LE doesn't have a page timeout concept
  1711. * like BR/EDR. Set a timer for any connection that doesn't use
  1712. * the white list for connecting.
  1713. */
  1714. if (filter_policy == HCI_LE_USE_PEER_ADDR)
  1715. queue_delayed_work(conn->hdev->workqueue,
  1716. &conn->le_conn_timeout,
  1717. conn->conn_timeout);
  1718. }
  1719. static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
  1720. {
  1721. struct hci_cp_le_create_conn *cp;
  1722. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1723. /* All connection failure handling is taken care of by the
  1724. * hci_le_conn_failed function which is triggered by the HCI
  1725. * request completion callbacks used for connecting.
  1726. */
  1727. if (status)
  1728. return;
  1729. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
  1730. if (!cp)
  1731. return;
  1732. hci_dev_lock(hdev);
  1733. cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
  1734. cp->own_address_type, cp->filter_policy);
  1735. hci_dev_unlock(hdev);
  1736. }
  1737. static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
  1738. {
  1739. struct hci_cp_le_ext_create_conn *cp;
  1740. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1741. /* All connection failure handling is taken care of by the
  1742. * hci_le_conn_failed function which is triggered by the HCI
  1743. * request completion callbacks used for connecting.
  1744. */
  1745. if (status)
  1746. return;
  1747. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
  1748. if (!cp)
  1749. return;
  1750. hci_dev_lock(hdev);
  1751. cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
  1752. cp->own_addr_type, cp->filter_policy);
  1753. hci_dev_unlock(hdev);
  1754. }
  1755. static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
  1756. {
  1757. struct hci_cp_le_read_remote_features *cp;
  1758. struct hci_conn *conn;
  1759. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1760. if (!status)
  1761. return;
  1762. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
  1763. if (!cp)
  1764. return;
  1765. hci_dev_lock(hdev);
  1766. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1767. if (conn) {
  1768. if (conn->state == BT_CONFIG) {
  1769. hci_connect_cfm(conn, status);
  1770. hci_conn_drop(conn);
  1771. }
  1772. }
  1773. hci_dev_unlock(hdev);
  1774. }
  1775. static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
  1776. {
  1777. struct hci_cp_le_start_enc *cp;
  1778. struct hci_conn *conn;
  1779. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1780. if (!status)
  1781. return;
  1782. hci_dev_lock(hdev);
  1783. cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
  1784. if (!cp)
  1785. goto unlock;
  1786. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
  1787. if (!conn)
  1788. goto unlock;
  1789. if (conn->state != BT_CONNECTED)
  1790. goto unlock;
  1791. hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
  1792. hci_conn_drop(conn);
  1793. unlock:
  1794. hci_dev_unlock(hdev);
  1795. }
  1796. static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
  1797. {
  1798. struct hci_cp_switch_role *cp;
  1799. struct hci_conn *conn;
  1800. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1801. if (!status)
  1802. return;
  1803. cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
  1804. if (!cp)
  1805. return;
  1806. hci_dev_lock(hdev);
  1807. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
  1808. if (conn)
  1809. clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
  1810. hci_dev_unlock(hdev);
  1811. }
  1812. static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  1813. {
  1814. __u8 status = *((__u8 *) skb->data);
  1815. struct discovery_state *discov = &hdev->discovery;
  1816. struct inquiry_entry *e;
  1817. BT_DBG("%s status 0x%2.2x", hdev->name, status);
  1818. hci_conn_check_pending(hdev);
  1819. if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
  1820. return;
  1821. smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  1822. wake_up_bit(&hdev->flags, HCI_INQUIRY);
  1823. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  1824. return;
  1825. hci_dev_lock(hdev);
  1826. if (discov->state != DISCOVERY_FINDING)
  1827. goto unlock;
  1828. if (list_empty(&discov->resolve)) {
  1829. /* When BR/EDR inquiry is active and no LE scanning is in
  1830. * progress, then change discovery state to indicate completion.
  1831. *
  1832. * When running LE scanning and BR/EDR inquiry simultaneously
  1833. * and the LE scan already finished, then change the discovery
  1834. * state to indicate completion.
  1835. */
  1836. if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  1837. !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
  1838. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  1839. goto unlock;
  1840. }
  1841. e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
  1842. if (e && hci_resolve_name(hdev, e) == 0) {
  1843. e->name_state = NAME_PENDING;
  1844. hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
  1845. } else {
  1846. /* When BR/EDR inquiry is active and no LE scanning is in
  1847. * progress, then change discovery state to indicate completion.
  1848. *
  1849. * When running LE scanning and BR/EDR inquiry simultaneously
  1850. * and the LE scan already finished, then change the discovery
  1851. * state to indicate completion.
  1852. */
  1853. if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  1854. !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
  1855. hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  1856. }
  1857. unlock:
  1858. hci_dev_unlock(hdev);
  1859. }
  1860. static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
  1861. {
  1862. struct inquiry_data data;
  1863. struct inquiry_info *info = (void *) (skb->data + 1);
  1864. int num_rsp = *((__u8 *) skb->data);
  1865. BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
  1866. if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
  1867. return;
  1868. if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
  1869. return;
  1870. hci_dev_lock(hdev);
  1871. for (; num_rsp; num_rsp--, info++) {
  1872. u32 flags;
  1873. bacpy(&data.bdaddr, &info->bdaddr);
  1874. data.pscan_rep_mode = info->pscan_rep_mode;
  1875. data.pscan_period_mode = info->pscan_period_mode;
  1876. data.pscan_mode = info->pscan_mode;
  1877. memcpy(data.dev_class, info->dev_class, 3);
  1878. data.clock_offset = info->clock_offset;
  1879. data.rssi = HCI_RSSI_INVALID;
  1880. data.ssp_mode = 0x00;
  1881. flags = hci_inquiry_cache_update(hdev, &data, false);
  1882. mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
  1883. info->dev_class, HCI_RSSI_INVALID,
  1884. flags, NULL, 0, NULL, 0);
  1885. }
  1886. hci_dev_unlock(hdev);
  1887. }
  1888. static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  1889. {
  1890. struct hci_ev_conn_complete *ev = (void *) skb->data;
  1891. struct hci_conn *conn;
  1892. BT_DBG("%s", hdev->name);
  1893. hci_dev_lock(hdev);
  1894. conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
  1895. if (!conn) {
  1896. /* Connection may not exist if auto-connected. Check the bredr
  1897. * allowlist to see if this device is allowed to auto connect.
  1898. * If link is an ACL type, create a connection class
  1899. * automatically.
  1900. *
  1901. * Auto-connect will only occur if the event filter is
  1902. * programmed with a given address. Right now, event filter is
  1903. * only used during suspend.
  1904. */
  1905. if (ev->link_type == ACL_LINK &&
  1906. hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
  1907. &ev->bdaddr,
  1908. BDADDR_BREDR)) {
  1909. conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
  1910. HCI_ROLE_SLAVE);
  1911. if (!conn) {
  1912. bt_dev_err(hdev, "no memory for new conn");
  1913. goto unlock;
  1914. }
  1915. } else {
  1916. if (ev->link_type != SCO_LINK)
  1917. goto unlock;
  1918. conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
  1919. &ev->bdaddr);
  1920. if (!conn)
  1921. goto unlock;
  1922. conn->type = SCO_LINK;
  1923. }
  1924. }
  1925. if (!ev->status) {
  1926. conn->handle = __le16_to_cpu(ev->handle);
  1927. if (conn->type == ACL_LINK) {
  1928. conn->state = BT_CONFIG;
  1929. hci_conn_hold(conn);
  1930. if (!conn->out && !hci_conn_ssp_enabled(conn) &&
  1931. !hci_find_link_key(hdev, &ev->bdaddr))
  1932. conn->disc_timeout = HCI_PAIRING_TIMEOUT;
  1933. else
  1934. conn->disc_timeout = HCI_DISCONN_TIMEOUT;
  1935. } else
  1936. conn->state = BT_CONNECTED;
  1937. hci_debugfs_create_conn(conn);
  1938. hci_conn_add_sysfs(conn);
  1939. if (test_bit(HCI_AUTH, &hdev->flags))
  1940. set_bit(HCI_CONN_AUTH, &conn->flags);
  1941. if (test_bit(HCI_ENCRYPT, &hdev->flags))
  1942. set_bit(HCI_CONN_ENCRYPT, &conn->flags);
  1943. /* Get remote features */
  1944. if (conn->type == ACL_LINK) {
  1945. struct hci_cp_read_remote_features cp;
  1946. cp.handle = ev->handle;
  1947. hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
  1948. sizeof(cp), &cp);
  1949. hci_req_update_scan(hdev);
  1950. }
  1951. /* Set packet type for incoming connection */
  1952. if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
  1953. struct hci_cp_change_conn_ptype cp;
  1954. cp.handle = ev->handle;
  1955. cp.pkt_type = cpu_to_le16(conn->pkt_type);
  1956. hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
  1957. &cp);
  1958. }
  1959. } else {
  1960. conn->state = BT_CLOSED;
  1961. if (conn->type == ACL_LINK)
  1962. mgmt_connect_failed(hdev, &conn->dst, conn->type,
  1963. conn->dst_type, ev->status);
  1964. }
  1965. if (conn->type == ACL_LINK)
  1966. hci_sco_setup(conn, ev->status);
  1967. if (ev->status) {
  1968. hci_connect_cfm(conn, ev->status);
  1969. hci_conn_del(conn);
  1970. } else if (ev->link_type == SCO_LINK) {
  1971. switch (conn->setting & SCO_AIRMODE_MASK) {
  1972. case SCO_AIRMODE_CVSD:
  1973. if (hdev->notify)
  1974. hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
  1975. break;
  1976. }
  1977. hci_connect_cfm(conn, ev->status);
  1978. }
  1979. unlock:
  1980. hci_dev_unlock(hdev);
  1981. hci_conn_check_pending(hdev);
  1982. }
  1983. static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
  1984. {
  1985. struct hci_cp_reject_conn_req cp;
  1986. bacpy(&cp.bdaddr, bdaddr);
  1987. cp.reason = HCI_ERROR_REJ_BAD_ADDR;
  1988. hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
  1989. }
  1990. static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  1991. {
  1992. struct hci_ev_conn_request *ev = (void *) skb->data;
  1993. int mask = hdev->link_mode;
  1994. struct inquiry_entry *ie;
  1995. struct hci_conn *conn;
  1996. __u8 flags = 0;
  1997. BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
  1998. ev->link_type);
  1999. mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
  2000. &flags);
  2001. if (!(mask & HCI_LM_ACCEPT)) {
  2002. hci_reject_conn(hdev, &ev->bdaddr);
  2003. return;
  2004. }
  2005. if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
  2006. BDADDR_BREDR)) {
  2007. hci_reject_conn(hdev, &ev->bdaddr);
  2008. return;
  2009. }
  2010. /* Require HCI_CONNECTABLE or a whitelist entry to accept the
  2011. * connection. These features are only touched through mgmt so
  2012. * only do the checks if HCI_MGMT is set.
  2013. */
  2014. if (hci_dev_test_flag(hdev, HCI_MGMT) &&
  2015. !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
  2016. !hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, &ev->bdaddr,
  2017. BDADDR_BREDR)) {
  2018. hci_reject_conn(hdev, &ev->bdaddr);
  2019. return;
  2020. }
  2021. /* Connection accepted */
  2022. hci_dev_lock(hdev);
  2023. ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
  2024. if (ie)
  2025. memcpy(ie->data.dev_class, ev->dev_class, 3);
  2026. conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
  2027. &ev->bdaddr);
  2028. if (!conn) {
  2029. conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
  2030. HCI_ROLE_SLAVE);
  2031. if (!conn) {
  2032. bt_dev_err(hdev, "no memory for new connection");
  2033. hci_dev_unlock(hdev);
  2034. return;
  2035. }
  2036. }
  2037. memcpy(conn->dev_class, ev->dev_class, 3);
  2038. hci_dev_unlock(hdev);
  2039. if (ev->link_type == ACL_LINK ||
  2040. (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
  2041. struct hci_cp_accept_conn_req cp;
  2042. conn->state = BT_CONNECT;
  2043. bacpy(&cp.bdaddr, &ev->bdaddr);
  2044. if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
  2045. cp.role = 0x00; /* Become master */
  2046. else
  2047. cp.role = 0x01; /* Remain slave */
  2048. hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
  2049. } else if (!(flags & HCI_PROTO_DEFER)) {
  2050. struct hci_cp_accept_sync_conn_req cp;
  2051. conn->state = BT_CONNECT;
  2052. bacpy(&cp.bdaddr, &ev->bdaddr);
  2053. cp.pkt_type = cpu_to_le16(conn->pkt_type);
  2054. cp.tx_bandwidth = cpu_to_le32(0x00001f40);
  2055. cp.rx_bandwidth = cpu_to_le32(0x00001f40);
  2056. cp.max_latency = cpu_to_le16(0xffff);
  2057. cp.content_format = cpu_to_le16(hdev->voice_setting);
  2058. cp.retrans_effort = 0xff;
  2059. hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
  2060. &cp);
  2061. } else {
  2062. conn->state = BT_CONNECT2;
  2063. hci_connect_cfm(conn, 0);
  2064. }
  2065. }
  2066. static u8 hci_to_mgmt_reason(u8 err)
  2067. {
  2068. switch (err) {
  2069. case HCI_ERROR_CONNECTION_TIMEOUT:
  2070. return MGMT_DEV_DISCONN_TIMEOUT;
  2071. case HCI_ERROR_REMOTE_USER_TERM:
  2072. case HCI_ERROR_REMOTE_LOW_RESOURCES:
  2073. case HCI_ERROR_REMOTE_POWER_OFF:
  2074. return MGMT_DEV_DISCONN_REMOTE;
  2075. case HCI_ERROR_LOCAL_HOST_TERM:
  2076. return MGMT_DEV_DISCONN_LOCAL_HOST;
  2077. default:
  2078. return MGMT_DEV_DISCONN_UNKNOWN;
  2079. }
  2080. }
  2081. static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2082. {
  2083. struct hci_ev_disconn_complete *ev = (void *) skb->data;
  2084. u8 reason;
  2085. struct hci_conn_params *params;
  2086. struct hci_conn *conn;
  2087. bool mgmt_connected;
  2088. u8 type;
  2089. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2090. hci_dev_lock(hdev);
  2091. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2092. if (!conn)
  2093. goto unlock;
  2094. if (ev->status) {
  2095. mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
  2096. conn->dst_type, ev->status);
  2097. goto unlock;
  2098. }
  2099. conn->state = BT_CLOSED;
  2100. mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
  2101. if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
  2102. reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
  2103. else
  2104. reason = hci_to_mgmt_reason(ev->reason);
  2105. mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
  2106. reason, mgmt_connected);
  2107. if (conn->type == ACL_LINK) {
  2108. if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
  2109. hci_remove_link_key(hdev, &conn->dst);
  2110. hci_req_update_scan(hdev);
  2111. }
  2112. params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
  2113. if (params) {
  2114. switch (params->auto_connect) {
  2115. case HCI_AUTO_CONN_LINK_LOSS:
  2116. if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
  2117. break;
  2118. fallthrough;
  2119. case HCI_AUTO_CONN_DIRECT:
  2120. case HCI_AUTO_CONN_ALWAYS:
  2121. list_del_init(&params->action);
  2122. list_add(&params->action, &hdev->pend_le_conns);
  2123. hci_update_background_scan(hdev);
  2124. break;
  2125. default:
  2126. break;
  2127. }
  2128. }
  2129. type = conn->type;
  2130. hci_disconn_cfm(conn, ev->reason);
  2131. hci_conn_del(conn);
  2132. /* The suspend notifier is waiting for all devices to disconnect so
  2133. * clear the bit from pending tasks and inform the wait queue.
