net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  45                                   u8 *new_status)
  46 {
  47         __u8 status = *((__u8 *) skb->data);
  48
  49         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  50
  51         /* It is possible that we receive Inquiry Complete event right
  52          * before we receive Inquiry Cancel Command Complete event, in
  53          * which case the latter event should have status of Command
  54          * Disallowed (0x0c). This should not be treated as error, since
  55          * we actually achieve what Inquiry Cancel wants to achieve,
  56          * which is to end the last Inquiry session.
  57          */
  58         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  59                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  60                 status = 0x00;
  61         }
  62
  63         *new_status = status;
  64
  65         if (status)
  66                 return;
  67
  68         clear_bit(HCI_INQUIRY, &hdev->flags);
  69         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  70         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  71
  72         hci_dev_lock(hdev);
  73         /* Set discovery state to stopped if we're not doing LE active
  74          * scanning.
  75          */
  76         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  77             hdev->le_scan_type != LE_SCAN_ACTIVE)
  78                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  79         hci_dev_unlock(hdev);
  80
  81         hci_conn_check_pending(hdev);
  82 }
  83
  84 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  85 {
  86         __u8 status = *((__u8 *) skb->data);
  87
  88         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  89
  90         if (status)
  91                 return;
  92
  93         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  94 }
  95
  96 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         __u8 status = *((__u8 *) skb->data);
  99
 100         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 101
 102         if (status)
 103                 return;
 104
 105         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 106
 107         hci_conn_check_pending(hdev);
 108 }
 109
 110 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 111                                           struct sk_buff *skb)
 112 {
 113         BT_DBG("%s", hdev->name);
 114 }
 115
 116 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_role_discovery *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->role = rp->role;
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         hci_dev_lock(hdev);
 146
 147         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 148         if (conn)
 149                 conn->link_policy = __le16_to_cpu(rp->policy);
 150
 151         hci_dev_unlock(hdev);
 152 }
 153
 154 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 155 {
 156         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 157         struct hci_conn *conn;
 158         void *sent;
 159
 160         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 161
 162         if (rp->status)
 163                 return;
 164
 165         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 166         if (!sent)
 167                 return;
 168
 169         hci_dev_lock(hdev);
 170
 171         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 172         if (conn)
 173                 conn->link_policy = get_unaligned_le16(sent + 2);
 174
 175         hci_dev_unlock(hdev);
 176 }
 177
 178 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 179                                         struct sk_buff *skb)
 180 {
 181         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 182
 183         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 184
 185         if (rp->status)
 186                 return;
 187
 188         hdev->link_policy = __le16_to_cpu(rp->policy);
 189 }
 190
 191 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 192                                          struct sk_buff *skb)
 193 {
 194         __u8 status = *((__u8 *) skb->data);
 195         void *sent;
 196
 197         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 198
 199         if (status)
 200                 return;
 201
 202         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 203         if (!sent)
 204                 return;
 205
 206         hdev->link_policy = get_unaligned_le16(sent);
 207 }
 208
 209 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 210 {
 211         __u8 status = *((__u8 *) skb->data);
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         clear_bit(HCI_RESET, &hdev->flags);
 216
 217         if (status)
 218                 return;
 219
 220         /* Reset all non-persistent flags */
 221         hci_dev_clear_volatile_flags(hdev);
 222
 223         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 224
 225         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 226         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 227
 228         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 229         hdev->adv_data_len = 0;
 230
 231         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 232         hdev->scan_rsp_data_len = 0;
 233
 234         hdev->le_scan_type = LE_SCAN_PASSIVE;
 235
 236         hdev->ssp_debug_mode = 0;
 237
 238         hci_bdaddr_list_clear(&hdev->le_white_list);
 239         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (hci_dev_test_flag(hdev, HCI_MGMT))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 307             hci_dev_test_flag(hdev, HCI_CONFIG))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (hci_dev_test_flag(hdev, HCI_MGMT))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (hci_dev_test_flag(hdev, HCI_MGMT))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (hci_dev_test_flag(hdev, HCI_MGMT))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 526                 else
 527                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 554                 if (sent->support)
 555                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 556                 else
 557                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 573             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 593             hci_dev_test_flag(hdev, HCI_CONFIG))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (hci_dev_test_flag(hdev, HCI_SETUP))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 return;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859 }
 860
 861 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 862                                          struct sk_buff *skb)
 863 {
 864         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 865
 866         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 867
 868         if (rp->status)
 869                 return;
 870
 871         hdev->inq_tx_power = rp->tx_power;
 872 }
 873
 874 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 877         struct hci_cp_pin_code_reply *cp;
 878         struct hci_conn *conn;
 879
 880         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 881
 882         hci_dev_lock(hdev);
 883
 884         if (hci_dev_test_flag(hdev, HCI_MGMT))
 885                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 886
 887         if (rp->status)
 888                 goto unlock;
 889
 890         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 891         if (!cp)
 892                 goto unlock;
 893
 894         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 895         if (conn)
 896                 conn->pin_length = cp->pin_len;
 897
 898 unlock:
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 903 {
 904         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         hci_dev_lock(hdev);
 909
 910         if (hci_dev_test_flag(hdev, HCI_MGMT))
 911                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 912                                                  rp->status);
 913
 914         hci_dev_unlock(hdev);
 915 }
 916
 917 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 918                                        struct sk_buff *skb)
 919 {
 920         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 921
 922         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 923
 924         if (rp->status)
 925                 return;
 926
 927         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 928         hdev->le_pkts = rp->le_max_pkt;
 929
 930         hdev->le_cnt = hdev->le_pkts;
 931
 932         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 933 }
 934
 935 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 936                                           struct sk_buff *skb)
 937 {
 938         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 941
 942         if (rp->status)
 943                 return;
 944
 945         memcpy(hdev->le_features, rp->features, 8);
 946 }
 947
 948 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 949                                         struct sk_buff *skb)
 950 {
 951         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 952
 953         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 954
 955         if (rp->status)
 956                 return;
 957
 958         hdev->adv_tx_power = rp->tx_power;
 959 }
 960
 961 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 962 {
 963         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 964
 965         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 966
 967         hci_dev_lock(hdev);
 968
 969         if (hci_dev_test_flag(hdev, HCI_MGMT))
 970                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 971                                                  rp->status);
 972
 973         hci_dev_unlock(hdev);
 974 }
 975
 976 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 977                                           struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (hci_dev_test_flag(hdev, HCI_MGMT))
 986                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 987                                                      ACL_LINK, 0, rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 993 {
 994         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 995
 996         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 997
 998         hci_dev_lock(hdev);
 999
1000         if (hci_dev_test_flag(hdev, HCI_MGMT))
1001                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1002                                                  0, rp->status);
1003
1004         hci_dev_unlock(hdev);
1005 }
1006
1007 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1008                                           struct sk_buff *skb)
1009 {
1010         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1011
1012         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1013
1014         hci_dev_lock(hdev);
1015
1016         if (hci_dev_test_flag(hdev, HCI_MGMT))
1017                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1018                                                      ACL_LINK, 0, rp->status);
1019
1020         hci_dev_unlock(hdev);
1021 }
1022
1023 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1024                                        struct sk_buff *skb)
1025 {
1026         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1027
1028         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1029 }
1030
1031 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1032                                            struct sk_buff *skb)
1033 {
1034         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037 }
1038
1039 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1040 {
1041         __u8 status = *((__u8 *) skb->data);
1042         bdaddr_t *sent;
1043
1044         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1045
1046         if (status)
1047                 return;
1048
1049         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1050         if (!sent)
1051                 return;
1052
1053         hci_dev_lock(hdev);
1054
1055         bacpy(&hdev->random_addr, sent);
1056
1057         hci_dev_unlock(hdev);
1058 }
1059
1060 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1061 {
1062         __u8 status = *((__u8 *) skb->data);
1063         struct hci_cp_le_set_default_phy *cp;
1064
1065         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1066
1067         if (status)
1068                 return;
1069
1070         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1071         if (!cp)
1072                 return;
1073
1074         hci_dev_lock(hdev);
1075
1076         hdev->le_tx_def_phys = cp->tx_phys;
1077         hdev->le_rx_def_phys = cp->rx_phys;
1078
1079         hci_dev_unlock(hdev);
1080 }
1081
1082 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1083                                               struct sk_buff *skb)
1084 {
1085         __u8 status = *((__u8 *) skb->data);
1086         struct hci_cp_le_set_adv_set_rand_addr *cp;
1087         struct adv_info *adv_instance;
1088
1089         if (status)
1090                 return;
1091
1092         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1093         if (!cp)
1094                 return;
1095
1096         hci_dev_lock(hdev);
1097
1098         if (!hdev->cur_adv_instance) {
1099                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1100                 bacpy(&hdev->random_addr, &cp->bdaddr);
1101         } else {
1102                 adv_instance = hci_find_adv_instance(hdev,
1103                                                      hdev->cur_adv_instance);
1104                 if (adv_instance)
1105                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1106         }
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         __u8 *sent, status = *((__u8 *) skb->data);
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1116
1117         if (status)
1118                 return;
1119
1120         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1121         if (!sent)
1122                 return;
1123
1124         hci_dev_lock(hdev);
1125
1126         /* If we're doing connection initiation as peripheral. Set a
1127          * timeout in case something goes wrong.
1128          */
1129         if (*sent) {
1130                 struct hci_conn *conn;
1131
1132                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1133
1134                 conn = hci_lookup_le_connect(hdev);
1135                 if (conn)
1136                         queue_delayed_work(hdev->workqueue,
1137                                            &conn->le_conn_timeout,
1138                                            conn->conn_timeout);
1139         } else {
1140                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1141         }
1142
1143         hci_dev_unlock(hdev);
1144 }
1145
1146 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1147                                          struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_ext_adv_enable *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         if (cp->enable) {
1164                 struct hci_conn *conn;
1165
1166                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1167
1168                 conn = hci_lookup_le_connect(hdev);
1169                 if (conn)
1170                         queue_delayed_work(hdev->workqueue,
1171                                            &conn->le_conn_timeout,
1172                                            conn->conn_timeout);
1173         } else {
1174                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1175         }
1176
1177         hci_dev_unlock(hdev);
1178 }
1179
1180 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1181 {
1182         struct hci_cp_le_set_scan_param *cp;
1183         __u8 status = *((__u8 *) skb->data);
1184
1185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1186
1187         if (status)
1188                 return;
1189
1190         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1191         if (!cp)
1192                 return;
1193
1194         hci_dev_lock(hdev);
1195
1196         hdev->le_scan_type = cp->type;
1197
1198         hci_dev_unlock(hdev);
1199 }
1200
1201 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1202                                          struct sk_buff *skb)
1203 {
1204         struct hci_cp_le_set_ext_scan_params *cp;
1205         __u8 status = *((__u8 *) skb->data);
1206         struct hci_cp_le_scan_phy_params *phy_param;
1207
1208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1209
1210         if (status)
1211                 return;
1212
1213         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1214         if (!cp)
1215                 return;
1216
1217         phy_param = (void *)cp->data;
1218
1219         hci_dev_lock(hdev);
1220
1221         hdev->le_scan_type = phy_param->type;
1222
1223         hci_dev_unlock(hdev);
1224 }
1225
1226 static bool has_pending_adv_report(struct hci_dev *hdev)
1227 {
1228         struct discovery_state *d = &hdev->discovery;
1229
1230         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1231 }
1232
1233 static void clear_pending_adv_report(struct hci_dev *hdev)
1234 {
1235         struct discovery_state *d = &hdev->discovery;
1236
1237         bacpy(&d->last_adv_addr, BDADDR_ANY);
1238         d->last_adv_data_len = 0;
1239 }
1240
1241 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1242                                      u8 bdaddr_type, s8 rssi, u32 flags,
1243                                      u8 *data, u8 len)
1244 {
1245         struct discovery_state *d = &hdev->discovery;
1246
1247         if (len > HCI_MAX_AD_LENGTH)
1248                 return;
1249
1250         bacpy(&d->last_adv_addr, bdaddr);
1251         d->last_adv_addr_type = bdaddr_type;
1252         d->last_adv_rssi = rssi;
1253         d->last_adv_flags = flags;
1254         memcpy(d->last_adv_data, data, len);
1255         d->last_adv_data_len = len;
1256 }
1257
1258 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1259 {
1260         hci_dev_lock(hdev);
1261
1262         switch (enable) {
1263         case LE_SCAN_ENABLE:
1264                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1265                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1266                         clear_pending_adv_report(hdev);
1267                 break;
1268
1269         case LE_SCAN_DISABLE:
1270                 /* We do this here instead of when setting DISCOVERY_STOPPED
1271                  * since the latter would potentially require waiting for
1272                  * inquiry to stop too.
1273                  */
1274                 if (has_pending_adv_report(hdev)) {
1275                         struct discovery_state *d = &hdev->discovery;
1276
1277                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1278                                           d->last_adv_addr_type, NULL,
1279                                           d->last_adv_rssi, d->last_adv_flags,
1280                                           d->last_adv_data,
1281                                           d->last_adv_data_len, NULL, 0);
1282                 }
1283
1284                 /* Cancel this timer so that we don't try to disable scanning
1285                  * when it's already disabled.
1286                  */
1287                 cancel_delayed_work(&hdev->le_scan_disable);
1288
1289                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1290
1291                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1292                  * interrupted scanning due to a connect request. Mark
1293                  * therefore discovery as stopped. If this was not
1294                  * because of a connect request advertising might have
1295                  * been disabled because of active scanning, so
1296                  * re-enable it again if necessary.
