net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 /* Handle HCI Event packets */
  44
  45 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  46                                   u8 *new_status)
  47 {
  48         __u8 status = *((__u8 *) skb->data);
  49
  50         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  51
  52         /* It is possible that we receive Inquiry Complete event right
  53          * before we receive Inquiry Cancel Command Complete event, in
  54          * which case the latter event should have status of Command
  55          * Disallowed (0x0c). This should not be treated as error, since
  56          * we actually achieve what Inquiry Cancel wants to achieve,
  57          * which is to end the last Inquiry session.
  58          */
  59         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  60                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  61                 status = 0x00;
  62         }
  63
  64         *new_status = status;
  65
  66         if (status)
  67                 return;
  68
  69         clear_bit(HCI_INQUIRY, &hdev->flags);
  70         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  71         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  72
  73         hci_dev_lock(hdev);
  74         /* Set discovery state to stopped if we're not doing LE active
  75          * scanning.
  76          */
  77         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  78             hdev->le_scan_type != LE_SCAN_ACTIVE)
  79                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  80         hci_dev_unlock(hdev);
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         __u8 status = *((__u8 *) skb->data);
  88
  89         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  90
  91         if (status)
  92                 return;
  93
  94         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  95 }
  96
  97 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  98 {
  99         __u8 status = *((__u8 *) skb->data);
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 102
 103         if (status)
 104                 return;
 105
 106         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 107
 108         hci_conn_check_pending(hdev);
 109 }
 110
 111 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 112                                           struct sk_buff *skb)
 113 {
 114         BT_DBG("%s", hdev->name);
 115 }
 116
 117 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 118 {
 119         struct hci_rp_role_discovery *rp = (void *) skb->data;
 120         struct hci_conn *conn;
 121
 122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 123
 124         if (rp->status)
 125                 return;
 126
 127         hci_dev_lock(hdev);
 128
 129         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 130         if (conn)
 131                 conn->role = rp->role;
 132
 133         hci_dev_unlock(hdev);
 134 }
 135
 136 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 137 {
 138         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 139         struct hci_conn *conn;
 140
 141         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         hci_dev_lock(hdev);
 147
 148         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 149         if (conn)
 150                 conn->link_policy = __le16_to_cpu(rp->policy);
 151
 152         hci_dev_unlock(hdev);
 153 }
 154
 155 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 156 {
 157         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 158         struct hci_conn *conn;
 159         void *sent;
 160
 161         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 162
 163         if (rp->status)
 164                 return;
 165
 166         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 167         if (!sent)
 168                 return;
 169
 170         hci_dev_lock(hdev);
 171
 172         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 173         if (conn)
 174                 conn->link_policy = get_unaligned_le16(sent + 2);
 175
 176         hci_dev_unlock(hdev);
 177 }
 178
 179 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 180                                         struct sk_buff *skb)
 181 {
 182         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 183
 184         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 185
 186         if (rp->status)
 187                 return;
 188
 189         hdev->link_policy = __le16_to_cpu(rp->policy);
 190 }
 191
 192 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 193                                          struct sk_buff *skb)
 194 {
 195         __u8 status = *((__u8 *) skb->data);
 196         void *sent;
 197
 198         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200         if (status)
 201                 return;
 202
 203         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 204         if (!sent)
 205                 return;
 206
 207         hdev->link_policy = get_unaligned_le16(sent);
 208 }
 209
 210 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 211 {
 212         __u8 status = *((__u8 *) skb->data);
 213
 214         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 215
 216         clear_bit(HCI_RESET, &hdev->flags);
 217
 218         if (status)
 219                 return;
 220
 221         /* Reset all non-persistent flags */
 222         hci_dev_clear_volatile_flags(hdev);
 223
 224         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 225
 226         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230         hdev->adv_data_len = 0;
 231
 232         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233         hdev->scan_rsp_data_len = 0;
 234
 235         hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237         hdev->ssp_debug_mode = 0;
 238
 239         hci_bdaddr_list_clear(&hdev->le_white_list);
 240         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 241 }
 242
 243 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 244                                         struct sk_buff *skb)
 245 {
 246         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 247         struct hci_cp_read_stored_link_key *sent;
 248
 249         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 250
 251         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 252         if (!sent)
 253                 return;
 254
 255         if (!rp->status && sent->read_all == 0x01) {
 256                 hdev->stored_max_keys = rp->max_keys;
 257                 hdev->stored_num_keys = rp->num_keys;
 258         }
 259 }
 260
 261 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 262                                           struct sk_buff *skb)
 263 {
 264         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 267
 268         if (rp->status)
 269                 return;
 270
 271         if (rp->num_keys <= hdev->stored_num_keys)
 272                 hdev->stored_num_keys -= rp->num_keys;
 273         else
 274                 hdev->stored_num_keys = 0;
 275 }
 276
 277 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 278 {
 279         __u8 status = *((__u8 *) skb->data);
 280         void *sent;
 281
 282         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 283
 284         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 285         if (!sent)
 286                 return;
 287
 288         hci_dev_lock(hdev);
 289
 290         if (hci_dev_test_flag(hdev, HCI_MGMT))
 291                 mgmt_set_local_name_complete(hdev, sent, status);
 292         else if (!status)
 293                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 294
 295         hci_dev_unlock(hdev);
 296 }
 297
 298 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 299 {
 300         struct hci_rp_read_local_name *rp = (void *) skb->data;
 301
 302         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 303
 304         if (rp->status)
 305                 return;
 306
 307         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 308             hci_dev_test_flag(hdev, HCI_CONFIG))
 309                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 310 }
 311
 312 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 313 {
 314         __u8 status = *((__u8 *) skb->data);
 315         void *sent;
 316
 317         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 318
 319         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 320         if (!sent)
 321                 return;
 322
 323         hci_dev_lock(hdev);
 324
 325         if (!status) {
 326                 __u8 param = *((__u8 *) sent);
 327
 328                 if (param == AUTH_ENABLED)
 329                         set_bit(HCI_AUTH, &hdev->flags);
 330                 else
 331                         clear_bit(HCI_AUTH, &hdev->flags);
 332         }
 333
 334         if (hci_dev_test_flag(hdev, HCI_MGMT))
 335                 mgmt_auth_enable_complete(hdev, status);
 336
 337         hci_dev_unlock(hdev);
 338 }
 339
 340 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 341 {
 342         __u8 status = *((__u8 *) skb->data);
 343         __u8 param;
 344         void *sent;
 345
 346         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 347
 348         if (status)
 349                 return;
 350
 351         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 352         if (!sent)
 353                 return;
 354
 355         param = *((__u8 *) sent);
 356
 357         if (param)
 358                 set_bit(HCI_ENCRYPT, &hdev->flags);
 359         else
 360                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 361 }
 362
 363 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 364 {
 365         __u8 status = *((__u8 *) skb->data);
 366         __u8 param;
 367         void *sent;
 368
 369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 370
 371         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 372         if (!sent)
 373                 return;
 374
 375         param = *((__u8 *) sent);
 376
 377         hci_dev_lock(hdev);
 378
 379         if (status) {
 380                 hdev->discov_timeout = 0;
 381                 goto done;
 382         }
 383
 384         if (param & SCAN_INQUIRY)
 385                 set_bit(HCI_ISCAN, &hdev->flags);
 386         else
 387                 clear_bit(HCI_ISCAN, &hdev->flags);
 388
 389         if (param & SCAN_PAGE)
 390                 set_bit(HCI_PSCAN, &hdev->flags);
 391         else
 392                 clear_bit(HCI_PSCAN, &hdev->flags);
 393
 394 done:
 395         hci_dev_unlock(hdev);
 396 }
 397
 398 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 399 {
 400         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 403
 404         if (rp->status)
 405                 return;
 406
 407         memcpy(hdev->dev_class, rp->dev_class, 3);
 408
 409         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 410                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 411 }
 412
 413 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416         void *sent;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 419
 420         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 421         if (!sent)
 422                 return;
 423
 424         hci_dev_lock(hdev);
 425
 426         if (status == 0)
 427                 memcpy(hdev->dev_class, sent, 3);
 428
 429         if (hci_dev_test_flag(hdev, HCI_MGMT))
 430                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 431
 432         hci_dev_unlock(hdev);
 433 }
 434
 435 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 436 {
 437         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 438         __u16 setting;
 439
 440         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 441
 442         if (rp->status)
 443                 return;
 444
 445         setting = __le16_to_cpu(rp->voice_setting);
 446
 447         if (hdev->voice_setting == setting)
 448                 return;
 449
 450         hdev->voice_setting = setting;
 451
 452         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 453
 454         if (hdev->notify)
 455                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 456 }
 457
 458 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 459                                        struct sk_buff *skb)
 460 {
 461         __u8 status = *((__u8 *) skb->data);
 462         __u16 setting;
 463         void *sent;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 466
 467         if (status)
 468                 return;
 469
 470         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 471         if (!sent)
 472                 return;
 473
 474         setting = get_unaligned_le16(sent);
 475
 476         if (hdev->voice_setting == setting)
 477                 return;
 478
 479         hdev->voice_setting = setting;
 480
 481         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 482
 483         if (hdev->notify)
 484                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 485 }
 486
 487 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 488                                           struct sk_buff *skb)
 489 {
 490         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 491
 492         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 493
 494         if (rp->status)
 495                 return;
 496
 497         hdev->num_iac = rp->num_iac;
 498
 499         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 500 }
 501
 502 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 503 {
 504         __u8 status = *((__u8 *) skb->data);
 505         struct hci_cp_write_ssp_mode *sent;
 506
 507         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 508
 509         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 510         if (!sent)
 511                 return;
 512
 513         hci_dev_lock(hdev);
 514
 515         if (!status) {
 516                 if (sent->mode)
 517                         hdev->features[1][0] |= LMP_HOST_SSP;
 518                 else
 519                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 520         }
 521
 522         if (hci_dev_test_flag(hdev, HCI_MGMT))
 523                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 524         else if (!status) {
 525                 if (sent->mode)
 526                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 527                 else
 528                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 529         }
 530
 531         hci_dev_unlock(hdev);
 532 }
 533
 534 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 535 {
 536         u8 status = *((u8 *) skb->data);
 537         struct hci_cp_write_sc_support *sent;
 538
 539         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 540
 541         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 542         if (!sent)
 543                 return;
 544
 545         hci_dev_lock(hdev);
 546
 547         if (!status) {
 548                 if (sent->support)
 549                         hdev->features[1][0] |= LMP_HOST_SC;
 550                 else
 551                         hdev->features[1][0] &= ~LMP_HOST_SC;
 552         }
 553
 554         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 555                 if (sent->support)
 556                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 557                 else
 558                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 559         }
 560
 561         hci_dev_unlock(hdev);
 562 }
 563
 564 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 565 {
 566         struct hci_rp_read_local_version *rp = (void *) skb->data;
 567
 568         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 569
 570         if (rp->status)
 571                 return;
 572
 573         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 574             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 575                 hdev->hci_ver = rp->hci_ver;
 576                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 577                 hdev->lmp_ver = rp->lmp_ver;
 578                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 579                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 580         }
 581 }
 582
 583 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 584                                        struct sk_buff *skb)
 585 {
 586         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 587
 588         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 589
 590         if (rp->status)
 591                 return;
 592
 593         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 594             hci_dev_test_flag(hdev, HCI_CONFIG))
 595                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 596 }
 597
 598 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 599                                              struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 602         struct hci_conn *conn;
 603
 604         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 605
 606         if (rp->status)
 607                 return;
 608
 609         hci_dev_lock(hdev);
 610
 611         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 612         if (conn)
 613                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 614
 615         hci_dev_unlock(hdev);
 616 }
 617
 618 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 619                                               struct sk_buff *skb)
 620 {
 621         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 622         struct hci_conn *conn;
 623         void *sent;
 624
 625         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 626
 627         if (rp->status)
 628                 return;
 629
 630         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 631         if (!sent)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_read_local_features(struct hci_dev *hdev,
 644                                        struct sk_buff *skb)
 645 {
 646         struct hci_rp_read_local_features *rp = (void *) skb->data;
 647
 648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650         if (rp->status)
 651                 return;
 652
 653         memcpy(hdev->features, rp->features, 8);
 654
 655         /* Adjust default settings according to features
 656          * supported by device. */
 657
 658         if (hdev->features[0][0] & LMP_3SLOT)
 659                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 660
 661         if (hdev->features[0][0] & LMP_5SLOT)
 662                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 663
 664         if (hdev->features[0][1] & LMP_HV2) {
 665                 hdev->pkt_type  |= (HCI_HV2);
 666                 hdev->esco_type |= (ESCO_HV2);
 667         }
 668
 669         if (hdev->features[0][1] & LMP_HV3) {
 670                 hdev->pkt_type  |= (HCI_HV3);
 671                 hdev->esco_type |= (ESCO_HV3);
 672         }
 673
 674         if (lmp_esco_capable(hdev))
 675                 hdev->esco_type |= (ESCO_EV3);
 676
 677         if (hdev->features[0][4] & LMP_EV4)
 678                 hdev->esco_type |= (ESCO_EV4);
 679
 680         if (hdev->features[0][4] & LMP_EV5)
 681                 hdev->esco_type |= (ESCO_EV5);
 682
 683         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 684                 hdev->esco_type |= (ESCO_2EV3);
 685
 686         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 687                 hdev->esco_type |= (ESCO_3EV3);
 688
 689         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 690                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 691 }
 692
 693 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 694                                            struct sk_buff *skb)
 695 {
 696         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 697
 698         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 699
 700         if (rp->status)
 701                 return;
 702
 703         if (hdev->max_page < rp->max_page)
 704                 hdev->max_page = rp->max_page;
 705
 706         if (rp->page < HCI_MAX_PAGES)
 707                 memcpy(hdev->features[rp->page], rp->features, 8);
 708 }
 709
 710 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 711                                           struct sk_buff *skb)
 712 {
 713         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 714
 715         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 716
 717         if (rp->status)
 718                 return;
 719
 720         hdev->flow_ctl_mode = rp->mode;
 721 }
 722
 723 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 724 {
 725         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 726
 727         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 728
 729         if (rp->status)
 730                 return;
 731
 732         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 733         hdev->sco_mtu  = rp->sco_mtu;
 734         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 735         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 736
 737         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 738                 hdev->sco_mtu  = 64;
 739                 hdev->sco_pkts = 8;
 740         }
 741
 742         hdev->acl_cnt = hdev->acl_pkts;
 743         hdev->sco_cnt = hdev->sco_pkts;
 744
 745         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 746                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 747 }
 748
 749 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 750 {
 751         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 754
 755         if (rp->status)
 756                 return;
 757
 758         if (test_bit(HCI_INIT, &hdev->flags))
 759                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 760
 761         if (hci_dev_test_flag(hdev, HCI_SETUP))
 762                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 763 }
 764
 765 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 766                                            struct sk_buff *skb)
 767 {
 768         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 769
 770         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 771
 772         if (rp->status)
 773                 return;
 774
 775         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 776             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 777                 hdev->pairing_opts = rp->pairing_opts;
 778                 hdev->max_enc_key_size = rp->max_key_size;
 779         }
 780 }
 781
 782 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 783                                            struct sk_buff *skb)
 784 {
 785         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 786
 787         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 788
 789         if (rp->status)
 790                 return;
 791
 792         if (test_bit(HCI_INIT, &hdev->flags)) {
 793                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 794                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 795         }
 796 }
 797
 798 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 799                                             struct sk_buff *skb)
 800 {
 801         u8 status = *((u8 *) skb->data);
 802         struct hci_cp_write_page_scan_activity *sent;
 803
 804         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 805
 806         if (status)
 807                 return;
 808
 809         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 810         if (!sent)
 811                 return;
 812
 813         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 814         hdev->page_scan_window = __le16_to_cpu(sent->window);
 815 }
 816
 817 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 818                                            struct sk_buff *skb)
 819 {
 820         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 821
 822         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 823
 824         if (rp->status)
 825                 return;
 826
 827         if (test_bit(HCI_INIT, &hdev->flags))
 828                 hdev->page_scan_type = rp->type;
 829 }
 830
 831 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 832                                         struct sk_buff *skb)
 833 {
 834         u8 status = *((u8 *) skb->data);
 835         u8 *type;
 836
 837         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 838
 839         if (status)
 840                 return;
 841
 842         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 843         if (type)
 844                 hdev->page_scan_type = *type;
 845 }
 846
 847 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 848                                         struct sk_buff *skb)
 849 {
 850         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 851
 852         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 853
 854         if (rp->status)
 855                 return;
 856
 857         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 858         hdev->block_len = __le16_to_cpu(rp->block_len);
 859         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 860
 861         hdev->block_cnt = hdev->num_blocks;
 862
 863         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 864                hdev->block_cnt, hdev->block_len);
 865 }
 866
 867 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 868 {
 869         struct hci_rp_read_clock *rp = (void *) skb->data;
 870         struct hci_cp_read_clock *cp;
 871         struct hci_conn *conn;
 872
 873         BT_DBG("%s", hdev->name);
 874
 875         if (skb->len < sizeof(*rp))
 876                 return;
 877
 878         if (rp->status)
 879                 return;
 880
 881         hci_dev_lock(hdev);
 882
 883         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 884         if (!cp)
 885                 goto unlock;
 886
 887         if (cp->which == 0x00) {
 888                 hdev->clock = le32_to_cpu(rp->clock);
 889                 goto unlock;
 890         }
 891
 892         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 893         if (conn) {
 894                 conn->clock = le32_to_cpu(rp->clock);
 895                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 896         }
 897
 898 unlock:
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 903                                        struct sk_buff *skb)
 904 {
 905         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 906
 907         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 908
 909         if (rp->status)
 910                 return;
 911
 912         hdev->amp_status = rp->amp_status;
 913         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 914         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 915         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 916         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 917         hdev->amp_type = rp->amp_type;
 918         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 919         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 920         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 921         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 922 }
 923
 924 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 925                                          struct sk_buff *skb)
 926 {
 927         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 928
 929         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 930
 931         if (rp->status)
 932                 return;
 933
 934         hdev->inq_tx_power = rp->tx_power;
 935 }
 936
 937 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 938                                                struct sk_buff *skb)
 939 {
 940         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 941
 942         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 943
 944         if (rp->status)
 945                 return;
 946
 947         hdev->err_data_reporting = rp->err_data_reporting;
 948 }
 949
 950 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 951                                                 struct sk_buff *skb)
 952 {
 953         __u8 status = *((__u8 *)skb->data);
 954         struct hci_cp_write_def_err_data_reporting *cp;
 955
 956         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 957
 958         if (status)
 959                 return;
 960
 961         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 962         if (!cp)
 963                 return;
 964
 965         hdev->err_data_reporting = cp->err_data_reporting;
 966 }
 967
 968 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 969 {
 970         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 971         struct hci_cp_pin_code_reply *cp;
 972         struct hci_conn *conn;
 973
 974         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 975
 976         hci_dev_lock(hdev);
 977
 978         if (hci_dev_test_flag(hdev, HCI_MGMT))
 979                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 980
 981         if (rp->status)
 982                 goto unlock;
 983
 984         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 985         if (!cp)
 986                 goto unlock;
 987
 988         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 989         if (conn)
 990                 conn->pin_length = cp->pin_len;
 991
 992 unlock:
 993         hci_dev_unlock(hdev);
 994 }
 995
 996 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 997 {
 998         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 999
1000         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1001
1002         hci_dev_lock(hdev);
1003
1004         if (hci_dev_test_flag(hdev, HCI_MGMT))
1005                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1006                                                  rp->status);
1007
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1012                                        struct sk_buff *skb)
1013 {
1014         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1015
1016         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1017
1018         if (rp->status)
1019                 return;
1020
1021         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1022         hdev->le_pkts = rp->le_max_pkt;
1023
1024         hdev->le_cnt = hdev->le_pkts;
1025
1026         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1027 }
1028
1029 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1030                                           struct sk_buff *skb)
1031 {
1032         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1033
1034         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1035
1036         if (rp->status)
1037                 return;
1038
1039         memcpy(hdev->le_features, rp->features, 8);
1040 }
1041
1042 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1043                                         struct sk_buff *skb)
1044 {
1045         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1046
1047         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1048
1049         if (rp->status)
1050                 return;
1051
1052         hdev->adv_tx_power = rp->tx_power;
1053 }
1054
1055 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1056 {
1057         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         hci_dev_lock(hdev);
1062
1063         if (hci_dev_test_flag(hdev, HCI_MGMT))
1064                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1065                                                  rp->status);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1071                                           struct sk_buff *skb)
1072 {
1073         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1074
1075         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1076
1077         hci_dev_lock(hdev);
1078
1079         if (hci_dev_test_flag(hdev, HCI_MGMT))
1080                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1081                                                      ACL_LINK, 0, rp->status);
1082
1083         hci_dev_unlock(hdev);
1084 }
1085
1086 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1087 {
1088         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1089
1090         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1091
1092         hci_dev_lock(hdev);
1093
1094         if (hci_dev_test_flag(hdev, HCI_MGMT))
1095                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1096                                                  0, rp->status);
1097
1098         hci_dev_unlock(hdev);
1099 }
1100
1101 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1102                                           struct sk_buff *skb)
1103 {
1104         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1105
1106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1107
1108         hci_dev_lock(hdev);
1109
1110         if (hci_dev_test_flag(hdev, HCI_MGMT))
1111                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1112                                                      ACL_LINK, 0, rp->status);
1113
1114         hci_dev_unlock(hdev);
1115 }
1116
1117 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1118                                        struct sk_buff *skb)
1119 {
1120         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1121
1122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1123 }
1124
1125 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1126                                            struct sk_buff *skb)
1127 {
1128         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1129
1130         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1131 }
1132
1133 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1134 {
1135         __u8 status = *((__u8 *) skb->data);
1136         bdaddr_t *sent;
1137
1138         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1139
1140         if (status)
1141                 return;
1142
1143         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1144         if (!sent)
1145                 return;
1146
1147         hci_dev_lock(hdev);
1148
1149         bacpy(&hdev->random_addr, sent);
1150
1151         hci_dev_unlock(hdev);
1152 }
1153
1154 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1155 {
1156         __u8 status = *((__u8 *) skb->data);
1157         struct hci_cp_le_set_default_phy *cp;
1158
1159         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1160
1161         if (status)
1162                 return;
1163
1164         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1165         if (!cp)
1166                 return;
1167
1168         hci_dev_lock(hdev);
1169
1170         hdev->le_tx_def_phys = cp->tx_phys;
1171         hdev->le_rx_def_phys = cp->rx_phys;
1172
1173         hci_dev_unlock(hdev);
1174 }
1175
1176 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1177                                               struct sk_buff *skb)
1178 {
1179         __u8 status = *((__u8 *) skb->data);
1180         struct hci_cp_le_set_adv_set_rand_addr *cp;
1181         struct adv_info *adv_instance;
1182
1183         if (status)
1184                 return;
1185
1186         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1187         if (!cp)
1188                 return;
1189
1190         hci_dev_lock(hdev);
1191
1192         if (!hdev->cur_adv_instance) {
1193                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1194                 bacpy(&hdev->random_addr, &cp->bdaddr);
1195         } else {
1196                 adv_instance = hci_find_adv_instance(hdev,
1197                                                      hdev->cur_adv_instance);
1198                 if (adv_instance)
1199                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1200         }
1201
1202         hci_dev_unlock(hdev);
1203 }
1204
1205 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1206 {
1207         __u8 *sent, status = *((__u8 *) skb->data);
1208
1209         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1210
1211         if (status)
1212                 return;
1213
1214         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1215         if (!sent)
1216                 return;
1217
1218         hci_dev_lock(hdev);
1219
1220         /* If we're doing connection initiation as peripheral. Set a
1221          * timeout in case something goes wrong.
