net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  45                                   u8 *new_status)
  46 {
  47         __u8 status = *((__u8 *) skb->data);
  48
  49         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  50
  51         /* It is possible that we receive Inquiry Complete event right
  52          * before we receive Inquiry Cancel Command Complete event, in
  53          * which case the latter event should have status of Command
  54          * Disallowed (0x0c). This should not be treated as error, since
  55          * we actually achieve what Inquiry Cancel wants to achieve,
  56          * which is to end the last Inquiry session.
  57          */
  58         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  59                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  60                 status = 0x00;
  61         }
  62
  63         *new_status = status;
  64
  65         if (status)
  66                 return;
  67
  68         clear_bit(HCI_INQUIRY, &hdev->flags);
  69         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  70         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  71
  72         hci_dev_lock(hdev);
  73         /* Set discovery state to stopped if we're not doing LE active
  74          * scanning.
  75          */
  76         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  77             hdev->le_scan_type != LE_SCAN_ACTIVE)
  78                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  79         hci_dev_unlock(hdev);
  80
  81         hci_conn_check_pending(hdev);
  82 }
  83
  84 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  85 {
  86         __u8 status = *((__u8 *) skb->data);
  87
  88         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  89
  90         if (status)
  91                 return;
  92
  93         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  94 }
  95
  96 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         __u8 status = *((__u8 *) skb->data);
  99
 100         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 101
 102         if (status)
 103                 return;
 104
 105         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 106
 107         hci_conn_check_pending(hdev);
 108 }
 109
 110 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 111                                           struct sk_buff *skb)
 112 {
 113         BT_DBG("%s", hdev->name);
 114 }
 115
 116 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_role_discovery *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->role = rp->role;
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         hci_dev_lock(hdev);
 146
 147         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 148         if (conn)
 149                 conn->link_policy = __le16_to_cpu(rp->policy);
 150
 151         hci_dev_unlock(hdev);
 152 }
 153
 154 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 155 {
 156         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 157         struct hci_conn *conn;
 158         void *sent;
 159
 160         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 161
 162         if (rp->status)
 163                 return;
 164
 165         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 166         if (!sent)
 167                 return;
 168
 169         hci_dev_lock(hdev);
 170
 171         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 172         if (conn)
 173                 conn->link_policy = get_unaligned_le16(sent + 2);
 174
 175         hci_dev_unlock(hdev);
 176 }
 177
 178 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 179                                         struct sk_buff *skb)
 180 {
 181         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 182
 183         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 184
 185         if (rp->status)
 186                 return;
 187
 188         hdev->link_policy = __le16_to_cpu(rp->policy);
 189 }
 190
 191 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 192                                          struct sk_buff *skb)
 193 {
 194         __u8 status = *((__u8 *) skb->data);
 195         void *sent;
 196
 197         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 198
 199         if (status)
 200                 return;
 201
 202         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 203         if (!sent)
 204                 return;
 205
 206         hdev->link_policy = get_unaligned_le16(sent);
 207 }
 208
 209 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 210 {
 211         __u8 status = *((__u8 *) skb->data);
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         clear_bit(HCI_RESET, &hdev->flags);
 216
 217         if (status)
 218                 return;
 219
 220         /* Reset all non-persistent flags */
 221         hci_dev_clear_volatile_flags(hdev);
 222
 223         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 224
 225         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 226         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 227
 228         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 229         hdev->adv_data_len = 0;
 230
 231         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 232         hdev->scan_rsp_data_len = 0;
 233
 234         hdev->le_scan_type = LE_SCAN_PASSIVE;
 235
 236         hdev->ssp_debug_mode = 0;
 237
 238         hci_bdaddr_list_clear(&hdev->le_white_list);
 239 }
 240
 241 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 242                                         struct sk_buff *skb)
 243 {
 244         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 245         struct hci_cp_read_stored_link_key *sent;
 246
 247         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 248
 249         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 250         if (!sent)
 251                 return;
 252
 253         if (!rp->status && sent->read_all == 0x01) {
 254                 hdev->stored_max_keys = rp->max_keys;
 255                 hdev->stored_num_keys = rp->num_keys;
 256         }
 257 }
 258
 259 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 260                                           struct sk_buff *skb)
 261 {
 262         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 263
 264         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 265
 266         if (rp->status)
 267                 return;
 268
 269         if (rp->num_keys <= hdev->stored_num_keys)
 270                 hdev->stored_num_keys -= rp->num_keys;
 271         else
 272                 hdev->stored_num_keys = 0;
 273 }
 274
 275 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 276 {
 277         __u8 status = *((__u8 *) skb->data);
 278         void *sent;
 279
 280         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 281
 282         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 283         if (!sent)
 284                 return;
 285
 286         hci_dev_lock(hdev);
 287
 288         if (hci_dev_test_flag(hdev, HCI_MGMT))
 289                 mgmt_set_local_name_complete(hdev, sent, status);
 290         else if (!status)
 291                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 292
 293         hci_dev_unlock(hdev);
 294 }
 295
 296 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 297 {
 298         struct hci_rp_read_local_name *rp = (void *) skb->data;
 299
 300         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 301
 302         if (rp->status)
 303                 return;
 304
 305         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 306             hci_dev_test_flag(hdev, HCI_CONFIG))
 307                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 308 }
 309
 310 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 311 {
 312         __u8 status = *((__u8 *) skb->data);
 313         void *sent;
 314
 315         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 316
 317         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 318         if (!sent)
 319                 return;
 320
 321         hci_dev_lock(hdev);
 322
 323         if (!status) {
 324                 __u8 param = *((__u8 *) sent);
 325
 326                 if (param == AUTH_ENABLED)
 327                         set_bit(HCI_AUTH, &hdev->flags);
 328                 else
 329                         clear_bit(HCI_AUTH, &hdev->flags);
 330         }
 331
 332         if (hci_dev_test_flag(hdev, HCI_MGMT))
 333                 mgmt_auth_enable_complete(hdev, status);
 334
 335         hci_dev_unlock(hdev);
 336 }
 337
 338 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 339 {
 340         __u8 status = *((__u8 *) skb->data);
 341         __u8 param;
 342         void *sent;
 343
 344         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 345
 346         if (status)
 347                 return;
 348
 349         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 350         if (!sent)
 351                 return;
 352
 353         param = *((__u8 *) sent);
 354
 355         if (param)
 356                 set_bit(HCI_ENCRYPT, &hdev->flags);
 357         else
 358                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 359 }
 360
 361 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 362 {
 363         __u8 status = *((__u8 *) skb->data);
 364         __u8 param;
 365         void *sent;
 366
 367         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 368
 369         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 370         if (!sent)
 371                 return;
 372
 373         param = *((__u8 *) sent);
 374
 375         hci_dev_lock(hdev);
 376
 377         if (status) {
 378                 hdev->discov_timeout = 0;
 379                 goto done;
 380         }
 381
 382         if (param & SCAN_INQUIRY)
 383                 set_bit(HCI_ISCAN, &hdev->flags);
 384         else
 385                 clear_bit(HCI_ISCAN, &hdev->flags);
 386
 387         if (param & SCAN_PAGE)
 388                 set_bit(HCI_PSCAN, &hdev->flags);
 389         else
 390                 clear_bit(HCI_PSCAN, &hdev->flags);
 391
 392 done:
 393         hci_dev_unlock(hdev);
 394 }
 395
 396 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 397 {
 398         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 399
 400         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 401
 402         if (rp->status)
 403                 return;
 404
 405         memcpy(hdev->dev_class, rp->dev_class, 3);
 406
 407         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 408                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 409 }
 410
 411 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 412 {
 413         __u8 status = *((__u8 *) skb->data);
 414         void *sent;
 415
 416         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 417
 418         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 419         if (!sent)
 420                 return;
 421
 422         hci_dev_lock(hdev);
 423
 424         if (status == 0)
 425                 memcpy(hdev->dev_class, sent, 3);
 426
 427         if (hci_dev_test_flag(hdev, HCI_MGMT))
 428                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 429
 430         hci_dev_unlock(hdev);
 431 }
 432
 433 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 434 {
 435         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 436         __u16 setting;
 437
 438         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 439
 440         if (rp->status)
 441                 return;
 442
 443         setting = __le16_to_cpu(rp->voice_setting);
 444
 445         if (hdev->voice_setting == setting)
 446                 return;
 447
 448         hdev->voice_setting = setting;
 449
 450         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 451
 452         if (hdev->notify)
 453                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 454 }
 455
 456 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 457                                        struct sk_buff *skb)
 458 {
 459         __u8 status = *((__u8 *) skb->data);
 460         __u16 setting;
 461         void *sent;
 462
 463         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 464
 465         if (status)
 466                 return;
 467
 468         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 469         if (!sent)
 470                 return;
 471
 472         setting = get_unaligned_le16(sent);
 473
 474         if (hdev->voice_setting == setting)
 475                 return;
 476
 477         hdev->voice_setting = setting;
 478
 479         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 480
 481         if (hdev->notify)
 482                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 483 }
 484
 485 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 486                                           struct sk_buff *skb)
 487 {
 488         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 489
 490         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 491
 492         if (rp->status)
 493                 return;
 494
 495         hdev->num_iac = rp->num_iac;
 496
 497         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 498 }
 499
 500 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 501 {
 502         __u8 status = *((__u8 *) skb->data);
 503         struct hci_cp_write_ssp_mode *sent;
 504
 505         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 506
 507         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 508         if (!sent)
 509                 return;
 510
 511         hci_dev_lock(hdev);
 512
 513         if (!status) {
 514                 if (sent->mode)
 515                         hdev->features[1][0] |= LMP_HOST_SSP;
 516                 else
 517                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 518         }
 519
 520         if (hci_dev_test_flag(hdev, HCI_MGMT))
 521                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 522         else if (!status) {
 523                 if (sent->mode)
 524                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 525                 else
 526                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 527         }
 528
 529         hci_dev_unlock(hdev);
 530 }
 531
 532 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 533 {
 534         u8 status = *((u8 *) skb->data);
 535         struct hci_cp_write_sc_support *sent;
 536
 537         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 538
 539         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 540         if (!sent)
 541                 return;
 542
 543         hci_dev_lock(hdev);
 544
 545         if (!status) {
 546                 if (sent->support)
 547                         hdev->features[1][0] |= LMP_HOST_SC;
 548                 else
 549                         hdev->features[1][0] &= ~LMP_HOST_SC;
 550         }
 551
 552         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 553                 if (sent->support)
 554                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 555                 else
 556                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 557         }
 558
 559         hci_dev_unlock(hdev);
 560 }
 561
 562 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 563 {
 564         struct hci_rp_read_local_version *rp = (void *) skb->data;
 565
 566         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 567
 568         if (rp->status)
 569                 return;
 570
 571         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 572             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 573                 hdev->hci_ver = rp->hci_ver;
 574                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 575                 hdev->lmp_ver = rp->lmp_ver;
 576                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 577                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 578         }
 579 }
 580
 581 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 582                                        struct sk_buff *skb)
 583 {
 584         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 585
 586         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 587
 588         if (rp->status)
 589                 return;
 590
 591         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 592             hci_dev_test_flag(hdev, HCI_CONFIG))
 593                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 594 }
 595
 596 static void hci_cc_read_local_features(struct hci_dev *hdev,
 597                                        struct sk_buff *skb)
 598 {
 599         struct hci_rp_read_local_features *rp = (void *) skb->data;
 600
 601         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 602
 603         if (rp->status)
 604                 return;
 605
 606         memcpy(hdev->features, rp->features, 8);
 607
 608         /* Adjust default settings according to features
 609          * supported by device. */
 610
 611         if (hdev->features[0][0] & LMP_3SLOT)
 612                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 613
 614         if (hdev->features[0][0] & LMP_5SLOT)
 615                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 616
 617         if (hdev->features[0][1] & LMP_HV2) {
 618                 hdev->pkt_type  |= (HCI_HV2);
 619                 hdev->esco_type |= (ESCO_HV2);
 620         }
 621
 622         if (hdev->features[0][1] & LMP_HV3) {
 623                 hdev->pkt_type  |= (HCI_HV3);
 624                 hdev->esco_type |= (ESCO_HV3);
 625         }
 626
 627         if (lmp_esco_capable(hdev))
 628                 hdev->esco_type |= (ESCO_EV3);
 629
 630         if (hdev->features[0][4] & LMP_EV4)
 631                 hdev->esco_type |= (ESCO_EV4);
 632
 633         if (hdev->features[0][4] & LMP_EV5)
 634                 hdev->esco_type |= (ESCO_EV5);
 635
 636         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 637                 hdev->esco_type |= (ESCO_2EV3);
 638
 639         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 640                 hdev->esco_type |= (ESCO_3EV3);
 641
 642         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 643                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 644 }
 645
 646 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 647                                            struct sk_buff *skb)
 648 {
 649         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 650
 651         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 652
 653         if (rp->status)
 654                 return;
 655
 656         if (hdev->max_page < rp->max_page)
 657                 hdev->max_page = rp->max_page;
 658
 659         if (rp->page < HCI_MAX_PAGES)
 660                 memcpy(hdev->features[rp->page], rp->features, 8);
 661 }
 662
 663 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 664                                           struct sk_buff *skb)
 665 {
 666         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 667
 668         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 669
 670         if (rp->status)
 671                 return;
 672
 673         hdev->flow_ctl_mode = rp->mode;
 674 }
 675
 676 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 677 {
 678         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 679
 680         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 681
 682         if (rp->status)
 683                 return;
 684
 685         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 686         hdev->sco_mtu  = rp->sco_mtu;
 687         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 688         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 689
 690         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 691                 hdev->sco_mtu  = 64;
 692                 hdev->sco_pkts = 8;
 693         }
 694
 695         hdev->acl_cnt = hdev->acl_pkts;
 696         hdev->sco_cnt = hdev->sco_pkts;
 697
 698         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 699                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 700 }
 701
 702 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 703 {
 704         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 705
 706         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 707
 708         if (rp->status)
 709                 return;
 710
 711         if (test_bit(HCI_INIT, &hdev->flags))
 712                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 713
 714         if (hci_dev_test_flag(hdev, HCI_SETUP))
 715                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 716 }
 717
 718 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 719                                            struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 return;
 727
 728         if (test_bit(HCI_INIT, &hdev->flags)) {
 729                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 730                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 731         }
 732 }
 733
 734 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 735                                             struct sk_buff *skb)
 736 {
 737         u8 status = *((u8 *) skb->data);
 738         struct hci_cp_write_page_scan_activity *sent;
 739
 740         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 741
 742         if (status)
 743                 return;
 744
 745         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 746         if (!sent)
 747                 return;
 748
 749         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 750         hdev->page_scan_window = __le16_to_cpu(sent->window);
 751 }
 752
 753 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 754                                            struct sk_buff *skb)
 755 {
 756         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 757
 758         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 759
 760         if (rp->status)
 761                 return;
 762
 763         if (test_bit(HCI_INIT, &hdev->flags))
 764                 hdev->page_scan_type = rp->type;
 765 }
 766
 767 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 768                                         struct sk_buff *skb)
 769 {
 770         u8 status = *((u8 *) skb->data);
 771         u8 *type;
 772
 773         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 774
 775         if (status)
 776                 return;
 777
 778         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 779         if (type)
 780                 hdev->page_scan_type = *type;
 781 }
 782
 783 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 784                                         struct sk_buff *skb)
 785 {
 786         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 787
 788         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 789
 790         if (rp->status)
 791                 return;
 792
 793         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 794         hdev->block_len = __le16_to_cpu(rp->block_len);
 795         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 796
 797         hdev->block_cnt = hdev->num_blocks;
 798
 799         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 800                hdev->block_cnt, hdev->block_len);
 801 }
 802
 803 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 804 {
 805         struct hci_rp_read_clock *rp = (void *) skb->data;
 806         struct hci_cp_read_clock *cp;
 807         struct hci_conn *conn;
 808
 809         BT_DBG("%s", hdev->name);
 810
 811         if (skb->len < sizeof(*rp))
 812                 return;
 813
 814         if (rp->status)
 815                 return;
 816
 817         hci_dev_lock(hdev);
 818
 819         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 820         if (!cp)
 821                 goto unlock;
 822
 823         if (cp->which == 0x00) {
 824                 hdev->clock = le32_to_cpu(rp->clock);
 825                 goto unlock;
 826         }
 827
 828         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 829         if (conn) {
 830                 conn->clock = le32_to_cpu(rp->clock);
 831                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 832         }
 833
 834 unlock:
 835         hci_dev_unlock(hdev);
 836 }
 837
 838 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 839                                        struct sk_buff *skb)
 840 {
 841         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 842
 843         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 844
 845         if (rp->status)
 846                 return;
 847
 848         hdev->amp_status = rp->amp_status;
 849         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 850         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 851         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 852         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 853         hdev->amp_type = rp->amp_type;
 854         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 855         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 856         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 857         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 858 }
 859
 860 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 861                                          struct sk_buff *skb)
 862 {
 863         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 864
 865         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 866
 867         if (rp->status)
 868                 return;
 869
 870         hdev->inq_tx_power = rp->tx_power;
 871 }
 872
 873 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 874 {
 875         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 876         struct hci_cp_pin_code_reply *cp;
 877         struct hci_conn *conn;
 878
 879         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 880
 881         hci_dev_lock(hdev);
 882
 883         if (hci_dev_test_flag(hdev, HCI_MGMT))
 884                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 885
 886         if (rp->status)
 887                 goto unlock;
 888
 889         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 890         if (!cp)
 891                 goto unlock;
 892
 893         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 894         if (conn)
 895                 conn->pin_length = cp->pin_len;
 896
 897 unlock:
 898         hci_dev_unlock(hdev);
 899 }
 900
 901 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 902 {
 903         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 904
 905         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 906
 907         hci_dev_lock(hdev);
 908
 909         if (hci_dev_test_flag(hdev, HCI_MGMT))
 910                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 911                                                  rp->status);
 912
 913         hci_dev_unlock(hdev);
 914 }
 915
 916 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 917                                        struct sk_buff *skb)
 918 {
 919         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 920
 921         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 922
 923         if (rp->status)
 924                 return;
 925
 926         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 927         hdev->le_pkts = rp->le_max_pkt;
 928
 929         hdev->le_cnt = hdev->le_pkts;
 930
 931         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 932 }
 933
 934 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 935                                           struct sk_buff *skb)
 936 {
 937         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 938
 939         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 940
 941         if (rp->status)
 942                 return;
 943
 944         memcpy(hdev->le_features, rp->features, 8);
 945 }
 946
 947 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 948                                         struct sk_buff *skb)
 949 {
 950         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 951
 952         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 953
 954         if (rp->status)
 955                 return;
 956
 957         hdev->adv_tx_power = rp->tx_power;
 958 }
 959
 960 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 961 {
 962         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 963
 964         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 965
 966         hci_dev_lock(hdev);
 967
 968         if (hci_dev_test_flag(hdev, HCI_MGMT))
 969                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 970                                                  rp->status);
 971
 972         hci_dev_unlock(hdev);
 973 }
 974
 975 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 976                                           struct sk_buff *skb)
 977 {
 978         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 979
 980         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 981
 982         hci_dev_lock(hdev);
 983
 984         if (hci_dev_test_flag(hdev, HCI_MGMT))
 985                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 986                                                      ACL_LINK, 0, rp->status);
 987
 988         hci_dev_unlock(hdev);
 989 }
 990
 991 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 992 {
 993         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 994
 995         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 996
 997         hci_dev_lock(hdev);
 998
 999         if (hci_dev_test_flag(hdev, HCI_MGMT))
1000                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1001                                                  0, rp->status);
1002
1003         hci_dev_unlock(hdev);
1004 }
1005
1006 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1007                                           struct sk_buff *skb)
1008 {
1009         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1010
1011         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1012
1013         hci_dev_lock(hdev);
1014
1015         if (hci_dev_test_flag(hdev, HCI_MGMT))
1016                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1017                                                      ACL_LINK, 0, rp->status);
1018
1019         hci_dev_unlock(hdev);
1020 }
1021
1022 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1023                                        struct sk_buff *skb)
1024 {
1025         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1026
1027         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1028 }
1029
1030 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1031                                            struct sk_buff *skb)
1032 {
1033         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1034
1035         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1036 }
1037
1038 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1039 {
1040         __u8 status = *((__u8 *) skb->data);
1041         bdaddr_t *sent;
1042
1043         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1044
1045         if (status)
1046                 return;
1047
1048         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1049         if (!sent)
1050                 return;
1051
1052         hci_dev_lock(hdev);
1053
1054         bacpy(&hdev->random_addr, sent);
1055
1056         hci_dev_unlock(hdev);
1057 }
1058
1059 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1060 {
1061         __u8 *sent, status = *((__u8 *) skb->data);
1062
1063         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1064
1065         if (status)
1066                 return;
1067
1068         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1069         if (!sent)
1070                 return;
1071
1072         hci_dev_lock(hdev);
1073
1074         /* If we're doing connection initiation as peripheral. Set a
1075          * timeout in case something goes wrong.
