net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  59         hci_dev_unlock(hdev);
  60
  61         hci_conn_check_pending(hdev);
  62 }
  63
  64 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  65 {
  66         __u8 status = *((__u8 *) skb->data);
  67
  68         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  69
  70         if (status)
  71                 return;
  72
  73         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  86
  87         hci_conn_check_pending(hdev);
  88 }
  89
  90 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  91                                           struct sk_buff *skb)
  92 {
  93         BT_DBG("%s", hdev->name);
  94 }
  95
  96 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         struct hci_rp_role_discovery *rp = (void *) skb->data;
  99         struct hci_conn *conn;
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 102
 103         if (rp->status)
 104                 return;
 105
 106         hci_dev_lock(hdev);
 107
 108         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 109         if (conn)
 110                 conn->role = rp->role;
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 172                                          struct sk_buff *skb)
 173 {
 174         __u8 status = *((__u8 *) skb->data);
 175         void *sent;
 176
 177         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 178
 179         if (status)
 180                 return;
 181
 182         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 183         if (!sent)
 184                 return;
 185
 186         hdev->link_policy = get_unaligned_le16(sent);
 187 }
 188
 189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192
 193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 194
 195         clear_bit(HCI_RESET, &hdev->flags);
 196
 197         if (status)
 198                 return;
 199
 200         /* Reset all non-persistent flags */
 201         hci_dev_clear_volatile_flags(hdev);
 202
 203         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 204
 205         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 206         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 207
 208         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 209         hdev->adv_data_len = 0;
 210
 211         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 212         hdev->scan_rsp_data_len = 0;
 213
 214         hdev->le_scan_type = LE_SCAN_PASSIVE;
 215
 216         hdev->ssp_debug_mode = 0;
 217
 218         hci_bdaddr_list_clear(&hdev->le_white_list);
 219 }
 220
 221 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 222                                         struct sk_buff *skb)
 223 {
 224         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 225         struct hci_cp_read_stored_link_key *sent;
 226
 227         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 228
 229         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 230         if (!sent)
 231                 return;
 232
 233         if (!rp->status && sent->read_all == 0x01) {
 234                 hdev->stored_max_keys = rp->max_keys;
 235                 hdev->stored_num_keys = rp->num_keys;
 236         }
 237 }
 238
 239 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 240                                           struct sk_buff *skb)
 241 {
 242         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 243
 244         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 245
 246         if (rp->status)
 247                 return;
 248
 249         if (rp->num_keys <= hdev->stored_num_keys)
 250                 hdev->stored_num_keys -= rp->num_keys;
 251         else
 252                 hdev->stored_num_keys = 0;
 253 }
 254
 255 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 256 {
 257         __u8 status = *((__u8 *) skb->data);
 258         void *sent;
 259
 260         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 261
 262         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 263         if (!sent)
 264                 return;
 265
 266         hci_dev_lock(hdev);
 267
 268         if (hci_dev_test_flag(hdev, HCI_MGMT))
 269                 mgmt_set_local_name_complete(hdev, sent, status);
 270         else if (!status)
 271                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 272
 273         hci_dev_unlock(hdev);
 274 }
 275
 276 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         struct hci_rp_read_local_name *rp = (void *) skb->data;
 279
 280         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 281
 282         if (rp->status)
 283                 return;
 284
 285         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 286             hci_dev_test_flag(hdev, HCI_CONFIG))
 287                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 288 }
 289
 290 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         __u8 status = *((__u8 *) skb->data);
 293         void *sent;
 294
 295         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 296
 297         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 298         if (!sent)
 299                 return;
 300
 301         hci_dev_lock(hdev);
 302
 303         if (!status) {
 304                 __u8 param = *((__u8 *) sent);
 305
 306                 if (param == AUTH_ENABLED)
 307                         set_bit(HCI_AUTH, &hdev->flags);
 308                 else
 309                         clear_bit(HCI_AUTH, &hdev->flags);
 310         }
 311
 312         if (hci_dev_test_flag(hdev, HCI_MGMT))
 313                 mgmt_auth_enable_complete(hdev, status);
 314
 315         hci_dev_unlock(hdev);
 316 }
 317
 318 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 319 {
 320         __u8 status = *((__u8 *) skb->data);
 321         __u8 param;
 322         void *sent;
 323
 324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 325
 326         if (status)
 327                 return;
 328
 329         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 330         if (!sent)
 331                 return;
 332
 333         param = *((__u8 *) sent);
 334
 335         if (param)
 336                 set_bit(HCI_ENCRYPT, &hdev->flags);
 337         else
 338                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 339 }
 340
 341 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 342 {
 343         __u8 status = *((__u8 *) skb->data);
 344         __u8 param;
 345         void *sent;
 346
 347         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 348
 349         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 350         if (!sent)
 351                 return;
 352
 353         param = *((__u8 *) sent);
 354
 355         hci_dev_lock(hdev);
 356
 357         if (status) {
 358                 hdev->discov_timeout = 0;
 359                 goto done;
 360         }
 361
 362         if (param & SCAN_INQUIRY)
 363                 set_bit(HCI_ISCAN, &hdev->flags);
 364         else
 365                 clear_bit(HCI_ISCAN, &hdev->flags);
 366
 367         if (param & SCAN_PAGE)
 368                 set_bit(HCI_PSCAN, &hdev->flags);
 369         else
 370                 clear_bit(HCI_PSCAN, &hdev->flags);
 371
 372 done:
 373         hci_dev_unlock(hdev);
 374 }
 375
 376 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 377 {
 378         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 379
 380         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 381
 382         if (rp->status)
 383                 return;
 384
 385         memcpy(hdev->dev_class, rp->dev_class, 3);
 386
 387         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 388                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 389 }
 390
 391 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 392 {
 393         __u8 status = *((__u8 *) skb->data);
 394         void *sent;
 395
 396         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 397
 398         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 399         if (!sent)
 400                 return;
 401
 402         hci_dev_lock(hdev);
 403
 404         if (status == 0)
 405                 memcpy(hdev->dev_class, sent, 3);
 406
 407         if (hci_dev_test_flag(hdev, HCI_MGMT))
 408                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 409
 410         hci_dev_unlock(hdev);
 411 }
 412
 413 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 416         __u16 setting;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 419
 420         if (rp->status)
 421                 return;
 422
 423         setting = __le16_to_cpu(rp->voice_setting);
 424
 425         if (hdev->voice_setting == setting)
 426                 return;
 427
 428         hdev->voice_setting = setting;
 429
 430         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 431
 432         if (hdev->notify)
 433                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 434 }
 435
 436 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 437                                        struct sk_buff *skb)
 438 {
 439         __u8 status = *((__u8 *) skb->data);
 440         __u16 setting;
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         if (status)
 446                 return;
 447
 448         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 449         if (!sent)
 450                 return;
 451
 452         setting = get_unaligned_le16(sent);
 453
 454         if (hdev->voice_setting == setting)
 455                 return;
 456
 457         hdev->voice_setting = setting;
 458
 459         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 460
 461         if (hdev->notify)
 462                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 463 }
 464
 465 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 466                                           struct sk_buff *skb)
 467 {
 468         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 469
 470         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 471
 472         if (rp->status)
 473                 return;
 474
 475         hdev->num_iac = rp->num_iac;
 476
 477         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 478 }
 479
 480 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 481 {
 482         __u8 status = *((__u8 *) skb->data);
 483         struct hci_cp_write_ssp_mode *sent;
 484
 485         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 486
 487         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 488         if (!sent)
 489                 return;
 490
 491         hci_dev_lock(hdev);
 492
 493         if (!status) {
 494                 if (sent->mode)
 495                         hdev->features[1][0] |= LMP_HOST_SSP;
 496                 else
 497                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 498         }
 499
 500         if (hci_dev_test_flag(hdev, HCI_MGMT))
 501                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 502         else if (!status) {
 503                 if (sent->mode)
 504                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 505                 else
 506                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 507         }
 508
 509         hci_dev_unlock(hdev);
 510 }
 511
 512 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 513 {
 514         u8 status = *((u8 *) skb->data);
 515         struct hci_cp_write_sc_support *sent;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 518
 519         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 520         if (!sent)
 521                 return;
 522
 523         hci_dev_lock(hdev);
 524
 525         if (!status) {
 526                 if (sent->support)
 527                         hdev->features[1][0] |= LMP_HOST_SC;
 528                 else
 529                         hdev->features[1][0] &= ~LMP_HOST_SC;
 530         }
 531
 532         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 533                 if (sent->support)
 534                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 535                 else
 536                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 537         }
 538
 539         hci_dev_unlock(hdev);
 540 }
 541
 542 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 543 {
 544         struct hci_rp_read_local_version *rp = (void *) skb->data;
 545
 546         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 547
 548         if (rp->status)
 549                 return;
 550
 551         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 552             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 553                 hdev->hci_ver = rp->hci_ver;
 554                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 555                 hdev->lmp_ver = rp->lmp_ver;
 556                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 557                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 558         }
 559 }
 560
 561 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 562                                        struct sk_buff *skb)
 563 {
 564         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 565
 566         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 567
 568         if (rp->status)
 569                 return;
 570
 571         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 572             hci_dev_test_flag(hdev, HCI_CONFIG))
 573                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 574 }
 575
 576 static void hci_cc_read_local_features(struct hci_dev *hdev,
 577                                        struct sk_buff *skb)
 578 {
 579         struct hci_rp_read_local_features *rp = (void *) skb->data;
 580
 581         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 582
 583         if (rp->status)
 584                 return;
 585
 586         memcpy(hdev->features, rp->features, 8);
 587
 588         /* Adjust default settings according to features
 589          * supported by device. */
 590
 591         if (hdev->features[0][0] & LMP_3SLOT)
 592                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 593
 594         if (hdev->features[0][0] & LMP_5SLOT)
 595                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 596
 597         if (hdev->features[0][1] & LMP_HV2) {
 598                 hdev->pkt_type  |= (HCI_HV2);
 599                 hdev->esco_type |= (ESCO_HV2);
 600         }
 601
 602         if (hdev->features[0][1] & LMP_HV3) {
 603                 hdev->pkt_type  |= (HCI_HV3);
 604                 hdev->esco_type |= (ESCO_HV3);
 605         }
 606
 607         if (lmp_esco_capable(hdev))
 608                 hdev->esco_type |= (ESCO_EV3);
 609
 610         if (hdev->features[0][4] & LMP_EV4)
 611                 hdev->esco_type |= (ESCO_EV4);
 612
 613         if (hdev->features[0][4] & LMP_EV5)
 614                 hdev->esco_type |= (ESCO_EV5);
 615
 616         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 617                 hdev->esco_type |= (ESCO_2EV3);
 618
 619         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 620                 hdev->esco_type |= (ESCO_3EV3);
 621
 622         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 623                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 624 }
 625
 626 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 627                                            struct sk_buff *skb)
 628 {
 629         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 630
 631         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 632
 633         if (rp->status)
 634                 return;
 635
 636         if (hdev->max_page < rp->max_page)
 637                 hdev->max_page = rp->max_page;
 638
 639         if (rp->page < HCI_MAX_PAGES)
 640                 memcpy(hdev->features[rp->page], rp->features, 8);
 641 }
 642
 643 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 644                                           struct sk_buff *skb)
 645 {
 646         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 647
 648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650         if (rp->status)
 651                 return;
 652
 653         hdev->flow_ctl_mode = rp->mode;
 654 }
 655
 656 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 657 {
 658         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 659
 660         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 661
 662         if (rp->status)
 663                 return;
 664
 665         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 666         hdev->sco_mtu  = rp->sco_mtu;
 667         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 668         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 669
 670         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 671                 hdev->sco_mtu  = 64;
 672                 hdev->sco_pkts = 8;
 673         }
 674
 675         hdev->acl_cnt = hdev->acl_pkts;
 676         hdev->sco_cnt = hdev->sco_pkts;
 677
 678         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 679                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 680 }
 681
 682 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 683 {
 684         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 685
 686         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 687
 688         if (rp->status)
 689                 return;
 690
 691         if (test_bit(HCI_INIT, &hdev->flags))
 692                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 693
 694         if (hci_dev_test_flag(hdev, HCI_SETUP))
 695                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 696 }
 697
 698 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 699                                            struct sk_buff *skb)
 700 {
 701         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 702
 703         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 704
 705         if (rp->status)
 706                 return;
 707
 708         if (test_bit(HCI_INIT, &hdev->flags)) {
 709                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 710                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 711         }
 712 }
 713
 714 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 715                                             struct sk_buff *skb)
 716 {
 717         u8 status = *((u8 *) skb->data);
 718         struct hci_cp_write_page_scan_activity *sent;
 719
 720         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 721
 722         if (status)
 723                 return;
 724
 725         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 726         if (!sent)
 727                 return;
 728
 729         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 730         hdev->page_scan_window = __le16_to_cpu(sent->window);
 731 }
 732
 733 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 734                                            struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 return;
 742
 743         if (test_bit(HCI_INIT, &hdev->flags))
 744                 hdev->page_scan_type = rp->type;
 745 }
 746
 747 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 748                                         struct sk_buff *skb)
 749 {
 750         u8 status = *((u8 *) skb->data);
 751         u8 *type;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 754
 755         if (status)
 756                 return;
 757
 758         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 759         if (type)
 760                 hdev->page_scan_type = *type;
 761 }
 762
 763 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 764                                         struct sk_buff *skb)
 765 {
 766         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 767
 768         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 769
 770         if (rp->status)
 771                 return;
 772
 773         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 774         hdev->block_len = __le16_to_cpu(rp->block_len);
 775         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 776
 777         hdev->block_cnt = hdev->num_blocks;
 778
 779         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 780                hdev->block_cnt, hdev->block_len);
 781 }
 782
 783 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 784 {
 785         struct hci_rp_read_clock *rp = (void *) skb->data;
 786         struct hci_cp_read_clock *cp;
 787         struct hci_conn *conn;
 788
 789         BT_DBG("%s", hdev->name);
 790
 791         if (skb->len < sizeof(*rp))
 792                 return;
 793
 794         if (rp->status)
 795                 return;
 796
 797         hci_dev_lock(hdev);
 798
 799         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 800         if (!cp)
 801                 goto unlock;
 802
 803         if (cp->which == 0x00) {
 804                 hdev->clock = le32_to_cpu(rp->clock);
 805                 goto unlock;
 806         }
 807
 808         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 809         if (conn) {
 810                 conn->clock = le32_to_cpu(rp->clock);
 811                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 812         }
 813
 814 unlock:
 815         hci_dev_unlock(hdev);
 816 }
 817
 818 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 819                                        struct sk_buff *skb)
 820 {
 821         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 822
 823         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 824
 825         if (rp->status)
 826                 return;
 827
 828         hdev->amp_status = rp->amp_status;
 829         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 830         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 831         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 832         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 833         hdev->amp_type = rp->amp_type;
 834         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 835         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 836         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 837         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 838 }
 839
 840 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 841                                          struct sk_buff *skb)
 842 {
 843         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 844
 845         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 846
 847         if (rp->status)
 848                 return;
 849
 850         hdev->inq_tx_power = rp->tx_power;
 851 }
 852
 853 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 854 {
 855         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 856         struct hci_cp_pin_code_reply *cp;
 857         struct hci_conn *conn;
 858
 859         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 860
 861         hci_dev_lock(hdev);
 862
 863         if (hci_dev_test_flag(hdev, HCI_MGMT))
 864                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 865
 866         if (rp->status)
 867                 goto unlock;
 868
 869         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 870         if (!cp)
 871                 goto unlock;
 872
 873         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 874         if (conn)
 875                 conn->pin_length = cp->pin_len;
 876
 877 unlock:
 878         hci_dev_unlock(hdev);
 879 }
 880
 881 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 882 {
 883         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 884
 885         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 886
 887         hci_dev_lock(hdev);
 888
 889         if (hci_dev_test_flag(hdev, HCI_MGMT))
 890                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 891                                                  rp->status);
 892
 893         hci_dev_unlock(hdev);
 894 }
 895
 896 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 897                                        struct sk_buff *skb)
 898 {
 899         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 900
 901         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 902
 903         if (rp->status)
 904                 return;
 905
 906         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 907         hdev->le_pkts = rp->le_max_pkt;
 908
 909         hdev->le_cnt = hdev->le_pkts;
 910
 911         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 912 }
 913
 914 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 915                                           struct sk_buff *skb)
 916 {
 917         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 918
 919         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 920
 921         if (rp->status)
 922                 return;
 923
 924         memcpy(hdev->le_features, rp->features, 8);
 925 }
 926
 927 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 928                                         struct sk_buff *skb)
 929 {
 930         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 931
 932         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 933
 934         if (rp->status)
 935                 return;
 936
 937         hdev->adv_tx_power = rp->tx_power;
 938 }
 939
 940 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 941 {
 942         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 943
 944         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 945
 946         hci_dev_lock(hdev);
 947
 948         if (hci_dev_test_flag(hdev, HCI_MGMT))
 949                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 950                                                  rp->status);
 951
 952         hci_dev_unlock(hdev);
 953 }
 954
 955 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 956                                           struct sk_buff *skb)
 957 {
 958         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 959
 960         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 961
 962         hci_dev_lock(hdev);
 963
 964         if (hci_dev_test_flag(hdev, HCI_MGMT))
 965                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 966                                                      ACL_LINK, 0, rp->status);
 967
 968         hci_dev_unlock(hdev);
 969 }
 970
 971 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 972 {
 973         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 974
 975         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 976
 977         hci_dev_lock(hdev);
 978
 979         if (hci_dev_test_flag(hdev, HCI_MGMT))
 980                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 981                                                  0, rp->status);
 982
 983         hci_dev_unlock(hdev);
 984 }
 985
 986 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 987                                           struct sk_buff *skb)
 988 {
 989         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 990
 991         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 992
 993         hci_dev_lock(hdev);
 994
 995         if (hci_dev_test_flag(hdev, HCI_MGMT))
 996                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 997                                                      ACL_LINK, 0, rp->status);
 998
 999         hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1003                                        struct sk_buff *skb)
1004 {
1005         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1006
1007         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1008 }
1009
1010 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1011                                            struct sk_buff *skb)
1012 {
1013         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1014
1015         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1016 }
1017
1018 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1019 {
1020         __u8 status = *((__u8 *) skb->data);
1021         bdaddr_t *sent;
1022
1023         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1024
1025         if (status)
1026                 return;
1027
1028         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1029         if (!sent)
1030                 return;
1031
1032         hci_dev_lock(hdev);
1033
1034         bacpy(&hdev->random_addr, sent);
1035
1036         hci_dev_unlock(hdev);
1037 }
1038
1039 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1040 {
1041         __u8 *sent, status = *((__u8 *) skb->data);
1042
1043         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1044
1045         if (status)
1046                 return;
1047
1048         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1049         if (!sent)
1050                 return;
1051
1052         hci_dev_lock(hdev);
1053
1054         /* If we're doing connection initiation as peripheral. Set a
1055          * timeout in case something goes wrong.