1222          */
1223         if (*sent) {
1224                 struct hci_conn *conn;
1225
1226                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1227
1228                 conn = hci_lookup_le_connect(hdev);
1229                 if (conn)
1230                         queue_delayed_work(hdev->workqueue,
1231                                            &conn->le_conn_timeout,
1232                                            conn->conn_timeout);
1233         } else {
1234                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1235         }
1236
1237         hci_dev_unlock(hdev);
1238 }
1239
1240 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1241                                          struct sk_buff *skb)
1242 {
1243         struct hci_cp_le_set_ext_adv_enable *cp;
1244         __u8 status = *((__u8 *) skb->data);
1245
1246         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1247
1248         if (status)
1249                 return;
1250
1251         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1252         if (!cp)
1253                 return;
1254
1255         hci_dev_lock(hdev);
1256
1257         if (cp->enable) {
1258                 struct hci_conn *conn;
1259
1260                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1261
1262                 conn = hci_lookup_le_connect(hdev);
1263                 if (conn)
1264                         queue_delayed_work(hdev->workqueue,
1265                                            &conn->le_conn_timeout,
1266                                            conn->conn_timeout);
1267         } else {
1268                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1269         }
1270
1271         hci_dev_unlock(hdev);
1272 }
1273
1274 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1275 {
1276         struct hci_cp_le_set_scan_param *cp;
1277         __u8 status = *((__u8 *) skb->data);
1278
1279         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1280
1281         if (status)
1282                 return;
1283
1284         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1285         if (!cp)
1286                 return;
1287
1288         hci_dev_lock(hdev);
1289
1290         hdev->le_scan_type = cp->type;
1291
1292         hci_dev_unlock(hdev);
1293 }
1294
1295 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1296                                          struct sk_buff *skb)
1297 {
1298         struct hci_cp_le_set_ext_scan_params *cp;
1299         __u8 status = *((__u8 *) skb->data);
1300         struct hci_cp_le_scan_phy_params *phy_param;
1301
1302         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1303
1304         if (status)
1305                 return;
1306
1307         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1308         if (!cp)
1309                 return;
1310
1311         phy_param = (void *)cp->data;
1312
1313         hci_dev_lock(hdev);
1314
1315         hdev->le_scan_type = phy_param->type;
1316
1317         hci_dev_unlock(hdev);
1318 }
1319
1320 static bool has_pending_adv_report(struct hci_dev *hdev)
1321 {
1322         struct discovery_state *d = &hdev->discovery;
1323
1324         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1325 }
1326
1327 static void clear_pending_adv_report(struct hci_dev *hdev)
1328 {
1329         struct discovery_state *d = &hdev->discovery;
1330
1331         bacpy(&d->last_adv_addr, BDADDR_ANY);
1332         d->last_adv_data_len = 0;
1333 }
1334
1335 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1336                                      u8 bdaddr_type, s8 rssi, u32 flags,
1337                                      u8 *data, u8 len)
1338 {
1339         struct discovery_state *d = &hdev->discovery;
1340
1341         bacpy(&d->last_adv_addr, bdaddr);
1342         d->last_adv_addr_type = bdaddr_type;
1343         d->last_adv_rssi = rssi;
1344         d->last_adv_flags = flags;
1345         memcpy(d->last_adv_data, data, len);
1346         d->last_adv_data_len = len;
1347 }
1348
1349 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1350 {
1351         hci_dev_lock(hdev);
1352
1353         switch (enable) {
1354         case LE_SCAN_ENABLE:
1355                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1356                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1357                         clear_pending_adv_report(hdev);
1358                 break;
1359
1360         case LE_SCAN_DISABLE:
1361                 /* We do this here instead of when setting DISCOVERY_STOPPED
1362                  * since the latter would potentially require waiting for
1363                  * inquiry to stop too.
1364                  */
1365                 if (has_pending_adv_report(hdev)) {
1366                         struct discovery_state *d = &hdev->discovery;
1367
1368                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1369                                           d->last_adv_addr_type, NULL,
1370                                           d->last_adv_rssi, d->last_adv_flags,
1371                                           d->last_adv_data,
1372                                           d->last_adv_data_len, NULL, 0);
1373                 }
1374
1375                 /* Cancel this timer so that we don't try to disable scanning
1376                  * when it's already disabled.
1377                  */
1378                 cancel_delayed_work(&hdev->le_scan_disable);
1379
1380                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1381
1382                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1383                  * interrupted scanning due to a connect request. Mark
1384                  * therefore discovery as stopped. If this was not
1385                  * because of a connect request advertising might have
1386                  * been disabled because of active scanning, so
1387                  * re-enable it again if necessary.
1388                  */
1389                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1390                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1391                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1392                          hdev->discovery.state == DISCOVERY_FINDING)
1393                         hci_req_reenable_advertising(hdev);
1394
1395                 break;
1396
1397         default:
1398                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1399                            enable);
1400                 break;
1401         }
1402
1403         hci_dev_unlock(hdev);
1404 }
1405
1406 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1407                                       struct sk_buff *skb)
1408 {
1409         struct hci_cp_le_set_scan_enable *cp;
1410         __u8 status = *((__u8 *) skb->data);
1411
1412         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1413
1414         if (status)
1415                 return;
1416
1417         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1418         if (!cp)
1419                 return;
1420
1421         le_set_scan_enable_complete(hdev, cp->enable);
1422 }
1423
1424 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1425                                       struct sk_buff *skb)
1426 {
1427         struct hci_cp_le_set_ext_scan_enable *cp;
1428         __u8 status = *((__u8 *) skb->data);
1429
1430         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1431
1432         if (status)
1433                 return;
1434
1435         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1436         if (!cp)
1437                 return;
1438
1439         le_set_scan_enable_complete(hdev, cp->enable);
1440 }
1441
1442 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1443                                       struct sk_buff *skb)
1444 {
1445         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1446
1447         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1448                rp->num_of_sets);
1449
1450         if (rp->status)
1451                 return;
1452
1453         hdev->le_num_of_adv_sets = rp->num_of_sets;
1454 }
1455
1456 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1457                                            struct sk_buff *skb)
1458 {
1459         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1460
1461         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1462
1463         if (rp->status)
1464                 return;
1465
1466         hdev->le_white_list_size = rp->size;
1467 }
1468
1469 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1470                                        struct sk_buff *skb)
1471 {
1472         __u8 status = *((__u8 *) skb->data);
1473
1474         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1475
1476         if (status)
1477                 return;
1478
1479         hci_bdaddr_list_clear(&hdev->le_white_list);
1480 }
1481
1482 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1483                                         struct sk_buff *skb)
1484 {
1485         struct hci_cp_le_add_to_white_list *sent;
1486         __u8 status = *((__u8 *) skb->data);
1487
1488         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1489
1490         if (status)
1491                 return;
1492
1493         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1494         if (!sent)
1495                 return;
1496
1497         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1498                            sent->bdaddr_type);
1499 }
1500
1501 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1502                                           struct sk_buff *skb)
1503 {
1504         struct hci_cp_le_del_from_white_list *sent;
1505         __u8 status = *((__u8 *) skb->data);
1506
1507         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1508
1509         if (status)
1510                 return;
1511
1512         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1513         if (!sent)
1514                 return;
1515
1516         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1517                             sent->bdaddr_type);
1518 }
1519
1520 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1521                                             struct sk_buff *skb)
1522 {
1523         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1524
1525         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1526
1527         if (rp->status)
1528                 return;
1529
1530         memcpy(hdev->le_states, rp->le_states, 8);
1531 }
1532
1533 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1534                                         struct sk_buff *skb)
1535 {
1536         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1537
1538         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1539
1540         if (rp->status)
1541                 return;
1542
1543         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1544         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1545 }
1546
1547 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1548                                          struct sk_buff *skb)
1549 {
1550         struct hci_cp_le_write_def_data_len *sent;
1551         __u8 status = *((__u8 *) skb->data);
1552
1553         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1554
1555         if (status)
1556                 return;
1557
1558         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1559         if (!sent)
1560                 return;
1561
1562         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1563         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1564 }
1565
1566 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1567                                          struct sk_buff *skb)
1568 {
1569         struct hci_cp_le_add_to_resolv_list *sent;
1570         __u8 status = *((__u8 *) skb->data);
1571
1572         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1573
1574         if (status)
1575                 return;
1576
1577         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1578         if (!sent)
1579                 return;
1580
1581         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1582                                 sent->bdaddr_type, sent->peer_irk,
1583                                 sent->local_irk);
1584 }
1585
1586 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1587                                           struct sk_buff *skb)
1588 {
1589         struct hci_cp_le_del_from_resolv_list *sent;
1590         __u8 status = *((__u8 *) skb->data);
1591
1592         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594         if (status)
1595                 return;
1596
1597         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1598         if (!sent)
1599                 return;
1600
1601         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1602                             sent->bdaddr_type);
1603 }
1604
1605 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1606                                        struct sk_buff *skb)
1607 {
1608         __u8 status = *((__u8 *) skb->data);
1609
1610         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1611
1612         if (status)
1613                 return;
1614
1615         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1616 }
1617
1618 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1619                                            struct sk_buff *skb)
1620 {
1621         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1622
1623         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1624
1625         if (rp->status)
1626                 return;
1627
1628         hdev->le_resolv_list_size = rp->size;
1629 }
1630
1631 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1632                                                 struct sk_buff *skb)
1633 {
1634         __u8 *sent, status = *((__u8 *) skb->data);
1635
1636         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1637
1638         if (status)
1639                 return;
1640
1641         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1642         if (!sent)
1643                 return;
1644
1645         hci_dev_lock(hdev);
1646
1647         if (*sent)
1648                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1649         else
1650                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1651
1652         hci_dev_unlock(hdev);
1653 }
1654
1655 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1656                                         struct sk_buff *skb)
1657 {
1658         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1659
1660         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1661
1662         if (rp->status)
1663                 return;
1664
1665         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1666         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1667         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1668         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1669 }
1670
1671 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1672                                            struct sk_buff *skb)
1673 {
1674         struct hci_cp_write_le_host_supported *sent;
1675         __u8 status = *((__u8 *) skb->data);
1676
1677         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1678
1679         if (status)
1680                 return;
1681
1682         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1683         if (!sent)
1684                 return;
1685
1686         hci_dev_lock(hdev);
1687
1688         if (sent->le) {
1689                 hdev->features[1][0] |= LMP_HOST_LE;
1690                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1691         } else {
1692                 hdev->features[1][0] &= ~LMP_HOST_LE;
1693                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1694                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1695         }
1696
1697         if (sent->simul)
1698                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1699         else
1700                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1701
1702         hci_dev_unlock(hdev);
1703 }
1704
1705 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1706 {
1707         struct hci_cp_le_set_adv_param *cp;
1708         u8 status = *((u8 *) skb->data);
1709
1710         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1711
1712         if (status)
1713                 return;
1714
1715         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1716         if (!cp)
1717                 return;
1718
1719         hci_dev_lock(hdev);
1720         hdev->adv_addr_type = cp->own_address_type;
1721         hci_dev_unlock(hdev);
1722 }
1723
1724 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1725 {
1726         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1727         struct hci_cp_le_set_ext_adv_params *cp;
1728         struct adv_info *adv_instance;
1729
1730         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1731
1732         if (rp->status)
1733                 return;
1734
1735         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1736         if (!cp)
1737                 return;
1738
1739         hci_dev_lock(hdev);
1740         hdev->adv_addr_type = cp->own_addr_type;
1741         if (!hdev->cur_adv_instance) {
1742                 /* Store in hdev for instance 0 */
1743                 hdev->adv_tx_power = rp->tx_power;
1744         } else {
1745                 adv_instance = hci_find_adv_instance(hdev,
1746                                                      hdev->cur_adv_instance);
1747                 if (adv_instance)
1748                         adv_instance->tx_power = rp->tx_power;
1749         }
1750         /* Update adv data as tx power is known now */
1751         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1752         hci_dev_unlock(hdev);
1753 }
1754
1755 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1756 {
1757         struct hci_rp_read_rssi *rp = (void *) skb->data;
1758         struct hci_conn *conn;
1759
1760         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1761
1762         if (rp->status)
1763                 return;
1764
1765         hci_dev_lock(hdev);
1766
1767         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1768         if (conn)
1769                 conn->rssi = rp->rssi;
1770
1771         hci_dev_unlock(hdev);
1772 }
1773
1774 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1775 {
1776         struct hci_cp_read_tx_power *sent;
1777         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1778         struct hci_conn *conn;
1779
1780         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1781
1782         if (rp->status)
1783                 return;
1784
1785         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1786         if (!sent)
1787                 return;
1788
1789         hci_dev_lock(hdev);
1790
1791         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1792         if (!conn)
1793                 goto unlock;
1794
1795         switch (sent->type) {
1796         case 0x00:
1797                 conn->tx_power = rp->tx_power;
1798                 break;
1799         case 0x01:
1800                 conn->max_tx_power = rp->tx_power;
1801                 break;
1802         }
1803
1804 unlock:
1805         hci_dev_unlock(hdev);
1806 }
1807
1808 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1809 {
1810         u8 status = *((u8 *) skb->data);
1811         u8 *mode;
1812
1813         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1814
1815         if (status)
1816                 return;
1817
1818         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1819         if (mode)
1820                 hdev->ssp_debug_mode = *mode;
1821 }
1822
1823 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1824 {
1825         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1826
1827         if (status) {
1828                 hci_conn_check_pending(hdev);
1829                 return;
1830         }
1831
1832         set_bit(HCI_INQUIRY, &hdev->flags);
1833 }
1834
1835 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1836 {
1837         struct hci_cp_create_conn *cp;
1838         struct hci_conn *conn;
1839
1840         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1841
1842         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1843         if (!cp)
1844                 return;
1845
1846         hci_dev_lock(hdev);
1847
1848         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1849
1850         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1851
1852         if (status) {
1853                 if (conn && conn->state == BT_CONNECT) {
1854                         if (status != 0x0c || conn->attempt > 2) {
1855                                 conn->state = BT_CLOSED;
1856                                 hci_connect_cfm(conn, status);
1857                                 hci_conn_del(conn);
1858                         } else
1859                                 conn->state = BT_CONNECT2;
1860                 }
1861         } else {
1862                 if (!conn) {
1863                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1864                                             HCI_ROLE_MASTER);
1865                         if (!conn)
1866                                 bt_dev_err(hdev, "no memory for new connection");
1867                 }
1868         }
1869
1870         hci_dev_unlock(hdev);
1871 }
1872
1873 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1874 {
1875         struct hci_cp_add_sco *cp;
1876         struct hci_conn *acl, *sco;
1877         __u16 handle;
1878
1879         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1880
1881         if (!status)
1882                 return;
1883
1884         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1885         if (!cp)
1886                 return;
1887
1888         handle = __le16_to_cpu(cp->handle);
1889
1890         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1891
1892         hci_dev_lock(hdev);
1893
1894         acl = hci_conn_hash_lookup_handle(hdev, handle);
1895         if (acl) {
1896                 sco = acl->link;
1897                 if (sco) {
1898                         sco->state = BT_CLOSED;
1899
1900                         hci_connect_cfm(sco, status);
1901                         hci_conn_del(sco);
1902                 }
1903         }
1904
1905         hci_dev_unlock(hdev);
1906 }
1907
1908 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1909 {
1910         struct hci_cp_auth_requested *cp;
1911         struct hci_conn *conn;
1912
1913         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1914
1915         if (!status)
1916                 return;
1917
1918         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1919         if (!cp)
1920                 return;
1921
1922         hci_dev_lock(hdev);
1923
1924         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1925         if (conn) {
1926                 if (conn->state == BT_CONFIG) {
1927                         hci_connect_cfm(conn, status);
1928                         hci_conn_drop(conn);
1929                 }
1930         }
1931
1932         hci_dev_unlock(hdev);
1933 }
1934
1935 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1936 {
1937         struct hci_cp_set_conn_encrypt *cp;
1938         struct hci_conn *conn;
1939
1940         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1941
1942         if (!status)
1943                 return;
1944
1945         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1946         if (!cp)
1947                 return;
1948
1949         hci_dev_lock(hdev);
1950
1951         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1952         if (conn) {
1953                 if (conn->state == BT_CONFIG) {
1954                         hci_connect_cfm(conn, status);
1955                         hci_conn_drop(conn);
1956                 }
1957         }
1958
1959         hci_dev_unlock(hdev);
1960 }
1961
1962 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1963                                     struct hci_conn *conn)
1964 {
1965         if (conn->state != BT_CONFIG || !conn->out)
1966                 return 0;
1967
1968         if (conn->pending_sec_level == BT_SECURITY_SDP)
1969                 return 0;
1970
1971         /* Only request authentication for SSP connections or non-SSP
1972          * devices with sec_level MEDIUM or HIGH or if MITM protection
1973          * is requested.