1297                  */
1298                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1299                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1300                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1301                          hdev->discovery.state == DISCOVERY_FINDING)
1302                         hci_req_reenable_advertising(hdev);
1303
1304                 break;
1305
1306         default:
1307                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1308                            enable);
1309                 break;
1310         }
1311
1312         hci_dev_unlock(hdev);
1313 }
1314
1315 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1316                                       struct sk_buff *skb)
1317 {
1318         struct hci_cp_le_set_scan_enable *cp;
1319         __u8 status = *((__u8 *) skb->data);
1320
1321         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1322
1323         if (status)
1324                 return;
1325
1326         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1327         if (!cp)
1328                 return;
1329
1330         le_set_scan_enable_complete(hdev, cp->enable);
1331 }
1332
1333 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1334                                       struct sk_buff *skb)
1335 {
1336         struct hci_cp_le_set_ext_scan_enable *cp;
1337         __u8 status = *((__u8 *) skb->data);
1338
1339         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1340
1341         if (status)
1342                 return;
1343
1344         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1345         if (!cp)
1346                 return;
1347
1348         le_set_scan_enable_complete(hdev, cp->enable);
1349 }
1350
1351 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1352                                       struct sk_buff *skb)
1353 {
1354         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1355
1356         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1357                rp->num_of_sets);
1358
1359         if (rp->status)
1360                 return;
1361
1362         hdev->le_num_of_adv_sets = rp->num_of_sets;
1363 }
1364
1365 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1366                                            struct sk_buff *skb)
1367 {
1368         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1369
1370         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1371
1372         if (rp->status)
1373                 return;
1374
1375         hdev->le_white_list_size = rp->size;
1376 }
1377
1378 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1379                                        struct sk_buff *skb)
1380 {
1381         __u8 status = *((__u8 *) skb->data);
1382
1383         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1384
1385         if (status)
1386                 return;
1387
1388         hci_bdaddr_list_clear(&hdev->le_white_list);
1389 }
1390
1391 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1392                                         struct sk_buff *skb)
1393 {
1394         struct hci_cp_le_add_to_white_list *sent;
1395         __u8 status = *((__u8 *) skb->data);
1396
1397         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1398
1399         if (status)
1400                 return;
1401
1402         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1403         if (!sent)
1404                 return;
1405
1406         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1407                            sent->bdaddr_type);
1408 }
1409
1410 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1411                                           struct sk_buff *skb)
1412 {
1413         struct hci_cp_le_del_from_white_list *sent;
1414         __u8 status = *((__u8 *) skb->data);
1415
1416         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1417
1418         if (status)
1419                 return;
1420
1421         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1422         if (!sent)
1423                 return;
1424
1425         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1426                             sent->bdaddr_type);
1427 }
1428
1429 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1430                                             struct sk_buff *skb)
1431 {
1432         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1433
1434         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1435
1436         if (rp->status)
1437                 return;
1438
1439         memcpy(hdev->le_states, rp->le_states, 8);
1440 }
1441
1442 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1443                                         struct sk_buff *skb)
1444 {
1445         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1446
1447         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1448
1449         if (rp->status)
1450                 return;
1451
1452         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1453         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1454 }
1455
1456 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1457                                          struct sk_buff *skb)
1458 {
1459         struct hci_cp_le_write_def_data_len *sent;
1460         __u8 status = *((__u8 *) skb->data);
1461
1462         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1463
1464         if (status)
1465                 return;
1466
1467         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1468         if (!sent)
1469                 return;
1470
1471         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1472         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1473 }
1474
1475 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1476                                        struct sk_buff *skb)
1477 {
1478         __u8 status = *((__u8 *) skb->data);
1479
1480         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1481
1482         if (status)
1483                 return;
1484
1485         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1486 }
1487
1488 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1489                                            struct sk_buff *skb)
1490 {
1491         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1492
1493         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1494
1495         if (rp->status)
1496                 return;
1497
1498         hdev->le_resolv_list_size = rp->size;
1499 }
1500
1501 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1502                                                 struct sk_buff *skb)
1503 {
1504         __u8 *sent, status = *((__u8 *) skb->data);
1505
1506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1507
1508         if (status)
1509                 return;
1510
1511         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1512         if (!sent)
1513                 return;
1514
1515         hci_dev_lock(hdev);
1516
1517         if (*sent)
1518                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1519         else
1520                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1521
1522         hci_dev_unlock(hdev);
1523 }
1524
1525 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1526                                         struct sk_buff *skb)
1527 {
1528         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1529
1530         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1531
1532         if (rp->status)
1533                 return;
1534
1535         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1536         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1537         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1538         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1539 }
1540
1541 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1542                                            struct sk_buff *skb)
1543 {
1544         struct hci_cp_write_le_host_supported *sent;
1545         __u8 status = *((__u8 *) skb->data);
1546
1547         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1548
1549         if (status)
1550                 return;
1551
1552         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1553         if (!sent)
1554                 return;
1555
1556         hci_dev_lock(hdev);
1557
1558         if (sent->le) {
1559                 hdev->features[1][0] |= LMP_HOST_LE;
1560                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1561         } else {
1562                 hdev->features[1][0] &= ~LMP_HOST_LE;
1563                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1564                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1565         }
1566
1567         if (sent->simul)
1568                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1569         else
1570                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1571
1572         hci_dev_unlock(hdev);
1573 }
1574
1575 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1576 {
1577         struct hci_cp_le_set_adv_param *cp;
1578         u8 status = *((u8 *) skb->data);
1579
1580         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1581
1582         if (status)
1583                 return;
1584
1585         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1586         if (!cp)
1587                 return;
1588
1589         hci_dev_lock(hdev);
1590         hdev->adv_addr_type = cp->own_address_type;
1591         hci_dev_unlock(hdev);
1592 }
1593
1594 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1595 {
1596         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1597         struct hci_cp_le_set_ext_adv_params *cp;
1598         struct adv_info *adv_instance;
1599
1600         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1601
1602         if (rp->status)
1603                 return;
1604
1605         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1606         if (!cp)
1607                 return;
1608
1609         hci_dev_lock(hdev);
1610         hdev->adv_addr_type = cp->own_addr_type;
1611         if (!hdev->cur_adv_instance) {
1612                 /* Store in hdev for instance 0 */
1613                 hdev->adv_tx_power = rp->tx_power;
1614         } else {
1615                 adv_instance = hci_find_adv_instance(hdev,
1616                                                      hdev->cur_adv_instance);
1617                 if (adv_instance)
1618                         adv_instance->tx_power = rp->tx_power;
1619         }
1620         /* Update adv data as tx power is known now */
1621         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1622         hci_dev_unlock(hdev);
1623 }
1624
1625 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1626 {
1627         struct hci_rp_read_rssi *rp = (void *) skb->data;
1628         struct hci_conn *conn;
1629
1630         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1631
1632         if (rp->status)
1633                 return;
1634
1635         hci_dev_lock(hdev);
1636
1637         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1638         if (conn)
1639                 conn->rssi = rp->rssi;
1640
1641         hci_dev_unlock(hdev);
1642 }
1643
1644 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1645 {
1646         struct hci_cp_read_tx_power *sent;
1647         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1648         struct hci_conn *conn;
1649
1650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1651
1652         if (rp->status)
1653                 return;
1654
1655         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1656         if (!sent)
1657                 return;
1658
1659         hci_dev_lock(hdev);
1660
1661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1662         if (!conn)
1663                 goto unlock;
1664
1665         switch (sent->type) {
1666         case 0x00:
1667                 conn->tx_power = rp->tx_power;
1668                 break;
1669         case 0x01:
1670                 conn->max_tx_power = rp->tx_power;
1671                 break;
1672         }
1673
1674 unlock:
1675         hci_dev_unlock(hdev);
1676 }
1677
1678 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1679 {
1680         u8 status = *((u8 *) skb->data);
1681         u8 *mode;
1682
1683         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1684
1685         if (status)
1686                 return;
1687
1688         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1689         if (mode)
1690                 hdev->ssp_debug_mode = *mode;
1691 }
1692
1693 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1694 {
1695         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1696
1697         if (status) {
1698                 hci_conn_check_pending(hdev);
1699                 return;
1700         }
1701
1702         set_bit(HCI_INQUIRY, &hdev->flags);
1703 }
1704
1705 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1706 {
1707         struct hci_cp_create_conn *cp;
1708         struct hci_conn *conn;
1709
1710         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1711
1712         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1713         if (!cp)
1714                 return;
1715
1716         hci_dev_lock(hdev);
1717
1718         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1719
1720         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1721
1722         if (status) {
1723                 if (conn && conn->state == BT_CONNECT) {
1724                         if (status != 0x0c || conn->attempt > 2) {
1725                                 conn->state = BT_CLOSED;
1726                                 hci_connect_cfm(conn, status);
1727                                 hci_conn_del(conn);
1728                         } else
1729                                 conn->state = BT_CONNECT2;
1730                 }
1731         } else {
1732                 if (!conn) {
1733                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1734                                             HCI_ROLE_MASTER);
1735                         if (!conn)
1736                                 bt_dev_err(hdev, "no memory for new connection");
1737                 }
1738         }
1739
1740         hci_dev_unlock(hdev);
1741 }
1742
1743 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1744 {
1745         struct hci_cp_add_sco *cp;
1746         struct hci_conn *acl, *sco;
1747         __u16 handle;
1748
1749         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1750
1751         if (!status)
1752                 return;
1753
1754         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1755         if (!cp)
1756                 return;
1757
1758         handle = __le16_to_cpu(cp->handle);
1759
1760         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1761
1762         hci_dev_lock(hdev);
1763
1764         acl = hci_conn_hash_lookup_handle(hdev, handle);
1765         if (acl) {
1766                 sco = acl->link;
1767                 if (sco) {
1768                         sco->state = BT_CLOSED;
1769
1770                         hci_connect_cfm(sco, status);
1771                         hci_conn_del(sco);
1772                 }
1773         }
1774
1775         hci_dev_unlock(hdev);
1776 }
1777
1778 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1779 {
1780         struct hci_cp_auth_requested *cp;
1781         struct hci_conn *conn;
1782
1783         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1784
1785         if (!status)
1786                 return;
1787
1788         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1789         if (!cp)
1790                 return;
1791
1792         hci_dev_lock(hdev);
1793
1794         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1795         if (conn) {
1796                 if (conn->state == BT_CONFIG) {
1797                         hci_connect_cfm(conn, status);
1798                         hci_conn_drop(conn);
1799                 }
1800         }
1801
1802         hci_dev_unlock(hdev);
1803 }
1804
1805 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1806 {
1807         struct hci_cp_set_conn_encrypt *cp;
1808         struct hci_conn *conn;
1809
1810         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1811
1812         if (!status)
1813                 return;
1814
1815         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1816         if (!cp)
1817                 return;
1818
1819         hci_dev_lock(hdev);
1820
1821         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1822         if (conn) {
1823                 if (conn->state == BT_CONFIG) {
1824                         hci_connect_cfm(conn, status);
1825                         hci_conn_drop(conn);
1826                 }
1827         }
1828
1829         hci_dev_unlock(hdev);
1830 }
1831
1832 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1833                                     struct hci_conn *conn)
1834 {
1835         if (conn->state != BT_CONFIG || !conn->out)
1836                 return 0;
1837
1838         if (conn->pending_sec_level == BT_SECURITY_SDP)
1839                 return 0;
1840
1841         /* Only request authentication for SSP connections or non-SSP
1842          * devices with sec_level MEDIUM or HIGH or if MITM protection
1843          * is requested.
1844          */
1845         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1846             conn->pending_sec_level != BT_SECURITY_FIPS &&
1847             conn->pending_sec_level != BT_SECURITY_HIGH &&
1848             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1849                 return 0;
1850
1851         return 1;
1852 }
1853
1854 static int hci_resolve_name(struct hci_dev *hdev,
1855                                    struct inquiry_entry *e)
1856 {
1857         struct hci_cp_remote_name_req cp;
1858
1859         memset(&cp, 0, sizeof(cp));
1860
1861         bacpy(&cp.bdaddr, &e->data.bdaddr);
1862         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1863         cp.pscan_mode = e->data.pscan_mode;
1864         cp.clock_offset = e->data.clock_offset;
1865
1866         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1867 }
1868
1869 static bool hci_resolve_next_name(struct hci_dev *hdev)
1870 {
1871         struct discovery_state *discov = &hdev->discovery;
1872         struct inquiry_entry *e;
1873
1874         if (list_empty(&discov->resolve))
1875                 return false;
1876
1877         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1878         if (!e)
1879                 return false;
1880
1881         if (hci_resolve_name(hdev, e) == 0) {
1882                 e->name_state = NAME_PENDING;
1883                 return true;
1884         }
1885
1886         return false;
1887 }
1888
1889 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1890                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1891 {
1892         struct discovery_state *discov = &hdev->discovery;
1893         struct inquiry_entry *e;
1894
1895         /* Update the mgmt connected state if necessary. Be careful with
1896          * conn objects that exist but are not (yet) connected however.
1897          * Only those in BT_CONFIG or BT_CONNECTED states can be
1898          * considered connected.
1899          */
1900         if (conn &&
1901             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1902             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1903                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1904
1905         if (discov->state == DISCOVERY_STOPPED)
1906                 return;
1907
1908         if (discov->state == DISCOVERY_STOPPING)
1909                 goto discov_complete;
1910
1911         if (discov->state != DISCOVERY_RESOLVING)
1912                 return;
1913
1914         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1915         /* If the device was not found in a list of found devices names of which
1916          * are pending. there is no need to continue resolving a next name as it
1917          * will be done upon receiving another Remote Name Request Complete
1918          * Event */
1919         if (!e)
1920                 return;
1921
1922         list_del(&e->list);
1923         if (name) {
1924                 e->name_state = NAME_KNOWN;
1925                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1926                                  e->data.rssi, name, name_len);
1927         } else {
1928                 e->name_state = NAME_NOT_KNOWN;
1929         }
1930
1931         if (hci_resolve_next_name(hdev))
1932                 return;
1933
1934 discov_complete:
1935         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1936 }
1937
1938 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1939 {
1940         struct hci_cp_remote_name_req *cp;
1941         struct hci_conn *conn;
1942
1943         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1944
1945         /* If successful wait for the name req complete event before
1946          * checking for the need to do authentication */
1947         if (!status)
1948                 return;
1949
1950         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1951         if (!cp)
1952                 return;
1953
1954         hci_dev_lock(hdev);
1955
1956         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1957
1958         if (hci_dev_test_flag(hdev, HCI_MGMT))
1959                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1960
1961         if (!conn)
1962                 goto unlock;
1963
1964         if (!hci_outgoing_auth_needed(hdev, conn))
1965                 goto unlock;
1966
1967         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1968                 struct hci_cp_auth_requested auth_cp;
1969
1970                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1971
1972                 auth_cp.handle = __cpu_to_le16(conn->handle);
1973                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1974                              sizeof(auth_cp), &auth_cp);
1975         }
1976
1977 unlock:
1978         hci_dev_unlock(hdev);
1979 }
1980
1981 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1982 {
1983         struct hci_cp_read_remote_features *cp;
1984         struct hci_conn *conn;
1985
1986         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1987
1988         if (!status)
1989                 return;
1990
1991         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1992         if (!cp)
1993                 return;
1994
1995         hci_dev_lock(hdev);
1996
1997         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1998         if (conn) {
1999                 if (conn->state == BT_CONFIG) {
2000                         hci_connect_cfm(conn, status);
2001                         hci_conn_drop(conn);
2002                 }
2003         }
2004
2005         hci_dev_unlock(hdev);
2006 }
2007
2008 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2009 {
2010         struct hci_cp_read_remote_ext_features *cp;
2011         struct hci_conn *conn;
2012
2013         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2014
2015         if (!status)
2016                 return;
2017
2018         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2019         if (!cp)
2020                 return;
2021
2022         hci_dev_lock(hdev);
2023
2024         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2025         if (conn) {
2026                 if (conn->state == BT_CONFIG) {
2027                         hci_connect_cfm(conn, status);
2028                         hci_conn_drop(conn);
2029                 }
2030         }
2031
2032         hci_dev_unlock(hdev);
2033 }
2034
2035 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2036 {
2037         struct hci_cp_setup_sync_conn *cp;
2038         struct hci_conn *acl, *sco;
2039         __u16 handle;
2040
2041         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2042
2043         if (!status)
2044                 return;
2045
2046         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2047         if (!cp)
2048                 return;
2049
2050         handle = __le16_to_cpu(cp->handle);
2051
2052         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2053
2054         hci_dev_lock(hdev);
2055
2056         acl = hci_conn_hash_lookup_handle(hdev, handle);
2057         if (acl) {
2058                 sco = acl->link;
2059                 if (sco) {
2060                         sco->state = BT_CLOSED;
2061
2062                         hci_connect_cfm(sco, status);
2063                         hci_conn_del(sco);
2064                 }
2065         }
2066
2067         hci_dev_unlock(hdev);
2068 }
2069
2070 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2071 {
2072         struct hci_cp_sniff_mode *cp;
2073         struct hci_conn *conn;
2074
2075         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2076
2077         if (!status)
2078                 return;
2079
2080         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2081         if (!cp)
2082                 return;
2083
2084         hci_dev_lock(hdev);
2085
2086         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2087         if (conn) {
2088                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2089
2090                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2091                         hci_sco_setup(conn, status);
2092         }
2093
2094         hci_dev_unlock(hdev);
2095 }
2096
2097 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2098 {
2099         struct hci_cp_exit_sniff_mode *cp;
2100         struct hci_conn *conn;
2101
2102         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2103
2104         if (!status)
2105                 return;
2106
2107         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2108         if (!cp)
2109                 return;
2110
2111         hci_dev_lock(hdev);
2112
2113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2114         if (conn) {
2115                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2116
2117                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2118                         hci_sco_setup(conn, status);
2119         }
2120
2121         hci_dev_unlock(hdev);
2122 }
2123
2124 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2125 {
2126         struct hci_cp_disconnect *cp;
2127         struct hci_conn *conn;
2128
2129         if (!status)
2130                 return;
2131
2132         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2133         if (!cp)
2134                 return;
2135
2136         hci_dev_lock(hdev);
2137
2138         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2139         if (conn)
2140                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2141                                        conn->dst_type, status);
2142
2143         hci_dev_unlock(hdev);
2144 }
2145
2146 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2147                               u8 peer_addr_type, u8 own_address_type,
2148                               u8 filter_policy)
2149 {
2150         struct hci_conn *conn;
2151
2152         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2153                                        peer_addr_type);
2154         if (!conn)
2155                 return;
2156
2157         /* Store the initiator and responder address information which
2158          * is needed for SMP. These values will not change during the
2159          * lifetime of the connection.
2160          */
2161         conn->init_addr_type = own_address_type;
2162         if (own_address_type == ADDR_LE_DEV_RANDOM)
2163                 bacpy(&conn->init_addr, &hdev->random_addr);
2164         else
2165                 bacpy(&conn->init_addr, &hdev->bdaddr);
2166
2167         conn->resp_addr_type = peer_addr_type;
2168         bacpy(&conn->resp_addr, peer_addr);
2169
2170         /* We don't want the connection attempt to stick around
2171          * indefinitely since LE doesn't have a page timeout concept
2172          * like BR/EDR. Set a timer for any connection that doesn't use
2173          * the white list for connecting.
2174          */
2175         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2176                 queue_delayed_work(conn->hdev->workqueue,
2177                                    &conn->le_conn_timeout,
2178                                    conn->conn_timeout);
2179 }
2180
2181 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2182 {
2183         struct hci_cp_le_create_conn *cp;
2184
2185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2186
2187         /* All connection failure handling is taken care of by the
2188          * hci_le_conn_failed function which is triggered by the HCI
2189          * request completion callbacks used for connecting.
2190          */
2191         if (status)
2192                 return;
2193
2194         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2195         if (!cp)
2196                 return;
2197
2198         hci_dev_lock(hdev);
2199
2200         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2201                           cp->own_address_type, cp->filter_policy);
2202
2203         hci_dev_unlock(hdev);
2204 }
2205
2206 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2207 {
2208         struct hci_cp_le_ext_create_conn *cp;
2209
2210         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2211
2212         /* All connection failure handling is taken care of by the
2213          * hci_le_conn_failed function which is triggered by the HCI
2214          * request completion callbacks used for connecting.
2215          */
2216         if (status)
2217                 return;
2218
2219         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2220         if (!cp)
2221                 return;
2222
2223         hci_dev_lock(hdev);
2224
2225         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2226                           cp->own_addr_type, cp->filter_policy);
2227
2228         hci_dev_unlock(hdev);
2229 }
2230
2231 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2232 {
2233         struct hci_cp_le_read_remote_features *cp;
2234         struct hci_conn *conn;
2235
2236         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2237
2238         if (!status)
2239                 return;
2240
2241         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2242         if (!cp)
2243                 return;
2244
2245         hci_dev_lock(hdev);
2246
2247         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2248         if (conn) {
2249                 if (conn->state == BT_CONFIG) {
2250                         hci_connect_cfm(conn, status);
2251                         hci_conn_drop(conn);
2252                 }
2253         }
2254
2255         hci_dev_unlock(hdev);
2256 }
2257
2258 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2259 {
2260         struct hci_cp_le_start_enc *cp;
2261         struct hci_conn *conn;
2262
2263         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2264
2265         if (!status)
2266                 return;
2267
2268         hci_dev_lock(hdev);
2269
2270         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2271         if (!cp)
2272                 goto unlock;
2273
2274         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2275         if (!conn)
2276                 goto unlock;
2277
2278         if (conn->state != BT_CONNECTED)
2279                 goto unlock;
2280
2281         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2282         hci_conn_drop(conn);
2283
2284 unlock:
2285         hci_dev_unlock(hdev);
2286 }
2287
2288 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2289 {
2290         struct hci_cp_switch_role *cp;
2291         struct hci_conn *conn;
2292
2293         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2294
2295         if (!status)
2296                 return;
2297
2298         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2299         if (!cp)
2300                 return;
2301
2302         hci_dev_lock(hdev);
2303
2304         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2305         if (conn)
2306                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2307
2308         hci_dev_unlock(hdev);
2309 }
2310
2311 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2312 {
2313         __u8 status = *((__u8 *) skb->data);
2314         struct discovery_state *discov = &hdev->discovery;
2315         struct inquiry_entry *e;
2316
2317         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2318
2319         hci_conn_check_pending(hdev);
2320
2321         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2322                 return;
2323
2324         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2325         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2326
2327         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2328                 return;
2329
2330         hci_dev_lock(hdev);
2331
2332         if (discov->state != DISCOVERY_FINDING)
2333                 goto unlock;
2334
2335         if (list_empty(&discov->resolve)) {
2336                 /* When BR/EDR inquiry is active and no LE scanning is in
2337                  * progress, then change discovery state to indicate completion.