1056          */
1057         if (*sent) {
1058                 struct hci_conn *conn;
1059
1060                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1061
1062                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1063                 if (conn)
1064                         queue_delayed_work(hdev->workqueue,
1065                                            &conn->le_conn_timeout,
1066                                            conn->conn_timeout);
1067         } else {
1068                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1069         }
1070
1071         hci_dev_unlock(hdev);
1072 }
1073
1074 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1075 {
1076         struct hci_cp_le_set_scan_param *cp;
1077         __u8 status = *((__u8 *) skb->data);
1078
1079         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1080
1081         if (status)
1082                 return;
1083
1084         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1085         if (!cp)
1086                 return;
1087
1088         hci_dev_lock(hdev);
1089
1090         hdev->le_scan_type = cp->type;
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static bool has_pending_adv_report(struct hci_dev *hdev)
1096 {
1097         struct discovery_state *d = &hdev->discovery;
1098
1099         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1100 }
1101
1102 static void clear_pending_adv_report(struct hci_dev *hdev)
1103 {
1104         struct discovery_state *d = &hdev->discovery;
1105
1106         bacpy(&d->last_adv_addr, BDADDR_ANY);
1107         d->last_adv_data_len = 0;
1108 }
1109
1110 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1111                                      u8 bdaddr_type, s8 rssi, u32 flags,
1112                                      u8 *data, u8 len)
1113 {
1114         struct discovery_state *d = &hdev->discovery;
1115
1116         bacpy(&d->last_adv_addr, bdaddr);
1117         d->last_adv_addr_type = bdaddr_type;
1118         d->last_adv_rssi = rssi;
1119         d->last_adv_flags = flags;
1120         memcpy(d->last_adv_data, data, len);
1121         d->last_adv_data_len = len;
1122 }
1123
1124 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1125                                       struct sk_buff *skb)
1126 {
1127         struct hci_cp_le_set_scan_enable *cp;
1128         __u8 status = *((__u8 *) skb->data);
1129
1130         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1131
1132         if (status)
1133                 return;
1134
1135         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1136         if (!cp)
1137                 return;
1138
1139         hci_dev_lock(hdev);
1140
1141         switch (cp->enable) {
1142         case LE_SCAN_ENABLE:
1143                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1144                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1145                         clear_pending_adv_report(hdev);
1146                 break;
1147
1148         case LE_SCAN_DISABLE:
1149                 /* We do this here instead of when setting DISCOVERY_STOPPED
1150                  * since the latter would potentially require waiting for
1151                  * inquiry to stop too.
1152                  */
1153                 if (has_pending_adv_report(hdev)) {
1154                         struct discovery_state *d = &hdev->discovery;
1155
1156                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1157                                           d->last_adv_addr_type, NULL,
1158                                           d->last_adv_rssi, d->last_adv_flags,
1159                                           d->last_adv_data,
1160                                           d->last_adv_data_len, NULL, 0);
1161                 }
1162
1163                 /* Cancel this timer so that we don't try to disable scanning
1164                  * when it's already disabled.
1165                  */
1166                 cancel_delayed_work(&hdev->le_scan_disable);
1167
1168                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1169
1170                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1171                  * interrupted scanning due to a connect request. Mark
1172                  * therefore discovery as stopped. If this was not
1173                  * because of a connect request advertising might have
1174                  * been disabled because of active scanning, so
1175                  * re-enable it again if necessary.
1176                  */
1177                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1178                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1179                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1180                          hdev->discovery.state == DISCOVERY_FINDING)
1181                         mgmt_reenable_advertising(hdev);
1182
1183                 break;
1184
1185         default:
1186                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1187                 break;
1188         }
1189
1190         hci_dev_unlock(hdev);
1191 }
1192
1193 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1194                                            struct sk_buff *skb)
1195 {
1196         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1197
1198         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1199
1200         if (rp->status)
1201                 return;
1202
1203         hdev->le_white_list_size = rp->size;
1204 }
1205
1206 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1207                                        struct sk_buff *skb)
1208 {
1209         __u8 status = *((__u8 *) skb->data);
1210
1211         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1212
1213         if (status)
1214                 return;
1215
1216         hci_bdaddr_list_clear(&hdev->le_white_list);
1217 }
1218
1219 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1220                                         struct sk_buff *skb)
1221 {
1222         struct hci_cp_le_add_to_white_list *sent;
1223         __u8 status = *((__u8 *) skb->data);
1224
1225         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1226
1227         if (status)
1228                 return;
1229
1230         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1231         if (!sent)
1232                 return;
1233
1234         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1235                            sent->bdaddr_type);
1236 }
1237
1238 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1239                                           struct sk_buff *skb)
1240 {
1241         struct hci_cp_le_del_from_white_list *sent;
1242         __u8 status = *((__u8 *) skb->data);
1243
1244         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1245
1246         if (status)
1247                 return;
1248
1249         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1250         if (!sent)
1251                 return;
1252
1253         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1254                             sent->bdaddr_type);
1255 }
1256
1257 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1258                                             struct sk_buff *skb)
1259 {
1260         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1261
1262         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1263
1264         if (rp->status)
1265                 return;
1266
1267         memcpy(hdev->le_states, rp->le_states, 8);
1268 }
1269
1270 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1271                                         struct sk_buff *skb)
1272 {
1273         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1274
1275         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1276
1277         if (rp->status)
1278                 return;
1279
1280         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1281         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1282 }
1283
1284 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1285                                          struct sk_buff *skb)
1286 {
1287         struct hci_cp_le_write_def_data_len *sent;
1288         __u8 status = *((__u8 *) skb->data);
1289
1290         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1291
1292         if (status)
1293                 return;
1294
1295         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1296         if (!sent)
1297                 return;
1298
1299         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1300         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1301 }
1302
1303 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1304                                         struct sk_buff *skb)
1305 {
1306         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1307
1308         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1309
1310         if (rp->status)
1311                 return;
1312
1313         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1314         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1315         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1316         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1317 }
1318
1319 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1320                                            struct sk_buff *skb)
1321 {
1322         struct hci_cp_write_le_host_supported *sent;
1323         __u8 status = *((__u8 *) skb->data);
1324
1325         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1326
1327         if (status)
1328                 return;
1329
1330         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1331         if (!sent)
1332                 return;
1333
1334         hci_dev_lock(hdev);
1335
1336         if (sent->le) {
1337                 hdev->features[1][0] |= LMP_HOST_LE;
1338                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1339         } else {
1340                 hdev->features[1][0] &= ~LMP_HOST_LE;
1341                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1342                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1343         }
1344
1345         if (sent->simul)
1346                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1347         else
1348                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1349
1350         hci_dev_unlock(hdev);
1351 }
1352
1353 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1354 {
1355         struct hci_cp_le_set_adv_param *cp;
1356         u8 status = *((u8 *) skb->data);
1357
1358         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1359
1360         if (status)
1361                 return;
1362
1363         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1364         if (!cp)
1365                 return;
1366
1367         hci_dev_lock(hdev);
1368         hdev->adv_addr_type = cp->own_address_type;
1369         hci_dev_unlock(hdev);
1370 }
1371
1372 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1373 {
1374         struct hci_rp_read_rssi *rp = (void *) skb->data;
1375         struct hci_conn *conn;
1376
1377         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1378
1379         if (rp->status)
1380                 return;
1381
1382         hci_dev_lock(hdev);
1383
1384         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1385         if (conn)
1386                 conn->rssi = rp->rssi;
1387
1388         hci_dev_unlock(hdev);
1389 }
1390
1391 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1392 {
1393         struct hci_cp_read_tx_power *sent;
1394         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1395         struct hci_conn *conn;
1396
1397         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1398
1399         if (rp->status)
1400                 return;
1401
1402         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1403         if (!sent)
1404                 return;
1405
1406         hci_dev_lock(hdev);
1407
1408         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1409         if (!conn)
1410                 goto unlock;
1411
1412         switch (sent->type) {
1413         case 0x00:
1414                 conn->tx_power = rp->tx_power;
1415                 break;
1416         case 0x01:
1417                 conn->max_tx_power = rp->tx_power;
1418                 break;
1419         }
1420
1421 unlock:
1422         hci_dev_unlock(hdev);
1423 }
1424
1425 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1426 {
1427         u8 status = *((u8 *) skb->data);
1428         u8 *mode;
1429
1430         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1431
1432         if (status)
1433                 return;
1434
1435         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1436         if (mode)
1437                 hdev->ssp_debug_mode = *mode;
1438 }
1439
1440 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1441 {
1442         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1443
1444         if (status) {
1445                 hci_conn_check_pending(hdev);
1446                 return;
1447         }
1448
1449         set_bit(HCI_INQUIRY, &hdev->flags);
1450 }
1451
1452 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1453 {
1454         struct hci_cp_create_conn *cp;
1455         struct hci_conn *conn;
1456
1457         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1458
1459         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1460         if (!cp)
1461                 return;
1462
1463         hci_dev_lock(hdev);
1464
1465         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1466
1467         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1468
1469         if (status) {
1470                 if (conn && conn->state == BT_CONNECT) {
1471                         if (status != 0x0c || conn->attempt > 2) {
1472                                 conn->state = BT_CLOSED;
1473                                 hci_connect_cfm(conn, status);
1474                                 hci_conn_del(conn);
1475                         } else
1476                                 conn->state = BT_CONNECT2;
1477                 }
1478         } else {
1479                 if (!conn) {
1480                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1481                                             HCI_ROLE_MASTER);
1482                         if (!conn)
1483                                 BT_ERR("No memory for new connection");
1484                 }
1485         }
1486
1487         hci_dev_unlock(hdev);
1488 }
1489
1490 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1491 {
1492         struct hci_cp_add_sco *cp;
1493         struct hci_conn *acl, *sco;
1494         __u16 handle;
1495
1496         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1497
1498         if (!status)
1499                 return;
1500
1501         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1502         if (!cp)
1503                 return;
1504
1505         handle = __le16_to_cpu(cp->handle);
1506
1507         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1508
1509         hci_dev_lock(hdev);
1510
1511         acl = hci_conn_hash_lookup_handle(hdev, handle);
1512         if (acl) {
1513                 sco = acl->link;
1514                 if (sco) {
1515                         sco->state = BT_CLOSED;
1516
1517                         hci_connect_cfm(sco, status);
1518                         hci_conn_del(sco);
1519                 }
1520         }
1521
1522         hci_dev_unlock(hdev);
1523 }
1524
1525 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1526 {
1527         struct hci_cp_auth_requested *cp;
1528         struct hci_conn *conn;
1529
1530         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1531
1532         if (!status)
1533                 return;
1534
1535         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1536         if (!cp)
1537                 return;
1538
1539         hci_dev_lock(hdev);
1540
1541         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1542         if (conn) {
1543                 if (conn->state == BT_CONFIG) {
1544                         hci_connect_cfm(conn, status);
1545                         hci_conn_drop(conn);
1546                 }
1547         }
1548
1549         hci_dev_unlock(hdev);
1550 }
1551
1552 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1553 {
1554         struct hci_cp_set_conn_encrypt *cp;
1555         struct hci_conn *conn;
1556
1557         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1558
1559         if (!status)
1560                 return;
1561
1562         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1563         if (!cp)
1564                 return;
1565
1566         hci_dev_lock(hdev);
1567
1568         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1569         if (conn) {
1570                 if (conn->state == BT_CONFIG) {
1571                         hci_connect_cfm(conn, status);
1572                         hci_conn_drop(conn);
1573                 }
1574         }
1575
1576         hci_dev_unlock(hdev);
1577 }
1578
1579 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1580                                     struct hci_conn *conn)
1581 {
1582         if (conn->state != BT_CONFIG || !conn->out)
1583                 return 0;
1584
1585         if (conn->pending_sec_level == BT_SECURITY_SDP)
1586                 return 0;
1587
1588         /* Only request authentication for SSP connections or non-SSP
1589          * devices with sec_level MEDIUM or HIGH or if MITM protection
1590          * is requested.
1591          */
1592         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1593             conn->pending_sec_level != BT_SECURITY_FIPS &&
1594             conn->pending_sec_level != BT_SECURITY_HIGH &&
1595             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1596                 return 0;
1597
1598         return 1;
1599 }
1600
1601 static int hci_resolve_name(struct hci_dev *hdev,
1602                                    struct inquiry_entry *e)
1603 {
1604         struct hci_cp_remote_name_req cp;
1605
1606         memset(&cp, 0, sizeof(cp));
1607
1608         bacpy(&cp.bdaddr, &e->data.bdaddr);
1609         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1610         cp.pscan_mode = e->data.pscan_mode;
1611         cp.clock_offset = e->data.clock_offset;
1612
1613         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1614 }
1615
1616 static bool hci_resolve_next_name(struct hci_dev *hdev)
1617 {
1618         struct discovery_state *discov = &hdev->discovery;
1619         struct inquiry_entry *e;
1620
1621         if (list_empty(&discov->resolve))
1622                 return false;
1623
1624         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1625         if (!e)
1626                 return false;
1627
1628         if (hci_resolve_name(hdev, e) == 0) {
1629                 e->name_state = NAME_PENDING;
1630                 return true;
1631         }
1632
1633         return false;
1634 }
1635
1636 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1637                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1638 {
1639         struct discovery_state *discov = &hdev->discovery;
1640         struct inquiry_entry *e;
1641
1642         /* Update the mgmt connected state if necessary. Be careful with
1643          * conn objects that exist but are not (yet) connected however.
1644          * Only those in BT_CONFIG or BT_CONNECTED states can be
1645          * considered connected.