1974          */
1975         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1976             conn->pending_sec_level != BT_SECURITY_FIPS &&
1977             conn->pending_sec_level != BT_SECURITY_HIGH &&
1978             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1979                 return 0;
1980
1981         return 1;
1982 }
1983
1984 static int hci_resolve_name(struct hci_dev *hdev,
1985                                    struct inquiry_entry *e)
1986 {
1987         struct hci_cp_remote_name_req cp;
1988
1989         memset(&cp, 0, sizeof(cp));
1990
1991         bacpy(&cp.bdaddr, &e->data.bdaddr);
1992         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1993         cp.pscan_mode = e->data.pscan_mode;
1994         cp.clock_offset = e->data.clock_offset;
1995
1996         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1997 }
1998
1999 static bool hci_resolve_next_name(struct hci_dev *hdev)
2000 {
2001         struct discovery_state *discov = &hdev->discovery;
2002         struct inquiry_entry *e;
2003
2004         if (list_empty(&discov->resolve))
2005                 return false;
2006
2007         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2008         if (!e)
2009                 return false;
2010
2011         if (hci_resolve_name(hdev, e) == 0) {
2012                 e->name_state = NAME_PENDING;
2013                 return true;
2014         }
2015
2016         return false;
2017 }
2018
2019 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2020                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2021 {
2022         struct discovery_state *discov = &hdev->discovery;
2023         struct inquiry_entry *e;
2024
2025         /* Update the mgmt connected state if necessary. Be careful with
2026          * conn objects that exist but are not (yet) connected however.
2027          * Only those in BT_CONFIG or BT_CONNECTED states can be
2028          * considered connected.
2029          */
2030         if (conn &&
2031             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2032             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2033                 mgmt_device_connected(hdev, conn, 0, name, name_len);
2034
2035         if (discov->state == DISCOVERY_STOPPED)
2036                 return;
2037
2038         if (discov->state == DISCOVERY_STOPPING)
2039                 goto discov_complete;
2040
2041         if (discov->state != DISCOVERY_RESOLVING)
2042                 return;
2043
2044         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2045         /* If the device was not found in a list of found devices names of which
2046          * are pending. there is no need to continue resolving a next name as it
2047          * will be done upon receiving another Remote Name Request Complete
2048          * Event */
2049         if (!e)
2050                 return;
2051
2052         list_del(&e->list);
2053         if (name) {
2054                 e->name_state = NAME_KNOWN;
2055                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2056                                  e->data.rssi, name, name_len);
2057         } else {
2058                 e->name_state = NAME_NOT_KNOWN;
2059         }
2060
2061         if (hci_resolve_next_name(hdev))
2062                 return;
2063
2064 discov_complete:
2065         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2066 }
2067
2068 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2069 {
2070         struct hci_cp_remote_name_req *cp;
2071         struct hci_conn *conn;
2072
2073         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2074
2075         /* If successful wait for the name req complete event before
2076          * checking for the need to do authentication */
2077         if (!status)
2078                 return;
2079
2080         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2081         if (!cp)
2082                 return;
2083
2084         hci_dev_lock(hdev);
2085
2086         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2087
2088         if (hci_dev_test_flag(hdev, HCI_MGMT))
2089                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2090
2091         if (!conn)
2092                 goto unlock;
2093
2094         if (!hci_outgoing_auth_needed(hdev, conn))
2095                 goto unlock;
2096
2097         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2098                 struct hci_cp_auth_requested auth_cp;
2099
2100                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2101
2102                 auth_cp.handle = __cpu_to_le16(conn->handle);
2103                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2104                              sizeof(auth_cp), &auth_cp);
2105         }
2106
2107 unlock:
2108         hci_dev_unlock(hdev);
2109 }
2110
2111 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2112 {
2113         struct hci_cp_read_remote_features *cp;
2114         struct hci_conn *conn;
2115
2116         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2117
2118         if (!status)
2119                 return;
2120
2121         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2122         if (!cp)
2123                 return;
2124
2125         hci_dev_lock(hdev);
2126
2127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2128         if (conn) {
2129                 if (conn->state == BT_CONFIG) {
2130                         hci_connect_cfm(conn, status);
2131                         hci_conn_drop(conn);
2132                 }
2133         }
2134
2135         hci_dev_unlock(hdev);
2136 }
2137
2138 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2139 {
2140         struct hci_cp_read_remote_ext_features *cp;
2141         struct hci_conn *conn;
2142
2143         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2144
2145         if (!status)
2146                 return;
2147
2148         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2149         if (!cp)
2150                 return;
2151
2152         hci_dev_lock(hdev);
2153
2154         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2155         if (conn) {
2156                 if (conn->state == BT_CONFIG) {
2157                         hci_connect_cfm(conn, status);
2158                         hci_conn_drop(conn);
2159                 }
2160         }
2161
2162         hci_dev_unlock(hdev);
2163 }
2164
2165 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2166 {
2167         struct hci_cp_setup_sync_conn *cp;
2168         struct hci_conn *acl, *sco;
2169         __u16 handle;
2170
2171         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2172
2173         if (!status)
2174                 return;
2175
2176         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2177         if (!cp)
2178                 return;
2179
2180         handle = __le16_to_cpu(cp->handle);
2181
2182         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2183
2184         hci_dev_lock(hdev);
2185
2186         acl = hci_conn_hash_lookup_handle(hdev, handle);
2187         if (acl) {
2188                 sco = acl->link;
2189                 if (sco) {
2190                         sco->state = BT_CLOSED;
2191
2192                         hci_connect_cfm(sco, status);
2193                         hci_conn_del(sco);
2194                 }
2195         }
2196
2197         hci_dev_unlock(hdev);
2198 }
2199
2200 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2201 {
2202         struct hci_cp_sniff_mode *cp;
2203         struct hci_conn *conn;
2204
2205         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2206
2207         if (!status)
2208                 return;
2209
2210         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2211         if (!cp)
2212                 return;
2213
2214         hci_dev_lock(hdev);
2215
2216         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2217         if (conn) {
2218                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2219
2220                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2221                         hci_sco_setup(conn, status);
2222         }
2223
2224         hci_dev_unlock(hdev);
2225 }
2226
2227 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2228 {
2229         struct hci_cp_exit_sniff_mode *cp;
2230         struct hci_conn *conn;
2231
2232         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2233
2234         if (!status)
2235                 return;
2236
2237         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2238         if (!cp)
2239                 return;
2240
2241         hci_dev_lock(hdev);
2242
2243         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2244         if (conn) {
2245                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2246
2247                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2248                         hci_sco_setup(conn, status);
2249         }
2250
2251         hci_dev_unlock(hdev);
2252 }
2253
2254 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2255 {
2256         struct hci_cp_disconnect *cp;
2257         struct hci_conn *conn;
2258
2259         if (!status)
2260                 return;
2261
2262         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2263         if (!cp)
2264                 return;
2265
2266         hci_dev_lock(hdev);
2267
2268         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2269         if (conn) {
2270                 u8 type = conn->type;
2271
2272                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2273                                        conn->dst_type, status);
2274
2275                 /* If the disconnection failed for any reason, the upper layer
2276                  * does not retry to disconnect in current implementation.
2277                  * Hence, we need to do some basic cleanup here and re-enable
2278                  * advertising if necessary.
2279                  */
2280                 hci_conn_del(conn);
2281                 if (type == LE_LINK)
2282                         hci_req_reenable_advertising(hdev);
2283         }
2284
2285         hci_dev_unlock(hdev);
2286 }
2287
2288 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2289                               u8 peer_addr_type, u8 own_address_type,
2290                               u8 filter_policy)
2291 {
2292         struct hci_conn *conn;
2293
2294         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2295                                        peer_addr_type);
2296         if (!conn)
2297                 return;
2298
2299         /* Store the initiator and responder address information which
2300          * is needed for SMP. These values will not change during the
2301          * lifetime of the connection.
2302          */
2303         conn->init_addr_type = own_address_type;
2304         if (own_address_type == ADDR_LE_DEV_RANDOM)
2305                 bacpy(&conn->init_addr, &hdev->random_addr);
2306         else
2307                 bacpy(&conn->init_addr, &hdev->bdaddr);
2308
2309         conn->resp_addr_type = peer_addr_type;
2310         bacpy(&conn->resp_addr, peer_addr);
2311
2312         /* We don't want the connection attempt to stick around
2313          * indefinitely since LE doesn't have a page timeout concept
2314          * like BR/EDR. Set a timer for any connection that doesn't use
2315          * the white list for connecting.
2316          */
2317         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2318                 queue_delayed_work(conn->hdev->workqueue,
2319                                    &conn->le_conn_timeout,
2320                                    conn->conn_timeout);
2321 }
2322
2323 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2324 {
2325         struct hci_cp_le_create_conn *cp;
2326
2327         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2328
2329         /* All connection failure handling is taken care of by the
2330          * hci_le_conn_failed function which is triggered by the HCI
2331          * request completion callbacks used for connecting.
2332          */
2333         if (status)
2334                 return;
2335
2336         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2337         if (!cp)
2338                 return;
2339
2340         hci_dev_lock(hdev);
2341
2342         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2343                           cp->own_address_type, cp->filter_policy);
2344
2345         hci_dev_unlock(hdev);
2346 }
2347
2348 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2349 {
2350         struct hci_cp_le_ext_create_conn *cp;
2351
2352         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2353
2354         /* All connection failure handling is taken care of by the
2355          * hci_le_conn_failed function which is triggered by the HCI
2356          * request completion callbacks used for connecting.
2357          */
2358         if (status)
2359                 return;
2360
2361         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2362         if (!cp)
2363                 return;
2364
2365         hci_dev_lock(hdev);
2366
2367         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2368                           cp->own_addr_type, cp->filter_policy);
2369
2370         hci_dev_unlock(hdev);
2371 }
2372
2373 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2374 {
2375         struct hci_cp_le_read_remote_features *cp;
2376         struct hci_conn *conn;
2377
2378         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2379
2380         if (!status)
2381                 return;
2382
2383         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2384         if (!cp)
2385                 return;
2386
2387         hci_dev_lock(hdev);
2388
2389         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2390         if (conn) {
2391                 if (conn->state == BT_CONFIG) {
2392                         hci_connect_cfm(conn, status);
2393                         hci_conn_drop(conn);
2394                 }
2395         }
2396
2397         hci_dev_unlock(hdev);
2398 }
2399
2400 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2401 {
2402         struct hci_cp_le_start_enc *cp;
2403         struct hci_conn *conn;
2404
2405         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2406
2407         if (!status)
2408                 return;
2409
2410         hci_dev_lock(hdev);
2411
2412         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2413         if (!cp)
2414                 goto unlock;
2415
2416         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2417         if (!conn)
2418                 goto unlock;
2419
2420         if (conn->state != BT_CONNECTED)
2421                 goto unlock;
2422
2423         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2424         hci_conn_drop(conn);
2425
2426 unlock:
2427         hci_dev_unlock(hdev);
2428 }
2429
2430 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2431 {
2432         struct hci_cp_switch_role *cp;
2433         struct hci_conn *conn;
2434
2435         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2436
2437         if (!status)
2438                 return;
2439
2440         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2441         if (!cp)
2442                 return;
2443
2444         hci_dev_lock(hdev);
2445
2446         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2447         if (conn)
2448                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2449
2450         hci_dev_unlock(hdev);
2451 }
2452
2453 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2454 {
2455         __u8 status = *((__u8 *) skb->data);
2456         struct discovery_state *discov = &hdev->discovery;
2457         struct inquiry_entry *e;
2458
2459         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2460
2461         hci_conn_check_pending(hdev);
2462
2463         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2464                 return;
2465
2466         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2467         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2468
2469         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2470                 return;
2471
2472         hci_dev_lock(hdev);
2473
2474         if (discov->state != DISCOVERY_FINDING)
2475                 goto unlock;
2476
2477         if (list_empty(&discov->resolve)) {
2478                 /* When BR/EDR inquiry is active and no LE scanning is in
2479                  * progress, then change discovery state to indicate completion.
2480                  *
2481                  * When running LE scanning and BR/EDR inquiry simultaneously
2482                  * and the LE scan already finished, then change the discovery
2483                  * state to indicate completion.
2484                  */
2485                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2486                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2487                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2488                 goto unlock;
2489         }
2490
2491         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2492         if (e && hci_resolve_name(hdev, e) == 0) {
2493                 e->name_state = NAME_PENDING;
2494                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2495         } else {
2496                 /* When BR/EDR inquiry is active and no LE scanning is in
2497                  * progress, then change discovery state to indicate completion.
2498                  *
2499                  * When running LE scanning and BR/EDR inquiry simultaneously
2500                  * and the LE scan already finished, then change the discovery
2501                  * state to indicate completion.
2502                  */
2503                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2504                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2505                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2506         }
2507
2508 unlock:
2509         hci_dev_unlock(hdev);
2510 }
2511
2512 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2513 {
2514         struct inquiry_data data;
2515         struct inquiry_info *info = (void *) (skb->data + 1);
2516         int num_rsp = *((__u8 *) skb->data);
2517
2518         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2519
2520         if (!num_rsp)
2521                 return;
2522
2523         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2524                 return;
2525
2526         hci_dev_lock(hdev);
2527
2528         for (; num_rsp; num_rsp--, info++) {
2529                 u32 flags;
2530
2531                 bacpy(&data.bdaddr, &info->bdaddr);
2532                 data.pscan_rep_mode     = info->pscan_rep_mode;
2533                 data.pscan_period_mode  = info->pscan_period_mode;
2534                 data.pscan_mode         = info->pscan_mode;
2535                 memcpy(data.dev_class, info->dev_class, 3);
2536                 data.clock_offset       = info->clock_offset;
2537                 data.rssi               = HCI_RSSI_INVALID;
2538                 data.ssp_mode           = 0x00;
2539
2540                 flags = hci_inquiry_cache_update(hdev, &data, false);
2541
2542                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2543                                   info->dev_class, HCI_RSSI_INVALID,
2544                                   flags, NULL, 0, NULL, 0);
2545         }
2546
2547         hci_dev_unlock(hdev);
2548 }
2549
2550 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2551 {
2552         struct hci_ev_conn_complete *ev = (void *) skb->data;
2553         struct inquiry_entry *ie;
2554         struct hci_conn *conn;
2555
2556         BT_DBG("%s", hdev->name);
2557
2558         hci_dev_lock(hdev);
2559
2560         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2561         if (!conn) {
2562                 /* Connection may not exist if auto-connected. Check the inquiry
2563                  * cache to see if we've already discovered this bdaddr before.
2564                  * If found and link is an ACL type, create a connection class
2565                  * automatically.
2566                  */
2567                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2568                 if (ie && ev->link_type == ACL_LINK) {
2569                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2570                                             HCI_ROLE_SLAVE);
2571                         if (!conn) {
2572                                 bt_dev_err(hdev, "no memory for new conn");
2573                                 goto unlock;
2574                         }
2575                 } else {
2576                         if (ev->link_type != SCO_LINK)
2577                                 goto unlock;
2578
2579                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2580                                                        &ev->bdaddr);
2581                         if (!conn)
2582                                 goto unlock;
2583
2584                         conn->type = SCO_LINK;
2585                 }
2586         }
2587
2588         if (!ev->status) {
2589                 conn->handle = __le16_to_cpu(ev->handle);
2590
2591                 if (conn->type == ACL_LINK) {
2592                         conn->state = BT_CONFIG;
2593                         hci_conn_hold(conn);
2594
2595                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2596                             !hci_find_link_key(hdev, &ev->bdaddr))
2597                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2598                         else
2599                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2600                 } else
2601                         conn->state = BT_CONNECTED;
2602
2603                 hci_debugfs_create_conn(conn);
2604                 hci_conn_add_sysfs(conn);
2605
2606                 if (test_bit(HCI_AUTH, &hdev->flags))
2607                         set_bit(HCI_CONN_AUTH, &conn->flags);
2608
2609                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2610                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2611
2612                 /* Get remote features */
2613                 if (conn->type == ACL_LINK) {
2614                         struct hci_cp_read_remote_features cp;
2615                         cp.handle = ev->handle;
2616                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2617                                      sizeof(cp), &cp);
2618
2619                         hci_req_update_scan(hdev);
2620                 }
2621
2622                 /* Set packet type for incoming connection */
2623                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2624                         struct hci_cp_change_conn_ptype cp;
2625                         cp.handle = ev->handle;
2626                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2627                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2628                                      &cp);
2629                 }
2630         } else {
2631                 conn->state = BT_CLOSED;
2632                 if (conn->type == ACL_LINK)
2633                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2634                                             conn->dst_type, ev->status);
2635         }
2636
2637         if (conn->type == ACL_LINK)
2638                 hci_sco_setup(conn, ev->status);
2639
2640         if (ev->status) {
2641                 hci_connect_cfm(conn, ev->status);
2642                 hci_conn_del(conn);
2643         } else if (ev->link_type == SCO_LINK) {
2644                 switch (conn->setting & SCO_AIRMODE_MASK) {
2645                 case SCO_AIRMODE_CVSD:
2646                         if (hdev->notify)
2647                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2648                         break;
2649                 }
2650
2651                 hci_connect_cfm(conn, ev->status);
2652         }
2653
2654 unlock:
2655         hci_dev_unlock(hdev);
2656
2657         hci_conn_check_pending(hdev);
2658 }
2659
2660 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2661 {
2662         struct hci_cp_reject_conn_req cp;
2663
2664         bacpy(&cp.bdaddr, bdaddr);
2665         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2666         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2667 }
2668
2669 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2670 {
2671         struct hci_ev_conn_request *ev = (void *) skb->data;
2672         int mask = hdev->link_mode;
2673         struct inquiry_entry *ie;
2674         struct hci_conn *conn;
2675         __u8 flags = 0;
2676
2677         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2678                ev->link_type);
2679
2680         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2681                                       &flags);
2682
2683         if (!(mask & HCI_LM_ACCEPT)) {
2684                 hci_reject_conn(hdev, &ev->bdaddr);
2685                 return;
2686         }
2687
2688         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2689                                    BDADDR_BREDR)) {
2690                 hci_reject_conn(hdev, &ev->bdaddr);
2691                 return;
2692         }
2693
2694         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2695          * connection. These features are only touched through mgmt so
2696          * only do the checks if HCI_MGMT is set.