2338                  *
2339                  * When running LE scanning and BR/EDR inquiry simultaneously
2340                  * and the LE scan already finished, then change the discovery
2341                  * state to indicate completion.
2342                  */
2343                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2344                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2345                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2346                 goto unlock;
2347         }
2348
2349         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2350         if (e && hci_resolve_name(hdev, e) == 0) {
2351                 e->name_state = NAME_PENDING;
2352                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2353         } else {
2354                 /* When BR/EDR inquiry is active and no LE scanning is in
2355                  * progress, then change discovery state to indicate completion.
2356                  *
2357                  * When running LE scanning and BR/EDR inquiry simultaneously
2358                  * and the LE scan already finished, then change the discovery
2359                  * state to indicate completion.
2360                  */
2361                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2362                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2363                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2364         }
2365
2366 unlock:
2367         hci_dev_unlock(hdev);
2368 }
2369
2370 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2371 {
2372         struct inquiry_data data;
2373         struct inquiry_info *info = (void *) (skb->data + 1);
2374         int num_rsp = *((__u8 *) skb->data);
2375
2376         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2377
2378         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2379                 return;
2380
2381         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2382                 return;
2383
2384         hci_dev_lock(hdev);
2385
2386         for (; num_rsp; num_rsp--, info++) {
2387                 u32 flags;
2388
2389                 bacpy(&data.bdaddr, &info->bdaddr);
2390                 data.pscan_rep_mode     = info->pscan_rep_mode;
2391                 data.pscan_period_mode  = info->pscan_period_mode;
2392                 data.pscan_mode         = info->pscan_mode;
2393                 memcpy(data.dev_class, info->dev_class, 3);
2394                 data.clock_offset       = info->clock_offset;
2395                 data.rssi               = HCI_RSSI_INVALID;
2396                 data.ssp_mode           = 0x00;
2397
2398                 flags = hci_inquiry_cache_update(hdev, &data, false);
2399
2400                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2401                                   info->dev_class, HCI_RSSI_INVALID,
2402                                   flags, NULL, 0, NULL, 0);
2403         }
2404
2405         hci_dev_unlock(hdev);
2406 }
2407
2408 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2409 {
2410         struct hci_ev_conn_complete *ev = (void *) skb->data;
2411         struct hci_conn *conn;
2412
2413         BT_DBG("%s", hdev->name);
2414
2415         hci_dev_lock(hdev);
2416
2417         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2418         if (!conn) {
2419                 if (ev->link_type != SCO_LINK)
2420                         goto unlock;
2421
2422                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2423                 if (!conn)
2424                         goto unlock;
2425
2426                 conn->type = SCO_LINK;
2427         }
2428
2429         if (!ev->status) {
2430                 conn->handle = __le16_to_cpu(ev->handle);
2431
2432                 if (conn->type == ACL_LINK) {
2433                         conn->state = BT_CONFIG;
2434                         hci_conn_hold(conn);
2435
2436                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2437                             !hci_find_link_key(hdev, &ev->bdaddr))
2438                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2439                         else
2440                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2441                 } else
2442                         conn->state = BT_CONNECTED;
2443
2444                 hci_debugfs_create_conn(conn);
2445                 hci_conn_add_sysfs(conn);
2446
2447                 if (test_bit(HCI_AUTH, &hdev->flags))
2448                         set_bit(HCI_CONN_AUTH, &conn->flags);
2449
2450                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2451                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2452
2453                 /* Get remote features */
2454                 if (conn->type == ACL_LINK) {
2455                         struct hci_cp_read_remote_features cp;
2456                         cp.handle = ev->handle;
2457                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2458                                      sizeof(cp), &cp);
2459
2460                         hci_req_update_scan(hdev);
2461                 }
2462
2463                 /* Set packet type for incoming connection */
2464                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2465                         struct hci_cp_change_conn_ptype cp;
2466                         cp.handle = ev->handle;
2467                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2468                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2469                                      &cp);
2470                 }
2471         } else {
2472                 conn->state = BT_CLOSED;
2473                 if (conn->type == ACL_LINK)
2474                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2475                                             conn->dst_type, ev->status);
2476         }
2477
2478         if (conn->type == ACL_LINK)
2479                 hci_sco_setup(conn, ev->status);
2480
2481         if (ev->status) {
2482                 hci_connect_cfm(conn, ev->status);
2483                 hci_conn_del(conn);
2484         } else if (ev->link_type != ACL_LINK)
2485                 hci_connect_cfm(conn, ev->status);
2486
2487 unlock:
2488         hci_dev_unlock(hdev);
2489
2490         hci_conn_check_pending(hdev);
2491 }
2492
2493 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2494 {
2495         struct hci_cp_reject_conn_req cp;
2496
2497         bacpy(&cp.bdaddr, bdaddr);
2498         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2499         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2500 }
2501
2502 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2503 {
2504         struct hci_ev_conn_request *ev = (void *) skb->data;
2505         int mask = hdev->link_mode;
2506         struct inquiry_entry *ie;
2507         struct hci_conn *conn;
2508         __u8 flags = 0;
2509
2510         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2511                ev->link_type);
2512
2513         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2514                                       &flags);
2515
2516         if (!(mask & HCI_LM_ACCEPT)) {
2517                 hci_reject_conn(hdev, &ev->bdaddr);
2518                 return;
2519         }
2520
2521         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2522                                    BDADDR_BREDR)) {
2523                 hci_reject_conn(hdev, &ev->bdaddr);
2524                 return;
2525         }
2526
2527         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2528          * connection. These features are only touched through mgmt so
2529          * only do the checks if HCI_MGMT is set.
2530          */
2531         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2532             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2533             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2534                                     BDADDR_BREDR)) {
2535                     hci_reject_conn(hdev, &ev->bdaddr);
2536                     return;
2537         }
2538
2539         /* Connection accepted */
2540
2541         hci_dev_lock(hdev);
2542
2543         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2544         if (ie)
2545                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2546
2547         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2548                         &ev->bdaddr);
2549         if (!conn) {
2550                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2551                                     HCI_ROLE_SLAVE);
2552                 if (!conn) {
2553                         bt_dev_err(hdev, "no memory for new connection");
2554                         hci_dev_unlock(hdev);
2555                         return;
2556                 }
2557         }
2558
2559         memcpy(conn->dev_class, ev->dev_class, 3);
2560
2561         hci_dev_unlock(hdev);
2562
2563         if (ev->link_type == ACL_LINK ||
2564             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2565                 struct hci_cp_accept_conn_req cp;
2566                 conn->state = BT_CONNECT;
2567
2568                 bacpy(&cp.bdaddr, &ev->bdaddr);
2569
2570                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2571                         cp.role = 0x00; /* Become master */
2572                 else
2573                         cp.role = 0x01; /* Remain slave */
2574
2575                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2576         } else if (!(flags & HCI_PROTO_DEFER)) {
2577                 struct hci_cp_accept_sync_conn_req cp;
2578                 conn->state = BT_CONNECT;
2579
2580                 bacpy(&cp.bdaddr, &ev->bdaddr);
2581                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2582
2583                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2584                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2585                 cp.max_latency    = cpu_to_le16(0xffff);
2586                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2587                 cp.retrans_effort = 0xff;
2588
2589                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2590                              &cp);
2591         } else {
2592                 conn->state = BT_CONNECT2;
2593                 hci_connect_cfm(conn, 0);
2594         }
2595 }
2596
2597 static u8 hci_to_mgmt_reason(u8 err)
2598 {
2599         switch (err) {
2600         case HCI_ERROR_CONNECTION_TIMEOUT:
2601                 return MGMT_DEV_DISCONN_TIMEOUT;
2602         case HCI_ERROR_REMOTE_USER_TERM:
2603         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2604         case HCI_ERROR_REMOTE_POWER_OFF:
2605                 return MGMT_DEV_DISCONN_REMOTE;
2606         case HCI_ERROR_LOCAL_HOST_TERM:
2607                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2608         default:
2609                 return MGMT_DEV_DISCONN_UNKNOWN;
2610         }
2611 }
2612
2613 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2614 {
2615         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2616         u8 reason;
2617         struct hci_conn_params *params;
2618         struct hci_conn *conn;
2619         bool mgmt_connected;
2620         u8 type;
2621
2622         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2623
2624         hci_dev_lock(hdev);
2625
2626         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2627         if (!conn)
2628                 goto unlock;
2629
2630         if (ev->status) {
2631                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2632                                        conn->dst_type, ev->status);
2633                 goto unlock;
2634         }
2635
2636         conn->state = BT_CLOSED;
2637
2638         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2639
2640         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2641                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2642         else
2643                 reason = hci_to_mgmt_reason(ev->reason);
2644
2645         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2646                                 reason, mgmt_connected);
2647
2648         if (conn->type == ACL_LINK) {
2649                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2650                         hci_remove_link_key(hdev, &conn->dst);
2651
2652                 hci_req_update_scan(hdev);
2653         }
2654
2655         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2656         if (params) {
2657                 switch (params->auto_connect) {
2658                 case HCI_AUTO_CONN_LINK_LOSS:
2659                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2660                                 break;
2661                         /* Fall through */
2662
2663                 case HCI_AUTO_CONN_DIRECT:
2664                 case HCI_AUTO_CONN_ALWAYS:
2665                         list_del_init(&params->action);
2666                         list_add(&params->action, &hdev->pend_le_conns);
2667                         hci_update_background_scan(hdev);
2668                         break;
2669
2670                 default:
2671                         break;
2672                 }
2673         }
2674
2675         type = conn->type;
2676
2677         hci_disconn_cfm(conn, ev->reason);
2678         hci_conn_del(conn);
2679
2680         /* Re-enable advertising if necessary, since it might
2681          * have been disabled by the connection. From the
2682          * HCI_LE_Set_Advertise_Enable command description in
2683          * the core specification (v4.0):
2684          * "The Controller shall continue advertising until the Host
2685          * issues an LE_Set_Advertise_Enable command with
2686          * Advertising_Enable set to 0x00 (Advertising is disabled)
2687          * or until a connection is created or until the Advertising
2688          * is timed out due to Directed Advertising."
2689          */
2690         if (type == LE_LINK)
2691                 hci_req_reenable_advertising(hdev);
2692
2693 unlock:
2694         hci_dev_unlock(hdev);
2695 }
2696
2697 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2698 {
2699         struct hci_ev_auth_complete *ev = (void *) skb->data;
2700         struct hci_conn *conn;
2701
2702         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2703
2704         hci_dev_lock(hdev);
2705
2706         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2707         if (!conn)
2708                 goto unlock;
2709
2710         if (!ev->status) {
2711                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2712
2713                 if (!hci_conn_ssp_enabled(conn) &&
2714                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2715                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2716                 } else {
2717                         set_bit(HCI_CONN_AUTH, &conn->flags);
2718                         conn->sec_level = conn->pending_sec_level;
2719                 }
2720         } else {
2721                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2722                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2723
2724                 mgmt_auth_failed(conn, ev->status);
2725         }
2726
2727         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2728         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2729
2730         if (conn->state == BT_CONFIG) {
2731                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2732                         struct hci_cp_set_conn_encrypt cp;
2733                         cp.handle  = ev->handle;
2734                         cp.encrypt = 0x01;
2735                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2736                                      &cp);
2737                 } else {
2738                         conn->state = BT_CONNECTED;
2739                         hci_connect_cfm(conn, ev->status);
2740                         hci_conn_drop(conn);
2741                 }
2742         } else {
2743                 hci_auth_cfm(conn, ev->status);
2744
2745                 hci_conn_hold(conn);
2746                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2747                 hci_conn_drop(conn);
2748         }
2749
2750         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2751                 if (!ev->status) {
2752                         struct hci_cp_set_conn_encrypt cp;
2753                         cp.handle  = ev->handle;
2754                         cp.encrypt = 0x01;
2755                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2756                                      &cp);
2757                 } else {
2758                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2759                         hci_encrypt_cfm(conn, ev->status);
2760                 }
2761         }
2762
2763 unlock:
2764         hci_dev_unlock(hdev);
2765 }
2766
2767 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2768 {
2769         struct hci_ev_remote_name *ev = (void *) skb->data;
2770         struct hci_conn *conn;
2771
2772         BT_DBG("%s", hdev->name);
2773
2774         hci_conn_check_pending(hdev);
2775
2776         hci_dev_lock(hdev);
2777
2778         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2779
2780         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2781                 goto check_auth;
2782
2783         if (ev->status == 0)
2784                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2785                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2786         else
2787                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2788
2789 check_auth:
2790         if (!conn)
2791                 goto unlock;
2792
2793         if (!hci_outgoing_auth_needed(hdev, conn))
2794                 goto unlock;
2795
2796         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2797                 struct hci_cp_auth_requested cp;
2798
2799                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2800
2801                 cp.handle = __cpu_to_le16(conn->handle);
2802                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2803         }
2804
2805 unlock:
2806         hci_dev_unlock(hdev);
2807 }
2808
2809 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2810                                        u16 opcode, struct sk_buff *skb)
2811 {
2812         const struct hci_rp_read_enc_key_size *rp;
2813         struct hci_conn *conn;
2814         u16 handle;
2815
2816         BT_DBG("%s status 0x%02x", hdev->name, status);
2817
2818         if (!skb || skb->len < sizeof(*rp)) {
2819                 bt_dev_err(hdev, "invalid read key size response");
2820                 return;
2821         }
2822
2823         rp = (void *)skb->data;
2824         handle = le16_to_cpu(rp->handle);
2825
2826         hci_dev_lock(hdev);
2827
2828         conn = hci_conn_hash_lookup_handle(hdev, handle);
2829         if (!conn)
2830                 goto unlock;
2831
2832         /* If we fail to read the encryption key size, assume maximum
2833          * (which is the same we do also when this HCI command isn't
2834          * supported.
2835          */
2836         if (rp->status) {
2837                 bt_dev_err(hdev, "failed to read key size for handle %u",
2838                            handle);
2839                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2840         } else {
2841                 conn->enc_key_size = rp->key_size;
2842         }
2843
2844         hci_encrypt_cfm(conn, 0);
2845
2846 unlock:
2847         hci_dev_unlock(hdev);
2848 }
2849
2850 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2851 {
2852         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2853         struct hci_conn *conn;
2854
2855         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2856
2857         hci_dev_lock(hdev);
2858
2859         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2860         if (!conn)
2861                 goto unlock;
2862
2863         if (!ev->status) {
2864                 if (ev->encrypt) {
2865                         /* Encryption implies authentication */
2866                         set_bit(HCI_CONN_AUTH, &conn->flags);
2867                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2868                         conn->sec_level = conn->pending_sec_level;
2869
2870                         /* P-256 authentication key implies FIPS */
2871                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2872                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2873
2874                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2875                             conn->type == LE_LINK)
2876                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2877                 } else {
2878                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2879                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2880                 }
2881         }
2882
2883         /* We should disregard the current RPA and generate a new one
2884          * whenever the encryption procedure fails.
2885          */
2886         if (ev->status && conn->type == LE_LINK) {
2887                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2888                 hci_adv_instances_set_rpa_expired(hdev, true);
2889         }
2890
2891         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2892
2893         /* Check link security requirements are met */
2894         if (!hci_conn_check_link_mode(conn))
2895                 ev->status = HCI_ERROR_AUTH_FAILURE;
2896
2897         if (ev->status && conn->state == BT_CONNECTED) {
2898                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2899                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2900
2901                 /* Notify upper layers so they can cleanup before
2902                  * disconnecting.
2903                  */
2904                 hci_encrypt_cfm(conn, ev->status);
2905                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2906                 hci_conn_drop(conn);
2907                 goto unlock;
2908         }
2909
2910         /* Try reading the encryption key size for encrypted ACL links */
2911         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2912                 struct hci_cp_read_enc_key_size cp;
2913                 struct hci_request req;
2914
2915                 /* Only send HCI_Read_Encryption_Key_Size if the
2916                  * controller really supports it. If it doesn't, assume
2917                  * the default size (16).
