kernel/net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  59         hci_dev_unlock(hdev);
  60
  61         hci_conn_check_pending(hdev);
  62 }
  63
  64 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  65 {
  66         __u8 status = *((__u8 *) skb->data);
  67
  68         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  69
  70         if (status)
  71                 return;
  72
  73         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  86
  87         hci_conn_check_pending(hdev);
  88 }
  89
  90 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  91                                           struct sk_buff *skb)
  92 {
  93         BT_DBG("%s", hdev->name);
  94 }
  95
  96 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  97 {
  98         struct hci_rp_role_discovery *rp = (void *) skb->data;
  99         struct hci_conn *conn;
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 102
 103         if (rp->status)
 104                 return;
 105
 106         hci_dev_lock(hdev);
 107
 108         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 109         if (conn)
 110                 conn->role = rp->role;
 111
 112         hci_dev_unlock(hdev);
 113 }
 114
 115 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 116 {
 117         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 118         struct hci_conn *conn;
 119
 120         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 121
 122         if (rp->status)
 123                 return;
 124
 125         hci_dev_lock(hdev);
 126
 127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 128         if (conn)
 129                 conn->link_policy = __le16_to_cpu(rp->policy);
 130
 131         hci_dev_unlock(hdev);
 132 }
 133
 134 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 135 {
 136         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 137         struct hci_conn *conn;
 138         void *sent;
 139
 140         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 141
 142         if (rp->status)
 143                 return;
 144
 145         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 146         if (!sent)
 147                 return;
 148
 149         hci_dev_lock(hdev);
 150
 151         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 152         if (conn)
 153                 conn->link_policy = get_unaligned_le16(sent + 2);
 154
 155         hci_dev_unlock(hdev);
 156 }
 157
 158 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 159                                         struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 172                                          struct sk_buff *skb)
 173 {
 174         __u8 status = *((__u8 *) skb->data);
 175         void *sent;
 176
 177         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 178
 179         if (status)
 180                 return;
 181
 182         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 183         if (!sent)
 184                 return;
 185
 186         hdev->link_policy = get_unaligned_le16(sent);
 187 }
 188
 189 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 190 {
 191         __u8 status = *((__u8 *) skb->data);
 192
 193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 194
 195         clear_bit(HCI_RESET, &hdev->flags);
 196
 197         if (status)
 198                 return;
 199
 200         /* Reset all non-persistent flags */
 201         hci_dev_clear_volatile_flags(hdev);
 202
 203         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 204
 205         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 206         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 207
 208         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 209         hdev->adv_data_len = 0;
 210
 211         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 212         hdev->scan_rsp_data_len = 0;
 213
 214         hdev->le_scan_type = LE_SCAN_PASSIVE;
 215
 216         hdev->ssp_debug_mode = 0;
 217
 218         hci_bdaddr_list_clear(&hdev->le_white_list);
 219 }
 220
 221 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 222                                         struct sk_buff *skb)
 223 {
 224         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 225         struct hci_cp_read_stored_link_key *sent;
 226
 227         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 228
 229         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 230         if (!sent)
 231                 return;
 232
 233         if (!rp->status && sent->read_all == 0x01) {
 234                 hdev->stored_max_keys = rp->max_keys;
 235                 hdev->stored_num_keys = rp->num_keys;
 236         }
 237 }
 238
 239 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 240                                           struct sk_buff *skb)
 241 {
 242         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 243
 244         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 245
 246         if (rp->status)
 247                 return;
 248
 249         if (rp->num_keys <= hdev->stored_num_keys)
 250                 hdev->stored_num_keys -= rp->num_keys;
 251         else
 252                 hdev->stored_num_keys = 0;
 253 }
 254
 255 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 256 {
 257         __u8 status = *((__u8 *) skb->data);
 258         void *sent;
 259
 260         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 261
 262         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 263         if (!sent)
 264                 return;
 265
 266         hci_dev_lock(hdev);
 267
 268         if (hci_dev_test_flag(hdev, HCI_MGMT))
 269                 mgmt_set_local_name_complete(hdev, sent, status);
 270         else if (!status)
 271                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 272
 273         hci_dev_unlock(hdev);
 274 }
 275
 276 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         struct hci_rp_read_local_name *rp = (void *) skb->data;
 279
 280         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 281
 282         if (rp->status)
 283                 return;
 284
 285         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 286             hci_dev_test_flag(hdev, HCI_CONFIG))
 287                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 288 }
 289
 290 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 291 {
 292         __u8 status = *((__u8 *) skb->data);
 293         void *sent;
 294
 295         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 296
 297         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 298         if (!sent)
 299                 return;
 300
 301         hci_dev_lock(hdev);
 302
 303         if (!status) {
 304                 __u8 param = *((__u8 *) sent);
 305
 306                 if (param == AUTH_ENABLED)
 307                         set_bit(HCI_AUTH, &hdev->flags);
 308                 else
 309                         clear_bit(HCI_AUTH, &hdev->flags);
 310         }
 311
 312         if (hci_dev_test_flag(hdev, HCI_MGMT))
 313                 mgmt_auth_enable_complete(hdev, status);
 314
 315         hci_dev_unlock(hdev);
 316 }
 317
 318 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 319 {
 320         __u8 status = *((__u8 *) skb->data);
 321         __u8 param;
 322         void *sent;
 323
 324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 325
 326         if (status)
 327                 return;
 328
 329         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 330         if (!sent)
 331                 return;
 332
 333         param = *((__u8 *) sent);
 334
 335         if (param)
 336                 set_bit(HCI_ENCRYPT, &hdev->flags);
 337         else
 338                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 339 }
 340
 341 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 342 {
 343         __u8 status = *((__u8 *) skb->data);
 344         __u8 param;
 345         void *sent;
 346
 347         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 348
 349         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 350         if (!sent)
 351                 return;
 352
 353         param = *((__u8 *) sent);
 354
 355         hci_dev_lock(hdev);
 356
 357         if (status) {
 358                 hdev->discov_timeout = 0;
 359                 goto done;
 360         }
 361
 362         if (param & SCAN_INQUIRY)
 363                 set_bit(HCI_ISCAN, &hdev->flags);
 364         else
 365                 clear_bit(HCI_ISCAN, &hdev->flags);
 366
 367         if (param & SCAN_PAGE)
 368                 set_bit(HCI_PSCAN, &hdev->flags);
 369         else
 370                 clear_bit(HCI_PSCAN, &hdev->flags);
 371
 372 done:
 373         hci_dev_unlock(hdev);
 374 }
 375
 376 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 377 {
 378         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 379
 380         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 381
 382         if (rp->status)
 383                 return;
 384
 385         memcpy(hdev->dev_class, rp->dev_class, 3);
 386
 387         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 388                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 389 }
 390
 391 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 392 {
 393         __u8 status = *((__u8 *) skb->data);
 394         void *sent;
 395
 396         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 397
 398         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 399         if (!sent)
 400                 return;
 401
 402         hci_dev_lock(hdev);
 403
 404         if (status == 0)
 405                 memcpy(hdev->dev_class, sent, 3);
 406
 407         if (hci_dev_test_flag(hdev, HCI_MGMT))
 408                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 409
 410         hci_dev_unlock(hdev);
 411 }
 412
 413 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 416         __u16 setting;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 419
 420         if (rp->status)
 421                 return;
 422
 423         setting = __le16_to_cpu(rp->voice_setting);
 424
 425         if (hdev->voice_setting == setting)
 426                 return;
 427
 428         hdev->voice_setting = setting;
 429
 430         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 431
 432         if (hdev->notify)
 433                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 434 }
 435
 436 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 437                                        struct sk_buff *skb)
 438 {
 439         __u8 status = *((__u8 *) skb->data);
 440         __u16 setting;
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         if (status)
 446                 return;
 447
 448         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 449         if (!sent)
 450                 return;
 451
 452         setting = get_unaligned_le16(sent);
 453
 454         if (hdev->voice_setting == setting)
 455                 return;
 456
 457         hdev->voice_setting = setting;
 458
 459         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 460
 461         if (hdev->notify)
 462                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 463 }
 464
 465 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 466                                           struct sk_buff *skb)
 467 {
 468         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 469
 470         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 471
 472         if (rp->status)
 473                 return;
 474
 475         hdev->num_iac = rp->num_iac;
 476
 477         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 478 }
 479
 480 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 481 {
 482         __u8 status = *((__u8 *) skb->data);
 483         struct hci_cp_write_ssp_mode *sent;
 484
 485         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 486
 487         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 488         if (!sent)
 489                 return;
 490
 491         hci_dev_lock(hdev);
 492
 493         if (!status) {
 494                 if (sent->mode)
 495                         hdev->features[1][0] |= LMP_HOST_SSP;
 496                 else
 497                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 498         }
 499
 500         if (hci_dev_test_flag(hdev, HCI_MGMT))
 501                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 502         else if (!status) {
 503                 if (sent->mode)
 504                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 505                 else
 506                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 507         }
 508
 509         hci_dev_unlock(hdev);
 510 }
 511
 512 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 513 {
 514         u8 status = *((u8 *) skb->data);
 515         struct hci_cp_write_sc_support *sent;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 518
 519         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 520         if (!sent)
 521                 return;
 522
 523         hci_dev_lock(hdev);
 524
 525         if (!status) {
 526                 if (sent->support)
 527                         hdev->features[1][0] |= LMP_HOST_SC;
 528                 else
 529                         hdev->features[1][0] &= ~LMP_HOST_SC;
 530         }
 531
 532         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 533                 if (sent->support)
 534                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 535                 else
 536                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 537         }
 538
 539         hci_dev_unlock(hdev);
 540 }
 541
 542 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 543 {
 544         struct hci_rp_read_local_version *rp = (void *) skb->data;
 545
 546         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 547
 548         if (rp->status)
 549                 return;
 550
 551         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 552             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 553                 hdev->hci_ver = rp->hci_ver;
 554                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 555                 hdev->lmp_ver = rp->lmp_ver;
 556                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 557                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 558         }
 559 }
 560
 561 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 562                                        struct sk_buff *skb)
 563 {
 564         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 565
 566         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 567
 568         if (rp->status)
 569                 return;
 570
 571         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 572             hci_dev_test_flag(hdev, HCI_CONFIG))
 573                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 574 }
 575
 576 static void hci_cc_read_local_features(struct hci_dev *hdev,
 577                                        struct sk_buff *skb)
 578 {
 579         struct hci_rp_read_local_features *rp = (void *) skb->data;
 580
 581         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 582
 583         if (rp->status)
 584                 return;
 585
 586         memcpy(hdev->features, rp->features, 8);
 587
 588         /* Adjust default settings according to features
 589          * supported by device. */
 590
 591         if (hdev->features[0][0] & LMP_3SLOT)
 592                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 593
 594         if (hdev->features[0][0] & LMP_5SLOT)
 595                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 596
 597         if (hdev->features[0][1] & LMP_HV2) {
 598                 hdev->pkt_type  |= (HCI_HV2);
 599                 hdev->esco_type |= (ESCO_HV2);
 600         }
 601
 602         if (hdev->features[0][1] & LMP_HV3) {
 603                 hdev->pkt_type  |= (HCI_HV3);
 604                 hdev->esco_type |= (ESCO_HV3);
 605         }
 606
 607         if (lmp_esco_capable(hdev))
 608                 hdev->esco_type |= (ESCO_EV3);
 609
 610         if (hdev->features[0][4] & LMP_EV4)
 611                 hdev->esco_type |= (ESCO_EV4);
 612
 613         if (hdev->features[0][4] & LMP_EV5)
 614                 hdev->esco_type |= (ESCO_EV5);
 615
 616         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 617                 hdev->esco_type |= (ESCO_2EV3);
 618
 619         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 620                 hdev->esco_type |= (ESCO_3EV3);
 621
 622         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 623                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 624 }
 625
 626 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 627                                            struct sk_buff *skb)
 628 {
 629         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 630
 631         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 632
 633         if (rp->status)
 634                 return;
 635
 636         if (hdev->max_page < rp->max_page)
 637                 hdev->max_page = rp->max_page;
 638
 639         if (rp->page < HCI_MAX_PAGES)
 640                 memcpy(hdev->features[rp->page], rp->features, 8);
 641 }
 642
 643 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 644                                           struct sk_buff *skb)
 645 {
 646         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 647
 648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650         if (rp->status)
 651                 return;
 652
 653         hdev->flow_ctl_mode = rp->mode;
 654 }
 655
 656 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 657 {
 658         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 659
 660         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 661
 662         if (rp->status)
 663                 return;
 664
 665         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 666         hdev->sco_mtu  = rp->sco_mtu;
 667         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 668         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 669