1076          */
1077         if (*sent) {
1078                 struct hci_conn *conn;
1079
1080                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1081
1082                 conn = hci_lookup_le_connect(hdev);
1083                 if (conn)
1084                         queue_delayed_work(hdev->workqueue,
1085                                            &conn->le_conn_timeout,
1086                                            conn->conn_timeout);
1087         } else {
1088                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1089         }
1090
1091         hci_dev_unlock(hdev);
1092 }
1093
1094 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1095 {
1096         struct hci_cp_le_set_scan_param *cp;
1097         __u8 status = *((__u8 *) skb->data);
1098
1099         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1100
1101         if (status)
1102                 return;
1103
1104         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1105         if (!cp)
1106                 return;
1107
1108         hci_dev_lock(hdev);
1109
1110         hdev->le_scan_type = cp->type;
1111
1112         hci_dev_unlock(hdev);
1113 }
1114
1115 static bool has_pending_adv_report(struct hci_dev *hdev)
1116 {
1117         struct discovery_state *d = &hdev->discovery;
1118
1119         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1120 }
1121
1122 static void clear_pending_adv_report(struct hci_dev *hdev)
1123 {
1124         struct discovery_state *d = &hdev->discovery;
1125
1126         bacpy(&d->last_adv_addr, BDADDR_ANY);
1127         d->last_adv_data_len = 0;
1128 }
1129
1130 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1131                                      u8 bdaddr_type, s8 rssi, u32 flags,
1132                                      u8 *data, u8 len)
1133 {
1134         struct discovery_state *d = &hdev->discovery;
1135
1136         if (len > HCI_MAX_AD_LENGTH)
1137                 return;
1138
1139         bacpy(&d->last_adv_addr, bdaddr);
1140         d->last_adv_addr_type = bdaddr_type;
1141         d->last_adv_rssi = rssi;
1142         d->last_adv_flags = flags;
1143         memcpy(d->last_adv_data, data, len);
1144         d->last_adv_data_len = len;
1145 }
1146
1147 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1148                                       struct sk_buff *skb)
1149 {
1150         struct hci_cp_le_set_scan_enable *cp;
1151         __u8 status = *((__u8 *) skb->data);
1152
1153         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1154
1155         if (status)
1156                 return;
1157
1158         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1159         if (!cp)
1160                 return;
1161
1162         hci_dev_lock(hdev);
1163
1164         switch (cp->enable) {
1165         case LE_SCAN_ENABLE:
1166                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1167                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1168                         clear_pending_adv_report(hdev);
1169                 break;
1170
1171         case LE_SCAN_DISABLE:
1172                 /* We do this here instead of when setting DISCOVERY_STOPPED
1173                  * since the latter would potentially require waiting for
1174                  * inquiry to stop too.
1175                  */
1176                 if (has_pending_adv_report(hdev)) {
1177                         struct discovery_state *d = &hdev->discovery;
1178
1179                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1180                                           d->last_adv_addr_type, NULL,
1181                                           d->last_adv_rssi, d->last_adv_flags,
1182                                           d->last_adv_data,
1183                                           d->last_adv_data_len, NULL, 0);
1184                 }
1185
1186                 /* Cancel this timer so that we don't try to disable scanning
1187                  * when it's already disabled.
1188                  */
1189                 cancel_delayed_work(&hdev->le_scan_disable);
1190
1191                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1192
1193                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1194                  * interrupted scanning due to a connect request. Mark
1195                  * therefore discovery as stopped. If this was not
1196                  * because of a connect request advertising might have
1197                  * been disabled because of active scanning, so
1198                  * re-enable it again if necessary.
1199                  */
1200                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1201                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1202                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1203                          hdev->discovery.state == DISCOVERY_FINDING)
1204                         hci_req_reenable_advertising(hdev);
1205
1206                 break;
1207
1208         default:
1209                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1210                 break;
1211         }
1212
1213         hci_dev_unlock(hdev);
1214 }
1215
1216 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1217                                            struct sk_buff *skb)
1218 {
1219         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1220
1221         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1222
1223         if (rp->status)
1224                 return;
1225
1226         hdev->le_white_list_size = rp->size;
1227 }
1228
1229 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1230                                        struct sk_buff *skb)
1231 {
1232         __u8 status = *((__u8 *) skb->data);
1233
1234         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1235
1236         if (status)
1237                 return;
1238
1239         hci_bdaddr_list_clear(&hdev->le_white_list);
1240 }
1241
1242 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1243                                         struct sk_buff *skb)
1244 {
1245         struct hci_cp_le_add_to_white_list *sent;
1246         __u8 status = *((__u8 *) skb->data);
1247
1248         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1249
1250         if (status)
1251                 return;
1252
1253         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1254         if (!sent)
1255                 return;
1256
1257         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1258                            sent->bdaddr_type);
1259 }
1260
1261 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1262                                           struct sk_buff *skb)
1263 {
1264         struct hci_cp_le_del_from_white_list *sent;
1265         __u8 status = *((__u8 *) skb->data);
1266
1267         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1268
1269         if (status)
1270                 return;
1271
1272         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1273         if (!sent)
1274                 return;
1275
1276         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1277                             sent->bdaddr_type);
1278 }
1279
1280 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1281                                             struct sk_buff *skb)
1282 {
1283         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1284
1285         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1286
1287         if (rp->status)
1288                 return;
1289
1290         memcpy(hdev->le_states, rp->le_states, 8);
1291 }
1292
1293 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1294                                         struct sk_buff *skb)
1295 {
1296         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1297
1298         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1299
1300         if (rp->status)
1301                 return;
1302
1303         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1304         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1305 }
1306
1307 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1308                                          struct sk_buff *skb)
1309 {
1310         struct hci_cp_le_write_def_data_len *sent;
1311         __u8 status = *((__u8 *) skb->data);
1312
1313         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1314
1315         if (status)
1316                 return;
1317
1318         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1319         if (!sent)
1320                 return;
1321
1322         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1323         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1324 }
1325
1326 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1327                                         struct sk_buff *skb)
1328 {
1329         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1330
1331         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1332
1333         if (rp->status)
1334                 return;
1335
1336         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1337         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1338         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1339         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1340 }
1341
1342 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1343                                            struct sk_buff *skb)
1344 {
1345         struct hci_cp_write_le_host_supported *sent;
1346         __u8 status = *((__u8 *) skb->data);
1347
1348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1349
1350         if (status)
1351                 return;
1352
1353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1354         if (!sent)
1355                 return;
1356
1357         hci_dev_lock(hdev);
1358
1359         if (sent->le) {
1360                 hdev->features[1][0] |= LMP_HOST_LE;
1361                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1362         } else {
1363                 hdev->features[1][0] &= ~LMP_HOST_LE;
1364                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1365                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1366         }
1367
1368         if (sent->simul)
1369                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1370         else
1371                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1372
1373         hci_dev_unlock(hdev);
1374 }
1375
1376 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1377 {
1378         struct hci_cp_le_set_adv_param *cp;
1379         u8 status = *((u8 *) skb->data);
1380
1381         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1382
1383         if (status)
1384                 return;
1385
1386         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1387         if (!cp)
1388                 return;
1389
1390         hci_dev_lock(hdev);
1391         hdev->adv_addr_type = cp->own_address_type;
1392         hci_dev_unlock(hdev);
1393 }
1394
1395 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1396 {
1397         struct hci_rp_read_rssi *rp = (void *) skb->data;
1398         struct hci_conn *conn;
1399
1400         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1401
1402         if (rp->status)
1403                 return;
1404
1405         hci_dev_lock(hdev);
1406
1407         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1408         if (conn)
1409                 conn->rssi = rp->rssi;
1410
1411         hci_dev_unlock(hdev);
1412 }
1413
1414 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1415 {
1416         struct hci_cp_read_tx_power *sent;
1417         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1418         struct hci_conn *conn;
1419
1420         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1421
1422         if (rp->status)
1423                 return;
1424
1425         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1426         if (!sent)
1427                 return;
1428
1429         hci_dev_lock(hdev);
1430
1431         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1432         if (!conn)
1433                 goto unlock;
1434
1435         switch (sent->type) {
1436         case 0x00:
1437                 conn->tx_power = rp->tx_power;
1438                 break;
1439         case 0x01:
1440                 conn->max_tx_power = rp->tx_power;
1441                 break;
1442         }
1443
1444 unlock:
1445         hci_dev_unlock(hdev);
1446 }
1447
1448 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1449 {
1450         u8 status = *((u8 *) skb->data);
1451         u8 *mode;
1452
1453         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1454
1455         if (status)
1456                 return;
1457
1458         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1459         if (mode)
1460                 hdev->ssp_debug_mode = *mode;
1461 }
1462
1463 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1464 {
1465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1466
1467         if (status) {
1468                 hci_conn_check_pending(hdev);
1469                 return;
1470         }
1471
1472         set_bit(HCI_INQUIRY, &hdev->flags);
1473 }
1474
1475 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1476 {
1477         struct hci_cp_create_conn *cp;
1478         struct hci_conn *conn;
1479
1480         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1481
1482         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1483         if (!cp)
1484                 return;
1485
1486         hci_dev_lock(hdev);
1487
1488         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1489
1490         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1491
1492         if (status) {
1493                 if (conn && conn->state == BT_CONNECT) {
1494                         if (status != 0x0c || conn->attempt > 2) {
1495                                 conn->state = BT_CLOSED;
1496                                 hci_connect_cfm(conn, status);
1497                                 hci_conn_del(conn);
1498                         } else
1499                                 conn->state = BT_CONNECT2;
1500                 }
1501         } else {
1502                 if (!conn) {
1503                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1504                                             HCI_ROLE_MASTER);
1505                         if (!conn)
1506                                 BT_ERR("No memory for new connection");
1507                 }
1508         }
1509
1510         hci_dev_unlock(hdev);
1511 }
1512
1513 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1514 {
1515         struct hci_cp_add_sco *cp;
1516         struct hci_conn *acl, *sco;
1517         __u16 handle;
1518
1519         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1520
1521         if (!status)
1522                 return;
1523
1524         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1525         if (!cp)
1526                 return;
1527
1528         handle = __le16_to_cpu(cp->handle);
1529
1530         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1531
1532         hci_dev_lock(hdev);
1533
1534         acl = hci_conn_hash_lookup_handle(hdev, handle);
1535         if (acl) {
1536                 sco = acl->link;
1537                 if (sco) {
1538                         sco->state = BT_CLOSED;
1539
1540                         hci_connect_cfm(sco, status);
1541                         hci_conn_del(sco);
1542                 }
1543         }
1544
1545         hci_dev_unlock(hdev);
1546 }
1547
1548 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1549 {
1550         struct hci_cp_auth_requested *cp;
1551         struct hci_conn *conn;
1552
1553         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1554
1555         if (!status)
1556                 return;
1557
1558         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1559         if (!cp)
1560                 return;
1561
1562         hci_dev_lock(hdev);
1563
1564         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1565         if (conn) {
1566                 if (conn->state == BT_CONFIG) {
1567                         hci_connect_cfm(conn, status);
1568                         hci_conn_drop(conn);
1569                 }
1570         }
1571
1572         hci_dev_unlock(hdev);
1573 }
1574
1575 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1576 {
1577         struct hci_cp_set_conn_encrypt *cp;
1578         struct hci_conn *conn;
1579
1580         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1581
1582         if (!status)
1583                 return;
1584
1585         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1586         if (!cp)
1587                 return;
1588
1589         hci_dev_lock(hdev);
1590
1591         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1592         if (conn) {
1593                 if (conn->state == BT_CONFIG) {
1594                         hci_connect_cfm(conn, status);
1595                         hci_conn_drop(conn);
1596                 }
1597         }
1598
1599         hci_dev_unlock(hdev);
1600 }
1601
1602 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1603                                     struct hci_conn *conn)
1604 {
1605         if (conn->state != BT_CONFIG || !conn->out)
1606                 return 0;
1607
1608         if (conn->pending_sec_level == BT_SECURITY_SDP)
1609                 return 0;
1610
1611         /* Only request authentication for SSP connections or non-SSP
1612          * devices with sec_level MEDIUM or HIGH or if MITM protection
1613          * is requested.
1614          */
1615         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1616             conn->pending_sec_level != BT_SECURITY_FIPS &&
1617             conn->pending_sec_level != BT_SECURITY_HIGH &&
1618             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1619                 return 0;
1620
1621         return 1;
1622 }
1623
1624 static int hci_resolve_name(struct hci_dev *hdev,
1625                                    struct inquiry_entry *e)
1626 {
1627         struct hci_cp_remote_name_req cp;
1628
1629         memset(&cp, 0, sizeof(cp));
1630
1631         bacpy(&cp.bdaddr, &e->data.bdaddr);
1632         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1633         cp.pscan_mode = e->data.pscan_mode;
1634         cp.clock_offset = e->data.clock_offset;
1635
1636         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1637 }
1638
1639 static bool hci_resolve_next_name(struct hci_dev *hdev)
1640 {
1641         struct discovery_state *discov = &hdev->discovery;
1642         struct inquiry_entry *e;
1643
1644         if (list_empty(&discov->resolve))
1645                 return false;
1646
1647         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1648         if (!e)
1649                 return false;
1650
1651         if (hci_resolve_name(hdev, e) == 0) {
1652                 e->name_state = NAME_PENDING;
1653                 return true;
1654         }
1655
1656         return false;
1657 }
1658
1659 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1660                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1661 {
1662         struct discovery_state *discov = &hdev->discovery;
1663         struct inquiry_entry *e;
1664
1665         /* Update the mgmt connected state if necessary. Be careful with
1666          * conn objects that exist but are not (yet) connected however.
1667          * Only those in BT_CONFIG or BT_CONNECTED states can be
1668          * considered connected.