2697          */
2698         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2699             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2700             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2701                                     BDADDR_BREDR)) {
2702                     hci_reject_conn(hdev, &ev->bdaddr);
2703                     return;
2704         }
2705
2706         /* Connection accepted */
2707
2708         hci_dev_lock(hdev);
2709
2710         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2711         if (ie)
2712                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2713
2714         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2715                         &ev->bdaddr);
2716         if (!conn) {
2717                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2718                                     HCI_ROLE_SLAVE);
2719                 if (!conn) {
2720                         bt_dev_err(hdev, "no memory for new connection");
2721                         hci_dev_unlock(hdev);
2722                         return;
2723                 }
2724         }
2725
2726         memcpy(conn->dev_class, ev->dev_class, 3);
2727
2728         hci_dev_unlock(hdev);
2729
2730         if (ev->link_type == ACL_LINK ||
2731             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2732                 struct hci_cp_accept_conn_req cp;
2733                 conn->state = BT_CONNECT;
2734
2735                 bacpy(&cp.bdaddr, &ev->bdaddr);
2736
2737                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2738                         cp.role = 0x00; /* Become master */
2739                 else
2740                         cp.role = 0x01; /* Remain slave */
2741
2742                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2743         } else if (!(flags & HCI_PROTO_DEFER)) {
2744                 struct hci_cp_accept_sync_conn_req cp;
2745                 conn->state = BT_CONNECT;
2746
2747                 bacpy(&cp.bdaddr, &ev->bdaddr);
2748                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2749
2750                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2751                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2752                 cp.max_latency    = cpu_to_le16(0xffff);
2753                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2754                 cp.retrans_effort = 0xff;
2755
2756                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2757                              &cp);
2758         } else {
2759                 conn->state = BT_CONNECT2;
2760                 hci_connect_cfm(conn, 0);
2761         }
2762 }
2763
2764 static u8 hci_to_mgmt_reason(u8 err)
2765 {
2766         switch (err) {
2767         case HCI_ERROR_CONNECTION_TIMEOUT:
2768                 return MGMT_DEV_DISCONN_TIMEOUT;
2769         case HCI_ERROR_REMOTE_USER_TERM:
2770         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2771         case HCI_ERROR_REMOTE_POWER_OFF:
2772                 return MGMT_DEV_DISCONN_REMOTE;
2773         case HCI_ERROR_LOCAL_HOST_TERM:
2774                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2775         default:
2776                 return MGMT_DEV_DISCONN_UNKNOWN;
2777         }
2778 }
2779
2780 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2781 {
2782         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2783         u8 reason;
2784         struct hci_conn_params *params;
2785         struct hci_conn *conn;
2786         bool mgmt_connected;
2787         u8 type;
2788
2789         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2790
2791         hci_dev_lock(hdev);
2792
2793         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2794         if (!conn)
2795                 goto unlock;
2796
2797         if (ev->status) {
2798                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2799                                        conn->dst_type, ev->status);
2800                 goto unlock;
2801         }
2802
2803         conn->state = BT_CLOSED;
2804
2805         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2806
2807         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2808                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2809         else
2810                 reason = hci_to_mgmt_reason(ev->reason);
2811
2812         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2813                                 reason, mgmt_connected);
2814
2815         if (conn->type == ACL_LINK) {
2816                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2817                         hci_remove_link_key(hdev, &conn->dst);
2818
2819                 hci_req_update_scan(hdev);
2820         }
2821
2822         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2823         if (params) {
2824                 switch (params->auto_connect) {
2825                 case HCI_AUTO_CONN_LINK_LOSS:
2826                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2827                                 break;
2828                         /* Fall through */
2829
2830                 case HCI_AUTO_CONN_DIRECT:
2831                 case HCI_AUTO_CONN_ALWAYS:
2832                         list_del_init(&params->action);
2833                         list_add(&params->action, &hdev->pend_le_conns);
2834                         hci_update_background_scan(hdev);
2835                         break;
2836
2837                 default:
2838                         break;
2839                 }
2840         }
2841
2842         type = conn->type;
2843
2844         hci_disconn_cfm(conn, ev->reason);
2845         hci_conn_del(conn);
2846
2847         /* The suspend notifier is waiting for all devices to disconnect so
2848          * clear the bit from pending tasks and inform the wait queue.
2849          */
2850         if (list_empty(&hdev->conn_hash.list) &&
2851             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
2852                 wake_up(&hdev->suspend_wait_q);
2853         }
2854
2855         /* Re-enable advertising if necessary, since it might
2856          * have been disabled by the connection. From the
2857          * HCI_LE_Set_Advertise_Enable command description in
2858          * the core specification (v4.0):
2859          * "The Controller shall continue advertising until the Host
2860          * issues an LE_Set_Advertise_Enable command with
2861          * Advertising_Enable set to 0x00 (Advertising is disabled)
2862          * or until a connection is created or until the Advertising
2863          * is timed out due to Directed Advertising."
2864          */
2865         if (type == LE_LINK)
2866                 hci_req_reenable_advertising(hdev);
2867
2868 unlock:
2869         hci_dev_unlock(hdev);
2870 }
2871
2872 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2873 {
2874         struct hci_ev_auth_complete *ev = (void *) skb->data;
2875         struct hci_conn *conn;
2876
2877         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2878
2879         hci_dev_lock(hdev);
2880
2881         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2882         if (!conn)
2883                 goto unlock;
2884
2885         if (!ev->status) {
2886                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2887
2888                 if (!hci_conn_ssp_enabled(conn) &&
2889                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2890                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2891                 } else {
2892                         set_bit(HCI_CONN_AUTH, &conn->flags);
2893                         conn->sec_level = conn->pending_sec_level;
2894                 }
2895         } else {
2896                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2897                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2898
2899                 mgmt_auth_failed(conn, ev->status);
2900         }
2901
2902         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2903         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2904
2905         if (conn->state == BT_CONFIG) {
2906                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2907                         struct hci_cp_set_conn_encrypt cp;
2908                         cp.handle  = ev->handle;
2909                         cp.encrypt = 0x01;
2910                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2911                                      &cp);
2912                 } else {
2913                         conn->state = BT_CONNECTED;
2914                         hci_connect_cfm(conn, ev->status);
2915                         hci_conn_drop(conn);
2916                 }
2917         } else {
2918                 hci_auth_cfm(conn, ev->status);
2919
2920                 hci_conn_hold(conn);
2921                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2922                 hci_conn_drop(conn);
2923         }
2924
2925         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2926                 if (!ev->status) {
2927                         struct hci_cp_set_conn_encrypt cp;
2928                         cp.handle  = ev->handle;
2929                         cp.encrypt = 0x01;
2930                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2931                                      &cp);
2932                 } else {
2933                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2934                         hci_encrypt_cfm(conn, ev->status);
2935                 }
2936         }
2937
2938 unlock:
2939         hci_dev_unlock(hdev);
2940 }
2941
2942 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2943 {
2944         struct hci_ev_remote_name *ev = (void *) skb->data;
2945         struct hci_conn *conn;
2946
2947         BT_DBG("%s", hdev->name);
2948
2949         hci_conn_check_pending(hdev);
2950
2951         hci_dev_lock(hdev);
2952
2953         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2954
2955         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2956                 goto check_auth;
2957
2958         if (ev->status == 0)
2959                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2960                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2961         else
2962                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2963
2964 check_auth:
2965         if (!conn)
2966                 goto unlock;
2967
2968         if (!hci_outgoing_auth_needed(hdev, conn))
2969                 goto unlock;
2970
2971         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2972                 struct hci_cp_auth_requested cp;
2973
2974                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2975
2976                 cp.handle = __cpu_to_le16(conn->handle);
2977                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2978         }
2979
2980 unlock:
2981         hci_dev_unlock(hdev);
2982 }
2983
2984 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2985                                        u16 opcode, struct sk_buff *skb)
2986 {
2987         const struct hci_rp_read_enc_key_size *rp;
2988         struct hci_conn *conn;
2989         u16 handle;
2990
2991         BT_DBG("%s status 0x%02x", hdev->name, status);
2992
2993         if (!skb || skb->len < sizeof(*rp)) {
2994                 bt_dev_err(hdev, "invalid read key size response");
2995                 return;
2996         }
2997
2998         rp = (void *)skb->data;
2999         handle = le16_to_cpu(rp->handle);
3000
3001         hci_dev_lock(hdev);
3002
3003         conn = hci_conn_hash_lookup_handle(hdev, handle);
3004         if (!conn)
3005                 goto unlock;
3006
3007         /* While unexpected, the read_enc_key_size command may fail. The most
3008          * secure approach is to then assume the key size is 0 to force a
3009          * disconnection.
3010          */
3011         if (rp->status) {
3012                 bt_dev_err(hdev, "failed to read key size for handle %u",
3013                            handle);
3014                 conn->enc_key_size = 0;
3015         } else {
3016                 conn->enc_key_size = rp->key_size;
3017         }
3018
3019         hci_encrypt_cfm(conn, 0);
3020
3021 unlock:
3022         hci_dev_unlock(hdev);
3023 }
3024
3025 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3026 {
3027         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3028         struct hci_conn *conn;
3029
3030         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3031
3032         hci_dev_lock(hdev);
3033
3034         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3035         if (!conn)
3036                 goto unlock;
3037
3038         if (!ev->status) {
3039                 if (ev->encrypt) {
3040                         /* Encryption implies authentication */
3041                         set_bit(HCI_CONN_AUTH, &conn->flags);
3042                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3043                         conn->sec_level = conn->pending_sec_level;
3044
3045                         /* P-256 authentication key implies FIPS */
3046                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3047                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3048
3049                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3050                             conn->type == LE_LINK)
3051                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3052                 } else {
3053                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3054                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3055                 }
3056         }
3057
3058         /* We should disregard the current RPA and generate a new one
3059          * whenever the encryption procedure fails.
3060          */
3061         if (ev->status && conn->type == LE_LINK) {
3062                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3063                 hci_adv_instances_set_rpa_expired(hdev, true);
3064         }
3065
3066         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3067
3068         if (ev->status && conn->state == BT_CONNECTED) {
3069                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3070                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3071
3072                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3073                 hci_conn_drop(conn);
3074                 goto unlock;
3075         }
3076
3077         /* In Secure Connections Only mode, do not allow any connections
3078          * that are not encrypted with AES-CCM using a P-256 authenticated
3079          * combination key.
3080          */
3081         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
3082             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
3083              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
3084                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
3085                 hci_conn_drop(conn);
3086                 goto unlock;
3087         }
3088
3089         /* Try reading the encryption key size for encrypted ACL links */
3090         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3091                 struct hci_cp_read_enc_key_size cp;
3092                 struct hci_request req;
3093
3094                 /* Only send HCI_Read_Encryption_Key_Size if the
3095                  * controller really supports it. If it doesn't, assume
3096                  * the default size (16).
3097                  */
3098                 if (!(hdev->commands[20] & 0x10)) {
3099                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3100                         goto notify;
3101                 }
3102
3103                 hci_req_init(&req, hdev);
3104
3105                 cp.handle = cpu_to_le16(conn->handle);
3106                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3107
3108                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3109                         bt_dev_err(hdev, "sending read key size failed");
3110                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3111                         goto notify;
3112                 }
3113
3114                 goto unlock;
3115         }
3116
3117         /* Set the default Authenticated Payload Timeout after
3118          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3119          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3120          * sent when the link is active and Encryption is enabled, the conn
3121          * type can be either LE or ACL and controller must support LMP Ping.
3122          * Ensure for AES-CCM encryption as well.
3123          */
3124         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3125             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3126             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3127              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3128                 struct hci_cp_write_auth_payload_to cp;
3129
3130                 cp.handle = cpu_to_le16(conn->handle);
3131                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3132                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3133                              sizeof(cp), &cp);
3134         }
3135
3136 notify:
3137         hci_encrypt_cfm(conn, ev->status);
3138
3139 unlock:
3140         hci_dev_unlock(hdev);
3141 }
3142
3143 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3144                                              struct sk_buff *skb)
3145 {
3146         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3147         struct hci_conn *conn;
3148
3149         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3150
3151         hci_dev_lock(hdev);
3152
3153         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3154         if (conn) {
3155                 if (!ev->status)
3156                         set_bit(HCI_CONN_SECURE, &conn->flags);
3157
3158                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3159
3160                 hci_key_change_cfm(conn, ev->status);
3161         }
3162
3163         hci_dev_unlock(hdev);
3164 }
3165
3166 static void hci_remote_features_evt(struct hci_dev *hdev,
3167                                     struct sk_buff *skb)
3168 {
3169         struct hci_ev_remote_features *ev = (void *) skb->data;
3170         struct hci_conn *conn;
3171
3172         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3173
3174         hci_dev_lock(hdev);
3175
3176         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3177         if (!conn)
3178                 goto unlock;
3179
3180         if (!ev->status)
3181                 memcpy(conn->features[0], ev->features, 8);
3182
3183         if (conn->state != BT_CONFIG)
3184                 goto unlock;
3185
3186         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3187             lmp_ext_feat_capable(conn)) {
3188                 struct hci_cp_read_remote_ext_features cp;
3189                 cp.handle = ev->handle;
3190                 cp.page = 0x01;
3191                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3192                              sizeof(cp), &cp);
3193                 goto unlock;
3194         }
3195
3196         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3197                 struct hci_cp_remote_name_req cp;
3198                 memset(&cp, 0, sizeof(cp));
3199                 bacpy(&cp.bdaddr, &conn->dst);
3200                 cp.pscan_rep_mode = 0x02;
3201                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3202         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3203                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3204
3205         if (!hci_outgoing_auth_needed(hdev, conn)) {
3206                 conn->state = BT_CONNECTED;
3207                 hci_connect_cfm(conn, ev->status);
3208                 hci_conn_drop(conn);
3209         }
3210
3211 unlock:
3212         hci_dev_unlock(hdev);
3213 }
3214
3215 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3216                                  u16 *opcode, u8 *status,
3217                                  hci_req_complete_t *req_complete,
3218                                  hci_req_complete_skb_t *req_complete_skb)
3219 {
3220         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3221
3222         *opcode = __le16_to_cpu(ev->opcode);
3223         *status = skb->data[sizeof(*ev)];
3224
3225         skb_pull(skb, sizeof(*ev));
3226
3227         switch (*opcode) {
3228         case HCI_OP_INQUIRY_CANCEL:
3229                 hci_cc_inquiry_cancel(hdev, skb, status);
3230                 break;
3231
3232         case HCI_OP_PERIODIC_INQ:
3233                 hci_cc_periodic_inq(hdev, skb);
3234                 break;
3235
3236         case HCI_OP_EXIT_PERIODIC_INQ:
3237                 hci_cc_exit_periodic_inq(hdev, skb);
3238                 break;
3239
3240         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3241                 hci_cc_remote_name_req_cancel(hdev, skb);
3242                 break;
3243
3244         case HCI_OP_ROLE_DISCOVERY:
3245                 hci_cc_role_discovery(hdev, skb);
3246                 break;
3247
3248         case HCI_OP_READ_LINK_POLICY:
3249                 hci_cc_read_link_policy(hdev, skb);
3250                 break;
3251
3252         case HCI_OP_WRITE_LINK_POLICY:
3253                 hci_cc_write_link_policy(hdev, skb);
3254                 break;
3255
3256         case HCI_OP_READ_DEF_LINK_POLICY:
3257                 hci_cc_read_def_link_policy(hdev, skb);
3258                 break;
3259
3260         case HCI_OP_WRITE_DEF_LINK_POLICY:
3261                 hci_cc_write_def_link_policy(hdev, skb);
3262                 break;
3263
3264         case HCI_OP_RESET:
3265                 hci_cc_reset(hdev, skb);
3266                 break;
3267
3268         case HCI_OP_READ_STORED_LINK_KEY:
3269                 hci_cc_read_stored_link_key(hdev, skb);
3270                 break;
3271
3272         case HCI_OP_DELETE_STORED_LINK_KEY:
3273                 hci_cc_delete_stored_link_key(hdev, skb);
3274                 break;
3275
3276         case HCI_OP_WRITE_LOCAL_NAME:
3277                 hci_cc_write_local_name(hdev, skb);
3278                 break;
3279
3280         case HCI_OP_READ_LOCAL_NAME:
3281                 hci_cc_read_local_name(hdev, skb);
3282                 break;
3283
3284         case HCI_OP_WRITE_AUTH_ENABLE:
3285                 hci_cc_write_auth_enable(hdev, skb);
3286                 break;
3287
3288         case HCI_OP_WRITE_ENCRYPT_MODE:
3289                 hci_cc_write_encrypt_mode(hdev, skb);
3290                 break;
3291
3292         case HCI_OP_WRITE_SCAN_ENABLE:
3293                 hci_cc_write_scan_enable(hdev, skb);
3294                 break;
3295
3296         case HCI_OP_READ_CLASS_OF_DEV:
3297                 hci_cc_read_class_of_dev(hdev, skb);
3298                 break;
3299
3300         case HCI_OP_WRITE_CLASS_OF_DEV:
3301                 hci_cc_write_class_of_dev(hdev, skb);
3302                 break;
3303
3304         case HCI_OP_READ_VOICE_SETTING:
3305                 hci_cc_read_voice_setting(hdev, skb);
3306                 break;
3307
3308         case HCI_OP_WRITE_VOICE_SETTING:
3309                 hci_cc_write_voice_setting(hdev, skb);
3310                 break;
3311
3312         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3313                 hci_cc_read_num_supported_iac(hdev, skb);
3314                 break;
3315
3316         case HCI_OP_WRITE_SSP_MODE:
3317                 hci_cc_write_ssp_mode(hdev, skb);
3318                 break;
3319
3320         case HCI_OP_WRITE_SC_SUPPORT:
3321                 hci_cc_write_sc_support(hdev, skb);
3322                 break;
3323
3324         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3325                 hci_cc_read_auth_payload_timeout(hdev, skb);
3326                 break;
3327
3328         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3329                 hci_cc_write_auth_payload_timeout(hdev, skb);
3330                 break;
3331
3332         case HCI_OP_READ_LOCAL_VERSION:
3333                 hci_cc_read_local_version(hdev, skb);
3334                 break;
3335
3336         case HCI_OP_READ_LOCAL_COMMANDS:
3337                 hci_cc_read_local_commands(hdev, skb);
3338                 break;
3339
3340         case HCI_OP_READ_LOCAL_FEATURES:
3341                 hci_cc_read_local_features(hdev, skb);
3342                 break;
3343
3344         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3345                 hci_cc_read_local_ext_features(hdev, skb);
3346                 break;
3347
3348         case HCI_OP_READ_BUFFER_SIZE:
3349                 hci_cc_read_buffer_size(hdev, skb);
3350                 break;
3351
3352         case HCI_OP_READ_BD_ADDR:
3353                 hci_cc_read_bd_addr(hdev, skb);
3354                 break;
3355
3356         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3357                 hci_cc_read_local_pairing_opts(hdev, skb);
3358                 break;
3359
3360         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3361                 hci_cc_read_page_scan_activity(hdev, skb);
3362                 break;
3363
3364         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3365                 hci_cc_write_page_scan_activity(hdev, skb);
3366                 break;
3367
3368         case HCI_OP_READ_PAGE_SCAN_TYPE:
3369                 hci_cc_read_page_scan_type(hdev, skb);
3370                 break;
3371