 670         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 671                 hdev->sco_mtu  = 64;
 672                 hdev->sco_pkts = 8;
 673         }
 674
 675         hdev->acl_cnt = hdev->acl_pkts;
 676         hdev->sco_cnt = hdev->sco_pkts;
 677
 678         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 679                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 680 }
 681
 682 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 683 {
 684         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 685
 686         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 687
 688         if (rp->status)
 689                 return;
 690
 691         if (test_bit(HCI_INIT, &hdev->flags))
 692                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 693
 694         if (hci_dev_test_flag(hdev, HCI_SETUP))
 695                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 696 }
 697
 698 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 699                                            struct sk_buff *skb)
 700 {
 701         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 702
 703         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 704
 705         if (rp->status)
 706                 return;
 707
 708         if (test_bit(HCI_INIT, &hdev->flags)) {
 709                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 710                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 711         }
 712 }
 713
 714 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 715                                             struct sk_buff *skb)
 716 {
 717         u8 status = *((u8 *) skb->data);
 718         struct hci_cp_write_page_scan_activity *sent;
 719
 720         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 721
 722         if (status)
 723                 return;
 724
 725         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 726         if (!sent)
 727                 return;
 728
 729         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 730         hdev->page_scan_window = __le16_to_cpu(sent->window);
 731 }
 732
 733 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 734                                            struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 return;
 742
 743         if (test_bit(HCI_INIT, &hdev->flags))
 744                 hdev->page_scan_type = rp->type;
 745 }
 746
 747 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 748                                         struct sk_buff *skb)
 749 {
 750         u8 status = *((u8 *) skb->data);
 751         u8 *type;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 754
 755         if (status)
 756                 return;
 757
 758         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 759         if (type)
 760                 hdev->page_scan_type = *type;
 761 }
 762
 763 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 764                                         struct sk_buff *skb)
 765 {
 766         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 767
 768         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 769
 770         if (rp->status)
 771                 return;
 772
 773         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 774         hdev->block_len = __le16_to_cpu(rp->block_len);
 775         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 776
 777         hdev->block_cnt = hdev->num_blocks;
 778
 779         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 780                hdev->block_cnt, hdev->block_len);
 781 }
 782
 783 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 784 {
 785         struct hci_rp_read_clock *rp = (void *) skb->data;
 786         struct hci_cp_read_clock *cp;
 787         struct hci_conn *conn;
 788
 789         BT_DBG("%s", hdev->name);
 790
 791         if (skb->len < sizeof(*rp))
 792                 return;
 793
 794         if (rp->status)
 795                 return;
 796
 797         hci_dev_lock(hdev);
 798
 799         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 800         if (!cp)
 801                 goto unlock;
 802
 803         if (cp->which == 0x00) {
 804                 hdev->clock = le32_to_cpu(rp->clock);
 805                 goto unlock;
 806         }
 807
 808         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 809         if (conn) {
 810                 conn->clock = le32_to_cpu(rp->clock);
 811                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 812         }
 813
 814 unlock:
 815         hci_dev_unlock(hdev);
 816 }
 817
 818 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 819                                        struct sk_buff *skb)
 820 {
 821         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 822
 823         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 824
 825         if (rp->status)
 826                 goto a2mp_rsp;
 827
 828         hdev->amp_status = rp->amp_status;
 829         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 830         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 831         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 832         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 833         hdev->amp_type = rp->amp_type;
 834         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 835         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 836         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 837         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 838
 839 a2mp_rsp:
 840         a2mp_send_getinfo_rsp(hdev);
 841 }
 842
 843 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 844                                         struct sk_buff *skb)
 845 {
 846         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 847         struct amp_assoc *assoc = &hdev->loc_assoc;
 848         size_t rem_len, frag_len;
 849
 850         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 851
 852         if (rp->status)
 853                 goto a2mp_rsp;
 854
 855         frag_len = skb->len - sizeof(*rp);
 856         rem_len = __le16_to_cpu(rp->rem_len);
 857
 858         if (rem_len > frag_len) {
 859                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 860
 861                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 862                 assoc->offset += frag_len;
 863
 864                 /* Read other fragments */
 865                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 866
 867                 return;
 868         }
 869
 870         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 871         assoc->len = assoc->offset + rem_len;
 872         assoc->offset = 0;
 873
 874 a2mp_rsp:
 875         /* Send A2MP Rsp when all fragments are received */
 876         a2mp_send_getampassoc_rsp(hdev, rp->status);
 877         a2mp_send_create_phy_link_req(hdev, rp->status);
 878 }
 879
 880 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 881                                          struct sk_buff *skb)
 882 {
 883         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 884
 885         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 886
 887         if (rp->status)
 888                 return;
 889
 890         hdev->inq_tx_power = rp->tx_power;
 891 }
 892
 893 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 894 {
 895         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 896         struct hci_cp_pin_code_reply *cp;
 897         struct hci_conn *conn;
 898
 899         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 900
 901         hci_dev_lock(hdev);
 902
 903         if (hci_dev_test_flag(hdev, HCI_MGMT))
 904                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 905
 906         if (rp->status)
 907                 goto unlock;
 908
 909         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 910         if (!cp)
 911                 goto unlock;
 912
 913         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 914         if (conn)
 915                 conn->pin_length = cp->pin_len;
 916
 917 unlock:
 918         hci_dev_unlock(hdev);
 919 }
 920
 921 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 922 {
 923         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 924
 925         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 926
 927         hci_dev_lock(hdev);
 928
 929         if (hci_dev_test_flag(hdev, HCI_MGMT))
 930                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 931                                                  rp->status);
 932
 933         hci_dev_unlock(hdev);
 934 }
 935
 936 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 937                                        struct sk_buff *skb)
 938 {
 939         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 940
 941         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 942
 943         if (rp->status)
 944                 return;
 945
 946         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 947         hdev->le_pkts = rp->le_max_pkt;
 948
 949         hdev->le_cnt = hdev->le_pkts;
 950
 951         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 952 }
 953
 954 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 955                                           struct sk_buff *skb)
 956 {
 957         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 958
 959         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 960
 961         if (rp->status)
 962                 return;
 963
 964         memcpy(hdev->le_features, rp->features, 8);
 965 }
 966
 967 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 968                                         struct sk_buff *skb)
 969 {
 970         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 971
 972         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 973
 974         if (rp->status)
 975                 return;
 976
 977         hdev->adv_tx_power = rp->tx_power;
 978 }
 979
 980 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 981 {
 982         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 983
 984         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 985
 986         hci_dev_lock(hdev);
 987
 988         if (hci_dev_test_flag(hdev, HCI_MGMT))
 989                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 990                                                  rp->status);
 991
 992         hci_dev_unlock(hdev);
 993 }
 994
 995 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 996                                           struct sk_buff *skb)
 997 {
 998         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 999
1000         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1001
1002         hci_dev_lock(hdev);
1003
1004         if (hci_dev_test_flag(hdev, HCI_MGMT))
1005                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1006                                                      ACL_LINK, 0, rp->status);
1007
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1012 {
1013         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1014
1015         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1016
1017         hci_dev_lock(hdev);
1018
1019         if (hci_dev_test_flag(hdev, HCI_MGMT))
1020                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1021                                                  0, rp->status);
1022
1023         hci_dev_unlock(hdev);
1024 }
1025
1026 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1027                                           struct sk_buff *skb)
1028 {
1029         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1030
1031         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1032
1033         hci_dev_lock(hdev);
1034
1035         if (hci_dev_test_flag(hdev, HCI_MGMT))
1036                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1037                                                      ACL_LINK, 0, rp->status);
1038
1039         hci_dev_unlock(hdev);
1040 }
1041
1042 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1043                                        struct sk_buff *skb)
1044 {
1045         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1046
1047         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1048 }
1049
1050 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1051                                            struct sk_buff *skb)
1052 {
1053         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1054
1055         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1056 }
1057
1058 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1059 {
1060         __u8 status = *((__u8 *) skb->data);
1061         bdaddr_t *sent;
1062
1063         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1064
1065         if (status)
1066                 return;
1067
1068         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1069         if (!sent)
1070                 return;
1071
1072         hci_dev_lock(hdev);
1073
1074         bacpy(&hdev->random_addr, sent);
1075
1076         hci_dev_unlock(hdev);
1077 }
1078
1079 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1080 {
1081         __u8 *sent, status = *((__u8 *) skb->data);
1082
1083         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1084
1085         if (status)
1086                 return;
1087
1088         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1089         if (!sent)
1090                 return;
1091
1092         hci_dev_lock(hdev);
1093
1094         /* If we're doing connection initiation as peripheral. Set a
1095          * timeout in case something goes wrong.
1096          */
1097         if (*sent) {
1098                 struct hci_conn *conn;
1099
1100                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1101
1102                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1103                 if (conn)
1104                         queue_delayed_work(hdev->workqueue,
1105                                            &conn->le_conn_timeout,
1106                                            conn->conn_timeout);
1107         } else {
1108                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1109         }
1110
1111         hci_dev_unlock(hdev);
1112 }
1113
1114 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1115 {
1116         struct hci_cp_le_set_scan_param *cp;
1117         __u8 status = *((__u8 *) skb->data);
1118
1119         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1120
1121         if (status)
1122                 return;
1123
1124         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1125         if (!cp)
1126                 return;
1127
1128         hci_dev_lock(hdev);
1129
1130         hdev->le_scan_type = cp->type;
1131
1132         hci_dev_unlock(hdev);
1133 }
1134
1135 static bool has_pending_adv_report(struct hci_dev *hdev)
1136 {
1137         struct discovery_state *d = &hdev->discovery;
1138
1139         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1140 }
1141
1142 static void clear_pending_adv_report(struct hci_dev *hdev)
1143 {
1144         struct discovery_state *d = &hdev->discovery;
1145
1146         bacpy(&d->last_adv_addr, BDADDR_ANY);
1147         d->last_adv_data_len = 0;
1148 }
1149
1150 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1151                                      u8 bdaddr_type, s8 rssi, u32 flags,
1152                                      u8 *data, u8 len)
1153 {
1154         struct discovery_state *d = &hdev->discovery;
1155
1156         bacpy(&d->last_adv_addr, bdaddr);
1157         d->last_adv_addr_type = bdaddr_type;
1158         d->last_adv_rssi = rssi;
1159         d->last_adv_flags = flags;
1160         memcpy(d->last_adv_data, data, len);
1161         d->last_adv_data_len = len;
1162 }
1163
1164 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1165                                       struct sk_buff *skb)
1166 {
1167         struct hci_cp_le_set_scan_enable *cp;
1168         __u8 status = *((__u8 *) skb->data);
1169
1170         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1171
1172         if (status)
1173                 return;
1174
1175         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1176         if (!cp)
1177                 return;
1178
1179         hci_dev_lock(hdev);
1180
1181         switch (cp->enable) {
1182         case LE_SCAN_ENABLE:
1183                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1184                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1185                         clear_pending_adv_report(hdev);
1186                 break;
1187
1188         case LE_SCAN_DISABLE:
1189                 /* We do this here instead of when setting DISCOVERY_STOPPED
1190                  * since the latter would potentially require waiting for
1191                  * inquiry to stop too.
1192                  */
1193                 if (has_pending_adv_report(hdev)) {
1194                         struct discovery_state *d = &hdev->discovery;
1195
1196                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1197                                           d->last_adv_addr_type, NULL,
1198                                           d->last_adv_rssi, d->last_adv_flags,
1199                                           d->last_adv_data,
1200                                           d->last_adv_data_len, NULL, 0);
1201                 }
1202
1203                 /* Cancel this timer so that we don't try to disable scanning
1204                  * when it's already disabled.
1205                  */
1206                 cancel_delayed_work(&hdev->le_scan_disable);
1207
1208                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1209
1210                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1211                  * interrupted scanning due to a connect request. Mark
1212                  * therefore discovery as stopped. If this was not
1213                  * because of a connect request advertising might have
1214                  * been disabled because of active scanning, so
1215                  * re-enable it again if necessary.