1669          */
1670         if (conn &&
1671             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1672             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1673                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1674
1675         if (discov->state == DISCOVERY_STOPPED)
1676                 return;
1677
1678         if (discov->state == DISCOVERY_STOPPING)
1679                 goto discov_complete;
1680
1681         if (discov->state != DISCOVERY_RESOLVING)
1682                 return;
1683
1684         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1685         /* If the device was not found in a list of found devices names of which
1686          * are pending. there is no need to continue resolving a next name as it
1687          * will be done upon receiving another Remote Name Request Complete
1688          * Event */
1689         if (!e)
1690                 return;
1691
1692         list_del(&e->list);
1693         if (name) {
1694                 e->name_state = NAME_KNOWN;
1695                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1696                                  e->data.rssi, name, name_len);
1697         } else {
1698                 e->name_state = NAME_NOT_KNOWN;
1699         }
1700
1701         if (hci_resolve_next_name(hdev))
1702                 return;
1703
1704 discov_complete:
1705         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1706 }
1707
1708 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1709 {
1710         struct hci_cp_remote_name_req *cp;
1711         struct hci_conn *conn;
1712
1713         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1714
1715         /* If successful wait for the name req complete event before
1716          * checking for the need to do authentication */
1717         if (!status)
1718                 return;
1719
1720         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1721         if (!cp)
1722                 return;
1723
1724         hci_dev_lock(hdev);
1725
1726         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1727
1728         if (hci_dev_test_flag(hdev, HCI_MGMT))
1729                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1730
1731         if (!conn)
1732                 goto unlock;
1733
1734         if (!hci_outgoing_auth_needed(hdev, conn))
1735                 goto unlock;
1736
1737         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1738                 struct hci_cp_auth_requested auth_cp;
1739
1740                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1741
1742                 auth_cp.handle = __cpu_to_le16(conn->handle);
1743                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1744                              sizeof(auth_cp), &auth_cp);
1745         }
1746
1747 unlock:
1748         hci_dev_unlock(hdev);
1749 }
1750
1751 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1752 {
1753         struct hci_cp_read_remote_features *cp;
1754         struct hci_conn *conn;
1755
1756         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1757
1758         if (!status)
1759                 return;
1760
1761         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1762         if (!cp)
1763                 return;
1764
1765         hci_dev_lock(hdev);
1766
1767         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1768         if (conn) {
1769                 if (conn->state == BT_CONFIG) {
1770                         hci_connect_cfm(conn, status);
1771                         hci_conn_drop(conn);
1772                 }
1773         }
1774
1775         hci_dev_unlock(hdev);
1776 }
1777
1778 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1779 {
1780         struct hci_cp_read_remote_ext_features *cp;
1781         struct hci_conn *conn;
1782
1783         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1784
1785         if (!status)
1786                 return;
1787
1788         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1789         if (!cp)
1790                 return;
1791
1792         hci_dev_lock(hdev);
1793
1794         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1795         if (conn) {
1796                 if (conn->state == BT_CONFIG) {
1797                         hci_connect_cfm(conn, status);
1798                         hci_conn_drop(conn);
1799                 }
1800         }
1801
1802         hci_dev_unlock(hdev);
1803 }
1804
1805 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1806 {
1807         struct hci_cp_setup_sync_conn *cp;
1808         struct hci_conn *acl, *sco;
1809         __u16 handle;
1810
1811         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1812
1813         if (!status)
1814                 return;
1815
1816         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1817         if (!cp)
1818                 return;
1819
1820         handle = __le16_to_cpu(cp->handle);
1821
1822         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1823
1824         hci_dev_lock(hdev);
1825
1826         acl = hci_conn_hash_lookup_handle(hdev, handle);
1827         if (acl) {
1828                 sco = acl->link;
1829                 if (sco) {
1830                         sco->state = BT_CLOSED;
1831
1832                         hci_connect_cfm(sco, status);
1833                         hci_conn_del(sco);
1834                 }
1835         }
1836
1837         hci_dev_unlock(hdev);
1838 }
1839
1840 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1841 {
1842         struct hci_cp_sniff_mode *cp;
1843         struct hci_conn *conn;
1844
1845         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1846
1847         if (!status)
1848                 return;
1849
1850         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1851         if (!cp)
1852                 return;
1853
1854         hci_dev_lock(hdev);
1855
1856         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1857         if (conn) {
1858                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1859
1860                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1861                         hci_sco_setup(conn, status);
1862         }
1863
1864         hci_dev_unlock(hdev);
1865 }
1866
1867 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1868 {
1869         struct hci_cp_exit_sniff_mode *cp;
1870         struct hci_conn *conn;
1871
1872         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1873
1874         if (!status)
1875                 return;
1876
1877         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1878         if (!cp)
1879                 return;
1880
1881         hci_dev_lock(hdev);
1882
1883         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1884         if (conn) {
1885                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1886
1887                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1888                         hci_sco_setup(conn, status);
1889         }
1890
1891         hci_dev_unlock(hdev);
1892 }
1893
1894 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1895 {
1896         struct hci_cp_disconnect *cp;
1897         struct hci_conn *conn;
1898
1899         if (!status)
1900                 return;
1901
1902         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1903         if (!cp)
1904                 return;
1905
1906         hci_dev_lock(hdev);
1907
1908         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1909         if (conn)
1910                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1911                                        conn->dst_type, status);
1912
1913         hci_dev_unlock(hdev);
1914 }
1915
1916 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1917 {
1918         struct hci_cp_le_create_conn *cp;
1919         struct hci_conn *conn;
1920
1921         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1922
1923         /* All connection failure handling is taken care of by the
1924          * hci_le_conn_failed function which is triggered by the HCI
1925          * request completion callbacks used for connecting.
1926          */
1927         if (status)
1928                 return;
1929
1930         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1931         if (!cp)
1932                 return;
1933
1934         hci_dev_lock(hdev);
1935
1936         conn = hci_conn_hash_lookup_le(hdev, &cp->peer_addr,
1937                                        cp->peer_addr_type);
1938         if (!conn)
1939                 goto unlock;
1940
1941         /* Store the initiator and responder address information which
1942          * is needed for SMP. These values will not change during the
1943          * lifetime of the connection.
1944          */
1945         conn->init_addr_type = cp->own_address_type;
1946         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1947                 bacpy(&conn->init_addr, &hdev->random_addr);
1948         else
1949                 bacpy(&conn->init_addr, &hdev->bdaddr);
1950
1951         conn->resp_addr_type = cp->peer_addr_type;
1952         bacpy(&conn->resp_addr, &cp->peer_addr);
1953
1954         /* We don't want the connection attempt to stick around
1955          * indefinitely since LE doesn't have a page timeout concept
1956          * like BR/EDR. Set a timer for any connection that doesn't use
1957          * the white list for connecting.
1958          */
1959         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1960                 queue_delayed_work(conn->hdev->workqueue,
1961                                    &conn->le_conn_timeout,
1962                                    conn->conn_timeout);
1963
1964 unlock:
1965         hci_dev_unlock(hdev);
1966 }
1967
1968 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
1969 {
1970         struct hci_cp_le_read_remote_features *cp;
1971         struct hci_conn *conn;
1972
1973         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1974
1975         if (!status)
1976                 return;
1977
1978         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
1979         if (!cp)
1980                 return;
1981
1982         hci_dev_lock(hdev);
1983
1984         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1985         if (conn) {
1986                 if (conn->state == BT_CONFIG) {
1987                         hci_connect_cfm(conn, status);
1988                         hci_conn_drop(conn);
1989                 }
1990         }
1991
1992         hci_dev_unlock(hdev);
1993 }
1994
1995 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1996 {
1997         struct hci_cp_le_start_enc *cp;
1998         struct hci_conn *conn;
1999
2000         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2001
2002         if (!status)
2003                 return;
2004
2005         hci_dev_lock(hdev);
2006
2007         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2008         if (!cp)
2009                 goto unlock;
2010
2011         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2012         if (!conn)
2013                 goto unlock;
2014
2015         if (conn->state != BT_CONNECTED)
2016                 goto unlock;
2017
2018         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2019         hci_conn_drop(conn);
2020
2021 unlock:
2022         hci_dev_unlock(hdev);
2023 }
2024
2025 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2026 {
2027         struct hci_cp_switch_role *cp;
2028         struct hci_conn *conn;
2029
2030         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2031
2032         if (!status)
2033                 return;
2034
2035         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2036         if (!cp)
2037                 return;
2038
2039         hci_dev_lock(hdev);
2040
2041         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2042         if (conn)
2043                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2044
2045         hci_dev_unlock(hdev);
2046 }
2047
2048 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2049 {
2050         __u8 status = *((__u8 *) skb->data);
2051         struct discovery_state *discov = &hdev->discovery;
2052         struct inquiry_entry *e;
2053
2054         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2055
2056         hci_conn_check_pending(hdev);
2057
2058         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2059                 return;
2060
2061         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2062         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2063
2064         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2065                 return;
2066
2067         hci_dev_lock(hdev);
2068
2069         if (discov->state != DISCOVERY_FINDING)
2070                 goto unlock;
2071
2072         if (list_empty(&discov->resolve)) {
2073                 /* When BR/EDR inquiry is active and no LE scanning is in
2074                  * progress, then change discovery state to indicate completion.
2075                  *
2076                  * When running LE scanning and BR/EDR inquiry simultaneously
2077                  * and the LE scan already finished, then change the discovery
2078                  * state to indicate completion.
2079                  */
2080                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2081                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2082                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2083                 goto unlock;
2084         }
2085
2086         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2087         if (e && hci_resolve_name(hdev, e) == 0) {
2088                 e->name_state = NAME_PENDING;
2089                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2090         } else {
2091                 /* When BR/EDR inquiry is active and no LE scanning is in
2092                  * progress, then change discovery state to indicate completion.
2093                  *
2094                  * When running LE scanning and BR/EDR inquiry simultaneously
2095                  * and the LE scan already finished, then change the discovery
2096                  * state to indicate completion.
2097                  */
2098                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2099                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2100                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2101         }
2102
2103 unlock:
2104         hci_dev_unlock(hdev);
2105 }
2106
2107 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2108 {
2109         struct inquiry_data data;
2110         struct inquiry_info *info = (void *) (skb->data + 1);
2111         int num_rsp = *((__u8 *) skb->data);
2112
2113         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2114
2115         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2116                 return;
2117
2118         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2119                 return;
2120
2121         hci_dev_lock(hdev);
2122
2123         for (; num_rsp; num_rsp--, info++) {
2124                 u32 flags;
2125
2126                 bacpy(&data.bdaddr, &info->bdaddr);
2127                 data.pscan_rep_mode     = info->pscan_rep_mode;
2128                 data.pscan_period_mode  = info->pscan_period_mode;
2129                 data.pscan_mode         = info->pscan_mode;
2130                 memcpy(data.dev_class, info->dev_class, 3);
2131                 data.clock_offset       = info->clock_offset;
2132                 data.rssi               = HCI_RSSI_INVALID;
2133                 data.ssp_mode           = 0x00;
2134
2135                 flags = hci_inquiry_cache_update(hdev, &data, false);
2136
2137                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2138                                   info->dev_class, HCI_RSSI_INVALID,
2139                                   flags, NULL, 0, NULL, 0);
2140         }
2141
2142         hci_dev_unlock(hdev);
2143 }
2144
2145 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2146 {
2147         struct hci_ev_conn_complete *ev = (void *) skb->data;
2148         struct hci_conn *conn;
2149
2150         BT_DBG("%s", hdev->name);
2151
2152         hci_dev_lock(hdev);
2153
2154         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2155         if (!conn) {
2156                 if (ev->link_type != SCO_LINK)
2157                         goto unlock;
2158
2159                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2160                 if (!conn)
2161                         goto unlock;
2162
2163                 conn->type = SCO_LINK;
2164         }
2165
2166         if (!ev->status) {
2167                 conn->handle = __le16_to_cpu(ev->handle);
2168
2169                 if (conn->type == ACL_LINK) {
2170                         conn->state = BT_CONFIG;
2171                         hci_conn_hold(conn);
2172
2173                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2174                             !hci_find_link_key(hdev, &ev->bdaddr))
2175                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2176                         else
2177                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2178                 } else
2179                         conn->state = BT_CONNECTED;
2180
2181                 hci_debugfs_create_conn(conn);
2182                 hci_conn_add_sysfs(conn);
2183
2184                 if (test_bit(HCI_AUTH, &hdev->flags))
2185                         set_bit(HCI_CONN_AUTH, &conn->flags);
2186
2187                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2188                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2189
2190                 /* Get remote features */
2191                 if (conn->type == ACL_LINK) {
2192                         struct hci_cp_read_remote_features cp;
2193                         cp.handle = ev->handle;
2194                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2195                                      sizeof(cp), &cp);
2196
2197                         hci_req_update_scan(hdev);
2198                 }
2199
2200                 /* Set packet type for incoming connection */
2201                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2202                         struct hci_cp_change_conn_ptype cp;
2203                         cp.handle = ev->handle;
2204                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2205                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2206                                      &cp);
2207                 }
2208         } else {
2209                 conn->state = BT_CLOSED;
2210                 if (conn->type == ACL_LINK)
2211                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2212                                             conn->dst_type, ev->status);
2213         }
2214
2215         if (conn->type == ACL_LINK)
2216                 hci_sco_setup(conn, ev->status);
2217
2218         if (ev->status) {
2219                 hci_connect_cfm(conn, ev->status);
2220                 hci_conn_del(conn);
2221         } else if (ev->link_type != ACL_LINK)
2222                 hci_connect_cfm(conn, ev->status);
2223
2224 unlock:
2225         hci_dev_unlock(hdev);
2226
2227         hci_conn_check_pending(hdev);
2228 }
2229
2230 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2231 {
2232         struct hci_cp_reject_conn_req cp;
2233
2234         bacpy(&cp.bdaddr, bdaddr);
2235         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2236         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2237 }
2238
2239 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2240 {
2241         struct hci_ev_conn_request *ev = (void *) skb->data;
2242         int mask = hdev->link_mode;
2243         struct inquiry_entry *ie;
2244         struct hci_conn *conn;
2245         __u8 flags = 0;
2246
2247         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2248                ev->link_type);
2249
2250         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2251                                       &flags);
2252
2253         if (!(mask & HCI_LM_ACCEPT)) {
2254                 hci_reject_conn(hdev, &ev->bdaddr);
2255                 return;
2256         }
2257
2258         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2259                                    BDADDR_BREDR)) {
2260                 hci_reject_conn(hdev, &ev->bdaddr);
2261                 return;
2262         }
2263
2264         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2265          * connection. These features are only touched through mgmt so
2266          * only do the checks if HCI_MGMT is set.
2267          */
2268         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2269             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2270             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2271                                     BDADDR_BREDR)) {
2272                     hci_reject_conn(hdev, &ev->bdaddr);
2273                     return;
2274         }
2275
2276         /* Connection accepted */
2277
2278         hci_dev_lock(hdev);
2279
2280         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2281         if (ie)
2282                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2283
2284         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2285                         &ev->bdaddr);
2286         if (!conn) {
2287                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2288                                     HCI_ROLE_SLAVE);
2289                 if (!conn) {
2290                         BT_ERR("No memory for new connection");
2291                         hci_dev_unlock(hdev);
2292                         return;
2293                 }
2294         }
2295
2296         memcpy(conn->dev_class, ev->dev_class, 3);
2297
2298         hci_dev_unlock(hdev);
2299
2300         if (ev->link_type == ACL_LINK ||
2301             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2302                 struct hci_cp_accept_conn_req cp;
2303                 conn->state = BT_CONNECT;
2304
2305                 bacpy(&cp.bdaddr, &ev->bdaddr);
2306
2307                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2308                         cp.role = 0x00; /* Become master */
2309                 else
2310                         cp.role = 0x01; /* Remain slave */
2311
2312                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2313         } else if (!(flags & HCI_PROTO_DEFER)) {
2314                 struct hci_cp_accept_sync_conn_req cp;
2315                 conn->state = BT_CONNECT;
2316
2317                 bacpy(&cp.bdaddr, &ev->bdaddr);
2318                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2319
2320                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2321                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2322                 cp.max_latency    = cpu_to_le16(0xffff);
2323                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2324                 cp.retrans_effort = 0xff;
2325
2326                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2327                              &cp);
2328         } else {
2329                 conn->state = BT_CONNECT2;
2330                 hci_connect_cfm(conn, 0);
2331         }
2332 }
2333
2334 static u8 hci_to_mgmt_reason(u8 err)
2335 {
2336         switch (err) {
2337         case HCI_ERROR_CONNECTION_TIMEOUT:
2338                 return MGMT_DEV_DISCONN_TIMEOUT;
2339         case HCI_ERROR_REMOTE_USER_TERM:
2340         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2341         case HCI_ERROR_REMOTE_POWER_OFF:
2342                 return MGMT_DEV_DISCONN_REMOTE;
2343         case HCI_ERROR_LOCAL_HOST_TERM:
2344                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2345         default:
2346                 return MGMT_DEV_DISCONN_UNKNOWN;
2347         }
2348 }
2349
2350 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2351 {
2352         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2353         u8 reason;
2354         struct hci_conn_params *params;
2355         struct hci_conn *conn;
2356         bool mgmt_connected;
2357         u8 type;
2358
2359         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2360
2361         hci_dev_lock(hdev);
2362
2363         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2364         if (!conn)
2365                 goto unlock;
2366
2367         if (ev->status) {
2368                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2369                                        conn->dst_type, ev->status);
2370                 goto unlock;
2371         }
2372
2373         conn->state = BT_CLOSED;
2374
2375         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2376
2377         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2378                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2379         else
2380                 reason = hci_to_mgmt_reason(ev->reason);
2381
2382         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2383                                 reason, mgmt_connected);
2384
2385         if (conn->type == ACL_LINK) {
2386                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2387                         hci_remove_link_key(hdev, &conn->dst);
2388
2389                 hci_req_update_scan(hdev);
2390         }
2391
2392         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2393         if (params) {
2394                 switch (params->auto_connect) {
2395                 case HCI_AUTO_CONN_LINK_LOSS:
2396                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2397                                 break;
2398                         /* Fall through */
2399
2400                 case HCI_AUTO_CONN_DIRECT:
2401                 case HCI_AUTO_CONN_ALWAYS:
2402                         list_del_init(&params->action);
2403                         list_add(&params->action, &hdev->pend_le_conns);
2404                         hci_update_background_scan(hdev);
2405                         break;
2406
2407                 default:
2408                         break;
2409                 }
2410         }
2411
2412         type = conn->type;
2413
2414         hci_disconn_cfm(conn, ev->reason);
2415         hci_conn_del(conn);
2416
2417         /* Re-enable advertising if necessary, since it might
2418          * have been disabled by the connection. From the
2419          * HCI_LE_Set_Advertise_Enable command description in
2420          * the core specification (v4.0):
2421          * "The Controller shall continue advertising until the Host
2422          * issues an LE_Set_Advertise_Enable command with
2423          * Advertising_Enable set to 0x00 (Advertising is disabled)
2424          * or until a connection is created or until the Advertising
2425          * is timed out due to Directed Advertising."