3372         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3373                 hci_cc_write_page_scan_type(hdev, skb);
3374                 break;
3375
3376         case HCI_OP_READ_DATA_BLOCK_SIZE:
3377                 hci_cc_read_data_block_size(hdev, skb);
3378                 break;
3379
3380         case HCI_OP_READ_FLOW_CONTROL_MODE:
3381                 hci_cc_read_flow_control_mode(hdev, skb);
3382                 break;
3383
3384         case HCI_OP_READ_LOCAL_AMP_INFO:
3385                 hci_cc_read_local_amp_info(hdev, skb);
3386                 break;
3387
3388         case HCI_OP_READ_CLOCK:
3389                 hci_cc_read_clock(hdev, skb);
3390                 break;
3391
3392         case HCI_OP_READ_INQ_RSP_TX_POWER:
3393                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3394                 break;
3395
3396         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3397                 hci_cc_read_def_err_data_reporting(hdev, skb);
3398                 break;
3399
3400         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3401                 hci_cc_write_def_err_data_reporting(hdev, skb);
3402                 break;
3403
3404         case HCI_OP_PIN_CODE_REPLY:
3405                 hci_cc_pin_code_reply(hdev, skb);
3406                 break;
3407
3408         case HCI_OP_PIN_CODE_NEG_REPLY:
3409                 hci_cc_pin_code_neg_reply(hdev, skb);
3410                 break;
3411
3412         case HCI_OP_READ_LOCAL_OOB_DATA:
3413                 hci_cc_read_local_oob_data(hdev, skb);
3414                 break;
3415
3416         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3417                 hci_cc_read_local_oob_ext_data(hdev, skb);
3418                 break;
3419
3420         case HCI_OP_LE_READ_BUFFER_SIZE:
3421                 hci_cc_le_read_buffer_size(hdev, skb);
3422                 break;
3423
3424         case HCI_OP_LE_READ_LOCAL_FEATURES:
3425                 hci_cc_le_read_local_features(hdev, skb);
3426                 break;
3427
3428         case HCI_OP_LE_READ_ADV_TX_POWER:
3429                 hci_cc_le_read_adv_tx_power(hdev, skb);
3430                 break;
3431
3432         case HCI_OP_USER_CONFIRM_REPLY:
3433                 hci_cc_user_confirm_reply(hdev, skb);
3434                 break;
3435
3436         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3437                 hci_cc_user_confirm_neg_reply(hdev, skb);
3438                 break;
3439
3440         case HCI_OP_USER_PASSKEY_REPLY:
3441                 hci_cc_user_passkey_reply(hdev, skb);
3442                 break;
3443
3444         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3445                 hci_cc_user_passkey_neg_reply(hdev, skb);
3446                 break;
3447
3448         case HCI_OP_LE_SET_RANDOM_ADDR:
3449                 hci_cc_le_set_random_addr(hdev, skb);
3450                 break;
3451
3452         case HCI_OP_LE_SET_ADV_ENABLE:
3453                 hci_cc_le_set_adv_enable(hdev, skb);
3454                 break;
3455
3456         case HCI_OP_LE_SET_SCAN_PARAM:
3457                 hci_cc_le_set_scan_param(hdev, skb);
3458                 break;
3459
3460         case HCI_OP_LE_SET_SCAN_ENABLE:
3461                 hci_cc_le_set_scan_enable(hdev, skb);
3462                 break;
3463
3464         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3465                 hci_cc_le_read_white_list_size(hdev, skb);
3466                 break;
3467
3468         case HCI_OP_LE_CLEAR_WHITE_LIST:
3469                 hci_cc_le_clear_white_list(hdev, skb);
3470                 break;
3471
3472         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3473                 hci_cc_le_add_to_white_list(hdev, skb);
3474                 break;
3475
3476         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3477                 hci_cc_le_del_from_white_list(hdev, skb);
3478                 break;
3479
3480         case HCI_OP_LE_READ_SUPPORTED_STATES:
3481                 hci_cc_le_read_supported_states(hdev, skb);
3482                 break;
3483
3484         case HCI_OP_LE_READ_DEF_DATA_LEN:
3485                 hci_cc_le_read_def_data_len(hdev, skb);
3486                 break;
3487
3488         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3489                 hci_cc_le_write_def_data_len(hdev, skb);
3490                 break;
3491
3492         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3493                 hci_cc_le_add_to_resolv_list(hdev, skb);
3494                 break;
3495
3496         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3497                 hci_cc_le_del_from_resolv_list(hdev, skb);
3498                 break;
3499
3500         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3501                 hci_cc_le_clear_resolv_list(hdev, skb);
3502                 break;
3503
3504         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3505                 hci_cc_le_read_resolv_list_size(hdev, skb);
3506                 break;
3507
3508         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3509                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3510                 break;
3511
3512         case HCI_OP_LE_READ_MAX_DATA_LEN:
3513                 hci_cc_le_read_max_data_len(hdev, skb);
3514                 break;
3515
3516         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3517                 hci_cc_write_le_host_supported(hdev, skb);
3518                 break;
3519
3520         case HCI_OP_LE_SET_ADV_PARAM:
3521                 hci_cc_set_adv_param(hdev, skb);
3522                 break;
3523
3524         case HCI_OP_READ_RSSI:
3525                 hci_cc_read_rssi(hdev, skb);
3526                 break;
3527
3528         case HCI_OP_READ_TX_POWER:
3529                 hci_cc_read_tx_power(hdev, skb);
3530                 break;
3531
3532         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3533                 hci_cc_write_ssp_debug_mode(hdev, skb);
3534                 break;
3535
3536         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3537                 hci_cc_le_set_ext_scan_param(hdev, skb);
3538                 break;
3539
3540         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3541                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3542                 break;
3543
3544         case HCI_OP_LE_SET_DEFAULT_PHY:
3545                 hci_cc_le_set_default_phy(hdev, skb);
3546                 break;
3547
3548         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3549                 hci_cc_le_read_num_adv_sets(hdev, skb);
3550                 break;
3551
3552         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3553                 hci_cc_set_ext_adv_param(hdev, skb);
3554                 break;
3555
3556         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3557                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3558                 break;
3559
3560         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3561                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3562                 break;
3563
3564         default:
3565                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3566                 break;
3567         }
3568
3569         if (*opcode != HCI_OP_NOP)
3570                 cancel_delayed_work(&hdev->cmd_timer);
3571
3572         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3573                 atomic_set(&hdev->cmd_cnt, 1);
3574
3575         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3576                              req_complete_skb);
3577
3578         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3579                 bt_dev_err(hdev,
3580                            "unexpected event for opcode 0x%4.4x", *opcode);
3581                 return;
3582         }
3583
3584         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3585                 queue_work(hdev->workqueue, &hdev->cmd_work);
3586 }
3587
3588 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3589                                u16 *opcode, u8 *status,
3590                                hci_req_complete_t *req_complete,
3591                                hci_req_complete_skb_t *req_complete_skb)
3592 {
3593         struct hci_ev_cmd_status *ev = (void *) skb->data;
3594
3595         skb_pull(skb, sizeof(*ev));
3596
3597         *opcode = __le16_to_cpu(ev->opcode);
3598         *status = ev->status;
3599
3600         switch (*opcode) {
3601         case HCI_OP_INQUIRY:
3602                 hci_cs_inquiry(hdev, ev->status);
3603                 break;
3604
3605         case HCI_OP_CREATE_CONN:
3606                 hci_cs_create_conn(hdev, ev->status);
3607                 break;
3608
3609         case HCI_OP_DISCONNECT:
3610                 hci_cs_disconnect(hdev, ev->status);
3611                 break;
3612
3613         case HCI_OP_ADD_SCO:
3614                 hci_cs_add_sco(hdev, ev->status);
3615                 break;
3616
3617         case HCI_OP_AUTH_REQUESTED:
3618                 hci_cs_auth_requested(hdev, ev->status);
3619                 break;
3620
3621         case HCI_OP_SET_CONN_ENCRYPT:
3622                 hci_cs_set_conn_encrypt(hdev, ev->status);
3623                 break;
3624
3625         case HCI_OP_REMOTE_NAME_REQ:
3626                 hci_cs_remote_name_req(hdev, ev->status);
3627                 break;
3628
3629         case HCI_OP_READ_REMOTE_FEATURES:
3630                 hci_cs_read_remote_features(hdev, ev->status);
3631                 break;
3632
3633         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3634                 hci_cs_read_remote_ext_features(hdev, ev->status);
3635                 break;
3636
3637         case HCI_OP_SETUP_SYNC_CONN:
3638                 hci_cs_setup_sync_conn(hdev, ev->status);
3639                 break;
3640
3641         case HCI_OP_SNIFF_MODE:
3642                 hci_cs_sniff_mode(hdev, ev->status);
3643                 break;
3644
3645         case HCI_OP_EXIT_SNIFF_MODE:
3646                 hci_cs_exit_sniff_mode(hdev, ev->status);
3647                 break;
3648
3649         case HCI_OP_SWITCH_ROLE:
3650                 hci_cs_switch_role(hdev, ev->status);
3651                 break;
3652
3653         case HCI_OP_LE_CREATE_CONN:
3654                 hci_cs_le_create_conn(hdev, ev->status);
3655                 break;
3656
3657         case HCI_OP_LE_READ_REMOTE_FEATURES:
3658                 hci_cs_le_read_remote_features(hdev, ev->status);
3659                 break;
3660
3661         case HCI_OP_LE_START_ENC:
3662                 hci_cs_le_start_enc(hdev, ev->status);
3663                 break;
3664
3665         case HCI_OP_LE_EXT_CREATE_CONN:
3666                 hci_cs_le_ext_create_conn(hdev, ev->status);
3667                 break;
3668
3669         default:
3670                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3671                 break;
3672         }
3673
3674         if (*opcode != HCI_OP_NOP)
3675                 cancel_delayed_work(&hdev->cmd_timer);
3676
3677         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3678                 atomic_set(&hdev->cmd_cnt, 1);
3679
3680         /* Indicate request completion if the command failed. Also, if
3681          * we're not waiting for a special event and we get a success
3682          * command status we should try to flag the request as completed
3683          * (since for this kind of commands there will not be a command
3684          * complete event).
3685          */
3686         if (ev->status ||
3687             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3688                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3689                                      req_complete_skb);
3690
3691         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3692                 bt_dev_err(hdev,
3693                            "unexpected event for opcode 0x%4.4x", *opcode);
3694                 return;
3695         }
3696
3697         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3698                 queue_work(hdev->workqueue, &hdev->cmd_work);
3699 }
3700
3701 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3702 {
3703         struct hci_ev_hardware_error *ev = (void *) skb->data;
3704
3705         hdev->hw_error_code = ev->code;
3706
3707         queue_work(hdev->req_workqueue, &hdev->error_reset);
3708 }
3709
3710 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3711 {
3712         struct hci_ev_role_change *ev = (void *) skb->data;
3713         struct hci_conn *conn;
3714
3715         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3716
3717         hci_dev_lock(hdev);
3718
3719         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3720         if (conn) {
3721                 if (!ev->status)
3722                         conn->role = ev->role;
3723
3724                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3725
3726                 hci_role_switch_cfm(conn, ev->status, ev->role);
3727         }
3728
3729         hci_dev_unlock(hdev);
3730 }
3731
3732 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3733 {
3734         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3735         int i;
3736
3737         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3738                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3739                 return;
3740         }
3741
3742         if (skb->len < sizeof(*ev) ||
3743             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3744                 BT_DBG("%s bad parameters", hdev->name);
3745                 return;
3746         }
3747
3748         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3749
3750         for (i = 0; i < ev->num_hndl; i++) {
3751                 struct hci_comp_pkts_info *info = &ev->handles[i];
3752                 struct hci_conn *conn;
3753                 __u16  handle, count;
3754
3755                 handle = __le16_to_cpu(info->handle);
3756                 count  = __le16_to_cpu(info->count);
3757
3758                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3759                 if (!conn)
3760                         continue;
3761
3762                 conn->sent -= count;
3763
3764                 switch (conn->type) {
3765                 case ACL_LINK:
3766                         hdev->acl_cnt += count;
3767                         if (hdev->acl_cnt > hdev->acl_pkts)
3768                                 hdev->acl_cnt = hdev->acl_pkts;
3769                         break;
3770
3771                 case LE_LINK:
3772                         if (hdev->le_pkts) {
3773                                 hdev->le_cnt += count;
3774                                 if (hdev->le_cnt > hdev->le_pkts)
3775                                         hdev->le_cnt = hdev->le_pkts;
3776                         } else {
3777                                 hdev->acl_cnt += count;
3778                                 if (hdev->acl_cnt > hdev->acl_pkts)
3779                                         hdev->acl_cnt = hdev->acl_pkts;
3780                         }
3781                         break;
3782
3783                 case SCO_LINK:
3784                         hdev->sco_cnt += count;
3785                         if (hdev->sco_cnt > hdev->sco_pkts)
3786                                 hdev->sco_cnt = hdev->sco_pkts;
3787                         break;
3788
3789                 default:
3790                         bt_dev_err(hdev, "unknown type %d conn %p",
3791                                    conn->type, conn);
3792                         break;
3793                 }
3794         }
3795
3796         queue_work(hdev->workqueue, &hdev->tx_work);
3797 }
3798
3799 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3800                                                  __u16 handle)
3801 {
3802         struct hci_chan *chan;
3803
3804         switch (hdev->dev_type) {
3805         case HCI_PRIMARY:
3806                 return hci_conn_hash_lookup_handle(hdev, handle);
3807         case HCI_AMP:
3808                 chan = hci_chan_lookup_handle(hdev, handle);
3809                 if (chan)
3810                         return chan->conn;
3811                 break;
3812         default:
3813                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3814                 break;
3815         }
3816
3817         return NULL;
3818 }
3819
3820 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3821 {
3822         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3823         int i;
3824
3825         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3826                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3827                 return;
3828         }
3829
3830         if (skb->len < sizeof(*ev) ||
3831             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3832                 BT_DBG("%s bad parameters", hdev->name);
3833                 return;
3834         }
3835
3836         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3837                ev->num_hndl);
3838
3839         for (i = 0; i < ev->num_hndl; i++) {
3840                 struct hci_comp_blocks_info *info = &ev->handles[i];
3841                 struct hci_conn *conn = NULL;
3842                 __u16  handle, block_count;
3843
3844                 handle = __le16_to_cpu(info->handle);
3845                 block_count = __le16_to_cpu(info->blocks);
3846
3847                 conn = __hci_conn_lookup_handle(hdev, handle);
3848                 if (!conn)
3849                         continue;
3850
3851                 conn->sent -= block_count;
3852
3853                 switch (conn->type) {
3854                 case ACL_LINK:
3855                 case AMP_LINK:
3856                         hdev->block_cnt += block_count;
3857                         if (hdev->block_cnt > hdev->num_blocks)
3858                                 hdev->block_cnt = hdev->num_blocks;
3859                         break;
3860
3861                 default:
3862                         bt_dev_err(hdev, "unknown type %d conn %p",
3863                                    conn->type, conn);
3864                         break;
3865                 }
3866         }
3867
3868         queue_work(hdev->workqueue, &hdev->tx_work);
3869 }
3870
3871 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3872 {
3873         struct hci_ev_mode_change *ev = (void *) skb->data;
3874         struct hci_conn *conn;
3875
3876         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3877
3878         hci_dev_lock(hdev);
3879
3880         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3881         if (conn) {
3882                 conn->mode = ev->mode;
3883
3884                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3885                                         &conn->flags)) {
3886                         if (conn->mode == HCI_CM_ACTIVE)
3887                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3888                         else
3889                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3890                 }
3891
3892                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3893                         hci_sco_setup(conn, ev->status);
3894         }
3895
3896         hci_dev_unlock(hdev);
3897 }
3898
3899 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3900 {
3901         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3902         struct hci_conn *conn;
3903
3904         BT_DBG("%s", hdev->name);
3905
3906         hci_dev_lock(hdev);
3907
3908         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3909         if (!conn)
3910                 goto unlock;
3911
3912         if (conn->state == BT_CONNECTED) {
3913                 hci_conn_hold(conn);
3914                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3915                 hci_conn_drop(conn);
3916         }
3917
3918         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3919             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3920                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3921                              sizeof(ev->bdaddr), &ev->bdaddr);
3922         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3923                 u8 secure;
3924
3925                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3926                         secure = 1;
3927                 else
3928                         secure = 0;
3929
3930                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3931         }
3932
3933 unlock:
3934         hci_dev_unlock(hdev);
3935 }
3936
3937 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3938 {
3939         if (key_type == HCI_LK_CHANGED_COMBINATION)
3940                 return;
3941
3942         conn->pin_length = pin_len;
3943         conn->key_type = key_type;
3944
3945         switch (key_type) {
3946         case HCI_LK_LOCAL_UNIT:
3947         case HCI_LK_REMOTE_UNIT:
3948         case HCI_LK_DEBUG_COMBINATION:
3949                 return;
3950         case HCI_LK_COMBINATION:
3951                 if (pin_len == 16)
3952                         conn->pending_sec_level = BT_SECURITY_HIGH;
3953                 else
3954                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3955                 break;
3956         case HCI_LK_UNAUTH_COMBINATION_P192:
3957         case HCI_LK_UNAUTH_COMBINATION_P256:
3958                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3959                 break;
3960         case HCI_LK_AUTH_COMBINATION_P192:
3961                 conn->pending_sec_level = BT_SECURITY_HIGH;
3962                 break;
3963         case HCI_LK_AUTH_COMBINATION_P256:
3964                 conn->pending_sec_level = BT_SECURITY_FIPS;
3965                 break;
3966         }
3967 }
3968
3969 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3970 {
3971         struct hci_ev_link_key_req *ev = (void *) skb->data;
3972         struct hci_cp_link_key_reply cp;
3973         struct hci_conn *conn;
3974         struct link_key *key;
3975
3976         BT_DBG("%s", hdev->name);
3977
3978         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3979                 return;
3980
3981         hci_dev_lock(hdev);
3982
3983         key = hci_find_link_key(hdev, &ev->bdaddr);
3984         if (!key) {
3985                 BT_DBG("%s link key not found for %pMR", hdev->name,
3986                        &ev->bdaddr);
3987                 goto not_found;
3988         }
3989
3990         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3991                &ev->bdaddr);
3992
3993         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3994         if (conn) {
3995                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3996
3997                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3998                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3999                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4000                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4001                         goto not_found;
4002                 }
4003
4004                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4005                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4006                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4007                         BT_DBG("%s ignoring key unauthenticated for high security",
4008                                hdev->name);
4009                         goto not_found;
4010                 }
4011
4012                 conn_set_key(conn, key->type, key->pin_len);
4013         }
4014
4015         bacpy(&cp.bdaddr, &ev->bdaddr);
4016         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4017
4018         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4019
4020         hci_dev_unlock(hdev);
4021
4022         return;
4023
4024 not_found:
4025         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4026         hci_dev_unlock(hdev);
4027 }
4028
4029 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4030 {
4031         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4032         struct hci_conn *conn;
4033         struct link_key *key;
4034         bool persistent;
4035         u8 pin_len = 0;
4036
4037         BT_DBG("%s", hdev->name);
4038
4039         hci_dev_lock(hdev);
4040
4041         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4042         if (!conn)
4043                 goto unlock;
4044
4045         hci_conn_hold(conn);
4046         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4047         hci_conn_drop(conn);
4048
4049         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4050         conn_set_key(conn, ev->key_type, conn->pin_length);
4051
4052         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4053                 goto unlock;
4054
4055         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4056                                 ev->key_type, pin_len, &persistent);
4057         if (!key)
4058                 goto unlock;
4059
4060         /* Update connection information since adding the key will have
4061          * fixed up the type in the case of changed combination keys.
4062          */
4063         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4064                 conn_set_key(conn, key->type, key->pin_len);
4065
4066         mgmt_new_link_key(hdev, key, persistent);
4067
4068         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4069          * is set. If it's not set simply remove the key from the kernel
4070          * list (we've still notified user space about it but with
4071          * store_hint being 0).