1216                  */
1217                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1218                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1219                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1220                          hdev->discovery.state == DISCOVERY_FINDING)
1221                         mgmt_reenable_advertising(hdev);
1222
1223                 break;
1224
1225         default:
1226                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1227                 break;
1228         }
1229
1230         hci_dev_unlock(hdev);
1231 }
1232
1233 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1234                                            struct sk_buff *skb)
1235 {
1236         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1237
1238         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1239
1240         if (rp->status)
1241                 return;
1242
1243         hdev->le_white_list_size = rp->size;
1244 }
1245
1246 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1247                                        struct sk_buff *skb)
1248 {
1249         __u8 status = *((__u8 *) skb->data);
1250
1251         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1252
1253         if (status)
1254                 return;
1255
1256         hci_bdaddr_list_clear(&hdev->le_white_list);
1257 }
1258
1259 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1260                                         struct sk_buff *skb)
1261 {
1262         struct hci_cp_le_add_to_white_list *sent;
1263         __u8 status = *((__u8 *) skb->data);
1264
1265         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1266
1267         if (status)
1268                 return;
1269
1270         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1271         if (!sent)
1272                 return;
1273
1274         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1275                            sent->bdaddr_type);
1276 }
1277
1278 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1279                                           struct sk_buff *skb)
1280 {
1281         struct hci_cp_le_del_from_white_list *sent;
1282         __u8 status = *((__u8 *) skb->data);
1283
1284         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1285
1286         if (status)
1287                 return;
1288
1289         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1290         if (!sent)
1291                 return;
1292
1293         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1294                             sent->bdaddr_type);
1295 }
1296
1297 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1298                                             struct sk_buff *skb)
1299 {
1300         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1301
1302         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1303
1304         if (rp->status)
1305                 return;
1306
1307         memcpy(hdev->le_states, rp->le_states, 8);
1308 }
1309
1310 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1311                                         struct sk_buff *skb)
1312 {
1313         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1314
1315         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1316
1317         if (rp->status)
1318                 return;
1319
1320         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1321         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1322 }
1323
1324 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1325                                          struct sk_buff *skb)
1326 {
1327         struct hci_cp_le_write_def_data_len *sent;
1328         __u8 status = *((__u8 *) skb->data);
1329
1330         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1331
1332         if (status)
1333                 return;
1334
1335         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1336         if (!sent)
1337                 return;
1338
1339         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1340         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1341 }
1342
1343 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1344                                         struct sk_buff *skb)
1345 {
1346         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1347
1348         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1349
1350         if (rp->status)
1351                 return;
1352
1353         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1354         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1355         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1356         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1357 }
1358
1359 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1360                                            struct sk_buff *skb)
1361 {
1362         struct hci_cp_write_le_host_supported *sent;
1363         __u8 status = *((__u8 *) skb->data);
1364
1365         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1366
1367         if (status)
1368                 return;
1369
1370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1371         if (!sent)
1372                 return;
1373
1374         hci_dev_lock(hdev);
1375
1376         if (sent->le) {
1377                 hdev->features[1][0] |= LMP_HOST_LE;
1378                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1379         } else {
1380                 hdev->features[1][0] &= ~LMP_HOST_LE;
1381                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1382                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1383         }
1384
1385         if (sent->simul)
1386                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1387         else
1388                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1389
1390         hci_dev_unlock(hdev);
1391 }
1392
1393 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1394 {
1395         struct hci_cp_le_set_adv_param *cp;
1396         u8 status = *((u8 *) skb->data);
1397
1398         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
1400         if (status)
1401                 return;
1402
1403         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1404         if (!cp)
1405                 return;
1406
1407         hci_dev_lock(hdev);
1408         hdev->adv_addr_type = cp->own_address_type;
1409         hci_dev_unlock(hdev);
1410 }
1411
1412 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1413                                           struct sk_buff *skb)
1414 {
1415         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1416
1417         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1418                hdev->name, rp->status, rp->phy_handle);
1419
1420         if (rp->status)
1421                 return;
1422
1423         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1424 }
1425
1426 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1427 {
1428         struct hci_rp_read_rssi *rp = (void *) skb->data;
1429         struct hci_conn *conn;
1430
1431         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1432
1433         if (rp->status)
1434                 return;
1435
1436         hci_dev_lock(hdev);
1437
1438         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1439         if (conn)
1440                 conn->rssi = rp->rssi;
1441
1442         hci_dev_unlock(hdev);
1443 }
1444
1445 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1446 {
1447         struct hci_cp_read_tx_power *sent;
1448         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1449         struct hci_conn *conn;
1450
1451         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1452
1453         if (rp->status)
1454                 return;
1455
1456         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1457         if (!sent)
1458                 return;
1459
1460         hci_dev_lock(hdev);
1461
1462         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1463         if (!conn)
1464                 goto unlock;
1465
1466         switch (sent->type) {
1467         case 0x00:
1468                 conn->tx_power = rp->tx_power;
1469                 break;
1470         case 0x01:
1471                 conn->max_tx_power = rp->tx_power;
1472                 break;
1473         }
1474
1475 unlock:
1476         hci_dev_unlock(hdev);
1477 }
1478
1479 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1480 {
1481         u8 status = *((u8 *) skb->data);
1482         u8 *mode;
1483
1484         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1485
1486         if (status)
1487                 return;
1488
1489         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1490         if (mode)
1491                 hdev->ssp_debug_mode = *mode;
1492 }
1493
1494 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1495 {
1496         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1497
1498         if (status) {
1499                 hci_conn_check_pending(hdev);
1500                 return;
1501         }
1502
1503         set_bit(HCI_INQUIRY, &hdev->flags);
1504 }
1505
1506 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1507 {
1508         struct hci_cp_create_conn *cp;
1509         struct hci_conn *conn;
1510
1511         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1512
1513         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1514         if (!cp)
1515                 return;
1516
1517         hci_dev_lock(hdev);
1518
1519         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1520
1521         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1522
1523         if (status) {
1524                 if (conn && conn->state == BT_CONNECT) {
1525                         if (status != 0x0c || conn->attempt > 2) {
1526                                 conn->state = BT_CLOSED;
1527                                 hci_connect_cfm(conn, status);
1528                                 hci_conn_del(conn);
1529                         } else
1530                                 conn->state = BT_CONNECT2;
1531                 }
1532         } else {
1533                 if (!conn) {
1534                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1535                                             HCI_ROLE_MASTER);
1536                         if (!conn)
1537                                 BT_ERR("No memory for new connection");
1538                 }
1539         }
1540
1541         hci_dev_unlock(hdev);
1542 }
1543
1544 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1545 {
1546         struct hci_cp_add_sco *cp;
1547         struct hci_conn *acl, *sco;
1548         __u16 handle;
1549
1550         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1551
1552         if (!status)
1553                 return;
1554
1555         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1556         if (!cp)
1557                 return;
1558
1559         handle = __le16_to_cpu(cp->handle);
1560
1561         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1562
1563         hci_dev_lock(hdev);
1564
1565         acl = hci_conn_hash_lookup_handle(hdev, handle);
1566         if (acl) {
1567                 sco = acl->link;
1568                 if (sco) {
1569                         sco->state = BT_CLOSED;
1570
1571                         hci_connect_cfm(sco, status);
1572                         hci_conn_del(sco);
1573                 }
1574         }
1575
1576         hci_dev_unlock(hdev);
1577 }
1578
1579 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1580 {
1581         struct hci_cp_auth_requested *cp;
1582         struct hci_conn *conn;
1583
1584         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1585
1586         if (!status)
1587                 return;
1588
1589         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1590         if (!cp)
1591                 return;
1592
1593         hci_dev_lock(hdev);
1594
1595         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1596         if (conn) {
1597                 if (conn->state == BT_CONFIG) {
1598                         hci_connect_cfm(conn, status);
1599                         hci_conn_drop(conn);
1600                 }
1601         }
1602
1603         hci_dev_unlock(hdev);
1604 }
1605
1606 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1607 {
1608         struct hci_cp_set_conn_encrypt *cp;
1609         struct hci_conn *conn;
1610
1611         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1612
1613         if (!status)
1614                 return;
1615
1616         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1617         if (!cp)
1618                 return;
1619
1620         hci_dev_lock(hdev);
1621
1622         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1623         if (conn) {
1624                 if (conn->state == BT_CONFIG) {
1625                         hci_connect_cfm(conn, status);
1626                         hci_conn_drop(conn);
1627                 }
1628         }
1629
1630         hci_dev_unlock(hdev);
1631 }
1632
1633 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1634                                     struct hci_conn *conn)
1635 {
1636         if (conn->state != BT_CONFIG || !conn->out)
1637                 return 0;
1638
1639         if (conn->pending_sec_level == BT_SECURITY_SDP)
1640                 return 0;
1641
1642         /* Only request authentication for SSP connections or non-SSP
1643          * devices with sec_level MEDIUM or HIGH or if MITM protection
1644          * is requested.
1645          */
1646         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1647             conn->pending_sec_level != BT_SECURITY_FIPS &&
1648             conn->pending_sec_level != BT_SECURITY_HIGH &&
1649             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1650                 return 0;
1651
1652         return 1;
1653 }
1654
1655 static int hci_resolve_name(struct hci_dev *hdev,
1656                                    struct inquiry_entry *e)
1657 {
1658         struct hci_cp_remote_name_req cp;
1659
1660         memset(&cp, 0, sizeof(cp));
1661
1662         bacpy(&cp.bdaddr, &e->data.bdaddr);
1663         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1664         cp.pscan_mode = e->data.pscan_mode;
1665         cp.clock_offset = e->data.clock_offset;
1666
1667         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1668 }
1669
1670 static bool hci_resolve_next_name(struct hci_dev *hdev)
1671 {
1672         struct discovery_state *discov = &hdev->discovery;
1673         struct inquiry_entry *e;
1674
1675         if (list_empty(&discov->resolve))
1676                 return false;
1677
1678         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1679         if (!e)
1680                 return false;
1681
1682         if (hci_resolve_name(hdev, e) == 0) {
1683                 e->name_state = NAME_PENDING;
1684                 return true;
1685         }
1686
1687         return false;
1688 }
1689
1690 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1691                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1692 {
1693         struct discovery_state *discov = &hdev->discovery;
1694         struct inquiry_entry *e;
1695
1696         /* Update the mgmt connected state if necessary. Be careful with
1697          * conn objects that exist but are not (yet) connected however.
1698          * Only those in BT_CONFIG or BT_CONNECTED states can be
1699          * considered connected.
1700          */
1701         if (conn &&
1702             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1703             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1704                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1705
1706         if (discov->state == DISCOVERY_STOPPED)
1707                 return;
1708
1709         if (discov->state == DISCOVERY_STOPPING)
1710                 goto discov_complete;
1711
1712         if (discov->state != DISCOVERY_RESOLVING)
1713                 return;
1714
1715         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1716         /* If the device was not found in a list of found devices names of which
1717          * are pending. there is no need to continue resolving a next name as it
1718          * will be done upon receiving another Remote Name Request Complete
1719          * Event */
1720         if (!e)
1721                 return;
1722
1723         list_del(&e->list);
1724         if (name) {
1725                 e->name_state = NAME_KNOWN;
1726                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1727                                  e->data.rssi, name, name_len);
1728         } else {
1729                 e->name_state = NAME_NOT_KNOWN;
1730         }
1731
1732         if (hci_resolve_next_name(hdev))
1733                 return;
1734
1735 discov_complete:
1736         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1737 }
1738
1739 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1740 {
1741         struct hci_cp_remote_name_req *cp;
1742         struct hci_conn *conn;
1743
1744         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1745
1746         /* If successful wait for the name req complete event before
1747          * checking for the need to do authentication */
1748         if (!status)
1749                 return;
1750
1751         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1752         if (!cp)
1753                 return;
1754
1755         hci_dev_lock(hdev);
1756
1757         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1758
1759         if (hci_dev_test_flag(hdev, HCI_MGMT))
1760                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1761
1762         if (!conn)
1763                 goto unlock;
1764
1765         if (!hci_outgoing_auth_needed(hdev, conn))
1766                 goto unlock;
1767
1768         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1769                 struct hci_cp_auth_requested auth_cp;
1770
1771                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1772
1773                 auth_cp.handle = __cpu_to_le16(conn->handle);
1774                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1775                              sizeof(auth_cp), &auth_cp);
1776         }
1777
1778 unlock:
1779         hci_dev_unlock(hdev);
1780 }
1781
1782 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1783 {
1784         struct hci_cp_read_remote_features *cp;
1785         struct hci_conn *conn;
1786
1787         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1788
1789         if (!status)
1790                 return;
1791
1792         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1793         if (!cp)
1794                 return;
1795
1796         hci_dev_lock(hdev);
1797
1798         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1799         if (conn) {
1800                 if (conn->state == BT_CONFIG) {
1801                         hci_connect_cfm(conn, status);
1802                         hci_conn_drop(conn);
1803                 }
1804         }
1805
1806         hci_dev_unlock(hdev);
1807 }
1808
1809 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1810 {
1811         struct hci_cp_read_remote_ext_features *cp;
1812         struct hci_conn *conn;
1813
1814         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1815
1816         if (!status)
1817                 return;
1818
1819         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1820         if (!cp)
1821                 return;
1822
1823         hci_dev_lock(hdev);
1824
1825         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1826         if (conn) {
1827                 if (conn->state == BT_CONFIG) {
1828                         hci_connect_cfm(conn, status);
1829                         hci_conn_drop(conn);
1830                 }
1831         }
1832
1833         hci_dev_unlock(hdev);
1834 }
1835
1836 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1837 {
1838         struct hci_cp_setup_sync_conn *cp;
1839         struct hci_conn *acl, *sco;
1840         __u16 handle;
1841
1842         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1843
1844         if (!status)
1845                 return;
1846
1847         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1848         if (!cp)
1849                 return;
1850
1851         handle = __le16_to_cpu(cp->handle);
1852
1853         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1854
1855         hci_dev_lock(hdev);
1856
1857         acl = hci_conn_hash_lookup_handle(hdev, handle);
1858         if (acl) {
1859                 sco = acl->link;
1860                 if (sco) {
1861                         sco->state = BT_CLOSED;
1862
1863                         hci_connect_cfm(sco, status);
1864                         hci_conn_del(sco);
1865                 }
1866         }
1867
1868         hci_dev_unlock(hdev);
1869 }
1870
1871 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1872 {
1873         struct hci_cp_sniff_mode *cp;
1874         struct hci_conn *conn;
1875
1876         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1877
1878         if (!status)
1879                 return;
1880
1881         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1882         if (!cp)
1883                 return;
1884
1885         hci_dev_lock(hdev);
1886
1887         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1888         if (conn) {
1889                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1890
1891                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1892                         hci_sco_setup(conn, status);
1893         }
1894
1895         hci_dev_unlock(hdev);
1896 }
1897
1898 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1899 {
1900         struct hci_cp_exit_sniff_mode *cp;
1901         struct hci_conn *conn;
1902
1903         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1904
1905         if (!status)
1906                 return;
1907
1908         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1909         if (!cp)
1910                 return;
1911
1912         hci_dev_lock(hdev);
1913
1914         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1915         if (conn) {
1916                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1917
1918                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1919                         hci_sco_setup(conn, status);
1920         }
1921
1922         hci_dev_unlock(hdev);
1923 }
1924
1925 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1926 {
1927         struct hci_cp_disconnect *cp;
1928         struct hci_conn *conn;
1929
1930         if (!status)
1931                 return;
1932
1933         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1934         if (!cp)
1935                 return;
1936
1937         hci_dev_lock(hdev);
1938
1939         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1940         if (conn)
1941                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1942                                        conn->dst_type, status);
1943
1944         hci_dev_unlock(hdev);
1945 }
1946
1947 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1948 {
1949         struct hci_cp_create_phy_link *cp;
1950
1951         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1952
1953         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1954         if (!cp)
1955                 return;
1956
1957         hci_dev_lock(hdev);
1958
1959         if (status) {
1960                 struct hci_conn *hcon;
1961
1962                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1963                 if (hcon)
1964                         hci_conn_del(hcon);
1965         } else {
1966                 amp_write_remote_assoc(hdev, cp->phy_handle);
1967         }
1968
1969         hci_dev_unlock(hdev);
1970 }
1971
1972 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1973 {
1974         struct hci_cp_accept_phy_link *cp;
1975
1976         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1977
1978         if (status)
1979                 return;
1980
1981         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1982         if (!cp)
1983                 return;
1984
1985         amp_write_remote_assoc(hdev, cp->phy_handle);
1986 }
1987
1988 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1989 {
1990         struct hci_cp_le_create_conn *cp;
1991         struct hci_conn *conn;
1992
1993         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1994
1995         /* All connection failure handling is taken care of by the
1996          * hci_le_conn_failed function which is triggered by the HCI
1997          * request completion callbacks used for connecting.