  2134. */
  2135. if (list_empty(&hdev->conn_hash.list) &&
  2136. test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
  2137. wake_up(&hdev->suspend_wait_q);
  2138. }
  2139. /* Re-enable advertising if necessary, since it might
  2140. * have been disabled by the connection. From the
  2141. * HCI_LE_Set_Advertise_Enable command description in
  2142. * the core specification (v4.0):
  2143. * "The Controller shall continue advertising until the Host
  2144. * issues an LE_Set_Advertise_Enable command with
  2145. * Advertising_Enable set to 0x00 (Advertising is disabled)
  2146. * or until a connection is created or until the Advertising
  2147. * is timed out due to Directed Advertising."
  2148. */
  2149. if (type == LE_LINK)
  2150. hci_req_reenable_advertising(hdev);
  2151. unlock:
  2152. hci_dev_unlock(hdev);
  2153. }
  2154. static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2155. {
  2156. struct hci_ev_auth_complete *ev = (void *) skb->data;
  2157. struct hci_conn *conn;
  2158. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2159. hci_dev_lock(hdev);
  2160. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2161. if (!conn)
  2162. goto unlock;
  2163. if (!ev->status) {
  2164. clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
  2165. if (!hci_conn_ssp_enabled(conn) &&
  2166. test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
  2167. bt_dev_info(hdev, "re-auth of legacy device is not possible.");
  2168. } else {
  2169. set_bit(HCI_CONN_AUTH, &conn->flags);
  2170. conn->sec_level = conn->pending_sec_level;
  2171. }
  2172. } else {
  2173. if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
  2174. set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
  2175. mgmt_auth_failed(conn, ev->status);
  2176. }
  2177. clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
  2178. clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
  2179. if (conn->state == BT_CONFIG) {
  2180. if (!ev->status && hci_conn_ssp_enabled(conn)) {
  2181. struct hci_cp_set_conn_encrypt cp;
  2182. cp.handle = ev->handle;
  2183. cp.encrypt = 0x01;
  2184. hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
  2185. &cp);
  2186. } else {
  2187. conn->state = BT_CONNECTED;
  2188. hci_connect_cfm(conn, ev->status);
  2189. hci_conn_drop(conn);
  2190. }
  2191. } else {
  2192. hci_auth_cfm(conn, ev->status);
  2193. hci_conn_hold(conn);
  2194. conn->disc_timeout = HCI_DISCONN_TIMEOUT;
  2195. hci_conn_drop(conn);
  2196. }
  2197. if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
  2198. if (!ev->status) {
  2199. struct hci_cp_set_conn_encrypt cp;
  2200. cp.handle = ev->handle;
  2201. cp.encrypt = 0x01;
  2202. hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
  2203. &cp);
  2204. } else {
  2205. clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
  2206. hci_encrypt_cfm(conn, ev->status);
  2207. }
  2208. }
  2209. unlock:
  2210. hci_dev_unlock(hdev);
  2211. }
  2212. static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2213. {
  2214. struct hci_ev_remote_name *ev = (void *) skb->data;
  2215. struct hci_conn *conn;
  2216. BT_DBG("%s", hdev->name);
  2217. hci_conn_check_pending(hdev);
  2218. hci_dev_lock(hdev);
  2219. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  2220. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  2221. goto check_auth;
  2222. if (ev->status == 0)
  2223. hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
  2224. strnlen(ev->name, HCI_MAX_NAME_LENGTH));
  2225. else
  2226. hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
  2227. check_auth:
  2228. if (!conn)
  2229. goto unlock;
  2230. if (!hci_outgoing_auth_needed(hdev, conn))
  2231. goto unlock;
  2232. if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
  2233. struct hci_cp_auth_requested cp;
  2234. set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
  2235. cp.handle = __cpu_to_le16(conn->handle);
  2236. hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
  2237. }
  2238. unlock:
  2239. hci_dev_unlock(hdev);
  2240. }
  2241. static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
  2242. u16 opcode, struct sk_buff *skb)
  2243. {
  2244. const struct hci_rp_read_enc_key_size *rp;
  2245. struct hci_conn *conn;
  2246. u16 handle;
  2247. BT_DBG("%s status 0x%02x", hdev->name, status);
  2248. if (!skb || skb->len < sizeof(*rp)) {
  2249. bt_dev_err(hdev, "invalid read key size response");
  2250. return;
  2251. }
  2252. rp = (void *)skb->data;
  2253. handle = le16_to_cpu(rp->handle);
  2254. hci_dev_lock(hdev);
  2255. conn = hci_conn_hash_lookup_handle(hdev, handle);
  2256. if (!conn)
  2257. goto unlock;
  2258. /* While unexpected, the read_enc_key_size command may fail. The most
  2259. * secure approach is to then assume the key size is 0 to force a
  2260. * disconnection.
  2261. */
  2262. if (rp->status) {
  2263. bt_dev_err(hdev, "failed to read key size for handle %u",
  2264. handle);
  2265. conn->enc_key_size = 0;
  2266. } else {
  2267. conn->enc_key_size = rp->key_size;
  2268. }
  2269. hci_encrypt_cfm(conn, 0);
  2270. unlock:
  2271. hci_dev_unlock(hdev);
  2272. }
  2273. static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2274. {
  2275. struct hci_ev_encrypt_change *ev = (void *) skb->data;
  2276. struct hci_conn *conn;
  2277. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2278. hci_dev_lock(hdev);
  2279. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2280. if (!conn)
  2281. goto unlock;
  2282. if (!ev->status) {
  2283. if (ev->encrypt) {
  2284. /* Encryption implies authentication */
  2285. set_bit(HCI_CONN_AUTH, &conn->flags);
  2286. set_bit(HCI_CONN_ENCRYPT, &conn->flags);
  2287. conn->sec_level = conn->pending_sec_level;
  2288. /* P-256 authentication key implies FIPS */
  2289. if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
  2290. set_bit(HCI_CONN_FIPS, &conn->flags);
  2291. if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
  2292. conn->type == LE_LINK)
  2293. set_bit(HCI_CONN_AES_CCM, &conn->flags);
  2294. } else {
  2295. clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
  2296. clear_bit(HCI_CONN_AES_CCM, &conn->flags);
  2297. }
  2298. }
  2299. /* We should disregard the current RPA and generate a new one
  2300. * whenever the encryption procedure fails.
  2301. */
  2302. if (ev->status && conn->type == LE_LINK) {
  2303. hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
  2304. hci_adv_instances_set_rpa_expired(hdev, true);
  2305. }
  2306. clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
  2307. /* Check link security requirements are met */
  2308. if (!hci_conn_check_link_mode(conn))
  2309. ev->status = HCI_ERROR_AUTH_FAILURE;
  2310. if (ev->status && conn->state == BT_CONNECTED) {
  2311. if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
  2312. set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
  2313. /* Notify upper layers so they can cleanup before
  2314. * disconnecting.
  2315. */
  2316. hci_encrypt_cfm(conn, ev->status);
  2317. hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
  2318. hci_conn_drop(conn);
  2319. goto unlock;
  2320. }
  2321. /* Try reading the encryption key size for encrypted ACL links */
  2322. if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
  2323. struct hci_cp_read_enc_key_size cp;
  2324. struct hci_request req;
  2325. /* Only send HCI_Read_Encryption_Key_Size if the
  2326. * controller really supports it. If it doesn't, assume
  2327. * the default size (16).
  2328. */
  2329. if (!(hdev->commands[20] & 0x10)) {
  2330. conn->enc_key_size = HCI_LINK_KEY_SIZE;
  2331. goto notify;
  2332. }
  2333. hci_req_init(&req, hdev);
  2334. cp.handle = cpu_to_le16(conn->handle);
  2335. hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
  2336. if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
  2337. bt_dev_err(hdev, "sending read key size failed");
  2338. conn->enc_key_size = HCI_LINK_KEY_SIZE;
  2339. goto notify;
  2340. }
  2341. goto unlock;
  2342. }
  2343. /* Set the default Authenticated Payload Timeout after
  2344. * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
  2345. * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
  2346. * sent when the link is active and Encryption is enabled, the conn
  2347. * type can be either LE or ACL and controller must support LMP Ping.
  2348. * Ensure for AES-CCM encryption as well.
  2349. */
  2350. if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
  2351. test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
  2352. ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
  2353. (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
  2354. struct hci_cp_write_auth_payload_to cp;
  2355. cp.handle = cpu_to_le16(conn->handle);
  2356. cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
  2357. hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
  2358. sizeof(cp), &cp);
  2359. }
  2360. notify:
  2361. hci_encrypt_cfm(conn, ev->status);
  2362. unlock:
  2363. hci_dev_unlock(hdev);
  2364. }
  2365. static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
  2366. struct sk_buff *skb)
  2367. {
  2368. struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
  2369. struct hci_conn *conn;
  2370. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2371. hci_dev_lock(hdev);
  2372. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2373. if (conn) {
  2374. if (!ev->status)
  2375. set_bit(HCI_CONN_SECURE, &conn->flags);
  2376. clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
  2377. hci_key_change_cfm(conn, ev->status);
  2378. }
  2379. hci_dev_unlock(hdev);
  2380. }
  2381. static void hci_remote_features_evt(struct hci_dev *hdev,
  2382. struct sk_buff *skb)
  2383. {
  2384. struct hci_ev_remote_features *ev = (void *) skb->data;
  2385. struct hci_conn *conn;
  2386. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2387. hci_dev_lock(hdev);
  2388. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2389. if (!conn)
  2390. goto unlock;
  2391. if (!ev->status)
  2392. memcpy(conn->features[0], ev->features, 8);
  2393. if (conn->state != BT_CONFIG)
  2394. goto unlock;
  2395. if (!ev->status && lmp_ext_feat_capable(hdev) &&
  2396. lmp_ext_feat_capable(conn)) {
  2397. struct hci_cp_read_remote_ext_features cp;
  2398. cp.handle = ev->handle;
  2399. cp.page = 0x01;
  2400. hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
  2401. sizeof(cp), &cp);
  2402. goto unlock;
  2403. }
  2404. if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
  2405. struct hci_cp_remote_name_req cp;
  2406. memset(&cp, 0, sizeof(cp));
  2407. bacpy(&cp.bdaddr, &conn->dst);
  2408. cp.pscan_rep_mode = 0x02;
  2409. hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
  2410. } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
  2411. mgmt_device_connected(hdev, conn, 0, NULL, 0);
  2412. if (!hci_outgoing_auth_needed(hdev, conn)) {
  2413. conn->state = BT_CONNECTED;
  2414. hci_connect_cfm(conn, ev->status);
  2415. hci_conn_drop(conn);
  2416. }
  2417. unlock:
  2418. hci_dev_unlock(hdev);
  2419. }
  2420. static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
  2421. u16 *opcode, u8 *status,
  2422. hci_req_complete_t *req_complete,
  2423. hci_req_complete_skb_t *req_complete_skb)
  2424. {
  2425. struct hci_ev_cmd_complete *ev = (void *) skb->data;
  2426. *opcode = __le16_to_cpu(ev->opcode);
  2427. *status = skb->data[sizeof(*ev)];
  2428. skb_pull(skb, sizeof(*ev));
  2429. switch (*opcode) {
  2430. case HCI_OP_INQUIRY_CANCEL:
  2431. hci_cc_inquiry_cancel(hdev, skb, status);
  2432. break;
  2433. case HCI_OP_PERIODIC_INQ:
  2434. hci_cc_periodic_inq(hdev, skb);
  2435. break;
  2436. case HCI_OP_EXIT_PERIODIC_INQ:
  2437. hci_cc_exit_periodic_inq(hdev, skb);
  2438. break;
  2439. case HCI_OP_REMOTE_NAME_REQ_CANCEL:
  2440. hci_cc_remote_name_req_cancel(hdev, skb);
