1 files changed, 279 insertions, 49 deletions

diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 77930aa522e..5a7074a7b5b 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -45,6 +45,8 @@
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
 
+static int enable_le;
+
 /* Handle HCI Event packets */
 
 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
@@ -56,8 +58,8 @@ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                        test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
@@ -74,8 +76,8 @@ static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
         if (status)
                 return;
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_conn_check_pending(hdev);
@@ -525,6 +527,20 @@ static void hci_setup_event_mask(struct hci_dev *hdev)
         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 }
 
+static void hci_set_le_support(struct hci_dev *hdev)
+{
+        struct hci_cp_write_le_host_supported cp;
+
+        memset(&cp, 0, sizeof(cp));
+
+        if (enable_le) {
+                cp.le = 1;
+                cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+        }
+
+        hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
+}
+
 static void hci_setup(struct hci_dev *hdev)
 {
         hci_setup_event_mask(hdev);
@@ -542,6 +558,17 @@ static void hci_setup(struct hci_dev *hdev)
 
         if (hdev->features[7] & LMP_INQ_TX_PWR)
                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
+
+        if (hdev->features[7] & LMP_EXTFEATURES) {
+                struct hci_cp_read_local_ext_features cp;
+
+                cp.page = 0x01;
+                hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
+                                                        sizeof(cp), &cp);
+        }
+
+        if (hdev->features[4] & LMP_LE)
+                hci_set_le_support(hdev);
 }
 
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
@@ -658,6 +685,21 @@ static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb
                                         hdev->features[6], hdev->features[7]);
 }
 
+static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        memcpy(hdev->extfeatures, rp->features, 8);
+
+        hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
+}
+
 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
@@ -841,6 +883,72 @@ static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
                                                 rp->randomizer, rp->status);
 }
 
+static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
+                                        struct sk_buff *skb)
+{
+        struct hci_cp_le_set_scan_enable *cp;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status)
+                return;
+
+        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
+        if (!cp)
+                return;
+
+        hci_dev_lock(hdev);
+
+        if (cp->enable == 0x01) {
+                del_timer(&hdev->adv_timer);
+                hci_adv_entries_clear(hdev);
+        } else if (cp->enable == 0x00) {
+                mod_timer(&hdev->adv_timer, jiffies + ADV_CLEAR_TIMEOUT);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
+}
+
+static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
+{
+        struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
+
+        BT_DBG("%s status 0x%x", hdev->name, rp->status);
+
+        if (rp->status)
+                return;
+
+        hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
+}
+
+static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
+                                                        struct sk_buff *skb)
+{
+        struct hci_cp_read_local_ext_features cp;
+        __u8 status = *((__u8 *) skb->data);
+
+        BT_DBG("%s status 0x%x", hdev->name, status);
+
+        if (status)
+                return;
+
+        cp.page = 0x01;
+        hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
+}
+
 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 {
         BT_DBG("%s status 0x%x", hdev->name, status);
@@ -851,9 +959,8 @@ static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
                 return;
         }
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                        !test_and_set_bit(HCI_INQUIRY,
-                                                        &hdev->flags))
+        if (!test_and_set_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 1);
 }
 
@@ -885,7 +992,7 @@ static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
                 }
         } else {
                 if (!conn) {
-                        conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
+                        conn = hci_conn_add(hdev, ACL_LINK, 0, &cp->bdaddr);
                         if (conn) {
                                 conn->out = 1;
                                 conn->link_mode |= HCI_LM_MASTER;
@@ -1208,25 +1315,32 @@ static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
                 }
         } else {
                 if (!conn) {
-                        conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
-                        if (conn)
+                        conn = hci_conn_add(hdev, LE_LINK, 0, &cp->peer_addr);
+                        if (conn) {
+                                conn->dst_type = cp->peer_addr_type;
                                 conn->out = 1;
-                        else
+                        } else {
                                 BT_ERR("No memory for new connection");
+                        }
                 }
         }
 
         hci_dev_unlock(hdev);
 }
 
+static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
+{
+        BT_DBG("%s status 0x%x", hdev->name, status);
+}
+
 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         __u8 status = *((__u8 *) skb->data);
 
         BT_DBG("%s status %d", hdev->name, status);
 
-        if (test_bit(HCI_MGMT, &hdev->flags) &&
-                                test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
+        if (test_and_clear_bit(HCI_INQUIRY, &hdev->flags) &&
+                                test_bit(HCI_MGMT, &hdev->flags))
                 mgmt_discovering(hdev->id, 0);
 