2426          */
2427         if (type == LE_LINK)
2428                 hci_req_reenable_advertising(hdev);
2429
2430 unlock:
2431         hci_dev_unlock(hdev);
2432 }
2433
2434 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2435 {
2436         struct hci_ev_auth_complete *ev = (void *) skb->data;
2437         struct hci_conn *conn;
2438
2439         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2440
2441         hci_dev_lock(hdev);
2442
2443         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2444         if (!conn)
2445                 goto unlock;
2446
2447         if (!ev->status) {
2448                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2449
2450                 if (!hci_conn_ssp_enabled(conn) &&
2451                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2452                         BT_INFO("re-auth of legacy device is not possible.");
2453                 } else {
2454                         set_bit(HCI_CONN_AUTH, &conn->flags);
2455                         conn->sec_level = conn->pending_sec_level;
2456                 }
2457         } else {
2458                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2459                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2460
2461                 mgmt_auth_failed(conn, ev->status);
2462         }
2463
2464         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2465         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2466
2467         if (conn->state == BT_CONFIG) {
2468                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2469                         struct hci_cp_set_conn_encrypt cp;
2470                         cp.handle  = ev->handle;
2471                         cp.encrypt = 0x01;
2472                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2473                                      &cp);
2474                 } else {
2475                         conn->state = BT_CONNECTED;
2476                         hci_connect_cfm(conn, ev->status);
2477                         hci_conn_drop(conn);
2478                 }
2479         } else {
2480                 hci_auth_cfm(conn, ev->status);
2481
2482                 hci_conn_hold(conn);
2483                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2484                 hci_conn_drop(conn);
2485         }
2486
2487         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2488                 if (!ev->status) {
2489                         struct hci_cp_set_conn_encrypt cp;
2490                         cp.handle  = ev->handle;
2491                         cp.encrypt = 0x01;
2492                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2493                                      &cp);
2494                 } else {
2495                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2496                         hci_encrypt_cfm(conn, ev->status);
2497                 }
2498         }
2499
2500 unlock:
2501         hci_dev_unlock(hdev);
2502 }
2503
2504 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2505 {
2506         struct hci_ev_remote_name *ev = (void *) skb->data;
2507         struct hci_conn *conn;
2508
2509         BT_DBG("%s", hdev->name);
2510
2511         hci_conn_check_pending(hdev);
2512
2513         hci_dev_lock(hdev);
2514
2515         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2516
2517         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2518                 goto check_auth;
2519
2520         if (ev->status == 0)
2521                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2522                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2523         else
2524                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2525
2526 check_auth:
2527         if (!conn)
2528                 goto unlock;
2529
2530         if (!hci_outgoing_auth_needed(hdev, conn))
2531                 goto unlock;
2532
2533         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2534                 struct hci_cp_auth_requested cp;
2535
2536                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2537
2538                 cp.handle = __cpu_to_le16(conn->handle);
2539                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2540         }
2541
2542 unlock:
2543         hci_dev_unlock(hdev);
2544 }
2545
2546 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2547                                        u16 opcode, struct sk_buff *skb)
2548 {
2549         const struct hci_rp_read_enc_key_size *rp;
2550         struct hci_conn *conn;
2551         u16 handle;
2552
2553         BT_DBG("%s status 0x%02x", hdev->name, status);
2554
2555         if (!skb || skb->len < sizeof(*rp)) {
2556                 BT_ERR("%s invalid HCI Read Encryption Key Size response",
2557                        hdev->name);
2558                 return;
2559         }
2560
2561         rp = (void *)skb->data;
2562         handle = le16_to_cpu(rp->handle);
2563
2564         hci_dev_lock(hdev);
2565
2566         conn = hci_conn_hash_lookup_handle(hdev, handle);
2567         if (!conn)
2568                 goto unlock;
2569
2570         /* If we fail to read the encryption key size, assume maximum
2571          * (which is the same we do also when this HCI command isn't
2572          * supported.
2573          */
2574         if (rp->status) {
2575                 BT_ERR("%s failed to read key size for handle %u", hdev->name,
2576                        handle);
2577                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2578         } else {
2579                 conn->enc_key_size = rp->key_size;
2580         }
2581
2582         hci_encrypt_cfm(conn, 0);
2583
2584 unlock:
2585         hci_dev_unlock(hdev);
2586 }
2587
2588 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2589 {
2590         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2591         struct hci_conn *conn;
2592
2593         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2594
2595         hci_dev_lock(hdev);
2596
2597         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2598         if (!conn)
2599                 goto unlock;
2600
2601         if (!ev->status) {
2602                 if (ev->encrypt) {
2603                         /* Encryption implies authentication */
2604                         set_bit(HCI_CONN_AUTH, &conn->flags);
2605                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2606                         conn->sec_level = conn->pending_sec_level;
2607
2608                         /* P-256 authentication key implies FIPS */
2609                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2610                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2611
2612                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2613                             conn->type == LE_LINK)
2614                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2615                 } else {
2616                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2617                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2618                 }
2619         }
2620
2621         /* We should disregard the current RPA and generate a new one
2622          * whenever the encryption procedure fails.
2623          */
2624         if (ev->status && conn->type == LE_LINK)
2625                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2626
2627         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2628
2629         /* Check link security requirements are met */
2630         if (!hci_conn_check_link_mode(conn))
2631                 ev->status = HCI_ERROR_AUTH_FAILURE;
2632
2633         if (ev->status && conn->state == BT_CONNECTED) {
2634                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2635                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2636
2637                 /* Notify upper layers so they can cleanup before
2638                  * disconnecting.
2639                  */
2640                 hci_encrypt_cfm(conn, ev->status);
2641                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2642                 hci_conn_drop(conn);
2643                 goto unlock;
2644         }
2645
2646         /* Try reading the encryption key size for encrypted ACL links */
2647         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2648                 struct hci_cp_read_enc_key_size cp;
2649                 struct hci_request req;
2650
2651                 /* Only send HCI_Read_Encryption_Key_Size if the
2652                  * controller really supports it. If it doesn't, assume
2653                  * the default size (16).
2654                  */
2655                 if (!(hdev->commands[20] & 0x10)) {
2656                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2657                         goto notify;
2658                 }
2659
2660                 hci_req_init(&req, hdev);
2661
2662                 cp.handle = cpu_to_le16(conn->handle);
2663                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2664
2665                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2666                         BT_ERR("Sending HCI Read Encryption Key Size failed");
2667                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2668                         goto notify;
2669                 }
2670
2671                 goto unlock;
2672         }
2673
2674 notify:
2675         hci_encrypt_cfm(conn, ev->status);
2676
2677 unlock:
2678         hci_dev_unlock(hdev);
2679 }
2680
2681 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2682                                              struct sk_buff *skb)
2683 {
2684         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2685         struct hci_conn *conn;
2686
2687         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2688
2689         hci_dev_lock(hdev);
2690
2691         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2692         if (conn) {
2693                 if (!ev->status)
2694                         set_bit(HCI_CONN_SECURE, &conn->flags);
2695
2696                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2697
2698                 hci_key_change_cfm(conn, ev->status);
2699         }
2700
2701         hci_dev_unlock(hdev);
2702 }
2703
2704 static void hci_remote_features_evt(struct hci_dev *hdev,
2705                                     struct sk_buff *skb)
2706 {
2707         struct hci_ev_remote_features *ev = (void *) skb->data;
2708         struct hci_conn *conn;
2709
2710         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2711
2712         hci_dev_lock(hdev);
2713
2714         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2715         if (!conn)
2716                 goto unlock;
2717
2718         if (!ev->status)
2719                 memcpy(conn->features[0], ev->features, 8);
2720
2721         if (conn->state != BT_CONFIG)
2722                 goto unlock;
2723
2724         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2725             lmp_ext_feat_capable(conn)) {
2726                 struct hci_cp_read_remote_ext_features cp;
2727                 cp.handle = ev->handle;
2728                 cp.page = 0x01;
2729                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2730                              sizeof(cp), &cp);
2731                 goto unlock;
2732         }
2733
2734         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2735                 struct hci_cp_remote_name_req cp;
2736                 memset(&cp, 0, sizeof(cp));
2737                 bacpy(&cp.bdaddr, &conn->dst);
2738                 cp.pscan_rep_mode = 0x02;
2739                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2740         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2741                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2742
2743         if (!hci_outgoing_auth_needed(hdev, conn)) {
2744                 conn->state = BT_CONNECTED;
2745                 hci_connect_cfm(conn, ev->status);
2746                 hci_conn_drop(conn);
2747         }
2748
2749 unlock:
2750         hci_dev_unlock(hdev);
2751 }
2752
2753 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2754                                  u16 *opcode, u8 *status,
2755                                  hci_req_complete_t *req_complete,
2756                                  hci_req_complete_skb_t *req_complete_skb)
2757 {
2758         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2759
2760         *opcode = __le16_to_cpu(ev->opcode);
2761         *status = skb->data[sizeof(*ev)];
2762
2763         skb_pull(skb, sizeof(*ev));
2764
2765         switch (*opcode) {
2766         case HCI_OP_INQUIRY_CANCEL:
2767                 hci_cc_inquiry_cancel(hdev, skb, status);
2768                 break;
2769
2770         case HCI_OP_PERIODIC_INQ:
2771                 hci_cc_periodic_inq(hdev, skb);
2772                 break;
2773
2774         case HCI_OP_EXIT_PERIODIC_INQ:
2775                 hci_cc_exit_periodic_inq(hdev, skb);
2776                 break;
2777
2778         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2779                 hci_cc_remote_name_req_cancel(hdev, skb);
2780                 break;
2781
2782         case HCI_OP_ROLE_DISCOVERY:
2783                 hci_cc_role_discovery(hdev, skb);
2784                 break;
2785
2786         case HCI_OP_READ_LINK_POLICY:
2787                 hci_cc_read_link_policy(hdev, skb);
2788                 break;
2789
2790         case HCI_OP_WRITE_LINK_POLICY:
2791                 hci_cc_write_link_policy(hdev, skb);
2792                 break;
2793
2794         case HCI_OP_READ_DEF_LINK_POLICY:
2795                 hci_cc_read_def_link_policy(hdev, skb);
2796                 break;
2797
2798         case HCI_OP_WRITE_DEF_LINK_POLICY:
2799                 hci_cc_write_def_link_policy(hdev, skb);
2800                 break;
2801
2802         case HCI_OP_RESET:
2803                 hci_cc_reset(hdev, skb);
2804                 break;
2805
2806         case HCI_OP_READ_STORED_LINK_KEY:
2807                 hci_cc_read_stored_link_key(hdev, skb);
2808                 break;
2809
2810         case HCI_OP_DELETE_STORED_LINK_KEY:
2811                 hci_cc_delete_stored_link_key(hdev, skb);
2812                 break;
2813
2814         case HCI_OP_WRITE_LOCAL_NAME:
2815                 hci_cc_write_local_name(hdev, skb);
2816                 break;
2817
2818         case HCI_OP_READ_LOCAL_NAME:
2819                 hci_cc_read_local_name(hdev, skb);
2820                 break;
2821
2822         case HCI_OP_WRITE_AUTH_ENABLE:
2823                 hci_cc_write_auth_enable(hdev, skb);
2824                 break;
2825
2826         case HCI_OP_WRITE_ENCRYPT_MODE:
2827                 hci_cc_write_encrypt_mode(hdev, skb);
2828                 break;
2829
2830         case HCI_OP_WRITE_SCAN_ENABLE:
2831                 hci_cc_write_scan_enable(hdev, skb);
2832                 break;
2833
2834         case HCI_OP_READ_CLASS_OF_DEV:
2835                 hci_cc_read_class_of_dev(hdev, skb);
2836                 break;
2837
2838         case HCI_OP_WRITE_CLASS_OF_DEV:
2839                 hci_cc_write_class_of_dev(hdev, skb);
2840                 break;
2841
2842         case HCI_OP_READ_VOICE_SETTING:
2843                 hci_cc_read_voice_setting(hdev, skb);
2844                 break;
2845
2846         case HCI_OP_WRITE_VOICE_SETTING:
2847                 hci_cc_write_voice_setting(hdev, skb);
2848                 break;
2849
2850         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2851                 hci_cc_read_num_supported_iac(hdev, skb);
2852                 break;
2853
2854         case HCI_OP_WRITE_SSP_MODE:
2855                 hci_cc_write_ssp_mode(hdev, skb);
2856                 break;
2857
2858         case HCI_OP_WRITE_SC_SUPPORT:
2859                 hci_cc_write_sc_support(hdev, skb);
2860                 break;
2861
2862         case HCI_OP_READ_LOCAL_VERSION:
2863                 hci_cc_read_local_version(hdev, skb);
2864                 break;
2865
2866         case HCI_OP_READ_LOCAL_COMMANDS:
2867                 hci_cc_read_local_commands(hdev, skb);
2868                 break;
2869
2870         case HCI_OP_READ_LOCAL_FEATURES:
2871                 hci_cc_read_local_features(hdev, skb);
2872                 break;
2873
2874         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2875                 hci_cc_read_local_ext_features(hdev, skb);
2876                 break;
2877
2878         case HCI_OP_READ_BUFFER_SIZE:
2879                 hci_cc_read_buffer_size(hdev, skb);
2880                 break;
2881
2882         case HCI_OP_READ_BD_ADDR:
2883                 hci_cc_read_bd_addr(hdev, skb);
2884                 break;
2885
2886         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2887                 hci_cc_read_page_scan_activity(hdev, skb);
2888                 break;
2889
2890         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2891                 hci_cc_write_page_scan_activity(hdev, skb);
2892                 break;
2893
2894         case HCI_OP_READ_PAGE_SCAN_TYPE:
2895                 hci_cc_read_page_scan_type(hdev, skb);
2896                 break;
2897
2898         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2899                 hci_cc_write_page_scan_type(hdev, skb);
2900                 break;
2901
2902         case HCI_OP_READ_DATA_BLOCK_SIZE:
2903                 hci_cc_read_data_block_size(hdev, skb);
2904                 break;
2905
2906         case HCI_OP_READ_FLOW_CONTROL_MODE:
2907                 hci_cc_read_flow_control_mode(hdev, skb);
2908                 break;
2909
2910         case HCI_OP_READ_LOCAL_AMP_INFO:
2911                 hci_cc_read_local_amp_info(hdev, skb);
2912                 break;
2913
2914         case HCI_OP_READ_CLOCK:
2915                 hci_cc_read_clock(hdev, skb);
2916                 break;
2917
2918         case HCI_OP_READ_INQ_RSP_TX_POWER:
2919                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2920                 break;
2921
2922         case HCI_OP_PIN_CODE_REPLY:
2923                 hci_cc_pin_code_reply(hdev, skb);
2924                 break;
2925
2926         case HCI_OP_PIN_CODE_NEG_REPLY:
2927                 hci_cc_pin_code_neg_reply(hdev, skb);
2928                 break;
2929
2930         case HCI_OP_READ_LOCAL_OOB_DATA:
2931                 hci_cc_read_local_oob_data(hdev, skb);
2932                 break;
2933
2934         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2935                 hci_cc_read_local_oob_ext_data(hdev, skb);
2936                 break;
2937
2938         case HCI_OP_LE_READ_BUFFER_SIZE:
2939                 hci_cc_le_read_buffer_size(hdev, skb);
2940                 break;
2941
2942         case HCI_OP_LE_READ_LOCAL_FEATURES:
2943                 hci_cc_le_read_local_features(hdev, skb);
2944                 break;
2945
2946         case HCI_OP_LE_READ_ADV_TX_POWER:
2947                 hci_cc_le_read_adv_tx_power(hdev, skb);
2948                 break;
2949
2950         case HCI_OP_USER_CONFIRM_REPLY:
2951                 hci_cc_user_confirm_reply(hdev, skb);
2952                 break;
2953
2954         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2955                 hci_cc_user_confirm_neg_reply(hdev, skb);
2956                 break;
2957
2958         case HCI_OP_USER_PASSKEY_REPLY:
2959                 hci_cc_user_passkey_reply(hdev, skb);
2960                 break;
2961
2962         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2963                 hci_cc_user_passkey_neg_reply(hdev, skb);
2964                 break;
2965
2966         case HCI_OP_LE_SET_RANDOM_ADDR:
2967                 hci_cc_le_set_random_addr(hdev, skb);
2968                 break;
2969
2970         case HCI_OP_LE_SET_ADV_ENABLE:
2971                 hci_cc_le_set_adv_enable(hdev, skb);
2972                 break;
2973
2974         case HCI_OP_LE_SET_SCAN_PARAM:
2975                 hci_cc_le_set_scan_param(hdev, skb);
2976                 break;
2977
2978         case HCI_OP_LE_SET_SCAN_ENABLE:
2979                 hci_cc_le_set_scan_enable(hdev, skb);
2980                 break;
2981
2982         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2983                 hci_cc_le_read_white_list_size(hdev, skb);
2984                 break;
2985
2986         case HCI_OP_LE_CLEAR_WHITE_LIST:
2987                 hci_cc_le_clear_white_list(hdev, skb);
2988                 break;
2989
2990         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2991                 hci_cc_le_add_to_white_list(hdev, skb);
2992                 break;
2993
2994         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2995                 hci_cc_le_del_from_white_list(hdev, skb);
2996                 break;
2997
2998         case HCI_OP_LE_READ_SUPPORTED_STATES:
2999                 hci_cc_le_read_supported_states(hdev, skb);
3000                 break;
3001
3002         case HCI_OP_LE_READ_DEF_DATA_LEN:
3003                 hci_cc_le_read_def_data_len(hdev, skb);
3004                 break;
3005
3006         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3007                 hci_cc_le_write_def_data_len(hdev, skb);
3008                 break;
3009
3010         case HCI_OP_LE_READ_MAX_DATA_LEN:
3011                 hci_cc_le_read_max_data_len(hdev, skb);
3012                 break;
3013
3014         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3015                 hci_cc_write_le_host_supported(hdev, skb);
3016                 break;
3017
3018         case HCI_OP_LE_SET_ADV_PARAM:
3019                 hci_cc_set_adv_param(hdev, skb);
3020                 break;
3021
3022         case HCI_OP_READ_RSSI:
3023                 hci_cc_read_rssi(hdev, skb);
3024                 break;
3025
3026         case HCI_OP_READ_TX_POWER:
3027                 hci_cc_read_tx_power(hdev, skb);
3028                 break;
3029
3030         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3031                 hci_cc_write_ssp_debug_mode(hdev, skb);
3032                 break;
3033
3034         default:
3035                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3036                 break;
3037         }
3038
3039         if (*opcode != HCI_OP_NOP)
3040                 cancel_delayed_work(&hdev->cmd_timer);
3041
3042         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3043                 atomic_set(&hdev->cmd_cnt, 1);
3044
3045         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3046                              req_complete_skb);
3047
3048         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3049                 queue_work(hdev->workqueue, &hdev->cmd_work);
3050 }
3051
3052 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3053                                u16 *opcode, u8 *status,
3054                                hci_req_complete_t *req_complete,
3055                                hci_req_complete_skb_t *req_complete_skb)
3056 {
3057         struct hci_ev_cmd_status *ev = (void *) skb->data;
3058
3059         skb_pull(skb, sizeof(*ev));
3060
3061         *opcode = __le16_to_cpu(ev->opcode);
3062         *status = ev->status;
3063
3064         switch (*opcode) {
3065         case HCI_OP_INQUIRY:
3066                 hci_cs_inquiry(hdev, ev->status);
3067                 break;
3068
3069         case HCI_OP_CREATE_CONN:
3070                 hci_cs_create_conn(hdev, ev->status);
3071                 break;
3072
3073         case HCI_OP_DISCONNECT:
3074                 hci_cs_disconnect(hdev, ev->status);
3075                 break;
3076
3077         case HCI_OP_ADD_SCO:
3078                 hci_cs_add_sco(hdev, ev->status);
3079                 break;
3080
3081         case HCI_OP_AUTH_REQUESTED:
3082                 hci_cs_auth_requested(hdev, ev->status);
3083                 break;
3084
3085         case HCI_OP_SET_CONN_ENCRYPT:
3086                 hci_cs_set_conn_encrypt(hdev, ev->status);
3087                 break;
3088
3089         case HCI_OP_REMOTE_NAME_REQ:
3090                 hci_cs_remote_name_req(hdev, ev->status);
3091                 break;
3092
3093         case HCI_OP_READ_REMOTE_FEATURES:
3094                 hci_cs_read_remote_features(hdev, ev->status);
3095                 break;
3096
3097         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3098                 hci_cs_read_remote_ext_features(hdev, ev->status);
3099                 break;
3100
3101         case HCI_OP_SETUP_SYNC_CONN:
3102                 hci_cs_setup_sync_conn(hdev, ev->status);
3103                 break;
3104
3105         case HCI_OP_SNIFF_MODE:
3106                 hci_cs_sniff_mode(hdev, ev->status);
3107                 break;
3108
3109         case HCI_OP_EXIT_SNIFF_MODE:
3110                 hci_cs_exit_sniff_mode(hdev, ev->status);
3111                 break;
3112
3113         case HCI_OP_SWITCH_ROLE:
3114                 hci_cs_switch_role(hdev, ev->status);
3115                 break;
3116
3117         case HCI_OP_LE_CREATE_CONN:
3118                 hci_cs_le_create_conn(hdev, ev->status);
3119                 break;
3120
3121         case HCI_OP_LE_READ_REMOTE_FEATURES:
3122                 hci_cs_le_read_remote_features(hdev, ev->status);
3123                 break;
3124
3125         case HCI_OP_LE_START_ENC:
3126                 hci_cs_le_start_enc(hdev, ev->status);
3127                 break;
3128
3129         default:
3130                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3131                 break;
3132         }
3133
3134         if (*opcode != HCI_OP_NOP)
3135                 cancel_delayed_work(&hdev->cmd_timer);
3136
3137         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3138                 atomic_set(&hdev->cmd_cnt, 1);
3139
3140         /* Indicate request completion if the command failed. Also, if
3141          * we're not waiting for a special event and we get a success
3142          * command status we should try to flag the request as completed
3143          * (since for this kind of commands there will not be a command
3144          * complete event).