  2441. break;
  2442. case HCI_OP_ROLE_DISCOVERY:
  2443. hci_cc_role_discovery(hdev, skb);
  2444. break;
  2445. case HCI_OP_READ_LINK_POLICY:
  2446. hci_cc_read_link_policy(hdev, skb);
  2447. break;
  2448. case HCI_OP_WRITE_LINK_POLICY:
  2449. hci_cc_write_link_policy(hdev, skb);
  2450. break;
  2451. case HCI_OP_READ_DEF_LINK_POLICY:
  2452. hci_cc_read_def_link_policy(hdev, skb);
  2453. break;
  2454. case HCI_OP_WRITE_DEF_LINK_POLICY:
  2455. hci_cc_write_def_link_policy(hdev, skb);
  2456. break;
  2457. case HCI_OP_RESET:
  2458. hci_cc_reset(hdev, skb);
  2459. break;
  2460. case HCI_OP_READ_STORED_LINK_KEY:
  2461. hci_cc_read_stored_link_key(hdev, skb);
  2462. break;
  2463. case HCI_OP_DELETE_STORED_LINK_KEY:
  2464. hci_cc_delete_stored_link_key(hdev, skb);
  2465. break;
  2466. case HCI_OP_WRITE_LOCAL_NAME:
  2467. hci_cc_write_local_name(hdev, skb);
  2468. break;
  2469. case HCI_OP_READ_LOCAL_NAME:
  2470. hci_cc_read_local_name(hdev, skb);
  2471. break;
  2472. case HCI_OP_WRITE_AUTH_ENABLE:
  2473. hci_cc_write_auth_enable(hdev, skb);
  2474. break;
  2475. case HCI_OP_WRITE_ENCRYPT_MODE:
  2476. hci_cc_write_encrypt_mode(hdev, skb);
  2477. break;
  2478. case HCI_OP_WRITE_SCAN_ENABLE:
  2479. hci_cc_write_scan_enable(hdev, skb);
  2480. break;
  2481. case HCI_OP_READ_CLASS_OF_DEV:
  2482. hci_cc_read_class_of_dev(hdev, skb);
  2483. break;
  2484. case HCI_OP_WRITE_CLASS_OF_DEV:
  2485. hci_cc_write_class_of_dev(hdev, skb);
  2486. break;
  2487. case HCI_OP_READ_VOICE_SETTING:
  2488. hci_cc_read_voice_setting(hdev, skb);
  2489. break;
  2490. case HCI_OP_WRITE_VOICE_SETTING:
  2491. hci_cc_write_voice_setting(hdev, skb);
  2492. break;
  2493. case HCI_OP_READ_NUM_SUPPORTED_IAC:
  2494. hci_cc_read_num_supported_iac(hdev, skb);
  2495. break;
  2496. case HCI_OP_WRITE_SSP_MODE:
  2497. hci_cc_write_ssp_mode(hdev, skb);
  2498. break;
  2499. case HCI_OP_WRITE_SC_SUPPORT:
  2500. hci_cc_write_sc_support(hdev, skb);
  2501. break;
  2502. case HCI_OP_READ_AUTH_PAYLOAD_TO:
  2503. hci_cc_read_auth_payload_timeout(hdev, skb);
  2504. break;
  2505. case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
  2506. hci_cc_write_auth_payload_timeout(hdev, skb);
  2507. break;
  2508. case HCI_OP_READ_LOCAL_VERSION:
  2509. hci_cc_read_local_version(hdev, skb);
  2510. break;
  2511. case HCI_OP_READ_LOCAL_COMMANDS:
  2512. hci_cc_read_local_commands(hdev, skb);
  2513. break;
  2514. case HCI_OP_READ_LOCAL_FEATURES:
  2515. hci_cc_read_local_features(hdev, skb);
  2516. break;
  2517. case HCI_OP_READ_LOCAL_EXT_FEATURES:
  2518. hci_cc_read_local_ext_features(hdev, skb);
  2519. break;
  2520. case HCI_OP_READ_BUFFER_SIZE:
  2521. hci_cc_read_buffer_size(hdev, skb);
  2522. break;
  2523. case HCI_OP_READ_BD_ADDR:
  2524. hci_cc_read_bd_addr(hdev, skb);
  2525. break;
  2526. case HCI_OP_READ_LOCAL_PAIRING_OPTS:
  2527. hci_cc_read_local_pairing_opts(hdev, skb);
  2528. break;
  2529. case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
  2530. hci_cc_read_page_scan_activity(hdev, skb);
  2531. break;
  2532. case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
  2533. hci_cc_write_page_scan_activity(hdev, skb);
  2534. break;
  2535. case HCI_OP_READ_PAGE_SCAN_TYPE:
  2536. hci_cc_read_page_scan_type(hdev, skb);
  2537. break;
  2538. case HCI_OP_WRITE_PAGE_SCAN_TYPE:
  2539. hci_cc_write_page_scan_type(hdev, skb);
  2540. break;
  2541. case HCI_OP_READ_DATA_BLOCK_SIZE:
  2542. hci_cc_read_data_block_size(hdev, skb);
  2543. break;
  2544. case HCI_OP_READ_FLOW_CONTROL_MODE:
  2545. hci_cc_read_flow_control_mode(hdev, skb);
  2546. break;
  2547. case HCI_OP_READ_LOCAL_AMP_INFO:
  2548. hci_cc_read_local_amp_info(hdev, skb);
  2549. break;
  2550. case HCI_OP_READ_CLOCK:
  2551. hci_cc_read_clock(hdev, skb);
  2552. break;
  2553. case HCI_OP_READ_INQ_RSP_TX_POWER:
  2554. hci_cc_read_inq_rsp_tx_power(hdev, skb);
  2555. break;
  2556. case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
  2557. hci_cc_read_def_err_data_reporting(hdev, skb);
  2558. break;
  2559. case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
  2560. hci_cc_write_def_err_data_reporting(hdev, skb);
  2561. break;
  2562. case HCI_OP_PIN_CODE_REPLY:
  2563. hci_cc_pin_code_reply(hdev, skb);
  2564. break;
  2565. case HCI_OP_PIN_CODE_NEG_REPLY:
  2566. hci_cc_pin_code_neg_reply(hdev, skb);
  2567. break;
  2568. case HCI_OP_READ_LOCAL_OOB_DATA:
  2569. hci_cc_read_local_oob_data(hdev, skb);
  2570. break;
  2571. case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
  2572. hci_cc_read_local_oob_ext_data(hdev, skb);
  2573. break;
  2574. case HCI_OP_LE_READ_BUFFER_SIZE:
  2575. hci_cc_le_read_buffer_size(hdev, skb);
  2576. break;
  2577. case HCI_OP_LE_READ_LOCAL_FEATURES:
  2578. hci_cc_le_read_local_features(hdev, skb);
  2579. break;
  2580. case HCI_OP_LE_READ_ADV_TX_POWER:
  2581. hci_cc_le_read_adv_tx_power(hdev, skb);
  2582. break;
  2583. case HCI_OP_USER_CONFIRM_REPLY:
  2584. hci_cc_user_confirm_reply(hdev, skb);
  2585. break;
  2586. case HCI_OP_USER_CONFIRM_NEG_REPLY:
  2587. hci_cc_user_confirm_neg_reply(hdev, skb);
  2588. break;
  2589. case HCI_OP_USER_PASSKEY_REPLY:
  2590. hci_cc_user_passkey_reply(hdev, skb);
  2591. break;
  2592. case HCI_OP_USER_PASSKEY_NEG_REPLY:
  2593. hci_cc_user_passkey_neg_reply(hdev, skb);
  2594. break;
  2595. case HCI_OP_LE_SET_RANDOM_ADDR:
  2596. hci_cc_le_set_random_addr(hdev, skb);
  2597. break;
  2598. case HCI_OP_LE_SET_ADV_ENABLE:
  2599. hci_cc_le_set_adv_enable(hdev, skb);
  2600. break;
  2601. case HCI_OP_LE_SET_SCAN_PARAM:
  2602. hci_cc_le_set_scan_param(hdev, skb);
  2603. break;
  2604. case HCI_OP_LE_SET_SCAN_ENABLE:
  2605. hci_cc_le_set_scan_enable(hdev, skb);
  2606. break;
  2607. case HCI_OP_LE_READ_WHITE_LIST_SIZE:
  2608. hci_cc_le_read_white_list_size(hdev, skb);
  2609. break;
  2610. case HCI_OP_LE_CLEAR_WHITE_LIST:
  2611. hci_cc_le_clear_white_list(hdev, skb);
  2612. break;
  2613. case HCI_OP_LE_ADD_TO_WHITE_LIST:
  2614. hci_cc_le_add_to_white_list(hdev, skb);
  2615. break;
  2616. case HCI_OP_LE_DEL_FROM_WHITE_LIST:
  2617. hci_cc_le_del_from_white_list(hdev, skb);
  2618. break;
  2619. case HCI_OP_LE_READ_SUPPORTED_STATES:
  2620. hci_cc_le_read_supported_states(hdev, skb);
  2621. break;
  2622. case HCI_OP_LE_READ_DEF_DATA_LEN:
  2623. hci_cc_le_read_def_data_len(hdev, skb);
  2624. break;
  2625. case HCI_OP_LE_WRITE_DEF_DATA_LEN:
  2626. hci_cc_le_write_def_data_len(hdev, skb);
  2627. break;
  2628. case HCI_OP_LE_ADD_TO_RESOLV_LIST:
  2629. hci_cc_le_add_to_resolv_list(hdev, skb);
  2630. break;
  2631. case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
  2632. hci_cc_le_del_from_resolv_list(hdev, skb);
  2633. break;
  2634. case HCI_OP_LE_CLEAR_RESOLV_LIST:
  2635. hci_cc_le_clear_resolv_list(hdev, skb);
  2636. break;
  2637. case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
  2638. hci_cc_le_read_resolv_list_size(hdev, skb);
  2639. break;
  2640. case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
  2641. hci_cc_le_set_addr_resolution_enable(hdev, skb);
  2642. break;
  2643. case HCI_OP_LE_READ_MAX_DATA_LEN:
  2644. hci_cc_le_read_max_data_len(hdev, skb);
  2645. break;
  2646. case HCI_OP_WRITE_LE_HOST_SUPPORTED:
  2647. hci_cc_write_le_host_supported(hdev, skb);
  2648. break;
  2649. case HCI_OP_LE_SET_ADV_PARAM:
  2650. hci_cc_set_adv_param(hdev, skb);
  2651. break;
  2652. case HCI_OP_READ_RSSI:
  2653. hci_cc_read_rssi(hdev, skb);
  2654. break;
  2655. case HCI_OP_READ_TX_POWER:
  2656. hci_cc_read_tx_power(hdev, skb);
  2657. break;
  2658. case HCI_OP_WRITE_SSP_DEBUG_MODE:
  2659. hci_cc_write_ssp_debug_mode(hdev, skb);
  2660. break;
  2661. case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
  2662. hci_cc_le_set_ext_scan_param(hdev, skb);
  2663. break;
  2664. case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
  2665. hci_cc_le_set_ext_scan_enable(hdev, skb);
  2666. break;
  2667. case HCI_OP_LE_SET_DEFAULT_PHY:
  2668. hci_cc_le_set_default_phy(hdev, skb);
  2669. break;
  2670. case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
  2671. hci_cc_le_read_num_adv_sets(hdev, skb);
  2672. break;
  2673. case HCI_OP_LE_SET_EXT_ADV_PARAMS:
  2674. hci_cc_set_ext_adv_param(hdev, skb);
  2675. break;
  2676. case HCI_OP_LE_SET_EXT_ADV_ENABLE:
  2677. hci_cc_le_set_ext_adv_enable(hdev, skb);
  2678. break;
  2679. case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
  2680. hci_cc_le_set_adv_set_random_addr(hdev, skb);
  2681. break;
  2682. default:
  2683. BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
  2684. break;
  2685. }
  2686. if (*opcode != HCI_OP_NOP)
  2687. cancel_delayed_work(&hdev->cmd_timer);
  2688. if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
  2689. atomic_set(&hdev->cmd_cnt, 1);
  2690. hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
  2691. req_complete_skb);
  2692. if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
  2693. bt_dev_err(hdev,
  2694. "unexpected event for opcode 0x%4.4x", *opcode);
  2695. return;
  2696. }
  2697. if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
  2698. queue_work(hdev->workqueue, &hdev->cmd_work);
  2699. }
  2700. static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
  2701. u16 *opcode, u8 *status,
  2702. hci_req_complete_t *req_complete,
  2703. hci_req_complete_skb_t *req_complete_skb)
  2704. {
  2705. struct hci_ev_cmd_status *ev = (void *) skb->data;
  2706. skb_pull(skb, sizeof(*ev));
  2707. *opcode = __le16_to_cpu(ev->opcode);
  2708. *status = ev->status;
  2709. switch (*opcode) {
  2710. case HCI_OP_INQUIRY:
  2711. hci_cs_inquiry(hdev, ev->status);
  2712. break;
  2713. case HCI_OP_CREATE_CONN:
  2714. hci_cs_create_conn(hdev, ev->status);
  2715. break;
  2716. case HCI_OP_DISCONNECT:
  2717. hci_cs_disconnect(hdev, ev->status);
  2718. break;
  2719. case HCI_OP_ADD_SCO:
  2720. hci_cs_add_sco(hdev, ev->status);
  2721. break;
  2722. case HCI_OP_AUTH_REQUESTED:
  2723. hci_cs_auth_requested(hdev, ev->status);
  2724. break;
  2725. case HCI_OP_SET_CONN_ENCRYPT:
  2726. hci_cs_set_conn_encrypt(hdev, ev->status);
  2727. break;
  2728. case HCI_OP_REMOTE_NAME_REQ:
  2729. hci_cs_remote_name_req(hdev, ev->status);
  2730. break;
  2731. case HCI_OP_READ_REMOTE_FEATURES:
  2732. hci_cs_read_remote_features(hdev, ev->status);
  2733. break;
  2734. case HCI_OP_READ_REMOTE_EXT_FEATURES:
  2735. hci_cs_read_remote_ext_features(hdev, ev->status);
  2736. break;
  2737. case HCI_OP_SETUP_SYNC_CONN:
  2738. hci_cs_setup_sync_conn(hdev, ev->status);
  2739. break;
  2740. case HCI_OP_SNIFF_MODE:
  2741. hci_cs_sniff_mode(hdev, ev->status);
  2742. break;
  2743. case HCI_OP_EXIT_SNIFF_MODE:
  2744. hci_cs_exit_sniff_mode(hdev, ev->status);
  2745. break;
  2746. case HCI_OP_SWITCH_ROLE:
  2747. hci_cs_switch_role(hdev, ev->status);
  2748. break;
  2749. case HCI_OP_LE_CREATE_CONN:
  2750. hci_cs_le_create_conn(hdev, ev->status);
  2751. break;
  2752. case HCI_OP_LE_READ_REMOTE_FEATURES:
  2753. hci_cs_le_read_remote_features(hdev, ev->status);
  2754. break;
  2755. case HCI_OP_LE_START_ENC:
  2756. hci_cs_le_start_enc(hdev, ev->status);
  2757. break;
  2758. case HCI_OP_LE_EXT_CREATE_CONN:
  2759. hci_cs_le_ext_create_conn(hdev, ev->status);
  2760. break;
  2761. default:
  2762. BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
  2763. break;
  2764. }
  2765. if (*opcode != HCI_OP_NOP)
  2766. cancel_delayed_work(&hdev->cmd_timer);
  2767. if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
  2768. atomic_set(&hdev->cmd_cnt, 1);
  2769. /* Indicate request completion if the command failed. Also, if
  2770. * we're not waiting for a special event and we get a success
  2771. * command status we should try to flag the request as completed
  2772. * (since for this kind of commands there will not be a command
  2773. * complete event).