1998          */
1999         if (status)
2000                 return;
2001
2002         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2003         if (!cp)
2004                 return;
2005
2006         hci_dev_lock(hdev);
2007
2008         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2009         if (!conn)
2010                 goto unlock;
2011
2012         /* Store the initiator and responder address information which
2013          * is needed for SMP. These values will not change during the
2014          * lifetime of the connection.
2015          */
2016         conn->init_addr_type = cp->own_address_type;
2017         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2018                 bacpy(&conn->init_addr, &hdev->random_addr);
2019         else
2020                 bacpy(&conn->init_addr, &hdev->bdaddr);
2021
2022         conn->resp_addr_type = cp->peer_addr_type;
2023         bacpy(&conn->resp_addr, &cp->peer_addr);
2024
2025         /* We don't want the connection attempt to stick around
2026          * indefinitely since LE doesn't have a page timeout concept
2027          * like BR/EDR. Set a timer for any connection that doesn't use
2028          * the white list for connecting.
2029          */
2030         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2031                 queue_delayed_work(conn->hdev->workqueue,
2032                                    &conn->le_conn_timeout,
2033                                    conn->conn_timeout);
2034
2035 unlock:
2036         hci_dev_unlock(hdev);
2037 }
2038
2039 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2040 {
2041         struct hci_cp_le_read_remote_features *cp;
2042         struct hci_conn *conn;
2043
2044         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2045
2046         if (!status)
2047                 return;
2048
2049         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2050         if (!cp)
2051                 return;
2052
2053         hci_dev_lock(hdev);
2054
2055         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2056         if (conn) {
2057                 if (conn->state == BT_CONFIG) {
2058                         hci_connect_cfm(conn, status);
2059                         hci_conn_drop(conn);
2060                 }
2061         }
2062
2063         hci_dev_unlock(hdev);
2064 }
2065
2066 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2067 {
2068         struct hci_cp_le_start_enc *cp;
2069         struct hci_conn *conn;
2070
2071         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2072
2073         if (!status)
2074                 return;
2075
2076         hci_dev_lock(hdev);
2077
2078         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2079         if (!cp)
2080                 goto unlock;
2081
2082         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2083         if (!conn)
2084                 goto unlock;
2085
2086         if (conn->state != BT_CONNECTED)
2087                 goto unlock;
2088
2089         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2090         hci_conn_drop(conn);
2091
2092 unlock:
2093         hci_dev_unlock(hdev);
2094 }
2095
2096 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2097 {
2098         struct hci_cp_switch_role *cp;
2099         struct hci_conn *conn;
2100
2101         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2102
2103         if (!status)
2104                 return;
2105
2106         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2107         if (!cp)
2108                 return;
2109
2110         hci_dev_lock(hdev);
2111
2112         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2113         if (conn)
2114                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2115
2116         hci_dev_unlock(hdev);
2117 }
2118
2119 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2120 {
2121         __u8 status = *((__u8 *) skb->data);
2122         struct discovery_state *discov = &hdev->discovery;
2123         struct inquiry_entry *e;
2124
2125         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2126
2127         hci_conn_check_pending(hdev);
2128
2129         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2130                 return;
2131
2132         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2133         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2134
2135         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2136                 return;
2137
2138         hci_dev_lock(hdev);
2139
2140         if (discov->state != DISCOVERY_FINDING)
2141                 goto unlock;
2142
2143         if (list_empty(&discov->resolve)) {
2144                 /* When BR/EDR inquiry is active and no LE scanning is in
2145                  * progress, then change discovery state to indicate completion.
2146                  *
2147                  * When running LE scanning and BR/EDR inquiry simultaneously
2148                  * and the LE scan already finished, then change the discovery
2149                  * state to indicate completion.
2150                  */
2151                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2152                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2153                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2154                 goto unlock;
2155         }
2156
2157         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2158         if (e && hci_resolve_name(hdev, e) == 0) {
2159                 e->name_state = NAME_PENDING;
2160                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2161         } else {
2162                 /* When BR/EDR inquiry is active and no LE scanning is in
2163                  * progress, then change discovery state to indicate completion.
2164                  *
2165                  * When running LE scanning and BR/EDR inquiry simultaneously
2166                  * and the LE scan already finished, then change the discovery
2167                  * state to indicate completion.
2168                  */
2169                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2170                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2171                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2172         }
2173
2174 unlock:
2175         hci_dev_unlock(hdev);
2176 }
2177
2178 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2179 {
2180         struct inquiry_data data;
2181         struct inquiry_info *info = (void *) (skb->data + 1);
2182         int num_rsp = *((__u8 *) skb->data);
2183
2184         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2185
2186         if (!num_rsp)
2187                 return;
2188
2189         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2190                 return;
2191
2192         hci_dev_lock(hdev);
2193
2194         for (; num_rsp; num_rsp--, info++) {
2195                 u32 flags;
2196
2197                 bacpy(&data.bdaddr, &info->bdaddr);
2198                 data.pscan_rep_mode     = info->pscan_rep_mode;
2199                 data.pscan_period_mode  = info->pscan_period_mode;
2200                 data.pscan_mode         = info->pscan_mode;
2201                 memcpy(data.dev_class, info->dev_class, 3);
2202                 data.clock_offset       = info->clock_offset;
2203                 data.rssi               = HCI_RSSI_INVALID;
2204                 data.ssp_mode           = 0x00;
2205
2206                 flags = hci_inquiry_cache_update(hdev, &data, false);
2207
2208                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2209                                   info->dev_class, HCI_RSSI_INVALID,
2210                                   flags, NULL, 0, NULL, 0);
2211         }
2212
2213         hci_dev_unlock(hdev);
2214 }
2215
2216 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2217 {
2218         struct hci_ev_conn_complete *ev = (void *) skb->data;
2219         struct hci_conn *conn;
2220
2221         BT_DBG("%s", hdev->name);
2222
2223         hci_dev_lock(hdev);
2224
2225         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2226         if (!conn) {
2227                 if (ev->link_type != SCO_LINK)
2228                         goto unlock;
2229
2230                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2231                 if (!conn)
2232                         goto unlock;
2233
2234                 conn->type = SCO_LINK;
2235         }
2236
2237         if (!ev->status) {
2238                 conn->handle = __le16_to_cpu(ev->handle);
2239
2240                 if (conn->type == ACL_LINK) {
2241                         conn->state = BT_CONFIG;
2242                         hci_conn_hold(conn);
2243
2244                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2245                             !hci_find_link_key(hdev, &ev->bdaddr))
2246                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2247                         else
2248                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2249                 } else
2250                         conn->state = BT_CONNECTED;
2251
2252                 hci_debugfs_create_conn(conn);
2253                 hci_conn_add_sysfs(conn);
2254
2255                 if (test_bit(HCI_AUTH, &hdev->flags))
2256                         set_bit(HCI_CONN_AUTH, &conn->flags);
2257
2258                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2259                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2260
2261                 /* Get remote features */
2262                 if (conn->type == ACL_LINK) {
2263                         struct hci_cp_read_remote_features cp;
2264                         cp.handle = ev->handle;
2265                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2266                                      sizeof(cp), &cp);
2267
2268                         hci_update_page_scan(hdev);
2269                 }
2270
2271                 /* Set packet type for incoming connection */
2272                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2273                         struct hci_cp_change_conn_ptype cp;
2274                         cp.handle = ev->handle;
2275                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2276                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2277                                      &cp);
2278                 }
2279         } else {
2280                 conn->state = BT_CLOSED;
2281                 if (conn->type == ACL_LINK)
2282                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2283                                             conn->dst_type, ev->status);
2284         }
2285
2286         if (conn->type == ACL_LINK)
2287                 hci_sco_setup(conn, ev->status);
2288
2289         if (ev->status) {
2290                 hci_connect_cfm(conn, ev->status);
2291                 hci_conn_del(conn);
2292         } else if (ev->link_type != ACL_LINK)
2293                 hci_connect_cfm(conn, ev->status);
2294
2295 unlock:
2296         hci_dev_unlock(hdev);
2297
2298         hci_conn_check_pending(hdev);
2299 }
2300
2301 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2302 {
2303         struct hci_cp_reject_conn_req cp;
2304
2305         bacpy(&cp.bdaddr, bdaddr);
2306         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2307         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2308 }
2309
2310 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2311 {
2312         struct hci_ev_conn_request *ev = (void *) skb->data;
2313         int mask = hdev->link_mode;
2314         struct inquiry_entry *ie;
2315         struct hci_conn *conn;
2316         __u8 flags = 0;
2317
2318         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2319                ev->link_type);
2320
2321         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2322                                       &flags);
2323
2324         if (!(mask & HCI_LM_ACCEPT)) {
2325                 hci_reject_conn(hdev, &ev->bdaddr);
2326                 return;
2327         }
2328
2329         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2330                                    BDADDR_BREDR)) {
2331                 hci_reject_conn(hdev, &ev->bdaddr);
2332                 return;
2333         }
2334
2335         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2336          * connection. These features are only touched through mgmt so
2337          * only do the checks if HCI_MGMT is set.
2338          */
2339         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2340             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2341             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2342                                     BDADDR_BREDR)) {
2343                     hci_reject_conn(hdev, &ev->bdaddr);
2344                     return;
2345         }
2346
2347         /* Connection accepted */
2348
2349         hci_dev_lock(hdev);
2350
2351         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2352         if (ie)
2353                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2354
2355         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2356                         &ev->bdaddr);
2357         if (!conn) {
2358                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2359                                     HCI_ROLE_SLAVE);
2360                 if (!conn) {
2361                         BT_ERR("No memory for new connection");
2362                         hci_dev_unlock(hdev);
2363                         return;
2364                 }
2365         }
2366
2367         memcpy(conn->dev_class, ev->dev_class, 3);
2368
2369         hci_dev_unlock(hdev);
2370
2371         if (ev->link_type == ACL_LINK ||
2372             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2373                 struct hci_cp_accept_conn_req cp;
2374                 conn->state = BT_CONNECT;
2375
2376                 bacpy(&cp.bdaddr, &ev->bdaddr);
2377
2378                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2379                         cp.role = 0x00; /* Become master */
2380                 else
2381                         cp.role = 0x01; /* Remain slave */
2382
2383                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2384         } else if (!(flags & HCI_PROTO_DEFER)) {
2385                 struct hci_cp_accept_sync_conn_req cp;
2386                 conn->state = BT_CONNECT;
2387
2388                 bacpy(&cp.bdaddr, &ev->bdaddr);
2389                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2390
2391                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2392                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2393                 cp.max_latency    = cpu_to_le16(0xffff);
2394                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2395                 cp.retrans_effort = 0xff;
2396
2397                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2398                              &cp);
2399         } else {
2400                 conn->state = BT_CONNECT2;
2401                 hci_connect_cfm(conn, 0);
2402         }
2403 }
2404
2405 static u8 hci_to_mgmt_reason(u8 err)
2406 {
2407         switch (err) {
2408         case HCI_ERROR_CONNECTION_TIMEOUT:
2409                 return MGMT_DEV_DISCONN_TIMEOUT;
2410         case HCI_ERROR_REMOTE_USER_TERM:
2411         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2412         case HCI_ERROR_REMOTE_POWER_OFF:
2413                 return MGMT_DEV_DISCONN_REMOTE;
2414         case HCI_ERROR_LOCAL_HOST_TERM:
2415                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2416         default:
2417                 return MGMT_DEV_DISCONN_UNKNOWN;
2418         }
2419 }
2420
2421 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2422 {
2423         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2424         u8 reason = hci_to_mgmt_reason(ev->reason);
2425         struct hci_conn_params *params;
2426         struct hci_conn *conn;
2427         bool mgmt_connected;
2428         u8 type;
2429
2430         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2431
2432         hci_dev_lock(hdev);
2433
2434         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2435         if (!conn)
2436                 goto unlock;
2437
2438         if (ev->status) {
2439                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2440                                        conn->dst_type, ev->status);
2441                 goto unlock;
2442         }
2443
2444         conn->state = BT_CLOSED;
2445
2446         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2447         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2448                                 reason, mgmt_connected);
2449
2450         if (conn->type == ACL_LINK) {
2451                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2452                         hci_remove_link_key(hdev, &conn->dst);
2453
2454                 hci_update_page_scan(hdev);
2455         }
2456
2457         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2458         if (params) {
2459                 switch (params->auto_connect) {
2460                 case HCI_AUTO_CONN_LINK_LOSS:
2461                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2462                                 break;
2463                         /* Fall through */
2464
2465                 case HCI_AUTO_CONN_DIRECT:
2466                 case HCI_AUTO_CONN_ALWAYS:
2467                         list_del_init(&params->action);
2468                         list_add(&params->action, &hdev->pend_le_conns);
2469                         hci_update_background_scan(hdev);
2470                         break;
2471
2472                 default:
2473                         break;
2474                 }
2475         }
2476
2477         type = conn->type;
2478
2479         hci_disconn_cfm(conn, ev->reason);
2480         hci_conn_del(conn);
2481
2482         /* Re-enable advertising if necessary, since it might
2483          * have been disabled by the connection. From the
2484          * HCI_LE_Set_Advertise_Enable command description in
2485          * the core specification (v4.0):
2486          * "The Controller shall continue advertising until the Host
2487          * issues an LE_Set_Advertise_Enable command with
2488          * Advertising_Enable set to 0x00 (Advertising is disabled)
2489          * or until a connection is created or until the Advertising
2490          * is timed out due to Directed Advertising."