4072          */
4073         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4074             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4075                 list_del_rcu(&key->list);
4076                 kfree_rcu(key, rcu);
4077                 goto unlock;
4078         }
4079
4080         if (persistent)
4081                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4082         else
4083                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4084
4085 unlock:
4086         hci_dev_unlock(hdev);
4087 }
4088
4089 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4090 {
4091         struct hci_ev_clock_offset *ev = (void *) skb->data;
4092         struct hci_conn *conn;
4093
4094         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4095
4096         hci_dev_lock(hdev);
4097
4098         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4099         if (conn && !ev->status) {
4100                 struct inquiry_entry *ie;
4101
4102                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4103                 if (ie) {
4104                         ie->data.clock_offset = ev->clock_offset;
4105                         ie->timestamp = jiffies;
4106                 }
4107         }
4108
4109         hci_dev_unlock(hdev);
4110 }
4111
4112 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4113 {
4114         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4115         struct hci_conn *conn;
4116
4117         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4118
4119         hci_dev_lock(hdev);
4120
4121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4122         if (conn && !ev->status)
4123                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4124
4125         hci_dev_unlock(hdev);
4126 }
4127
4128 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4129 {
4130         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4131         struct inquiry_entry *ie;
4132
4133         BT_DBG("%s", hdev->name);
4134
4135         hci_dev_lock(hdev);
4136
4137         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4138         if (ie) {
4139                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4140                 ie->timestamp = jiffies;
4141         }
4142
4143         hci_dev_unlock(hdev);
4144 }
4145
4146 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4147                                              struct sk_buff *skb)
4148 {
4149         struct inquiry_data data;
4150         int num_rsp = *((__u8 *) skb->data);
4151
4152         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4153
4154         if (!num_rsp)
4155                 return;
4156
4157         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4158                 return;
4159
4160         hci_dev_lock(hdev);
4161
4162         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4163                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4164                 info = (void *) (skb->data + 1);
4165
4166                 for (; num_rsp; num_rsp--, info++) {
4167                         u32 flags;
4168
4169                         bacpy(&data.bdaddr, &info->bdaddr);
4170                         data.pscan_rep_mode     = info->pscan_rep_mode;
4171                         data.pscan_period_mode  = info->pscan_period_mode;
4172                         data.pscan_mode         = info->pscan_mode;
4173                         memcpy(data.dev_class, info->dev_class, 3);
4174                         data.clock_offset       = info->clock_offset;
4175                         data.rssi               = info->rssi;
4176                         data.ssp_mode           = 0x00;
4177
4178                         flags = hci_inquiry_cache_update(hdev, &data, false);
4179
4180                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4181                                           info->dev_class, info->rssi,
4182                                           flags, NULL, 0, NULL, 0);
4183                 }
4184         } else {
4185                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4186
4187                 for (; num_rsp; num_rsp--, info++) {
4188                         u32 flags;
4189
4190                         bacpy(&data.bdaddr, &info->bdaddr);
4191                         data.pscan_rep_mode     = info->pscan_rep_mode;
4192                         data.pscan_period_mode  = info->pscan_period_mode;
4193                         data.pscan_mode         = 0x00;
4194                         memcpy(data.dev_class, info->dev_class, 3);
4195                         data.clock_offset       = info->clock_offset;
4196                         data.rssi               = info->rssi;
4197                         data.ssp_mode           = 0x00;
4198
4199                         flags = hci_inquiry_cache_update(hdev, &data, false);
4200
4201                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4202                                           info->dev_class, info->rssi,
4203                                           flags, NULL, 0, NULL, 0);
4204                 }
4205         }
4206
4207         hci_dev_unlock(hdev);
4208 }
4209
4210 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4211                                         struct sk_buff *skb)
4212 {
4213         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4214         struct hci_conn *conn;
4215
4216         BT_DBG("%s", hdev->name);
4217
4218         hci_dev_lock(hdev);
4219
4220         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4221         if (!conn)
4222                 goto unlock;
4223
4224         if (ev->page < HCI_MAX_PAGES)
4225                 memcpy(conn->features[ev->page], ev->features, 8);
4226
4227         if (!ev->status && ev->page == 0x01) {
4228                 struct inquiry_entry *ie;
4229
4230                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4231                 if (ie)
4232                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4233
4234                 if (ev->features[0] & LMP_HOST_SSP) {
4235                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4236                 } else {
4237                         /* It is mandatory by the Bluetooth specification that
4238                          * Extended Inquiry Results are only used when Secure
4239                          * Simple Pairing is enabled, but some devices violate
4240                          * this.
4241                          *
4242                          * To make these devices work, the internal SSP
4243                          * enabled flag needs to be cleared if the remote host
4244                          * features do not indicate SSP support */
4245                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4246                 }
4247
4248                 if (ev->features[0] & LMP_HOST_SC)
4249                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4250         }
4251
4252         if (conn->state != BT_CONFIG)
4253                 goto unlock;
4254
4255         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4256                 struct hci_cp_remote_name_req cp;
4257                 memset(&cp, 0, sizeof(cp));
4258                 bacpy(&cp.bdaddr, &conn->dst);
4259                 cp.pscan_rep_mode = 0x02;
4260                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4261         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4262                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4263
4264         if (!hci_outgoing_auth_needed(hdev, conn)) {
4265                 conn->state = BT_CONNECTED;
4266                 hci_connect_cfm(conn, ev->status);
4267                 hci_conn_drop(conn);
4268         }
4269
4270 unlock:
4271         hci_dev_unlock(hdev);
4272 }
4273
4274 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4275                                        struct sk_buff *skb)
4276 {
4277         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4278         struct hci_conn *conn;
4279
4280         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4281
4282         hci_dev_lock(hdev);
4283
4284         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4285         if (!conn) {
4286                 if (ev->link_type == ESCO_LINK)
4287                         goto unlock;
4288
4289                 /* When the link type in the event indicates SCO connection
4290                  * and lookup of the connection object fails, then check
4291                  * if an eSCO connection object exists.
4292                  *
4293                  * The core limits the synchronous connections to either
4294                  * SCO or eSCO. The eSCO connection is preferred and tried
4295                  * to be setup first and until successfully established,
4296                  * the link type will be hinted as eSCO.
4297                  */
4298                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4299                 if (!conn)
4300                         goto unlock;
4301         }
4302
4303         switch (ev->status) {
4304         case 0x00:
4305                 conn->handle = __le16_to_cpu(ev->handle);
4306                 conn->state  = BT_CONNECTED;
4307                 conn->type   = ev->link_type;
4308
4309                 hci_debugfs_create_conn(conn);
4310                 hci_conn_add_sysfs(conn);
4311                 break;
4312
4313         case 0x10:      /* Connection Accept Timeout */
4314         case 0x0d:      /* Connection Rejected due to Limited Resources */
4315         case 0x11:      /* Unsupported Feature or Parameter Value */
4316         case 0x1c:      /* SCO interval rejected */
4317         case 0x1a:      /* Unsupported Remote Feature */
4318         case 0x1e:      /* Invalid LMP Parameters */
4319         case 0x1f:      /* Unspecified error */
4320         case 0x20:      /* Unsupported LMP Parameter value */
4321                 if (conn->out) {
4322                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4323                                         (hdev->esco_type & EDR_ESCO_MASK);
4324                         if (hci_setup_sync(conn, conn->link->handle))
4325                                 goto unlock;
4326                 }
4327                 /* fall through */
4328
4329         default:
4330                 conn->state = BT_CLOSED;
4331                 break;
4332         }
4333
4334         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4335
4336         switch (conn->setting & SCO_AIRMODE_MASK) {
4337         case SCO_AIRMODE_CVSD:
4338                 if (hdev->notify)
4339                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4340                 break;
4341         case SCO_AIRMODE_TRANSP:
4342                 if (hdev->notify)
4343                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4344                 break;
4345         }
4346
4347         hci_connect_cfm(conn, ev->status);
4348         if (ev->status)
4349                 hci_conn_del(conn);
4350
4351 unlock:
4352         hci_dev_unlock(hdev);
4353 }
4354
4355 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4356 {
4357         size_t parsed = 0;
4358
4359         while (parsed < eir_len) {
4360                 u8 field_len = eir[0];
4361
4362                 if (field_len == 0)
4363                         return parsed;
4364
4365                 parsed += field_len + 1;
4366                 eir += field_len + 1;
4367         }
4368
4369         return eir_len;
4370 }
4371
4372 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4373                                             struct sk_buff *skb)
4374 {
4375         struct inquiry_data data;
4376         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4377         int num_rsp = *((__u8 *) skb->data);
4378         size_t eir_len;
4379
4380         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4381
4382         if (!num_rsp)
4383                 return;
4384
4385         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4386                 return;
4387
4388         hci_dev_lock(hdev);
4389
4390         for (; num_rsp; num_rsp--, info++) {
4391                 u32 flags;
4392                 bool name_known;
4393
4394                 bacpy(&data.bdaddr, &info->bdaddr);
4395                 data.pscan_rep_mode     = info->pscan_rep_mode;
4396                 data.pscan_period_mode  = info->pscan_period_mode;
4397                 data.pscan_mode         = 0x00;
4398                 memcpy(data.dev_class, info->dev_class, 3);
4399                 data.clock_offset       = info->clock_offset;
4400                 data.rssi               = info->rssi;
4401                 data.ssp_mode           = 0x01;
4402
4403                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4404                         name_known = eir_get_data(info->data,
4405                                                   sizeof(info->data),
4406                                                   EIR_NAME_COMPLETE, NULL);
4407                 else
4408                         name_known = true;
4409
4410                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4411
4412                 eir_len = eir_get_length(info->data, sizeof(info->data));
4413
4414                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4415                                   info->dev_class, info->rssi,
4416                                   flags, info->data, eir_len, NULL, 0);
4417         }
4418
4419         hci_dev_unlock(hdev);
4420 }
4421
4422 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4423                                          struct sk_buff *skb)
4424 {
4425         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4426         struct hci_conn *conn;
4427
4428         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4429                __le16_to_cpu(ev->handle));
4430
4431         hci_dev_lock(hdev);
4432
4433         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4434         if (!conn)
4435                 goto unlock;
4436
4437         /* For BR/EDR the necessary steps are taken through the
4438          * auth_complete event.
4439          */
4440         if (conn->type != LE_LINK)
4441                 goto unlock;
4442
4443         if (!ev->status)
4444                 conn->sec_level = conn->pending_sec_level;
4445
4446         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4447
4448         if (ev->status && conn->state == BT_CONNECTED) {
4449                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4450                 hci_conn_drop(conn);
4451                 goto unlock;
4452         }
4453
4454         if (conn->state == BT_CONFIG) {
4455                 if (!ev->status)
4456                         conn->state = BT_CONNECTED;
4457
4458                 hci_connect_cfm(conn, ev->status);
4459                 hci_conn_drop(conn);
4460         } else {
4461                 hci_auth_cfm(conn, ev->status);
4462
4463                 hci_conn_hold(conn);
4464                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4465                 hci_conn_drop(conn);
4466         }
4467
4468 unlock:
4469         hci_dev_unlock(hdev);
4470 }
4471
4472 static u8 hci_get_auth_req(struct hci_conn *conn)
4473 {
4474         /* If remote requests no-bonding follow that lead */
4475         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4476             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4477                 return conn->remote_auth | (conn->auth_type & 0x01);
4478
4479         /* If both remote and local have enough IO capabilities, require
4480          * MITM protection
4481          */
4482         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4483             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4484                 return conn->remote_auth | 0x01;
4485
4486         /* No MITM protection possible so ignore remote requirement */
4487         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4488 }
4489
4490 static u8 bredr_oob_data_present(struct hci_conn *conn)
4491 {
4492         struct hci_dev *hdev = conn->hdev;
4493         struct oob_data *data;
4494
4495         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4496         if (!data)
4497                 return 0x00;
4498
4499         if (bredr_sc_enabled(hdev)) {
4500                 /* When Secure Connections is enabled, then just
4501                  * return the present value stored with the OOB
4502                  * data. The stored value contains the right present
4503                  * information. However it can only be trusted when
4504                  * not in Secure Connection Only mode.
4505                  */
4506                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4507                         return data->present;
4508
4509                 /* When Secure Connections Only mode is enabled, then
4510                  * the P-256 values are required. If they are not
4511                  * available, then do not declare that OOB data is
4512                  * present.
4513                  */
4514                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4515                     !memcmp(data->hash256, ZERO_KEY, 16))
4516                         return 0x00;
4517
4518                 return 0x02;
4519         }
4520
4521         /* When Secure Connections is not enabled or actually
4522          * not supported by the hardware, then check that if
4523          * P-192 data values are present.
4524          */
4525         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4526             !memcmp(data->hash192, ZERO_KEY, 16))
4527                 return 0x00;
4528
4529         return 0x01;
4530 }
4531
4532 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4533 {
4534         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4535         struct hci_conn *conn;
4536
4537         BT_DBG("%s", hdev->name);
4538
4539         hci_dev_lock(hdev);
4540
4541         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4542         if (!conn)
4543                 goto unlock;
4544
4545         hci_conn_hold(conn);
4546
4547         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4548                 goto unlock;
4549
4550         /* Allow pairing if we're pairable, the initiators of the
4551          * pairing or if the remote is not requesting bonding.
4552          */
4553         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4554             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4555             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4556                 struct hci_cp_io_capability_reply cp;
4557
4558                 bacpy(&cp.bdaddr, &ev->bdaddr);
4559                 /* Change the IO capability from KeyboardDisplay
4560                  * to DisplayYesNo as it is not supported by BT spec. */
4561                 cp.capability = (conn->io_capability == 0x04) ?
4562                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4563
4564                 /* If we are initiators, there is no remote information yet */
4565                 if (conn->remote_auth == 0xff) {
4566                         /* Request MITM protection if our IO caps allow it
4567                          * except for the no-bonding case.
4568                          */
4569                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4570                             conn->auth_type != HCI_AT_NO_BONDING)
4571                                 conn->auth_type |= 0x01;
4572                 } else {
4573                         conn->auth_type = hci_get_auth_req(conn);
4574                 }
4575
4576                 /* If we're not bondable, force one of the non-bondable
4577                  * authentication requirement values.
4578                  */
4579                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4580                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4581
4582                 cp.authentication = conn->auth_type;
4583                 cp.oob_data = bredr_oob_data_present(conn);
4584
4585                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4586                              sizeof(cp), &cp);
4587         } else {
4588                 struct hci_cp_io_capability_neg_reply cp;
4589
4590                 bacpy(&cp.bdaddr, &ev->bdaddr);
4591                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4592
4593                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4594                              sizeof(cp), &cp);
4595         }
4596
4597 unlock:
4598         hci_dev_unlock(hdev);
4599 }
4600
4601 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4602 {
4603         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4604         struct hci_conn *conn;
4605
4606         BT_DBG("%s", hdev->name);
4607
4608         hci_dev_lock(hdev);
4609
4610         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4611         if (!conn)
4612                 goto unlock;
4613
4614         conn->remote_cap = ev->capability;
4615         conn->remote_auth = ev->authentication;
4616
4617 unlock:
4618         hci_dev_unlock(hdev);
4619 }
4620
4621 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4622                                          struct sk_buff *skb)
4623 {
4624         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4625         int loc_mitm, rem_mitm, confirm_hint = 0;
4626         struct hci_conn *conn;
4627
4628         BT_DBG("%s", hdev->name);
4629
4630         hci_dev_lock(hdev);
4631
4632         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4633                 goto unlock;
4634
4635         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4636         if (!conn)
4637                 goto unlock;
4638
4639         loc_mitm = (conn->auth_type & 0x01);
4640         rem_mitm = (conn->remote_auth & 0x01);
4641
4642         /* If we require MITM but the remote device can't provide that
4643          * (it has NoInputNoOutput) then reject the confirmation
4644          * request. We check the security level here since it doesn't
4645          * necessarily match conn->auth_type.
4646          */
4647         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4648             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4649                 BT_DBG("Rejecting request: remote device can't provide MITM");
4650                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4651                              sizeof(ev->bdaddr), &ev->bdaddr);
4652                 goto unlock;
4653         }
4654
4655         /* If no side requires MITM protection; auto-accept */
4656         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4657             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4658
4659                 /* If we're not the initiators request authorization to
4660                  * proceed from user space (mgmt_user_confirm with
4661                  * confirm_hint set to 1). The exception is if neither
4662                  * side had MITM or if the local IO capability is
4663                  * NoInputNoOutput, in which case we do auto-accept
4664                  */
4665                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4666                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4667                     (loc_mitm || rem_mitm)) {
4668                         BT_DBG("Confirming auto-accept as acceptor");
4669                         confirm_hint = 1;
4670                         goto confirm;
4671                 }
4672
4673                 /* If there already exists link key in local host, leave the
4674                  * decision to user space since the remote device could be
4675                  * legitimate or malicious.