  2774. */
  2775. if (ev->status ||
  2776. (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
  2777. hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
  2778. req_complete_skb);
  2779. if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
  2780. bt_dev_err(hdev,
  2781. "unexpected event for opcode 0x%4.4x", *opcode);
  2782. return;
  2783. }
  2784. if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
  2785. queue_work(hdev->workqueue, &hdev->cmd_work);
  2786. }
  2787. static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2788. {
  2789. struct hci_ev_hardware_error *ev = (void *) skb->data;
  2790. hdev->hw_error_code = ev->code;
  2791. queue_work(hdev->req_workqueue, &hdev->error_reset);
  2792. }
  2793. static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2794. {
  2795. struct hci_ev_role_change *ev = (void *) skb->data;
  2796. struct hci_conn *conn;
  2797. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2798. hci_dev_lock(hdev);
  2799. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  2800. if (conn) {
  2801. if (!ev->status)
  2802. conn->role = ev->role;
  2803. clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
  2804. hci_role_switch_cfm(conn, ev->status, ev->role);
  2805. }
  2806. hci_dev_unlock(hdev);
  2807. }
  2808. static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2809. {
  2810. struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
  2811. int i;
  2812. if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
  2813. bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
  2814. return;
  2815. }
  2816. if (skb->len < sizeof(*ev) ||
  2817. skb->len < struct_size(ev, handles, ev->num_hndl)) {
  2818. BT_DBG("%s bad parameters", hdev->name);
  2819. return;
  2820. }
  2821. BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
  2822. for (i = 0; i < ev->num_hndl; i++) {
  2823. struct hci_comp_pkts_info *info = &ev->handles[i];
  2824. struct hci_conn *conn;
  2825. __u16 handle, count;
  2826. handle = __le16_to_cpu(info->handle);
  2827. count = __le16_to_cpu(info->count);
  2828. conn = hci_conn_hash_lookup_handle(hdev, handle);
  2829. if (!conn)
  2830. continue;
  2831. conn->sent -= count;
  2832. switch (conn->type) {
  2833. case ACL_LINK:
  2834. hdev->acl_cnt += count;
  2835. if (hdev->acl_cnt > hdev->acl_pkts)
  2836. hdev->acl_cnt = hdev->acl_pkts;
  2837. break;
  2838. case LE_LINK:
  2839. if (hdev->le_pkts) {
  2840. hdev->le_cnt += count;
  2841. if (hdev->le_cnt > hdev->le_pkts)
  2842. hdev->le_cnt = hdev->le_pkts;
  2843. } else {
  2844. hdev->acl_cnt += count;
  2845. if (hdev->acl_cnt > hdev->acl_pkts)
  2846. hdev->acl_cnt = hdev->acl_pkts;
  2847. }
  2848. break;
  2849. case SCO_LINK:
  2850. hdev->sco_cnt += count;
  2851. if (hdev->sco_cnt > hdev->sco_pkts)
  2852. hdev->sco_cnt = hdev->sco_pkts;
  2853. break;
  2854. default:
  2855. bt_dev_err(hdev, "unknown type %d conn %p",
  2856. conn->type, conn);
  2857. break;
  2858. }
  2859. }
  2860. queue_work(hdev->workqueue, &hdev->tx_work);
  2861. }
  2862. static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
  2863. __u16 handle)
  2864. {
  2865. struct hci_chan *chan;
  2866. switch (hdev->dev_type) {
  2867. case HCI_PRIMARY:
  2868. return hci_conn_hash_lookup_handle(hdev, handle);
  2869. case HCI_AMP:
  2870. chan = hci_chan_lookup_handle(hdev, handle);
  2871. if (chan)
  2872. return chan->conn;
  2873. break;
  2874. default:
  2875. bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
  2876. break;
  2877. }
  2878. return NULL;
  2879. }
  2880. static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2881. {
  2882. struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
  2883. int i;
  2884. if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
  2885. bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
  2886. return;
  2887. }
  2888. if (skb->len < sizeof(*ev) ||
  2889. skb->len < struct_size(ev, handles, ev->num_hndl)) {
  2890. BT_DBG("%s bad parameters", hdev->name);
  2891. return;
  2892. }
  2893. BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
  2894. ev->num_hndl);
  2895. for (i = 0; i < ev->num_hndl; i++) {
  2896. struct hci_comp_blocks_info *info = &ev->handles[i];
  2897. struct hci_conn *conn = NULL;
  2898. __u16 handle, block_count;
  2899. handle = __le16_to_cpu(info->handle);
  2900. block_count = __le16_to_cpu(info->blocks);
  2901. conn = __hci_conn_lookup_handle(hdev, handle);
  2902. if (!conn)
  2903. continue;
  2904. conn->sent -= block_count;
  2905. switch (conn->type) {
  2906. case ACL_LINK:
  2907. case AMP_LINK:
  2908. hdev->block_cnt += block_count;
  2909. if (hdev->block_cnt > hdev->num_blocks)
  2910. hdev->block_cnt = hdev->num_blocks;
  2911. break;
  2912. default:
  2913. bt_dev_err(hdev, "unknown type %d conn %p",
  2914. conn->type, conn);
  2915. break;
  2916. }
  2917. }
  2918. queue_work(hdev->workqueue, &hdev->tx_work);
  2919. }
  2920. static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2921. {
  2922. struct hci_ev_mode_change *ev = (void *) skb->data;
  2923. struct hci_conn *conn;
  2924. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  2925. hci_dev_lock(hdev);
  2926. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  2927. if (conn) {
  2928. conn->mode = ev->mode;
  2929. if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
  2930. &conn->flags)) {
  2931. if (conn->mode == HCI_CM_ACTIVE)
  2932. set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
  2933. else
  2934. clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
  2935. }
  2936. if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
  2937. hci_sco_setup(conn, ev->status);
  2938. }
  2939. hci_dev_unlock(hdev);
  2940. }
  2941. static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  2942. {
  2943. struct hci_ev_pin_code_req *ev = (void *) skb->data;
  2944. struct hci_conn *conn;
  2945. BT_DBG("%s", hdev->name);
  2946. hci_dev_lock(hdev);
  2947. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  2948. if (!conn)
  2949. goto unlock;
  2950. if (conn->state == BT_CONNECTED) {
  2951. hci_conn_hold(conn);
  2952. conn->disc_timeout = HCI_PAIRING_TIMEOUT;
  2953. hci_conn_drop(conn);
  2954. }
  2955. if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
  2956. !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
  2957. hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
  2958. sizeof(ev->bdaddr), &ev->bdaddr);
  2959. } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
  2960. u8 secure;
  2961. if (conn->pending_sec_level == BT_SECURITY_HIGH)
  2962. secure = 1;
  2963. else
  2964. secure = 0;
  2965. mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
  2966. }
  2967. unlock:
  2968. hci_dev_unlock(hdev);
  2969. }
  2970. static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
  2971. {
  2972. if (key_type == HCI_LK_CHANGED_COMBINATION)
  2973. return;
  2974. conn->pin_length = pin_len;
  2975. conn->key_type = key_type;
  2976. switch (key_type) {
  2977. case HCI_LK_LOCAL_UNIT:
  2978. case HCI_LK_REMOTE_UNIT:
  2979. case HCI_LK_DEBUG_COMBINATION:
  2980. return;
  2981. case HCI_LK_COMBINATION:
  2982. if (pin_len == 16)
  2983. conn->pending_sec_level = BT_SECURITY_HIGH;
  2984. else
  2985. conn->pending_sec_level = BT_SECURITY_MEDIUM;
  2986. break;
  2987. case HCI_LK_UNAUTH_COMBINATION_P192:
  2988. case HCI_LK_UNAUTH_COMBINATION_P256:
  2989. conn->pending_sec_level = BT_SECURITY_MEDIUM;
  2990. break;
  2991. case HCI_LK_AUTH_COMBINATION_P192:
  2992. conn->pending_sec_level = BT_SECURITY_HIGH;
  2993. break;
  2994. case HCI_LK_AUTH_COMBINATION_P256:
  2995. conn->pending_sec_level = BT_SECURITY_FIPS;
  2996. break;
  2997. }
  2998. }
  2999. static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3000. {
  3001. struct hci_ev_link_key_req *ev = (void *) skb->data;
  3002. struct hci_cp_link_key_reply cp;
  3003. struct hci_conn *conn;
  3004. struct link_key *key;
  3005. BT_DBG("%s", hdev->name);
  3006. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  3007. return;
  3008. hci_dev_lock(hdev);
  3009. key = hci_find_link_key(hdev, &ev->bdaddr);
  3010. if (!key) {
  3011. BT_DBG("%s link key not found for %pMR", hdev->name,
  3012. &ev->bdaddr);
  3013. goto not_found;
  3014. }
  3015. BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
  3016. &ev->bdaddr);
  3017. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3018. if (conn) {
  3019. clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
  3020. if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
  3021. key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
  3022. conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
  3023. BT_DBG("%s ignoring unauthenticated key", hdev->name);
  3024. goto not_found;
  3025. }
  3026. if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
  3027. (conn->pending_sec_level == BT_SECURITY_HIGH ||
  3028. conn->pending_sec_level == BT_SECURITY_FIPS)) {
  3029. BT_DBG("%s ignoring key unauthenticated for high security",
  3030. hdev->name);
  3031. goto not_found;
  3032. }
  3033. conn_set_key(conn, key->type, key->pin_len);
  3034. }
  3035. bacpy(&cp.bdaddr, &ev->bdaddr);
  3036. memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
  3037. hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
  3038. hci_dev_unlock(hdev);
  3039. return;
  3040. not_found:
  3041. hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
  3042. hci_dev_unlock(hdev);
  3043. }
  3044. static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3045. {
  3046. struct hci_ev_link_key_notify *ev = (void *) skb->data;
  3047. struct hci_conn *conn;
  3048. struct link_key *key;
  3049. bool persistent;
  3050. u8 pin_len = 0;
  3051. BT_DBG("%s", hdev->name);
  3052. hci_dev_lock(hdev);
  3053. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3054. if (!conn)
  3055. goto unlock;
  3056. hci_conn_hold(conn);
  3057. conn->disc_timeout = HCI_DISCONN_TIMEOUT;
  3058. hci_conn_drop(conn);
  3059. set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
  3060. conn_set_key(conn, ev->key_type, conn->pin_length);
  3061. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  3062. goto unlock;
  3063. key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
  3064. ev->key_type, pin_len, &persistent);
  3065. if (!key)
  3066. goto unlock;
  3067. /* Update connection information since adding the key will have
  3068. * fixed up the type in the case of changed combination keys.
  3069. */
  3070. if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
  3071. conn_set_key(conn, key->type, key->pin_len);
  3072. mgmt_new_link_key(hdev, key, persistent);
  3073. /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
  3074. * is set. If it's not set simply remove the key from the kernel
  3075. * list (we've still notified user space about it but with
  3076. * store_hint being 0).
  3077. */
  3078. if (key->type == HCI_LK_DEBUG_COMBINATION &&
  3079. !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
  3080. list_del_rcu(&key->list);
  3081. kfree_rcu(key, rcu);
  3082. goto unlock;
  3083. }
  3084. if (persistent)
  3085. clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
  3086. else
  3087. set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
  3088. unlock:
  3089. hci_dev_unlock(hdev);
  3090. }
  3091. static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3092. {
  3093. struct hci_ev_clock_offset *ev = (void *) skb->data;
  3094. struct hci_conn *conn;
  3095. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  3096. hci_dev_lock(hdev);
  3097. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  3098. if (conn && !ev->status) {
  3099. struct inquiry_entry *ie;
  3100. ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  3101. if (ie) {
  3102. ie->data.clock_offset = ev->clock_offset;
  3103. ie->timestamp = jiffies;
  3104. }
  3105. }
  3106. hci_dev_unlock(hdev);
  3107. }
  3108. static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3109. {
  3110. struct hci_ev_pkt_type_change *ev = (void *) skb->data;
  3111. struct hci_conn *conn;
  3112. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  3113. hci_dev_lock(hdev);
  3114. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  3115. if (conn && !ev->status)
  3116. conn->pkt_type = __le16_to_cpu(ev->pkt_type);
  3117. hci_dev_unlock(hdev);
  3118. }
  3119. static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3120. {
  3121. struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
  3122. struct inquiry_entry *ie;
  3123. BT_DBG("%s", hdev->name);
  3124. hci_dev_lock(hdev);
  3125. ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
  3126. if (ie) {
  3127. ie->data.pscan_rep_mode = ev->pscan_rep_mode;
  3128. ie->timestamp = jiffies;
  3129. }
  3130. hci_dev_unlock(hdev);
  3131. }
  3132. static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
  3133. struct sk_buff *skb)
  3134. {
  3135. struct inquiry_data data;
  3136. int num_rsp = *((__u8 *) skb->data);
  3137. BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
  3138. if (!num_rsp)
  3139. return;
  3140. if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
  3141. return;
  3142. hci_dev_lock(hdev);
  3143. if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
  3144. struct inquiry_info_with_rssi_and_pscan_mode *info;
  3145. info = (void *) (skb->data + 1);
  3146. if (skb->len < num_rsp * sizeof(*info) + 1)
  3147. goto unlock;
  3148. for (; num_rsp; num_rsp--, info++) {
  3149. u32 flags;
  3150. bacpy(&data.bdaddr, &info->bdaddr);
  3151. data.pscan_rep_mode = info->pscan_rep_mode;
  3152. data.pscan_period_mode = info->pscan_period_mode;
  3153. data.pscan_mode = info->pscan_mode;
  3154. memcpy(data.dev_class, info->dev_class, 3);
  3155. data.clock_offset = info->clock_offset;
  3156. data.rssi = info->rssi;
  3157. data.ssp_mode = 0x00;
  3158. flags = hci_inquiry_cache_update(hdev, &data, false);
  3159. mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
  3160. info->dev_class, info->rssi,
  3161. flags, NULL, 0, NULL, 0);
  3162. }
  3163. } else {
  3164. struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
  3165. if (skb->len < num_rsp * sizeof(*info) + 1)
  3166. goto unlock;
  3167. for (; num_rsp; num_rsp--, info++) {
  3168. u32 flags;
  3169. bacpy(&data.bdaddr, &info->bdaddr);
  3170. data.pscan_rep_mode = info->pscan_rep_mode;
  3171. data.pscan_period_mode = info->pscan_period_mode;
  3172. data.pscan_mode = 0x00;
  3173. memcpy(data.dev_class, info->dev_class, 3);
  3174. data.clock_offset = info->clock_offset;
  3175. data.rssi = info->rssi;
  3176. data.ssp_mode = 0x00;
  3177. flags = hci_inquiry_cache_update(hdev, &data, false);
  3178. mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
  3179. info->dev_class, info->rssi,
  3180. flags, NULL, 0, NULL, 0);
  3181. }
  3182. }
  3183. unlock:
  3184. hci_dev_unlock(hdev);
  3185. }
  3186. static void hci_remote_ext_features_evt(struct hci_dev *hdev,
  3187. struct sk_buff *skb)
  3188. {
  3189. struct hci_ev_remote_ext_features *ev = (void *) skb->data;
  3190. struct hci_conn *conn;
  3191. BT_DBG("%s", hdev->name);
  3192. hci_dev_lock(hdev);
  3193. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  3194. if (!conn)
  3195. goto unlock;
  3196. if (ev->page < HCI_MAX_PAGES)
  3197. memcpy(conn->features[ev->page], ev->features, 8);
  3198. if (!ev->status && ev->page == 0x01) {
  3199. struct inquiry_entry *ie;
  3200. ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
  3201. if (ie)
  3202. ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
  3203. if (ev->features[0] & LMP_HOST_SSP) {
  3204. set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  3205. } else {
  3206. /* It is mandatory by the Bluetooth specification that
  3207. * Extended Inquiry Results are only used when Secure
  3208. * Simple Pairing is enabled, but some devices violate
  3209. * this.
  3210. *
  3211. * To make these devices work, the internal SSP
  3212. * enabled flag needs to be cleared if the remote host
  3213. * features do not indicate SSP support */
  3214. clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
  3215. }
  3216. if (ev->features[0] & LMP_HOST_SC)
  3217. set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
  3218. }
  3219. if (conn->state != BT_CONFIG)
  3220. goto unlock;
  3221. if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
  3222. struct hci_cp_remote_name_req cp;
  3223. memset(&cp, 0, sizeof(cp));
  3224. bacpy(&cp.bdaddr, &conn->dst);
  3225. cp.pscan_rep_mode = 0x02;
  3226. hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
  3227. } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
  3228. mgmt_device_connected(hdev, conn, 0, NULL, 0);
  3229. if (!hci_outgoing_auth_needed(hdev, conn)) {
  3230. conn->state = BT_CONNECTED;
  3231. hci_connect_cfm(conn, ev->status);
  3232. hci_conn_drop(conn);
  3233. }
  3234. unlock:
  3235. hci_dev_unlock(hdev);
  3236. }
  3237. static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
  3238. struct sk_buff *skb)
  3239. {
  3240. struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
  3241. struct hci_conn *conn;
  3242. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  3243. hci_dev_lock(hdev);
  3244. conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
  3245. if (!conn) {
  3246. if (ev->link_type == ESCO_LINK)
  3247. goto unlock;
  3248. /* When the link type in the event indicates SCO connection
  3249. * and lookup of the connection object fails, then check
  3250. * if an eSCO connection object exists.
  3251. *
  3252. * The core limits the synchronous connections to either
  3253. * SCO or eSCO. The eSCO connection is preferred and tried
  3254. * to be setup first and until successfully established,
  3255. * the link type will be hinted as eSCO.
  3256. */
  3257. conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
  3258. if (!conn)
  3259. goto unlock;
  3260. }
  3261. switch (ev->status) {
  3262. case 0x00:
  3263. /* The synchronous connection complete event should only be
  3264. * sent once per new connection. Receiving a successful
  3265. * complete event when the connection status is already
  3266. * BT_CONNECTED means that the device is misbehaving and sent
  3267. * multiple complete event packets for the same new connection.
  3268. *
  3269. * Registering the device more than once can corrupt kernel
  3270. * memory, hence upon detecting this invalid event, we report
  3271. * an error and ignore the packet.