2491          */
2492         if (type == LE_LINK)
2493                 mgmt_reenable_advertising(hdev);
2494
2495 unlock:
2496         hci_dev_unlock(hdev);
2497 }
2498
2499 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2500 {
2501         struct hci_ev_auth_complete *ev = (void *) skb->data;
2502         struct hci_conn *conn;
2503
2504         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2505
2506         hci_dev_lock(hdev);
2507
2508         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2509         if (!conn)
2510                 goto unlock;
2511
2512         if (!ev->status) {
2513                 if (!hci_conn_ssp_enabled(conn) &&
2514                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2515                         BT_INFO("re-auth of legacy device is not possible.");
2516                 } else {
2517                         set_bit(HCI_CONN_AUTH, &conn->flags);
2518                         conn->sec_level = conn->pending_sec_level;
2519                 }
2520         } else {
2521                 mgmt_auth_failed(conn, ev->status);
2522         }
2523
2524         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2525         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2526
2527         if (conn->state == BT_CONFIG) {
2528                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2529                         struct hci_cp_set_conn_encrypt cp;
2530                         cp.handle  = ev->handle;
2531                         cp.encrypt = 0x01;
2532                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2533                                      &cp);
2534                 } else {
2535                         conn->state = BT_CONNECTED;
2536                         hci_connect_cfm(conn, ev->status);
2537                         hci_conn_drop(conn);
2538                 }
2539         } else {
2540                 hci_auth_cfm(conn, ev->status);
2541
2542                 hci_conn_hold(conn);
2543                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2544                 hci_conn_drop(conn);
2545         }
2546
2547         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2548                 if (!ev->status) {
2549                         struct hci_cp_set_conn_encrypt cp;
2550                         cp.handle  = ev->handle;
2551                         cp.encrypt = 0x01;
2552                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2553                                      &cp);
2554                 } else {
2555                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2556                         hci_encrypt_cfm(conn, ev->status, 0x00);
2557                 }
2558         }
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562 }
2563
2564 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2565 {
2566         struct hci_ev_remote_name *ev = (void *) skb->data;
2567         struct hci_conn *conn;
2568
2569         BT_DBG("%s", hdev->name);
2570
2571         hci_conn_check_pending(hdev);
2572
2573         hci_dev_lock(hdev);
2574
2575         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2576
2577         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2578                 goto check_auth;
2579
2580         if (ev->status == 0)
2581                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2582                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2583         else
2584                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2585
2586 check_auth:
2587         if (!conn)
2588                 goto unlock;
2589
2590         if (!hci_outgoing_auth_needed(hdev, conn))
2591                 goto unlock;
2592
2593         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2594                 struct hci_cp_auth_requested cp;
2595
2596                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2597
2598                 cp.handle = __cpu_to_le16(conn->handle);
2599                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2600         }
2601
2602 unlock:
2603         hci_dev_unlock(hdev);
2604 }
2605
2606 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2607 {
2608         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2609         struct hci_conn *conn;
2610
2611         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2612
2613         hci_dev_lock(hdev);
2614
2615         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2616         if (!conn)
2617                 goto unlock;
2618
2619         if (!ev->status) {
2620                 if (ev->encrypt) {
2621                         /* Encryption implies authentication */
2622                         set_bit(HCI_CONN_AUTH, &conn->flags);
2623                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2624                         conn->sec_level = conn->pending_sec_level;
2625
2626                         /* P-256 authentication key implies FIPS */
2627                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2628                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2629
2630                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2631                             conn->type == LE_LINK)
2632                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2633                 } else {
2634                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2635                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2636                 }
2637         }
2638
2639         /* We should disregard the current RPA and generate a new one
2640          * whenever the encryption procedure fails.
2641          */
2642         if (ev->status && conn->type == LE_LINK)
2643                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2644
2645         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2646
2647         if (ev->status && conn->state == BT_CONNECTED) {
2648                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2649                 hci_conn_drop(conn);
2650                 goto unlock;
2651         }
2652
2653         if (conn->state == BT_CONFIG) {
2654                 if (!ev->status)
2655                         conn->state = BT_CONNECTED;
2656
2657                 /* In Secure Connections Only mode, do not allow any
2658                  * connections that are not encrypted with AES-CCM
2659                  * using a P-256 authenticated combination key.
2660                  */
2661                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2662                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2663                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2664                         hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2665                         hci_conn_drop(conn);
2666                         goto unlock;
2667                 }
2668
2669                 hci_connect_cfm(conn, ev->status);
2670                 hci_conn_drop(conn);
2671         } else
2672                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2673
2674 unlock:
2675         hci_dev_unlock(hdev);
2676 }
2677
2678 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2679                                              struct sk_buff *skb)
2680 {
2681         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2682         struct hci_conn *conn;
2683
2684         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2685
2686         hci_dev_lock(hdev);
2687
2688         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2689         if (conn) {
2690                 if (!ev->status)
2691                         set_bit(HCI_CONN_SECURE, &conn->flags);
2692
2693                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2694
2695                 hci_key_change_cfm(conn, ev->status);
2696         }
2697
2698         hci_dev_unlock(hdev);
2699 }
2700
2701 static void hci_remote_features_evt(struct hci_dev *hdev,
2702                                     struct sk_buff *skb)
2703 {
2704         struct hci_ev_remote_features *ev = (void *) skb->data;
2705         struct hci_conn *conn;
2706
2707         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2708
2709         hci_dev_lock(hdev);
2710
2711         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2712         if (!conn)
2713                 goto unlock;
2714
2715         if (!ev->status)
2716                 memcpy(conn->features[0], ev->features, 8);
2717
2718         if (conn->state != BT_CONFIG)
2719                 goto unlock;
2720
2721         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2722             lmp_ext_feat_capable(conn)) {
2723                 struct hci_cp_read_remote_ext_features cp;
2724                 cp.handle = ev->handle;
2725                 cp.page = 0x01;
2726                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2727                              sizeof(cp), &cp);
2728                 goto unlock;
2729         }
2730
2731         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2732                 struct hci_cp_remote_name_req cp;
2733                 memset(&cp, 0, sizeof(cp));
2734                 bacpy(&cp.bdaddr, &conn->dst);
2735                 cp.pscan_rep_mode = 0x02;
2736                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2737         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2738                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2739
2740         if (!hci_outgoing_auth_needed(hdev, conn)) {
2741                 conn->state = BT_CONNECTED;
2742                 hci_connect_cfm(conn, ev->status);
2743                 hci_conn_drop(conn);
2744         }
2745
2746 unlock:
2747         hci_dev_unlock(hdev);
2748 }
2749
2750 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2751                                  u16 *opcode, u8 *status,
2752                                  hci_req_complete_t *req_complete,
2753                                  hci_req_complete_skb_t *req_complete_skb)
2754 {
2755         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2756
2757         *opcode = __le16_to_cpu(ev->opcode);
2758         *status = skb->data[sizeof(*ev)];
2759
2760         skb_pull(skb, sizeof(*ev));
2761
2762         switch (*opcode) {
2763         case HCI_OP_INQUIRY_CANCEL:
2764                 hci_cc_inquiry_cancel(hdev, skb);
2765                 break;
2766
2767         case HCI_OP_PERIODIC_INQ:
2768                 hci_cc_periodic_inq(hdev, skb);
2769                 break;
2770
2771         case HCI_OP_EXIT_PERIODIC_INQ:
2772                 hci_cc_exit_periodic_inq(hdev, skb);
2773                 break;
2774
2775         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2776                 hci_cc_remote_name_req_cancel(hdev, skb);
2777                 break;
2778
2779         case HCI_OP_ROLE_DISCOVERY:
2780                 hci_cc_role_discovery(hdev, skb);
2781                 break;
2782
2783         case HCI_OP_READ_LINK_POLICY:
2784                 hci_cc_read_link_policy(hdev, skb);
2785                 break;
2786
2787         case HCI_OP_WRITE_LINK_POLICY:
2788                 hci_cc_write_link_policy(hdev, skb);
2789                 break;
2790
2791         case HCI_OP_READ_DEF_LINK_POLICY:
2792                 hci_cc_read_def_link_policy(hdev, skb);
2793                 break;
2794
2795         case HCI_OP_WRITE_DEF_LINK_POLICY:
2796                 hci_cc_write_def_link_policy(hdev, skb);
2797                 break;
2798
2799         case HCI_OP_RESET:
2800                 hci_cc_reset(hdev, skb);
2801                 break;
2802
2803         case HCI_OP_READ_STORED_LINK_KEY:
2804                 hci_cc_read_stored_link_key(hdev, skb);
2805                 break;
2806
2807         case HCI_OP_DELETE_STORED_LINK_KEY:
2808                 hci_cc_delete_stored_link_key(hdev, skb);
2809                 break;
2810
2811         case HCI_OP_WRITE_LOCAL_NAME:
2812                 hci_cc_write_local_name(hdev, skb);
2813                 break;
2814
2815         case HCI_OP_READ_LOCAL_NAME:
2816                 hci_cc_read_local_name(hdev, skb);
2817                 break;