1646          */
1647         if (conn &&
1648             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1649             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1650                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1651
1652         if (discov->state == DISCOVERY_STOPPED)
1653                 return;
1654
1655         if (discov->state == DISCOVERY_STOPPING)
1656                 goto discov_complete;
1657
1658         if (discov->state != DISCOVERY_RESOLVING)
1659                 return;
1660
1661         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1662         /* If the device was not found in a list of found devices names of which
1663          * are pending. there is no need to continue resolving a next name as it
1664          * will be done upon receiving another Remote Name Request Complete
1665          * Event */
1666         if (!e)
1667                 return;
1668
1669         list_del(&e->list);
1670         if (name) {
1671                 e->name_state = NAME_KNOWN;
1672                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1673                                  e->data.rssi, name, name_len);
1674         } else {
1675                 e->name_state = NAME_NOT_KNOWN;
1676         }
1677
1678         if (hci_resolve_next_name(hdev))
1679                 return;
1680
1681 discov_complete:
1682         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1683 }
1684
1685 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1686 {
1687         struct hci_cp_remote_name_req *cp;
1688         struct hci_conn *conn;
1689
1690         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1691
1692         /* If successful wait for the name req complete event before
1693          * checking for the need to do authentication */
1694         if (!status)
1695                 return;
1696
1697         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1698         if (!cp)
1699                 return;
1700
1701         hci_dev_lock(hdev);
1702
1703         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1704
1705         if (hci_dev_test_flag(hdev, HCI_MGMT))
1706                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1707
1708         if (!conn)
1709                 goto unlock;
1710
1711         if (!hci_outgoing_auth_needed(hdev, conn))
1712                 goto unlock;
1713
1714         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1715                 struct hci_cp_auth_requested auth_cp;
1716
1717                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1718
1719                 auth_cp.handle = __cpu_to_le16(conn->handle);
1720                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1721                              sizeof(auth_cp), &auth_cp);
1722         }
1723
1724 unlock:
1725         hci_dev_unlock(hdev);
1726 }
1727
1728 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1729 {
1730         struct hci_cp_read_remote_features *cp;
1731         struct hci_conn *conn;
1732
1733         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1734
1735         if (!status)
1736                 return;
1737
1738         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1739         if (!cp)
1740                 return;
1741
1742         hci_dev_lock(hdev);
1743
1744         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1745         if (conn) {
1746                 if (conn->state == BT_CONFIG) {
1747                         hci_connect_cfm(conn, status);
1748                         hci_conn_drop(conn);
1749                 }
1750         }
1751
1752         hci_dev_unlock(hdev);
1753 }
1754
1755 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1756 {
1757         struct hci_cp_read_remote_ext_features *cp;
1758         struct hci_conn *conn;
1759
1760         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1761
1762         if (!status)
1763                 return;
1764
1765         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1766         if (!cp)
1767                 return;
1768
1769         hci_dev_lock(hdev);
1770
1771         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1772         if (conn) {
1773                 if (conn->state == BT_CONFIG) {
1774                         hci_connect_cfm(conn, status);
1775                         hci_conn_drop(conn);
1776                 }
1777         }
1778
1779         hci_dev_unlock(hdev);
1780 }
1781
1782 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1783 {
1784         struct hci_cp_setup_sync_conn *cp;
1785         struct hci_conn *acl, *sco;
1786         __u16 handle;
1787
1788         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1789
1790         if (!status)
1791                 return;
1792
1793         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1794         if (!cp)
1795                 return;
1796
1797         handle = __le16_to_cpu(cp->handle);
1798
1799         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1800
1801         hci_dev_lock(hdev);
1802
1803         acl = hci_conn_hash_lookup_handle(hdev, handle);
1804         if (acl) {
1805                 sco = acl->link;
1806                 if (sco) {
1807                         sco->state = BT_CLOSED;
1808
1809                         hci_connect_cfm(sco, status);
1810                         hci_conn_del(sco);
1811                 }
1812         }
1813
1814         hci_dev_unlock(hdev);
1815 }
1816
1817 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1818 {
1819         struct hci_cp_sniff_mode *cp;
1820         struct hci_conn *conn;
1821
1822         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1823
1824         if (!status)
1825                 return;
1826
1827         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1828         if (!cp)
1829                 return;
1830
1831         hci_dev_lock(hdev);
1832
1833         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1834         if (conn) {
1835                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1836
1837                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1838                         hci_sco_setup(conn, status);
1839         }
1840
1841         hci_dev_unlock(hdev);
1842 }
1843
1844 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1845 {
1846         struct hci_cp_exit_sniff_mode *cp;
1847         struct hci_conn *conn;
1848
1849         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1850
1851         if (!status)
1852                 return;
1853
1854         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1855         if (!cp)
1856                 return;
1857
1858         hci_dev_lock(hdev);
1859
1860         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1861         if (conn) {
1862                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1863
1864                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1865                         hci_sco_setup(conn, status);
1866         }
1867
1868         hci_dev_unlock(hdev);
1869 }
1870
1871 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1872 {
1873         struct hci_cp_disconnect *cp;
1874         struct hci_conn *conn;
1875
1876         if (!status)
1877                 return;
1878
1879         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1880         if (!cp)
1881                 return;
1882
1883         hci_dev_lock(hdev);
1884
1885         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1886         if (conn)
1887                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1888                                        conn->dst_type, status);
1889
1890         hci_dev_unlock(hdev);
1891 }
1892
1893 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1894 {
1895         struct hci_cp_create_phy_link *cp;
1896
1897         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1898
1899         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1900         if (!cp)
1901                 return;
1902
1903         hci_dev_lock(hdev);
1904
1905         if (status) {
1906                 struct hci_conn *hcon;
1907
1908                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1909                 if (hcon)
1910                         hci_conn_del(hcon);
1911         } else {
1912                 amp_write_remote_assoc(hdev, cp->phy_handle);
1913         }
1914
1915         hci_dev_unlock(hdev);
1916 }
1917
1918 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1919 {
1920         struct hci_cp_accept_phy_link *cp;
1921
1922         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1923
1924         if (status)
1925                 return;
1926
1927         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1928         if (!cp)
1929                 return;
1930
1931         amp_write_remote_assoc(hdev, cp->phy_handle);
1932 }
1933
1934 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1935 {
1936         struct hci_cp_le_create_conn *cp;
1937         struct hci_conn *conn;
1938
1939         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1940
1941         /* All connection failure handling is taken care of by the
1942          * hci_le_conn_failed function which is triggered by the HCI
1943          * request completion callbacks used for connecting.
1944          */
1945         if (status)
1946                 return;
1947
1948         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1949         if (!cp)
1950                 return;
1951
1952         hci_dev_lock(hdev);
1953
1954         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1955         if (!conn)
1956                 goto unlock;
1957
1958         /* Store the initiator and responder address information which
1959          * is needed for SMP. These values will not change during the
1960          * lifetime of the connection.
1961          */
1962         conn->init_addr_type = cp->own_address_type;
1963         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1964                 bacpy(&conn->init_addr, &hdev->random_addr);
1965         else
1966                 bacpy(&conn->init_addr, &hdev->bdaddr);
1967
1968         conn->resp_addr_type = cp->peer_addr_type;
1969         bacpy(&conn->resp_addr, &cp->peer_addr);
1970
1971         /* We don't want the connection attempt to stick around
1972          * indefinitely since LE doesn't have a page timeout concept
1973          * like BR/EDR. Set a timer for any connection that doesn't use
1974          * the white list for connecting.
1975          */
1976         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1977                 queue_delayed_work(conn->hdev->workqueue,
1978                                    &conn->le_conn_timeout,
1979                                    conn->conn_timeout);
1980
1981 unlock:
1982         hci_dev_unlock(hdev);
1983 }
1984
1985 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
1986 {
1987         struct hci_cp_le_read_remote_features *cp;
1988         struct hci_conn *conn;
1989
1990         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1991
1992         if (!status)
1993                 return;
1994
1995         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
1996         if (!cp)
1997                 return;
1998
1999         hci_dev_lock(hdev);
2000
2001         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2002         if (conn) {
2003                 if (conn->state == BT_CONFIG) {
2004                         hci_connect_cfm(conn, status);
2005                         hci_conn_drop(conn);
2006                 }
2007         }
2008
2009         hci_dev_unlock(hdev);
2010 }
2011
2012 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2013 {
2014         struct hci_cp_le_start_enc *cp;
2015         struct hci_conn *conn;
2016
2017         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2018
2019         if (!status)
2020                 return;
2021
2022         hci_dev_lock(hdev);
2023
2024         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2025         if (!cp)
2026                 goto unlock;
2027
2028         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2029         if (!conn)
2030                 goto unlock;
2031
2032         if (conn->state != BT_CONNECTED)
2033                 goto unlock;
2034
2035         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2036         hci_conn_drop(conn);
2037
2038 unlock:
2039         hci_dev_unlock(hdev);
2040 }
2041
2042 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2043 {
2044         struct hci_cp_switch_role *cp;
2045         struct hci_conn *conn;
2046
2047         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2048
2049         if (!status)
2050                 return;
2051
2052         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2053         if (!cp)
2054                 return;
2055
2056         hci_dev_lock(hdev);
2057
2058         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2059         if (conn)
2060                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2061
2062         hci_dev_unlock(hdev);
2063 }
2064
2065 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2066 {
2067         __u8 status = *((__u8 *) skb->data);
2068         struct discovery_state *discov = &hdev->discovery;
2069         struct inquiry_entry *e;
2070
2071         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2072
2073         hci_conn_check_pending(hdev);
2074
2075         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2076                 return;
2077
2078         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2079         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2080
2081         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2082                 return;
2083
2084         hci_dev_lock(hdev);
2085
2086         if (discov->state != DISCOVERY_FINDING)
2087                 goto unlock;
2088
2089         if (list_empty(&discov->resolve)) {
2090                 /* When BR/EDR inquiry is active and no LE scanning is in
2091                  * progress, then change discovery state to indicate completion.
2092                  *
2093                  * When running LE scanning and BR/EDR inquiry simultaneously
2094                  * and the LE scan already finished, then change the discovery
2095                  * state to indicate completion.
2096                  */
2097                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2098                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2099                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2100                 goto unlock;
2101         }
2102
2103         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2104         if (e && hci_resolve_name(hdev, e) == 0) {
2105                 e->name_state = NAME_PENDING;
2106                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2107         } else {
2108                 /* When BR/EDR inquiry is active and no LE scanning is in
2109                  * progress, then change discovery state to indicate completion.
2110                  *
2111                  * When running LE scanning and BR/EDR inquiry simultaneously
2112                  * and the LE scan already finished, then change the discovery
2113                  * state to indicate completion.
2114                  */
2115                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2116                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2117                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2118         }
2119
2120 unlock:
2121         hci_dev_unlock(hdev);
2122 }
2123
2124 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2125 {
2126         struct inquiry_data data;
2127         struct inquiry_info *info = (void *) (skb->data + 1);
2128         int num_rsp = *((__u8 *) skb->data);
2129
2130         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2131
2132         if (!num_rsp)
2133                 return;
2134
2135         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2136                 return;
2137
2138         hci_dev_lock(hdev);
2139
2140         for (; num_rsp; num_rsp--, info++) {
2141                 u32 flags;
2142
2143                 bacpy(&data.bdaddr, &info->bdaddr);
2144                 data.pscan_rep_mode     = info->pscan_rep_mode;
2145                 data.pscan_period_mode  = info->pscan_period_mode;
2146                 data.pscan_mode         = info->pscan_mode;
2147                 memcpy(data.dev_class, info->dev_class, 3);
2148                 data.clock_offset       = info->clock_offset;
2149                 data.rssi               = HCI_RSSI_INVALID;
2150                 data.ssp_mode           = 0x00;
2151
2152                 flags = hci_inquiry_cache_update(hdev, &data, false);
2153
2154                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2155                                   info->dev_class, HCI_RSSI_INVALID,
2156                                   flags, NULL, 0, NULL, 0);
2157         }
2158
2159         hci_dev_unlock(hdev);
2160 }
2161
2162 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2163 {
2164         struct hci_ev_conn_complete *ev = (void *) skb->data;
2165         struct hci_conn *conn;
2166
2167         BT_DBG("%s", hdev->name);
2168
2169         hci_dev_lock(hdev);
2170
2171         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2172         if (!conn) {
2173                 if (ev->link_type != SCO_LINK)
2174                         goto unlock;
2175
2176                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2177                 if (!conn)
2178                         goto unlock;
2179
2180                 conn->type = SCO_LINK;
2181         }
2182
2183         if (!ev->status) {
2184                 conn->handle = __le16_to_cpu(ev->handle);
2185
2186                 if (conn->type == ACL_LINK) {
2187                         conn->state = BT_CONFIG;
2188                         hci_conn_hold(conn);
2189
2190                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2191                             !hci_find_link_key(hdev, &ev->bdaddr))
2192                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2193                         else
2194                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2195                 } else
2196                         conn->state = BT_CONNECTED;
2197
2198                 hci_debugfs_create_conn(conn);
2199                 hci_conn_add_sysfs(conn);
2200
2201                 if (test_bit(HCI_AUTH, &hdev->flags))
2202                         set_bit(HCI_CONN_AUTH, &conn->flags);
2203
2204                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2205                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2206
2207                 /* Get remote features */
2208                 if (conn->type == ACL_LINK) {
2209                         struct hci_cp_read_remote_features cp;
2210                         cp.handle = ev->handle;
2211                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2212                                      sizeof(cp), &cp);
2213
2214                         hci_update_page_scan(hdev);
2215                 }
2216
2217                 /* Set packet type for incoming connection */
2218                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2219                         struct hci_cp_change_conn_ptype cp;
2220                         cp.handle = ev->handle;
2221                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2222                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2223                                      &cp);
2224                 }
2225         } else {
2226                 conn->state = BT_CLOSED;
2227                 if (conn->type == ACL_LINK)
2228                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2229                                             conn->dst_type, ev->status);
2230         }
2231
2232         if (conn->type == ACL_LINK)
2233                 hci_sco_setup(conn, ev->status);
2234
2235         if (ev->status) {
2236                 hci_connect_cfm(conn, ev->status);
2237                 hci_conn_del(conn);
2238         } else if (ev->link_type != ACL_LINK)
2239                 hci_connect_cfm(conn, ev->status);
2240
2241 unlock:
2242         hci_dev_unlock(hdev);
2243
2244         hci_conn_check_pending(hdev);
2245 }
2246
2247 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2248 {
2249         struct hci_cp_reject_conn_req cp;
2250
2251         bacpy(&cp.bdaddr, bdaddr);
2252         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2253         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2254 }
2255
2256 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2257 {
2258         struct hci_ev_conn_request *ev = (void *) skb->data;
2259         int mask = hdev->link_mode;
2260         struct inquiry_entry *ie;
2261         struct hci_conn *conn;
2262         __u8 flags = 0;
2263
2264         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2265                ev->link_type);
2266
2267         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2268                                       &flags);
2269
2270         if (!(mask & HCI_LM_ACCEPT)) {
2271                 hci_reject_conn(hdev, &ev->bdaddr);
2272                 return;
2273         }
2274
2275         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2276                                    BDADDR_BREDR)) {
2277                 hci_reject_conn(hdev, &ev->bdaddr);
2278                 return;
2279         }
2280
2281         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2282          * connection. These features are only touched through mgmt so
2283          * only do the checks if HCI_MGMT is set.
2284          */
2285         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2286             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2287             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2288                                     BDADDR_BREDR)) {
2289                     hci_reject_conn(hdev, &ev->bdaddr);
2290                     return;
2291         }
2292
2293         /* Connection accepted */
2294
2295         hci_dev_lock(hdev);
2296
2297         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2298         if (ie)
2299                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2300
2301         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2302                         &ev->bdaddr);
2303         if (!conn) {
2304                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2305                                     HCI_ROLE_SLAVE);
2306                 if (!conn) {
2307                         BT_ERR("No memory for new connection");
2308                         hci_dev_unlock(hdev);
2309                         return;
2310                 }
2311         }
2312
2313         memcpy(conn->dev_class, ev->dev_class, 3);
2314
2315         hci_dev_unlock(hdev);
2316
2317         if (ev->link_type == ACL_LINK ||
2318             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2319                 struct hci_cp_accept_conn_req cp;
2320                 conn->state = BT_CONNECT;
2321
2322                 bacpy(&cp.bdaddr, &ev->bdaddr);
2323
2324                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2325                         cp.role = 0x00; /* Become master */
2326                 else
2327                         cp.role = 0x01; /* Remain slave */
2328
2329                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2330         } else if (!(flags & HCI_PROTO_DEFER)) {
2331                 struct hci_cp_accept_sync_conn_req cp;
2332                 conn->state = BT_CONNECT;
2333
2334                 bacpy(&cp.bdaddr, &ev->bdaddr);
2335                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2336
2337                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2338                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2339                 cp.max_latency    = cpu_to_le16(0xffff);
2340                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2341                 cp.retrans_effort = 0xff;
2342
2343                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2344                              &cp);
2345         } else {
2346                 conn->state = BT_CONNECT2;
2347                 hci_connect_cfm(conn, 0);
2348         }
2349 }
2350
2351 static u8 hci_to_mgmt_reason(u8 err)
2352 {
2353         switch (err) {
2354         case HCI_ERROR_CONNECTION_TIMEOUT:
2355                 return MGMT_DEV_DISCONN_TIMEOUT;
2356         case HCI_ERROR_REMOTE_USER_TERM:
2357         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2358         case HCI_ERROR_REMOTE_POWER_OFF:
2359                 return MGMT_DEV_DISCONN_REMOTE;
2360         case HCI_ERROR_LOCAL_HOST_TERM:
2361                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2362         default:
2363                 return MGMT_DEV_DISCONN_UNKNOWN;
2364         }
2365 }
2366
2367 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2368 {
2369         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2370         u8 reason = hci_to_mgmt_reason(ev->reason);
2371         struct hci_conn_params *params;
2372         struct hci_conn *conn;
2373         bool mgmt_connected;
2374         u8 type;
2375
2376         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2377
2378         hci_dev_lock(hdev);
2379
2380         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2381         if (!conn)
2382                 goto unlock;
2383
2384         if (ev->status) {
2385                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2386                                        conn->dst_type, ev->status);
2387                 goto unlock;
2388         }
2389
2390         conn->state = BT_CLOSED;
2391
2392         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2393         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2394                                 reason, mgmt_connected);
2395
2396         if (conn->type == ACL_LINK) {
2397                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2398                         hci_remove_link_key(hdev, &conn->dst);
2399
2400                 hci_update_page_scan(hdev);
2401         }
2402
2403         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2404         if (params) {
2405                 switch (params->auto_connect) {
2406                 case HCI_AUTO_CONN_LINK_LOSS:
2407                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2408                                 break;
2409                         /* Fall through */
2410
2411                 case HCI_AUTO_CONN_DIRECT:
2412                 case HCI_AUTO_CONN_ALWAYS:
2413                         list_del_init(&params->action);
2414                         list_add(&params->action, &hdev->pend_le_conns);
2415                         hci_update_background_scan(hdev);
2416                         break;
2417
2418                 default:
2419                         break;
2420                 }
2421         }
2422
2423         type = conn->type;
2424
2425         hci_disconn_cfm(conn, ev->reason);
2426         hci_conn_del(conn);
2427
2428         /* Re-enable advertising if necessary, since it might
2429          * have been disabled by the connection. From the
2430          * HCI_LE_Set_Advertise_Enable command description in
2431          * the core specification (v4.0):
2432          * "The Controller shall continue advertising until the Host
2433          * issues an LE_Set_Advertise_Enable command with
2434          * Advertising_Enable set to 0x00 (Advertising is disabled)
2435          * or until a connection is created or until the Advertising
2436          * is timed out due to Directed Advertising."