2918                  */
2919                 if (!(hdev->commands[20] & 0x10)) {
2920                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2921                         goto notify;
2922                 }
2923
2924                 hci_req_init(&req, hdev);
2925
2926                 cp.handle = cpu_to_le16(conn->handle);
2927                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2928
2929                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2930                         bt_dev_err(hdev, "sending read key size failed");
2931                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2932                         goto notify;
2933                 }
2934
2935                 goto unlock;
2936         }
2937
2938 notify:
2939         hci_encrypt_cfm(conn, ev->status);
2940
2941 unlock:
2942         hci_dev_unlock(hdev);
2943 }
2944
2945 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2946                                              struct sk_buff *skb)
2947 {
2948         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2949         struct hci_conn *conn;
2950
2951         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2952
2953         hci_dev_lock(hdev);
2954
2955         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2956         if (conn) {
2957                 if (!ev->status)
2958                         set_bit(HCI_CONN_SECURE, &conn->flags);
2959
2960                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2961
2962                 hci_key_change_cfm(conn, ev->status);
2963         }
2964
2965         hci_dev_unlock(hdev);
2966 }
2967
2968 static void hci_remote_features_evt(struct hci_dev *hdev,
2969                                     struct sk_buff *skb)
2970 {
2971         struct hci_ev_remote_features *ev = (void *) skb->data;
2972         struct hci_conn *conn;
2973
2974         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2975
2976         hci_dev_lock(hdev);
2977
2978         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2979         if (!conn)
2980                 goto unlock;
2981
2982         if (!ev->status)
2983                 memcpy(conn->features[0], ev->features, 8);
2984
2985         if (conn->state != BT_CONFIG)
2986                 goto unlock;
2987
2988         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2989             lmp_ext_feat_capable(conn)) {
2990                 struct hci_cp_read_remote_ext_features cp;
2991                 cp.handle = ev->handle;
2992                 cp.page = 0x01;
2993                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2994                              sizeof(cp), &cp);
2995                 goto unlock;
2996         }
2997
2998         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2999                 struct hci_cp_remote_name_req cp;
3000                 memset(&cp, 0, sizeof(cp));
3001                 bacpy(&cp.bdaddr, &conn->dst);
3002                 cp.pscan_rep_mode = 0x02;
3003                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3004         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3005                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3006
3007         if (!hci_outgoing_auth_needed(hdev, conn)) {
3008                 conn->state = BT_CONNECTED;
3009                 hci_connect_cfm(conn, ev->status);
3010                 hci_conn_drop(conn);
3011         }
3012
3013 unlock:
3014         hci_dev_unlock(hdev);
3015 }
3016
3017 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3018                                  u16 *opcode, u8 *status,
3019                                  hci_req_complete_t *req_complete,
3020                                  hci_req_complete_skb_t *req_complete_skb)
3021 {
3022         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3023
3024         *opcode = __le16_to_cpu(ev->opcode);
3025         *status = skb->data[sizeof(*ev)];
3026
3027         skb_pull(skb, sizeof(*ev));
3028
3029         switch (*opcode) {
3030         case HCI_OP_INQUIRY_CANCEL:
3031                 hci_cc_inquiry_cancel(hdev, skb, status);
3032                 break;
3033
3034         case HCI_OP_PERIODIC_INQ:
3035                 hci_cc_periodic_inq(hdev, skb);
3036                 break;
3037
3038         case HCI_OP_EXIT_PERIODIC_INQ:
3039                 hci_cc_exit_periodic_inq(hdev, skb);
3040                 break;
3041
3042         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3043                 hci_cc_remote_name_req_cancel(hdev, skb);
3044                 break;
3045
3046         case HCI_OP_ROLE_DISCOVERY:
3047                 hci_cc_role_discovery(hdev, skb);
3048                 break;
3049
3050         case HCI_OP_READ_LINK_POLICY:
3051                 hci_cc_read_link_policy(hdev, skb);
3052                 break;
3053
3054         case HCI_OP_WRITE_LINK_POLICY:
3055                 hci_cc_write_link_policy(hdev, skb);
3056                 break;
3057
3058         case HCI_OP_READ_DEF_LINK_POLICY:
3059                 hci_cc_read_def_link_policy(hdev, skb);
3060                 break;
3061
3062         case HCI_OP_WRITE_DEF_LINK_POLICY:
3063                 hci_cc_write_def_link_policy(hdev, skb);
3064                 break;
3065
3066         case HCI_OP_RESET:
3067                 hci_cc_reset(hdev, skb);
3068                 break;
3069
3070         case HCI_OP_READ_STORED_LINK_KEY:
3071                 hci_cc_read_stored_link_key(hdev, skb);
3072                 break;
3073
3074         case HCI_OP_DELETE_STORED_LINK_KEY:
3075                 hci_cc_delete_stored_link_key(hdev, skb);
3076                 break;
3077
3078         case HCI_OP_WRITE_LOCAL_NAME:
3079                 hci_cc_write_local_name(hdev, skb);
3080                 break;
3081
3082         case HCI_OP_READ_LOCAL_NAME:
3083                 hci_cc_read_local_name(hdev, skb);
3084                 break;
3085
3086         case HCI_OP_WRITE_AUTH_ENABLE:
3087                 hci_cc_write_auth_enable(hdev, skb);
3088                 break;
3089
3090         case HCI_OP_WRITE_ENCRYPT_MODE:
3091                 hci_cc_write_encrypt_mode(hdev, skb);
3092                 break;
3093
3094         case HCI_OP_WRITE_SCAN_ENABLE:
3095                 hci_cc_write_scan_enable(hdev, skb);
3096                 break;
3097
3098         case HCI_OP_READ_CLASS_OF_DEV:
3099                 hci_cc_read_class_of_dev(hdev, skb);
3100                 break;
3101
3102         case HCI_OP_WRITE_CLASS_OF_DEV:
3103                 hci_cc_write_class_of_dev(hdev, skb);
3104                 break;
3105
3106         case HCI_OP_READ_VOICE_SETTING:
3107                 hci_cc_read_voice_setting(hdev, skb);
3108                 break;
3109
3110         case HCI_OP_WRITE_VOICE_SETTING:
3111                 hci_cc_write_voice_setting(hdev, skb);
3112                 break;
3113
3114         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3115                 hci_cc_read_num_supported_iac(hdev, skb);
3116                 break;
3117
3118         case HCI_OP_WRITE_SSP_MODE:
3119                 hci_cc_write_ssp_mode(hdev, skb);
3120                 break;
3121
3122         case HCI_OP_WRITE_SC_SUPPORT:
3123                 hci_cc_write_sc_support(hdev, skb);
3124                 break;
3125
3126         case HCI_OP_READ_LOCAL_VERSION:
3127                 hci_cc_read_local_version(hdev, skb);
3128                 break;
3129
3130         case HCI_OP_READ_LOCAL_COMMANDS:
3131                 hci_cc_read_local_commands(hdev, skb);
3132                 break;
3133
3134         case HCI_OP_READ_LOCAL_FEATURES:
3135                 hci_cc_read_local_features(hdev, skb);
3136                 break;
3137
3138         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3139                 hci_cc_read_local_ext_features(hdev, skb);
3140                 break;
3141
3142         case HCI_OP_READ_BUFFER_SIZE:
3143                 hci_cc_read_buffer_size(hdev, skb);
3144                 break;
3145
3146         case HCI_OP_READ_BD_ADDR:
3147                 hci_cc_read_bd_addr(hdev, skb);
3148                 break;
3149
3150         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3151                 hci_cc_read_page_scan_activity(hdev, skb);
3152                 break;
3153
3154         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3155                 hci_cc_write_page_scan_activity(hdev, skb);
3156                 break;
3157
3158         case HCI_OP_READ_PAGE_SCAN_TYPE:
3159                 hci_cc_read_page_scan_type(hdev, skb);
3160                 break;
3161
3162         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3163                 hci_cc_write_page_scan_type(hdev, skb);
3164                 break;
3165
3166         case HCI_OP_READ_DATA_BLOCK_SIZE:
3167                 hci_cc_read_data_block_size(hdev, skb);
3168                 break;
3169
3170         case HCI_OP_READ_FLOW_CONTROL_MODE:
3171                 hci_cc_read_flow_control_mode(hdev, skb);
3172                 break;
3173
3174         case HCI_OP_READ_LOCAL_AMP_INFO:
3175                 hci_cc_read_local_amp_info(hdev, skb);
3176                 break;
3177
3178         case HCI_OP_READ_CLOCK:
3179                 hci_cc_read_clock(hdev, skb);
3180                 break;
3181
3182         case HCI_OP_READ_INQ_RSP_TX_POWER:
3183                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3184                 break;
3185
3186         case HCI_OP_PIN_CODE_REPLY:
3187                 hci_cc_pin_code_reply(hdev, skb);
3188                 break;
3189
3190         case HCI_OP_PIN_CODE_NEG_REPLY:
3191                 hci_cc_pin_code_neg_reply(hdev, skb);
3192                 break;
3193
3194         case HCI_OP_READ_LOCAL_OOB_DATA:
3195                 hci_cc_read_local_oob_data(hdev, skb);
3196                 break;
3197
3198         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3199                 hci_cc_read_local_oob_ext_data(hdev, skb);
3200                 break;
3201
3202         case HCI_OP_LE_READ_BUFFER_SIZE:
3203                 hci_cc_le_read_buffer_size(hdev, skb);
3204                 break;
3205
3206         case HCI_OP_LE_READ_LOCAL_FEATURES:
3207                 hci_cc_le_read_local_features(hdev, skb);
3208                 break;
3209
3210         case HCI_OP_LE_READ_ADV_TX_POWER:
3211                 hci_cc_le_read_adv_tx_power(hdev, skb);
3212                 break;
3213
3214         case HCI_OP_USER_CONFIRM_REPLY:
3215                 hci_cc_user_confirm_reply(hdev, skb);
3216                 break;
3217
3218         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3219                 hci_cc_user_confirm_neg_reply(hdev, skb);
3220                 break;
3221
3222         case HCI_OP_USER_PASSKEY_REPLY:
3223                 hci_cc_user_passkey_reply(hdev, skb);
3224                 break;
3225
3226         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3227                 hci_cc_user_passkey_neg_reply(hdev, skb);
3228                 break;
3229
3230         case HCI_OP_LE_SET_RANDOM_ADDR:
3231                 hci_cc_le_set_random_addr(hdev, skb);
3232                 break;
3233
3234         case HCI_OP_LE_SET_ADV_ENABLE:
3235                 hci_cc_le_set_adv_enable(hdev, skb);
3236                 break;
3237
3238         case HCI_OP_LE_SET_SCAN_PARAM:
3239                 hci_cc_le_set_scan_param(hdev, skb);
3240                 break;
3241
3242         case HCI_OP_LE_SET_SCAN_ENABLE:
3243                 hci_cc_le_set_scan_enable(hdev, skb);
3244                 break;
3245
3246         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3247                 hci_cc_le_read_white_list_size(hdev, skb);
3248                 break;
3249
3250         case HCI_OP_LE_CLEAR_WHITE_LIST:
3251                 hci_cc_le_clear_white_list(hdev, skb);
3252                 break;
3253
3254         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3255                 hci_cc_le_add_to_white_list(hdev, skb);
3256                 break;
3257
3258         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3259                 hci_cc_le_del_from_white_list(hdev, skb);
3260                 break;
3261
3262         case HCI_OP_LE_READ_SUPPORTED_STATES:
3263                 hci_cc_le_read_supported_states(hdev, skb);
3264                 break;
3265
3266         case HCI_OP_LE_READ_DEF_DATA_LEN:
3267                 hci_cc_le_read_def_data_len(hdev, skb);
3268                 break;
3269
3270         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3271                 hci_cc_le_write_def_data_len(hdev, skb);
3272                 break;
3273
3274         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3275                 hci_cc_le_clear_resolv_list(hdev, skb);
3276                 break;
3277
3278         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3279                 hci_cc_le_read_resolv_list_size(hdev, skb);
3280                 break;
3281
3282         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3283                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3284                 break;
3285
3286         case HCI_OP_LE_READ_MAX_DATA_LEN:
3287                 hci_cc_le_read_max_data_len(hdev, skb);
3288                 break;
3289
3290         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3291                 hci_cc_write_le_host_supported(hdev, skb);
3292                 break;
3293
3294         case HCI_OP_LE_SET_ADV_PARAM:
3295                 hci_cc_set_adv_param(hdev, skb);
3296                 break;
3297
3298         case HCI_OP_READ_RSSI:
3299                 hci_cc_read_rssi(hdev, skb);
3300                 break;
3301
3302         case HCI_OP_READ_TX_POWER:
3303                 hci_cc_read_tx_power(hdev, skb);
3304                 break;
3305
3306         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3307                 hci_cc_write_ssp_debug_mode(hdev, skb);
3308                 break;
3309
3310         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3311                 hci_cc_le_set_ext_scan_param(hdev, skb);
3312                 break;
3313
3314         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3315                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3316                 break;
3317
3318         case HCI_OP_LE_SET_DEFAULT_PHY:
3319                 hci_cc_le_set_default_phy(hdev, skb);
3320                 break;
3321
3322         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3323                 hci_cc_le_read_num_adv_sets(hdev, skb);
3324                 break;
3325
3326         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3327                 hci_cc_set_ext_adv_param(hdev, skb);
3328                 break;
3329
3330         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3331                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3332                 break;
3333
3334         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3335                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3336                 break;
3337
3338         default:
3339                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3340                 break;
3341         }
3342
3343         if (*opcode != HCI_OP_NOP)
3344                 cancel_delayed_work(&hdev->cmd_timer);
3345
3346         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3347                 atomic_set(&hdev->cmd_cnt, 1);
3348
3349         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3350                              req_complete_skb);
3351
3352         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3353                 bt_dev_err(hdev,
3354                            "unexpected event for opcode 0x%4.4x", *opcode);
3355                 return;
3356         }
3357
3358         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3359                 queue_work(hdev->workqueue, &hdev->cmd_work);
3360 }
3361
3362 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3363                                u16 *opcode, u8 *status,
3364                                hci_req_complete_t *req_complete,
3365                                hci_req_complete_skb_t *req_complete_skb)
3366 {
3367         struct hci_ev_cmd_status *ev = (void *) skb->data;
3368
3369         skb_pull(skb, sizeof(*ev));
3370
3371         *opcode = __le16_to_cpu(ev->opcode);
3372         *status = ev->status;
3373
3374         switch (*opcode) {
3375         case HCI_OP_INQUIRY:
3376                 hci_cs_inquiry(hdev, ev->status);
3377                 break;
3378
3379         case HCI_OP_CREATE_CONN:
3380                 hci_cs_create_conn(hdev, ev->status);
3381                 break;
3382
3383         case HCI_OP_DISCONNECT:
3384                 hci_cs_disconnect(hdev, ev->status);
3385                 break;
3386
3387         case HCI_OP_ADD_SCO:
3388                 hci_cs_add_sco(hdev, ev->status);
3389                 break;
3390
3391         case HCI_OP_AUTH_REQUESTED:
3392                 hci_cs_auth_requested(hdev, ev->status);
3393                 break;
3394
3395         case HCI_OP_SET_CONN_ENCRYPT:
3396                 hci_cs_set_conn_encrypt(hdev, ev->status);
3397                 break;
3398
3399         case HCI_OP_REMOTE_NAME_REQ:
3400                 hci_cs_remote_name_req(hdev, ev->status);
3401                 break;
3402
3403         case HCI_OP_READ_REMOTE_FEATURES:
3404                 hci_cs_read_remote_features(hdev, ev->status);
3405                 break;
3406
3407         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3408                 hci_cs_read_remote_ext_features(hdev, ev->status);
3409                 break;
3410
3411         case HCI_OP_SETUP_SYNC_CONN:
3412                 hci_cs_setup_sync_conn(hdev, ev->status);
3413                 break;
3414
3415         case HCI_OP_SNIFF_MODE:
3416                 hci_cs_sniff_mode(hdev, ev->status);
3417                 break;
3418
3419         case HCI_OP_EXIT_SNIFF_MODE:
3420                 hci_cs_exit_sniff_mode(hdev, ev->status);
3421                 break;
3422
3423         case HCI_OP_SWITCH_ROLE:
3424                 hci_cs_switch_role(hdev, ev->status);
3425                 break;
3426
3427         case HCI_OP_LE_CREATE_CONN:
3428                 hci_cs_le_create_conn(hdev, ev->status);
3429                 break;
3430
3431         case HCI_OP_LE_READ_REMOTE_FEATURES:
3432                 hci_cs_le_read_remote_features(hdev, ev->status);
3433                 break;
3434
3435         case HCI_OP_LE_START_ENC:
3436                 hci_cs_le_start_enc(hdev, ev->status);
3437                 break;
3438
3439         case HCI_OP_LE_EXT_CREATE_CONN:
3440                 hci_cs_le_ext_create_conn(hdev, ev->status);
3441                 break;
3442
3443         default:
3444                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3445                 break;
3446         }
3447
3448         if (*opcode != HCI_OP_NOP)
3449                 cancel_delayed_work(&hdev->cmd_timer);
3450
3451         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3452                 atomic_set(&hdev->cmd_cnt, 1);
3453
3454         /* Indicate request completion if the command failed. Also, if
3455          * we're not waiting for a special event and we get a success
3456          * command status we should try to flag the request as completed
3457          * (since for this kind of commands there will not be a command
3458          * complete event).