2818
2819         case HCI_OP_WRITE_AUTH_ENABLE:
2820                 hci_cc_write_auth_enable(hdev, skb);
2821                 break;
2822
2823         case HCI_OP_WRITE_ENCRYPT_MODE:
2824                 hci_cc_write_encrypt_mode(hdev, skb);
2825                 break;
2826
2827         case HCI_OP_WRITE_SCAN_ENABLE:
2828                 hci_cc_write_scan_enable(hdev, skb);
2829                 break;
2830
2831         case HCI_OP_READ_CLASS_OF_DEV:
2832                 hci_cc_read_class_of_dev(hdev, skb);
2833                 break;
2834
2835         case HCI_OP_WRITE_CLASS_OF_DEV:
2836                 hci_cc_write_class_of_dev(hdev, skb);
2837                 break;
2838
2839         case HCI_OP_READ_VOICE_SETTING:
2840                 hci_cc_read_voice_setting(hdev, skb);
2841                 break;
2842
2843         case HCI_OP_WRITE_VOICE_SETTING:
2844                 hci_cc_write_voice_setting(hdev, skb);
2845                 break;
2846
2847         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2848                 hci_cc_read_num_supported_iac(hdev, skb);
2849                 break;
2850
2851         case HCI_OP_WRITE_SSP_MODE:
2852                 hci_cc_write_ssp_mode(hdev, skb);
2853                 break;
2854
2855         case HCI_OP_WRITE_SC_SUPPORT:
2856                 hci_cc_write_sc_support(hdev, skb);
2857                 break;
2858
2859         case HCI_OP_READ_LOCAL_VERSION:
2860                 hci_cc_read_local_version(hdev, skb);
2861                 break;
2862
2863         case HCI_OP_READ_LOCAL_COMMANDS:
2864                 hci_cc_read_local_commands(hdev, skb);
2865                 break;
2866
2867         case HCI_OP_READ_LOCAL_FEATURES:
2868                 hci_cc_read_local_features(hdev, skb);
2869                 break;
2870
2871         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2872                 hci_cc_read_local_ext_features(hdev, skb);
2873                 break;
2874
2875         case HCI_OP_READ_BUFFER_SIZE:
2876                 hci_cc_read_buffer_size(hdev, skb);
2877                 break;
2878
2879         case HCI_OP_READ_BD_ADDR:
2880                 hci_cc_read_bd_addr(hdev, skb);
2881                 break;
2882
2883         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2884                 hci_cc_read_page_scan_activity(hdev, skb);
2885                 break;
2886
2887         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2888                 hci_cc_write_page_scan_activity(hdev, skb);
2889                 break;
2890
2891         case HCI_OP_READ_PAGE_SCAN_TYPE:
2892                 hci_cc_read_page_scan_type(hdev, skb);
2893                 break;
2894
2895         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2896                 hci_cc_write_page_scan_type(hdev, skb);
2897                 break;
2898
2899         case HCI_OP_READ_DATA_BLOCK_SIZE:
2900                 hci_cc_read_data_block_size(hdev, skb);
2901                 break;
2902
2903         case HCI_OP_READ_FLOW_CONTROL_MODE:
2904                 hci_cc_read_flow_control_mode(hdev, skb);
2905                 break;
2906
2907         case HCI_OP_READ_LOCAL_AMP_INFO:
2908                 hci_cc_read_local_amp_info(hdev, skb);
2909                 break;
2910
2911         case HCI_OP_READ_CLOCK:
2912                 hci_cc_read_clock(hdev, skb);
2913                 break;
2914
2915         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2916                 hci_cc_read_local_amp_assoc(hdev, skb);
2917                 break;
2918
2919         case HCI_OP_READ_INQ_RSP_TX_POWER:
2920                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2921                 break;
2922
2923         case HCI_OP_PIN_CODE_REPLY:
2924                 hci_cc_pin_code_reply(hdev, skb);
2925                 break;
2926
2927         case HCI_OP_PIN_CODE_NEG_REPLY:
2928                 hci_cc_pin_code_neg_reply(hdev, skb);
2929                 break;
2930
2931         case HCI_OP_READ_LOCAL_OOB_DATA:
2932                 hci_cc_read_local_oob_data(hdev, skb);
2933                 break;
2934
2935         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2936                 hci_cc_read_local_oob_ext_data(hdev, skb);
2937                 break;
2938
2939         case HCI_OP_LE_READ_BUFFER_SIZE:
2940                 hci_cc_le_read_buffer_size(hdev, skb);
2941                 break;
2942
2943         case HCI_OP_LE_READ_LOCAL_FEATURES:
2944                 hci_cc_le_read_local_features(hdev, skb);
2945                 break;
2946
2947         case HCI_OP_LE_READ_ADV_TX_POWER:
2948                 hci_cc_le_read_adv_tx_power(hdev, skb);
2949                 break;
2950
2951         case HCI_OP_USER_CONFIRM_REPLY:
2952                 hci_cc_user_confirm_reply(hdev, skb);
2953                 break;
2954
2955         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2956                 hci_cc_user_confirm_neg_reply(hdev, skb);
2957                 break;
2958
2959         case HCI_OP_USER_PASSKEY_REPLY:
2960                 hci_cc_user_passkey_reply(hdev, skb);
2961                 break;
2962
2963         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2964                 hci_cc_user_passkey_neg_reply(hdev, skb);
2965                 break;
2966
2967         case HCI_OP_LE_SET_RANDOM_ADDR:
2968                 hci_cc_le_set_random_addr(hdev, skb);
2969                 break;
2970
2971         case HCI_OP_LE_SET_ADV_ENABLE:
2972                 hci_cc_le_set_adv_enable(hdev, skb);
2973                 break;
2974
2975         case HCI_OP_LE_SET_SCAN_PARAM:
2976                 hci_cc_le_set_scan_param(hdev, skb);
2977                 break;
2978
2979         case HCI_OP_LE_SET_SCAN_ENABLE:
2980                 hci_cc_le_set_scan_enable(hdev, skb);
2981                 break;
2982
2983         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2984                 hci_cc_le_read_white_list_size(hdev, skb);
2985                 break;
2986
2987         case HCI_OP_LE_CLEAR_WHITE_LIST:
2988                 hci_cc_le_clear_white_list(hdev, skb);
2989                 break;
2990
2991         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2992                 hci_cc_le_add_to_white_list(hdev, skb);
2993                 break;
2994
2995         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2996                 hci_cc_le_del_from_white_list(hdev, skb);
2997                 break;
2998
2999         case HCI_OP_LE_READ_SUPPORTED_STATES:
3000                 hci_cc_le_read_supported_states(hdev, skb);
3001                 break;
3002
3003         case HCI_OP_LE_READ_DEF_DATA_LEN:
3004                 hci_cc_le_read_def_data_len(hdev, skb);
3005                 break;
3006
3007         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3008                 hci_cc_le_write_def_data_len(hdev, skb);
3009                 break;
3010
3011         case HCI_OP_LE_READ_MAX_DATA_LEN:
3012                 hci_cc_le_read_max_data_len(hdev, skb);
3013                 break;
3014
3015         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3016                 hci_cc_write_le_host_supported(hdev, skb);
3017                 break;
3018
3019         case HCI_OP_LE_SET_ADV_PARAM:
3020                 hci_cc_set_adv_param(hdev, skb);
3021                 break;
3022
3023         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
3024                 hci_cc_write_remote_amp_assoc(hdev, skb);
3025                 break;
3026
3027         case HCI_OP_READ_RSSI:
3028                 hci_cc_read_rssi(hdev, skb);
3029                 break;
3030
3031         case HCI_OP_READ_TX_POWER:
3032                 hci_cc_read_tx_power(hdev, skb);
3033                 break;
3034
3035         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3036                 hci_cc_write_ssp_debug_mode(hdev, skb);
3037                 break;
3038
3039         default:
3040                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3041                 break;
3042         }
3043
3044         if (*opcode != HCI_OP_NOP)
3045                 cancel_delayed_work(&hdev->cmd_timer);
3046
3047         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3048                 atomic_set(&hdev->cmd_cnt, 1);
3049
3050         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3051                              req_complete_skb);
3052
3053         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3054                 queue_work(hdev->workqueue, &hdev->cmd_work);
3055 }
3056
3057 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3058                                u16 *opcode, u8 *status,
3059                                hci_req_complete_t *req_complete,
3060                                hci_req_complete_skb_t *req_complete_skb)
3061 {
3062         struct hci_ev_cmd_status *ev = (void *) skb->data;
3063
3064         skb_pull(skb, sizeof(*ev));
3065
3066         *opcode = __le16_to_cpu(ev->opcode);
3067         *status = ev->status;
3068
3069         switch (*opcode) {
3070         case HCI_OP_INQUIRY:
3071                 hci_cs_inquiry(hdev, ev->status);
3072                 break;
3073
3074         case HCI_OP_CREATE_CONN:
3075                 hci_cs_create_conn(hdev, ev->status);
3076                 break;
3077
3078         case HCI_OP_DISCONNECT:
3079                 hci_cs_disconnect(hdev, ev->status);
3080                 break;
3081
3082         case HCI_OP_ADD_SCO:
3083                 hci_cs_add_sco(hdev, ev->status);
3084                 break;
3085
3086         case HCI_OP_AUTH_REQUESTED:
3087                 hci_cs_auth_requested(hdev, ev->status);
3088                 break;
3089
3090         case HCI_OP_SET_CONN_ENCRYPT:
3091                 hci_cs_set_conn_encrypt(hdev, ev->status);
3092                 break;
3093
3094         case HCI_OP_REMOTE_NAME_REQ:
3095                 hci_cs_remote_name_req(hdev, ev->status);
3096                 break;
3097
3098         case HCI_OP_READ_REMOTE_FEATURES:
3099                 hci_cs_read_remote_features(hdev, ev->status);
3100                 break;
3101
3102         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3103                 hci_cs_read_remote_ext_features(hdev, ev->status);
3104                 break;
3105
3106         case HCI_OP_SETUP_SYNC_CONN:
3107                 hci_cs_setup_sync_conn(hdev, ev->status);
3108                 break;
3109
3110         case HCI_OP_CREATE_PHY_LINK:
3111                 hci_cs_create_phylink(hdev, ev->status);
3112                 break;
3113
3114         case HCI_OP_ACCEPT_PHY_LINK:
3115                 hci_cs_accept_phylink(hdev, ev->status);
3116                 break;
3117
3118         case HCI_OP_SNIFF_MODE:
3119                 hci_cs_sniff_mode(hdev, ev->status);
3120                 break;
3121
3122         case HCI_OP_EXIT_SNIFF_MODE:
3123                 hci_cs_exit_sniff_mode(hdev, ev->status);
3124                 break;
3125
3126         case HCI_OP_SWITCH_ROLE:
3127                 hci_cs_switch_role(hdev, ev->status);
3128                 break;
3129
3130         case HCI_OP_LE_CREATE_CONN:
3131                 hci_cs_le_create_conn(hdev, ev->status);
3132                 break;
3133
3134         case HCI_OP_LE_READ_REMOTE_FEATURES:
3135                 hci_cs_le_read_remote_features(hdev, ev->status);
3136                 break;
3137
3138         case HCI_OP_LE_START_ENC:
3139                 hci_cs_le_start_enc(hdev, ev->status);
3140                 break;
3141
3142         default:
3143                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3144                 break;
3145         }
3146
3147         if (*opcode != HCI_OP_NOP)
3148                 cancel_delayed_work(&hdev->cmd_timer);
3149
3150         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3151                 atomic_set(&hdev->cmd_cnt, 1);
3152
3153         /* Indicate request completion if the command failed. Also, if
3154          * we're not waiting for a special event and we get a success
3155          * command status we should try to flag the request as completed
3156          * (since for this kind of commands there will not be a command
3157          * complete event).