         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
@@ -1348,6 +1462,15 @@ unlock:
         hci_conn_check_pending(hdev);
 }
 
+static inline bool is_sco_active(struct hci_dev *hdev)
+{
+        if (hci_conn_hash_lookup_state(hdev, SCO_LINK, BT_CONNECTED) ||
+                        (hci_conn_hash_lookup_state(hdev, ESCO_LINK,
+                                                    BT_CONNECTED)))
+                return true;
+        return false;
+}
+
 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_conn_request *ev = (void *) skb->data;
@@ -1372,7 +1495,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
                 if (!conn) {
-                        conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
+                        /* pkt_type not yet used for incoming connections */
+                        conn = hci_conn_add(hdev, ev->link_type, 0, &ev->bdaddr);
                         if (!conn) {
                                 BT_ERR("No memory for new connection");
                                 hci_dev_unlock(hdev);
@@ -1390,7 +1514,8 @@ static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *sk
 
                         bacpy(&cp.bdaddr, &ev->bdaddr);
 
-                        if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
+                        if (lmp_rswitch_capable(hdev) && ((mask & HCI_LM_MASTER)
+                                                || is_sco_active(hdev)))
                                 cp.role = 0x00; /* Become master */
                         else
                                 cp.role = 0x01; /* Remain slave */
@@ -1462,51 +1587,58 @@ static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *s
         hci_dev_lock(hdev);
 
         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
-        if (conn) {
-                if (!ev->status) {
+        if (!conn)
+                goto unlock;
+
+        if (!ev->status) {
+                if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
+                                test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
+                        BT_INFO("re-auth of legacy device is not possible.");
+                } else {
                         conn->link_mode |= HCI_LM_AUTH;
                         conn->sec_level = conn->pending_sec_level;
-                } else {
-                        mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
                 }
+        } else {
+                mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
+        }
 
-                clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+        clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
+        clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
 
-                if (conn->state == BT_CONFIG) {
-                        if (!ev->status && hdev->ssp_mode > 0 &&
-                                                        conn->ssp_mode > 0) {
-                                struct hci_cp_set_conn_encrypt cp;
-                                cp.handle  = ev->handle;
-                                cp.encrypt = 0x01;
-                                hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                conn->state = BT_CONNECTED;
-                                hci_proto_connect_cfm(conn, ev->status);
-                                hci_conn_put(conn);
-                        }
+        if (conn->state == BT_CONFIG) {
+                if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
+                        struct hci_cp_set_conn_encrypt cp;
+                        cp.handle  = ev->handle;
+                        cp.encrypt = 0x01;
+                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
                 } else {
-                        hci_auth_cfm(conn, ev->status);
-
-                        hci_conn_hold(conn);
-                        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                        conn->state = BT_CONNECTED;
+                        hci_proto_connect_cfm(conn, ev->status);
                         hci_conn_put(conn);
                 }
+        } else {
+                hci_auth_cfm(conn, ev->status);
 
-                if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
-                        if (!ev->status) {
-                                struct hci_cp_set_conn_encrypt cp;
-                                cp.handle  = ev->handle;
-                                cp.encrypt = 0x01;
-                                hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT,
-                                                        sizeof(cp), &cp);
-                        } else {
-                                clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
-                                hci_encrypt_cfm(conn, ev->status, 0x00);
-                        }
+                hci_conn_hold(conn);
+                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
+                hci_conn_put(conn);
+        }
+
+        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
+                if (!ev->status) {
+                        struct hci_cp_set_conn_encrypt cp;
+                        cp.handle  = ev->handle;
+                        cp.encrypt = 0x01;
+                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
+                                                                        &cp);
+                } else {
+                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+                        hci_encrypt_cfm(conn, ev->status, 0x00);
                 }
         }
 
+unlock:
         hci_dev_unlock(hdev);
 }
 
@@ -1557,6 +1689,7 @@ static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *
                                 /* Encryption implies authentication */
                                 conn->link_mode |= HCI_LM_AUTH;
                                 conn->link_mode |= HCI_LM_ENCRYPT;
+                                conn->sec_level = conn->pending_sec_level;
                         } else
                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
                 }
@@ -1760,6 +1893,10 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_read_local_features(hdev, skb);
                 break;
 