3459          */
3460         if (ev->status ||
3461             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3462                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3463                                      req_complete_skb);
3464
3465         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3466                 bt_dev_err(hdev,
3467                            "unexpected event for opcode 0x%4.4x", *opcode);
3468                 return;
3469         }
3470
3471         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3472                 queue_work(hdev->workqueue, &hdev->cmd_work);
3473 }
3474
3475 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3476 {
3477         struct hci_ev_hardware_error *ev = (void *) skb->data;
3478
3479         hdev->hw_error_code = ev->code;
3480
3481         queue_work(hdev->req_workqueue, &hdev->error_reset);
3482 }
3483
3484 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3485 {
3486         struct hci_ev_role_change *ev = (void *) skb->data;
3487         struct hci_conn *conn;
3488
3489         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3490
3491         hci_dev_lock(hdev);
3492
3493         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3494         if (conn) {
3495                 if (!ev->status)
3496                         conn->role = ev->role;
3497
3498                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3499
3500                 hci_role_switch_cfm(conn, ev->status, ev->role);
3501         }
3502
3503         hci_dev_unlock(hdev);
3504 }
3505
3506 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3507 {
3508         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3509         int i;
3510
3511         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3512                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3513                 return;
3514         }
3515
3516         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3517             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3518                 BT_DBG("%s bad parameters", hdev->name);
3519                 return;
3520         }
3521
3522         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3523
3524         for (i = 0; i < ev->num_hndl; i++) {
3525                 struct hci_comp_pkts_info *info = &ev->handles[i];
3526                 struct hci_conn *conn;
3527                 __u16  handle, count;
3528
3529                 handle = __le16_to_cpu(info->handle);
3530                 count  = __le16_to_cpu(info->count);
3531
3532                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3533                 if (!conn)
3534                         continue;
3535
3536                 conn->sent -= count;
3537
3538                 switch (conn->type) {
3539                 case ACL_LINK:
3540                         hdev->acl_cnt += count;
3541                         if (hdev->acl_cnt > hdev->acl_pkts)
3542                                 hdev->acl_cnt = hdev->acl_pkts;
3543                         break;
3544
3545                 case LE_LINK:
3546                         if (hdev->le_pkts) {
3547                                 hdev->le_cnt += count;
3548                                 if (hdev->le_cnt > hdev->le_pkts)
3549                                         hdev->le_cnt = hdev->le_pkts;
3550                         } else {
3551                                 hdev->acl_cnt += count;
3552                                 if (hdev->acl_cnt > hdev->acl_pkts)
3553                                         hdev->acl_cnt = hdev->acl_pkts;
3554                         }
3555                         break;
3556
3557                 case SCO_LINK:
3558                         hdev->sco_cnt += count;
3559                         if (hdev->sco_cnt > hdev->sco_pkts)
3560                                 hdev->sco_cnt = hdev->sco_pkts;
3561                         break;
3562
3563                 default:
3564                         bt_dev_err(hdev, "unknown type %d conn %p",
3565                                    conn->type, conn);
3566                         break;
3567                 }
3568         }
3569
3570         queue_work(hdev->workqueue, &hdev->tx_work);
3571 }
3572
3573 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3574                                                  __u16 handle)
3575 {
3576         struct hci_chan *chan;
3577
3578         switch (hdev->dev_type) {
3579         case HCI_PRIMARY:
3580                 return hci_conn_hash_lookup_handle(hdev, handle);
3581         case HCI_AMP:
3582                 chan = hci_chan_lookup_handle(hdev, handle);
3583                 if (chan)
3584                         return chan->conn;
3585                 break;
3586         default:
3587                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3588                 break;
3589         }
3590
3591         return NULL;
3592 }
3593
3594 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3595 {
3596         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3597         int i;
3598
3599         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3600                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3601                 return;
3602         }
3603
3604         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3605             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3606                 BT_DBG("%s bad parameters", hdev->name);
3607                 return;
3608         }
3609
3610         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3611                ev->num_hndl);
3612
3613         for (i = 0; i < ev->num_hndl; i++) {
3614                 struct hci_comp_blocks_info *info = &ev->handles[i];
3615                 struct hci_conn *conn = NULL;
3616                 __u16  handle, block_count;
3617
3618                 handle = __le16_to_cpu(info->handle);
3619                 block_count = __le16_to_cpu(info->blocks);
3620
3621                 conn = __hci_conn_lookup_handle(hdev, handle);
3622                 if (!conn)
3623                         continue;
3624
3625                 conn->sent -= block_count;
3626
3627                 switch (conn->type) {
3628                 case ACL_LINK:
3629                 case AMP_LINK:
3630                         hdev->block_cnt += block_count;
3631                         if (hdev->block_cnt > hdev->num_blocks)
3632                                 hdev->block_cnt = hdev->num_blocks;
3633                         break;
3634
3635                 default:
3636                         bt_dev_err(hdev, "unknown type %d conn %p",
3637                                    conn->type, conn);
3638                         break;
3639                 }
3640         }
3641
3642         queue_work(hdev->workqueue, &hdev->tx_work);
3643 }
3644
3645 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3646 {
3647         struct hci_ev_mode_change *ev = (void *) skb->data;
3648         struct hci_conn *conn;
3649
3650         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3651
3652         hci_dev_lock(hdev);
3653
3654         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3655         if (conn) {
3656                 conn->mode = ev->mode;
3657
3658                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3659                                         &conn->flags)) {
3660                         if (conn->mode == HCI_CM_ACTIVE)
3661                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3662                         else
3663                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3664                 }
3665
3666                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3667                         hci_sco_setup(conn, ev->status);
3668         }
3669
3670         hci_dev_unlock(hdev);
3671 }
3672
3673 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3674 {
3675         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3676         struct hci_conn *conn;
3677
3678         BT_DBG("%s", hdev->name);
3679
3680         hci_dev_lock(hdev);
3681
3682         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3683         if (!conn)
3684                 goto unlock;
3685
3686         if (conn->state == BT_CONNECTED) {
3687                 hci_conn_hold(conn);
3688                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3689                 hci_conn_drop(conn);
3690         }
3691
3692         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3693             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3694                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3695                              sizeof(ev->bdaddr), &ev->bdaddr);
3696         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3697                 u8 secure;
3698
3699                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3700                         secure = 1;
3701                 else
3702                         secure = 0;
3703
3704                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3705         }
3706
3707 unlock:
3708         hci_dev_unlock(hdev);
3709 }
3710
3711 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3712 {
3713         if (key_type == HCI_LK_CHANGED_COMBINATION)
3714                 return;
3715
3716         conn->pin_length = pin_len;
3717         conn->key_type = key_type;
3718
3719         switch (key_type) {
3720         case HCI_LK_LOCAL_UNIT:
3721         case HCI_LK_REMOTE_UNIT:
3722         case HCI_LK_DEBUG_COMBINATION:
3723                 return;
3724         case HCI_LK_COMBINATION:
3725                 if (pin_len == 16)
3726                         conn->pending_sec_level = BT_SECURITY_HIGH;
3727                 else
3728                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3729                 break;
3730         case HCI_LK_UNAUTH_COMBINATION_P192:
3731         case HCI_LK_UNAUTH_COMBINATION_P256:
3732                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3733                 break;
3734         case HCI_LK_AUTH_COMBINATION_P192:
3735                 conn->pending_sec_level = BT_SECURITY_HIGH;
3736                 break;
3737         case HCI_LK_AUTH_COMBINATION_P256:
3738                 conn->pending_sec_level = BT_SECURITY_FIPS;
3739                 break;
3740         }
3741 }
3742
3743 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3744 {
3745         struct hci_ev_link_key_req *ev = (void *) skb->data;
3746         struct hci_cp_link_key_reply cp;
3747         struct hci_conn *conn;
3748         struct link_key *key;
3749
3750         BT_DBG("%s", hdev->name);
3751
3752         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3753                 return;
3754
3755         hci_dev_lock(hdev);
3756
3757         key = hci_find_link_key(hdev, &ev->bdaddr);
3758         if (!key) {
3759                 BT_DBG("%s link key not found for %pMR", hdev->name,
3760                        &ev->bdaddr);
3761                 goto not_found;
3762         }
3763
3764         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3765                &ev->bdaddr);
3766
3767         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3768         if (conn) {
3769                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3770
3771                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3772                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3773                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3774                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3775                         goto not_found;
3776                 }
3777
3778                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3779                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3780                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3781                         BT_DBG("%s ignoring key unauthenticated for high security",
3782                                hdev->name);
3783                         goto not_found;
3784                 }
3785
3786                 conn_set_key(conn, key->type, key->pin_len);
3787         }
3788
3789         bacpy(&cp.bdaddr, &ev->bdaddr);
3790         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3791
3792         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3793
3794         hci_dev_unlock(hdev);
3795
3796         return;
3797
3798 not_found:
3799         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3800         hci_dev_unlock(hdev);
3801 }
3802
3803 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3804 {
3805         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3806         struct hci_conn *conn;
3807         struct link_key *key;
3808         bool persistent;
3809         u8 pin_len = 0;
3810
3811         BT_DBG("%s", hdev->name);
3812
3813         hci_dev_lock(hdev);
3814
3815         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3816         if (!conn)
3817                 goto unlock;
3818
3819         hci_conn_hold(conn);
3820         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3821         hci_conn_drop(conn);
3822
3823         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3824         conn_set_key(conn, ev->key_type, conn->pin_length);
3825
3826         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3827                 goto unlock;
3828
3829         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3830                                 ev->key_type, pin_len, &persistent);
3831         if (!key)
3832                 goto unlock;
3833
3834         /* Update connection information since adding the key will have
3835          * fixed up the type in the case of changed combination keys.
3836          */
3837         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3838                 conn_set_key(conn, key->type, key->pin_len);
3839
3840         mgmt_new_link_key(hdev, key, persistent);
3841
3842         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3843          * is set. If it's not set simply remove the key from the kernel
3844          * list (we've still notified user space about it but with
3845          * store_hint being 0).
3846          */
3847         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3848             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3849                 list_del_rcu(&key->list);
3850                 kfree_rcu(key, rcu);
3851                 goto unlock;
3852         }
3853
3854         if (persistent)
3855                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3856         else
3857                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3858
3859 unlock:
3860         hci_dev_unlock(hdev);
3861 }
3862
3863 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3864 {
3865         struct hci_ev_clock_offset *ev = (void *) skb->data;
3866         struct hci_conn *conn;
3867
3868         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3869
3870         hci_dev_lock(hdev);
3871
3872         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3873         if (conn && !ev->status) {
3874                 struct inquiry_entry *ie;
3875
3876                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3877                 if (ie) {
3878                         ie->data.clock_offset = ev->clock_offset;
3879                         ie->timestamp = jiffies;
3880                 }
3881         }
3882
3883         hci_dev_unlock(hdev);
3884 }
3885
3886 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3887 {
3888         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3889         struct hci_conn *conn;
3890
3891         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3892
3893         hci_dev_lock(hdev);
3894
3895         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3896         if (conn && !ev->status)
3897                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3898
3899         hci_dev_unlock(hdev);
3900 }
3901
3902 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3903 {
3904         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3905         struct inquiry_entry *ie;
3906
3907         BT_DBG("%s", hdev->name);
3908
3909         hci_dev_lock(hdev);
3910
3911         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3912         if (ie) {
3913                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3914                 ie->timestamp = jiffies;
3915         }
3916
3917         hci_dev_unlock(hdev);
3918 }
3919
3920 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3921                                              struct sk_buff *skb)
3922 {
3923         struct inquiry_data data;
3924         int num_rsp = *((__u8 *) skb->data);
3925
3926         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3927
3928         if (!num_rsp)
3929                 return;
3930
3931         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3932                 return;
3933
3934         hci_dev_lock(hdev);
3935
3936         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3937                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3938                 info = (void *) (skb->data + 1);
3939
3940                 if (skb->len < num_rsp * sizeof(*info) + 1)
3941                         goto unlock;
3942
3943                 for (; num_rsp; num_rsp--, info++) {
3944                         u32 flags;
3945
3946                         bacpy(&data.bdaddr, &info->bdaddr);
3947                         data.pscan_rep_mode     = info->pscan_rep_mode;
3948                         data.pscan_period_mode  = info->pscan_period_mode;
3949                         data.pscan_mode         = info->pscan_mode;
3950                         memcpy(data.dev_class, info->dev_class, 3);
3951                         data.clock_offset       = info->clock_offset;
3952                         data.rssi               = info->rssi;
3953                         data.ssp_mode           = 0x00;
3954
3955                         flags = hci_inquiry_cache_update(hdev, &data, false);
3956
3957                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3958                                           info->dev_class, info->rssi,
3959                                           flags, NULL, 0, NULL, 0);
3960                 }
3961         } else {
3962                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3963
3964                 if (skb->len < num_rsp * sizeof(*info) + 1)
3965                         goto unlock;
3966
3967                 for (; num_rsp; num_rsp--, info++) {
3968                         u32 flags;
3969
3970                         bacpy(&data.bdaddr, &info->bdaddr);
3971                         data.pscan_rep_mode     = info->pscan_rep_mode;
3972                         data.pscan_period_mode  = info->pscan_period_mode;
3973                         data.pscan_mode         = 0x00;
3974                         memcpy(data.dev_class, info->dev_class, 3);
3975                         data.clock_offset       = info->clock_offset;
3976                         data.rssi               = info->rssi;
3977                         data.ssp_mode           = 0x00;
3978
3979                         flags = hci_inquiry_cache_update(hdev, &data, false);
3980
3981                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3982                                           info->dev_class, info->rssi,
3983                                           flags, NULL, 0, NULL, 0);
3984                 }
3985         }
3986
3987 unlock:
3988         hci_dev_unlock(hdev);
3989 }
3990
3991 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3992                                         struct sk_buff *skb)
3993 {
3994         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3995         struct hci_conn *conn;
3996
3997         BT_DBG("%s", hdev->name);
3998
3999         hci_dev_lock(hdev);
4000
4001         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4002         if (!conn)
4003                 goto unlock;
4004
4005         if (ev->page < HCI_MAX_PAGES)
4006                 memcpy(conn->features[ev->page], ev->features, 8);
4007
4008         if (!ev->status && ev->page == 0x01) {
4009                 struct inquiry_entry *ie;
4010
4011                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4012                 if (ie)
4013                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4014
4015                 if (ev->features[0] & LMP_HOST_SSP) {
4016                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4017                 } else {
4018                         /* It is mandatory by the Bluetooth specification that
4019                          * Extended Inquiry Results are only used when Secure
4020                          * Simple Pairing is enabled, but some devices violate
4021                          * this.
4022                          *
4023                          * To make these devices work, the internal SSP
4024                          * enabled flag needs to be cleared if the remote host
4025                          * features do not indicate SSP support */
4026                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4027                 }
4028
4029                 if (ev->features[0] & LMP_HOST_SC)
4030                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4031         }
4032
4033         if (conn->state != BT_CONFIG)
4034                 goto unlock;
4035
4036         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4037                 struct hci_cp_remote_name_req cp;
4038                 memset(&cp, 0, sizeof(cp));
4039                 bacpy(&cp.bdaddr, &conn->dst);
4040                 cp.pscan_rep_mode = 0x02;
4041                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4042         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4043                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4044
4045         if (!hci_outgoing_auth_needed(hdev, conn)) {
4046                 conn->state = BT_CONNECTED;
4047                 hci_connect_cfm(conn, ev->status);
4048                 hci_conn_drop(conn);
4049         }
4050
4051 unlock:
4052         hci_dev_unlock(hdev);
4053 }
4054
4055 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4056                                        struct sk_buff *skb)
4057 {
4058         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4059         struct hci_conn *conn;
4060
4061         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4062
4063         hci_dev_lock(hdev);
4064
4065         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4066         if (!conn) {
4067                 if (ev->link_type == ESCO_LINK)
4068                         goto unlock;
4069
4070                 /* When the link type in the event indicates SCO connection
4071                  * and lookup of the connection object fails, then check
4072                  * if an eSCO connection object exists.
4073                  *
4074                  * The core limits the synchronous connections to either
4075                  * SCO or eSCO. The eSCO connection is preferred and tried
4076                  * to be setup first and until successfully established,
4077                  * the link type will be hinted as eSCO.
4078                  */
4079                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4080                 if (!conn)
4081                         goto unlock;
4082         }
4083
4084         switch (ev->status) {
4085         case 0x00:
4086                 /* The synchronous connection complete event should only be
4087                  * sent once per new connection. Receiving a successful
4088                  * complete event when the connection status is already
4089                  * BT_CONNECTED means that the device is misbehaving and sent
4090                  * multiple complete event packets for the same new connection.
4091                  *
4092                  * Registering the device more than once can corrupt kernel
4093                  * memory, hence upon detecting this invalid event, we report
4094                  * an error and ignore the packet.