3145          */
3146         if (ev->status ||
3147             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3148                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3149                                      req_complete_skb);
3150
3151         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3152                 queue_work(hdev->workqueue, &hdev->cmd_work);
3153 }
3154
3155 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3156 {
3157         struct hci_ev_hardware_error *ev = (void *) skb->data;
3158
3159         hdev->hw_error_code = ev->code;
3160
3161         queue_work(hdev->req_workqueue, &hdev->error_reset);
3162 }
3163
3164 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3165 {
3166         struct hci_ev_role_change *ev = (void *) skb->data;
3167         struct hci_conn *conn;
3168
3169         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3170
3171         hci_dev_lock(hdev);
3172
3173         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3174         if (conn) {
3175                 if (!ev->status)
3176                         conn->role = ev->role;
3177
3178                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3179
3180                 hci_role_switch_cfm(conn, ev->status, ev->role);
3181         }
3182
3183         hci_dev_unlock(hdev);
3184 }
3185
3186 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3187 {
3188         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3189         int i;
3190
3191         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3192                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3193                 return;
3194         }
3195
3196         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3197             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3198                 BT_DBG("%s bad parameters", hdev->name);
3199                 return;
3200         }
3201
3202         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3203
3204         for (i = 0; i < ev->num_hndl; i++) {
3205                 struct hci_comp_pkts_info *info = &ev->handles[i];
3206                 struct hci_conn *conn;
3207                 __u16  handle, count;
3208
3209                 handle = __le16_to_cpu(info->handle);
3210                 count  = __le16_to_cpu(info->count);
3211
3212                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3213                 if (!conn)
3214                         continue;
3215
3216                 conn->sent -= count;
3217
3218                 switch (conn->type) {
3219                 case ACL_LINK:
3220                         hdev->acl_cnt += count;
3221                         if (hdev->acl_cnt > hdev->acl_pkts)
3222                                 hdev->acl_cnt = hdev->acl_pkts;
3223                         break;
3224
3225                 case LE_LINK:
3226                         if (hdev->le_pkts) {
3227                                 hdev->le_cnt += count;
3228                                 if (hdev->le_cnt > hdev->le_pkts)
3229                                         hdev->le_cnt = hdev->le_pkts;
3230                         } else {
3231                                 hdev->acl_cnt += count;
3232                                 if (hdev->acl_cnt > hdev->acl_pkts)
3233                                         hdev->acl_cnt = hdev->acl_pkts;
3234                         }
3235                         break;
3236
3237                 case SCO_LINK:
3238                         hdev->sco_cnt += count;
3239                         if (hdev->sco_cnt > hdev->sco_pkts)
3240                                 hdev->sco_cnt = hdev->sco_pkts;
3241                         break;
3242
3243                 default:
3244                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3245                         break;
3246                 }
3247         }
3248
3249         queue_work(hdev->workqueue, &hdev->tx_work);
3250 }
3251
3252 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3253                                                  __u16 handle)
3254 {
3255         struct hci_chan *chan;
3256
3257         switch (hdev->dev_type) {
3258         case HCI_PRIMARY:
3259                 return hci_conn_hash_lookup_handle(hdev, handle);
3260         case HCI_AMP:
3261                 chan = hci_chan_lookup_handle(hdev, handle);
3262                 if (chan)
3263                         return chan->conn;
3264                 break;
3265         default:
3266                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3267                 break;
3268         }
3269
3270         return NULL;
3271 }
3272
3273 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3274 {
3275         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3276         int i;
3277
3278         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3279                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3280                 return;
3281         }
3282
3283         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3284             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3285                 BT_DBG("%s bad parameters", hdev->name);
3286                 return;
3287         }
3288
3289         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3290                ev->num_hndl);
3291
3292         for (i = 0; i < ev->num_hndl; i++) {
3293                 struct hci_comp_blocks_info *info = &ev->handles[i];
3294                 struct hci_conn *conn = NULL;
3295                 __u16  handle, block_count;
3296
3297                 handle = __le16_to_cpu(info->handle);
3298                 block_count = __le16_to_cpu(info->blocks);
3299
3300                 conn = __hci_conn_lookup_handle(hdev, handle);
3301                 if (!conn)
3302                         continue;
3303
3304                 conn->sent -= block_count;
3305
3306                 switch (conn->type) {
3307                 case ACL_LINK:
3308                 case AMP_LINK:
3309                         hdev->block_cnt += block_count;
3310                         if (hdev->block_cnt > hdev->num_blocks)
3311                                 hdev->block_cnt = hdev->num_blocks;
3312                         break;
3313
3314                 default:
3315                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3316                         break;
3317                 }
3318         }
3319
3320         queue_work(hdev->workqueue, &hdev->tx_work);
3321 }
3322
3323 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3324 {
3325         struct hci_ev_mode_change *ev = (void *) skb->data;
3326         struct hci_conn *conn;
3327
3328         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3329
3330         hci_dev_lock(hdev);
3331
3332         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3333         if (conn) {
3334                 conn->mode = ev->mode;
3335
3336                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3337                                         &conn->flags)) {
3338                         if (conn->mode == HCI_CM_ACTIVE)
3339                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3340                         else
3341                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3342                 }
3343
3344                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3345                         hci_sco_setup(conn, ev->status);
3346         }
3347
3348         hci_dev_unlock(hdev);
3349 }
3350
3351 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3352 {
3353         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3354         struct hci_conn *conn;
3355
3356         BT_DBG("%s", hdev->name);
3357
3358         hci_dev_lock(hdev);
3359
3360         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3361         if (!conn)
3362                 goto unlock;
3363
3364         if (conn->state == BT_CONNECTED) {
3365                 hci_conn_hold(conn);
3366                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3367                 hci_conn_drop(conn);
3368         }
3369
3370         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3371             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3372                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3373                              sizeof(ev->bdaddr), &ev->bdaddr);
3374         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3375                 u8 secure;
3376
3377                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3378                         secure = 1;
3379                 else
3380                         secure = 0;
3381
3382                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3383         }
3384
3385 unlock:
3386         hci_dev_unlock(hdev);
3387 }
3388
3389 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3390 {
3391         if (key_type == HCI_LK_CHANGED_COMBINATION)
3392                 return;
3393
3394         conn->pin_length = pin_len;
3395         conn->key_type = key_type;
3396
3397         switch (key_type) {
3398         case HCI_LK_LOCAL_UNIT:
3399         case HCI_LK_REMOTE_UNIT:
3400         case HCI_LK_DEBUG_COMBINATION:
3401                 return;
3402         case HCI_LK_COMBINATION:
3403                 if (pin_len == 16)
3404                         conn->pending_sec_level = BT_SECURITY_HIGH;
3405                 else
3406                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3407                 break;
3408         case HCI_LK_UNAUTH_COMBINATION_P192:
3409         case HCI_LK_UNAUTH_COMBINATION_P256:
3410                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3411                 break;
3412         case HCI_LK_AUTH_COMBINATION_P192:
3413                 conn->pending_sec_level = BT_SECURITY_HIGH;
3414                 break;
3415         case HCI_LK_AUTH_COMBINATION_P256:
3416                 conn->pending_sec_level = BT_SECURITY_FIPS;
3417                 break;
3418         }
3419 }
3420
3421 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3422 {
3423         struct hci_ev_link_key_req *ev = (void *) skb->data;
3424         struct hci_cp_link_key_reply cp;
3425         struct hci_conn *conn;
3426         struct link_key *key;
3427
3428         BT_DBG("%s", hdev->name);
3429
3430         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3431                 return;
3432
3433         hci_dev_lock(hdev);
3434
3435         key = hci_find_link_key(hdev, &ev->bdaddr);
3436         if (!key) {
3437                 BT_DBG("%s link key not found for %pMR", hdev->name,
3438                        &ev->bdaddr);
3439                 goto not_found;
3440         }
3441
3442         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3443                &ev->bdaddr);
3444
3445         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3446         if (conn) {
3447                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3448
3449                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3450                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3451                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3452                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3453                         goto not_found;
3454                 }
3455
3456                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3457                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3458                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3459                         BT_DBG("%s ignoring key unauthenticated for high security",
3460                                hdev->name);
3461                         goto not_found;
3462                 }
3463
3464                 conn_set_key(conn, key->type, key->pin_len);
3465         }
3466
3467         bacpy(&cp.bdaddr, &ev->bdaddr);
3468         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3469
3470         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3471
3472         hci_dev_unlock(hdev);
3473
3474         return;
3475
3476 not_found:
3477         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3478         hci_dev_unlock(hdev);
3479 }
3480
3481 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3482 {
3483         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3484         struct hci_conn *conn;
3485         struct link_key *key;
3486         bool persistent;
3487         u8 pin_len = 0;
3488
3489         BT_DBG("%s", hdev->name);
3490
3491         hci_dev_lock(hdev);
3492
3493         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3494         if (!conn)
3495                 goto unlock;
3496
3497         hci_conn_hold(conn);
3498         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3499         hci_conn_drop(conn);
3500
3501         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3502         conn_set_key(conn, ev->key_type, conn->pin_length);
3503
3504         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3505                 goto unlock;
3506
3507         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3508                                 ev->key_type, pin_len, &persistent);
3509         if (!key)
3510                 goto unlock;
3511
3512         /* Update connection information since adding the key will have
3513          * fixed up the type in the case of changed combination keys.
3514          */
3515         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3516                 conn_set_key(conn, key->type, key->pin_len);
3517
3518         mgmt_new_link_key(hdev, key, persistent);
3519
3520         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3521          * is set. If it's not set simply remove the key from the kernel
3522          * list (we've still notified user space about it but with
3523          * store_hint being 0).
3524          */
3525         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3526             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3527                 list_del_rcu(&key->list);
3528                 kfree_rcu(key, rcu);
3529                 goto unlock;
3530         }
3531
3532         if (persistent)
3533                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3534         else
3535                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3536
3537 unlock:
3538         hci_dev_unlock(hdev);
3539 }
3540
3541 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3542 {
3543         struct hci_ev_clock_offset *ev = (void *) skb->data;
3544         struct hci_conn *conn;
3545
3546         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3547
3548         hci_dev_lock(hdev);
3549
3550         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3551         if (conn && !ev->status) {
3552                 struct inquiry_entry *ie;
3553
3554                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3555                 if (ie) {
3556                         ie->data.clock_offset = ev->clock_offset;
3557                         ie->timestamp = jiffies;
3558                 }
3559         }
3560
3561         hci_dev_unlock(hdev);
3562 }
3563
3564 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3565 {
3566         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3567         struct hci_conn *conn;
3568
3569         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3570
3571         hci_dev_lock(hdev);
3572
3573         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3574         if (conn && !ev->status)
3575                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3576
3577         hci_dev_unlock(hdev);
3578 }
3579
3580 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3581 {
3582         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3583         struct inquiry_entry *ie;
3584
3585         BT_DBG("%s", hdev->name);
3586
3587         hci_dev_lock(hdev);
3588
3589         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3590         if (ie) {
3591                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3592                 ie->timestamp = jiffies;
3593         }
3594
3595         hci_dev_unlock(hdev);
3596 }
3597
3598 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3599                                              struct sk_buff *skb)
3600 {
3601         struct inquiry_data data;
3602         int num_rsp = *((__u8 *) skb->data);
3603
3604         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3605
3606         if (!num_rsp)
3607                 return;
3608
3609         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3610                 return;
3611
3612         hci_dev_lock(hdev);
3613
3614         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3615                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3616                 info = (void *) (skb->data + 1);
3617
3618                 if (skb->len < num_rsp * sizeof(*info) + 1)
3619                         goto unlock;
3620
3621                 for (; num_rsp; num_rsp--, info++) {
3622                         u32 flags;
3623
3624                         bacpy(&data.bdaddr, &info->bdaddr);
3625                         data.pscan_rep_mode     = info->pscan_rep_mode;
3626                         data.pscan_period_mode  = info->pscan_period_mode;
3627                         data.pscan_mode         = info->pscan_mode;
3628                         memcpy(data.dev_class, info->dev_class, 3);
3629                         data.clock_offset       = info->clock_offset;
3630                         data.rssi               = info->rssi;
3631                         data.ssp_mode           = 0x00;
3632
3633                         flags = hci_inquiry_cache_update(hdev, &data, false);
3634
3635                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3636                                           info->dev_class, info->rssi,
3637                                           flags, NULL, 0, NULL, 0);
3638                 }
3639         } else {
3640                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3641
3642                 if (skb->len < num_rsp * sizeof(*info) + 1)
3643                         goto unlock;
3644
3645                 for (; num_rsp; num_rsp--, info++) {
3646                         u32 flags;
3647
3648                         bacpy(&data.bdaddr, &info->bdaddr);
3649                         data.pscan_rep_mode     = info->pscan_rep_mode;
3650                         data.pscan_period_mode  = info->pscan_period_mode;
3651                         data.pscan_mode         = 0x00;
3652                         memcpy(data.dev_class, info->dev_class, 3);
3653                         data.clock_offset       = info->clock_offset;
3654                         data.rssi               = info->rssi;
3655                         data.ssp_mode           = 0x00;
3656
3657                         flags = hci_inquiry_cache_update(hdev, &data, false);
3658
3659                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3660                                           info->dev_class, info->rssi,
3661                                           flags, NULL, 0, NULL, 0);
3662                 }
3663         }
3664
3665 unlock:
3666         hci_dev_unlock(hdev);
3667 }
3668
3669 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3670                                         struct sk_buff *skb)
3671 {
3672         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3673         struct hci_conn *conn;
3674
3675         BT_DBG("%s", hdev->name);
3676
3677         hci_dev_lock(hdev);
3678
3679         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3680         if (!conn)
3681                 goto unlock;
3682
3683         if (ev->page < HCI_MAX_PAGES)
3684                 memcpy(conn->features[ev->page], ev->features, 8);
3685
3686         if (!ev->status && ev->page == 0x01) {
3687                 struct inquiry_entry *ie;
3688
3689                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3690                 if (ie)
3691                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3692
3693                 if (ev->features[0] & LMP_HOST_SSP) {
3694                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3695                 } else {
3696                         /* It is mandatory by the Bluetooth specification that
3697                          * Extended Inquiry Results are only used when Secure
3698                          * Simple Pairing is enabled, but some devices violate
3699                          * this.