3158          */
3159         if (ev->status ||
3160             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3161                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3162                                      req_complete_skb);
3163
3164         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3165                 queue_work(hdev->workqueue, &hdev->cmd_work);
3166 }
3167
3168 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3169 {
3170         struct hci_ev_hardware_error *ev = (void *) skb->data;
3171
3172         hdev->hw_error_code = ev->code;
3173
3174         queue_work(hdev->req_workqueue, &hdev->error_reset);
3175 }
3176
3177 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3178 {
3179         struct hci_ev_role_change *ev = (void *) skb->data;
3180         struct hci_conn *conn;
3181
3182         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3183
3184         hci_dev_lock(hdev);
3185
3186         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3187         if (conn) {
3188                 if (!ev->status)
3189                         conn->role = ev->role;
3190
3191                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3192
3193                 hci_role_switch_cfm(conn, ev->status, ev->role);
3194         }
3195
3196         hci_dev_unlock(hdev);
3197 }
3198
3199 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3200 {
3201         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3202         int i;
3203
3204         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3205                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3206                 return;
3207         }
3208
3209         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3210             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3211                 BT_DBG("%s bad parameters", hdev->name);
3212                 return;
3213         }
3214
3215         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3216
3217         for (i = 0; i < ev->num_hndl; i++) {
3218                 struct hci_comp_pkts_info *info = &ev->handles[i];
3219                 struct hci_conn *conn;
3220                 __u16  handle, count;
3221
3222                 handle = __le16_to_cpu(info->handle);
3223                 count  = __le16_to_cpu(info->count);
3224
3225                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3226                 if (!conn)
3227                         continue;
3228
3229                 conn->sent -= count;
3230
3231                 switch (conn->type) {
3232                 case ACL_LINK:
3233                         hdev->acl_cnt += count;
3234                         if (hdev->acl_cnt > hdev->acl_pkts)
3235                                 hdev->acl_cnt = hdev->acl_pkts;
3236                         break;
3237
3238                 case LE_LINK:
3239                         if (hdev->le_pkts) {
3240                                 hdev->le_cnt += count;
3241                                 if (hdev->le_cnt > hdev->le_pkts)
3242                                         hdev->le_cnt = hdev->le_pkts;
3243                         } else {
3244                                 hdev->acl_cnt += count;
3245                                 if (hdev->acl_cnt > hdev->acl_pkts)
3246                                         hdev->acl_cnt = hdev->acl_pkts;
3247                         }
3248                         break;
3249
3250                 case SCO_LINK:
3251                         hdev->sco_cnt += count;
3252                         if (hdev->sco_cnt > hdev->sco_pkts)
3253                                 hdev->sco_cnt = hdev->sco_pkts;
3254                         break;
3255
3256                 default:
3257                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3258                         break;
3259                 }
3260         }
3261
3262         queue_work(hdev->workqueue, &hdev->tx_work);
3263 }
3264
3265 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3266                                                  __u16 handle)
3267 {
3268         struct hci_chan *chan;
3269
3270         switch (hdev->dev_type) {
3271         case HCI_BREDR:
3272                 return hci_conn_hash_lookup_handle(hdev, handle);
3273         case HCI_AMP:
3274                 chan = hci_chan_lookup_handle(hdev, handle);
3275                 if (chan)
3276                         return chan->conn;
3277                 break;
3278         default:
3279                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3280                 break;
3281         }
3282
3283         return NULL;
3284 }
3285
3286 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3287 {
3288         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3289         int i;
3290
3291         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3292                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3293                 return;
3294         }
3295
3296         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3297             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3298                 BT_DBG("%s bad parameters", hdev->name);
3299                 return;
3300         }
3301
3302         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3303                ev->num_hndl);
3304
3305         for (i = 0; i < ev->num_hndl; i++) {
3306                 struct hci_comp_blocks_info *info = &ev->handles[i];
3307                 struct hci_conn *conn = NULL;
3308                 __u16  handle, block_count;
3309
3310                 handle = __le16_to_cpu(info->handle);
3311                 block_count = __le16_to_cpu(info->blocks);
3312
3313                 conn = __hci_conn_lookup_handle(hdev, handle);
3314                 if (!conn)
3315                         continue;
3316
3317                 conn->sent -= block_count;
3318
3319                 switch (conn->type) {
3320                 case ACL_LINK:
3321                 case AMP_LINK:
3322                         hdev->block_cnt += block_count;
3323                         if (hdev->block_cnt > hdev->num_blocks)
3324                                 hdev->block_cnt = hdev->num_blocks;
3325                         break;
3326
3327                 default:
3328                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3329                         break;
3330                 }
3331         }
3332
3333         queue_work(hdev->workqueue, &hdev->tx_work);
3334 }
3335
3336 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3337 {
3338         struct hci_ev_mode_change *ev = (void *) skb->data;
3339         struct hci_conn *conn;
3340
3341         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3342
3343         hci_dev_lock(hdev);
3344
3345         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3346         if (conn) {
3347                 conn->mode = ev->mode;
3348
3349                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3350                                         &conn->flags)) {
3351                         if (conn->mode == HCI_CM_ACTIVE)
3352                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3353                         else
3354                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3355                 }
3356
3357                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3358                         hci_sco_setup(conn, ev->status);
3359         }
3360
3361         hci_dev_unlock(hdev);
3362 }
3363
3364 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3365 {
3366         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3367         struct hci_conn *conn;
3368
3369         BT_DBG("%s", hdev->name);
3370
3371         hci_dev_lock(hdev);
3372
3373         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3374         if (!conn)
3375                 goto unlock;
3376
3377         if (conn->state == BT_CONNECTED) {
3378                 hci_conn_hold(conn);
3379                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3380                 hci_conn_drop(conn);
3381         }
3382
3383         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3384             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3385                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3386                              sizeof(ev->bdaddr), &ev->bdaddr);
3387         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3388                 u8 secure;
3389
3390                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3391                         secure = 1;
3392                 else
3393                         secure = 0;
3394
3395                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3396         }
3397
3398 unlock:
3399         hci_dev_unlock(hdev);
3400 }
3401
3402 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3403 {
3404         if (key_type == HCI_LK_CHANGED_COMBINATION)
3405                 return;
3406
3407         conn->pin_length = pin_len;
3408         conn->key_type = key_type;
3409
3410         switch (key_type) {
3411         case HCI_LK_LOCAL_UNIT:
3412         case HCI_LK_REMOTE_UNIT:
3413         case HCI_LK_DEBUG_COMBINATION:
3414                 return;
3415         case HCI_LK_COMBINATION:
3416                 if (pin_len == 16)
3417                         conn->pending_sec_level = BT_SECURITY_HIGH;
3418                 else
3419                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3420                 break;
3421         case HCI_LK_UNAUTH_COMBINATION_P192:
3422         case HCI_LK_UNAUTH_COMBINATION_P256:
3423                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3424                 break;
3425         case HCI_LK_AUTH_COMBINATION_P192:
3426                 conn->pending_sec_level = BT_SECURITY_HIGH;
3427                 break;
3428         case HCI_LK_AUTH_COMBINATION_P256:
3429                 conn->pending_sec_level = BT_SECURITY_FIPS;
3430                 break;
3431         }
3432 }
3433
3434 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3435 {
3436         struct hci_ev_link_key_req *ev = (void *) skb->data;
3437         struct hci_cp_link_key_reply cp;
3438         struct hci_conn *conn;
3439         struct link_key *key;
3440
3441         BT_DBG("%s", hdev->name);
3442
3443         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3444                 return;
3445
3446         hci_dev_lock(hdev);
3447
3448         key = hci_find_link_key(hdev, &ev->bdaddr);
3449         if (!key) {
3450                 BT_DBG("%s link key not found for %pMR", hdev->name,
3451                        &ev->bdaddr);
3452                 goto not_found;
3453         }
3454
3455         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3456                &ev->bdaddr);
3457
3458         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3459         if (conn) {
3460                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3461
3462                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3463                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3464                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3465                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3466                         goto not_found;
3467                 }
3468
3469                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3470                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3471                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3472                         BT_DBG("%s ignoring key unauthenticated for high security",
3473                                hdev->name);
3474                         goto not_found;
3475                 }
3476
3477                 conn_set_key(conn, key->type, key->pin_len);
3478         }
3479
3480         bacpy(&cp.bdaddr, &ev->bdaddr);
3481         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3482
3483         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3484
3485         hci_dev_unlock(hdev);
3486
3487         return;
3488
3489 not_found:
3490         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3491         hci_dev_unlock(hdev);
3492 }
3493
3494 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3495 {
3496         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3497         struct hci_conn *conn;
3498         struct link_key *key;
3499         bool persistent;
3500         u8 pin_len = 0;
3501
3502         BT_DBG("%s", hdev->name);
3503
3504         hci_dev_lock(hdev);
3505
3506         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3507         if (!conn)
3508                 goto unlock;
3509
3510         hci_conn_hold(conn);
3511         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3512         hci_conn_drop(conn);
3513
3514         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3515         conn_set_key(conn, ev->key_type, conn->pin_length);
3516
3517         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3518                 goto unlock;
3519
3520         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3521                                 ev->key_type, pin_len, &persistent);
3522         if (!key)
3523                 goto unlock;
3524
3525         /* Update connection information since adding the key will have
3526          * fixed up the type in the case of changed combination keys.
3527          */
3528         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3529                 conn_set_key(conn, key->type, key->pin_len);
3530
3531         mgmt_new_link_key(hdev, key, persistent);
3532
3533         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3534          * is set. If it's not set simply remove the key from the kernel
3535          * list (we've still notified user space about it but with
3536          * store_hint being 0).
3537          */
3538         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3539             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3540                 list_del_rcu(&key->list);
3541                 kfree_rcu(key, rcu);
3542                 goto unlock;
3543         }
3544
3545         if (persistent)
3546                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3547         else
3548                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3549
3550 unlock:
3551         hci_dev_unlock(hdev);
3552 }
3553
3554 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3555 {
3556         struct hci_ev_clock_offset *ev = (void *) skb->data;
3557         struct hci_conn *conn;
3558
3559         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3560
3561         hci_dev_lock(hdev);
3562
3563         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3564         if (conn && !ev->status) {
3565                 struct inquiry_entry *ie;
3566
3567                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3568                 if (ie) {
3569                         ie->data.clock_offset = ev->clock_offset;
3570                         ie->timestamp = jiffies;
3571                 }
3572         }
3573
3574         hci_dev_unlock(hdev);
3575 }
3576
3577 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3578 {
3579         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3580         struct hci_conn *conn;
3581
3582         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3583
3584         hci_dev_lock(hdev);
3585
3586         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3587         if (conn && !ev->status)
3588                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3589
3590         hci_dev_unlock(hdev);
3591 }
3592
3593 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3594 {
3595         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3596         struct inquiry_entry *ie;
3597
3598         BT_DBG("%s", hdev->name);
3599
3600         hci_dev_lock(hdev);
3601
3602         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3603         if (ie) {
3604                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3605                 ie->timestamp = jiffies;
3606         }
3607
3608         hci_dev_unlock(hdev);
3609 }
3610
3611 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3612                                              struct sk_buff *skb)
3613 {
3614         struct inquiry_data data;
3615         int num_rsp = *((__u8 *) skb->data);
3616
3617         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3618
3619         if (!num_rsp)
3620                 return;
3621
3622         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3623                 return;
3624
3625         hci_dev_lock(hdev);
3626
3627         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3628                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3629                 info = (void *) (skb->data + 1);
3630
3631                 for (; num_rsp; num_rsp--, info++) {
3632                         u32 flags;
3633
3634                         bacpy(&data.bdaddr, &info->bdaddr);
3635                         data.pscan_rep_mode     = info->pscan_rep_mode;
3636                         data.pscan_period_mode  = info->pscan_period_mode;
3637                         data.pscan_mode         = info->pscan_mode;
3638                         memcpy(data.dev_class, info->dev_class, 3);
3639                         data.clock_offset       = info->clock_offset;
3640                         data.rssi               = info->rssi;
3641                         data.ssp_mode           = 0x00;
3642
3643                         flags = hci_inquiry_cache_update(hdev, &data, false);
3644
3645                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3646                                           info->dev_class, info->rssi,
3647                                           flags, NULL, 0, NULL, 0);
3648                 }
3649         } else {
3650                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3651
3652                 for (; num_rsp; num_rsp--, info++) {
3653                         u32 flags;
3654
3655                         bacpy(&data.bdaddr, &info->bdaddr);
3656                         data.pscan_rep_mode     = info->pscan_rep_mode;
3657                         data.pscan_period_mode  = info->pscan_period_mode;
3658                         data.pscan_mode         = 0x00;
3659                         memcpy(data.dev_class, info->dev_class, 3);
3660                         data.clock_offset       = info->clock_offset;
3661                         data.rssi               = info->rssi;
3662                         data.ssp_mode           = 0x00;
3663
3664                         flags = hci_inquiry_cache_update(hdev, &data, false);
3665
3666                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3667                                           info->dev_class, info->rssi,
3668                                           flags, NULL, 0, NULL, 0);
3669                 }
3670         }
3671
3672         hci_dev_unlock(hdev);
3673 }
3674
3675 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3676                                         struct sk_buff *skb)
3677 {
3678         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3679         struct hci_conn *conn;
3680
3681         BT_DBG("%s", hdev->name);
3682
3683         hci_dev_lock(hdev);
3684
3685         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3686         if (!conn)
3687                 goto unlock;
3688
3689         if (ev->page < HCI_MAX_PAGES)
3690                 memcpy(conn->features[ev->page], ev->features, 8);
3691
3692         if (!ev->status && ev->page == 0x01) {
3693                 struct inquiry_entry *ie;
3694
3695                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3696                 if (ie)
3697                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3698
3699                 if (ev->features[0] & LMP_HOST_SSP) {
3700                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3701                 } else {
3702                         /* It is mandatory by the Bluetooth specification that
3703                          * Extended Inquiry Results are only used when Secure
3704                          * Simple Pairing is enabled, but some devices violate
3705                          * this.
3706                          *
3707                          * To make these devices work, the internal SSP
3708                          * enabled flag needs to be cleared if the remote host
3709                          * features do not indicate SSP support */
3710                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3711                 }
3712
3713                 if (ev->features[0] & LMP_HOST_SC)
3714                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3715         }
3716
3717         if (conn->state != BT_CONFIG)
3718                 goto unlock;
3719
3720         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3721                 struct hci_cp_remote_name_req cp;
3722                 memset(&cp, 0, sizeof(cp));
3723                 bacpy(&cp.bdaddr, &conn->dst);
3724                 cp.pscan_rep_mode = 0x02;
3725                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3726         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3727                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3728
3729         if (!hci_outgoing_auth_needed(hdev, conn)) {
3730                 conn->state = BT_CONNECTED;
3731                 hci_connect_cfm(conn, ev->status);
3732                 hci_conn_drop(conn);
3733         }
3734
3735 unlock:
3736         hci_dev_unlock(hdev);
3737 }
3738
3739 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3740                                        struct sk_buff *skb)
3741 {
3742         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3743         struct hci_conn *conn;
3744
3745         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3746
3747         hci_dev_lock(hdev);
3748
3749         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3750         if (!conn) {
3751                 if (ev->link_type == ESCO_LINK)
3752                         goto unlock;
3753
3754                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3755                 if (!conn)
3756                         goto unlock;
3757
3758                 conn->type = SCO_LINK;
3759         }
3760
3761         switch (ev->status) {
3762         case 0x00:
3763                 conn->handle = __le16_to_cpu(ev->handle);
3764                 conn->state  = BT_CONNECTED;
3765
3766                 hci_debugfs_create_conn(conn);
3767                 hci_conn_add_sysfs(conn);
3768                 break;
3769
3770         case 0x10:      /* Connection Accept Timeout */
3771         case 0x0d:      /* Connection Rejected due to Limited Resources */
3772         case 0x11:      /* Unsupported Feature or Parameter Value */
3773         case 0x1c:      /* SCO interval rejected */
3774         case 0x1a:      /* Unsupported Remote Feature */
3775         case 0x1f:      /* Unspecified error */
3776         case 0x20:      /* Unsupported LMP Parameter value */
3777                 if (conn->out) {
3778                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3779                                         (hdev->esco_type & EDR_ESCO_MASK);
3780                         if (hci_setup_sync(conn, conn->link->handle))
3781                                 goto unlock;
3782                 }
3783                 /* fall through */
3784
3785         default:
3786                 conn->state = BT_CLOSED;
3787                 break;
3788         }
3789
3790         hci_connect_cfm(conn, ev->status);
3791         if (ev->status)
3792                 hci_conn_del(conn);
3793
3794 unlock:
3795         hci_dev_unlock(hdev);
3796 }
3797
3798 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3799 {
3800         size_t parsed = 0;
3801
3802         while (parsed < eir_len) {
3803                 u8 field_len = eir[0];
3804
3805                 if (field_len == 0)
3806                         return parsed;
3807
3808                 parsed += field_len + 1;
3809                 eir += field_len + 1;
3810         }
3811
3812         return eir_len;
3813 }
3814
3815 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3816                                             struct sk_buff *skb)
3817 {
3818         struct inquiry_data data;
3819         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3820         int num_rsp = *((__u8 *) skb->data);
3821         size_t eir_len;
3822
3823         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3824
3825         if (!num_rsp)
3826                 return;
3827
3828         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3829                 return;
3830
3831         hci_dev_lock(hdev);
3832
3833         for (; num_rsp; num_rsp--, info++) {
3834                 u32 flags;
3835                 bool name_known;
3836
3837                 bacpy(&data.bdaddr, &info->bdaddr);
3838                 data.pscan_rep_mode     = info->pscan_rep_mode;
3839                 data.pscan_period_mode  = info->pscan_period_mode;
3840                 data.pscan_mode         = 0x00;
3841                 memcpy(data.dev_class, info->dev_class, 3);
3842                 data.clock_offset       = info->clock_offset;
3843                 data.rssi               = info->rssi;
3844                 data.ssp_mode           = 0x01;
3845
3846                 if (hci_dev_test_flag(hdev, HCI_MGMT))
3847                         name_known = eir_has_data_type(info->data,
3848                                                        sizeof(info->data),
3849                                                        EIR_NAME_COMPLETE);
3850                 else
3851                         name_known = true;
3852
3853                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3854
3855                 eir_len = eir_get_length(info->data, sizeof(info->data));
3856
3857                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3858                                   info->dev_class, info->rssi,
3859                                   flags, info->data, eir_len, NULL, 0);
3860         }
3861
3862         hci_dev_unlock(hdev);
3863 }
3864
3865 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3866                                          struct sk_buff *skb)
3867 {
3868         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3869         struct hci_conn *conn;
3870
3871         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3872                __le16_to_cpu(ev->handle));
3873
3874         hci_dev_lock(hdev);
3875
3876         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3877         if (!conn)
3878                 goto unlock;
3879
3880         /* For BR/EDR the necessary steps are taken through the
3881          * auth_complete event.