4095                  */
4096                 if (conn->state == BT_CONNECTED) {
4097                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4098                         goto unlock;
4099                 }
4100
4101                 conn->handle = __le16_to_cpu(ev->handle);
4102                 conn->state  = BT_CONNECTED;
4103                 conn->type   = ev->link_type;
4104
4105                 hci_debugfs_create_conn(conn);
4106                 hci_conn_add_sysfs(conn);
4107                 break;
4108
4109         case 0x10:      /* Connection Accept Timeout */
4110         case 0x0d:      /* Connection Rejected due to Limited Resources */
4111         case 0x11:      /* Unsupported Feature or Parameter Value */
4112         case 0x1c:      /* SCO interval rejected */
4113         case 0x1a:      /* Unsupported Remote Feature */
4114         case 0x1e:      /* Invalid LMP Parameters */
4115         case 0x1f:      /* Unspecified error */
4116         case 0x20:      /* Unsupported LMP Parameter value */
4117                 if (conn->out) {
4118                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4119                                         (hdev->esco_type & EDR_ESCO_MASK);
4120                         if (hci_setup_sync(conn, conn->link->handle))
4121                                 goto unlock;
4122                 }
4123                 /* fall through */
4124
4125         default:
4126                 conn->state = BT_CLOSED;
4127                 break;
4128         }
4129
4130         hci_connect_cfm(conn, ev->status);
4131         if (ev->status)
4132                 hci_conn_del(conn);
4133
4134 unlock:
4135         hci_dev_unlock(hdev);
4136 }
4137
4138 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4139 {
4140         size_t parsed = 0;
4141
4142         while (parsed < eir_len) {
4143                 u8 field_len = eir[0];
4144
4145                 if (field_len == 0)
4146                         return parsed;
4147
4148                 parsed += field_len + 1;
4149                 eir += field_len + 1;
4150         }
4151
4152         return eir_len;
4153 }
4154
4155 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4156                                             struct sk_buff *skb)
4157 {
4158         struct inquiry_data data;
4159         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4160         int num_rsp = *((__u8 *) skb->data);
4161         size_t eir_len;
4162
4163         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4164
4165         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4166                 return;
4167
4168         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4169                 return;
4170
4171         hci_dev_lock(hdev);
4172
4173         for (; num_rsp; num_rsp--, info++) {
4174                 u32 flags;
4175                 bool name_known;
4176
4177                 bacpy(&data.bdaddr, &info->bdaddr);
4178                 data.pscan_rep_mode     = info->pscan_rep_mode;
4179                 data.pscan_period_mode  = info->pscan_period_mode;
4180                 data.pscan_mode         = 0x00;
4181                 memcpy(data.dev_class, info->dev_class, 3);
4182                 data.clock_offset       = info->clock_offset;
4183                 data.rssi               = info->rssi;
4184                 data.ssp_mode           = 0x01;
4185
4186                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4187                         name_known = eir_get_data(info->data,
4188                                                   sizeof(info->data),
4189                                                   EIR_NAME_COMPLETE, NULL);
4190                 else
4191                         name_known = true;
4192
4193                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4194
4195                 eir_len = eir_get_length(info->data, sizeof(info->data));
4196
4197                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4198                                   info->dev_class, info->rssi,
4199                                   flags, info->data, eir_len, NULL, 0);
4200         }
4201
4202         hci_dev_unlock(hdev);
4203 }
4204
4205 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4206                                          struct sk_buff *skb)
4207 {
4208         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4209         struct hci_conn *conn;
4210
4211         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4212                __le16_to_cpu(ev->handle));
4213
4214         hci_dev_lock(hdev);
4215
4216         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4217         if (!conn)
4218                 goto unlock;
4219
4220         /* For BR/EDR the necessary steps are taken through the
4221          * auth_complete event.
4222          */
4223         if (conn->type != LE_LINK)
4224                 goto unlock;
4225
4226         if (!ev->status)
4227                 conn->sec_level = conn->pending_sec_level;
4228
4229         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4230
4231         if (ev->status && conn->state == BT_CONNECTED) {
4232                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4233                 hci_conn_drop(conn);
4234                 goto unlock;
4235         }
4236
4237         if (conn->state == BT_CONFIG) {
4238                 if (!ev->status)
4239                         conn->state = BT_CONNECTED;
4240
4241                 hci_connect_cfm(conn, ev->status);
4242                 hci_conn_drop(conn);
4243         } else {
4244                 hci_auth_cfm(conn, ev->status);
4245
4246                 hci_conn_hold(conn);
4247                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4248                 hci_conn_drop(conn);
4249         }
4250
4251 unlock:
4252         hci_dev_unlock(hdev);
4253 }
4254
4255 static u8 hci_get_auth_req(struct hci_conn *conn)
4256 {
4257         /* If remote requests no-bonding follow that lead */
4258         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4259             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4260                 return conn->remote_auth | (conn->auth_type & 0x01);
4261
4262         /* If both remote and local have enough IO capabilities, require
4263          * MITM protection
4264          */
4265         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4266             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4267                 return conn->remote_auth | 0x01;
4268
4269         /* No MITM protection possible so ignore remote requirement */
4270         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4271 }
4272
4273 static u8 bredr_oob_data_present(struct hci_conn *conn)
4274 {
4275         struct hci_dev *hdev = conn->hdev;
4276         struct oob_data *data;
4277
4278         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4279         if (!data)
4280                 return 0x00;
4281
4282         if (bredr_sc_enabled(hdev)) {
4283                 /* When Secure Connections is enabled, then just
4284                  * return the present value stored with the OOB
4285                  * data. The stored value contains the right present
4286                  * information. However it can only be trusted when
4287                  * not in Secure Connection Only mode.
4288                  */
4289                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4290                         return data->present;
4291
4292                 /* When Secure Connections Only mode is enabled, then
4293                  * the P-256 values are required. If they are not
4294                  * available, then do not declare that OOB data is
4295                  * present.
4296                  */
4297                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4298                     !memcmp(data->hash256, ZERO_KEY, 16))
4299                         return 0x00;
4300
4301                 return 0x02;
4302         }
4303
4304         /* When Secure Connections is not enabled or actually
4305          * not supported by the hardware, then check that if
4306          * P-192 data values are present.
4307          */
4308         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4309             !memcmp(data->hash192, ZERO_KEY, 16))
4310                 return 0x00;
4311
4312         return 0x01;
4313 }
4314
4315 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4316 {
4317         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4318         struct hci_conn *conn;
4319
4320         BT_DBG("%s", hdev->name);
4321
4322         hci_dev_lock(hdev);
4323
4324         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4325         if (!conn)
4326                 goto unlock;
4327
4328         hci_conn_hold(conn);
4329
4330         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4331                 goto unlock;
4332
4333         /* Allow pairing if we're pairable, the initiators of the
4334          * pairing or if the remote is not requesting bonding.
4335          */
4336         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4337             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4338             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4339                 struct hci_cp_io_capability_reply cp;
4340
4341                 bacpy(&cp.bdaddr, &ev->bdaddr);
4342                 /* Change the IO capability from KeyboardDisplay
4343                  * to DisplayYesNo as it is not supported by BT spec. */
4344                 cp.capability = (conn->io_capability == 0x04) ?
4345                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4346
4347                 /* If we are initiators, there is no remote information yet */
4348                 if (conn->remote_auth == 0xff) {
4349                         /* Request MITM protection if our IO caps allow it
4350                          * except for the no-bonding case.
4351                          */
4352                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4353                             conn->auth_type != HCI_AT_NO_BONDING)
4354                                 conn->auth_type |= 0x01;
4355                 } else {
4356                         conn->auth_type = hci_get_auth_req(conn);
4357                 }
4358
4359                 /* If we're not bondable, force one of the non-bondable
4360                  * authentication requirement values.
4361                  */
4362                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4363                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4364
4365                 cp.authentication = conn->auth_type;
4366                 cp.oob_data = bredr_oob_data_present(conn);
4367
4368                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4369                              sizeof(cp), &cp);
4370         } else {
4371                 struct hci_cp_io_capability_neg_reply cp;
4372
4373                 bacpy(&cp.bdaddr, &ev->bdaddr);
4374                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4375
4376                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4377                              sizeof(cp), &cp);
4378         }
4379
4380 unlock:
4381         hci_dev_unlock(hdev);
4382 }
4383
4384 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4385 {
4386         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4387         struct hci_conn *conn;
4388
4389         BT_DBG("%s", hdev->name);
4390
4391         hci_dev_lock(hdev);
4392
4393         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4394         if (!conn)
4395                 goto unlock;
4396
4397         conn->remote_cap = ev->capability;
4398         conn->remote_auth = ev->authentication;
4399
4400 unlock:
4401         hci_dev_unlock(hdev);
4402 }
4403
4404 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4405                                          struct sk_buff *skb)
4406 {
4407         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4408         int loc_mitm, rem_mitm, confirm_hint = 0;
4409         struct hci_conn *conn;
4410
4411         BT_DBG("%s", hdev->name);
4412
4413         hci_dev_lock(hdev);
4414
4415         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4416                 goto unlock;
4417
4418         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4419         if (!conn)
4420                 goto unlock;
4421
4422         loc_mitm = (conn->auth_type & 0x01);
4423         rem_mitm = (conn->remote_auth & 0x01);
4424
4425         /* If we require MITM but the remote device can't provide that
4426          * (it has NoInputNoOutput) then reject the confirmation
4427          * request. We check the security level here since it doesn't
4428          * necessarily match conn->auth_type.
4429          */
4430         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4431             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4432                 BT_DBG("Rejecting request: remote device can't provide MITM");
4433                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4434                              sizeof(ev->bdaddr), &ev->bdaddr);
4435                 goto unlock;
4436         }
4437
4438         /* If no side requires MITM protection; auto-accept */
4439         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4440             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4441
4442                 /* If we're not the initiators request authorization to
4443                  * proceed from user space (mgmt_user_confirm with
4444                  * confirm_hint set to 1). The exception is if neither
4445                  * side had MITM or if the local IO capability is
4446                  * NoInputNoOutput, in which case we do auto-accept
4447                  */
4448                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4449                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4450                     (loc_mitm || rem_mitm)) {
4451                         BT_DBG("Confirming auto-accept as acceptor");
4452                         confirm_hint = 1;
4453                         goto confirm;
4454                 }
4455
4456                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4457                        hdev->auto_accept_delay);
4458
4459                 if (hdev->auto_accept_delay > 0) {
4460                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4461                         queue_delayed_work(conn->hdev->workqueue,
4462                                            &conn->auto_accept_work, delay);
4463                         goto unlock;
4464                 }
4465
4466                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4467                              sizeof(ev->bdaddr), &ev->bdaddr);
4468                 goto unlock;
4469         }
4470
4471 confirm:
4472         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4473                                   le32_to_cpu(ev->passkey), confirm_hint);
4474
4475 unlock:
4476         hci_dev_unlock(hdev);
4477 }
4478
4479 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4480                                          struct sk_buff *skb)
4481 {
4482         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4483
4484         BT_DBG("%s", hdev->name);
4485
4486         if (hci_dev_test_flag(hdev, HCI_MGMT))
4487                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4488 }
4489
4490 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4491                                         struct sk_buff *skb)
4492 {
4493         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4494         struct hci_conn *conn;
4495
4496         BT_DBG("%s", hdev->name);
4497
4498         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4499         if (!conn)
4500                 return;
4501
4502         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4503         conn->passkey_entered = 0;
4504
4505         if (hci_dev_test_flag(hdev, HCI_MGMT))
4506                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4507                                          conn->dst_type, conn->passkey_notify,
4508                                          conn->passkey_entered);
4509 }
4510
4511 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4512 {
4513         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4514         struct hci_conn *conn;
4515
4516         BT_DBG("%s", hdev->name);
4517
4518         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4519         if (!conn)
4520                 return;
4521
4522         switch (ev->type) {
4523         case HCI_KEYPRESS_STARTED:
4524                 conn->passkey_entered = 0;
4525                 return;
4526
4527         case HCI_KEYPRESS_ENTERED:
4528                 conn->passkey_entered++;
4529                 break;
4530
4531         case HCI_KEYPRESS_ERASED:
4532                 conn->passkey_entered--;
4533                 break;
4534
4535         case HCI_KEYPRESS_CLEARED:
4536                 conn->passkey_entered = 0;
4537                 break;
4538
4539         case HCI_KEYPRESS_COMPLETED:
4540                 return;
4541         }
4542
4543         if (hci_dev_test_flag(hdev, HCI_MGMT))
4544                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4545                                          conn->dst_type, conn->passkey_notify,
4546                                          conn->passkey_entered);
4547 }
4548
4549 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4550                                          struct sk_buff *skb)
4551 {
4552         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4553         struct hci_conn *conn;
4554
4555         BT_DBG("%s", hdev->name);
4556
4557         hci_dev_lock(hdev);
4558
4559         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4560         if (!conn)
4561                 goto unlock;
4562
4563         /* Reset the authentication requirement to unknown */
4564         conn->remote_auth = 0xff;
4565
4566         /* To avoid duplicate auth_failed events to user space we check
4567          * the HCI_CONN_AUTH_PEND flag which will be set if we
4568          * initiated the authentication. A traditional auth_complete
4569          * event gets always produced as initiator and is also mapped to
4570          * the mgmt_auth_failed event */
4571         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4572                 mgmt_auth_failed(conn, ev->status);
4573
4574         hci_conn_drop(conn);
4575
4576 unlock:
4577         hci_dev_unlock(hdev);
4578 }
4579
4580 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4581                                          struct sk_buff *skb)
4582 {
4583         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4584         struct inquiry_entry *ie;
4585         struct hci_conn *conn;
4586
4587         BT_DBG("%s", hdev->name);
4588
4589         hci_dev_lock(hdev);
4590
4591         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4592         if (conn)
4593                 memcpy(conn->features[1], ev->features, 8);
4594
4595         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4596         if (ie)
4597                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4598
4599         hci_dev_unlock(hdev);
4600 }
4601
4602 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4603                                             struct sk_buff *skb)
4604 {
4605         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4606         struct oob_data *data;
4607
4608         BT_DBG("%s", hdev->name);
4609
4610         hci_dev_lock(hdev);
4611
4612         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4613                 goto unlock;
4614
4615         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4616         if (!data) {
4617                 struct hci_cp_remote_oob_data_neg_reply cp;
4618
4619                 bacpy(&cp.bdaddr, &ev->bdaddr);
4620                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4621                              sizeof(cp), &cp);
4622                 goto unlock;
4623         }
4624
4625         if (bredr_sc_enabled(hdev)) {
4626                 struct hci_cp_remote_oob_ext_data_reply cp;
4627
4628                 bacpy(&cp.bdaddr, &ev->bdaddr);
4629                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4630                         memset(cp.hash192, 0, sizeof(cp.hash192));
4631                         memset(cp.rand192, 0, sizeof(cp.rand192));
4632                 } else {
4633                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4634                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4635                 }
4636                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4637                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4638
4639                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4640                              sizeof(cp), &cp);
4641         } else {
4642                 struct hci_cp_remote_oob_data_reply cp;
4643
4644                 bacpy(&cp.bdaddr, &ev->bdaddr);
4645                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4646                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4647
4648                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4649                              sizeof(cp), &cp);
4650         }
4651
4652 unlock:
4653         hci_dev_unlock(hdev);
4654 }
4655
4656 #if IS_ENABLED(CONFIG_BT_HS)
4657 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4658 {
4659         struct hci_ev_channel_selected *ev = (void *)skb->data;
4660         struct hci_conn *hcon;
4661
4662         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4663
4664         skb_pull(skb, sizeof(*ev));
4665
4666         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4667         if (!hcon)
4668                 return;
4669
4670         amp_read_loc_assoc_final_data(hdev, hcon);
4671 }
4672
4673 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4674                                       struct sk_buff *skb)
4675 {
4676         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4677         struct hci_conn *hcon, *bredr_hcon;
4678
4679         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4680                ev->status);
4681
4682         hci_dev_lock(hdev);
4683
4684         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4685         if (!hcon) {
4686                 hci_dev_unlock(hdev);
4687                 return;
4688         }
4689
4690         if (!hcon->amp_mgr) {
4691                 hci_dev_unlock(hdev);
4692                 return;
4693         }
4694
4695         if (ev->status) {
4696                 hci_conn_del(hcon);
4697                 hci_dev_unlock(hdev);
4698                 return;
4699         }
4700
4701         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4702
4703         hcon->state = BT_CONNECTED;
4704         bacpy(&hcon->dst, &bredr_hcon->dst);
4705
4706         hci_conn_hold(hcon);
4707         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4708         hci_conn_drop(hcon);
4709
4710         hci_debugfs_create_conn(hcon);
4711         hci_conn_add_sysfs(hcon);
4712
4713         amp_physical_cfm(bredr_hcon, hcon);
4714
4715         hci_dev_unlock(hdev);
4716 }
4717
4718 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4719 {
4720         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4721         struct hci_conn *hcon;
4722         struct hci_chan *hchan;
4723         struct amp_mgr *mgr;
4724
4725         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4726                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4727                ev->status);
4728
4729         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4730         if (!hcon)
4731                 return;
4732
4733         /* Create AMP hchan */
4734         hchan = hci_chan_create(hcon);
4735         if (!hchan)
4736                 return;
4737
4738         hchan->handle = le16_to_cpu(ev->handle);
4739         hchan->amp = true;
4740
4741         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4742
4743         mgr = hcon->amp_mgr;
4744         if (mgr && mgr->bredr_chan) {
4745                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4746
4747                 l2cap_chan_lock(bredr_chan);
4748
4749                 bredr_chan->conn->mtu = hdev->block_mtu;
4750                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4751                 hci_conn_hold(hcon);
4752
4753                 l2cap_chan_unlock(bredr_chan);
4754         }
4755 }
4756
4757 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4758                                              struct sk_buff *skb)
4759 {
4760         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4761         struct hci_chan *hchan;
4762
4763         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4764                le16_to_cpu(ev->handle), ev->status);
4765
4766         if (ev->status)
4767                 return;
4768
4769         hci_dev_lock(hdev);
4770
4771         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4772         if (!hchan || !hchan->amp)
4773                 goto unlock;
4774
4775         amp_destroy_logical_link(hchan, ev->reason);
4776
4777 unlock:
4778         hci_dev_unlock(hdev);
4779 }
4780
4781 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4782                                              struct sk_buff *skb)
4783 {
4784         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4785         struct hci_conn *hcon;
4786
4787         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4788
4789         if (ev->status)
4790                 return;
4791
4792         hci_dev_lock(hdev);
4793
4794         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4795         if (hcon && hcon->type == AMP_LINK) {
4796                 hcon->state = BT_CLOSED;
4797                 hci_disconn_cfm(hcon, ev->reason);
4798                 hci_conn_del(hcon);
4799         }
4800
4801         hci_dev_unlock(hdev);
4802 }
4803 #endif
4804
4805 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
4806                                 u8 bdaddr_type, bdaddr_t *local_rpa)
4807 {
4808         if (conn->out) {
4809                 conn->dst_type = bdaddr_type;
4810                 conn->resp_addr_type = bdaddr_type;
4811                 bacpy(&conn->resp_addr, bdaddr);
4812
4813                 /* Check if the controller has set a Local RPA then it must be
4814                  * used instead or hdev->rpa.