  3272. */
  3273. if (conn->state == BT_CONNECTED) {
  3274. bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
  3275. goto unlock;
  3276. }
  3277. conn->handle = __le16_to_cpu(ev->handle);
  3278. conn->state = BT_CONNECTED;
  3279. conn->type = ev->link_type;
  3280. hci_debugfs_create_conn(conn);
  3281. hci_conn_add_sysfs(conn);
  3282. break;
  3283. case 0x10: /* Connection Accept Timeout */
  3284. case 0x0d: /* Connection Rejected due to Limited Resources */
  3285. case 0x11: /* Unsupported Feature or Parameter Value */
  3286. case 0x1c: /* SCO interval rejected */
  3287. case 0x1a: /* Unsupported Remote Feature */
  3288. case 0x1e: /* Invalid LMP Parameters */
  3289. case 0x1f: /* Unspecified error */
  3290. case 0x20: /* Unsupported LMP Parameter value */
  3291. if (conn->out) {
  3292. conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
  3293. (hdev->esco_type & EDR_ESCO_MASK);
  3294. if (hci_setup_sync(conn, conn->link->handle))
  3295. goto unlock;
  3296. }
  3297. fallthrough;
  3298. default:
  3299. conn->state = BT_CLOSED;
  3300. break;
  3301. }
  3302. bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
  3303. switch (ev->air_mode) {
  3304. case 0x02:
  3305. if (hdev->notify)
  3306. hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
  3307. break;
  3308. case 0x03:
  3309. if (hdev->notify)
  3310. hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
  3311. break;
  3312. }
  3313. hci_connect_cfm(conn, ev->status);
  3314. if (ev->status)
  3315. hci_conn_del(conn);
  3316. unlock:
  3317. hci_dev_unlock(hdev);
  3318. }
  3319. static inline size_t eir_get_length(u8 *eir, size_t eir_len)
  3320. {
  3321. size_t parsed = 0;
  3322. while (parsed < eir_len) {
  3323. u8 field_len = eir[0];
  3324. if (field_len == 0)
  3325. return parsed;
  3326. parsed += field_len + 1;
  3327. eir += field_len + 1;
  3328. }
  3329. return eir_len;
  3330. }
  3331. static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
  3332. struct sk_buff *skb)
  3333. {
  3334. struct inquiry_data data;
  3335. struct extended_inquiry_info *info = (void *) (skb->data + 1);
  3336. int num_rsp = *((__u8 *) skb->data);
  3337. size_t eir_len;
  3338. BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
  3339. if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
  3340. return;
  3341. if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
  3342. return;
  3343. hci_dev_lock(hdev);
  3344. for (; num_rsp; num_rsp--, info++) {
  3345. u32 flags;
  3346. bool name_known;
  3347. bacpy(&data.bdaddr, &info->bdaddr);
  3348. data.pscan_rep_mode = info->pscan_rep_mode;
  3349. data.pscan_period_mode = info->pscan_period_mode;
  3350. data.pscan_mode = 0x00;
  3351. memcpy(data.dev_class, info->dev_class, 3);
  3352. data.clock_offset = info->clock_offset;
  3353. data.rssi = info->rssi;
  3354. data.ssp_mode = 0x01;
  3355. if (hci_dev_test_flag(hdev, HCI_MGMT))
  3356. name_known = eir_get_data(info->data,
  3357. sizeof(info->data),
  3358. EIR_NAME_COMPLETE, NULL);
  3359. else
  3360. name_known = true;
  3361. flags = hci_inquiry_cache_update(hdev, &data, name_known);
  3362. eir_len = eir_get_length(info->data, sizeof(info->data));
  3363. mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
  3364. info->dev_class, info->rssi,
  3365. flags, info->data, eir_len, NULL, 0);
  3366. }
  3367. hci_dev_unlock(hdev);
  3368. }
  3369. static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
  3370. struct sk_buff *skb)
  3371. {
  3372. struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
  3373. struct hci_conn *conn;
  3374. BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
  3375. __le16_to_cpu(ev->handle));
  3376. hci_dev_lock(hdev);
  3377. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  3378. if (!conn)
  3379. goto unlock;
  3380. /* For BR/EDR the necessary steps are taken through the
  3381. * auth_complete event.
  3382. */
  3383. if (conn->type != LE_LINK)
  3384. goto unlock;
  3385. if (!ev->status)
  3386. conn->sec_level = conn->pending_sec_level;
  3387. clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
  3388. if (ev->status && conn->state == BT_CONNECTED) {
  3389. hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
  3390. hci_conn_drop(conn);
  3391. goto unlock;
  3392. }
  3393. if (conn->state == BT_CONFIG) {
  3394. if (!ev->status)
  3395. conn->state = BT_CONNECTED;
  3396. hci_connect_cfm(conn, ev->status);
  3397. hci_conn_drop(conn);
  3398. } else {
  3399. hci_auth_cfm(conn, ev->status);
  3400. hci_conn_hold(conn);
  3401. conn->disc_timeout = HCI_DISCONN_TIMEOUT;
  3402. hci_conn_drop(conn);
  3403. }
  3404. unlock:
  3405. hci_dev_unlock(hdev);
  3406. }
  3407. static u8 hci_get_auth_req(struct hci_conn *conn)
  3408. {
  3409. /* If remote requests no-bonding follow that lead */
  3410. if (conn->remote_auth == HCI_AT_NO_BONDING ||
  3411. conn->remote_auth == HCI_AT_NO_BONDING_MITM)
  3412. return conn->remote_auth | (conn->auth_type & 0x01);
  3413. /* If both remote and local have enough IO capabilities, require
  3414. * MITM protection
  3415. */
  3416. if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
  3417. conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
  3418. return conn->remote_auth | 0x01;
  3419. /* No MITM protection possible so ignore remote requirement */
  3420. return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
  3421. }
  3422. static u8 bredr_oob_data_present(struct hci_conn *conn)
  3423. {
  3424. struct hci_dev *hdev = conn->hdev;
  3425. struct oob_data *data;
  3426. data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
  3427. if (!data)
  3428. return 0x00;
  3429. if (bredr_sc_enabled(hdev)) {
  3430. /* When Secure Connections is enabled, then just
  3431. * return the present value stored with the OOB
  3432. * data. The stored value contains the right present
  3433. * information. However it can only be trusted when
  3434. * not in Secure Connection Only mode.
  3435. */
  3436. if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
  3437. return data->present;
  3438. /* When Secure Connections Only mode is enabled, then
  3439. * the P-256 values are required. If they are not
  3440. * available, then do not declare that OOB data is
  3441. * present.
  3442. */
  3443. if (!memcmp(data->rand256, ZERO_KEY, 16) ||
  3444. !memcmp(data->hash256, ZERO_KEY, 16))
  3445. return 0x00;
  3446. return 0x02;
  3447. }
  3448. /* When Secure Connections is not enabled or actually
  3449. * not supported by the hardware, then check that if
  3450. * P-192 data values are present.
  3451. */
  3452. if (!memcmp(data->rand192, ZERO_KEY, 16) ||
  3453. !memcmp(data->hash192, ZERO_KEY, 16))
  3454. return 0x00;
  3455. return 0x01;
  3456. }
  3457. static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3458. {
  3459. struct hci_ev_io_capa_request *ev = (void *) skb->data;
  3460. struct hci_conn *conn;
  3461. BT_DBG("%s", hdev->name);
  3462. hci_dev_lock(hdev);
  3463. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3464. if (!conn)
  3465. goto unlock;
  3466. hci_conn_hold(conn);
  3467. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  3468. goto unlock;
  3469. /* Allow pairing if we're pairable, the initiators of the
  3470. * pairing or if the remote is not requesting bonding.
  3471. */
  3472. if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
  3473. test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
  3474. (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
  3475. struct hci_cp_io_capability_reply cp;
  3476. bacpy(&cp.bdaddr, &ev->bdaddr);
  3477. /* Change the IO capability from KeyboardDisplay
  3478. * to DisplayYesNo as it is not supported by BT spec. */
  3479. cp.capability = (conn->io_capability == 0x04) ?
  3480. HCI_IO_DISPLAY_YESNO : conn->io_capability;
  3481. /* If we are initiators, there is no remote information yet */
  3482. if (conn->remote_auth == 0xff) {
  3483. /* Request MITM protection if our IO caps allow it
  3484. * except for the no-bonding case.
  3485. */
  3486. if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
  3487. conn->auth_type != HCI_AT_NO_BONDING)
  3488. conn->auth_type |= 0x01;
  3489. } else {
  3490. conn->auth_type = hci_get_auth_req(conn);
  3491. }
  3492. /* If we're not bondable, force one of the non-bondable
  3493. * authentication requirement values.
  3494. */
  3495. if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
  3496. conn->auth_type &= HCI_AT_NO_BONDING_MITM;
  3497. cp.authentication = conn->auth_type;
  3498. cp.oob_data = bredr_oob_data_present(conn);
  3499. hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
  3500. sizeof(cp), &cp);
  3501. } else {
  3502. struct hci_cp_io_capability_neg_reply cp;
  3503. bacpy(&cp.bdaddr, &ev->bdaddr);
  3504. cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
  3505. hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
  3506. sizeof(cp), &cp);
  3507. }
  3508. unlock:
  3509. hci_dev_unlock(hdev);
  3510. }
  3511. static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3512. {
  3513. struct hci_ev_io_capa_reply *ev = (void *) skb->data;
  3514. struct hci_conn *conn;
  3515. BT_DBG("%s", hdev->name);
  3516. hci_dev_lock(hdev);
  3517. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3518. if (!conn)
  3519. goto unlock;
  3520. conn->remote_cap = ev->capability;
  3521. conn->remote_auth = ev->authentication;
  3522. unlock:
  3523. hci_dev_unlock(hdev);
  3524. }
  3525. static void hci_user_confirm_request_evt(struct hci_dev *hdev,
  3526. struct sk_buff *skb)
  3527. {
  3528. struct hci_ev_user_confirm_req *ev = (void *) skb->data;
  3529. int loc_mitm, rem_mitm, confirm_hint = 0;
  3530. struct hci_conn *conn;
  3531. BT_DBG("%s", hdev->name);
  3532. hci_dev_lock(hdev);
  3533. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  3534. goto unlock;
  3535. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3536. if (!conn)
  3537. goto unlock;
  3538. loc_mitm = (conn->auth_type & 0x01);
  3539. rem_mitm = (conn->remote_auth & 0x01);
  3540. /* If we require MITM but the remote device can't provide that
  3541. * (it has NoInputNoOutput) then reject the confirmation
  3542. * request. We check the security level here since it doesn't
  3543. * necessarily match conn->auth_type.
  3544. */
  3545. if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
  3546. conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
  3547. BT_DBG("Rejecting request: remote device can't provide MITM");
  3548. hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
  3549. sizeof(ev->bdaddr), &ev->bdaddr);
  3550. goto unlock;
  3551. }
  3552. /* If no side requires MITM protection; auto-accept */
  3553. if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
  3554. (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
  3555. /* If we're not the initiators request authorization to
  3556. * proceed from user space (mgmt_user_confirm with
  3557. * confirm_hint set to 1). The exception is if neither
  3558. * side had MITM or if the local IO capability is
  3559. * NoInputNoOutput, in which case we do auto-accept
  3560. */
  3561. if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
  3562. conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
  3563. (loc_mitm || rem_mitm)) {
  3564. BT_DBG("Confirming auto-accept as acceptor");
  3565. confirm_hint = 1;
  3566. goto confirm;
  3567. }
  3568. /* If there already exists link key in local host, leave the
  3569. * decision to user space since the remote device could be
  3570. * legitimate or malicious.
  3571. */
  3572. if (hci_find_link_key(hdev, &ev->bdaddr)) {
  3573. bt_dev_dbg(hdev, "Local host already has link key");
  3574. confirm_hint = 1;
  3575. goto confirm;
  3576. }
  3577. BT_DBG("Auto-accept of user confirmation with %ums delay",
  3578. hdev->auto_accept_delay);
  3579. if (hdev->auto_accept_delay > 0) {
  3580. int delay = msecs_to_jiffies(hdev->auto_accept_delay);
  3581. queue_delayed_work(conn->hdev->workqueue,
  3582. &conn->auto_accept_work, delay);
  3583. goto unlock;
  3584. }
  3585. hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
  3586. sizeof(ev->bdaddr), &ev->bdaddr);
  3587. goto unlock;
  3588. }
  3589. confirm:
  3590. mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
  3591. le32_to_cpu(ev->passkey), confirm_hint);
  3592. unlock:
  3593. hci_dev_unlock(hdev);
  3594. }
  3595. static void hci_user_passkey_request_evt(struct hci_dev *hdev,
  3596. struct sk_buff *skb)
  3597. {
  3598. struct hci_ev_user_passkey_req *ev = (void *) skb->data;
  3599. BT_DBG("%s", hdev->name);
  3600. if (hci_dev_test_flag(hdev, HCI_MGMT))
  3601. mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
  3602. }
  3603. static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
  3604. struct sk_buff *skb)
  3605. {
  3606. struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
  3607. struct hci_conn *conn;
  3608. BT_DBG("%s", hdev->name);
  3609. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3610. if (!conn)
  3611. return;
  3612. conn->passkey_notify = __le32_to_cpu(ev->passkey);
  3613. conn->passkey_entered = 0;
  3614. if (hci_dev_test_flag(hdev, HCI_MGMT))
  3615. mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
  3616. conn->dst_type, conn->passkey_notify,
  3617. conn->passkey_entered);
  3618. }
  3619. static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3620. {
  3621. struct hci_ev_keypress_notify *ev = (void *) skb->data;
  3622. struct hci_conn *conn;
  3623. BT_DBG("%s", hdev->name);
  3624. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3625. if (!conn)
  3626. return;
  3627. switch (ev->type) {
  3628. case HCI_KEYPRESS_STARTED:
  3629. conn->passkey_entered = 0;
  3630. return;
  3631. case HCI_KEYPRESS_ENTERED:
  3632. conn->passkey_entered++;
  3633. break;
  3634. case HCI_KEYPRESS_ERASED:
  3635. conn->passkey_entered--;
  3636. break;
  3637. case HCI_KEYPRESS_CLEARED:
  3638. conn->passkey_entered = 0;
  3639. break;
  3640. case HCI_KEYPRESS_COMPLETED:
  3641. return;
  3642. }
  3643. if (hci_dev_test_flag(hdev, HCI_MGMT))
  3644. mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
  3645. conn->dst_type, conn->passkey_notify,
  3646. conn->passkey_entered);
  3647. }
  3648. static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
  3649. struct sk_buff *skb)
  3650. {
  3651. struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
  3652. struct hci_conn *conn;
  3653. BT_DBG("%s", hdev->name);
  3654. hci_dev_lock(hdev);
  3655. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3656. if (!conn)
  3657. goto unlock;
  3658. /* Reset the authentication requirement to unknown */
  3659. conn->remote_auth = 0xff;
  3660. /* To avoid duplicate auth_failed events to user space we check
  3661. * the HCI_CONN_AUTH_PEND flag which will be set if we
  3662. * initiated the authentication. A traditional auth_complete
  3663. * event gets always produced as initiator and is also mapped to
  3664. * the mgmt_auth_failed event */
  3665. if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
  3666. mgmt_auth_failed(conn, ev->status);
  3667. hci_conn_drop(conn);
  3668. unlock:
  3669. hci_dev_unlock(hdev);
  3670. }
  3671. static void hci_remote_host_features_evt(struct hci_dev *hdev,
  3672. struct sk_buff *skb)
  3673. {
  3674. struct hci_ev_remote_host_features *ev = (void *) skb->data;
  3675. struct inquiry_entry *ie;
  3676. struct hci_conn *conn;
  3677. BT_DBG("%s", hdev->name);
  3678. hci_dev_lock(hdev);
  3679. conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
  3680. if (conn)
  3681. memcpy(conn->features[1], ev->features, 8);
  3682. ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
  3683. if (ie)
  3684. ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
  3685. hci_dev_unlock(hdev);
  3686. }
  3687. static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
  3688. struct sk_buff *skb)
  3689. {
  3690. struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
  3691. struct oob_data *data;
  3692. BT_DBG("%s", hdev->name);
  3693. hci_dev_lock(hdev);
  3694. if (!hci_dev_test_flag(hdev, HCI_MGMT))
  3695. goto unlock;
  3696. data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
  3697. if (!data) {
  3698. struct hci_cp_remote_oob_data_neg_reply cp;
  3699. bacpy(&cp.bdaddr, &ev->bdaddr);
  3700. hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
  3701. sizeof(cp), &cp);
  3702. goto unlock;
  3703. }
  3704. if (bredr_sc_enabled(hdev)) {
  3705. struct hci_cp_remote_oob_ext_data_reply cp;
  3706. bacpy(&cp.bdaddr, &ev->bdaddr);