2437          */
2438         if (type == LE_LINK)
2439                 mgmt_reenable_advertising(hdev);
2440
2441 unlock:
2442         hci_dev_unlock(hdev);
2443 }
2444
2445 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2446 {
2447         struct hci_ev_auth_complete *ev = (void *) skb->data;
2448         struct hci_conn *conn;
2449
2450         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2451
2452         hci_dev_lock(hdev);
2453
2454         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2455         if (!conn)
2456                 goto unlock;
2457
2458         if (!ev->status) {
2459                 if (!hci_conn_ssp_enabled(conn) &&
2460                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2461                         BT_INFO("re-auth of legacy device is not possible.");
2462                 } else {
2463                         set_bit(HCI_CONN_AUTH, &conn->flags);
2464                         conn->sec_level = conn->pending_sec_level;
2465                 }
2466         } else {
2467                 mgmt_auth_failed(conn, ev->status);
2468         }
2469
2470         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2471         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2472
2473         if (conn->state == BT_CONFIG) {
2474                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2475                         struct hci_cp_set_conn_encrypt cp;
2476                         cp.handle  = ev->handle;
2477                         cp.encrypt = 0x01;
2478                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2479                                      &cp);
2480                 } else {
2481                         conn->state = BT_CONNECTED;
2482                         hci_connect_cfm(conn, ev->status);
2483                         hci_conn_drop(conn);
2484                 }
2485         } else {
2486                 hci_auth_cfm(conn, ev->status);
2487
2488                 hci_conn_hold(conn);
2489                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2490                 hci_conn_drop(conn);
2491         }
2492
2493         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2494                 if (!ev->status) {
2495                         struct hci_cp_set_conn_encrypt cp;
2496                         cp.handle  = ev->handle;
2497                         cp.encrypt = 0x01;
2498                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2499                                      &cp);
2500                 } else {
2501                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2502                         hci_encrypt_cfm(conn, ev->status, 0x00);
2503                 }
2504         }
2505
2506 unlock:
2507         hci_dev_unlock(hdev);
2508 }
2509
2510 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2511 {
2512         struct hci_ev_remote_name *ev = (void *) skb->data;
2513         struct hci_conn *conn;
2514
2515         BT_DBG("%s", hdev->name);
2516
2517         hci_conn_check_pending(hdev);
2518
2519         hci_dev_lock(hdev);
2520
2521         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2522
2523         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2524                 goto check_auth;
2525
2526         if (ev->status == 0)
2527                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2528                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2529         else
2530                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2531
2532 check_auth:
2533         if (!conn)
2534                 goto unlock;
2535
2536         if (!hci_outgoing_auth_needed(hdev, conn))
2537                 goto unlock;
2538
2539         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2540                 struct hci_cp_auth_requested cp;
2541
2542                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2543
2544                 cp.handle = __cpu_to_le16(conn->handle);
2545                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2546         }
2547
2548 unlock:
2549         hci_dev_unlock(hdev);
2550 }
2551
2552 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2553                                        u16 opcode, struct sk_buff *skb)
2554 {
2555         const struct hci_rp_read_enc_key_size *rp;
2556         struct hci_conn *conn;
2557         u16 handle;
2558
2559         BT_DBG("%s status 0x%02x", hdev->name, status);
2560
2561         if (!skb || skb->len < sizeof(*rp)) {
2562                 BT_ERR("%s invalid HCI Read Encryption Key Size response",
2563                        hdev->name);
2564                 return;
2565         }
2566
2567         rp = (void *)skb->data;
2568         handle = le16_to_cpu(rp->handle);
2569
2570         hci_dev_lock(hdev);
2571
2572         conn = hci_conn_hash_lookup_handle(hdev, handle);
2573         if (!conn)
2574                 goto unlock;
2575
2576         /* If we fail to read the encryption key size, assume maximum
2577          * (which is the same we do also when this HCI command isn't
2578          * supported.
2579          */
2580         if (rp->status) {
2581                 BT_ERR("%s failed to read key size for handle %u", hdev->name,
2582                        handle);
2583                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2584         } else {
2585                 conn->enc_key_size = rp->key_size;
2586         }
2587
2588         if (conn->state == BT_CONFIG) {
2589                 conn->state = BT_CONNECTED;
2590                 hci_connect_cfm(conn, 0);
2591                 hci_conn_drop(conn);
2592         } else {
2593                 u8 encrypt;
2594
2595                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2596                         encrypt = 0x00;
2597                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2598                         encrypt = 0x02;
2599                 else
2600                         encrypt = 0x01;
2601
2602                 hci_encrypt_cfm(conn, 0, encrypt);
2603         }
2604
2605 unlock:
2606         hci_dev_unlock(hdev);
2607 }
2608
2609 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2610 {
2611         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2612         struct hci_conn *conn;
2613
2614         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2615
2616         hci_dev_lock(hdev);
2617
2618         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2619         if (!conn)
2620                 goto unlock;
2621
2622         if (!ev->status) {
2623                 if (ev->encrypt) {
2624                         /* Encryption implies authentication */
2625                         set_bit(HCI_CONN_AUTH, &conn->flags);
2626                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2627                         conn->sec_level = conn->pending_sec_level;
2628
2629                         /* P-256 authentication key implies FIPS */
2630                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2631                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2632
2633                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2634                             conn->type == LE_LINK)
2635                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2636                 } else {
2637                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2638                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2639                 }
2640         }
2641
2642         /* We should disregard the current RPA and generate a new one
2643          * whenever the encryption procedure fails.
2644          */
2645         if (ev->status && conn->type == LE_LINK)
2646                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2647
2648         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2649
2650         if (ev->status && conn->state == BT_CONNECTED) {
2651                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2652                 hci_conn_drop(conn);
2653                 goto unlock;
2654         }
2655
2656         /* In Secure Connections Only mode, do not allow any connections
2657          * that are not encrypted with AES-CCM using a P-256 authenticated
2658          * combination key.
2659          */
2660         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2661             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2662              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2663                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2664                 hci_conn_drop(conn);
2665                 goto unlock;
2666         }
2667
2668         /* Try reading the encryption key size for encrypted ACL links */
2669         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2670                 struct hci_cp_read_enc_key_size cp;
2671                 struct hci_request req;
2672
2673                 /* Only send HCI_Read_Encryption_Key_Size if the
2674                  * controller really supports it. If it doesn't, assume
2675                  * the default size (16).
2676                  */
2677                 if (!(hdev->commands[20] & 0x10)) {
2678                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2679                         goto notify;
2680                 }
2681
2682                 hci_req_init(&req, hdev);
2683
2684                 cp.handle = cpu_to_le16(conn->handle);
2685                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2686
2687                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2688                         BT_ERR("Sending HCI Read Encryption Key Size failed");
2689                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2690                         goto notify;
2691                 }
2692
2693                 goto unlock;
2694         }
2695
2696 notify:
2697         if (conn->state == BT_CONFIG) {
2698                 if (!ev->status)
2699                         conn->state = BT_CONNECTED;
2700
2701                 hci_connect_cfm(conn, ev->status);
2702                 hci_conn_drop(conn);
2703         } else
2704                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2705
2706 unlock:
2707         hci_dev_unlock(hdev);
2708 }
2709
2710 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2711                                              struct sk_buff *skb)
2712 {
2713         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2714         struct hci_conn *conn;
2715
2716         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2717
2718         hci_dev_lock(hdev);
2719
2720         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2721         if (conn) {
2722                 if (!ev->status)
2723                         set_bit(HCI_CONN_SECURE, &conn->flags);
2724
2725                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2726
2727                 hci_key_change_cfm(conn, ev->status);
2728         }
2729
2730         hci_dev_unlock(hdev);
2731 }
2732
2733 static void hci_remote_features_evt(struct hci_dev *hdev,
2734                                     struct sk_buff *skb)
2735 {
2736         struct hci_ev_remote_features *ev = (void *) skb->data;
2737         struct hci_conn *conn;
2738
2739         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2740
2741         hci_dev_lock(hdev);
2742
2743         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2744         if (!conn)
2745                 goto unlock;
2746
2747         if (!ev->status)
2748                 memcpy(conn->features[0], ev->features, 8);
2749
2750         if (conn->state != BT_CONFIG)
2751                 goto unlock;
2752
2753         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2754             lmp_ext_feat_capable(conn)) {
2755                 struct hci_cp_read_remote_ext_features cp;
2756                 cp.handle = ev->handle;
2757                 cp.page = 0x01;
2758                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2759                              sizeof(cp), &cp);
2760                 goto unlock;
2761         }
2762
2763         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2764                 struct hci_cp_remote_name_req cp;
2765                 memset(&cp, 0, sizeof(cp));
2766                 bacpy(&cp.bdaddr, &conn->dst);
2767                 cp.pscan_rep_mode = 0x02;
2768                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2769         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2770                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2771
2772         if (!hci_outgoing_auth_needed(hdev, conn)) {
2773                 conn->state = BT_CONNECTED;
2774                 hci_connect_cfm(conn, ev->status);
2775                 hci_conn_drop(conn);
2776         }
2777
2778 unlock:
2779         hci_dev_unlock(hdev);
2780 }
2781
2782 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2783                                  u16 *opcode, u8 *status,
2784                                  hci_req_complete_t *req_complete,
2785                                  hci_req_complete_skb_t *req_complete_skb)
2786 {
2787         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2788
2789         *opcode = __le16_to_cpu(ev->opcode);
2790         *status = skb->data[sizeof(*ev)];
2791
2792         skb_pull(skb, sizeof(*ev));
2793
2794         switch (*opcode) {
2795         case HCI_OP_INQUIRY_CANCEL:
2796                 hci_cc_inquiry_cancel(hdev, skb);
2797                 break;
2798
2799         case HCI_OP_PERIODIC_INQ:
2800                 hci_cc_periodic_inq(hdev, skb);
2801                 break;
2802
2803         case HCI_OP_EXIT_PERIODIC_INQ:
2804                 hci_cc_exit_periodic_inq(hdev, skb);
2805                 break;
2806
2807         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2808                 hci_cc_remote_name_req_cancel(hdev, skb);
2809                 break;
2810
2811         case HCI_OP_ROLE_DISCOVERY:
2812                 hci_cc_role_discovery(hdev, skb);
2813                 break;
2814
2815         case HCI_OP_READ_LINK_POLICY:
2816                 hci_cc_read_link_policy(hdev, skb);
2817                 break;
2818
2819         case HCI_OP_WRITE_LINK_POLICY:
2820                 hci_cc_write_link_policy(hdev, skb);
2821                 break;
2822
2823         case HCI_OP_READ_DEF_LINK_POLICY:
2824                 hci_cc_read_def_link_policy(hdev, skb);
2825                 break;
2826
2827         case HCI_OP_WRITE_DEF_LINK_POLICY:
2828                 hci_cc_write_def_link_policy(hdev, skb);
2829                 break;
2830
2831         case HCI_OP_RESET:
2832                 hci_cc_reset(hdev, skb);
2833                 break;
2834
2835         case HCI_OP_READ_STORED_LINK_KEY:
2836                 hci_cc_read_stored_link_key(hdev, skb);
2837                 break;
2838
2839         case HCI_OP_DELETE_STORED_LINK_KEY:
2840                 hci_cc_delete_stored_link_key(hdev, skb);
2841                 break;
2842
2843         case HCI_OP_WRITE_LOCAL_NAME:
2844                 hci_cc_write_local_name(hdev, skb);
2845                 break;
2846
2847         case HCI_OP_READ_LOCAL_NAME:
2848                 hci_cc_read_local_name(hdev, skb);
2849                 break;
2850
2851         case HCI_OP_WRITE_AUTH_ENABLE:
2852                 hci_cc_write_auth_enable(hdev, skb);
2853                 break;
2854
2855         case HCI_OP_WRITE_ENCRYPT_MODE:
2856                 hci_cc_write_encrypt_mode(hdev, skb);
2857                 break;
2858
2859         case HCI_OP_WRITE_SCAN_ENABLE:
2860                 hci_cc_write_scan_enable(hdev, skb);
2861                 break;
2862
2863         case HCI_OP_READ_CLASS_OF_DEV:
2864                 hci_cc_read_class_of_dev(hdev, skb);
2865                 break;
2866
2867         case HCI_OP_WRITE_CLASS_OF_DEV:
2868                 hci_cc_write_class_of_dev(hdev, skb);
2869                 break;
2870
2871         case HCI_OP_READ_VOICE_SETTING:
2872                 hci_cc_read_voice_setting(hdev, skb);
2873                 break;
2874
2875         case HCI_OP_WRITE_VOICE_SETTING:
2876                 hci_cc_write_voice_setting(hdev, skb);
2877                 break;
2878
2879         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2880                 hci_cc_read_num_supported_iac(hdev, skb);
2881                 break;
2882
2883         case HCI_OP_WRITE_SSP_MODE:
2884                 hci_cc_write_ssp_mode(hdev, skb);
2885                 break;
2886
2887         case HCI_OP_WRITE_SC_SUPPORT:
2888                 hci_cc_write_sc_support(hdev, skb);
2889                 break;
2890
2891         case HCI_OP_READ_LOCAL_VERSION:
2892                 hci_cc_read_local_version(hdev, skb);
2893                 break;
2894
2895         case HCI_OP_READ_LOCAL_COMMANDS:
2896                 hci_cc_read_local_commands(hdev, skb);
2897                 break;
2898
2899         case HCI_OP_READ_LOCAL_FEATURES:
2900                 hci_cc_read_local_features(hdev, skb);
2901                 break;
2902
2903         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2904                 hci_cc_read_local_ext_features(hdev, skb);
2905                 break;
2906
2907         case HCI_OP_READ_BUFFER_SIZE:
2908                 hci_cc_read_buffer_size(hdev, skb);
2909                 break;
2910
2911         case HCI_OP_READ_BD_ADDR:
2912                 hci_cc_read_bd_addr(hdev, skb);
2913                 break;
2914
2915         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2916                 hci_cc_read_page_scan_activity(hdev, skb);
2917                 break;
2918
2919         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2920                 hci_cc_write_page_scan_activity(hdev, skb);
2921                 break;
2922
2923         case HCI_OP_READ_PAGE_SCAN_TYPE:
2924                 hci_cc_read_page_scan_type(hdev, skb);
2925                 break;
2926
2927         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2928                 hci_cc_write_page_scan_type(hdev, skb);
2929                 break;
2930
2931         case HCI_OP_READ_DATA_BLOCK_SIZE:
2932                 hci_cc_read_data_block_size(hdev, skb);
2933                 break;
2934
2935         case HCI_OP_READ_FLOW_CONTROL_MODE:
2936                 hci_cc_read_flow_control_mode(hdev, skb);
2937                 break;
2938
2939         case HCI_OP_READ_LOCAL_AMP_INFO:
2940                 hci_cc_read_local_amp_info(hdev, skb);
2941                 break;
2942
2943         case HCI_OP_READ_CLOCK:
2944                 hci_cc_read_clock(hdev, skb);
2945                 break;
2946
2947         case HCI_OP_READ_INQ_RSP_TX_POWER:
2948                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2949                 break;
2950
2951         case HCI_OP_PIN_CODE_REPLY:
2952                 hci_cc_pin_code_reply(hdev, skb);
2953                 break;
2954
2955         case HCI_OP_PIN_CODE_NEG_REPLY:
2956                 hci_cc_pin_code_neg_reply(hdev, skb);
2957                 break;
2958
2959         case HCI_OP_READ_LOCAL_OOB_DATA:
2960                 hci_cc_read_local_oob_data(hdev, skb);
2961                 break;
2962
2963         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2964                 hci_cc_read_local_oob_ext_data(hdev, skb);
2965                 break;
2966
2967         case HCI_OP_LE_READ_BUFFER_SIZE:
2968                 hci_cc_le_read_buffer_size(hdev, skb);
2969                 break;
2970
2971         case HCI_OP_LE_READ_LOCAL_FEATURES:
2972                 hci_cc_le_read_local_features(hdev, skb);
2973                 break;
2974
2975         case HCI_OP_LE_READ_ADV_TX_POWER:
2976                 hci_cc_le_read_adv_tx_power(hdev, skb);
2977                 break;
2978
2979         case HCI_OP_USER_CONFIRM_REPLY:
2980                 hci_cc_user_confirm_reply(hdev, skb);
2981                 break;
2982
2983         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2984                 hci_cc_user_confirm_neg_reply(hdev, skb);
2985                 break;
2986
2987         case HCI_OP_USER_PASSKEY_REPLY:
2988                 hci_cc_user_passkey_reply(hdev, skb);
2989                 break;
2990
2991         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2992                 hci_cc_user_passkey_neg_reply(hdev, skb);
2993                 break;
2994
2995         case HCI_OP_LE_SET_RANDOM_ADDR:
2996                 hci_cc_le_set_random_addr(hdev, skb);