4815                  */
4816                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
4817                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4818                         bacpy(&conn->init_addr, local_rpa);
4819                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
4820                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4821                         bacpy(&conn->init_addr, &conn->hdev->rpa);
4822                 } else {
4823                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
4824                                                   &conn->init_addr_type);
4825                 }
4826         } else {
4827                 conn->resp_addr_type = conn->hdev->adv_addr_type;
4828                 /* Check if the controller has set a Local RPA then it must be
4829                  * used instead or hdev->rpa.
4830                  */
4831                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
4832                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
4833                         bacpy(&conn->resp_addr, local_rpa);
4834                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4835                         /* In case of ext adv, resp_addr will be updated in
4836                          * Adv Terminated event.
4837                          */
4838                         if (!ext_adv_capable(conn->hdev))
4839                                 bacpy(&conn->resp_addr,
4840                                       &conn->hdev->random_addr);
4841                 } else {
4842                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
4843                 }
4844
4845                 conn->init_addr_type = bdaddr_type;
4846                 bacpy(&conn->init_addr, bdaddr);
4847
4848                 /* For incoming connections, set the default minimum
4849                  * and maximum connection interval. They will be used
4850                  * to check if the parameters are in range and if not
4851                  * trigger the connection update procedure.
4852                  */
4853                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
4854                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
4855         }
4856 }
4857
4858 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4859                                  bdaddr_t *bdaddr, u8 bdaddr_type,
4860                                  bdaddr_t *local_rpa, u8 role, u16 handle,
4861                                  u16 interval, u16 latency,
4862                                  u16 supervision_timeout)
4863 {
4864         struct hci_conn_params *params;
4865         struct hci_conn *conn;
4866         struct smp_irk *irk;
4867         u8 addr_type;
4868
4869         hci_dev_lock(hdev);
4870
4871         /* All controllers implicitly stop advertising in the event of a
4872          * connection, so ensure that the state bit is cleared.
4873          */
4874         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4875
4876         conn = hci_lookup_le_connect(hdev);
4877         if (!conn) {
4878                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4879                 if (!conn) {
4880                         bt_dev_err(hdev, "no memory for new connection");
4881                         goto unlock;
4882                 }
4883
4884                 conn->dst_type = bdaddr_type;
4885
4886                 /* If we didn't have a hci_conn object previously
4887                  * but we're in master role this must be something
4888                  * initiated using a white list. Since white list based
4889                  * connections are not "first class citizens" we don't
4890                  * have full tracking of them. Therefore, we go ahead
4891                  * with a "best effort" approach of determining the
4892                  * initiator address based on the HCI_PRIVACY flag.
4893                  */
4894                 if (conn->out) {
4895                         conn->resp_addr_type = bdaddr_type;
4896                         bacpy(&conn->resp_addr, bdaddr);
4897                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4898                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4899                                 bacpy(&conn->init_addr, &hdev->rpa);
4900                         } else {
4901                                 hci_copy_identity_address(hdev,
4902                                                           &conn->init_addr,
4903                                                           &conn->init_addr_type);
4904                         }
4905                 }
4906         } else {
4907                 cancel_delayed_work(&conn->le_conn_timeout);
4908         }
4909
4910         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
4911
4912         /* Lookup the identity address from the stored connection
4913          * address and address type.
4914          *
4915          * When establishing connections to an identity address, the
4916          * connection procedure will store the resolvable random
4917          * address first. Now if it can be converted back into the
4918          * identity address, start using the identity address from
4919          * now on.
4920          */
4921         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4922         if (irk) {
4923                 bacpy(&conn->dst, &irk->bdaddr);
4924                 conn->dst_type = irk->addr_type;
4925         }
4926
4927         if (status) {
4928                 hci_le_conn_failed(conn, status);
4929                 goto unlock;
4930         }
4931
4932         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4933                 addr_type = BDADDR_LE_PUBLIC;
4934         else
4935                 addr_type = BDADDR_LE_RANDOM;
4936
4937         /* Drop the connection if the device is blocked */
4938         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4939                 hci_conn_drop(conn);
4940                 goto unlock;
4941         }
4942
4943         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4944                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4945
4946         conn->sec_level = BT_SECURITY_LOW;
4947         conn->handle = handle;
4948         conn->state = BT_CONFIG;
4949
4950         conn->le_conn_interval = interval;
4951         conn->le_conn_latency = latency;
4952         conn->le_supv_timeout = supervision_timeout;
4953
4954         hci_debugfs_create_conn(conn);
4955         hci_conn_add_sysfs(conn);
4956
4957         if (!status) {
4958                 /* The remote features procedure is defined for master
4959                  * role only. So only in case of an initiated connection
4960                  * request the remote features.
4961                  *
4962                  * If the local controller supports slave-initiated features
4963                  * exchange, then requesting the remote features in slave
4964                  * role is possible. Otherwise just transition into the
4965                  * connected state without requesting the remote features.
4966                  */
4967                 if (conn->out ||
4968                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4969                         struct hci_cp_le_read_remote_features cp;
4970
4971                         cp.handle = __cpu_to_le16(conn->handle);
4972
4973                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4974                                      sizeof(cp), &cp);
4975
4976                         hci_conn_hold(conn);
4977                 } else {
4978                         conn->state = BT_CONNECTED;
4979                         hci_connect_cfm(conn, status);
4980                 }
4981         } else {
4982                 hci_connect_cfm(conn, status);
4983         }
4984
4985         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4986                                            conn->dst_type);
4987         if (params) {
4988                 list_del_init(&params->action);
4989                 if (params->conn) {
4990                         hci_conn_drop(params->conn);
4991                         hci_conn_put(params->conn);
4992                         params->conn = NULL;
4993                 }
4994         }
4995
4996 unlock:
4997         hci_update_background_scan(hdev);
4998         hci_dev_unlock(hdev);
4999 }
5000
5001 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5002 {
5003         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5004
5005         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5006
5007         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5008                              NULL, ev->role, le16_to_cpu(ev->handle),
5009                              le16_to_cpu(ev->interval),
5010                              le16_to_cpu(ev->latency),
5011                              le16_to_cpu(ev->supervision_timeout));
5012 }
5013
5014 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5015                                          struct sk_buff *skb)
5016 {
5017         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5018
5019         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5020
5021         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5022                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5023                              le16_to_cpu(ev->interval),
5024                              le16_to_cpu(ev->latency),
5025                              le16_to_cpu(ev->supervision_timeout));
5026 }
5027
5028 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5029 {
5030         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5031         struct hci_conn *conn;
5032
5033         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5034
5035         if (ev->status) {
5036                 struct adv_info *adv;
5037
5038                 adv = hci_find_adv_instance(hdev, ev->handle);
5039                 if (!adv)
5040                         return;
5041
5042                 /* Remove advertising as it has been terminated */
5043                 hci_remove_adv_instance(hdev, ev->handle);
5044                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5045
5046                 return;
5047         }
5048
5049         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5050         if (conn) {
5051                 struct adv_info *adv_instance;
5052
5053                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5054                     bacmp(&conn->resp_addr, BDADDR_ANY))
5055                         return;
5056
5057                 if (!hdev->cur_adv_instance) {
5058                         bacpy(&conn->resp_addr, &hdev->random_addr);
5059                         return;
5060                 }
5061
5062                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5063                 if (adv_instance)
5064                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5065         }
5066 }
5067
5068 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5069                                             struct sk_buff *skb)
5070 {
5071         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5072         struct hci_conn *conn;
5073
5074         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5075
5076         if (ev->status)
5077                 return;
5078
5079         hci_dev_lock(hdev);
5080
5081         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5082         if (conn) {
5083                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5084                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5085                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5086         }
5087
5088         hci_dev_unlock(hdev);
5089 }
5090
5091 /* This function requires the caller holds hdev->lock */
5092 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5093                                               bdaddr_t *addr,
5094                                               u8 addr_type, u8 adv_type,
5095                                               bdaddr_t *direct_rpa)
5096 {
5097         struct hci_conn *conn;
5098         struct hci_conn_params *params;
5099
5100         /* If the event is not connectable don't proceed further */
5101         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5102                 return NULL;
5103
5104         /* Ignore if the device is blocked */
5105         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5106                 return NULL;
5107
5108         /* Most controller will fail if we try to create new connections
5109          * while we have an existing one in slave role.
5110          */
5111         if (hdev->conn_hash.le_num_slave > 0)
5112                 return NULL;
5113
5114         /* If we're not connectable only connect devices that we have in
5115          * our pend_le_conns list.
5116          */
5117         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5118                                            addr_type);
5119         if (!params)
5120                 return NULL;
5121
5122         if (!params->explicit_connect) {
5123                 switch (params->auto_connect) {
5124                 case HCI_AUTO_CONN_DIRECT:
5125                         /* Only devices advertising with ADV_DIRECT_IND are
5126                          * triggering a connection attempt. This is allowing
5127                          * incoming connections from slave devices.
5128                          */
5129                         if (adv_type != LE_ADV_DIRECT_IND)
5130                                 return NULL;
5131                         break;
5132                 case HCI_AUTO_CONN_ALWAYS:
5133                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5134                          * are triggering a connection attempt. This means
5135                          * that incoming connectioms from slave device are
5136                          * accepted and also outgoing connections to slave
5137                          * devices are established when found.
5138                          */
5139                         break;
5140                 default:
5141                         return NULL;
5142                 }
5143         }
5144
5145         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5146                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5147                               direct_rpa);
5148         if (!IS_ERR(conn)) {
5149                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5150                  * by higher layer that tried to connect, if no then
5151                  * store the pointer since we don't really have any
5152                  * other owner of the object besides the params that
5153                  * triggered it. This way we can abort the connection if
5154                  * the parameters get removed and keep the reference
5155                  * count consistent once the connection is established.
5156                  */
5157
5158                 if (!params->explicit_connect)
5159                         params->conn = hci_conn_get(conn);
5160
5161                 return conn;
5162         }
5163
5164         switch (PTR_ERR(conn)) {
5165         case -EBUSY:
5166                 /* If hci_connect() returns -EBUSY it means there is already
5167                  * an LE connection attempt going on. Since controllers don't
5168                  * support more than one connection attempt at the time, we
5169                  * don't consider this an error case.
5170                  */
5171                 break;
5172         default:
5173                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5174                 return NULL;
5175         }
5176
5177         return NULL;
5178 }
5179
5180 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5181                                u8 bdaddr_type, bdaddr_t *direct_addr,
5182                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5183                                bool ext_adv)
5184 {
5185         struct discovery_state *d = &hdev->discovery;
5186         struct smp_irk *irk;
5187         struct hci_conn *conn;
5188         bool match;
5189         u32 flags;
5190         u8 *ptr, real_len;
5191
5192         switch (type) {
5193         case LE_ADV_IND:
5194         case LE_ADV_DIRECT_IND:
5195         case LE_ADV_SCAN_IND:
5196         case LE_ADV_NONCONN_IND:
5197         case LE_ADV_SCAN_RSP:
5198                 break;
5199         default:
5200                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5201                                        "type: 0x%02x", type);
5202                 return;
5203         }
5204
5205         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5206                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5207                 return;
5208         }
5209
5210         /* Find the end of the data in case the report contains padded zero
5211          * bytes at the end causing an invalid length value.
5212          *
5213          * When data is NULL, len is 0 so there is no need for extra ptr
5214          * check as 'ptr < data + 0' is already false in such case.
5215          */
5216         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5217                 if (ptr + 1 + *ptr > data + len)
5218                         break;
5219         }
5220
5221         real_len = ptr - data;
5222
5223         /* Adjust for actual length */
5224         if (len != real_len) {
5225                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5226                 len = real_len;
5227         }
5228
5229         /* If the direct address is present, then this report is from
5230          * a LE Direct Advertising Report event. In that case it is
5231          * important to see if the address is matching the local
5232          * controller address.
5233          */
5234         if (direct_addr) {
5235                 /* Only resolvable random addresses are valid for these
5236                  * kind of reports and others can be ignored.
5237                  */
5238                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5239                         return;
5240
5241                 /* If the controller is not using resolvable random
5242                  * addresses, then this report can be ignored.
5243                  */
5244                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5245                         return;
5246
5247                 /* If the local IRK of the controller does not match
5248                  * with the resolvable random address provided, then
5249                  * this report can be ignored.
5250                  */
5251                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5252                         return;
5253         }
5254
5255         /* Check if we need to convert to identity address */
5256         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5257         if (irk) {
5258                 bdaddr = &irk->bdaddr;
5259                 bdaddr_type = irk->addr_type;
5260         }
5261
5262         /* Check if we have been requested to connect to this device.
5263          *
5264          * direct_addr is set only for directed advertising reports (it is NULL
5265          * for advertising reports) and is already verified to be RPA above.
5266          */
5267         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5268                                                                 direct_addr);
5269         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5270                 /* Store report for later inclusion by
5271                  * mgmt_device_connected
5272                  */
5273                 memcpy(conn->le_adv_data, data, len);
5274                 conn->le_adv_data_len = len;
5275         }
5276
5277         /* Passive scanning shouldn't trigger any device found events,
5278          * except for devices marked as CONN_REPORT for which we do send
5279          * device found events.
5280          */
5281         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5282                 if (type == LE_ADV_DIRECT_IND)
5283                         return;
5284
5285                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5286                                                bdaddr, bdaddr_type))
5287                         return;
5288
5289                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5290                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5291                 else
5292                         flags = 0;
5293                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5294                                   rssi, flags, data, len, NULL, 0);
5295                 return;
5296         }
5297
5298         /* When receiving non-connectable or scannable undirected
5299          * advertising reports, this means that the remote device is
5300          * not connectable and then clearly indicate this in the
5301          * device found event.
5302          *
5303          * When receiving a scan response, then there is no way to
5304          * know if the remote device is connectable or not. However
5305          * since scan responses are merged with a previously seen
5306          * advertising report, the flags field from that report
5307          * will be used.
5308          *
5309          * In the really unlikely case that a controller get confused
5310          * and just sends a scan response event, then it is marked as
5311          * not connectable as well.
5312          */
5313         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5314             type == LE_ADV_SCAN_RSP)
5315                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5316         else
5317                 flags = 0;
5318
5319         /* If there's nothing pending either store the data from this
5320          * event or send an immediate device found event if the data
5321          * should not be stored for later.
5322          */
5323         if (!ext_adv && !has_pending_adv_report(hdev)) {
5324                 /* If the report will trigger a SCAN_REQ store it for
5325                  * later merging.
5326                  */
5327                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5328                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5329                                                  rssi, flags, data, len);
5330                         return;
5331                 }
5332
5333                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5334                                   rssi, flags, data, len, NULL, 0);
5335                 return;
5336         }
5337
5338         /* Check if the pending report is for the same device as the new one */
5339         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5340                  bdaddr_type == d->last_adv_addr_type);
5341
5342         /* If the pending data doesn't match this report or this isn't a
5343          * scan response (e.g. we got a duplicate ADV_IND) then force
5344          * sending of the pending data.
5345          */
5346         if (type != LE_ADV_SCAN_RSP || !match) {
5347                 /* Send out whatever is in the cache, but skip duplicates */
5348                 if (!match)
5349                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5350                                           d->last_adv_addr_type, NULL,
5351                                           d->last_adv_rssi, d->last_adv_flags,
5352                                           d->last_adv_data,
5353                                           d->last_adv_data_len, NULL, 0);
5354
5355                 /* If the new report will trigger a SCAN_REQ store it for
5356                  * later merging.
5357                  */
5358                 if (!ext_adv && (type == LE_ADV_IND ||
5359                                  type == LE_ADV_SCAN_IND)) {
5360                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5361                                                  rssi, flags, data, len);
5362                         return;
5363                 }
5364
5365                 /* The advertising reports cannot be merged, so clear
5366                  * the pending report and send out a device found event.
5367                  */
5368                 clear_pending_adv_report(hdev);
5369                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5370                                   rssi, flags, data, len, NULL, 0);
5371                 return;
5372         }
5373
5374         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5375          * the new event is a SCAN_RSP. We can therefore proceed with
5376          * sending a merged device found event.