  3707. if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
  3708. memset(cp.hash192, 0, sizeof(cp.hash192));
  3709. memset(cp.rand192, 0, sizeof(cp.rand192));
  3710. } else {
  3711. memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
  3712. memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
  3713. }
  3714. memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
  3715. memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
  3716. hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
  3717. sizeof(cp), &cp);
  3718. } else {
  3719. struct hci_cp_remote_oob_data_reply cp;
  3720. bacpy(&cp.bdaddr, &ev->bdaddr);
  3721. memcpy(cp.hash, data->hash192, sizeof(cp.hash));
  3722. memcpy(cp.rand, data->rand192, sizeof(cp.rand));
  3723. hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
  3724. sizeof(cp), &cp);
  3725. }
  3726. unlock:
  3727. hci_dev_unlock(hdev);
  3728. }
  3729. #if IS_ENABLED(CONFIG_BT_HS)
  3730. static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3731. {
  3732. struct hci_ev_channel_selected *ev = (void *)skb->data;
  3733. struct hci_conn *hcon;
  3734. BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
  3735. skb_pull(skb, sizeof(*ev));
  3736. hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
  3737. if (!hcon)
  3738. return;
  3739. amp_read_loc_assoc_final_data(hdev, hcon);
  3740. }
  3741. static void hci_phy_link_complete_evt(struct hci_dev *hdev,
  3742. struct sk_buff *skb)
  3743. {
  3744. struct hci_ev_phy_link_complete *ev = (void *) skb->data;
  3745. struct hci_conn *hcon, *bredr_hcon;
  3746. BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
  3747. ev->status);
  3748. hci_dev_lock(hdev);
  3749. hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
  3750. if (!hcon) {
  3751. hci_dev_unlock(hdev);
  3752. return;
  3753. }
  3754. if (!hcon->amp_mgr) {
  3755. hci_dev_unlock(hdev);
  3756. return;
  3757. }
  3758. if (ev->status) {
  3759. hci_conn_del(hcon);
  3760. hci_dev_unlock(hdev);
  3761. return;
  3762. }
  3763. bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
  3764. hcon->state = BT_CONNECTED;
  3765. bacpy(&hcon->dst, &bredr_hcon->dst);
  3766. hci_conn_hold(hcon);
  3767. hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
  3768. hci_conn_drop(hcon);
  3769. hci_debugfs_create_conn(hcon);
  3770. hci_conn_add_sysfs(hcon);
  3771. amp_physical_cfm(bredr_hcon, hcon);
  3772. hci_dev_unlock(hdev);
  3773. }
  3774. static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  3775. {
  3776. struct hci_ev_logical_link_complete *ev = (void *) skb->data;
  3777. struct hci_conn *hcon;
  3778. struct hci_chan *hchan;
  3779. struct amp_mgr *mgr;
  3780. BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
  3781. hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
  3782. ev->status);
  3783. hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
  3784. if (!hcon)
  3785. return;
  3786. /* Create AMP hchan */
  3787. hchan = hci_chan_create(hcon);
  3788. if (!hchan)
  3789. return;
  3790. hchan->handle = le16_to_cpu(ev->handle);
  3791. hchan->amp = true;
  3792. BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
  3793. mgr = hcon->amp_mgr;
  3794. if (mgr && mgr->bredr_chan) {
  3795. struct l2cap_chan *bredr_chan = mgr->bredr_chan;
  3796. l2cap_chan_lock(bredr_chan);
  3797. bredr_chan->conn->mtu = hdev->block_mtu;
  3798. l2cap_logical_cfm(bredr_chan, hchan, 0);
  3799. hci_conn_hold(hcon);
  3800. l2cap_chan_unlock(bredr_chan);
  3801. }
  3802. }
  3803. static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
  3804. struct sk_buff *skb)
  3805. {
  3806. struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
  3807. struct hci_chan *hchan;
  3808. BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
  3809. le16_to_cpu(ev->handle), ev->status);
  3810. if (ev->status)
  3811. return;
  3812. hci_dev_lock(hdev);
  3813. hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
  3814. if (!hchan || !hchan->amp)
  3815. goto unlock;
  3816. amp_destroy_logical_link(hchan, ev->reason);
  3817. unlock:
  3818. hci_dev_unlock(hdev);
  3819. }
  3820. static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
  3821. struct sk_buff *skb)
  3822. {
  3823. struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
  3824. struct hci_conn *hcon;
  3825. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  3826. if (ev->status)
  3827. return;
  3828. hci_dev_lock(hdev);
  3829. hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
  3830. if (hcon && hcon->type == AMP_LINK) {
  3831. hcon->state = BT_CLOSED;
  3832. hci_disconn_cfm(hcon, ev->reason);
  3833. hci_conn_del(hcon);
  3834. }
  3835. hci_dev_unlock(hdev);
  3836. }
  3837. #endif
  3838. static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
  3839. u8 bdaddr_type, bdaddr_t *local_rpa)
  3840. {
  3841. if (conn->out) {
  3842. conn->dst_type = bdaddr_type;
  3843. conn->resp_addr_type = bdaddr_type;
  3844. bacpy(&conn->resp_addr, bdaddr);
  3845. /* Check if the controller has set a Local RPA then it must be
  3846. * used instead or hdev->rpa.
  3847. */
  3848. if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
  3849. conn->init_addr_type = ADDR_LE_DEV_RANDOM;
  3850. bacpy(&conn->init_addr, local_rpa);
  3851. } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
  3852. conn->init_addr_type = ADDR_LE_DEV_RANDOM;
  3853. bacpy(&conn->init_addr, &conn->hdev->rpa);
  3854. } else {
  3855. hci_copy_identity_address(conn->hdev, &conn->init_addr,
  3856. &conn->init_addr_type);
  3857. }
  3858. } else {
  3859. conn->resp_addr_type = conn->hdev->adv_addr_type;
  3860. /* Check if the controller has set a Local RPA then it must be
  3861. * used instead or hdev->rpa.
  3862. */
  3863. if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
  3864. conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
  3865. bacpy(&conn->resp_addr, local_rpa);
  3866. } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
  3867. /* In case of ext adv, resp_addr will be updated in
  3868. * Adv Terminated event.
  3869. */
  3870. if (!ext_adv_capable(conn->hdev))
  3871. bacpy(&conn->resp_addr,
  3872. &conn->hdev->random_addr);
  3873. } else {
  3874. bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
  3875. }
  3876. conn->init_addr_type = bdaddr_type;
  3877. bacpy(&conn->init_addr, bdaddr);
  3878. /* For incoming connections, set the default minimum
  3879. * and maximum connection interval. They will be used
  3880. * to check if the parameters are in range and if not
  3881. * trigger the connection update procedure.
  3882. */
  3883. conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
  3884. conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
  3885. }
  3886. }
  3887. static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
  3888. bdaddr_t *bdaddr, u8 bdaddr_type,
  3889. bdaddr_t *local_rpa, u8 role, u16 handle,
  3890. u16 interval, u16 latency,
  3891. u16 supervision_timeout)
  3892. {
  3893. struct hci_conn_params *params;
  3894. struct hci_conn *conn;
  3895. struct smp_irk *irk;
  3896. u8 addr_type;
  3897. hci_dev_lock(hdev);
  3898. /* All controllers implicitly stop advertising in the event of a
  3899. * connection, so ensure that the state bit is cleared.
  3900. */
  3901. hci_dev_clear_flag(hdev, HCI_LE_ADV);
  3902. conn = hci_lookup_le_connect(hdev);
  3903. if (!conn) {
  3904. conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
  3905. if (!conn) {
  3906. bt_dev_err(hdev, "no memory for new connection");
  3907. goto unlock;
  3908. }
  3909. conn->dst_type = bdaddr_type;
  3910. /* If we didn't have a hci_conn object previously
  3911. * but we're in master role this must be something
  3912. * initiated using a white list. Since white list based
  3913. * connections are not "first class citizens" we don't
  3914. * have full tracking of them. Therefore, we go ahead
  3915. * with a "best effort" approach of determining the
  3916. * initiator address based on the HCI_PRIVACY flag.
  3917. */
  3918. if (conn->out) {
  3919. conn->resp_addr_type = bdaddr_type;
  3920. bacpy(&conn->resp_addr, bdaddr);
  3921. if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
  3922. conn->init_addr_type = ADDR_LE_DEV_RANDOM;
  3923. bacpy(&conn->init_addr, &hdev->rpa);
  3924. } else {
  3925. hci_copy_identity_address(hdev,
  3926. &conn->init_addr,
  3927. &conn->init_addr_type);
  3928. }
  3929. }
  3930. } else {
  3931. cancel_delayed_work(&conn->le_conn_timeout);
  3932. }
  3933. le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
  3934. /* Lookup the identity address from the stored connection
  3935. * address and address type.
  3936. *
  3937. * When establishing connections to an identity address, the
  3938. * connection procedure will store the resolvable random
  3939. * address first. Now if it can be converted back into the
  3940. * identity address, start using the identity address from
  3941. * now on.
  3942. */
  3943. irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
  3944. if (irk) {
  3945. bacpy(&conn->dst, &irk->bdaddr);
  3946. conn->dst_type = irk->addr_type;
  3947. }
  3948. if (status) {
  3949. hci_le_conn_failed(conn, status);
  3950. goto unlock;
  3951. }
  3952. if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
  3953. addr_type = BDADDR_LE_PUBLIC;
  3954. else
  3955. addr_type = BDADDR_LE_RANDOM;
  3956. /* Drop the connection if the device is blocked */
  3957. if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
  3958. hci_conn_drop(conn);
  3959. goto unlock;
  3960. }
  3961. if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
  3962. mgmt_device_connected(hdev, conn, 0, NULL, 0);
  3963. conn->sec_level = BT_SECURITY_LOW;
  3964. conn->handle = handle;
  3965. conn->state = BT_CONFIG;
  3966. conn->le_conn_interval = interval;
  3967. conn->le_conn_latency = latency;
  3968. conn->le_supv_timeout = supervision_timeout;
  3969. hci_debugfs_create_conn(conn);
  3970. hci_conn_add_sysfs(conn);
  3971. /* The remote features procedure is defined for master
  3972. * role only. So only in case of an initiated connection
  3973. * request the remote features.
  3974. *
  3975. * If the local controller supports slave-initiated features
  3976. * exchange, then requesting the remote features in slave
  3977. * role is possible. Otherwise just transition into the
  3978. * connected state without requesting the remote features.
  3979. */
  3980. if (conn->out ||
  3981. (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
  3982. struct hci_cp_le_read_remote_features cp;
  3983. cp.handle = __cpu_to_le16(conn->handle);
  3984. hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
  3985. sizeof(cp), &cp);
  3986. hci_conn_hold(conn);
  3987. } else {
  3988. conn->state = BT_CONNECTED;
  3989. hci_connect_cfm(conn, status);
  3990. }
  3991. params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
  3992. conn->dst_type);
  3993. if (params) {
  3994. list_del_init(&params->action);
  3995. if (params->conn) {
  3996. hci_conn_drop(params->conn);
  3997. hci_conn_put(params->conn);
  3998. params->conn = NULL;
  3999. }
  4000. }
  4001. unlock:
  4002. hci_update_background_scan(hdev);
  4003. hci_dev_unlock(hdev);
  4004. }
  4005. static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4006. {
  4007. struct hci_ev_le_conn_complete *ev = (void *) skb->data;
  4008. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4009. le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
  4010. NULL, ev->role, le16_to_cpu(ev->handle),
  4011. le16_to_cpu(ev->interval),
  4012. le16_to_cpu(ev->latency),
  4013. le16_to_cpu(ev->supervision_timeout));
  4014. }
  4015. static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
  4016. struct sk_buff *skb)
  4017. {
  4018. struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
  4019. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4020. le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
  4021. &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
  4022. le16_to_cpu(ev->interval),
  4023. le16_to_cpu(ev->latency),
  4024. le16_to_cpu(ev->supervision_timeout));
  4025. if (use_ll_privacy(hdev) &&
  4026. hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
  4027. hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
  4028. hci_req_disable_address_resolution(hdev);
  4029. }
  4030. static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4031. {
  4032. struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
  4033. struct hci_conn *conn;
  4034. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4035. if (ev->status) {
  4036. struct adv_info *adv;
  4037. adv = hci_find_adv_instance(hdev, ev->handle);
  4038. if (!adv)
  4039. return;
  4040. /* Remove advertising as it has been terminated */
  4041. hci_remove_adv_instance(hdev, ev->handle);
  4042. mgmt_advertising_removed(NULL, hdev, ev->handle);
  4043. return;
  4044. }
  4045. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
  4046. if (conn) {
  4047. struct adv_info *adv_instance;
  4048. if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
  4049. bacmp(&conn->resp_addr, BDADDR_ANY))
  4050. return;
  4051. if (!hdev->cur_adv_instance) {
  4052. bacpy(&conn->resp_addr, &hdev->random_addr);
  4053. return;
  4054. }
  4055. adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
  4056. if (adv_instance)
  4057. bacpy(&conn->resp_addr, &adv_instance->random_addr);
  4058. }
  4059. }
  4060. static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
  4061. struct sk_buff *skb)
  4062. {
  4063. struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
  4064. struct hci_conn *conn;
  4065. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4066. if (ev->status)
  4067. return;
  4068. hci_dev_lock(hdev);
  4069. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  4070. if (conn) {
  4071. conn->le_conn_interval = le16_to_cpu(ev->interval);
  4072. conn->le_conn_latency = le16_to_cpu(ev->latency);
  4073. conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
  4074. }
  4075. hci_dev_unlock(hdev);
  4076. }
  4077. /* This function requires the caller holds hdev->lock */
  4078. static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
  4079. bdaddr_t *addr,
  4080. u8 addr_type, u8 adv_type,
  4081. bdaddr_t *direct_rpa)
  4082. {
  4083. struct hci_conn *conn;
  4084. struct hci_conn_params *params;
  4085. /* If the event is not connectable don't proceed further */
  4086. if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
  4087. return NULL;
  4088. /* Ignore if the device is blocked */
  4089. if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
  4090. return NULL;
  4091. /* Most controller will fail if we try to create new connections
  4092. * while we have an existing one in slave role.
  4093. */
  4094. if (hdev->conn_hash.le_num_slave > 0 &&
  4095. (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
  4096. !(hdev->le_states[3] & 0x10)))
  4097. return NULL;
  4098. /* If we're not connectable only connect devices that we have in
  4099. * our pend_le_conns list.
  4100. */
  4101. params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
  4102. addr_type);
  4103. if (!params)
  4104. return NULL;
  4105. if (!params->explicit_connect) {
  4106. switch (params->auto_connect) {
  4107. case HCI_AUTO_CONN_DIRECT:
  4108. /* Only devices advertising with ADV_DIRECT_IND are
  4109. * triggering a connection attempt. This is allowing
  4110. * incoming connections from slave devices.
  4111. */
  4112. if (adv_type != LE_ADV_DIRECT_IND)
  4113. return NULL;
  4114. break;
  4115. case HCI_AUTO_CONN_ALWAYS:
  4116. /* Devices advertising with ADV_IND or ADV_DIRECT_IND
  4117. * are triggering a connection attempt. This means
  4118. * that incoming connections from slave device are
  4119. * accepted and also outgoing connections to slave
  4120. * devices are established when found.
  4121. */
  4122. break;
  4123. default:
  4124. return NULL;
  4125. }
  4126. }
  4127. conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
  4128. hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
  4129. direct_rpa);
  4130. if (!IS_ERR(conn)) {
  4131. /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
  4132. * by higher layer that tried to connect, if no then
  4133. * store the pointer since we don't really have any
  4134. * other owner of the object besides the params that
  4135. * triggered it. This way we can abort the connection if
  4136. * the parameters get removed and keep the reference
  4137. * count consistent once the connection is established.