2997                 break;
2998
2999         case HCI_OP_LE_SET_ADV_ENABLE:
3000                 hci_cc_le_set_adv_enable(hdev, skb);
3001                 break;
3002
3003         case HCI_OP_LE_SET_SCAN_PARAM:
3004                 hci_cc_le_set_scan_param(hdev, skb);
3005                 break;
3006
3007         case HCI_OP_LE_SET_SCAN_ENABLE:
3008                 hci_cc_le_set_scan_enable(hdev, skb);
3009                 break;
3010
3011         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3012                 hci_cc_le_read_white_list_size(hdev, skb);
3013                 break;
3014
3015         case HCI_OP_LE_CLEAR_WHITE_LIST:
3016                 hci_cc_le_clear_white_list(hdev, skb);
3017                 break;
3018
3019         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3020                 hci_cc_le_add_to_white_list(hdev, skb);
3021                 break;
3022
3023         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3024                 hci_cc_le_del_from_white_list(hdev, skb);
3025                 break;
3026
3027         case HCI_OP_LE_READ_SUPPORTED_STATES:
3028                 hci_cc_le_read_supported_states(hdev, skb);
3029                 break;
3030
3031         case HCI_OP_LE_READ_DEF_DATA_LEN:
3032                 hci_cc_le_read_def_data_len(hdev, skb);
3033                 break;
3034
3035         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3036                 hci_cc_le_write_def_data_len(hdev, skb);
3037                 break;
3038
3039         case HCI_OP_LE_READ_MAX_DATA_LEN:
3040                 hci_cc_le_read_max_data_len(hdev, skb);
3041                 break;
3042
3043         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3044                 hci_cc_write_le_host_supported(hdev, skb);
3045                 break;
3046
3047         case HCI_OP_LE_SET_ADV_PARAM:
3048                 hci_cc_set_adv_param(hdev, skb);
3049                 break;
3050
3051         case HCI_OP_READ_RSSI:
3052                 hci_cc_read_rssi(hdev, skb);
3053                 break;
3054
3055         case HCI_OP_READ_TX_POWER:
3056                 hci_cc_read_tx_power(hdev, skb);
3057                 break;
3058
3059         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3060                 hci_cc_write_ssp_debug_mode(hdev, skb);
3061                 break;
3062
3063         default:
3064                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3065                 break;
3066         }
3067
3068         if (*opcode != HCI_OP_NOP)
3069                 cancel_delayed_work(&hdev->cmd_timer);
3070
3071         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3072                 atomic_set(&hdev->cmd_cnt, 1);
3073
3074         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3075                              req_complete_skb);
3076
3077         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3078                 queue_work(hdev->workqueue, &hdev->cmd_work);
3079 }
3080
3081 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3082                                u16 *opcode, u8 *status,
3083                                hci_req_complete_t *req_complete,
3084                                hci_req_complete_skb_t *req_complete_skb)
3085 {
3086         struct hci_ev_cmd_status *ev = (void *) skb->data;
3087
3088         skb_pull(skb, sizeof(*ev));
3089
3090         *opcode = __le16_to_cpu(ev->opcode);
3091         *status = ev->status;
3092
3093         switch (*opcode) {
3094         case HCI_OP_INQUIRY:
3095                 hci_cs_inquiry(hdev, ev->status);
3096                 break;
3097
3098         case HCI_OP_CREATE_CONN:
3099                 hci_cs_create_conn(hdev, ev->status);
3100                 break;
3101
3102         case HCI_OP_DISCONNECT:
3103                 hci_cs_disconnect(hdev, ev->status);
3104                 break;
3105
3106         case HCI_OP_ADD_SCO:
3107                 hci_cs_add_sco(hdev, ev->status);
3108                 break;
3109
3110         case HCI_OP_AUTH_REQUESTED:
3111                 hci_cs_auth_requested(hdev, ev->status);
3112                 break;
3113
3114         case HCI_OP_SET_CONN_ENCRYPT:
3115                 hci_cs_set_conn_encrypt(hdev, ev->status);
3116                 break;
3117
3118         case HCI_OP_REMOTE_NAME_REQ:
3119                 hci_cs_remote_name_req(hdev, ev->status);
3120                 break;
3121
3122         case HCI_OP_READ_REMOTE_FEATURES:
3123                 hci_cs_read_remote_features(hdev, ev->status);
3124                 break;
3125
3126         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3127                 hci_cs_read_remote_ext_features(hdev, ev->status);
3128                 break;
3129
3130         case HCI_OP_SETUP_SYNC_CONN:
3131                 hci_cs_setup_sync_conn(hdev, ev->status);
3132                 break;
3133
3134         case HCI_OP_CREATE_PHY_LINK:
3135                 hci_cs_create_phylink(hdev, ev->status);
3136                 break;
3137
3138         case HCI_OP_ACCEPT_PHY_LINK:
3139                 hci_cs_accept_phylink(hdev, ev->status);
3140                 break;
3141
3142         case HCI_OP_SNIFF_MODE:
3143                 hci_cs_sniff_mode(hdev, ev->status);
3144                 break;
3145
3146         case HCI_OP_EXIT_SNIFF_MODE:
3147                 hci_cs_exit_sniff_mode(hdev, ev->status);
3148                 break;
3149
3150         case HCI_OP_SWITCH_ROLE:
3151                 hci_cs_switch_role(hdev, ev->status);
3152                 break;
3153
3154         case HCI_OP_LE_CREATE_CONN:
3155                 hci_cs_le_create_conn(hdev, ev->status);
3156                 break;
3157
3158         case HCI_OP_LE_READ_REMOTE_FEATURES:
3159                 hci_cs_le_read_remote_features(hdev, ev->status);
3160                 break;
3161
3162         case HCI_OP_LE_START_ENC:
3163                 hci_cs_le_start_enc(hdev, ev->status);
3164                 break;
3165
3166         default:
3167                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3168                 break;
3169         }
3170
3171         if (*opcode != HCI_OP_NOP)
3172                 cancel_delayed_work(&hdev->cmd_timer);
3173
3174         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3175                 atomic_set(&hdev->cmd_cnt, 1);
3176
3177         /* Indicate request completion if the command failed. Also, if
3178          * we're not waiting for a special event and we get a success
3179          * command status we should try to flag the request as completed
3180          * (since for this kind of commands there will not be a command
3181          * complete event).
3182          */
3183         if (ev->status ||
3184             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3185                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3186                                      req_complete_skb);
3187
3188         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3189                 queue_work(hdev->workqueue, &hdev->cmd_work);
3190 }
3191
3192 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3193 {
3194         struct hci_ev_hardware_error *ev = (void *) skb->data;
3195
3196         hdev->hw_error_code = ev->code;
3197
3198         queue_work(hdev->req_workqueue, &hdev->error_reset);
3199 }
3200
3201 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3202 {
3203         struct hci_ev_role_change *ev = (void *) skb->data;
3204         struct hci_conn *conn;
3205
3206         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3207
3208         hci_dev_lock(hdev);
3209
3210         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3211         if (conn) {
3212                 if (!ev->status)
3213                         conn->role = ev->role;
3214
3215                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3216
3217                 hci_role_switch_cfm(conn, ev->status, ev->role);
3218         }
3219
3220         hci_dev_unlock(hdev);
3221 }
3222
3223 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3224 {
3225         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3226         int i;
3227
3228         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3229                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3230                 return;
3231         }
3232
3233         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3234             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3235                 BT_DBG("%s bad parameters", hdev->name);
3236                 return;
3237         }
3238
3239         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3240
3241         for (i = 0; i < ev->num_hndl; i++) {
3242                 struct hci_comp_pkts_info *info = &ev->handles[i];
3243                 struct hci_conn *conn;
3244                 __u16  handle, count;
3245
3246                 handle = __le16_to_cpu(info->handle);
3247                 count  = __le16_to_cpu(info->count);
3248
3249                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3250                 if (!conn)
3251                         continue;
3252
3253                 conn->sent -= count;
3254
3255                 switch (conn->type) {
3256                 case ACL_LINK:
3257                         hdev->acl_cnt += count;
3258                         if (hdev->acl_cnt > hdev->acl_pkts)
3259                                 hdev->acl_cnt = hdev->acl_pkts;
3260                         break;
3261
3262                 case LE_LINK:
3263                         if (hdev->le_pkts) {
3264                                 hdev->le_cnt += count;
3265                                 if (hdev->le_cnt > hdev->le_pkts)
3266                                         hdev->le_cnt = hdev->le_pkts;
3267                         } else {
3268                                 hdev->acl_cnt += count;
3269                                 if (hdev->acl_cnt > hdev->acl_pkts)
3270                                         hdev->acl_cnt = hdev->acl_pkts;
3271                         }
3272                         break;
3273
3274                 case SCO_LINK:
3275                         hdev->sco_cnt += count;
3276                         if (hdev->sco_cnt > hdev->sco_pkts)
3277                                 hdev->sco_cnt = hdev->sco_pkts;
3278                         break;
3279
3280                 default:
3281                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3282                         break;
3283                 }
3284         }
3285
3286         queue_work(hdev->workqueue, &hdev->tx_work);
3287 }
3288
3289 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3290                                                  __u16 handle)
3291 {
3292         struct hci_chan *chan;
3293
3294         switch (hdev->dev_type) {
3295         case HCI_BREDR:
3296                 return hci_conn_hash_lookup_handle(hdev, handle);
3297         case HCI_AMP:
3298                 chan = hci_chan_lookup_handle(hdev, handle);
3299                 if (chan)
3300                         return chan->conn;
3301                 break;
3302         default:
3303                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3304                 break;
3305         }
3306
3307         return NULL;
3308 }
3309
3310 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3311 {
3312         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3313         int i;
3314
3315         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3316                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3317                 return;
3318         }
3319
3320         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3321             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3322                 BT_DBG("%s bad parameters", hdev->name);
3323                 return;
3324         }
3325
3326         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3327                ev->num_hndl);
3328
3329         for (i = 0; i < ev->num_hndl; i++) {
3330                 struct hci_comp_blocks_info *info = &ev->handles[i];
3331                 struct hci_conn *conn = NULL;
3332                 __u16  handle, block_count;
3333
3334                 handle = __le16_to_cpu(info->handle);
3335                 block_count = __le16_to_cpu(info->blocks);
3336
3337                 conn = __hci_conn_lookup_handle(hdev, handle);
3338                 if (!conn)
3339                         continue;
3340
3341                 conn->sent -= block_count;
3342
3343                 switch (conn->type) {
3344                 case ACL_LINK:
3345                 case AMP_LINK:
3346                         hdev->block_cnt += block_count;
3347                         if (hdev->block_cnt > hdev->num_blocks)
3348                                 hdev->block_cnt = hdev->num_blocks;
3349                         break;
3350
3351                 default:
3352                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3353                         break;
3354                 }
3355         }
3356
3357         queue_work(hdev->workqueue, &hdev->tx_work);
3358 }
3359
3360 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3361 {
3362         struct hci_ev_mode_change *ev = (void *) skb->data;
3363         struct hci_conn *conn;
3364
3365         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3366
3367         hci_dev_lock(hdev);
3368
3369         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3370         if (conn) {
3371                 conn->mode = ev->mode;
3372
3373                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3374                                         &conn->flags)) {
3375                         if (conn->mode == HCI_CM_ACTIVE)
3376                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3377                         else
3378                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3379                 }
3380
3381                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3382                         hci_sco_setup(conn, ev->status);
3383         }
3384
3385         hci_dev_unlock(hdev);
3386 }
3387
3388 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3389 {
3390         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3391         struct hci_conn *conn;
3392
3393         BT_DBG("%s", hdev->name);
3394
3395         hci_dev_lock(hdev);
3396
3397         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3398         if (!conn)
3399                 goto unlock;
3400
3401         if (conn->state == BT_CONNECTED) {
3402                 hci_conn_hold(conn);
3403                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3404                 hci_conn_drop(conn);
3405         }
3406
3407         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3408             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3409                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3410                              sizeof(ev->bdaddr), &ev->bdaddr);
3411         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3412                 u8 secure;
3413
3414                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3415                         secure = 1;
3416                 else
3417                         secure = 0;
3418
3419                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3420         }
3421
3422 unlock:
3423         hci_dev_unlock(hdev);
3424 }
3425
3426 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3427 {
3428         if (key_type == HCI_LK_CHANGED_COMBINATION)
3429                 return;
3430
3431         conn->pin_length = pin_len;
3432         conn->key_type = key_type;
3433
3434         switch (key_type) {
3435         case HCI_LK_LOCAL_UNIT:
3436         case HCI_LK_REMOTE_UNIT:
3437         case HCI_LK_DEBUG_COMBINATION:
3438                 return;
3439         case HCI_LK_COMBINATION:
3440                 if (pin_len == 16)
3441                         conn->pending_sec_level = BT_SECURITY_HIGH;
3442                 else
3443                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3444                 break;
3445         case HCI_LK_UNAUTH_COMBINATION_P192:
3446         case HCI_LK_UNAUTH_COMBINATION_P256:
3447                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3448                 break;
3449         case HCI_LK_AUTH_COMBINATION_P192:
3450                 conn->pending_sec_level = BT_SECURITY_HIGH;
3451                 break;
3452         case HCI_LK_AUTH_COMBINATION_P256:
3453                 conn->pending_sec_level = BT_SECURITY_FIPS;
3454                 break;
3455         }
3456 }
3457
3458 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3459 {
3460         struct hci_ev_link_key_req *ev = (void *) skb->data;
3461         struct hci_cp_link_key_reply cp;
3462         struct hci_conn *conn;
3463         struct link_key *key;
3464
3465         BT_DBG("%s", hdev->name);
3466
3467         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3468                 return;
3469
3470         hci_dev_lock(hdev);
3471
3472         key = hci_find_link_key(hdev, &ev->bdaddr);
3473         if (!key) {
3474                 BT_DBG("%s link key not found for %pMR", hdev->name,
3475                        &ev->bdaddr);
3476                 goto not_found;
3477         }
3478
3479         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3480                &ev->bdaddr);
3481
3482         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3483         if (conn) {
3484                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3485
3486                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3487                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3488                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3489                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3490                         goto not_found;
3491                 }
3492
3493                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3494                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3495                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3496                         BT_DBG("%s ignoring key unauthenticated for high security",
3497                                hdev->name);
3498                         goto not_found;
3499                 }
3500
3501                 conn_set_key(conn, key->type, key->pin_len);
3502         }
3503
3504         bacpy(&cp.bdaddr, &ev->bdaddr);
3505         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3506
3507         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3508
3509         hci_dev_unlock(hdev);
3510
3511         return;
3512
3513 not_found:
3514         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3515         hci_dev_unlock(hdev);
3516 }
3517
3518 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3519 {
3520         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3521         struct hci_conn *conn;
3522         struct link_key *key;
3523         bool persistent;
3524         u8 pin_len = 0;
3525
3526         BT_DBG("%s", hdev->name);
3527
3528         hci_dev_lock(hdev);
3529
3530         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3531         if (!conn)
3532                 goto unlock;
3533
3534         hci_conn_hold(conn);
3535         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3536         hci_conn_drop(conn);
3537
3538         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3539         conn_set_key(conn, ev->key_type, conn->pin_length);
3540
3541         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3542                 goto unlock;
3543
3544         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3545                                 ev->key_type, pin_len, &persistent);
3546         if (!key)
3547                 goto unlock;
3548
3549         /* Update connection information since adding the key will have
3550          * fixed up the type in the case of changed combination keys.
3551          */
3552         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3553                 conn_set_key(conn, key->type, key->pin_len);
3554
3555         mgmt_new_link_key(hdev, key, persistent);
3556
3557         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3558          * is set. If it's not set simply remove the key from the kernel
3559          * list (we've still notified user space about it but with
3560          * store_hint being 0).