3700                          *
3701                          * To make these devices work, the internal SSP
3702                          * enabled flag needs to be cleared if the remote host
3703                          * features do not indicate SSP support */
3704                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3705                 }
3706
3707                 if (ev->features[0] & LMP_HOST_SC)
3708                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3709         }
3710
3711         if (conn->state != BT_CONFIG)
3712                 goto unlock;
3713
3714         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3715                 struct hci_cp_remote_name_req cp;
3716                 memset(&cp, 0, sizeof(cp));
3717                 bacpy(&cp.bdaddr, &conn->dst);
3718                 cp.pscan_rep_mode = 0x02;
3719                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3720         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3721                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3722
3723         if (!hci_outgoing_auth_needed(hdev, conn)) {
3724                 conn->state = BT_CONNECTED;
3725                 hci_connect_cfm(conn, ev->status);
3726                 hci_conn_drop(conn);
3727         }
3728
3729 unlock:
3730         hci_dev_unlock(hdev);
3731 }
3732
3733 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3734                                        struct sk_buff *skb)
3735 {
3736         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3737         struct hci_conn *conn;
3738
3739         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3740
3741         hci_dev_lock(hdev);
3742
3743         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3744         if (!conn) {
3745                 if (ev->link_type == ESCO_LINK)
3746                         goto unlock;
3747
3748                 /* When the link type in the event indicates SCO connection
3749                  * and lookup of the connection object fails, then check
3750                  * if an eSCO connection object exists.
3751                  *
3752                  * The core limits the synchronous connections to either
3753                  * SCO or eSCO. The eSCO connection is preferred and tried
3754                  * to be setup first and until successfully established,
3755                  * the link type will be hinted as eSCO.
3756                  */
3757                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3758                 if (!conn)
3759                         goto unlock;
3760         }
3761
3762         switch (ev->status) {
3763         case 0x00:
3764                 /* The synchronous connection complete event should only be
3765                  * sent once per new connection. Receiving a successful
3766                  * complete event when the connection status is already
3767                  * BT_CONNECTED means that the device is misbehaving and sent
3768                  * multiple complete event packets for the same new connection.
3769                  *
3770                  * Registering the device more than once can corrupt kernel
3771                  * memory, hence upon detecting this invalid event, we report
3772                  * an error and ignore the packet.
3773                  */
3774                 if (conn->state == BT_CONNECTED) {
3775                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
3776                         goto unlock;
3777                 }
3778
3779                 conn->handle = __le16_to_cpu(ev->handle);
3780                 conn->state  = BT_CONNECTED;
3781                 conn->type   = ev->link_type;
3782
3783                 hci_debugfs_create_conn(conn);
3784                 hci_conn_add_sysfs(conn);
3785                 break;
3786
3787         case 0x10:      /* Connection Accept Timeout */
3788         case 0x0d:      /* Connection Rejected due to Limited Resources */
3789         case 0x11:      /* Unsupported Feature or Parameter Value */
3790         case 0x1c:      /* SCO interval rejected */
3791         case 0x1a:      /* Unsupported Remote Feature */
3792         case 0x1e:      /* Invalid LMP Parameters */
3793         case 0x1f:      /* Unspecified error */
3794         case 0x20:      /* Unsupported LMP Parameter value */
3795                 if (conn->out) {
3796                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3797                                         (hdev->esco_type & EDR_ESCO_MASK);
3798                         if (hci_setup_sync(conn, conn->link->handle))
3799                                 goto unlock;
3800                 }
3801                 /* fall through */
3802
3803         default:
3804                 conn->state = BT_CLOSED;
3805                 break;
3806         }
3807
3808         hci_connect_cfm(conn, ev->status);
3809         if (ev->status)
3810                 hci_conn_del(conn);
3811
3812 unlock:
3813         hci_dev_unlock(hdev);
3814 }
3815
3816 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3817 {
3818         size_t parsed = 0;
3819
3820         while (parsed < eir_len) {
3821                 u8 field_len = eir[0];
3822
3823                 if (field_len == 0)
3824                         return parsed;
3825
3826                 parsed += field_len + 1;
3827                 eir += field_len + 1;
3828         }
3829
3830         return eir_len;
3831 }
3832
3833 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3834                                             struct sk_buff *skb)
3835 {
3836         struct inquiry_data data;
3837         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3838         int num_rsp = *((__u8 *) skb->data);
3839         size_t eir_len;
3840
3841         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3842
3843         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
3844                 return;
3845
3846         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3847                 return;
3848
3849         hci_dev_lock(hdev);
3850
3851         for (; num_rsp; num_rsp--, info++) {
3852                 u32 flags;
3853                 bool name_known;
3854
3855                 bacpy(&data.bdaddr, &info->bdaddr);
3856                 data.pscan_rep_mode     = info->pscan_rep_mode;
3857                 data.pscan_period_mode  = info->pscan_period_mode;
3858                 data.pscan_mode         = 0x00;
3859                 memcpy(data.dev_class, info->dev_class, 3);
3860                 data.clock_offset       = info->clock_offset;
3861                 data.rssi               = info->rssi;
3862                 data.ssp_mode           = 0x01;
3863
3864                 if (hci_dev_test_flag(hdev, HCI_MGMT))
3865                         name_known = eir_get_data(info->data,
3866                                                   sizeof(info->data),
3867                                                   EIR_NAME_COMPLETE, NULL);
3868                 else
3869                         name_known = true;
3870
3871                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3872
3873                 eir_len = eir_get_length(info->data, sizeof(info->data));
3874
3875                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3876                                   info->dev_class, info->rssi,
3877                                   flags, info->data, eir_len, NULL, 0);
3878         }
3879
3880         hci_dev_unlock(hdev);
3881 }
3882
3883 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3884                                          struct sk_buff *skb)
3885 {
3886         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3887         struct hci_conn *conn;
3888
3889         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3890                __le16_to_cpu(ev->handle));
3891
3892         hci_dev_lock(hdev);
3893
3894         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3895         if (!conn)
3896                 goto unlock;
3897
3898         /* For BR/EDR the necessary steps are taken through the
3899          * auth_complete event.
3900          */
3901         if (conn->type != LE_LINK)
3902                 goto unlock;
3903
3904         if (!ev->status)
3905                 conn->sec_level = conn->pending_sec_level;
3906
3907         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3908
3909         if (ev->status && conn->state == BT_CONNECTED) {
3910                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3911                 hci_conn_drop(conn);
3912                 goto unlock;
3913         }
3914
3915         if (conn->state == BT_CONFIG) {
3916                 if (!ev->status)
3917                         conn->state = BT_CONNECTED;
3918
3919                 hci_connect_cfm(conn, ev->status);
3920                 hci_conn_drop(conn);
3921         } else {
3922                 hci_auth_cfm(conn, ev->status);
3923
3924                 hci_conn_hold(conn);
3925                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3926                 hci_conn_drop(conn);
3927         }
3928
3929 unlock:
3930         hci_dev_unlock(hdev);
3931 }
3932
3933 static u8 hci_get_auth_req(struct hci_conn *conn)
3934 {
3935         /* If remote requests no-bonding follow that lead */
3936         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3937             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3938                 return conn->remote_auth | (conn->auth_type & 0x01);
3939
3940         /* If both remote and local have enough IO capabilities, require
3941          * MITM protection
3942          */
3943         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3944             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3945                 return conn->remote_auth | 0x01;
3946
3947         /* No MITM protection possible so ignore remote requirement */
3948         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3949 }
3950
3951 static u8 bredr_oob_data_present(struct hci_conn *conn)
3952 {
3953         struct hci_dev *hdev = conn->hdev;
3954         struct oob_data *data;
3955
3956         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3957         if (!data)
3958                 return 0x00;
3959
3960         if (bredr_sc_enabled(hdev)) {
3961                 /* When Secure Connections is enabled, then just
3962                  * return the present value stored with the OOB
3963                  * data. The stored value contains the right present
3964                  * information. However it can only be trusted when
3965                  * not in Secure Connection Only mode.
3966                  */
3967                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3968                         return data->present;
3969
3970                 /* When Secure Connections Only mode is enabled, then
3971                  * the P-256 values are required. If they are not
3972                  * available, then do not declare that OOB data is
3973                  * present.
3974                  */
3975                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3976                     !memcmp(data->hash256, ZERO_KEY, 16))
3977                         return 0x00;
3978
3979                 return 0x02;
3980         }
3981
3982         /* When Secure Connections is not enabled or actually
3983          * not supported by the hardware, then check that if
3984          * P-192 data values are present.
3985          */
3986         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3987             !memcmp(data->hash192, ZERO_KEY, 16))
3988                 return 0x00;
3989
3990         return 0x01;
3991 }
3992
3993 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3994 {
3995         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3996         struct hci_conn *conn;
3997
3998         BT_DBG("%s", hdev->name);
3999
4000         hci_dev_lock(hdev);
4001
4002         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4003         if (!conn)
4004                 goto unlock;
4005
4006         hci_conn_hold(conn);
4007
4008         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4009                 goto unlock;
4010
4011         /* Allow pairing if we're pairable, the initiators of the
4012          * pairing or if the remote is not requesting bonding.
4013          */
4014         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4015             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4016             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4017                 struct hci_cp_io_capability_reply cp;
4018
4019                 bacpy(&cp.bdaddr, &ev->bdaddr);
4020                 /* Change the IO capability from KeyboardDisplay
4021                  * to DisplayYesNo as it is not supported by BT spec. */
4022                 cp.capability = (conn->io_capability == 0x04) ?
4023                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4024
4025                 /* If we are initiators, there is no remote information yet */
4026                 if (conn->remote_auth == 0xff) {
4027                         /* Request MITM protection if our IO caps allow it
4028                          * except for the no-bonding case.
4029                          */
4030                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4031                             conn->auth_type != HCI_AT_NO_BONDING)
4032                                 conn->auth_type |= 0x01;
4033                 } else {
4034                         conn->auth_type = hci_get_auth_req(conn);
4035                 }
4036
4037                 /* If we're not bondable, force one of the non-bondable
4038                  * authentication requirement values.
4039                  */
4040                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4041                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4042
4043                 cp.authentication = conn->auth_type;
4044                 cp.oob_data = bredr_oob_data_present(conn);
4045
4046                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4047                              sizeof(cp), &cp);
4048         } else {
4049                 struct hci_cp_io_capability_neg_reply cp;
4050
4051                 bacpy(&cp.bdaddr, &ev->bdaddr);
4052                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4053
4054                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4055                              sizeof(cp), &cp);
4056         }
4057
4058 unlock:
4059         hci_dev_unlock(hdev);
4060 }
4061
4062 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4063 {
4064         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4065         struct hci_conn *conn;
4066
4067         BT_DBG("%s", hdev->name);
4068
4069         hci_dev_lock(hdev);
4070
4071         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4072         if (!conn)
4073                 goto unlock;
4074
4075         conn->remote_cap = ev->capability;
4076         conn->remote_auth = ev->authentication;
4077
4078 unlock:
4079         hci_dev_unlock(hdev);
4080 }
4081
4082 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4083                                          struct sk_buff *skb)
4084 {
4085         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4086         int loc_mitm, rem_mitm, confirm_hint = 0;
4087         struct hci_conn *conn;
4088
4089         BT_DBG("%s", hdev->name);
4090
4091         hci_dev_lock(hdev);
4092
4093         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4094                 goto unlock;
4095
4096         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4097         if (!conn)
4098                 goto unlock;
4099
4100         loc_mitm = (conn->auth_type & 0x01);
4101         rem_mitm = (conn->remote_auth & 0x01);
4102
4103         /* If we require MITM but the remote device can't provide that
4104          * (it has NoInputNoOutput) then reject the confirmation
4105          * request. We check the security level here since it doesn't
4106          * necessarily match conn->auth_type.