+        case HCI_OP_READ_LOCAL_EXT_FEATURES:
+                hci_cc_read_local_ext_features(hdev, skb);
+                break;
+
         case HCI_OP_READ_BUFFER_SIZE:
                 hci_cc_read_buffer_size(hdev, skb);
                 break;
@@ -1816,6 +1953,22 @@ static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *sk
                 hci_cc_user_confirm_neg_reply(hdev, skb);
                 break;
 
+        case HCI_OP_LE_SET_SCAN_ENABLE:
+                hci_cc_le_set_scan_enable(hdev, skb);
+                break;
+
+        case HCI_OP_LE_LTK_REPLY:
+                hci_cc_le_ltk_reply(hdev, skb);
+                break;
+
+        case HCI_OP_LE_LTK_NEG_REPLY:
+                hci_cc_le_ltk_neg_reply(hdev, skb);
+                break;
+
+        case HCI_OP_WRITE_LE_HOST_SUPPORTED:
+                hci_cc_write_le_host_supported(hdev, skb);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
@@ -1894,6 +2047,10 @@ static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_cs_le_create_conn(hdev, ev->status);
                 break;
 
+        case HCI_OP_LE_START_ENC:
+                hci_cs_le_start_enc(hdev, ev->status);
+                break;
+
         default:
                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
                 break;
@@ -2333,6 +2490,7 @@ static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_bu
                 hci_conn_add_sysfs(conn);
                 break;
 
+        case 0x10:      /* Connection Accept Timeout */
         case 0x11:      /* Unsupported Feature or Parameter Value */
         case 0x1c:      /* SCO interval rejected */
         case 0x1a:      /* Unsupported Remote Feature */
@@ -2652,12 +2810,14 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
         if (!conn) {
-                conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
+                conn = hci_conn_add(hdev, LE_LINK, 0, &ev->bdaddr);
                 if (!conn) {
                         BT_ERR("No memory for new connection");
                         hci_dev_unlock(hdev);
                         return;
                 }
+
+                conn->dst_type = ev->bdaddr_type;
         }
 
         if (ev->status) {
@@ -2670,6 +2830,7 @@ static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff
 
         mgmt_connected(hdev->id, &ev->bdaddr);
 
+        conn->sec_level = BT_SECURITY_LOW;
         conn->handle = __le16_to_cpu(ev->handle);
         conn->state = BT_CONNECTED;
 
@@ -2682,6 +2843,64 @@ unlock:
         hci_dev_unlock(hdev);
 }
 
+static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
+                                                struct sk_buff *skb)
+{
+        struct hci_ev_le_advertising_info *ev;
+        u8 num_reports;
+
+        num_reports = skb->data[0];
+        ev = (void *) &skb->data[1];
+
+        hci_dev_lock(hdev);
+
+        hci_add_adv_entry(hdev, ev);
+
+        while (--num_reports) {
+                ev = (void *) (ev->data + ev->length + 1);
+                hci_add_adv_entry(hdev, ev);
+        }
+
+        hci_dev_unlock(hdev);
+}
+
+static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
+                                                struct sk_buff *skb)
+{
+        struct hci_ev_le_ltk_req *ev = (void *) skb->data;
+        struct hci_cp_le_ltk_reply cp;
+        struct hci_cp_le_ltk_neg_reply neg;
+        struct hci_conn *conn;
+        struct link_key *ltk;
+
+        BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
+
+        hci_dev_lock(hdev);
+
+        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
+        if (conn == NULL)
+                goto not_found;
+
+        ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
+        if (ltk == NULL)
+                goto not_found;
+
+        memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
+        cp.handle = cpu_to_le16(conn->handle);
+        conn->pin_length = ltk->pin_len;
+
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+
+        hci_dev_unlock(hdev);
+
+        return;
+
+not_found:
+        neg.handle = ev->handle;
+        hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
+        hci_dev_unlock(hdev);
+}
+
 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
 {
         struct hci_ev_le_meta *le_ev = (void *) skb->data;
@@ -2693,6 +2912,14 @@ static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
                 hci_le_conn_complete_evt(hdev, skb);
                 break;
 
+        case HCI_EV_LE_ADVERTISING_REPORT:
+                hci_le_adv_report_evt(hdev, skb);
+                break;
+
+        case HCI_EV_LE_LTK_REQ:
+                hci_le_ltk_request_evt(hdev, skb);
+                break;
+
         default:
                 break;
         }
@@ -2886,3 +3113,6 @@ void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
         hci_send_to_sock(hdev, skb, NULL);
         kfree_skb(skb);
 }
+
+module_param(enable_le, bool, 0444);
+MODULE_PARM_DESC(enable_le, "Enable LE support");