3561          */
3562         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3563             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3564                 list_del_rcu(&key->list);
3565                 kfree_rcu(key, rcu);
3566                 goto unlock;
3567         }
3568
3569         if (persistent)
3570                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3571         else
3572                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3573
3574 unlock:
3575         hci_dev_unlock(hdev);
3576 }
3577
3578 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3579 {
3580         struct hci_ev_clock_offset *ev = (void *) skb->data;
3581         struct hci_conn *conn;
3582
3583         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3584
3585         hci_dev_lock(hdev);
3586
3587         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3588         if (conn && !ev->status) {
3589                 struct inquiry_entry *ie;
3590
3591                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3592                 if (ie) {
3593                         ie->data.clock_offset = ev->clock_offset;
3594                         ie->timestamp = jiffies;
3595                 }
3596         }
3597
3598         hci_dev_unlock(hdev);
3599 }
3600
3601 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3602 {
3603         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3604         struct hci_conn *conn;
3605
3606         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3607
3608         hci_dev_lock(hdev);
3609
3610         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3611         if (conn && !ev->status)
3612                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3613
3614         hci_dev_unlock(hdev);
3615 }
3616
3617 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3618 {
3619         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3620         struct inquiry_entry *ie;
3621
3622         BT_DBG("%s", hdev->name);
3623
3624         hci_dev_lock(hdev);
3625
3626         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3627         if (ie) {
3628                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3629                 ie->timestamp = jiffies;
3630         }
3631
3632         hci_dev_unlock(hdev);
3633 }
3634
3635 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3636                                              struct sk_buff *skb)
3637 {
3638         struct inquiry_data data;
3639         int num_rsp = *((__u8 *) skb->data);
3640
3641         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3642
3643         if (!num_rsp)
3644                 return;
3645
3646         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3647                 return;
3648
3649         hci_dev_lock(hdev);
3650
3651         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3652                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3653                 info = (void *) (skb->data + 1);
3654
3655                 for (; num_rsp; num_rsp--, info++) {
3656                         u32 flags;
3657
3658                         bacpy(&data.bdaddr, &info->bdaddr);
3659                         data.pscan_rep_mode     = info->pscan_rep_mode;
3660                         data.pscan_period_mode  = info->pscan_period_mode;
3661                         data.pscan_mode         = info->pscan_mode;
3662                         memcpy(data.dev_class, info->dev_class, 3);
3663                         data.clock_offset       = info->clock_offset;
3664                         data.rssi               = info->rssi;
3665                         data.ssp_mode           = 0x00;
3666
3667                         flags = hci_inquiry_cache_update(hdev, &data, false);
3668
3669                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3670                                           info->dev_class, info->rssi,
3671                                           flags, NULL, 0, NULL, 0);
3672                 }
3673         } else {
3674                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3675
3676                 for (; num_rsp; num_rsp--, info++) {
3677                         u32 flags;
3678
3679                         bacpy(&data.bdaddr, &info->bdaddr);
3680                         data.pscan_rep_mode     = info->pscan_rep_mode;
3681                         data.pscan_period_mode  = info->pscan_period_mode;
3682                         data.pscan_mode         = 0x00;
3683                         memcpy(data.dev_class, info->dev_class, 3);
3684                         data.clock_offset       = info->clock_offset;
3685                         data.rssi               = info->rssi;
3686                         data.ssp_mode           = 0x00;
3687
3688                         flags = hci_inquiry_cache_update(hdev, &data, false);
3689
3690                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3691                                           info->dev_class, info->rssi,
3692                                           flags, NULL, 0, NULL, 0);
3693                 }
3694         }
3695
3696         hci_dev_unlock(hdev);
3697 }
3698
3699 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3700                                         struct sk_buff *skb)
3701 {
3702         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3703         struct hci_conn *conn;
3704
3705         BT_DBG("%s", hdev->name);
3706
3707         hci_dev_lock(hdev);
3708
3709         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3710         if (!conn)
3711                 goto unlock;
3712
3713         if (ev->page < HCI_MAX_PAGES)
3714                 memcpy(conn->features[ev->page], ev->features, 8);
3715
3716         if (!ev->status && ev->page == 0x01) {
3717                 struct inquiry_entry *ie;
3718
3719                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3720                 if (ie)
3721                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3722
3723                 if (ev->features[0] & LMP_HOST_SSP) {
3724                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3725                 } else {
3726                         /* It is mandatory by the Bluetooth specification that
3727                          * Extended Inquiry Results are only used when Secure
3728                          * Simple Pairing is enabled, but some devices violate
3729                          * this.
3730                          *
3731                          * To make these devices work, the internal SSP
3732                          * enabled flag needs to be cleared if the remote host
3733                          * features do not indicate SSP support */
3734                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3735                 }
3736
3737                 if (ev->features[0] & LMP_HOST_SC)
3738                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3739         }
3740
3741         if (conn->state != BT_CONFIG)
3742                 goto unlock;
3743
3744         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3745                 struct hci_cp_remote_name_req cp;
3746                 memset(&cp, 0, sizeof(cp));
3747                 bacpy(&cp.bdaddr, &conn->dst);
3748                 cp.pscan_rep_mode = 0x02;
3749                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3750         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3751                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3752
3753         if (!hci_outgoing_auth_needed(hdev, conn)) {
3754                 conn->state = BT_CONNECTED;
3755                 hci_connect_cfm(conn, ev->status);
3756                 hci_conn_drop(conn);
3757         }
3758
3759 unlock:
3760         hci_dev_unlock(hdev);
3761 }
3762
3763 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3764                                        struct sk_buff *skb)
3765 {
3766         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3767         struct hci_conn *conn;
3768
3769         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3770
3771         hci_dev_lock(hdev);
3772
3773         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3774         if (!conn) {
3775                 if (ev->link_type == ESCO_LINK)
3776                         goto unlock;
3777
3778                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3779                 if (!conn)
3780                         goto unlock;
3781
3782                 conn->type = SCO_LINK;
3783         }
3784
3785         switch (ev->status) {
3786         case 0x00:
3787                 conn->handle = __le16_to_cpu(ev->handle);
3788                 conn->state  = BT_CONNECTED;
3789
3790                 hci_debugfs_create_conn(conn);
3791                 hci_conn_add_sysfs(conn);
3792                 break;
3793
3794         case 0x10:      /* Connection Accept Timeout */
3795         case 0x0d:      /* Connection Rejected due to Limited Resources */
3796         case 0x11:      /* Unsupported Feature or Parameter Value */
3797         case 0x1c:      /* SCO interval rejected */
3798         case 0x1a:      /* Unsupported Remote Feature */
3799         case 0x1f:      /* Unspecified error */
3800         case 0x20:      /* Unsupported LMP Parameter value */
3801                 if (conn->out) {
3802                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3803                                         (hdev->esco_type & EDR_ESCO_MASK);
3804                         if (hci_setup_sync(conn, conn->link->handle))
3805                                 goto unlock;
3806                 }
3807                 /* fall through */
3808
3809         default:
3810                 conn->state = BT_CLOSED;
3811                 break;
3812         }
3813
3814         hci_connect_cfm(conn, ev->status);
3815         if (ev->status)
3816                 hci_conn_del(conn);
3817
3818 unlock:
3819         hci_dev_unlock(hdev);
3820 }
3821
3822 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3823 {
3824         size_t parsed = 0;
3825
3826         while (parsed < eir_len) {
3827                 u8 field_len = eir[0];
3828
3829                 if (field_len == 0)
3830                         return parsed;
3831
3832                 parsed += field_len + 1;
3833                 eir += field_len + 1;
3834         }
3835
3836         return eir_len;
3837 }
3838
3839 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3840                                             struct sk_buff *skb)
3841 {
3842         struct inquiry_data data;
3843         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3844         int num_rsp = *((__u8 *) skb->data);
3845         size_t eir_len;
3846
3847         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3848
3849         if (!num_rsp)
3850                 return;
3851
3852         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3853                 return;
3854
3855         hci_dev_lock(hdev);
3856
3857         for (; num_rsp; num_rsp--, info++) {
3858                 u32 flags;
3859                 bool name_known;
3860
3861                 bacpy(&data.bdaddr, &info->bdaddr);
3862                 data.pscan_rep_mode     = info->pscan_rep_mode;
3863                 data.pscan_period_mode  = info->pscan_period_mode;
3864                 data.pscan_mode         = 0x00;
3865                 memcpy(data.dev_class, info->dev_class, 3);
3866                 data.clock_offset       = info->clock_offset;
3867                 data.rssi               = info->rssi;
3868                 data.ssp_mode           = 0x01;
3869
3870                 if (hci_dev_test_flag(hdev, HCI_MGMT))
3871                         name_known = eir_has_data_type(info->data,
3872                                                        sizeof(info->data),
3873                                                        EIR_NAME_COMPLETE);
3874                 else
3875                         name_known = true;
3876
3877                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3878
3879                 eir_len = eir_get_length(info->data, sizeof(info->data));
3880
3881                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3882                                   info->dev_class, info->rssi,
3883                                   flags, info->data, eir_len, NULL, 0);
3884         }
3885
3886         hci_dev_unlock(hdev);
3887 }
3888
3889 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3890                                          struct sk_buff *skb)
3891 {
3892         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3893         struct hci_conn *conn;
3894
3895         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3896                __le16_to_cpu(ev->handle));
3897
3898         hci_dev_lock(hdev);
3899
3900         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3901         if (!conn)
3902                 goto unlock;
3903
3904         /* For BR/EDR the necessary steps are taken through the
3905          * auth_complete event.
3906          */
3907         if (conn->type != LE_LINK)
3908                 goto unlock;
3909
3910         if (!ev->status)
3911                 conn->sec_level = conn->pending_sec_level;
3912
3913         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3914
3915         if (ev->status && conn->state == BT_CONNECTED) {
3916                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3917                 hci_conn_drop(conn);
3918                 goto unlock;
3919         }
3920
3921         if (conn->state == BT_CONFIG) {
3922                 if (!ev->status)
3923                         conn->state = BT_CONNECTED;
3924
3925                 hci_connect_cfm(conn, ev->status);
3926                 hci_conn_drop(conn);
3927         } else {
3928                 hci_auth_cfm(conn, ev->status);
3929
3930                 hci_conn_hold(conn);
3931                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3932                 hci_conn_drop(conn);
3933         }
3934
3935 unlock:
3936         hci_dev_unlock(hdev);
3937 }
3938
3939 static u8 hci_get_auth_req(struct hci_conn *conn)
3940 {
3941         /* If remote requests no-bonding follow that lead */
3942         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3943             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3944                 return conn->remote_auth | (conn->auth_type & 0x01);
3945
3946         /* If both remote and local have enough IO capabilities, require
3947          * MITM protection
3948          */
3949         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3950             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3951                 return conn->remote_auth | 0x01;
3952
3953         /* No MITM protection possible so ignore remote requirement */
3954         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3955 }
3956
3957 static u8 bredr_oob_data_present(struct hci_conn *conn)
3958 {
3959         struct hci_dev *hdev = conn->hdev;
3960         struct oob_data *data;
3961
3962         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3963         if (!data)
3964                 return 0x00;
3965
3966         if (bredr_sc_enabled(hdev)) {
3967                 /* When Secure Connections is enabled, then just
3968                  * return the present value stored with the OOB
3969                  * data. The stored value contains the right present
3970                  * information. However it can only be trusted when
3971                  * not in Secure Connection Only mode.
3972                  */
3973                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3974                         return data->present;
3975
3976                 /* When Secure Connections Only mode is enabled, then
3977                  * the P-256 values are required. If they are not
3978                  * available, then do not declare that OOB data is
3979                  * present.
3980                  */
3981                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3982                     !memcmp(data->hash256, ZERO_KEY, 16))
3983                         return 0x00;
3984
3985                 return 0x02;
3986         }
3987
3988         /* When Secure Connections is not enabled or actually
3989          * not supported by the hardware, then check that if
3990          * P-192 data values are present.
3991          */
3992         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3993             !memcmp(data->hash192, ZERO_KEY, 16))
3994                 return 0x00;
3995
3996         return 0x01;
3997 }
3998
3999 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4000 {
4001         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4002         struct hci_conn *conn;
4003
4004         BT_DBG("%s", hdev->name);
4005
4006         hci_dev_lock(hdev);
4007
4008         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4009         if (!conn)
4010                 goto unlock;
4011
4012         hci_conn_hold(conn);
4013
4014         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4015                 goto unlock;
4016
4017         /* Allow pairing if we're pairable, the initiators of the
4018          * pairing or if the remote is not requesting bonding.
4019          */
4020         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4021             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4022             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4023                 struct hci_cp_io_capability_reply cp;
4024
4025                 bacpy(&cp.bdaddr, &ev->bdaddr);
4026                 /* Change the IO capability from KeyboardDisplay
4027                  * to DisplayYesNo as it is not supported by BT spec. */
4028                 cp.capability = (conn->io_capability == 0x04) ?
4029                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4030
4031                 /* If we are initiators, there is no remote information yet */
4032                 if (conn->remote_auth == 0xff) {
4033                         /* Request MITM protection if our IO caps allow it
4034                          * except for the no-bonding case.
4035                          */
4036                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4037                             conn->auth_type != HCI_AT_NO_BONDING)
4038                                 conn->auth_type |= 0x01;
4039                 } else {
4040                         conn->auth_type = hci_get_auth_req(conn);
4041                 }
4042
4043                 /* If we're not bondable, force one of the non-bondable
4044                  * authentication requirement values.
4045                  */
4046                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4047                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4048
4049                 cp.authentication = conn->auth_type;
4050                 cp.oob_data = bredr_oob_data_present(conn);
4051
4052                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4053                              sizeof(cp), &cp);
4054         } else {
4055                 struct hci_cp_io_capability_neg_reply cp;
4056
4057                 bacpy(&cp.bdaddr, &ev->bdaddr);
4058                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4059
4060                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4061                              sizeof(cp), &cp);
4062         }
4063
4064 unlock:
4065         hci_dev_unlock(hdev);
4066 }
4067
4068 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4069 {
4070         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4071         struct hci_conn *conn;
4072
4073         BT_DBG("%s", hdev->name);
4074
4075         hci_dev_lock(hdev);
4076
4077         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4078         if (!conn)
4079                 goto unlock;
4080
4081         conn->remote_cap = ev->capability;
4082         conn->remote_auth = ev->authentication;
4083
4084 unlock:
4085         hci_dev_unlock(hdev);
4086 }
4087
4088 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4089                                          struct sk_buff *skb)
4090 {
4091         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4092         int loc_mitm, rem_mitm, confirm_hint = 0;
4093         struct hci_conn *conn;
4094
4095         BT_DBG("%s", hdev->name);
4096
4097         hci_dev_lock(hdev);
4098
4099         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4100                 goto unlock;
4101
4102         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4103         if (!conn)
4104                 goto unlock;
4105
4106         loc_mitm = (conn->auth_type & 0x01);
4107         rem_mitm = (conn->remote_auth & 0x01);
4108
4109         /* If we require MITM but the remote device can't provide that
4110          * (it has NoInputNoOutput) then reject the confirmation
4111          * request. We check the security level here since it doesn't
4112          * necessarily match conn->auth_type.