4107          */
4108         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4109             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4110                 BT_DBG("Rejecting request: remote device can't provide MITM");
4111                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4112                              sizeof(ev->bdaddr), &ev->bdaddr);
4113                 goto unlock;
4114         }
4115
4116         /* If no side requires MITM protection; auto-accept */
4117         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4118             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4119
4120                 /* If we're not the initiators request authorization to
4121                  * proceed from user space (mgmt_user_confirm with
4122                  * confirm_hint set to 1). The exception is if neither
4123                  * side had MITM or if the local IO capability is
4124                  * NoInputNoOutput, in which case we do auto-accept
4125                  */
4126                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4127                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4128                     (loc_mitm || rem_mitm)) {
4129                         BT_DBG("Confirming auto-accept as acceptor");
4130                         confirm_hint = 1;
4131                         goto confirm;
4132                 }
4133
4134                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4135                        hdev->auto_accept_delay);
4136
4137                 if (hdev->auto_accept_delay > 0) {
4138                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4139                         queue_delayed_work(conn->hdev->workqueue,
4140                                            &conn->auto_accept_work, delay);
4141                         goto unlock;
4142                 }
4143
4144                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4145                              sizeof(ev->bdaddr), &ev->bdaddr);
4146                 goto unlock;
4147         }
4148
4149 confirm:
4150         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4151                                   le32_to_cpu(ev->passkey), confirm_hint);
4152
4153 unlock:
4154         hci_dev_unlock(hdev);
4155 }
4156
4157 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4158                                          struct sk_buff *skb)
4159 {
4160         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4161
4162         BT_DBG("%s", hdev->name);
4163
4164         if (hci_dev_test_flag(hdev, HCI_MGMT))
4165                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4166 }
4167
4168 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4169                                         struct sk_buff *skb)
4170 {
4171         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4172         struct hci_conn *conn;
4173
4174         BT_DBG("%s", hdev->name);
4175
4176         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4177         if (!conn)
4178                 return;
4179
4180         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4181         conn->passkey_entered = 0;
4182
4183         if (hci_dev_test_flag(hdev, HCI_MGMT))
4184                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4185                                          conn->dst_type, conn->passkey_notify,
4186                                          conn->passkey_entered);
4187 }
4188
4189 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4190 {
4191         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4192         struct hci_conn *conn;
4193
4194         BT_DBG("%s", hdev->name);
4195
4196         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4197         if (!conn)
4198                 return;
4199
4200         switch (ev->type) {
4201         case HCI_KEYPRESS_STARTED:
4202                 conn->passkey_entered = 0;
4203                 return;
4204
4205         case HCI_KEYPRESS_ENTERED:
4206                 conn->passkey_entered++;
4207                 break;
4208
4209         case HCI_KEYPRESS_ERASED:
4210                 conn->passkey_entered--;
4211                 break;
4212
4213         case HCI_KEYPRESS_CLEARED:
4214                 conn->passkey_entered = 0;
4215                 break;
4216
4217         case HCI_KEYPRESS_COMPLETED:
4218                 return;
4219         }
4220
4221         if (hci_dev_test_flag(hdev, HCI_MGMT))
4222                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4223                                          conn->dst_type, conn->passkey_notify,
4224                                          conn->passkey_entered);
4225 }
4226
4227 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4228                                          struct sk_buff *skb)
4229 {
4230         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4231         struct hci_conn *conn;
4232
4233         BT_DBG("%s", hdev->name);
4234
4235         hci_dev_lock(hdev);
4236
4237         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4238         if (!conn)
4239                 goto unlock;
4240
4241         /* Reset the authentication requirement to unknown */
4242         conn->remote_auth = 0xff;
4243
4244         /* To avoid duplicate auth_failed events to user space we check
4245          * the HCI_CONN_AUTH_PEND flag which will be set if we
4246          * initiated the authentication. A traditional auth_complete
4247          * event gets always produced as initiator and is also mapped to
4248          * the mgmt_auth_failed event */
4249         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4250                 mgmt_auth_failed(conn, ev->status);
4251
4252         hci_conn_drop(conn);
4253
4254 unlock:
4255         hci_dev_unlock(hdev);
4256 }
4257
4258 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4259                                          struct sk_buff *skb)
4260 {
4261         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4262         struct inquiry_entry *ie;
4263         struct hci_conn *conn;
4264
4265         BT_DBG("%s", hdev->name);
4266
4267         hci_dev_lock(hdev);
4268
4269         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4270         if (conn)
4271                 memcpy(conn->features[1], ev->features, 8);
4272
4273         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4274         if (ie)
4275                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4276
4277         hci_dev_unlock(hdev);
4278 }
4279
4280 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4281                                             struct sk_buff *skb)
4282 {
4283         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4284         struct oob_data *data;
4285
4286         BT_DBG("%s", hdev->name);
4287
4288         hci_dev_lock(hdev);
4289
4290         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4291                 goto unlock;
4292
4293         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4294         if (!data) {
4295                 struct hci_cp_remote_oob_data_neg_reply cp;
4296
4297                 bacpy(&cp.bdaddr, &ev->bdaddr);
4298                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4299                              sizeof(cp), &cp);
4300                 goto unlock;
4301         }
4302
4303         if (bredr_sc_enabled(hdev)) {
4304                 struct hci_cp_remote_oob_ext_data_reply cp;
4305
4306                 bacpy(&cp.bdaddr, &ev->bdaddr);
4307                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4308                         memset(cp.hash192, 0, sizeof(cp.hash192));
4309                         memset(cp.rand192, 0, sizeof(cp.rand192));
4310                 } else {
4311                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4312                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4313                 }
4314                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4315                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4316
4317                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4318                              sizeof(cp), &cp);
4319         } else {
4320                 struct hci_cp_remote_oob_data_reply cp;
4321
4322                 bacpy(&cp.bdaddr, &ev->bdaddr);
4323                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4324                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4325
4326                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4327                              sizeof(cp), &cp);
4328         }
4329
4330 unlock:
4331         hci_dev_unlock(hdev);
4332 }
4333
4334 #if IS_ENABLED(CONFIG_BT_HS)
4335 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4336 {
4337         struct hci_ev_channel_selected *ev = (void *)skb->data;
4338         struct hci_conn *hcon;
4339
4340         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4341
4342         skb_pull(skb, sizeof(*ev));
4343
4344         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4345         if (!hcon)
4346                 return;
4347
4348         amp_read_loc_assoc_final_data(hdev, hcon);
4349 }
4350
4351 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4352                                       struct sk_buff *skb)
4353 {
4354         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4355         struct hci_conn *hcon, *bredr_hcon;
4356
4357         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4358                ev->status);
4359
4360         hci_dev_lock(hdev);
4361
4362         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4363         if (!hcon) {
4364                 hci_dev_unlock(hdev);
4365                 return;
4366         }
4367
4368         if (!hcon->amp_mgr) {
4369                 hci_dev_unlock(hdev);
4370                 return;
4371         }
4372
4373         if (ev->status) {
4374                 hci_conn_del(hcon);
4375                 hci_dev_unlock(hdev);
4376                 return;
4377         }
4378
4379         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4380
4381         hcon->state = BT_CONNECTED;
4382         bacpy(&hcon->dst, &bredr_hcon->dst);
4383
4384         hci_conn_hold(hcon);
4385         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4386         hci_conn_drop(hcon);
4387
4388         hci_debugfs_create_conn(hcon);
4389         hci_conn_add_sysfs(hcon);
4390
4391         amp_physical_cfm(bredr_hcon, hcon);
4392
4393         hci_dev_unlock(hdev);
4394 }
4395
4396 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4397 {
4398         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4399         struct hci_conn *hcon;
4400         struct hci_chan *hchan;
4401         struct amp_mgr *mgr;
4402
4403         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4404                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4405                ev->status);
4406
4407         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4408         if (!hcon)
4409                 return;
4410
4411         /* Create AMP hchan */
4412         hchan = hci_chan_create(hcon);
4413         if (!hchan)
4414                 return;
4415
4416         hchan->handle = le16_to_cpu(ev->handle);
4417         hchan->amp = true;
4418
4419         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4420
4421         mgr = hcon->amp_mgr;
4422         if (mgr && mgr->bredr_chan) {
4423                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4424
4425                 l2cap_chan_lock(bredr_chan);
4426
4427                 bredr_chan->conn->mtu = hdev->block_mtu;
4428                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4429                 hci_conn_hold(hcon);
4430
4431                 l2cap_chan_unlock(bredr_chan);
4432         }
4433 }
4434
4435 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4436                                              struct sk_buff *skb)
4437 {
4438         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4439         struct hci_chan *hchan;
4440
4441         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4442                le16_to_cpu(ev->handle), ev->status);
4443
4444         if (ev->status)
4445                 return;
4446
4447         hci_dev_lock(hdev);
4448
4449         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4450         if (!hchan || !hchan->amp)
4451                 goto unlock;
4452
4453         amp_destroy_logical_link(hchan, ev->reason);
4454
4455 unlock:
4456         hci_dev_unlock(hdev);
4457 }
4458
4459 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4460                                              struct sk_buff *skb)
4461 {
4462         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4463         struct hci_conn *hcon;
4464
4465         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4466
4467         if (ev->status)
4468                 return;
4469
4470         hci_dev_lock(hdev);
4471
4472         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4473         if (hcon && hcon->type == AMP_LINK) {
4474                 hcon->state = BT_CLOSED;
4475                 hci_disconn_cfm(hcon, ev->reason);
4476                 hci_conn_del(hcon);
4477         }
4478
4479         hci_dev_unlock(hdev);
4480 }
4481 #endif
4482
4483 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4484 {
4485         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4486         struct hci_conn_params *params;
4487         struct hci_conn *conn;
4488         struct smp_irk *irk;
4489         u8 addr_type;
4490
4491         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4492
4493         hci_dev_lock(hdev);
4494
4495         /* All controllers implicitly stop advertising in the event of a
4496          * connection, so ensure that the state bit is cleared.
4497          */
4498         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4499
4500         conn = hci_lookup_le_connect(hdev);
4501         if (!conn) {
4502                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4503                 if (!conn) {
4504                         BT_ERR("No memory for new connection");
4505                         goto unlock;
4506                 }
4507
4508                 conn->dst_type = ev->bdaddr_type;
4509
4510                 /* If we didn't have a hci_conn object previously
4511                  * but we're in master role this must be something
4512                  * initiated using a white list. Since white list based
4513                  * connections are not "first class citizens" we don't
4514                  * have full tracking of them. Therefore, we go ahead
4515                  * with a "best effort" approach of determining the
4516                  * initiator address based on the HCI_PRIVACY flag.
4517                  */
4518                 if (conn->out) {
4519                         conn->resp_addr_type = ev->bdaddr_type;
4520                         bacpy(&conn->resp_addr, &ev->bdaddr);
4521                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4522                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4523                                 bacpy(&conn->init_addr, &hdev->rpa);
4524                         } else {
4525                                 hci_copy_identity_address(hdev,
4526                                                           &conn->init_addr,
4527                                                           &conn->init_addr_type);
4528                         }
4529                 }
4530         } else {
4531                 cancel_delayed_work(&conn->le_conn_timeout);
4532         }
4533
4534         if (!conn->out) {
4535                 /* Set the responder (our side) address type based on
4536                  * the advertising address type.
4537                  */
4538                 conn->resp_addr_type = hdev->adv_addr_type;
4539                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4540                         bacpy(&conn->resp_addr, &hdev->random_addr);
4541                 else
4542                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4543
4544                 conn->init_addr_type = ev->bdaddr_type;
4545                 bacpy(&conn->init_addr, &ev->bdaddr);
4546
4547                 /* For incoming connections, set the default minimum
4548                  * and maximum connection interval. They will be used
4549                  * to check if the parameters are in range and if not
4550                  * trigger the connection update procedure.
4551                  */
4552                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4553                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4554         }
4555
4556         /* Lookup the identity address from the stored connection
4557          * address and address type.
4558          *
4559          * When establishing connections to an identity address, the
4560          * connection procedure will store the resolvable random
4561          * address first. Now if it can be converted back into the
4562          * identity address, start using the identity address from
4563          * now on.
4564          */
4565         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4566         if (irk) {
4567                 bacpy(&conn->dst, &irk->bdaddr);
4568                 conn->dst_type = irk->addr_type;
4569         }
4570
4571         if (ev->status) {
4572                 hci_le_conn_failed(conn, ev->status);
4573                 goto unlock;
4574         }
4575
4576         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4577                 addr_type = BDADDR_LE_PUBLIC;
4578         else
4579                 addr_type = BDADDR_LE_RANDOM;
4580
4581         /* Drop the connection if the device is blocked */
4582         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4583                 hci_conn_drop(conn);
4584                 goto unlock;
4585         }
4586
4587         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4588                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4589
4590         conn->sec_level = BT_SECURITY_LOW;
4591         conn->handle = __le16_to_cpu(ev->handle);
4592         conn->state = BT_CONFIG;
4593
4594         conn->le_conn_interval = le16_to_cpu(ev->interval);
4595         conn->le_conn_latency = le16_to_cpu(ev->latency);
4596         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4597
4598         hci_debugfs_create_conn(conn);
4599         hci_conn_add_sysfs(conn);
4600
4601         if (!ev->status) {
4602                 /* The remote features procedure is defined for master
4603                  * role only. So only in case of an initiated connection
4604                  * request the remote features.
4605                  *
4606                  * If the local controller supports slave-initiated features
4607                  * exchange, then requesting the remote features in slave
4608                  * role is possible. Otherwise just transition into the
4609                  * connected state without requesting the remote features.
4610                  */
4611                 if (conn->out ||
4612                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4613                         struct hci_cp_le_read_remote_features cp;
4614
4615                         cp.handle = __cpu_to_le16(conn->handle);
4616
4617                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4618                                      sizeof(cp), &cp);
4619
4620                         hci_conn_hold(conn);
4621                 } else {
4622                         conn->state = BT_CONNECTED;
4623                         hci_connect_cfm(conn, ev->status);
4624                 }
4625         } else {
4626                 hci_connect_cfm(conn, ev->status);
4627         }
4628
4629         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4630                                            conn->dst_type);
4631         if (params) {
4632                 list_del_init(&params->action);
4633                 if (params->conn) {
4634                         hci_conn_drop(params->conn);
4635                         hci_conn_put(params->conn);
4636                         params->conn = NULL;
4637                 }
4638         }
4639
4640 unlock:
4641         hci_update_background_scan(hdev);
4642         hci_dev_unlock(hdev);
4643 }
4644
4645 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4646                                             struct sk_buff *skb)
4647 {
4648         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4649         struct hci_conn *conn;
4650
4651         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4652
4653         if (ev->status)
4654                 return;
4655
4656         hci_dev_lock(hdev);
4657
4658         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4659         if (conn) {
4660                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4661                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4662                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4663         }
4664
4665         hci_dev_unlock(hdev);
4666 }
4667
4668 /* This function requires the caller holds hdev->lock */
4669 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4670                                               bdaddr_t *addr,
4671                                               u8 addr_type, u8 adv_type,
4672                                               bdaddr_t *direct_rpa)
4673 {
4674         struct hci_conn *conn;
4675         struct hci_conn_params *params;
4676
4677         /* If the event is not connectable don't proceed further */
4678         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4679                 return NULL;
4680
4681         /* Ignore if the device is blocked */
4682         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4683                 return NULL;
4684
4685         /* Most controller will fail if we try to create new connections
4686          * while we have an existing one in slave role.
4687          */
4688         if (hdev->conn_hash.le_num_slave > 0)
4689                 return NULL;
4690
4691         /* If we're not connectable only connect devices that we have in
4692          * our pend_le_conns list.
4693          */
4694         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
4695                                            addr_type);
4696         if (!params)
4697                 return NULL;
4698
4699         if (!params->explicit_connect) {
4700                 switch (params->auto_connect) {
4701                 case HCI_AUTO_CONN_DIRECT:
4702                         /* Only devices advertising with ADV_DIRECT_IND are
4703                          * triggering a connection attempt. This is allowing
4704                          * incoming connections from slave devices.
4705                          */
4706                         if (adv_type != LE_ADV_DIRECT_IND)
4707                                 return NULL;
4708                         break;
4709                 case HCI_AUTO_CONN_ALWAYS:
4710                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4711                          * are triggering a connection attempt. This means
4712                          * that incoming connectioms from slave device are
4713                          * accepted and also outgoing connections to slave
4714                          * devices are established when found.
4715                          */
4716                         break;
4717                 default:
4718                         return NULL;
4719                 }
4720         }
4721
4722         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4723                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
4724                               direct_rpa);
4725         if (!IS_ERR(conn)) {
4726                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
4727                  * by higher layer that tried to connect, if no then
4728                  * store the pointer since we don't really have any
4729                  * other owner of the object besides the params that
4730                  * triggered it. This way we can abort the connection if
4731                  * the parameters get removed and keep the reference
4732                  * count consistent once the connection is established.
4733                  */
4734
4735                 if (!params->explicit_connect)
4736                         params->conn = hci_conn_get(conn);
4737
4738                 return conn;
4739         }
4740
4741         switch (PTR_ERR(conn)) {
4742         case -EBUSY:
4743                 /* If hci_connect() returns -EBUSY it means there is already
4744                  * an LE connection attempt going on. Since controllers don't
4745                  * support more than one connection attempt at the time, we
4746                  * don't consider this an error case.
4747                  */
4748                 break;
4749         default:
4750                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4751                 return NULL;
4752         }
4753
4754         return NULL;
4755 }
4756
4757 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4758                                u8 bdaddr_type, bdaddr_t *direct_addr,
4759                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4760 {
4761         struct discovery_state *d = &hdev->discovery;
4762         struct smp_irk *irk;
4763         struct hci_conn *conn;
4764         bool match;
4765         u32 flags;
4766         u8 *ptr, real_len;
4767
4768         switch (type) {
4769         case LE_ADV_IND:
4770         case LE_ADV_DIRECT_IND:
4771         case LE_ADV_SCAN_IND:
4772         case LE_ADV_NONCONN_IND:
4773         case LE_ADV_SCAN_RSP:
4774                 break;
4775         default:
4776                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
4777                                    type);
4778                 return;
4779         }
4780
4781         if (len > HCI_MAX_AD_LENGTH) {
4782                 pr_err_ratelimited("legacy adv larger than 31 bytes");
4783                 return;
4784         }
4785
4786         /* Find the end of the data in case the report contains padded zero
4787          * bytes at the end causing an invalid length value.
4788          *
4789          * When data is NULL, len is 0 so there is no need for extra ptr
4790          * check as 'ptr < data + 0' is already false in such case.
4791          */
4792         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
4793                 if (ptr + 1 + *ptr > data + len)
4794                         break;
4795         }
4796
4797         real_len = ptr - data;
4798
4799         /* Adjust for actual length */
4800         if (len != real_len) {
4801                 BT_ERR_RATELIMITED("%s advertising data length corrected",
4802                                    hdev->name);
4803                 len = real_len;
4804         }
4805
4806         /* If the direct address is present, then this report is from
4807          * a LE Direct Advertising Report event. In that case it is
4808          * important to see if the address is matching the local
4809          * controller address.
4810          */
4811         if (direct_addr) {
4812                 /* Only resolvable random addresses are valid for these
4813                  * kind of reports and others can be ignored.
4814                  */
4815                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4816                         return;
4817
4818                 /* If the controller is not using resolvable random
4819                  * addresses, then this report can be ignored.
4820                  */
4821                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4822                         return;
4823
4824                 /* If the local IRK of the controller does not match
4825                  * with the resolvable random address provided, then
4826                  * this report can be ignored.
4827                  */
4828                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4829                         return;
4830         }
4831
4832         /* Check if we need to convert to identity address */
4833         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4834         if (irk) {
4835                 bdaddr = &irk->bdaddr;
4836                 bdaddr_type = irk->addr_type;
4837         }
4838
4839         /* Check if we have been requested to connect to this device.
4840          *
4841          * direct_addr is set only for directed advertising reports (it is NULL
4842          * for advertising reports) and is already verified to be RPA above.
4843          */
4844         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
4845                                                                 direct_addr);
4846         if (conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
4847                 /* Store report for later inclusion by
4848                  * mgmt_device_connected
4849                  */
4850                 memcpy(conn->le_adv_data, data, len);
4851                 conn->le_adv_data_len = len;
4852         }
4853
4854         /* Passive scanning shouldn't trigger any device found events,
4855          * except for devices marked as CONN_REPORT for which we do send
4856          * device found events.
4857          */
4858         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4859                 if (type == LE_ADV_DIRECT_IND)
4860                         return;
4861
4862                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4863                                                bdaddr, bdaddr_type))
4864                         return;
4865
4866                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4867                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4868                 else
4869                         flags = 0;
4870                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4871                                   rssi, flags, data, len, NULL, 0);
4872                 return;
4873         }
4874
4875         /* When receiving non-connectable or scannable undirected
4876          * advertising reports, this means that the remote device is
4877          * not connectable and then clearly indicate this in the
4878          * device found event.
4879          *
4880          * When receiving a scan response, then there is no way to
4881          * know if the remote device is connectable or not. However
4882          * since scan responses are merged with a previously seen
4883          * advertising report, the flags field from that report
4884          * will be used.
4885          *
4886          * In the really unlikely case that a controller get confused
4887          * and just sends a scan response event, then it is marked as
4888          * not connectable as well.
4889          */
4890         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4891             type == LE_ADV_SCAN_RSP)
4892                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4893         else
4894                 flags = 0;
4895
4896         /* If there's nothing pending either store the data from this
4897          * event or send an immediate device found event if the data
4898          * should not be stored for later.
4899          */
4900         if (!has_pending_adv_report(hdev)) {
4901                 /* If the report will trigger a SCAN_REQ store it for
4902                  * later merging.