5377          */
5378         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5379                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5380                           d->last_adv_data, d->last_adv_data_len, data, len);
5381         clear_pending_adv_report(hdev);
5382 }
5383
5384 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5385 {
5386         u8 num_reports = skb->data[0];
5387         void *ptr = &skb->data[1];
5388
5389         hci_dev_lock(hdev);
5390
5391         while (num_reports--) {
5392                 struct hci_ev_le_advertising_info *ev = ptr;
5393                 s8 rssi;
5394
5395                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
5396                         bt_dev_err(hdev, "Malicious advertising data.");
5397                         break;
5398                 }
5399
5400                 if (ev->length <= HCI_MAX_AD_LENGTH &&
5401                     ev->data + ev->length <= skb_tail_pointer(skb)) {
5402                         rssi = ev->data[ev->length];
5403                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5404                                            ev->bdaddr_type, NULL, 0, rssi,
5405                                            ev->data, ev->length, false);
5406                 } else {
5407                         bt_dev_err(hdev, "Dropping invalid advertising data");
5408                 }
5409
5410                 ptr += sizeof(*ev) + ev->length + 1;
5411         }
5412
5413         hci_dev_unlock(hdev);
5414 }
5415
5416 static u8 ext_evt_type_to_legacy(u16 evt_type)
5417 {
5418         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5419                 switch (evt_type) {
5420                 case LE_LEGACY_ADV_IND:
5421                         return LE_ADV_IND;
5422                 case LE_LEGACY_ADV_DIRECT_IND:
5423                         return LE_ADV_DIRECT_IND;
5424                 case LE_LEGACY_ADV_SCAN_IND:
5425                         return LE_ADV_SCAN_IND;
5426                 case LE_LEGACY_NONCONN_IND:
5427                         return LE_ADV_NONCONN_IND;
5428                 case LE_LEGACY_SCAN_RSP_ADV:
5429                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5430                         return LE_ADV_SCAN_RSP;
5431                 }
5432
5433                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5434                                    evt_type);
5435
5436                 return LE_ADV_INVALID;
5437         }
5438
5439         if (evt_type & LE_EXT_ADV_CONN_IND) {
5440                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5441                         return LE_ADV_DIRECT_IND;
5442
5443                 return LE_ADV_IND;
5444         }
5445
5446         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5447                 return LE_ADV_SCAN_RSP;
5448
5449         if (evt_type & LE_EXT_ADV_SCAN_IND)
5450                 return LE_ADV_SCAN_IND;
5451
5452         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5453             evt_type & LE_EXT_ADV_DIRECT_IND)
5454                 return LE_ADV_NONCONN_IND;
5455
5456         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5457                                    evt_type);
5458
5459         return LE_ADV_INVALID;
5460 }
5461
5462 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5463 {
5464         u8 num_reports = skb->data[0];
5465         void *ptr = &skb->data[1];
5466
5467         hci_dev_lock(hdev);
5468
5469         while (num_reports--) {
5470                 struct hci_ev_le_ext_adv_report *ev = ptr;
5471                 u8 legacy_evt_type;
5472                 u16 evt_type;
5473
5474                 evt_type = __le16_to_cpu(ev->evt_type);
5475                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5476                 if (legacy_evt_type != LE_ADV_INVALID) {
5477                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5478                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5479                                            ev->data, ev->length,
5480                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5481                 }
5482
5483                 ptr += sizeof(*ev) + ev->length + 1;
5484         }
5485
5486         hci_dev_unlock(hdev);
5487 }
5488
5489 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5490                                             struct sk_buff *skb)
5491 {
5492         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5493         struct hci_conn *conn;
5494
5495         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5496
5497         hci_dev_lock(hdev);
5498
5499         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5500         if (conn) {
5501                 if (!ev->status)
5502                         memcpy(conn->features[0], ev->features, 8);
5503
5504                 if (conn->state == BT_CONFIG) {
5505                         __u8 status;
5506
5507                         /* If the local controller supports slave-initiated
5508                          * features exchange, but the remote controller does
5509                          * not, then it is possible that the error code 0x1a
5510                          * for unsupported remote feature gets returned.
5511                          *
5512                          * In this specific case, allow the connection to
5513                          * transition into connected state and mark it as
5514                          * successful.
5515                          */
5516                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5517                             !conn->out && ev->status == 0x1a)
5518                                 status = 0x00;
5519                         else
5520                                 status = ev->status;
5521
5522                         conn->state = BT_CONNECTED;
5523                         hci_connect_cfm(conn, status);
5524                         hci_conn_drop(conn);
5525                 }
5526         }
5527
5528         hci_dev_unlock(hdev);
5529 }
5530
5531 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5532 {
5533         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5534         struct hci_cp_le_ltk_reply cp;
5535         struct hci_cp_le_ltk_neg_reply neg;
5536         struct hci_conn *conn;
5537         struct smp_ltk *ltk;
5538
5539         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5540
5541         hci_dev_lock(hdev);
5542
5543         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5544         if (conn == NULL)
5545                 goto not_found;
5546
5547         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5548         if (!ltk)
5549                 goto not_found;
5550
5551         if (smp_ltk_is_sc(ltk)) {
5552                 /* With SC both EDiv and Rand are set to zero */
5553                 if (ev->ediv || ev->rand)
5554                         goto not_found;
5555         } else {
5556                 /* For non-SC keys check that EDiv and Rand match */
5557                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5558                         goto not_found;
5559         }
5560
5561         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5562         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5563         cp.handle = cpu_to_le16(conn->handle);
5564
5565         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5566
5567         conn->enc_key_size = ltk->enc_size;
5568
5569         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5570
5571         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5572          * temporary key used to encrypt a connection following
5573          * pairing. It is used during the Encrypted Session Setup to
5574          * distribute the keys. Later, security can be re-established
5575          * using a distributed LTK.
5576          */
5577         if (ltk->type == SMP_STK) {
5578                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5579                 list_del_rcu(&ltk->list);
5580                 kfree_rcu(ltk, rcu);
5581         } else {
5582                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5583         }
5584
5585         hci_dev_unlock(hdev);
5586
5587         return;
5588
5589 not_found:
5590         neg.handle = ev->handle;
5591         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5592         hci_dev_unlock(hdev);
5593 }
5594
5595 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5596                                       u8 reason)
5597 {
5598         struct hci_cp_le_conn_param_req_neg_reply cp;
5599
5600         cp.handle = cpu_to_le16(handle);
5601         cp.reason = reason;
5602
5603         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5604                      &cp);
5605 }
5606
5607 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5608                                              struct sk_buff *skb)
5609 {
5610         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5611         struct hci_cp_le_conn_param_req_reply cp;
5612         struct hci_conn *hcon;
5613         u16 handle, min, max, latency, timeout;
5614
5615         handle = le16_to_cpu(ev->handle);
5616         min = le16_to_cpu(ev->interval_min);
5617         max = le16_to_cpu(ev->interval_max);
5618         latency = le16_to_cpu(ev->latency);
5619         timeout = le16_to_cpu(ev->timeout);
5620
5621         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5622         if (!hcon || hcon->state != BT_CONNECTED)
5623                 return send_conn_param_neg_reply(hdev, handle,
5624                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5625
5626         if (hci_check_conn_params(min, max, latency, timeout))
5627                 return send_conn_param_neg_reply(hdev, handle,
5628                                                  HCI_ERROR_INVALID_LL_PARAMS);
5629
5630         if (hcon->role == HCI_ROLE_MASTER) {
5631                 struct hci_conn_params *params;
5632                 u8 store_hint;
5633
5634                 hci_dev_lock(hdev);
5635
5636                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5637                                                 hcon->dst_type);
5638                 if (params) {
5639                         params->conn_min_interval = min;
5640                         params->conn_max_interval = max;
5641                         params->conn_latency = latency;
5642                         params->supervision_timeout = timeout;
5643                         store_hint = 0x01;
5644                 } else{
5645                         store_hint = 0x00;
5646                 }
5647
5648                 hci_dev_unlock(hdev);
5649
5650                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5651                                     store_hint, min, max, latency, timeout);
5652         }
5653
5654         cp.handle = ev->handle;
5655         cp.interval_min = ev->interval_min;
5656         cp.interval_max = ev->interval_max;
5657         cp.latency = ev->latency;
5658         cp.timeout = ev->timeout;
5659         cp.min_ce_len = 0;
5660         cp.max_ce_len = 0;
5661
5662         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5663 }
5664
5665 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5666                                          struct sk_buff *skb)
5667 {
5668         u8 num_reports = skb->data[0];
5669         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
5670
5671         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
5672                 return;
5673
5674         hci_dev_lock(hdev);
5675
5676         for (; num_reports; num_reports--, ev++)
5677                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5678                                    ev->bdaddr_type, &ev->direct_addr,
5679                                    ev->direct_addr_type, ev->rssi, NULL, 0,
5680                                    false);
5681
5682         hci_dev_unlock(hdev);
5683 }
5684
5685 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5686 {
5687         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5688
5689         skb_pull(skb, sizeof(*le_ev));
5690
5691         switch (le_ev->subevent) {
5692         case HCI_EV_LE_CONN_COMPLETE:
5693                 hci_le_conn_complete_evt(hdev, skb);
5694                 break;
5695
5696         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5697                 hci_le_conn_update_complete_evt(hdev, skb);
5698                 break;
5699
5700         case HCI_EV_LE_ADVERTISING_REPORT:
5701                 hci_le_adv_report_evt(hdev, skb);
5702                 break;
5703
5704         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5705                 hci_le_remote_feat_complete_evt(hdev, skb);
5706                 break;
5707
5708         case HCI_EV_LE_LTK_REQ:
5709                 hci_le_ltk_request_evt(hdev, skb);
5710                 break;
5711
5712         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5713                 hci_le_remote_conn_param_req_evt(hdev, skb);
5714                 break;
5715
5716         case HCI_EV_LE_DIRECT_ADV_REPORT:
5717                 hci_le_direct_adv_report_evt(hdev, skb);
5718                 break;
5719
5720         case HCI_EV_LE_EXT_ADV_REPORT:
5721                 hci_le_ext_adv_report_evt(hdev, skb);
5722                 break;
5723
5724         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5725                 hci_le_enh_conn_complete_evt(hdev, skb);
5726                 break;
5727
5728         case HCI_EV_LE_EXT_ADV_SET_TERM:
5729                 hci_le_ext_adv_term_evt(hdev, skb);
5730                 break;
5731
5732         default:
5733                 break;
5734         }
5735 }
5736
5737 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5738                                  u8 event, struct sk_buff *skb)
5739 {
5740         struct hci_ev_cmd_complete *ev;
5741         struct hci_event_hdr *hdr;
5742
5743         if (!skb)
5744                 return false;
5745
5746         if (skb->len < sizeof(*hdr)) {
5747                 bt_dev_err(hdev, "too short HCI event");
5748                 return false;
5749         }
5750
5751         hdr = (void *) skb->data;
5752         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5753
5754         if (event) {
5755                 if (hdr->evt != event)
5756                         return false;
5757                 return true;
5758         }
5759
5760         /* Check if request ended in Command Status - no way to retreive
5761          * any extra parameters in this case.
5762          */
5763         if (hdr->evt == HCI_EV_CMD_STATUS)
5764                 return false;
5765
5766         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5767                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5768                            hdr->evt);
5769                 return false;
5770         }
5771
5772         if (skb->len < sizeof(*ev)) {
5773                 bt_dev_err(hdev, "too short cmd_complete event");
5774                 return false;
5775         }
5776
5777         ev = (void *) skb->data;
5778         skb_pull(skb, sizeof(*ev));
5779
5780         if (opcode != __le16_to_cpu(ev->opcode)) {
5781                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5782                        __le16_to_cpu(ev->opcode));
5783                 return false;
5784         }
5785
5786         return true;
5787 }
5788
5789 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5790 {
5791         struct hci_event_hdr *hdr = (void *) skb->data;
5792         hci_req_complete_t req_complete = NULL;
5793         hci_req_complete_skb_t req_complete_skb = NULL;
5794         struct sk_buff *orig_skb = NULL;
5795         u8 status = 0, event = hdr->evt, req_evt = 0;
5796         u16 opcode = HCI_OP_NOP;
5797
5798         if (!event) {
5799                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
5800                 goto done;
5801         }
5802
5803         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5804                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5805                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5806                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5807                                      &req_complete_skb);
5808                 req_evt = event;
5809         }
5810
5811         /* If it looks like we might end up having to call
5812          * req_complete_skb, store a pristine copy of the skb since the
5813          * various handlers may modify the original one through
5814          * skb_pull() calls, etc.
5815          */
5816         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5817             event == HCI_EV_CMD_COMPLETE)
5818                 orig_skb = skb_clone(skb, GFP_KERNEL);
5819
5820         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5821
5822         switch (event) {
5823         case HCI_EV_INQUIRY_COMPLETE:
5824                 hci_inquiry_complete_evt(hdev, skb);
5825                 break;
5826
5827         case HCI_EV_INQUIRY_RESULT:
5828                 hci_inquiry_result_evt(hdev, skb);
5829                 break;
5830
5831         case HCI_EV_CONN_COMPLETE:
5832                 hci_conn_complete_evt(hdev, skb);
5833                 break;
5834
5835         case HCI_EV_CONN_REQUEST:
5836                 hci_conn_request_evt(hdev, skb);
5837                 break;
5838
5839         case HCI_EV_DISCONN_COMPLETE:
5840                 hci_disconn_complete_evt(hdev, skb);
5841                 break;
5842
5843         case HCI_EV_AUTH_COMPLETE:
5844                 hci_auth_complete_evt(hdev, skb);
5845                 break;
5846
5847         case HCI_EV_REMOTE_NAME:
5848                 hci_remote_name_evt(hdev, skb);
5849                 break;
5850
5851         case HCI_EV_ENCRYPT_CHANGE:
5852                 hci_encrypt_change_evt(hdev, skb);
5853                 break;
5854
5855         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5856                 hci_change_link_key_complete_evt(hdev, skb);
5857                 break;
5858
5859         case HCI_EV_REMOTE_FEATURES:
5860                 hci_remote_features_evt(hdev, skb);
5861                 break;
5862
5863         case HCI_EV_CMD_COMPLETE:
5864                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5865                                      &req_complete, &req_complete_skb);
5866                 break;
5867
5868         case HCI_EV_CMD_STATUS:
5869                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5870                                    &req_complete_skb);
5871                 break;
5872
5873         case HCI_EV_HARDWARE_ERROR:
5874                 hci_hardware_error_evt(hdev, skb);
5875                 break;
5876
5877         case HCI_EV_ROLE_CHANGE:
5878                 hci_role_change_evt(hdev, skb);
5879                 break;
5880
5881         case HCI_EV_NUM_COMP_PKTS:
5882                 hci_num_comp_pkts_evt(hdev, skb);
5883                 break;
5884
5885         case HCI_EV_MODE_CHANGE:
5886                 hci_mode_change_evt(hdev, skb);
5887                 break;
5888
5889         case HCI_EV_PIN_CODE_REQ:
5890                 hci_pin_code_request_evt(hdev, skb);
5891                 break;
5892
5893         case HCI_EV_LINK_KEY_REQ:
5894                 hci_link_key_request_evt(hdev, skb);
5895                 break;
5896
5897         case HCI_EV_LINK_KEY_NOTIFY:
5898                 hci_link_key_notify_evt(hdev, skb);
5899                 break;
5900
5901         case HCI_EV_CLOCK_OFFSET:
5902                 hci_clock_offset_evt(hdev, skb);
5903                 break;
5904
5905         case HCI_EV_PKT_TYPE_CHANGE:
5906                 hci_pkt_type_change_evt(hdev, skb);
5907                 break;
5908
5909         case HCI_EV_PSCAN_REP_MODE:
5910                 hci_pscan_rep_mode_evt(hdev, skb);
5911                 break;
5912
5913         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5914                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5915                 break;
5916
5917         case HCI_EV_REMOTE_EXT_FEATURES:
5918                 hci_remote_ext_features_evt(hdev, skb);
5919                 break;
5920
5921         case HCI_EV_SYNC_CONN_COMPLETE:
5922                 hci_sync_conn_complete_evt(hdev, skb);
5923                 break;
5924
5925         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5926                 hci_extended_inquiry_result_evt(hdev, skb);
5927                 break;
5928
5929         case HCI_EV_KEY_REFRESH_COMPLETE:
5930                 hci_key_refresh_complete_evt(hdev, skb);
5931                 break;
5932
5933         case HCI_EV_IO_CAPA_REQUEST:
5934                 hci_io_capa_request_evt(hdev, skb);
5935                 break;
5936
5937         case HCI_EV_IO_CAPA_REPLY:
5938                 hci_io_capa_reply_evt(hdev, skb);
5939                 break;
5940
5941         case HCI_EV_USER_CONFIRM_REQUEST:
5942                 hci_user_confirm_request_evt(hdev, skb);
5943                 break;
5944
5945         case HCI_EV_USER_PASSKEY_REQUEST:
5946                 hci_user_passkey_request_evt(hdev, skb);
5947                 break;
5948
5949         case HCI_EV_USER_PASSKEY_NOTIFY:
5950                 hci_user_passkey_notify_evt(hdev, skb);
5951                 break;
5952
5953         case HCI_EV_KEYPRESS_NOTIFY:
5954                 hci_keypress_notify_evt(hdev, skb);
5955                 break;
5956
5957         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5958                 hci_simple_pair_complete_evt(hdev, skb);
5959                 break;
5960
5961         case HCI_EV_REMOTE_HOST_FEATURES:
5962                 hci_remote_host_features_evt(hdev, skb);
5963                 break;
5964
5965         case HCI_EV_LE_META:
5966                 hci_le_meta_evt(hdev, skb);
5967                 break;
5968
5969         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5970                 hci_remote_oob_data_request_evt(hdev, skb);
5971                 break;
5972
5973 #if IS_ENABLED(CONFIG_BT_HS)
5974         case HCI_EV_CHANNEL_SELECTED:
5975                 hci_chan_selected_evt(hdev, skb);
5976                 break;
5977
5978         case HCI_EV_PHY_LINK_COMPLETE:
5979                 hci_phy_link_complete_evt(hdev, skb);
5980                 break;
5981
5982         case HCI_EV_LOGICAL_LINK_COMPLETE:
5983                 hci_loglink_complete_evt(hdev, skb);
5984                 break;
5985
5986         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5987                 hci_disconn_loglink_complete_evt(hdev, skb);
5988                 break;
5989
5990         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5991                 hci_disconn_phylink_complete_evt(hdev, skb);
5992                 break;
5993 #endif
5994
5995         case HCI_EV_NUM_COMP_BLOCKS:
5996                 hci_num_comp_blocks_evt(hdev, skb);
5997                 break;
5998
5999         default:
6000                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6001                 break;
6002         }
6003
6004         if (req_complete) {
6005                 req_complete(hdev, status, opcode);
6006         } else if (req_complete_skb) {
6007                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6008                         kfree_skb(orig_skb);
6009                         orig_skb = NULL;
6010                 }
6011                 req_complete_skb(hdev, status, opcode, orig_skb);
6012         }
6013
6014 done:
6015         kfree_skb(orig_skb);
6016         kfree_skb(skb);
6017         hdev->stat.evt_rx++;
6018 }