  4138. */
  4139. if (!params->explicit_connect)
  4140. params->conn = hci_conn_get(conn);
  4141. return conn;
  4142. }
  4143. switch (PTR_ERR(conn)) {
  4144. case -EBUSY:
  4145. /* If hci_connect() returns -EBUSY it means there is already
  4146. * an LE connection attempt going on. Since controllers don't
  4147. * support more than one connection attempt at the time, we
  4148. * don't consider this an error case.
  4149. */
  4150. break;
  4151. default:
  4152. BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
  4153. return NULL;
  4154. }
  4155. return NULL;
  4156. }
  4157. static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
  4158. u8 bdaddr_type, bdaddr_t *direct_addr,
  4159. u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
  4160. bool ext_adv)
  4161. {
  4162. struct discovery_state *d = &hdev->discovery;
  4163. struct smp_irk *irk;
  4164. struct hci_conn *conn;
  4165. bool match;
  4166. u32 flags;
  4167. u8 *ptr;
  4168. switch (type) {
  4169. case LE_ADV_IND:
  4170. case LE_ADV_DIRECT_IND:
  4171. case LE_ADV_SCAN_IND:
  4172. case LE_ADV_NONCONN_IND:
  4173. case LE_ADV_SCAN_RSP:
  4174. break;
  4175. default:
  4176. bt_dev_err_ratelimited(hdev, "unknown advertising packet "
  4177. "type: 0x%02x", type);
  4178. return;
  4179. }
  4180. if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
  4181. bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
  4182. return;
  4183. }
  4184. /* Find the end of the data in case the report contains padded zero
  4185. * bytes at the end causing an invalid length value.
  4186. *
  4187. * When data is NULL, len is 0 so there is no need for extra ptr
  4188. * check as 'ptr < data + 0' is already false in such case.
  4189. */
  4190. for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
  4191. if (ptr + 1 + *ptr > data + len)
  4192. break;
  4193. }
  4194. /* Adjust for actual length. This handles the case when remote
  4195. * device is advertising with incorrect data length.
  4196. */
  4197. len = ptr - data;
  4198. /* If the direct address is present, then this report is from
  4199. * a LE Direct Advertising Report event. In that case it is
  4200. * important to see if the address is matching the local
  4201. * controller address.
  4202. */
  4203. if (direct_addr) {
  4204. /* Only resolvable random addresses are valid for these
  4205. * kind of reports and others can be ignored.
  4206. */
  4207. if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
  4208. return;
  4209. /* If the controller is not using resolvable random
  4210. * addresses, then this report can be ignored.
  4211. */
  4212. if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
  4213. return;
  4214. /* If the local IRK of the controller does not match
  4215. * with the resolvable random address provided, then
  4216. * this report can be ignored.
  4217. */
  4218. if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
  4219. return;
  4220. }
  4221. /* Check if we need to convert to identity address */
  4222. irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
  4223. if (irk) {
  4224. bdaddr = &irk->bdaddr;
  4225. bdaddr_type = irk->addr_type;
  4226. }
  4227. /* Check if we have been requested to connect to this device.
  4228. *
  4229. * direct_addr is set only for directed advertising reports (it is NULL
  4230. * for advertising reports) and is already verified to be RPA above.
  4231. */
  4232. conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
  4233. direct_addr);
  4234. if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
  4235. /* Store report for later inclusion by
  4236. * mgmt_device_connected
  4237. */
  4238. memcpy(conn->le_adv_data, data, len);
  4239. conn->le_adv_data_len = len;
  4240. }
  4241. /* Passive scanning shouldn't trigger any device found events,
  4242. * except for devices marked as CONN_REPORT for which we do send
  4243. * device found events, or advertisement monitoring requested.
  4244. */
  4245. if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
  4246. if (type == LE_ADV_DIRECT_IND)
  4247. return;
  4248. if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
  4249. bdaddr, bdaddr_type) &&
  4250. idr_is_empty(&hdev->adv_monitors_idr))
  4251. return;
  4252. if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
  4253. flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
  4254. else
  4255. flags = 0;
  4256. mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
  4257. rssi, flags, data, len, NULL, 0);
  4258. return;
  4259. }
  4260. /* When receiving non-connectable or scannable undirected
  4261. * advertising reports, this means that the remote device is
  4262. * not connectable and then clearly indicate this in the
  4263. * device found event.
  4264. *
  4265. * When receiving a scan response, then there is no way to
  4266. * know if the remote device is connectable or not. However
  4267. * since scan responses are merged with a previously seen
  4268. * advertising report, the flags field from that report
  4269. * will be used.
  4270. *
  4271. * In the really unlikely case that a controller get confused
  4272. * and just sends a scan response event, then it is marked as
  4273. * not connectable as well.
  4274. */
  4275. if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
  4276. type == LE_ADV_SCAN_RSP)
  4277. flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
  4278. else
  4279. flags = 0;
  4280. /* If there's nothing pending either store the data from this
  4281. * event or send an immediate device found event if the data
  4282. * should not be stored for later.
  4283. */
  4284. if (!ext_adv && !has_pending_adv_report(hdev)) {
  4285. /* If the report will trigger a SCAN_REQ store it for
  4286. * later merging.
  4287. */
  4288. if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
  4289. store_pending_adv_report(hdev, bdaddr, bdaddr_type,
  4290. rssi, flags, data, len);
  4291. return;
  4292. }
  4293. mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
  4294. rssi, flags, data, len, NULL, 0);
  4295. return;
  4296. }
  4297. /* Check if the pending report is for the same device as the new one */
  4298. match = (!bacmp(bdaddr, &d->last_adv_addr) &&
  4299. bdaddr_type == d->last_adv_addr_type);
  4300. /* If the pending data doesn't match this report or this isn't a
  4301. * scan response (e.g. we got a duplicate ADV_IND) then force
  4302. * sending of the pending data.
  4303. */
  4304. if (type != LE_ADV_SCAN_RSP || !match) {
  4305. /* Send out whatever is in the cache, but skip duplicates */
  4306. if (!match)
  4307. mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
  4308. d->last_adv_addr_type, NULL,
  4309. d->last_adv_rssi, d->last_adv_flags,
  4310. d->last_adv_data,
  4311. d->last_adv_data_len, NULL, 0);
  4312. /* If the new report will trigger a SCAN_REQ store it for
  4313. * later merging.
  4314. */
  4315. if (!ext_adv && (type == LE_ADV_IND ||
  4316. type == LE_ADV_SCAN_IND)) {
  4317. store_pending_adv_report(hdev, bdaddr, bdaddr_type,
  4318. rssi, flags, data, len);
  4319. return;
  4320. }
  4321. /* The advertising reports cannot be merged, so clear
  4322. * the pending report and send out a device found event.
  4323. */
  4324. clear_pending_adv_report(hdev);
  4325. mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
  4326. rssi, flags, data, len, NULL, 0);
  4327. return;
  4328. }
  4329. /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
  4330. * the new event is a SCAN_RSP. We can therefore proceed with
  4331. * sending a merged device found event.
  4332. */
  4333. mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
  4334. d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
  4335. d->last_adv_data, d->last_adv_data_len, data, len);
  4336. clear_pending_adv_report(hdev);
  4337. }
  4338. static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4339. {
  4340. u8 num_reports = skb->data[0];
  4341. void *ptr = &skb->data[1];
  4342. hci_dev_lock(hdev);
  4343. while (num_reports--) {
  4344. struct hci_ev_le_advertising_info *ev = ptr;
  4345. s8 rssi;
  4346. if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
  4347. bt_dev_err(hdev, "Malicious advertising data.");
  4348. break;
  4349. }
  4350. if (ev->length <= HCI_MAX_AD_LENGTH &&
  4351. ev->data + ev->length <= skb_tail_pointer(skb)) {
  4352. rssi = ev->data[ev->length];
  4353. process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
  4354. ev->bdaddr_type, NULL, 0, rssi,
  4355. ev->data, ev->length, false);
  4356. } else {
  4357. bt_dev_err(hdev, "Dropping invalid advertising data");
  4358. }
  4359. ptr += sizeof(*ev) + ev->length + 1;
  4360. }
  4361. hci_dev_unlock(hdev);
  4362. }
  4363. static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
  4364. {
  4365. if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
  4366. switch (evt_type) {
  4367. case LE_LEGACY_ADV_IND:
  4368. return LE_ADV_IND;
  4369. case LE_LEGACY_ADV_DIRECT_IND:
  4370. return LE_ADV_DIRECT_IND;
  4371. case LE_LEGACY_ADV_SCAN_IND:
  4372. return LE_ADV_SCAN_IND;
  4373. case LE_LEGACY_NONCONN_IND:
  4374. return LE_ADV_NONCONN_IND;
  4375. case LE_LEGACY_SCAN_RSP_ADV:
  4376. case LE_LEGACY_SCAN_RSP_ADV_SCAN:
  4377. return LE_ADV_SCAN_RSP;
  4378. }
  4379. goto invalid;
  4380. }
  4381. if (evt_type & LE_EXT_ADV_CONN_IND) {
  4382. if (evt_type & LE_EXT_ADV_DIRECT_IND)
  4383. return LE_ADV_DIRECT_IND;
  4384. return LE_ADV_IND;
  4385. }
  4386. if (evt_type & LE_EXT_ADV_SCAN_RSP)
  4387. return LE_ADV_SCAN_RSP;
  4388. if (evt_type & LE_EXT_ADV_SCAN_IND)
  4389. return LE_ADV_SCAN_IND;
  4390. if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
  4391. evt_type & LE_EXT_ADV_DIRECT_IND)
  4392. return LE_ADV_NONCONN_IND;
  4393. invalid:
  4394. bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
  4395. evt_type);
  4396. return LE_ADV_INVALID;
  4397. }
  4398. static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4399. {
  4400. u8 num_reports = skb->data[0];
  4401. void *ptr = &skb->data[1];
  4402. hci_dev_lock(hdev);
  4403. while (num_reports--) {
  4404. struct hci_ev_le_ext_adv_report *ev = ptr;
  4405. u8 legacy_evt_type;
  4406. u16 evt_type;
  4407. evt_type = __le16_to_cpu(ev->evt_type);
  4408. legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
  4409. if (legacy_evt_type != LE_ADV_INVALID) {
  4410. process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
  4411. ev->bdaddr_type, NULL, 0, ev->rssi,
  4412. ev->data, ev->length,
  4413. !(evt_type & LE_EXT_ADV_LEGACY_PDU));
  4414. }
  4415. ptr += sizeof(*ev) + ev->length;
  4416. }
  4417. hci_dev_unlock(hdev);
  4418. }
  4419. static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
  4420. struct sk_buff *skb)
  4421. {
  4422. struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
  4423. struct hci_conn *conn;
  4424. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4425. hci_dev_lock(hdev);
  4426. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  4427. if (conn) {
  4428. if (!ev->status)
  4429. memcpy(conn->features[0], ev->features, 8);
  4430. if (conn->state == BT_CONFIG) {
  4431. __u8 status;
  4432. /* If the local controller supports slave-initiated
  4433. * features exchange, but the remote controller does
  4434. * not, then it is possible that the error code 0x1a
  4435. * for unsupported remote feature gets returned.
  4436. *
  4437. * In this specific case, allow the connection to
  4438. * transition into connected state and mark it as
  4439. * successful.
  4440. */
  4441. if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
  4442. !conn->out && ev->status == 0x1a)
  4443. status = 0x00;
  4444. else
  4445. status = ev->status;
  4446. conn->state = BT_CONNECTED;
  4447. hci_connect_cfm(conn, status);
  4448. hci_conn_drop(conn);
  4449. }
  4450. }
  4451. hci_dev_unlock(hdev);
  4452. }
  4453. static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4454. {
  4455. struct hci_ev_le_ltk_req *ev = (void *) skb->data;
  4456. struct hci_cp_le_ltk_reply cp;
  4457. struct hci_cp_le_ltk_neg_reply neg;
  4458. struct hci_conn *conn;
  4459. struct smp_ltk *ltk;
  4460. BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
  4461. hci_dev_lock(hdev);
  4462. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  4463. if (conn == NULL)
  4464. goto not_found;
  4465. ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
  4466. if (!ltk)
  4467. goto not_found;
  4468. if (smp_ltk_is_sc(ltk)) {
  4469. /* With SC both EDiv and Rand are set to zero */
  4470. if (ev->ediv || ev->rand)
  4471. goto not_found;
  4472. } else {
  4473. /* For non-SC keys check that EDiv and Rand match */
  4474. if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
  4475. goto not_found;
  4476. }
  4477. memcpy(cp.ltk, ltk->val, ltk->enc_size);
  4478. memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
  4479. cp.handle = cpu_to_le16(conn->handle);
  4480. conn->pending_sec_level = smp_ltk_sec_level(ltk);
  4481. conn->enc_key_size = ltk->enc_size;
  4482. hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
  4483. /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
  4484. * temporary key used to encrypt a connection following
  4485. * pairing. It is used during the Encrypted Session Setup to
  4486. * distribute the keys. Later, security can be re-established
  4487. * using a distributed LTK.