4676                  */
4677                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4678                         bt_dev_dbg(hdev, "Local host already has link key");
4679                         confirm_hint = 1;
4680                         goto confirm;
4681                 }
4682
4683                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4684                        hdev->auto_accept_delay);
4685
4686                 if (hdev->auto_accept_delay > 0) {
4687                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4688                         queue_delayed_work(conn->hdev->workqueue,
4689                                            &conn->auto_accept_work, delay);
4690                         goto unlock;
4691                 }
4692
4693                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4694                              sizeof(ev->bdaddr), &ev->bdaddr);
4695                 goto unlock;
4696         }
4697
4698 confirm:
4699         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4700                                   le32_to_cpu(ev->passkey), confirm_hint);
4701
4702 unlock:
4703         hci_dev_unlock(hdev);
4704 }
4705
4706 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4707                                          struct sk_buff *skb)
4708 {
4709         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4710
4711         BT_DBG("%s", hdev->name);
4712
4713         if (hci_dev_test_flag(hdev, HCI_MGMT))
4714                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4715 }
4716
4717 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4718                                         struct sk_buff *skb)
4719 {
4720         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4721         struct hci_conn *conn;
4722
4723         BT_DBG("%s", hdev->name);
4724
4725         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4726         if (!conn)
4727                 return;
4728
4729         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4730         conn->passkey_entered = 0;
4731
4732         if (hci_dev_test_flag(hdev, HCI_MGMT))
4733                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4734                                          conn->dst_type, conn->passkey_notify,
4735                                          conn->passkey_entered);
4736 }
4737
4738 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4739 {
4740         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4741         struct hci_conn *conn;
4742
4743         BT_DBG("%s", hdev->name);
4744
4745         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4746         if (!conn)
4747                 return;
4748
4749         switch (ev->type) {
4750         case HCI_KEYPRESS_STARTED:
4751                 conn->passkey_entered = 0;
4752                 return;
4753
4754         case HCI_KEYPRESS_ENTERED:
4755                 conn->passkey_entered++;
4756                 break;
4757
4758         case HCI_KEYPRESS_ERASED:
4759                 conn->passkey_entered--;
4760                 break;
4761
4762         case HCI_KEYPRESS_CLEARED:
4763                 conn->passkey_entered = 0;
4764                 break;
4765
4766         case HCI_KEYPRESS_COMPLETED:
4767                 return;
4768         }
4769
4770         if (hci_dev_test_flag(hdev, HCI_MGMT))
4771                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4772                                          conn->dst_type, conn->passkey_notify,
4773                                          conn->passkey_entered);
4774 }
4775
4776 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4777                                          struct sk_buff *skb)
4778 {
4779         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4780         struct hci_conn *conn;
4781
4782         BT_DBG("%s", hdev->name);
4783
4784         hci_dev_lock(hdev);
4785
4786         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4787         if (!conn)
4788                 goto unlock;
4789
4790         /* Reset the authentication requirement to unknown */
4791         conn->remote_auth = 0xff;
4792
4793         /* To avoid duplicate auth_failed events to user space we check
4794          * the HCI_CONN_AUTH_PEND flag which will be set if we
4795          * initiated the authentication. A traditional auth_complete
4796          * event gets always produced as initiator and is also mapped to
4797          * the mgmt_auth_failed event */
4798         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4799                 mgmt_auth_failed(conn, ev->status);
4800
4801         hci_conn_drop(conn);
4802
4803 unlock:
4804         hci_dev_unlock(hdev);
4805 }
4806
4807 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4808                                          struct sk_buff *skb)
4809 {
4810         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4811         struct inquiry_entry *ie;
4812         struct hci_conn *conn;
4813
4814         BT_DBG("%s", hdev->name);
4815
4816         hci_dev_lock(hdev);
4817
4818         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4819         if (conn)
4820                 memcpy(conn->features[1], ev->features, 8);
4821
4822         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4823         if (ie)
4824                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4825
4826         hci_dev_unlock(hdev);
4827 }
4828
4829 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4830                                             struct sk_buff *skb)
4831 {
4832         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4833         struct oob_data *data;
4834
4835         BT_DBG("%s", hdev->name);
4836
4837         hci_dev_lock(hdev);
4838
4839         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4840                 goto unlock;
4841
4842         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4843         if (!data) {
4844                 struct hci_cp_remote_oob_data_neg_reply cp;
4845
4846                 bacpy(&cp.bdaddr, &ev->bdaddr);
4847                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4848                              sizeof(cp), &cp);
4849                 goto unlock;
4850         }
4851
4852         if (bredr_sc_enabled(hdev)) {
4853                 struct hci_cp_remote_oob_ext_data_reply cp;
4854
4855                 bacpy(&cp.bdaddr, &ev->bdaddr);
4856                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4857                         memset(cp.hash192, 0, sizeof(cp.hash192));
4858                         memset(cp.rand192, 0, sizeof(cp.rand192));
4859                 } else {
4860                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4861                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4862                 }
4863                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4864                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4865
4866                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4867                              sizeof(cp), &cp);
4868         } else {
4869                 struct hci_cp_remote_oob_data_reply cp;
4870
4871                 bacpy(&cp.bdaddr, &ev->bdaddr);
4872                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4873                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4874
4875                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4876                              sizeof(cp), &cp);
4877         }
4878
4879 unlock:
4880         hci_dev_unlock(hdev);
4881 }
4882
4883 #if IS_ENABLED(CONFIG_BT_HS)
4884 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4885 {
4886         struct hci_ev_channel_selected *ev = (void *)skb->data;
4887         struct hci_conn *hcon;
4888
4889         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4890
4891         skb_pull(skb, sizeof(*ev));
4892
4893         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4894         if (!hcon)
4895                 return;
4896
4897         amp_read_loc_assoc_final_data(hdev, hcon);
4898 }
4899
4900 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4901                                       struct sk_buff *skb)
4902 {
4903         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4904         struct hci_conn *hcon, *bredr_hcon;
4905
4906         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4907                ev->status);
4908
4909         hci_dev_lock(hdev);
4910
4911         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4912         if (!hcon) {
4913                 hci_dev_unlock(hdev);
4914                 return;
4915         }
4916
4917         if (ev->status) {
4918                 hci_conn_del(hcon);
4919                 hci_dev_unlock(hdev);
4920                 return;
4921         }
4922
4923         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4924
4925         hcon->state = BT_CONNECTED;
4926         bacpy(&hcon->dst, &bredr_hcon->dst);
4927
4928         hci_conn_hold(hcon);
4929         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4930         hci_conn_drop(hcon);
4931
4932         hci_debugfs_create_conn(hcon);
4933         hci_conn_add_sysfs(hcon);
4934
4935         amp_physical_cfm(bredr_hcon, hcon);
4936
4937         hci_dev_unlock(hdev);
4938 }
4939
4940 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4941 {
4942         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4943         struct hci_conn *hcon;
4944         struct hci_chan *hchan;
4945         struct amp_mgr *mgr;
4946
4947         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4948                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4949                ev->status);
4950
4951         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4952         if (!hcon)
4953                 return;
4954
4955         /* Create AMP hchan */
4956         hchan = hci_chan_create(hcon);
4957         if (!hchan)
4958                 return;
4959
4960         hchan->handle = le16_to_cpu(ev->handle);
4961
4962         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4963
4964         mgr = hcon->amp_mgr;
4965         if (mgr && mgr->bredr_chan) {
4966                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4967
4968                 l2cap_chan_lock(bredr_chan);
4969
4970                 bredr_chan->conn->mtu = hdev->block_mtu;
4971                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4972                 hci_conn_hold(hcon);
4973
4974                 l2cap_chan_unlock(bredr_chan);
4975         }
4976 }
4977
4978 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4979                                              struct sk_buff *skb)
4980 {
4981         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4982         struct hci_chan *hchan;
4983
4984         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4985                le16_to_cpu(ev->handle), ev->status);
4986
4987         if (ev->status)
4988                 return;
4989
4990         hci_dev_lock(hdev);
4991
4992         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4993         if (!hchan)
4994                 goto unlock;
4995
4996         amp_destroy_logical_link(hchan, ev->reason);
4997
4998 unlock:
4999         hci_dev_unlock(hdev);
5000 }
5001
5002 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5003                                              struct sk_buff *skb)
5004 {
5005         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5006         struct hci_conn *hcon;
5007
5008         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5009
5010         if (ev->status)
5011                 return;
5012
5013         hci_dev_lock(hdev);
5014
5015         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5016         if (hcon) {
5017                 hcon->state = BT_CLOSED;
5018                 hci_conn_del(hcon);
5019         }
5020
5021         hci_dev_unlock(hdev);
5022 }
5023 #endif
5024
5025 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5026                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
5027                         u16 interval, u16 latency, u16 supervision_timeout)
5028 {
5029         struct hci_conn_params *params;
5030         struct hci_conn *conn;
5031         struct smp_irk *irk;
5032         u8 addr_type;
5033
5034         hci_dev_lock(hdev);
5035
5036         /* All controllers implicitly stop advertising in the event of a
5037          * connection, so ensure that the state bit is cleared.
5038          */
5039         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5040
5041         conn = hci_lookup_le_connect(hdev);
5042         if (!conn) {
5043                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5044                 if (!conn) {
5045                         bt_dev_err(hdev, "no memory for new connection");
5046                         goto unlock;
5047                 }
5048
5049                 conn->dst_type = bdaddr_type;
5050
5051                 /* If we didn't have a hci_conn object previously
5052                  * but we're in master role this must be something
5053                  * initiated using a white list. Since white list based
5054                  * connections are not "first class citizens" we don't
5055                  * have full tracking of them. Therefore, we go ahead
5056                  * with a "best effort" approach of determining the
5057                  * initiator address based on the HCI_PRIVACY flag.
5058                  */
5059                 if (conn->out) {
5060                         conn->resp_addr_type = bdaddr_type;
5061                         bacpy(&conn->resp_addr, bdaddr);
5062                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5063                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5064                                 bacpy(&conn->init_addr, &hdev->rpa);
5065                         } else {
5066                                 hci_copy_identity_address(hdev,
5067                                                           &conn->init_addr,
5068                                                           &conn->init_addr_type);
5069                         }
5070                 }
5071         } else {
5072                 cancel_delayed_work(&conn->le_conn_timeout);
5073         }
5074
5075         if (!conn->out) {
5076                 /* Set the responder (our side) address type based on
5077                  * the advertising address type.
5078                  */
5079                 conn->resp_addr_type = hdev->adv_addr_type;
5080                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5081                         /* In case of ext adv, resp_addr will be updated in
5082                          * Adv Terminated event.
5083                          */
5084                         if (!ext_adv_capable(hdev))
5085                                 bacpy(&conn->resp_addr, &hdev->random_addr);
5086                 } else {
5087                         bacpy(&conn->resp_addr, &hdev->bdaddr);
5088                 }
5089
5090                 conn->init_addr_type = bdaddr_type;
5091                 bacpy(&conn->init_addr, bdaddr);
5092
5093                 /* For incoming connections, set the default minimum
5094                  * and maximum connection interval. They will be used
5095                  * to check if the parameters are in range and if not
5096                  * trigger the connection update procedure.
5097                  */
5098                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
5099                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
5100         }
5101
5102         /* Lookup the identity address from the stored connection
5103          * address and address type.
5104          *
5105          * When establishing connections to an identity address, the
5106          * connection procedure will store the resolvable random
5107          * address first. Now if it can be converted back into the
5108          * identity address, start using the identity address from
5109          * now on.
5110          */
5111         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5112         if (irk) {
5113                 bacpy(&conn->dst, &irk->bdaddr);
5114                 conn->dst_type = irk->addr_type;
5115         }
5116
5117         if (status) {
5118                 hci_le_conn_failed(conn, status);
5119                 goto unlock;
5120         }
5121
5122         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5123                 addr_type = BDADDR_LE_PUBLIC;
5124         else
5125                 addr_type = BDADDR_LE_RANDOM;
5126
5127         /* Drop the connection if the device is blocked */
5128         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5129                 hci_conn_drop(conn);
5130                 goto unlock;
5131         }
5132
5133         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5134                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
5135
5136         conn->sec_level = BT_SECURITY_LOW;
5137         conn->handle = handle;
5138         conn->state = BT_CONFIG;
5139
5140         conn->le_conn_interval = interval;
5141         conn->le_conn_latency = latency;
5142         conn->le_supv_timeout = supervision_timeout;
5143
5144         hci_debugfs_create_conn(conn);
5145         hci_conn_add_sysfs(conn);
5146
5147         /* The remote features procedure is defined for master
5148          * role only. So only in case of an initiated connection
5149          * request the remote features.
5150          *
5151          * If the local controller supports slave-initiated features
5152          * exchange, then requesting the remote features in slave
5153          * role is possible. Otherwise just transition into the
5154          * connected state without requesting the remote features.
5155          */
5156         if (conn->out ||
5157             (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5158                 struct hci_cp_le_read_remote_features cp;
5159
5160                 cp.handle = __cpu_to_le16(conn->handle);
5161
5162                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5163                              sizeof(cp), &cp);
5164
5165                 hci_conn_hold(conn);
5166         } else {
5167                 conn->state = BT_CONNECTED;
5168                 hci_connect_cfm(conn, status);
5169         }
5170
5171         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5172                                            conn->dst_type);
5173         if (params) {
5174                 list_del_init(&params->action);
5175                 if (params->conn) {
5176                         hci_conn_drop(params->conn);
5177                         hci_conn_put(params->conn);
5178                         params->conn = NULL;
5179                 }
5180         }
5181
5182 unlock:
5183         hci_update_background_scan(hdev);
5184         hci_dev_unlock(hdev);
5185 }
5186
5187 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5188 {
5189         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5190
5191         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5192
5193         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5194                              ev->role, le16_to_cpu(ev->handle),
5195                              le16_to_cpu(ev->interval),
5196                              le16_to_cpu(ev->latency),
5197                              le16_to_cpu(ev->supervision_timeout));
5198 }
5199
5200 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5201                                          struct sk_buff *skb)
5202 {
5203         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5204
5205         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5206
5207         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5208                              ev->role, le16_to_cpu(ev->handle),
5209                              le16_to_cpu(ev->interval),
5210                              le16_to_cpu(ev->latency),
5211                              le16_to_cpu(ev->supervision_timeout));
5212 }
5213
5214 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5215 {
5216         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5217         struct hci_conn *conn;
5218
5219         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5220
5221         if (ev->status)
5222                 return;
5223
5224         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5225         if (conn) {
5226                 struct adv_info *adv_instance;
5227
5228                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5229                         return;
5230
5231                 if (!hdev->cur_adv_instance) {
5232                         bacpy(&conn->resp_addr, &hdev->random_addr);
5233                         return;
5234                 }
5235
5236                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5237                 if (adv_instance)
5238                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5239         }
5240 }
5241
5242 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5243                                             struct sk_buff *skb)
5244 {
5245         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5246         struct hci_conn *conn;
5247
5248         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5249
5250         if (ev->status)
5251                 return;
5252
5253         hci_dev_lock(hdev);
5254
5255         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5256         if (conn) {
5257                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5258                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5259                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5260         }
5261
5262         hci_dev_unlock(hdev);
5263 }
5264
5265 /* This function requires the caller holds hdev->lock */
5266 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5267                                               bdaddr_t *addr,
5268                                               u8 addr_type, u8 adv_type,
5269                                               bdaddr_t *direct_rpa)
5270 {
5271         struct hci_conn *conn;
5272         struct hci_conn_params *params;
5273
5274         /* If the event is not connectable don't proceed further */
5275         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5276                 return NULL;
5277
5278         /* Ignore if the device is blocked */
5279         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5280                 return NULL;
5281
5282         /* Most controller will fail if we try to create new connections
5283          * while we have an existing one in slave role.
5284          */
5285         if (hdev->conn_hash.le_num_slave > 0 &&
5286             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5287              !(hdev->le_states[3] & 0x10)))
5288                 return NULL;
5289
5290         /* If we're not connectable only connect devices that we have in
5291          * our pend_le_conns list.
5292          */
5293         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5294                                            addr_type);
5295         if (!params)
5296                 return NULL;
5297
5298         if (!params->explicit_connect) {
5299                 switch (params->auto_connect) {
5300                 case HCI_AUTO_CONN_DIRECT:
5301                         /* Only devices advertising with ADV_DIRECT_IND are
5302                          * triggering a connection attempt. This is allowing
5303                          * incoming connections from slave devices.
5304                          */
5305                         if (adv_type != LE_ADV_DIRECT_IND)
5306                                 return NULL;
5307                         break;
5308                 case HCI_AUTO_CONN_ALWAYS:
5309                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5310                          * are triggering a connection attempt. This means
5311                          * that incoming connections from slave device are
5312                          * accepted and also outgoing connections to slave
5313                          * devices are established when found.
5314                          */
5315                         break;
5316                 default:
5317                         return NULL;
5318                 }
5319         }
5320
5321         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5322                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5323                               direct_rpa);
5324         if (!IS_ERR(conn)) {
5325                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5326                  * by higher layer that tried to connect, if no then
5327                  * store the pointer since we don't really have any
5328                  * other owner of the object besides the params that
5329                  * triggered it. This way we can abort the connection if
5330                  * the parameters get removed and keep the reference
5331                  * count consistent once the connection is established.
5332                  */
5333
5334                 if (!params->explicit_connect)
5335                         params->conn = hci_conn_get(conn);
5336
5337                 return conn;
5338         }
5339
5340         switch (PTR_ERR(conn)) {
5341         case -EBUSY:
5342                 /* If hci_connect() returns -EBUSY it means there is already
5343                  * an LE connection attempt going on. Since controllers don't
5344                  * support more than one connection attempt at the time, we
5345                  * don't consider this an error case.
5346                  */
5347                 break;
5348         default:
5349                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5350                 return NULL;
5351         }
5352
5353         return NULL;
5354 }
5355
5356 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5357                                u8 bdaddr_type, bdaddr_t *direct_addr,
5358                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5359 {
5360         struct discovery_state *d = &hdev->discovery;
5361         struct smp_irk *irk;
5362         struct hci_conn *conn;
5363         bool match;
5364         u32 flags;
5365         u8 *ptr, real_len;
5366
5367         switch (type) {
5368         case LE_ADV_IND:
5369         case LE_ADV_DIRECT_IND:
5370         case LE_ADV_SCAN_IND:
5371         case LE_ADV_NONCONN_IND:
5372         case LE_ADV_SCAN_RSP:
5373                 break;
5374         default:
5375                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5376                                        "type: 0x%02x", type);
5377                 return;
5378         }
5379
5380         /* Find the end of the data in case the report contains padded zero
5381          * bytes at the end causing an invalid length value.
5382          *
5383          * When data is NULL, len is 0 so there is no need for extra ptr
5384          * check as 'ptr < data + 0' is already false in such case.
5385          */
5386         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5387                 if (ptr + 1 + *ptr > data + len)
5388                         break;
5389         }
5390
5391         real_len = ptr - data;
5392
5393         /* Adjust for actual length */
5394         if (len != real_len) {
5395                 bt_dev_err_ratelimited(hdev, "advertising data len corrected %u -> %u",
5396                                        len, real_len);
5397                 len = real_len;
5398         }
5399
5400         /* If the direct address is present, then this report is from
5401          * a LE Direct Advertising Report event. In that case it is
5402          * important to see if the address is matching the local
5403          * controller address.
5404          */
5405         if (direct_addr) {
5406                 /* Only resolvable random addresses are valid for these
5407                  * kind of reports and others can be ignored.
5408                  */
5409                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5410                         return;
5411
5412                 /* If the controller is not using resolvable random
5413                  * addresses, then this report can be ignored.
5414                  */
5415                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5416                         return;
5417
5418                 /* If the local IRK of the controller does not match
5419                  * with the resolvable random address provided, then
5420                  * this report can be ignored.
5421                  */
5422                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5423                         return;
5424         }
5425
5426         /* Check if we need to convert to identity address */
5427         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5428         if (irk) {
5429                 bdaddr = &irk->bdaddr;
5430                 bdaddr_type = irk->addr_type;
5431         }
5432
5433         /* Check if we have been requested to connect to this device.
5434          *
5435          * direct_addr is set only for directed advertising reports (it is NULL
5436          * for advertising reports) and is already verified to be RPA above.
5437          */
5438         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5439                                                                 direct_addr);
5440         if (conn && type == LE_ADV_IND) {
5441                 /* Store report for later inclusion by
5442                  * mgmt_device_connected
5443                  */
5444                 memcpy(conn->le_adv_data, data, len);
5445                 conn->le_adv_data_len = len;
5446         }
5447
5448         /* Passive scanning shouldn't trigger any device found events,
5449          * except for devices marked as CONN_REPORT for which we do send
5450          * device found events.
5451          */
5452         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5453                 if (type == LE_ADV_DIRECT_IND)
5454                         return;
5455
5456                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5457                                                bdaddr, bdaddr_type))
5458                         return;
5459
5460                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5461                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5462                 else
5463                         flags = 0;
5464                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5465                                   rssi, flags, data, len, NULL, 0);
5466                 return;
5467         }
5468
5469         /* When receiving non-connectable or scannable undirected
5470          * advertising reports, this means that the remote device is
5471          * not connectable and then clearly indicate this in the
5472          * device found event.
5473          *
5474          * When receiving a scan response, then there is no way to
5475          * know if the remote device is connectable or not. However
5476          * since scan responses are merged with a previously seen
5477          * advertising report, the flags field from that report
5478          * will be used.
5479          *
5480          * In the really unlikely case that a controller get confused
5481          * and just sends a scan response event, then it is marked as
5482          * not connectable as well.
5483          */
5484         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5485             type == LE_ADV_SCAN_RSP)
5486                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5487         else
5488                 flags = 0;
5489
5490         /* If there's nothing pending either store the data from this
5491          * event or send an immediate device found event if the data
5492          * should not be stored for later.
5493          */
5494         if (!has_pending_adv_report(hdev)) {
5495                 /* If the report will trigger a SCAN_REQ store it for
5496                  * later merging.
5497                  */
5498                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5499                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5500                                                  rssi, flags, data, len);
5501                         return;
5502                 }
5503
5504                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5505                                   rssi, flags, data, len, NULL, 0);
5506                 return;
5507         }
5508
5509         /* Check if the pending report is for the same device as the new one */
5510         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5511                  bdaddr_type == d->last_adv_addr_type);
5512
5513         /* If the pending data doesn't match this report or this isn't a
5514          * scan response (e.g. we got a duplicate ADV_IND) then force
5515          * sending of the pending data.
5516          */
5517         if (type != LE_ADV_SCAN_RSP || !match) {
5518                 /* Send out whatever is in the cache, but skip duplicates */
5519                 if (!match)
5520                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5521                                           d->last_adv_addr_type, NULL,
5522                                           d->last_adv_rssi, d->last_adv_flags,
5523                                           d->last_adv_data,
5524                                           d->last_adv_data_len, NULL, 0);
5525
5526                 /* If the new report will trigger a SCAN_REQ store it for
5527                  * later merging.
5528                  */
5529                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5530                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5531                                                  rssi, flags, data, len);
5532                         return;
5533                 }
5534
5535                 /* The advertising reports cannot be merged, so clear
5536                  * the pending report and send out a device found event.