4113          */
4114         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4115             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4116                 BT_DBG("Rejecting request: remote device can't provide MITM");
4117                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4118                              sizeof(ev->bdaddr), &ev->bdaddr);
4119                 goto unlock;
4120         }
4121
4122         /* If no side requires MITM protection; auto-accept */
4123         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4124             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4125
4126                 /* If we're not the initiators request authorization to
4127                  * proceed from user space (mgmt_user_confirm with
4128                  * confirm_hint set to 1). The exception is if neither
4129                  * side had MITM or if the local IO capability is
4130                  * NoInputNoOutput, in which case we do auto-accept
4131                  */
4132                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4133                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4134                     (loc_mitm || rem_mitm)) {
4135                         BT_DBG("Confirming auto-accept as acceptor");
4136                         confirm_hint = 1;
4137                         goto confirm;
4138                 }
4139
4140                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4141                        hdev->auto_accept_delay);
4142
4143                 if (hdev->auto_accept_delay > 0) {
4144                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4145                         queue_delayed_work(conn->hdev->workqueue,
4146                                            &conn->auto_accept_work, delay);
4147                         goto unlock;
4148                 }
4149
4150                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4151                              sizeof(ev->bdaddr), &ev->bdaddr);
4152                 goto unlock;
4153         }
4154
4155 confirm:
4156         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4157                                   le32_to_cpu(ev->passkey), confirm_hint);
4158
4159 unlock:
4160         hci_dev_unlock(hdev);
4161 }
4162
4163 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4164                                          struct sk_buff *skb)
4165 {
4166         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4167
4168         BT_DBG("%s", hdev->name);
4169
4170         if (hci_dev_test_flag(hdev, HCI_MGMT))
4171                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4172 }
4173
4174 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4175                                         struct sk_buff *skb)
4176 {
4177         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4178         struct hci_conn *conn;
4179
4180         BT_DBG("%s", hdev->name);
4181
4182         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4183         if (!conn)
4184                 return;
4185
4186         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4187         conn->passkey_entered = 0;
4188
4189         if (hci_dev_test_flag(hdev, HCI_MGMT))
4190                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4191                                          conn->dst_type, conn->passkey_notify,
4192                                          conn->passkey_entered);
4193 }
4194
4195 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4196 {
4197         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4198         struct hci_conn *conn;
4199
4200         BT_DBG("%s", hdev->name);
4201
4202         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4203         if (!conn)
4204                 return;
4205
4206         switch (ev->type) {
4207         case HCI_KEYPRESS_STARTED:
4208                 conn->passkey_entered = 0;
4209                 return;
4210
4211         case HCI_KEYPRESS_ENTERED:
4212                 conn->passkey_entered++;
4213                 break;
4214
4215         case HCI_KEYPRESS_ERASED:
4216                 conn->passkey_entered--;
4217                 break;
4218
4219         case HCI_KEYPRESS_CLEARED:
4220                 conn->passkey_entered = 0;
4221                 break;
4222
4223         case HCI_KEYPRESS_COMPLETED:
4224                 return;
4225         }
4226
4227         if (hci_dev_test_flag(hdev, HCI_MGMT))
4228                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4229                                          conn->dst_type, conn->passkey_notify,
4230                                          conn->passkey_entered);
4231 }
4232
4233 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4234                                          struct sk_buff *skb)
4235 {
4236         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4237         struct hci_conn *conn;
4238
4239         BT_DBG("%s", hdev->name);
4240
4241         hci_dev_lock(hdev);
4242
4243         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4244         if (!conn)
4245                 goto unlock;
4246
4247         /* Reset the authentication requirement to unknown */
4248         conn->remote_auth = 0xff;
4249
4250         /* To avoid duplicate auth_failed events to user space we check
4251          * the HCI_CONN_AUTH_PEND flag which will be set if we
4252          * initiated the authentication. A traditional auth_complete
4253          * event gets always produced as initiator and is also mapped to
4254          * the mgmt_auth_failed event */
4255         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4256                 mgmt_auth_failed(conn, ev->status);
4257
4258         hci_conn_drop(conn);
4259
4260 unlock:
4261         hci_dev_unlock(hdev);
4262 }
4263
4264 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4265                                          struct sk_buff *skb)
4266 {
4267         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4268         struct inquiry_entry *ie;
4269         struct hci_conn *conn;
4270
4271         BT_DBG("%s", hdev->name);
4272
4273         hci_dev_lock(hdev);
4274
4275         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4276         if (conn)
4277                 memcpy(conn->features[1], ev->features, 8);
4278
4279         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4280         if (ie)
4281                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4282
4283         hci_dev_unlock(hdev);
4284 }
4285
4286 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4287                                             struct sk_buff *skb)
4288 {
4289         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4290         struct oob_data *data;
4291
4292         BT_DBG("%s", hdev->name);
4293
4294         hci_dev_lock(hdev);
4295
4296         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4297                 goto unlock;
4298
4299         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4300         if (!data) {
4301                 struct hci_cp_remote_oob_data_neg_reply cp;
4302
4303                 bacpy(&cp.bdaddr, &ev->bdaddr);
4304                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4305                              sizeof(cp), &cp);
4306                 goto unlock;
4307         }
4308
4309         if (bredr_sc_enabled(hdev)) {
4310                 struct hci_cp_remote_oob_ext_data_reply cp;
4311
4312                 bacpy(&cp.bdaddr, &ev->bdaddr);
4313                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4314                         memset(cp.hash192, 0, sizeof(cp.hash192));
4315                         memset(cp.rand192, 0, sizeof(cp.rand192));
4316                 } else {
4317                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4318                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4319                 }
4320                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4321                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4322
4323                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4324                              sizeof(cp), &cp);
4325         } else {
4326                 struct hci_cp_remote_oob_data_reply cp;
4327
4328                 bacpy(&cp.bdaddr, &ev->bdaddr);
4329                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4330                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4331
4332                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4333                              sizeof(cp), &cp);
4334         }
4335
4336 unlock:
4337         hci_dev_unlock(hdev);
4338 }
4339
4340 #if IS_ENABLED(CONFIG_BT_HS)
4341 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4342 {
4343         struct hci_ev_channel_selected *ev = (void *)skb->data;
4344         struct hci_conn *hcon;
4345
4346         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4347
4348         skb_pull(skb, sizeof(*ev));
4349
4350         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4351         if (!hcon)
4352                 return;
4353
4354         amp_read_loc_assoc_final_data(hdev, hcon);
4355 }
4356
4357 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4358                                       struct sk_buff *skb)
4359 {
4360         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4361         struct hci_conn *hcon, *bredr_hcon;
4362
4363         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4364                ev->status);
4365
4366         hci_dev_lock(hdev);
4367
4368         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4369         if (!hcon) {
4370                 hci_dev_unlock(hdev);
4371                 return;
4372         }
4373
4374         if (ev->status) {
4375                 hci_conn_del(hcon);
4376                 hci_dev_unlock(hdev);
4377                 return;
4378         }
4379
4380         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4381
4382         hcon->state = BT_CONNECTED;
4383         bacpy(&hcon->dst, &bredr_hcon->dst);
4384
4385         hci_conn_hold(hcon);
4386         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4387         hci_conn_drop(hcon);
4388
4389         hci_debugfs_create_conn(hcon);
4390         hci_conn_add_sysfs(hcon);
4391
4392         amp_physical_cfm(bredr_hcon, hcon);
4393
4394         hci_dev_unlock(hdev);
4395 }
4396
4397 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4398 {
4399         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4400         struct hci_conn *hcon;
4401         struct hci_chan *hchan;
4402         struct amp_mgr *mgr;
4403
4404         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4405                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4406                ev->status);
4407
4408         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4409         if (!hcon)
4410                 return;
4411
4412         /* Create AMP hchan */
4413         hchan = hci_chan_create(hcon);
4414         if (!hchan)
4415                 return;
4416
4417         hchan->handle = le16_to_cpu(ev->handle);
4418
4419         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4420
4421         mgr = hcon->amp_mgr;
4422         if (mgr && mgr->bredr_chan) {
4423                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4424
4425                 l2cap_chan_lock(bredr_chan);
4426
4427                 bredr_chan->conn->mtu = hdev->block_mtu;
4428                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4429                 hci_conn_hold(hcon);
4430
4431                 l2cap_chan_unlock(bredr_chan);
4432         }
4433 }
4434
4435 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4436                                              struct sk_buff *skb)
4437 {
4438         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4439         struct hci_chan *hchan;
4440
4441         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4442                le16_to_cpu(ev->handle), ev->status);
4443
4444         if (ev->status)
4445                 return;
4446
4447         hci_dev_lock(hdev);
4448
4449         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4450         if (!hchan)
4451                 goto unlock;
4452
4453         amp_destroy_logical_link(hchan, ev->reason);
4454
4455 unlock:
4456         hci_dev_unlock(hdev);
4457 }
4458
4459 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4460                                              struct sk_buff *skb)
4461 {
4462         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4463         struct hci_conn *hcon;
4464
4465         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4466
4467         if (ev->status)
4468                 return;
4469
4470         hci_dev_lock(hdev);
4471
4472         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4473         if (hcon) {
4474                 hcon->state = BT_CLOSED;
4475                 hci_conn_del(hcon);
4476         }
4477
4478         hci_dev_unlock(hdev);
4479 }
4480 #endif
4481
4482 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4483 {
4484         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4485         struct hci_conn_params *params;
4486         struct hci_conn *conn;
4487         struct smp_irk *irk;
4488         u8 addr_type;
4489
4490         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4491
4492         hci_dev_lock(hdev);
4493
4494         /* All controllers implicitly stop advertising in the event of a
4495          * connection, so ensure that the state bit is cleared.
4496          */
4497         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4498
4499         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4500         if (!conn) {
4501                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4502                 if (!conn) {
4503                         BT_ERR("No memory for new connection");
4504                         goto unlock;
4505                 }
4506
4507                 conn->dst_type = ev->bdaddr_type;
4508
4509                 /* If we didn't have a hci_conn object previously
4510                  * but we're in master role this must be something
4511                  * initiated using a white list. Since white list based
4512                  * connections are not "first class citizens" we don't
4513                  * have full tracking of them. Therefore, we go ahead
4514                  * with a "best effort" approach of determining the
4515                  * initiator address based on the HCI_PRIVACY flag.
4516                  */
4517                 if (conn->out) {
4518                         conn->resp_addr_type = ev->bdaddr_type;
4519                         bacpy(&conn->resp_addr, &ev->bdaddr);
4520                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4521                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4522                                 bacpy(&conn->init_addr, &hdev->rpa);
4523                         } else {
4524                                 hci_copy_identity_address(hdev,
4525                                                           &conn->init_addr,
4526                                                           &conn->init_addr_type);
4527                         }
4528                 }
4529         } else {
4530                 cancel_delayed_work(&conn->le_conn_timeout);
4531         }
4532
4533         if (!conn->out) {
4534                 /* Set the responder (our side) address type based on
4535                  * the advertising address type.
4536                  */
4537                 conn->resp_addr_type = hdev->adv_addr_type;
4538                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4539                         bacpy(&conn->resp_addr, &hdev->random_addr);
4540                 else
4541                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4542
4543                 conn->init_addr_type = ev->bdaddr_type;
4544                 bacpy(&conn->init_addr, &ev->bdaddr);
4545
4546                 /* For incoming connections, set the default minimum
4547                  * and maximum connection interval. They will be used
4548                  * to check if the parameters are in range and if not
4549                  * trigger the connection update procedure.
4550                  */
4551                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4552                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4553         }
4554
4555         /* Lookup the identity address from the stored connection
4556          * address and address type.
4557          *
4558          * When establishing connections to an identity address, the
4559          * connection procedure will store the resolvable random
4560          * address first. Now if it can be converted back into the
4561          * identity address, start using the identity address from
4562          * now on.
4563          */
4564         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4565         if (irk) {
4566                 bacpy(&conn->dst, &irk->bdaddr);
4567                 conn->dst_type = irk->addr_type;
4568         }
4569
4570         if (ev->status) {
4571                 hci_le_conn_failed(conn, ev->status);
4572                 goto unlock;
4573         }
4574
4575         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4576                 addr_type = BDADDR_LE_PUBLIC;
4577         else
4578                 addr_type = BDADDR_LE_RANDOM;
4579
4580         /* Drop the connection if the device is blocked */
4581         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4582                 hci_conn_drop(conn);
4583                 goto unlock;
4584         }
4585
4586         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4587                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4588
4589         conn->sec_level = BT_SECURITY_LOW;
4590         conn->handle = __le16_to_cpu(ev->handle);
4591         conn->state = BT_CONFIG;
4592
4593         conn->le_conn_interval = le16_to_cpu(ev->interval);
4594         conn->le_conn_latency = le16_to_cpu(ev->latency);
4595         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4596
4597         hci_debugfs_create_conn(conn);
4598         hci_conn_add_sysfs(conn);
4599
4600         if (!ev->status) {
4601                 /* The remote features procedure is defined for master
4602                  * role only. So only in case of an initiated connection
4603                  * request the remote features.
4604                  *
4605                  * If the local controller supports slave-initiated features
4606                  * exchange, then requesting the remote features in slave
4607                  * role is possible. Otherwise just transition into the
4608                  * connected state without requesting the remote features.
4609                  */
4610                 if (conn->out ||
4611                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4612                         struct hci_cp_le_read_remote_features cp;
4613
4614                         cp.handle = __cpu_to_le16(conn->handle);
4615
4616                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4617                                      sizeof(cp), &cp);
4618
4619                         hci_conn_hold(conn);
4620                 } else {
4621                         conn->state = BT_CONNECTED;
4622                         hci_connect_cfm(conn, ev->status);
4623                 }
4624         } else {
4625                 hci_connect_cfm(conn, ev->status);
4626         }
4627
4628         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4629                                            conn->dst_type);
4630         if (params) {
4631                 list_del_init(&params->action);
4632                 if (params->conn) {
4633                         hci_conn_drop(params->conn);
4634                         hci_conn_put(params->conn);
4635                         params->conn = NULL;
4636                 }
4637         }
4638
4639 unlock:
4640         hci_update_background_scan(hdev);
4641         hci_dev_unlock(hdev);
4642 }
4643
4644 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4645                                             struct sk_buff *skb)
4646 {
4647         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4648         struct hci_conn *conn;
4649
4650         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4651
4652         if (ev->status)
4653                 return;
4654
4655         hci_dev_lock(hdev);
4656
4657         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4658         if (conn) {
4659                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4660                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4661                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4662         }
4663
4664         hci_dev_unlock(hdev);
4665 }
4666
4667 /* This function requires the caller holds hdev->lock */
4668 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4669                                               bdaddr_t *addr,
4670                                               u8 addr_type, u8 adv_type)
4671 {
4672         struct hci_conn *conn;
4673         struct hci_conn_params *params;
4674
4675         /* If the event is not connectable don't proceed further */
4676         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4677                 return NULL;
4678
4679         /* Ignore if the device is blocked */
4680         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4681                 return NULL;
4682
4683         /* Most controller will fail if we try to create new connections
4684          * while we have an existing one in slave role.
4685          */
4686         if (hdev->conn_hash.le_num_slave > 0)
4687                 return NULL;
4688
4689         /* If we're not connectable only connect devices that we have in
4690          * our pend_le_conns list.
4691          */
4692         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4693                                            addr, addr_type);
4694         if (!params)
4695                 return NULL;
4696
4697         switch (params->auto_connect) {
4698         case HCI_AUTO_CONN_DIRECT:
4699                 /* Only devices advertising with ADV_DIRECT_IND are
4700                  * triggering a connection attempt. This is allowing
4701                  * incoming connections from slave devices.
4702                  */
4703                 if (adv_type != LE_ADV_DIRECT_IND)
4704                         return NULL;
4705                 break;
4706         case HCI_AUTO_CONN_ALWAYS:
4707                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4708                  * are triggering a connection attempt. This means
4709                  * that incoming connectioms from slave device are
4710                  * accepted and also outgoing connections to slave
4711                  * devices are established when found.
4712                  */
4713                 break;
4714         default:
4715                 return NULL;
4716         }
4717
4718         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4719                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4720         if (!IS_ERR(conn)) {
4721                 /* Store the pointer since we don't really have any
4722                  * other owner of the object besides the params that
4723                  * triggered it. This way we can abort the connection if
4724                  * the parameters get removed and keep the reference
4725                  * count consistent once the connection is established.
4726                  */
4727                 params->conn = hci_conn_get(conn);
4728                 return conn;
4729         }
4730
4731         switch (PTR_ERR(conn)) {
4732         case -EBUSY:
4733                 /* If hci_connect() returns -EBUSY it means there is already
4734                  * an LE connection attempt going on. Since controllers don't
4735                  * support more than one connection attempt at the time, we
4736                  * don't consider this an error case.
4737                  */
4738                 break;
4739         default:
4740                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4741                 return NULL;
4742         }
4743
4744         return NULL;
4745 }
4746
4747 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4748                                u8 bdaddr_type, bdaddr_t *direct_addr,
4749                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4750 {
4751         struct discovery_state *d = &hdev->discovery;
4752         struct smp_irk *irk;
4753         struct hci_conn *conn;
4754         bool match;
4755         u32 flags;
4756
4757         /* If the direct address is present, then this report is from
4758          * a LE Direct Advertising Report event. In that case it is
4759          * important to see if the address is matching the local
4760          * controller address.
4761          */
4762         if (direct_addr) {
4763                 /* Only resolvable random addresses are valid for these
4764                  * kind of reports and others can be ignored.
4765                  */
4766                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4767                         return;
4768
4769                 /* If the controller is not using resolvable random
4770                  * addresses, then this report can be ignored.
4771                  */
4772                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4773                         return;
4774
4775                 /* If the local IRK of the controller does not match
4776                  * with the resolvable random address provided, then
4777                  * this report can be ignored.
4778                  */
4779                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4780                         return;
4781         }
4782
4783         /* Check if we need to convert to identity address */
4784         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4785         if (irk) {
4786                 bdaddr = &irk->bdaddr;
4787                 bdaddr_type = irk->addr_type;
4788         }
4789
4790         /* Check if we have been requested to connect to this device */
4791         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4792         if (conn && type == LE_ADV_IND) {
4793                 /* Store report for later inclusion by
4794                  * mgmt_device_connected
4795                  */
4796                 memcpy(conn->le_adv_data, data, len);
4797                 conn->le_adv_data_len = len;
4798         }
4799
4800         /* Passive scanning shouldn't trigger any device found events,
4801          * except for devices marked as CONN_REPORT for which we do send
4802          * device found events.
4803          */
4804         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4805                 if (type == LE_ADV_DIRECT_IND)
4806                         return;
4807
4808                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4809                                                bdaddr, bdaddr_type))
4810                         return;
4811
4812                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4813                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4814                 else
4815                         flags = 0;
4816                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4817                                   rssi, flags, data, len, NULL, 0);
4818                 return;
4819         }
4820
4821         /* When receiving non-connectable or scannable undirected
4822          * advertising reports, this means that the remote device is
4823          * not connectable and then clearly indicate this in the
4824          * device found event.
4825          *
4826          * When receiving a scan response, then there is no way to
4827          * know if the remote device is connectable or not. However
4828          * since scan responses are merged with a previously seen
4829          * advertising report, the flags field from that report
4830          * will be used.
4831          *
4832          * In the really unlikely case that a controller get confused
4833          * and just sends a scan response event, then it is marked as
4834          * not connectable as well.
4835          */
4836         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4837             type == LE_ADV_SCAN_RSP)
4838                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4839         else
4840                 flags = 0;
4841
4842         /* If there's nothing pending either store the data from this
4843          * event or send an immediate device found event if the data
4844          * should not be stored for later.
4845          */
4846         if (!has_pending_adv_report(hdev)) {
4847                 /* If the report will trigger a SCAN_REQ store it for
4848                  * later merging.