  4488. */
  4489. if (ltk->type == SMP_STK) {
  4490. set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
  4491. list_del_rcu(&ltk->list);
  4492. kfree_rcu(ltk, rcu);
  4493. } else {
  4494. clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
  4495. }
  4496. hci_dev_unlock(hdev);
  4497. return;
  4498. not_found:
  4499. neg.handle = ev->handle;
  4500. hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
  4501. hci_dev_unlock(hdev);
  4502. }
  4503. static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
  4504. u8 reason)
  4505. {
  4506. struct hci_cp_le_conn_param_req_neg_reply cp;
  4507. cp.handle = cpu_to_le16(handle);
  4508. cp.reason = reason;
  4509. hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
  4510. &cp);
  4511. }
  4512. static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
  4513. struct sk_buff *skb)
  4514. {
  4515. struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
  4516. struct hci_cp_le_conn_param_req_reply cp;
  4517. struct hci_conn *hcon;
  4518. u16 handle, min, max, latency, timeout;
  4519. handle = le16_to_cpu(ev->handle);
  4520. min = le16_to_cpu(ev->interval_min);
  4521. max = le16_to_cpu(ev->interval_max);
  4522. latency = le16_to_cpu(ev->latency);
  4523. timeout = le16_to_cpu(ev->timeout);
  4524. hcon = hci_conn_hash_lookup_handle(hdev, handle);
  4525. if (!hcon || hcon->state != BT_CONNECTED)
  4526. return send_conn_param_neg_reply(hdev, handle,
  4527. HCI_ERROR_UNKNOWN_CONN_ID);
  4528. if (hci_check_conn_params(min, max, latency, timeout))
  4529. return send_conn_param_neg_reply(hdev, handle,
  4530. HCI_ERROR_INVALID_LL_PARAMS);
  4531. if (hcon->role == HCI_ROLE_MASTER) {
  4532. struct hci_conn_params *params;
  4533. u8 store_hint;
  4534. hci_dev_lock(hdev);
  4535. params = hci_conn_params_lookup(hdev, &hcon->dst,
  4536. hcon->dst_type);
  4537. if (params) {
  4538. params->conn_min_interval = min;
  4539. params->conn_max_interval = max;
  4540. params->conn_latency = latency;
  4541. params->supervision_timeout = timeout;
  4542. store_hint = 0x01;
  4543. } else{
  4544. store_hint = 0x00;
  4545. }
  4546. hci_dev_unlock(hdev);
  4547. mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
  4548. store_hint, min, max, latency, timeout);
  4549. }
  4550. cp.handle = ev->handle;
  4551. cp.interval_min = ev->interval_min;
  4552. cp.interval_max = ev->interval_max;
  4553. cp.latency = ev->latency;
  4554. cp.timeout = ev->timeout;
  4555. cp.min_ce_len = 0;
  4556. cp.max_ce_len = 0;
  4557. hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
  4558. }
  4559. static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
  4560. struct sk_buff *skb)
  4561. {
  4562. u8 num_reports = skb->data[0];
  4563. struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
  4564. if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
  4565. return;
  4566. hci_dev_lock(hdev);
  4567. for (; num_reports; num_reports--, ev++)
  4568. process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
  4569. ev->bdaddr_type, &ev->direct_addr,
  4570. ev->direct_addr_type, ev->rssi, NULL, 0,
  4571. false);
  4572. hci_dev_unlock(hdev);
  4573. }
  4574. static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4575. {
  4576. struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
  4577. struct hci_conn *conn;
  4578. BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
  4579. if (ev->status)
  4580. return;
  4581. hci_dev_lock(hdev);
  4582. conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
  4583. if (!conn)
  4584. goto unlock;
  4585. conn->le_tx_phy = ev->tx_phy;
  4586. conn->le_rx_phy = ev->rx_phy;
  4587. unlock:
  4588. hci_dev_unlock(hdev);
  4589. }
  4590. static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
  4591. {
  4592. struct hci_ev_le_meta *le_ev = (void *) skb->data;
  4593. skb_pull(skb, sizeof(*le_ev));
  4594. switch (le_ev->subevent) {
  4595. case HCI_EV_LE_CONN_COMPLETE:
  4596. hci_le_conn_complete_evt(hdev, skb);
  4597. break;
  4598. case HCI_EV_LE_CONN_UPDATE_COMPLETE:
  4599. hci_le_conn_update_complete_evt(hdev, skb);
  4600. break;
  4601. case HCI_EV_LE_ADVERTISING_REPORT:
  4602. hci_le_adv_report_evt(hdev, skb);
  4603. break;
  4604. case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
  4605. hci_le_remote_feat_complete_evt(hdev, skb);
  4606. break;
  4607. case HCI_EV_LE_LTK_REQ:
  4608. hci_le_ltk_request_evt(hdev, skb);
  4609. break;
  4610. case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
  4611. hci_le_remote_conn_param_req_evt(hdev, skb);
  4612. break;
  4613. case HCI_EV_LE_DIRECT_ADV_REPORT:
  4614. hci_le_direct_adv_report_evt(hdev, skb);
  4615. break;
  4616. case HCI_EV_LE_PHY_UPDATE_COMPLETE:
  4617. hci_le_phy_update_evt(hdev, skb);
  4618. break;
  4619. case HCI_EV_LE_EXT_ADV_REPORT:
  4620. hci_le_ext_adv_report_evt(hdev, skb);
  4621. break;
  4622. case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
  4623. hci_le_enh_conn_complete_evt(hdev, skb);
  4624. break;
  4625. case HCI_EV_LE_EXT_ADV_SET_TERM:
  4626. hci_le_ext_adv_term_evt(hdev, skb);
  4627. break;
  4628. default:
  4629. break;
  4630. }
  4631. }
  4632. static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
  4633. u8 event, struct sk_buff *skb)
  4634. {
  4635. struct hci_ev_cmd_complete *ev;
  4636. struct hci_event_hdr *hdr;
  4637. if (!skb)
  4638. return false;
  4639. if (skb->len < sizeof(*hdr)) {
  4640. bt_dev_err(hdev, "too short HCI event");
  4641. return false;
  4642. }
  4643. hdr = (void *) skb->data;
  4644. skb_pull(skb, HCI_EVENT_HDR_SIZE);
  4645. if (event) {
  4646. if (hdr->evt != event)
  4647. return false;
  4648. return true;
  4649. }
  4650. /* Check if request ended in Command Status - no way to retreive
  4651. * any extra parameters in this case.
  4652. */
  4653. if (hdr->evt == HCI_EV_CMD_STATUS)
  4654. return false;
  4655. if (hdr->evt != HCI_EV_CMD_COMPLETE) {
  4656. bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
  4657. hdr->evt);
  4658. return false;
  4659. }
  4660. if (skb->len < sizeof(*ev)) {
  4661. bt_dev_err(hdev, "too short cmd_complete event");
  4662. return false;
  4663. }
  4664. ev = (void *) skb->data;
  4665. skb_pull(skb, sizeof(*ev));
  4666. if (opcode != __le16_to_cpu(ev->opcode)) {
  4667. BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
  4668. __le16_to_cpu(ev->opcode));
  4669. return false;
  4670. }
  4671. return true;
  4672. }
  4673. static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
  4674. struct sk_buff *skb)
  4675. {
  4676. struct hci_ev_le_advertising_info *adv;
  4677. struct hci_ev_le_direct_adv_info *direct_adv;
  4678. struct hci_ev_le_ext_adv_report *ext_adv;
  4679. const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
  4680. const struct hci_ev_conn_request *conn_request = (void *)skb->data;
  4681. hci_dev_lock(hdev);
  4682. /* If we are currently suspended and this is the first BT event seen,
  4683. * save the wake reason associated with the event.
  4684. */
  4685. if (!hdev->suspended || hdev->wake_reason)
  4686. goto unlock;
  4687. /* Default to remote wake. Values for wake_reason are documented in the
  4688. * Bluez mgmt api docs.
  4689. */
  4690. hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
  4691. /* Once configured for remote wakeup, we should only wake up for
  4692. * reconnections. It's useful to see which device is waking us up so
  4693. * keep track of the bdaddr of the connection event that woke us up.
  4694. */
  4695. if (event == HCI_EV_CONN_REQUEST) {
  4696. bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
  4697. hdev->wake_addr_type = BDADDR_BREDR;
  4698. } else if (event == HCI_EV_CONN_COMPLETE) {
  4699. bacpy(&hdev->wake_addr, &conn_request->bdaddr);
  4700. hdev->wake_addr_type = BDADDR_BREDR;
  4701. } else if (event == HCI_EV_LE_META) {
  4702. struct hci_ev_le_meta *le_ev = (void *)skb->data;
  4703. u8 subevent = le_ev->subevent;
  4704. u8 *ptr = &skb->data[sizeof(*le_ev)];
  4705. u8 num_reports = *ptr;
  4706. if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
  4707. subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
  4708. subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
  4709. num_reports) {
  4710. adv = (void *)(ptr + 1);
  4711. direct_adv = (void *)(ptr + 1);
  4712. ext_adv = (void *)(ptr + 1);
  4713. switch (subevent) {
  4714. case HCI_EV_LE_ADVERTISING_REPORT:
  4715. bacpy(&hdev->wake_addr, &adv->bdaddr);
  4716. hdev->wake_addr_type = adv->bdaddr_type;
  4717. break;
  4718. case HCI_EV_LE_DIRECT_ADV_REPORT:
  4719. bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
  4720. hdev->wake_addr_type = direct_adv->bdaddr_type;
  4721. break;
  4722. case HCI_EV_LE_EXT_ADV_REPORT:
  4723. bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
  4724. hdev->wake_addr_type = ext_adv->bdaddr_type;
  4725. break;
  4726. }
  4727. }
  4728. } else {
  4729. hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
  4730. }
  4731. unlock:
  4732. hci_dev_unlock(hdev);
  4733. }
  4734. void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
  4735. {
  4736. struct hci_event_hdr *hdr = (void *) skb->data;
  4737. hci_req_complete_t req_complete = NULL;
  4738. hci_req_complete_skb_t req_complete_skb = NULL;
  4739. struct sk_buff *orig_skb = NULL;
  4740. u8 status = 0, event = hdr->evt, req_evt = 0;
  4741. u16 opcode = HCI_OP_NOP;
  4742. if (!event) {
  4743. bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
  4744. goto done;
  4745. }
  4746. if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
  4747. struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
  4748. opcode = __le16_to_cpu(cmd_hdr->opcode);
  4749. hci_req_cmd_complete(hdev, opcode, status, &req_complete,
  4750. &req_complete_skb);
  4751. req_evt = event;
  4752. }
  4753. /* If it looks like we might end up having to call
  4754. * req_complete_skb, store a pristine copy of the skb since the
  4755. * various handlers may modify the original one through
  4756. * skb_pull() calls, etc.
  4757. */
  4758. if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
  4759. event == HCI_EV_CMD_COMPLETE)
  4760. orig_skb = skb_clone(skb, GFP_KERNEL);
  4761. skb_pull(skb, HCI_EVENT_HDR_SIZE);
  4762. /* Store wake reason if we're suspended */
  4763. hci_store_wake_reason(hdev, event, skb);
  4764. switch (event) {
  4765. case HCI_EV_INQUIRY_COMPLETE:
  4766. hci_inquiry_complete_evt(hdev, skb);
  4767. break;
  4768. case HCI_EV_INQUIRY_RESULT:
  4769. hci_inquiry_result_evt(hdev, skb);
  4770. break;
  4771. case HCI_EV_CONN_COMPLETE:
  4772. hci_conn_complete_evt(hdev, skb);
  4773. break;
  4774. case HCI_EV_CONN_REQUEST:
  4775. hci_conn_request_evt(hdev, skb);
  4776. break;
  4777. case HCI_EV_DISCONN_COMPLETE:
  4778. hci_disconn_complete_evt(hdev, skb);
  4779. break;
  4780. case HCI_EV_AUTH_COMPLETE:
  4781. hci_auth_complete_evt(hdev, skb);
  4782. break;
  4783. case HCI_EV_REMOTE_NAME:
  4784. hci_remote_name_evt(hdev, skb);
  4785. break;
  4786. case HCI_EV_ENCRYPT_CHANGE:
  4787. hci_encrypt_change_evt(hdev, skb);
  4788. break;
  4789. case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
  4790. hci_change_link_key_complete_evt(hdev, skb);
  4791. break;
  4792. case HCI_EV_REMOTE_FEATURES:
  4793. hci_remote_features_evt(hdev, skb);
  4794. break;
  4795. case HCI_EV_CMD_COMPLETE:
  4796. hci_cmd_complete_evt(hdev, skb, &opcode, &status,
  4797. &req_complete, &req_complete_skb);
  4798. break;
  4799. case HCI_EV_CMD_STATUS:
  4800. hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
  4801. &req_complete_skb);
  4802. break;
  4803. case HCI_EV_HARDWARE_ERROR:
  4804. hci_hardware_error_evt(hdev, skb);
  4805. break;
  4806. case HCI_EV_ROLE_CHANGE:
  4807. hci_role_change_evt(hdev, skb);
  4808. break;
  4809. case HCI_EV_NUM_COMP_PKTS:
  4810. hci_num_comp_pkts_evt(hdev, skb);
  4811. break;
  4812. case HCI_EV_MODE_CHANGE:
  4813. hci_mode_change_evt(hdev, skb);
  4814. break;
  4815. case HCI_EV_PIN_CODE_REQ:
  4816. hci_pin_code_request_evt(hdev, skb);
  4817. break;
  4818. case HCI_EV_LINK_KEY_REQ:
  4819. hci_link_key_request_evt(hdev, skb);
  4820. break;
  4821. case HCI_EV_LINK_KEY_NOTIFY:
  4822. hci_link_key_notify_evt(hdev, skb);
  4823. break;
  4824. case HCI_EV_CLOCK_OFFSET:
  4825. hci_clock_offset_evt(hdev, skb);
  4826. break;
  4827. case HCI_EV_PKT_TYPE_CHANGE:
  4828. hci_pkt_type_change_evt(hdev, skb);
  4829. break;
  4830. case HCI_EV_PSCAN_REP_MODE:
  4831. hci_pscan_rep_mode_evt(hdev, skb);
  4832. break;
  4833. case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
  4834. hci_inquiry_result_with_rssi_evt(hdev, skb);
  4835. break;
  4836. case HCI_EV_REMOTE_EXT_FEATURES:
  4837. hci_remote_ext_features_evt(hdev, skb);
  4838. break;
  4839. case HCI_EV_SYNC_CONN_COMPLETE:
  4840. hci_sync_conn_complete_evt(hdev, skb);
  4841. break;
  4842. case HCI_EV_EXTENDED_INQUIRY_RESULT:
  4843. hci_extended_inquiry_result_evt(hdev, skb);
  4844. break;
  4845. case HCI_EV_KEY_REFRESH_COMPLETE:
  4846. hci_key_refresh_complete_evt(hdev, skb);
  4847. break;
  4848. case HCI_EV_IO_CAPA_REQUEST:
  4849. hci_io_capa_request_evt(hdev, skb);
  4850. break;
  4851. case HCI_EV_IO_CAPA_REPLY:
  4852. hci_io_capa_reply_evt(hdev, skb);
  4853. break;
  4854. case HCI_EV_USER_CONFIRM_REQUEST:
  4855. hci_user_confirm_request_evt(hdev, skb);
  4856. break;
  4857. case HCI_EV_USER_PASSKEY_REQUEST:
  4858. hci_user_passkey_request_evt(hdev, skb);
  4859. break;
  4860. case HCI_EV_USER_PASSKEY_NOTIFY:
  4861. hci_user_passkey_notify_evt(hdev, skb);
  4862. break;
  4863. case HCI_EV_KEYPRESS_NOTIFY:
  4864. hci_keypress_notify_evt(hdev, skb);
  4865. break;
  4866. case HCI_EV_SIMPLE_PAIR_COMPLETE:
  4867. hci_simple_pair_complete_evt(hdev, skb);
  4868. break;
  4869. case HCI_EV_REMOTE_HOST_FEATURES:
  4870. hci_remote_host_features_evt(hdev, skb);
  4871. break;
  4872. case HCI_EV_LE_META:
  4873. hci_le_meta_evt(hdev, skb);
  4874. break;
  4875. case HCI_EV_REMOTE_OOB_DATA_REQUEST:
  4876. hci_remote_oob_data_request_evt(hdev, skb);
  4877. break;
  4878. #if IS_ENABLED(CONFIG_BT_HS)
  4879. case HCI_EV_CHANNEL_SELECTED:
  4880. hci_chan_selected_evt(hdev, skb);
  4881. break;
  4882. case HCI_EV_PHY_LINK_COMPLETE:
  4883. hci_phy_link_complete_evt(hdev, skb);
  4884. break;
  4885. case HCI_EV_LOGICAL_LINK_COMPLETE:
  4886. hci_loglink_complete_evt(hdev, skb);
  4887. break;
  4888. case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
  4889. hci_disconn_loglink_complete_evt(hdev, skb);
  4890. break;
  4891. case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
  4892. hci_disconn_phylink_complete_evt(hdev, skb);
  4893. break;
  4894. #endif
  4895. case HCI_EV_NUM_COMP_BLOCKS:
  4896. hci_num_comp_blocks_evt(hdev, skb);
  4897. break;
  4898. case HCI_EV_VENDOR:
  4899. msft_vendor_evt(hdev, skb);
  4900. break;
  4901. default:
  4902. BT_DBG("%s event 0x%2.2x", hdev->name, event);
  4903. break;
  4904. }
  4905. if (req_complete) {
  4906. req_complete(hdev, status, opcode);
  4907. } else if (req_complete_skb) {
  4908. if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
  4909. kfree_skb(orig_skb);
  4910. orig_skb = NULL;
  4911. }
  4912. req_complete_skb(hdev, status, opcode, orig_skb);
  4913. }
  4914. done:
  4915. kfree_skb(orig_skb);
  4916. kfree_skb(skb);
  4917. hdev->stat.evt_rx++;
  4918. }