5537                  */
5538                 clear_pending_adv_report(hdev);
5539                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5540                                   rssi, flags, data, len, NULL, 0);
5541                 return;
5542         }
5543
5544         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5545          * the new event is a SCAN_RSP. We can therefore proceed with
5546          * sending a merged device found event.
5547          */
5548         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5549                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5550                           d->last_adv_data, d->last_adv_data_len, data, len);
5551         clear_pending_adv_report(hdev);
5552 }
5553
5554 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5555 {
5556         u8 num_reports = skb->data[0];
5557         void *ptr = &skb->data[1];
5558
5559         hci_dev_lock(hdev);
5560
5561         while (num_reports--) {
5562                 struct hci_ev_le_advertising_info *ev = ptr;
5563                 s8 rssi;
5564
5565                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5566                         rssi = ev->data[ev->length];
5567                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5568                                            ev->bdaddr_type, NULL, 0, rssi,
5569                                            ev->data, ev->length);
5570                 } else {
5571                         bt_dev_err(hdev, "Dropping invalid advertising data");
5572                 }
5573
5574                 ptr += sizeof(*ev) + ev->length + 1;
5575         }
5576
5577         hci_dev_unlock(hdev);
5578 }
5579
5580 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5581 {
5582         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5583                 switch (evt_type) {
5584                 case LE_LEGACY_ADV_IND:
5585                         return LE_ADV_IND;
5586                 case LE_LEGACY_ADV_DIRECT_IND:
5587                         return LE_ADV_DIRECT_IND;
5588                 case LE_LEGACY_ADV_SCAN_IND:
5589                         return LE_ADV_SCAN_IND;
5590                 case LE_LEGACY_NONCONN_IND:
5591                         return LE_ADV_NONCONN_IND;
5592                 case LE_LEGACY_SCAN_RSP_ADV:
5593                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5594                         return LE_ADV_SCAN_RSP;
5595                 }
5596
5597                 goto invalid;
5598         }
5599
5600         if (evt_type & LE_EXT_ADV_CONN_IND) {
5601                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5602                         return LE_ADV_DIRECT_IND;
5603
5604                 return LE_ADV_IND;
5605         }
5606
5607         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5608                 return LE_ADV_SCAN_RSP;
5609
5610         if (evt_type & LE_EXT_ADV_SCAN_IND)
5611                 return LE_ADV_SCAN_IND;
5612
5613         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5614             evt_type & LE_EXT_ADV_DIRECT_IND)
5615                 return LE_ADV_NONCONN_IND;
5616
5617 invalid:
5618         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5619                                evt_type);
5620
5621         return LE_ADV_INVALID;
5622 }
5623
5624 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5625 {
5626         u8 num_reports = skb->data[0];
5627         void *ptr = &skb->data[1];
5628
5629         hci_dev_lock(hdev);
5630
5631         while (num_reports--) {
5632                 struct hci_ev_le_ext_adv_report *ev = ptr;
5633                 u8 legacy_evt_type;
5634                 u16 evt_type;
5635
5636                 evt_type = __le16_to_cpu(ev->evt_type);
5637                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5638                 if (legacy_evt_type != LE_ADV_INVALID) {
5639                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5640                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5641                                            ev->data, ev->length);
5642                 }
5643
5644                 ptr += sizeof(*ev) + ev->length;
5645         }
5646
5647         hci_dev_unlock(hdev);
5648 }
5649
5650 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5651                                             struct sk_buff *skb)
5652 {
5653         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5654         struct hci_conn *conn;
5655
5656         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5657
5658         hci_dev_lock(hdev);
5659
5660         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5661         if (conn) {
5662                 if (!ev->status)
5663                         memcpy(conn->features[0], ev->features, 8);
5664
5665                 if (conn->state == BT_CONFIG) {
5666                         __u8 status;
5667
5668                         /* If the local controller supports slave-initiated
5669                          * features exchange, but the remote controller does
5670                          * not, then it is possible that the error code 0x1a
5671                          * for unsupported remote feature gets returned.
5672                          *
5673                          * In this specific case, allow the connection to
5674                          * transition into connected state and mark it as
5675                          * successful.
5676                          */
5677                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5678                             !conn->out && ev->status == 0x1a)
5679                                 status = 0x00;
5680                         else
5681                                 status = ev->status;
5682
5683                         conn->state = BT_CONNECTED;
5684                         hci_connect_cfm(conn, status);
5685                         hci_conn_drop(conn);
5686                 }
5687         }
5688
5689         hci_dev_unlock(hdev);
5690 }
5691
5692 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5693 {
5694         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5695         struct hci_cp_le_ltk_reply cp;
5696         struct hci_cp_le_ltk_neg_reply neg;
5697         struct hci_conn *conn;
5698         struct smp_ltk *ltk;
5699
5700         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5701
5702         hci_dev_lock(hdev);
5703
5704         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5705         if (conn == NULL)
5706                 goto not_found;
5707
5708         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5709         if (!ltk)
5710                 goto not_found;
5711
5712         if (smp_ltk_is_sc(ltk)) {
5713                 /* With SC both EDiv and Rand are set to zero */
5714                 if (ev->ediv || ev->rand)
5715                         goto not_found;
5716         } else {
5717                 /* For non-SC keys check that EDiv and Rand match */
5718                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5719                         goto not_found;
5720         }
5721
5722         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5723         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5724         cp.handle = cpu_to_le16(conn->handle);
5725
5726         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5727
5728         conn->enc_key_size = ltk->enc_size;
5729
5730         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5731
5732         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5733          * temporary key used to encrypt a connection following
5734          * pairing. It is used during the Encrypted Session Setup to
5735          * distribute the keys. Later, security can be re-established
5736          * using a distributed LTK.
5737          */
5738         if (ltk->type == SMP_STK) {
5739                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5740                 list_del_rcu(&ltk->list);
5741                 kfree_rcu(ltk, rcu);
5742         } else {
5743                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5744         }
5745
5746         hci_dev_unlock(hdev);
5747
5748         return;
5749
5750 not_found:
5751         neg.handle = ev->handle;
5752         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5753         hci_dev_unlock(hdev);
5754 }
5755
5756 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5757                                       u8 reason)
5758 {
5759         struct hci_cp_le_conn_param_req_neg_reply cp;
5760
5761         cp.handle = cpu_to_le16(handle);
5762         cp.reason = reason;
5763
5764         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5765                      &cp);
5766 }
5767
5768 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5769                                              struct sk_buff *skb)
5770 {
5771         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5772         struct hci_cp_le_conn_param_req_reply cp;
5773         struct hci_conn *hcon;
5774         u16 handle, min, max, latency, timeout;
5775
5776         handle = le16_to_cpu(ev->handle);
5777         min = le16_to_cpu(ev->interval_min);
5778         max = le16_to_cpu(ev->interval_max);
5779         latency = le16_to_cpu(ev->latency);
5780         timeout = le16_to_cpu(ev->timeout);
5781
5782         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5783         if (!hcon || hcon->state != BT_CONNECTED)
5784                 return send_conn_param_neg_reply(hdev, handle,
5785                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5786
5787         if (hci_check_conn_params(min, max, latency, timeout))
5788                 return send_conn_param_neg_reply(hdev, handle,
5789                                                  HCI_ERROR_INVALID_LL_PARAMS);
5790
5791         if (hcon->role == HCI_ROLE_MASTER) {
5792                 struct hci_conn_params *params;
5793                 u8 store_hint;
5794
5795                 hci_dev_lock(hdev);
5796
5797                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5798                                                 hcon->dst_type);
5799                 if (params) {
5800                         params->conn_min_interval = min;
5801                         params->conn_max_interval = max;
5802                         params->conn_latency = latency;
5803                         params->supervision_timeout = timeout;
5804                         store_hint = 0x01;
5805                 } else{
5806                         store_hint = 0x00;
5807                 }
5808
5809                 hci_dev_unlock(hdev);
5810
5811                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5812                                     store_hint, min, max, latency, timeout);
5813         }
5814
5815         cp.handle = ev->handle;
5816         cp.interval_min = ev->interval_min;
5817         cp.interval_max = ev->interval_max;
5818         cp.latency = ev->latency;
5819         cp.timeout = ev->timeout;
5820         cp.min_ce_len = 0;
5821         cp.max_ce_len = 0;
5822
5823         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5824 }
5825
5826 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5827                                          struct sk_buff *skb)
5828 {
5829         u8 num_reports = skb->data[0];
5830         void *ptr = &skb->data[1];
5831
5832         hci_dev_lock(hdev);
5833
5834         while (num_reports--) {
5835                 struct hci_ev_le_direct_adv_info *ev = ptr;
5836
5837                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5838                                    ev->bdaddr_type, &ev->direct_addr,
5839                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5840
5841                 ptr += sizeof(*ev);
5842         }
5843
5844         hci_dev_unlock(hdev);
5845 }
5846
5847 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
5848 {
5849         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
5850         struct hci_conn *conn;
5851
5852         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5853
5854         if (!ev->status)
5855                 return;
5856
5857         hci_dev_lock(hdev);
5858
5859         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5860         if (!conn)
5861                 goto unlock;
5862
5863         conn->le_tx_phy = ev->tx_phy;
5864         conn->le_rx_phy = ev->rx_phy;
5865
5866 unlock:
5867         hci_dev_unlock(hdev);
5868 }
5869
5870 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5871 {
5872         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5873
5874         skb_pull(skb, sizeof(*le_ev));
5875
5876         switch (le_ev->subevent) {
5877         case HCI_EV_LE_CONN_COMPLETE:
5878                 hci_le_conn_complete_evt(hdev, skb);
5879                 break;
5880
5881         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5882                 hci_le_conn_update_complete_evt(hdev, skb);
5883                 break;
5884
5885         case HCI_EV_LE_ADVERTISING_REPORT:
5886                 hci_le_adv_report_evt(hdev, skb);
5887                 break;
5888
5889         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5890                 hci_le_remote_feat_complete_evt(hdev, skb);
5891                 break;
5892
5893         case HCI_EV_LE_LTK_REQ:
5894                 hci_le_ltk_request_evt(hdev, skb);
5895                 break;
5896
5897         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5898                 hci_le_remote_conn_param_req_evt(hdev, skb);
5899                 break;
5900
5901         case HCI_EV_LE_DIRECT_ADV_REPORT:
5902                 hci_le_direct_adv_report_evt(hdev, skb);
5903                 break;
5904
5905         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
5906                 hci_le_phy_update_evt(hdev, skb);
5907                 break;
5908
5909         case HCI_EV_LE_EXT_ADV_REPORT:
5910                 hci_le_ext_adv_report_evt(hdev, skb);
5911                 break;
5912
5913         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5914                 hci_le_enh_conn_complete_evt(hdev, skb);
5915                 break;
5916
5917         case HCI_EV_LE_EXT_ADV_SET_TERM:
5918                 hci_le_ext_adv_term_evt(hdev, skb);
5919                 break;
5920
5921         default:
5922                 break;
5923         }
5924 }
5925
5926 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5927                                  u8 event, struct sk_buff *skb)
5928 {
5929         struct hci_ev_cmd_complete *ev;
5930         struct hci_event_hdr *hdr;
5931
5932         if (!skb)
5933                 return false;
5934
5935         if (skb->len < sizeof(*hdr)) {
5936                 bt_dev_err(hdev, "too short HCI event");
5937                 return false;
5938         }
5939
5940         hdr = (void *) skb->data;
5941         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5942
5943         if (event) {
5944                 if (hdr->evt != event)
5945                         return false;
5946                 return true;
5947         }
5948
5949         /* Check if request ended in Command Status - no way to retreive
5950          * any extra parameters in this case.
5951          */
5952         if (hdr->evt == HCI_EV_CMD_STATUS)
5953                 return false;
5954
5955         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5956                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5957                            hdr->evt);
5958                 return false;
5959         }
5960
5961         if (skb->len < sizeof(*ev)) {
5962                 bt_dev_err(hdev, "too short cmd_complete event");
5963                 return false;
5964         }
5965
5966         ev = (void *) skb->data;
5967         skb_pull(skb, sizeof(*ev));
5968
5969         if (opcode != __le16_to_cpu(ev->opcode)) {
5970                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5971                        __le16_to_cpu(ev->opcode));
5972                 return false;
5973         }
5974
5975         return true;
5976 }
5977
5978 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5979 {
5980         struct hci_event_hdr *hdr = (void *) skb->data;
5981         hci_req_complete_t req_complete = NULL;
5982         hci_req_complete_skb_t req_complete_skb = NULL;
5983         struct sk_buff *orig_skb = NULL;
5984         u8 status = 0, event = hdr->evt, req_evt = 0;
5985         u16 opcode = HCI_OP_NOP;
5986
5987         if (!event) {
5988                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
5989                 goto done;
5990         }
5991
5992         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5993                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5994                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5995                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5996                                      &req_complete_skb);
5997                 req_evt = event;
5998         }
5999
6000         /* If it looks like we might end up having to call
6001          * req_complete_skb, store a pristine copy of the skb since the
6002          * various handlers may modify the original one through
6003          * skb_pull() calls, etc.
6004          */
6005         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6006             event == HCI_EV_CMD_COMPLETE)
6007                 orig_skb = skb_clone(skb, GFP_KERNEL);
6008
6009         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6010
6011         switch (event) {
6012         case HCI_EV_INQUIRY_COMPLETE:
6013                 hci_inquiry_complete_evt(hdev, skb);
6014                 break;
6015
6016         case HCI_EV_INQUIRY_RESULT:
6017                 hci_inquiry_result_evt(hdev, skb);
6018                 break;
6019
6020         case HCI_EV_CONN_COMPLETE:
6021                 hci_conn_complete_evt(hdev, skb);
6022                 break;
6023
6024         case HCI_EV_CONN_REQUEST:
6025                 hci_conn_request_evt(hdev, skb);
6026                 break;
6027
6028         case HCI_EV_DISCONN_COMPLETE:
6029                 hci_disconn_complete_evt(hdev, skb);
6030                 break;
6031
6032         case HCI_EV_AUTH_COMPLETE:
6033                 hci_auth_complete_evt(hdev, skb);
6034                 break;
6035
6036         case HCI_EV_REMOTE_NAME:
6037                 hci_remote_name_evt(hdev, skb);
6038                 break;
6039
6040         case HCI_EV_ENCRYPT_CHANGE:
6041                 hci_encrypt_change_evt(hdev, skb);
6042                 break;
6043
6044         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6045                 hci_change_link_key_complete_evt(hdev, skb);
6046                 break;
6047
6048         case HCI_EV_REMOTE_FEATURES:
6049                 hci_remote_features_evt(hdev, skb);
6050                 break;
6051
6052         case HCI_EV_CMD_COMPLETE:
6053                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6054                                      &req_complete, &req_complete_skb);
6055                 break;
6056
6057         case HCI_EV_CMD_STATUS:
6058                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6059                                    &req_complete_skb);
6060                 break;
6061
6062         case HCI_EV_HARDWARE_ERROR:
6063                 hci_hardware_error_evt(hdev, skb);
6064                 break;
6065
6066         case HCI_EV_ROLE_CHANGE:
6067                 hci_role_change_evt(hdev, skb);
6068                 break;
6069
6070         case HCI_EV_NUM_COMP_PKTS:
6071                 hci_num_comp_pkts_evt(hdev, skb);
6072                 break;
6073
6074         case HCI_EV_MODE_CHANGE:
6075                 hci_mode_change_evt(hdev, skb);
6076                 break;
6077
6078         case HCI_EV_PIN_CODE_REQ:
6079                 hci_pin_code_request_evt(hdev, skb);
6080                 break;
6081
6082         case HCI_EV_LINK_KEY_REQ:
6083                 hci_link_key_request_evt(hdev, skb);
6084                 break;
6085
6086         case HCI_EV_LINK_KEY_NOTIFY:
6087                 hci_link_key_notify_evt(hdev, skb);
6088                 break;
6089
6090         case HCI_EV_CLOCK_OFFSET:
6091                 hci_clock_offset_evt(hdev, skb);
6092                 break;
6093
6094         case HCI_EV_PKT_TYPE_CHANGE:
6095                 hci_pkt_type_change_evt(hdev, skb);
6096                 break;
6097
6098         case HCI_EV_PSCAN_REP_MODE:
6099                 hci_pscan_rep_mode_evt(hdev, skb);
6100                 break;
6101
6102         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6103                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6104                 break;
6105
6106         case HCI_EV_REMOTE_EXT_FEATURES:
6107                 hci_remote_ext_features_evt(hdev, skb);
6108                 break;
6109
6110         case HCI_EV_SYNC_CONN_COMPLETE:
6111                 hci_sync_conn_complete_evt(hdev, skb);
6112                 break;
6113
6114         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6115                 hci_extended_inquiry_result_evt(hdev, skb);
6116                 break;
6117
6118         case HCI_EV_KEY_REFRESH_COMPLETE:
6119                 hci_key_refresh_complete_evt(hdev, skb);
6120                 break;
6121
6122         case HCI_EV_IO_CAPA_REQUEST:
6123                 hci_io_capa_request_evt(hdev, skb);
6124                 break;
6125
6126         case HCI_EV_IO_CAPA_REPLY:
6127                 hci_io_capa_reply_evt(hdev, skb);
6128                 break;
6129
6130         case HCI_EV_USER_CONFIRM_REQUEST:
6131                 hci_user_confirm_request_evt(hdev, skb);
6132                 break;
6133
6134         case HCI_EV_USER_PASSKEY_REQUEST:
6135                 hci_user_passkey_request_evt(hdev, skb);
6136                 break;
6137
6138         case HCI_EV_USER_PASSKEY_NOTIFY:
6139                 hci_user_passkey_notify_evt(hdev, skb);
6140                 break;
6141
6142         case HCI_EV_KEYPRESS_NOTIFY:
6143                 hci_keypress_notify_evt(hdev, skb);
6144                 break;
6145
6146         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6147                 hci_simple_pair_complete_evt(hdev, skb);
6148                 break;
6149
6150         case HCI_EV_REMOTE_HOST_FEATURES:
6151                 hci_remote_host_features_evt(hdev, skb);
6152                 break;
6153
6154         case HCI_EV_LE_META:
6155                 hci_le_meta_evt(hdev, skb);
6156                 break;
6157
6158         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6159                 hci_remote_oob_data_request_evt(hdev, skb);
6160                 break;
6161
6162 #if IS_ENABLED(CONFIG_BT_HS)
6163         case HCI_EV_CHANNEL_SELECTED:
6164                 hci_chan_selected_evt(hdev, skb);
6165                 break;
6166
6167         case HCI_EV_PHY_LINK_COMPLETE:
6168                 hci_phy_link_complete_evt(hdev, skb);
6169                 break;
6170
6171         case HCI_EV_LOGICAL_LINK_COMPLETE:
6172                 hci_loglink_complete_evt(hdev, skb);
6173                 break;
6174
6175         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6176                 hci_disconn_loglink_complete_evt(hdev, skb);
6177                 break;
6178
6179         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6180                 hci_disconn_phylink_complete_evt(hdev, skb);
6181                 break;
6182 #endif
6183
6184         case HCI_EV_NUM_COMP_BLOCKS:
6185                 hci_num_comp_blocks_evt(hdev, skb);
6186                 break;
6187
6188         case HCI_EV_VENDOR:
6189                 msft_vendor_evt(hdev, skb);
6190                 break;
6191
6192         default:
6193                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6194                 break;
6195         }
6196
6197         if (req_complete) {
6198                 req_complete(hdev, status, opcode);
6199         } else if (req_complete_skb) {
6200                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6201                         kfree_skb(orig_skb);
6202                         orig_skb = NULL;
6203                 }
6204                 req_complete_skb(hdev, status, opcode, orig_skb);
6205         }
6206
6207 done:
6208         kfree_skb(orig_skb);
6209         kfree_skb(skb);
6210         hdev->stat.evt_rx++;
6211 }