4849                  */
4850                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4851                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4852                                                  rssi, flags, data, len);
4853                         return;
4854                 }
4855
4856                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4857                                   rssi, flags, data, len, NULL, 0);
4858                 return;
4859         }
4860
4861         /* Check if the pending report is for the same device as the new one */
4862         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4863                  bdaddr_type == d->last_adv_addr_type);
4864
4865         /* If the pending data doesn't match this report or this isn't a
4866          * scan response (e.g. we got a duplicate ADV_IND) then force
4867          * sending of the pending data.
4868          */
4869         if (type != LE_ADV_SCAN_RSP || !match) {
4870                 /* Send out whatever is in the cache, but skip duplicates */
4871                 if (!match)
4872                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4873                                           d->last_adv_addr_type, NULL,
4874                                           d->last_adv_rssi, d->last_adv_flags,
4875                                           d->last_adv_data,
4876                                           d->last_adv_data_len, NULL, 0);
4877
4878                 /* If the new report will trigger a SCAN_REQ store it for
4879                  * later merging.
4880                  */
4881                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4882                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4883                                                  rssi, flags, data, len);
4884                         return;
4885                 }
4886
4887                 /* The advertising reports cannot be merged, so clear
4888                  * the pending report and send out a device found event.
4889                  */
4890                 clear_pending_adv_report(hdev);
4891                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4892                                   rssi, flags, data, len, NULL, 0);
4893                 return;
4894         }
4895
4896         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4897          * the new event is a SCAN_RSP. We can therefore proceed with
4898          * sending a merged device found event.
4899          */
4900         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4901                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4902                           d->last_adv_data, d->last_adv_data_len, data, len);
4903         clear_pending_adv_report(hdev);
4904 }
4905
4906 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4907 {
4908         u8 num_reports = skb->data[0];
4909         void *ptr = &skb->data[1];
4910
4911         hci_dev_lock(hdev);
4912
4913         while (num_reports--) {
4914                 struct hci_ev_le_advertising_info *ev = ptr;
4915                 s8 rssi;
4916
4917                 rssi = ev->data[ev->length];
4918                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4919                                    ev->bdaddr_type, NULL, 0, rssi,
4920                                    ev->data, ev->length);
4921
4922                 ptr += sizeof(*ev) + ev->length + 1;
4923         }
4924
4925         hci_dev_unlock(hdev);
4926 }
4927
4928 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4929                                             struct sk_buff *skb)
4930 {
4931         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4932         struct hci_conn *conn;
4933
4934         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4935
4936         hci_dev_lock(hdev);
4937
4938         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4939         if (conn) {
4940                 if (!ev->status)
4941                         memcpy(conn->features[0], ev->features, 8);
4942
4943                 if (conn->state == BT_CONFIG) {
4944                         __u8 status;
4945
4946                         /* If the local controller supports slave-initiated
4947                          * features exchange, but the remote controller does
4948                          * not, then it is possible that the error code 0x1a
4949                          * for unsupported remote feature gets returned.
4950                          *
4951                          * In this specific case, allow the connection to
4952                          * transition into connected state and mark it as
4953                          * successful.
4954                          */
4955                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
4956                             !conn->out && ev->status == 0x1a)
4957                                 status = 0x00;
4958                         else
4959                                 status = ev->status;
4960
4961                         conn->state = BT_CONNECTED;
4962                         hci_connect_cfm(conn, status);
4963                         hci_conn_drop(conn);
4964                 }
4965         }
4966
4967         hci_dev_unlock(hdev);
4968 }
4969
4970 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4971 {
4972         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4973         struct hci_cp_le_ltk_reply cp;
4974         struct hci_cp_le_ltk_neg_reply neg;
4975         struct hci_conn *conn;
4976         struct smp_ltk *ltk;
4977
4978         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4979
4980         hci_dev_lock(hdev);
4981
4982         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4983         if (conn == NULL)
4984                 goto not_found;
4985
4986         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4987         if (!ltk)
4988                 goto not_found;
4989
4990         if (smp_ltk_is_sc(ltk)) {
4991                 /* With SC both EDiv and Rand are set to zero */
4992                 if (ev->ediv || ev->rand)
4993                         goto not_found;
4994         } else {
4995                 /* For non-SC keys check that EDiv and Rand match */
4996                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4997                         goto not_found;
4998         }
4999
5000         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5001         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5002         cp.handle = cpu_to_le16(conn->handle);
5003
5004         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5005
5006         conn->enc_key_size = ltk->enc_size;
5007
5008         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5009
5010         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5011          * temporary key used to encrypt a connection following
5012          * pairing. It is used during the Encrypted Session Setup to
5013          * distribute the keys. Later, security can be re-established
5014          * using a distributed LTK.
5015          */
5016         if (ltk->type == SMP_STK) {
5017                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5018                 list_del_rcu(&ltk->list);
5019                 kfree_rcu(ltk, rcu);
5020         } else {
5021                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5022         }
5023
5024         hci_dev_unlock(hdev);
5025
5026         return;
5027
5028 not_found:
5029         neg.handle = ev->handle;
5030         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5031         hci_dev_unlock(hdev);
5032 }
5033
5034 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5035                                       u8 reason)
5036 {
5037         struct hci_cp_le_conn_param_req_neg_reply cp;
5038
5039         cp.handle = cpu_to_le16(handle);
5040         cp.reason = reason;
5041
5042         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5043                      &cp);
5044 }
5045
5046 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5047                                              struct sk_buff *skb)
5048 {
5049         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5050         struct hci_cp_le_conn_param_req_reply cp;
5051         struct hci_conn *hcon;
5052         u16 handle, min, max, latency, timeout;
5053
5054         handle = le16_to_cpu(ev->handle);
5055         min = le16_to_cpu(ev->interval_min);
5056         max = le16_to_cpu(ev->interval_max);
5057         latency = le16_to_cpu(ev->latency);
5058         timeout = le16_to_cpu(ev->timeout);
5059
5060         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5061         if (!hcon || hcon->state != BT_CONNECTED)
5062                 return send_conn_param_neg_reply(hdev, handle,
5063                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5064
5065         if (hci_check_conn_params(min, max, latency, timeout))
5066                 return send_conn_param_neg_reply(hdev, handle,
5067                                                  HCI_ERROR_INVALID_LL_PARAMS);
5068
5069         if (hcon->role == HCI_ROLE_MASTER) {
5070                 struct hci_conn_params *params;
5071                 u8 store_hint;
5072
5073                 hci_dev_lock(hdev);
5074
5075                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5076                                                 hcon->dst_type);
5077                 if (params) {
5078                         params->conn_min_interval = min;
5079                         params->conn_max_interval = max;
5080                         params->conn_latency = latency;
5081                         params->supervision_timeout = timeout;
5082                         store_hint = 0x01;
5083                 } else{
5084                         store_hint = 0x00;
5085                 }
5086
5087                 hci_dev_unlock(hdev);
5088
5089                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5090                                     store_hint, min, max, latency, timeout);
5091         }
5092
5093         cp.handle = ev->handle;
5094         cp.interval_min = ev->interval_min;
5095         cp.interval_max = ev->interval_max;
5096         cp.latency = ev->latency;
5097         cp.timeout = ev->timeout;
5098         cp.min_ce_len = 0;
5099         cp.max_ce_len = 0;
5100
5101         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5102 }
5103
5104 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5105                                          struct sk_buff *skb)
5106 {
5107         u8 num_reports = skb->data[0];
5108         void *ptr = &skb->data[1];
5109
5110         hci_dev_lock(hdev);
5111
5112         while (num_reports--) {
5113                 struct hci_ev_le_direct_adv_info *ev = ptr;
5114
5115                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5116                                    ev->bdaddr_type, &ev->direct_addr,
5117                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5118
5119                 ptr += sizeof(*ev);
5120         }
5121
5122         hci_dev_unlock(hdev);
5123 }
5124
5125 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5126 {
5127         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5128
5129         skb_pull(skb, sizeof(*le_ev));
5130
5131         switch (le_ev->subevent) {
5132         case HCI_EV_LE_CONN_COMPLETE:
5133                 hci_le_conn_complete_evt(hdev, skb);
5134                 break;
5135
5136         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5137                 hci_le_conn_update_complete_evt(hdev, skb);
5138                 break;
5139
5140         case HCI_EV_LE_ADVERTISING_REPORT:
5141                 hci_le_adv_report_evt(hdev, skb);
5142                 break;
5143
5144         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5145                 hci_le_remote_feat_complete_evt(hdev, skb);
5146                 break;
5147
5148         case HCI_EV_LE_LTK_REQ:
5149                 hci_le_ltk_request_evt(hdev, skb);
5150                 break;
5151
5152         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5153                 hci_le_remote_conn_param_req_evt(hdev, skb);
5154                 break;
5155
5156         case HCI_EV_LE_DIRECT_ADV_REPORT:
5157                 hci_le_direct_adv_report_evt(hdev, skb);
5158                 break;
5159
5160         default:
5161                 break;
5162         }
5163 }
5164
5165 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5166                                  u8 event, struct sk_buff *skb)
5167 {
5168         struct hci_ev_cmd_complete *ev;
5169         struct hci_event_hdr *hdr;
5170
5171         if (!skb)
5172                 return false;
5173
5174         if (skb->len < sizeof(*hdr)) {
5175                 BT_ERR("Too short HCI event");
5176                 return false;
5177         }
5178
5179         hdr = (void *) skb->data;
5180         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5181
5182         if (event) {
5183                 if (hdr->evt != event)
5184                         return false;
5185                 return true;
5186         }
5187
5188         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5189                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5190                 return false;
5191         }
5192
5193         if (skb->len < sizeof(*ev)) {
5194                 BT_ERR("Too short cmd_complete event");
5195                 return false;
5196         }
5197
5198         ev = (void *) skb->data;
5199         skb_pull(skb, sizeof(*ev));
5200
5201         if (opcode != __le16_to_cpu(ev->opcode)) {
5202                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5203                        __le16_to_cpu(ev->opcode));
5204                 return false;
5205         }
5206
5207         return true;
5208 }
5209
5210 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5211 {
5212         struct hci_event_hdr *hdr = (void *) skb->data;
5213         hci_req_complete_t req_complete = NULL;
5214         hci_req_complete_skb_t req_complete_skb = NULL;
5215         struct sk_buff *orig_skb = NULL;
5216         u8 status = 0, event = hdr->evt, req_evt = 0;
5217         u16 opcode = HCI_OP_NOP;
5218
5219         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5220                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5221                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5222                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5223                                      &req_complete_skb);
5224                 req_evt = event;
5225         }
5226
5227         /* If it looks like we might end up having to call
5228          * req_complete_skb, store a pristine copy of the skb since the
5229          * various handlers may modify the original one through
5230          * skb_pull() calls, etc.
5231          */
5232         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5233             event == HCI_EV_CMD_COMPLETE)
5234                 orig_skb = skb_clone(skb, GFP_KERNEL);
5235
5236         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5237
5238         switch (event) {
5239         case HCI_EV_INQUIRY_COMPLETE:
5240                 hci_inquiry_complete_evt(hdev, skb);
5241                 break;
5242
5243         case HCI_EV_INQUIRY_RESULT:
5244                 hci_inquiry_result_evt(hdev, skb);
5245                 break;
5246
5247         case HCI_EV_CONN_COMPLETE:
5248                 hci_conn_complete_evt(hdev, skb);
5249                 break;
5250
5251         case HCI_EV_CONN_REQUEST:
5252                 hci_conn_request_evt(hdev, skb);
5253                 break;
5254
5255         case HCI_EV_DISCONN_COMPLETE:
5256                 hci_disconn_complete_evt(hdev, skb);
5257                 break;
5258
5259         case HCI_EV_AUTH_COMPLETE:
5260                 hci_auth_complete_evt(hdev, skb);
5261                 break;
5262
5263         case HCI_EV_REMOTE_NAME:
5264                 hci_remote_name_evt(hdev, skb);
5265                 break;
5266
5267         case HCI_EV_ENCRYPT_CHANGE:
5268                 hci_encrypt_change_evt(hdev, skb);
5269                 break;
5270
5271         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5272                 hci_change_link_key_complete_evt(hdev, skb);
5273                 break;
5274
5275         case HCI_EV_REMOTE_FEATURES:
5276                 hci_remote_features_evt(hdev, skb);
5277                 break;
5278
5279         case HCI_EV_CMD_COMPLETE:
5280                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5281                                      &req_complete, &req_complete_skb);
5282                 break;
5283
5284         case HCI_EV_CMD_STATUS:
5285                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5286                                    &req_complete_skb);
5287                 break;
5288
5289         case HCI_EV_HARDWARE_ERROR:
5290                 hci_hardware_error_evt(hdev, skb);
5291                 break;
5292
5293         case HCI_EV_ROLE_CHANGE:
5294                 hci_role_change_evt(hdev, skb);
5295                 break;
5296
5297         case HCI_EV_NUM_COMP_PKTS:
5298                 hci_num_comp_pkts_evt(hdev, skb);
5299                 break;
5300
5301         case HCI_EV_MODE_CHANGE:
5302                 hci_mode_change_evt(hdev, skb);
5303                 break;
5304
5305         case HCI_EV_PIN_CODE_REQ:
5306                 hci_pin_code_request_evt(hdev, skb);
5307                 break;
5308
5309         case HCI_EV_LINK_KEY_REQ:
5310                 hci_link_key_request_evt(hdev, skb);
5311                 break;
5312
5313         case HCI_EV_LINK_KEY_NOTIFY:
5314                 hci_link_key_notify_evt(hdev, skb);
5315                 break;
5316
5317         case HCI_EV_CLOCK_OFFSET:
5318                 hci_clock_offset_evt(hdev, skb);
5319                 break;
5320
5321         case HCI_EV_PKT_TYPE_CHANGE:
5322                 hci_pkt_type_change_evt(hdev, skb);
5323                 break;
5324
5325         case HCI_EV_PSCAN_REP_MODE:
5326                 hci_pscan_rep_mode_evt(hdev, skb);
5327                 break;
5328
5329         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5330                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5331                 break;
5332
5333         case HCI_EV_REMOTE_EXT_FEATURES:
5334                 hci_remote_ext_features_evt(hdev, skb);
5335                 break;
5336
5337         case HCI_EV_SYNC_CONN_COMPLETE:
5338                 hci_sync_conn_complete_evt(hdev, skb);
5339                 break;
5340
5341         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5342                 hci_extended_inquiry_result_evt(hdev, skb);
5343                 break;
5344
5345         case HCI_EV_KEY_REFRESH_COMPLETE:
5346                 hci_key_refresh_complete_evt(hdev, skb);
5347                 break;
5348
5349         case HCI_EV_IO_CAPA_REQUEST:
5350                 hci_io_capa_request_evt(hdev, skb);
5351                 break;
5352
5353         case HCI_EV_IO_CAPA_REPLY:
5354                 hci_io_capa_reply_evt(hdev, skb);
5355                 break;
5356
5357         case HCI_EV_USER_CONFIRM_REQUEST:
5358                 hci_user_confirm_request_evt(hdev, skb);
5359                 break;
5360
5361         case HCI_EV_USER_PASSKEY_REQUEST:
5362                 hci_user_passkey_request_evt(hdev, skb);
5363                 break;
5364
5365         case HCI_EV_USER_PASSKEY_NOTIFY:
5366                 hci_user_passkey_notify_evt(hdev, skb);
5367                 break;
5368
5369         case HCI_EV_KEYPRESS_NOTIFY:
5370                 hci_keypress_notify_evt(hdev, skb);
5371                 break;
5372
5373         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5374                 hci_simple_pair_complete_evt(hdev, skb);
5375                 break;
5376
5377         case HCI_EV_REMOTE_HOST_FEATURES:
5378                 hci_remote_host_features_evt(hdev, skb);
5379                 break;
5380
5381         case HCI_EV_LE_META:
5382                 hci_le_meta_evt(hdev, skb);
5383                 break;
5384
5385         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5386                 hci_remote_oob_data_request_evt(hdev, skb);
5387                 break;
5388
5389 #if IS_ENABLED(CONFIG_BT_HS)
5390         case HCI_EV_CHANNEL_SELECTED:
5391                 hci_chan_selected_evt(hdev, skb);
5392                 break;
5393
5394         case HCI_EV_PHY_LINK_COMPLETE:
5395                 hci_phy_link_complete_evt(hdev, skb);
5396                 break;
5397
5398         case HCI_EV_LOGICAL_LINK_COMPLETE:
5399                 hci_loglink_complete_evt(hdev, skb);
5400                 break;
5401
5402         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5403                 hci_disconn_loglink_complete_evt(hdev, skb);
5404                 break;
5405
5406         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5407                 hci_disconn_phylink_complete_evt(hdev, skb);
5408                 break;
5409 #endif
5410
5411         case HCI_EV_NUM_COMP_BLOCKS:
5412                 hci_num_comp_blocks_evt(hdev, skb);
5413                 break;
5414
5415         default:
5416                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5417                 break;
5418         }
5419
5420         if (req_complete) {
5421                 req_complete(hdev, status, opcode);
5422         } else if (req_complete_skb) {
5423                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5424                         kfree_skb(orig_skb);
5425                         orig_skb = NULL;
5426                 }
5427                 req_complete_skb(hdev, status, opcode, orig_skb);
5428         }
5429
5430         kfree_skb(orig_skb);
5431         kfree_skb(skb);
5432         hdev->stat.evt_rx++;
5433 }