4903                  */
4904                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4905                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4906                                                  rssi, flags, data, len);
4907                         return;
4908                 }
4909
4910                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4911                                   rssi, flags, data, len, NULL, 0);
4912                 return;
4913         }
4914
4915         /* Check if the pending report is for the same device as the new one */
4916         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4917                  bdaddr_type == d->last_adv_addr_type);
4918
4919         /* If the pending data doesn't match this report or this isn't a
4920          * scan response (e.g. we got a duplicate ADV_IND) then force
4921          * sending of the pending data.
4922          */
4923         if (type != LE_ADV_SCAN_RSP || !match) {
4924                 /* Send out whatever is in the cache, but skip duplicates */
4925                 if (!match)
4926                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4927                                           d->last_adv_addr_type, NULL,
4928                                           d->last_adv_rssi, d->last_adv_flags,
4929                                           d->last_adv_data,
4930                                           d->last_adv_data_len, NULL, 0);
4931
4932                 /* If the new report will trigger a SCAN_REQ store it for
4933                  * later merging.
4934                  */
4935                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4936                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4937                                                  rssi, flags, data, len);
4938                         return;
4939                 }
4940
4941                 /* The advertising reports cannot be merged, so clear
4942                  * the pending report and send out a device found event.
4943                  */
4944                 clear_pending_adv_report(hdev);
4945                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4946                                   rssi, flags, data, len, NULL, 0);
4947                 return;
4948         }
4949
4950         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4951          * the new event is a SCAN_RSP. We can therefore proceed with
4952          * sending a merged device found event.
4953          */
4954         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4955                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4956                           d->last_adv_data, d->last_adv_data_len, data, len);
4957         clear_pending_adv_report(hdev);
4958 }
4959
4960 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4961 {
4962         u8 num_reports = skb->data[0];
4963         void *ptr = &skb->data[1];
4964
4965         hci_dev_lock(hdev);
4966
4967         while (num_reports--) {
4968                 struct hci_ev_le_advertising_info *ev = ptr;
4969                 s8 rssi;
4970
4971                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
4972                         bt_dev_err(hdev, "Malicious advertising data.");
4973                         break;
4974                 }
4975
4976                 if (ev->length <= HCI_MAX_AD_LENGTH &&
4977                     ev->data + ev->length <= skb_tail_pointer(skb)) {
4978                         rssi = ev->data[ev->length];
4979                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4980                                            ev->bdaddr_type, NULL, 0, rssi,
4981                                            ev->data, ev->length);
4982                 } else {
4983                         bt_dev_err(hdev, "Dropping invalid advertising data");
4984                 }
4985
4986                 ptr += sizeof(*ev) + ev->length + 1;
4987         }
4988
4989         hci_dev_unlock(hdev);
4990 }
4991
4992 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4993                                             struct sk_buff *skb)
4994 {
4995         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4996         struct hci_conn *conn;
4997
4998         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4999
5000         hci_dev_lock(hdev);
5001
5002         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5003         if (conn) {
5004                 if (!ev->status)
5005                         memcpy(conn->features[0], ev->features, 8);
5006
5007                 if (conn->state == BT_CONFIG) {
5008                         __u8 status;
5009
5010                         /* If the local controller supports slave-initiated
5011                          * features exchange, but the remote controller does
5012                          * not, then it is possible that the error code 0x1a
5013                          * for unsupported remote feature gets returned.
5014                          *
5015                          * In this specific case, allow the connection to
5016                          * transition into connected state and mark it as
5017                          * successful.
5018                          */
5019                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5020                             !conn->out && ev->status == 0x1a)
5021                                 status = 0x00;
5022                         else
5023                                 status = ev->status;
5024
5025                         conn->state = BT_CONNECTED;
5026                         hci_connect_cfm(conn, status);
5027                         hci_conn_drop(conn);
5028                 }
5029         }
5030
5031         hci_dev_unlock(hdev);
5032 }
5033
5034 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5035 {
5036         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5037         struct hci_cp_le_ltk_reply cp;
5038         struct hci_cp_le_ltk_neg_reply neg;
5039         struct hci_conn *conn;
5040         struct smp_ltk *ltk;
5041
5042         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5043
5044         hci_dev_lock(hdev);
5045
5046         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5047         if (conn == NULL)
5048                 goto not_found;
5049
5050         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5051         if (!ltk)
5052                 goto not_found;
5053
5054         if (smp_ltk_is_sc(ltk)) {
5055                 /* With SC both EDiv and Rand are set to zero */
5056                 if (ev->ediv || ev->rand)
5057                         goto not_found;
5058         } else {
5059                 /* For non-SC keys check that EDiv and Rand match */
5060                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5061                         goto not_found;
5062         }
5063
5064         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5065         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5066         cp.handle = cpu_to_le16(conn->handle);
5067
5068         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5069
5070         conn->enc_key_size = ltk->enc_size;
5071
5072         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5073
5074         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5075          * temporary key used to encrypt a connection following
5076          * pairing. It is used during the Encrypted Session Setup to
5077          * distribute the keys. Later, security can be re-established
5078          * using a distributed LTK.
5079          */
5080         if (ltk->type == SMP_STK) {
5081                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5082                 list_del_rcu(&ltk->list);
5083                 kfree_rcu(ltk, rcu);
5084         } else {
5085                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5086         }
5087
5088         hci_dev_unlock(hdev);
5089
5090         return;
5091
5092 not_found:
5093         neg.handle = ev->handle;
5094         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5095         hci_dev_unlock(hdev);
5096 }
5097
5098 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5099                                       u8 reason)
5100 {
5101         struct hci_cp_le_conn_param_req_neg_reply cp;
5102
5103         cp.handle = cpu_to_le16(handle);
5104         cp.reason = reason;
5105
5106         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5107                      &cp);
5108 }
5109
5110 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5111                                              struct sk_buff *skb)
5112 {
5113         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5114         struct hci_cp_le_conn_param_req_reply cp;
5115         struct hci_conn *hcon;
5116         u16 handle, min, max, latency, timeout;
5117
5118         handle = le16_to_cpu(ev->handle);
5119         min = le16_to_cpu(ev->interval_min);
5120         max = le16_to_cpu(ev->interval_max);
5121         latency = le16_to_cpu(ev->latency);
5122         timeout = le16_to_cpu(ev->timeout);
5123
5124         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5125         if (!hcon || hcon->state != BT_CONNECTED)
5126                 return send_conn_param_neg_reply(hdev, handle,
5127                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5128
5129         if (hci_check_conn_params(min, max, latency, timeout))
5130                 return send_conn_param_neg_reply(hdev, handle,
5131                                                  HCI_ERROR_INVALID_LL_PARAMS);
5132
5133         if (hcon->role == HCI_ROLE_MASTER) {
5134                 struct hci_conn_params *params;
5135                 u8 store_hint;
5136
5137                 hci_dev_lock(hdev);
5138
5139                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5140                                                 hcon->dst_type);
5141                 if (params) {
5142                         params->conn_min_interval = min;
5143                         params->conn_max_interval = max;
5144                         params->conn_latency = latency;
5145                         params->supervision_timeout = timeout;
5146                         store_hint = 0x01;
5147                 } else{
5148                         store_hint = 0x00;
5149                 }
5150
5151                 hci_dev_unlock(hdev);
5152
5153                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5154                                     store_hint, min, max, latency, timeout);
5155         }
5156
5157         cp.handle = ev->handle;
5158         cp.interval_min = ev->interval_min;
5159         cp.interval_max = ev->interval_max;
5160         cp.latency = ev->latency;
5161         cp.timeout = ev->timeout;
5162         cp.min_ce_len = 0;
5163         cp.max_ce_len = 0;
5164
5165         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5166 }
5167
5168 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5169                                          struct sk_buff *skb)
5170 {
5171         u8 num_reports = skb->data[0];
5172         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
5173
5174         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
5175                 return;
5176
5177         hci_dev_lock(hdev);
5178
5179         for (; num_reports; num_reports--, ev++)
5180                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5181                                    ev->bdaddr_type, &ev->direct_addr,
5182                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5183
5184         hci_dev_unlock(hdev);
5185 }
5186
5187 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5188 {
5189         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5190
5191         skb_pull(skb, sizeof(*le_ev));
5192
5193         switch (le_ev->subevent) {
5194         case HCI_EV_LE_CONN_COMPLETE:
5195                 hci_le_conn_complete_evt(hdev, skb);
5196                 break;
5197
5198         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5199                 hci_le_conn_update_complete_evt(hdev, skb);
5200                 break;
5201
5202         case HCI_EV_LE_ADVERTISING_REPORT:
5203                 hci_le_adv_report_evt(hdev, skb);
5204                 break;
5205
5206         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5207                 hci_le_remote_feat_complete_evt(hdev, skb);
5208                 break;
5209
5210         case HCI_EV_LE_LTK_REQ:
5211                 hci_le_ltk_request_evt(hdev, skb);
5212                 break;
5213
5214         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5215                 hci_le_remote_conn_param_req_evt(hdev, skb);
5216                 break;
5217
5218         case HCI_EV_LE_DIRECT_ADV_REPORT:
5219                 hci_le_direct_adv_report_evt(hdev, skb);
5220                 break;
5221
5222         default:
5223                 break;
5224         }
5225 }
5226
5227 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5228                                  u8 event, struct sk_buff *skb)
5229 {
5230         struct hci_ev_cmd_complete *ev;
5231         struct hci_event_hdr *hdr;
5232
5233         if (!skb)
5234                 return false;
5235
5236         if (skb->len < sizeof(*hdr)) {
5237                 BT_ERR("Too short HCI event");
5238                 return false;
5239         }
5240
5241         hdr = (void *) skb->data;
5242         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5243
5244         if (event) {
5245                 if (hdr->evt != event)
5246                         return false;
5247                 return true;
5248         }
5249
5250         /* Check if request ended in Command Status - no way to retreive
5251          * any extra parameters in this case.
5252          */
5253         if (hdr->evt == HCI_EV_CMD_STATUS)
5254                 return false;
5255
5256         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5257                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5258                 return false;
5259         }
5260
5261         if (skb->len < sizeof(*ev)) {
5262                 BT_ERR("Too short cmd_complete event");
5263                 return false;
5264         }
5265
5266         ev = (void *) skb->data;
5267         skb_pull(skb, sizeof(*ev));
5268
5269         if (opcode != __le16_to_cpu(ev->opcode)) {
5270                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5271                        __le16_to_cpu(ev->opcode));
5272                 return false;
5273         }
5274
5275         return true;
5276 }
5277
5278 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5279 {
5280         struct hci_event_hdr *hdr = (void *) skb->data;
5281         hci_req_complete_t req_complete = NULL;
5282         hci_req_complete_skb_t req_complete_skb = NULL;
5283         struct sk_buff *orig_skb = NULL;
5284         u8 status = 0, event = hdr->evt, req_evt = 0;
5285         u16 opcode = HCI_OP_NOP;
5286
5287         if (!event) {
5288                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
5289                 goto done;
5290         }
5291
5292         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5293                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5294                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5295                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5296                                      &req_complete_skb);
5297                 req_evt = event;
5298         }
5299
5300         /* If it looks like we might end up having to call
5301          * req_complete_skb, store a pristine copy of the skb since the
5302          * various handlers may modify the original one through
5303          * skb_pull() calls, etc.
5304          */
5305         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5306             event == HCI_EV_CMD_COMPLETE)
5307                 orig_skb = skb_clone(skb, GFP_KERNEL);
5308
5309         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5310
5311         switch (event) {
5312         case HCI_EV_INQUIRY_COMPLETE:
5313                 hci_inquiry_complete_evt(hdev, skb);
5314                 break;
5315
5316         case HCI_EV_INQUIRY_RESULT:
5317                 hci_inquiry_result_evt(hdev, skb);
5318                 break;
5319
5320         case HCI_EV_CONN_COMPLETE:
5321                 hci_conn_complete_evt(hdev, skb);
5322                 break;
5323
5324         case HCI_EV_CONN_REQUEST:
5325                 hci_conn_request_evt(hdev, skb);
5326                 break;
5327
5328         case HCI_EV_DISCONN_COMPLETE:
5329                 hci_disconn_complete_evt(hdev, skb);
5330                 break;
5331
5332         case HCI_EV_AUTH_COMPLETE:
5333                 hci_auth_complete_evt(hdev, skb);
5334                 break;
5335
5336         case HCI_EV_REMOTE_NAME:
5337                 hci_remote_name_evt(hdev, skb);
5338                 break;
5339
5340         case HCI_EV_ENCRYPT_CHANGE:
5341                 hci_encrypt_change_evt(hdev, skb);
5342                 break;
5343
5344         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5345                 hci_change_link_key_complete_evt(hdev, skb);
5346                 break;
5347
5348         case HCI_EV_REMOTE_FEATURES:
5349                 hci_remote_features_evt(hdev, skb);
5350                 break;
5351
5352         case HCI_EV_CMD_COMPLETE:
5353                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5354                                      &req_complete, &req_complete_skb);
5355                 break;
5356
5357         case HCI_EV_CMD_STATUS:
5358                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5359                                    &req_complete_skb);
5360                 break;
5361
5362         case HCI_EV_HARDWARE_ERROR:
5363                 hci_hardware_error_evt(hdev, skb);
5364                 break;
5365
5366         case HCI_EV_ROLE_CHANGE:
5367                 hci_role_change_evt(hdev, skb);
5368                 break;
5369
5370         case HCI_EV_NUM_COMP_PKTS:
5371                 hci_num_comp_pkts_evt(hdev, skb);
5372                 break;
5373
5374         case HCI_EV_MODE_CHANGE:
5375                 hci_mode_change_evt(hdev, skb);
5376                 break;
5377
5378         case HCI_EV_PIN_CODE_REQ:
5379                 hci_pin_code_request_evt(hdev, skb);
5380                 break;
5381
5382         case HCI_EV_LINK_KEY_REQ:
5383                 hci_link_key_request_evt(hdev, skb);
5384                 break;
5385
5386         case HCI_EV_LINK_KEY_NOTIFY:
5387                 hci_link_key_notify_evt(hdev, skb);
5388                 break;
5389
5390         case HCI_EV_CLOCK_OFFSET:
5391                 hci_clock_offset_evt(hdev, skb);
5392                 break;
5393
5394         case HCI_EV_PKT_TYPE_CHANGE:
5395                 hci_pkt_type_change_evt(hdev, skb);
5396                 break;
5397
5398         case HCI_EV_PSCAN_REP_MODE:
5399                 hci_pscan_rep_mode_evt(hdev, skb);
5400                 break;
5401
5402         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5403                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5404                 break;
5405
5406         case HCI_EV_REMOTE_EXT_FEATURES:
5407                 hci_remote_ext_features_evt(hdev, skb);
5408                 break;
5409
5410         case HCI_EV_SYNC_CONN_COMPLETE:
5411                 hci_sync_conn_complete_evt(hdev, skb);
5412                 break;
5413
5414         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5415                 hci_extended_inquiry_result_evt(hdev, skb);
5416                 break;
5417
5418         case HCI_EV_KEY_REFRESH_COMPLETE:
5419                 hci_key_refresh_complete_evt(hdev, skb);
5420                 break;
5421
5422         case HCI_EV_IO_CAPA_REQUEST:
5423                 hci_io_capa_request_evt(hdev, skb);
5424                 break;
5425
5426         case HCI_EV_IO_CAPA_REPLY:
5427                 hci_io_capa_reply_evt(hdev, skb);
5428                 break;
5429
5430         case HCI_EV_USER_CONFIRM_REQUEST:
5431                 hci_user_confirm_request_evt(hdev, skb);
5432                 break;
5433
5434         case HCI_EV_USER_PASSKEY_REQUEST:
5435                 hci_user_passkey_request_evt(hdev, skb);
5436                 break;
5437
5438         case HCI_EV_USER_PASSKEY_NOTIFY:
5439                 hci_user_passkey_notify_evt(hdev, skb);
5440                 break;
5441
5442         case HCI_EV_KEYPRESS_NOTIFY:
5443                 hci_keypress_notify_evt(hdev, skb);
5444                 break;
5445
5446         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5447                 hci_simple_pair_complete_evt(hdev, skb);
5448                 break;
5449
5450         case HCI_EV_REMOTE_HOST_FEATURES:
5451                 hci_remote_host_features_evt(hdev, skb);
5452                 break;
5453
5454         case HCI_EV_LE_META:
5455                 hci_le_meta_evt(hdev, skb);
5456                 break;
5457
5458         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5459                 hci_remote_oob_data_request_evt(hdev, skb);
5460                 break;
5461
5462 #if IS_ENABLED(CONFIG_BT_HS)
5463         case HCI_EV_CHANNEL_SELECTED:
5464                 hci_chan_selected_evt(hdev, skb);
5465                 break;
5466
5467         case HCI_EV_PHY_LINK_COMPLETE:
5468                 hci_phy_link_complete_evt(hdev, skb);
5469                 break;
5470
5471         case HCI_EV_LOGICAL_LINK_COMPLETE:
5472                 hci_loglink_complete_evt(hdev, skb);
5473                 break;
5474
5475         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5476                 hci_disconn_loglink_complete_evt(hdev, skb);
5477                 break;
5478
5479         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5480                 hci_disconn_phylink_complete_evt(hdev, skb);
5481                 break;
5482 #endif
5483
5484         case HCI_EV_NUM_COMP_BLOCKS:
5485                 hci_num_comp_blocks_evt(hdev, skb);
5486                 break;
5487
5488         default:
5489                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5490                 break;
5491         }
5492
5493         if (req_complete) {
5494                 req_complete(hdev, status, opcode);
5495         } else if (req_complete_skb) {
5496                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5497                         kfree_skb(orig_skb);
5498                         orig_skb = NULL;
5499                 }
5500                 req_complete_skb(hdev, status, opcode, orig_skb);
5501         }
5502
5503 done:
5504         kfree_skb(orig_skb);
5505         kfree_skb(skb);
5506         hdev->stat.evt_rx++;
5507 }