3882          */
3883         if (conn->type != LE_LINK)
3884                 goto unlock;
3885
3886         if (!ev->status)
3887                 conn->sec_level = conn->pending_sec_level;
3888
3889         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3890
3891         if (ev->status && conn->state == BT_CONNECTED) {
3892                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3893                 hci_conn_drop(conn);
3894                 goto unlock;
3895         }
3896
3897         if (conn->state == BT_CONFIG) {
3898                 if (!ev->status)
3899                         conn->state = BT_CONNECTED;
3900
3901                 hci_connect_cfm(conn, ev->status);
3902                 hci_conn_drop(conn);
3903         } else {
3904                 hci_auth_cfm(conn, ev->status);
3905
3906                 hci_conn_hold(conn);
3907                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3908                 hci_conn_drop(conn);
3909         }
3910
3911 unlock:
3912         hci_dev_unlock(hdev);
3913 }
3914
3915 static u8 hci_get_auth_req(struct hci_conn *conn)
3916 {
3917         /* If remote requests no-bonding follow that lead */
3918         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3919             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3920                 return conn->remote_auth | (conn->auth_type & 0x01);
3921
3922         /* If both remote and local have enough IO capabilities, require
3923          * MITM protection
3924          */
3925         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3926             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3927                 return conn->remote_auth | 0x01;
3928
3929         /* No MITM protection possible so ignore remote requirement */
3930         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3931 }
3932
3933 static u8 bredr_oob_data_present(struct hci_conn *conn)
3934 {
3935         struct hci_dev *hdev = conn->hdev;
3936         struct oob_data *data;
3937
3938         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3939         if (!data)
3940                 return 0x00;
3941
3942         if (bredr_sc_enabled(hdev)) {
3943                 /* When Secure Connections is enabled, then just
3944                  * return the present value stored with the OOB
3945                  * data. The stored value contains the right present
3946                  * information. However it can only be trusted when
3947                  * not in Secure Connection Only mode.
3948                  */
3949                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3950                         return data->present;
3951
3952                 /* When Secure Connections Only mode is enabled, then
3953                  * the P-256 values are required. If they are not
3954                  * available, then do not declare that OOB data is
3955                  * present.
3956                  */
3957                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
3958                     !memcmp(data->hash256, ZERO_KEY, 16))
3959                         return 0x00;
3960
3961                 return 0x02;
3962         }
3963
3964         /* When Secure Connections is not enabled or actually
3965          * not supported by the hardware, then check that if
3966          * P-192 data values are present.
3967          */
3968         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
3969             !memcmp(data->hash192, ZERO_KEY, 16))
3970                 return 0x00;
3971
3972         return 0x01;
3973 }
3974
3975 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3976 {
3977         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3978         struct hci_conn *conn;
3979
3980         BT_DBG("%s", hdev->name);
3981
3982         hci_dev_lock(hdev);
3983
3984         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3985         if (!conn)
3986                 goto unlock;
3987
3988         hci_conn_hold(conn);
3989
3990         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3991                 goto unlock;
3992
3993         /* Allow pairing if we're pairable, the initiators of the
3994          * pairing or if the remote is not requesting bonding.
3995          */
3996         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
3997             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
3998             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3999                 struct hci_cp_io_capability_reply cp;
4000
4001                 bacpy(&cp.bdaddr, &ev->bdaddr);
4002                 /* Change the IO capability from KeyboardDisplay
4003                  * to DisplayYesNo as it is not supported by BT spec. */
4004                 cp.capability = (conn->io_capability == 0x04) ?
4005                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4006
4007                 /* If we are initiators, there is no remote information yet */
4008                 if (conn->remote_auth == 0xff) {
4009                         /* Request MITM protection if our IO caps allow it
4010                          * except for the no-bonding case.
4011                          */
4012                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4013                             conn->auth_type != HCI_AT_NO_BONDING)
4014                                 conn->auth_type |= 0x01;
4015                 } else {
4016                         conn->auth_type = hci_get_auth_req(conn);
4017                 }
4018
4019                 /* If we're not bondable, force one of the non-bondable
4020                  * authentication requirement values.
4021                  */
4022                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4023                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4024
4025                 cp.authentication = conn->auth_type;
4026                 cp.oob_data = bredr_oob_data_present(conn);
4027
4028                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4029                              sizeof(cp), &cp);
4030         } else {
4031                 struct hci_cp_io_capability_neg_reply cp;
4032
4033                 bacpy(&cp.bdaddr, &ev->bdaddr);
4034                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4035
4036                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4037                              sizeof(cp), &cp);
4038         }
4039
4040 unlock:
4041         hci_dev_unlock(hdev);
4042 }
4043
4044 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4045 {
4046         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4047         struct hci_conn *conn;
4048
4049         BT_DBG("%s", hdev->name);
4050
4051         hci_dev_lock(hdev);
4052
4053         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4054         if (!conn)
4055                 goto unlock;
4056
4057         conn->remote_cap = ev->capability;
4058         conn->remote_auth = ev->authentication;
4059
4060 unlock:
4061         hci_dev_unlock(hdev);
4062 }
4063
4064 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4065                                          struct sk_buff *skb)
4066 {
4067         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4068         int loc_mitm, rem_mitm, confirm_hint = 0;
4069         struct hci_conn *conn;
4070
4071         BT_DBG("%s", hdev->name);
4072
4073         hci_dev_lock(hdev);
4074
4075         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4076                 goto unlock;
4077
4078         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4079         if (!conn)
4080                 goto unlock;
4081
4082         loc_mitm = (conn->auth_type & 0x01);
4083         rem_mitm = (conn->remote_auth & 0x01);
4084
4085         /* If we require MITM but the remote device can't provide that
4086          * (it has NoInputNoOutput) then reject the confirmation
4087          * request. We check the security level here since it doesn't
4088          * necessarily match conn->auth_type.
4089          */
4090         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4091             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4092                 BT_DBG("Rejecting request: remote device can't provide MITM");
4093                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4094                              sizeof(ev->bdaddr), &ev->bdaddr);
4095                 goto unlock;
4096         }
4097
4098         /* If no side requires MITM protection; auto-accept */
4099         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4100             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4101
4102                 /* If we're not the initiators request authorization to
4103                  * proceed from user space (mgmt_user_confirm with
4104                  * confirm_hint set to 1). The exception is if neither
4105                  * side had MITM or if the local IO capability is
4106                  * NoInputNoOutput, in which case we do auto-accept
4107                  */
4108                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4109                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4110                     (loc_mitm || rem_mitm)) {
4111                         BT_DBG("Confirming auto-accept as acceptor");
4112                         confirm_hint = 1;
4113                         goto confirm;
4114                 }
4115
4116                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4117                        hdev->auto_accept_delay);
4118
4119                 if (hdev->auto_accept_delay > 0) {
4120                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4121                         queue_delayed_work(conn->hdev->workqueue,
4122                                            &conn->auto_accept_work, delay);
4123                         goto unlock;
4124                 }
4125
4126                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4127                              sizeof(ev->bdaddr), &ev->bdaddr);
4128                 goto unlock;
4129         }
4130
4131 confirm:
4132         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4133                                   le32_to_cpu(ev->passkey), confirm_hint);
4134
4135 unlock:
4136         hci_dev_unlock(hdev);
4137 }
4138
4139 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4140                                          struct sk_buff *skb)
4141 {
4142         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4143
4144         BT_DBG("%s", hdev->name);
4145
4146         if (hci_dev_test_flag(hdev, HCI_MGMT))
4147                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4148 }
4149
4150 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4151                                         struct sk_buff *skb)
4152 {
4153         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4154         struct hci_conn *conn;
4155
4156         BT_DBG("%s", hdev->name);
4157
4158         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4159         if (!conn)
4160                 return;
4161
4162         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4163         conn->passkey_entered = 0;
4164
4165         if (hci_dev_test_flag(hdev, HCI_MGMT))
4166                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4167                                          conn->dst_type, conn->passkey_notify,
4168                                          conn->passkey_entered);
4169 }
4170
4171 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4172 {
4173         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4174         struct hci_conn *conn;
4175
4176         BT_DBG("%s", hdev->name);
4177
4178         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4179         if (!conn)
4180                 return;
4181
4182         switch (ev->type) {
4183         case HCI_KEYPRESS_STARTED:
4184                 conn->passkey_entered = 0;
4185                 return;
4186
4187         case HCI_KEYPRESS_ENTERED:
4188                 conn->passkey_entered++;
4189                 break;
4190
4191         case HCI_KEYPRESS_ERASED:
4192                 conn->passkey_entered--;
4193                 break;
4194
4195         case HCI_KEYPRESS_CLEARED:
4196                 conn->passkey_entered = 0;
4197                 break;
4198
4199         case HCI_KEYPRESS_COMPLETED:
4200                 return;
4201         }
4202
4203         if (hci_dev_test_flag(hdev, HCI_MGMT))
4204                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4205                                          conn->dst_type, conn->passkey_notify,
4206                                          conn->passkey_entered);
4207 }
4208
4209 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4210                                          struct sk_buff *skb)
4211 {
4212         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4213         struct hci_conn *conn;
4214
4215         BT_DBG("%s", hdev->name);
4216
4217         hci_dev_lock(hdev);
4218
4219         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4220         if (!conn)
4221                 goto unlock;
4222
4223         /* Reset the authentication requirement to unknown */
4224         conn->remote_auth = 0xff;
4225
4226         /* To avoid duplicate auth_failed events to user space we check
4227          * the HCI_CONN_AUTH_PEND flag which will be set if we
4228          * initiated the authentication. A traditional auth_complete
4229          * event gets always produced as initiator and is also mapped to
4230          * the mgmt_auth_failed event */
4231         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4232                 mgmt_auth_failed(conn, ev->status);
4233
4234         hci_conn_drop(conn);
4235
4236 unlock:
4237         hci_dev_unlock(hdev);
4238 }
4239
4240 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4241                                          struct sk_buff *skb)
4242 {
4243         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4244         struct inquiry_entry *ie;
4245         struct hci_conn *conn;
4246
4247         BT_DBG("%s", hdev->name);
4248
4249         hci_dev_lock(hdev);
4250
4251         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4252         if (conn)
4253                 memcpy(conn->features[1], ev->features, 8);
4254
4255         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4256         if (ie)
4257                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4258
4259         hci_dev_unlock(hdev);
4260 }
4261
4262 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4263                                             struct sk_buff *skb)
4264 {
4265         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4266         struct oob_data *data;
4267
4268         BT_DBG("%s", hdev->name);
4269
4270         hci_dev_lock(hdev);
4271
4272         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4273                 goto unlock;
4274
4275         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4276         if (!data) {
4277                 struct hci_cp_remote_oob_data_neg_reply cp;
4278
4279                 bacpy(&cp.bdaddr, &ev->bdaddr);
4280                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4281                              sizeof(cp), &cp);
4282                 goto unlock;
4283         }
4284
4285         if (bredr_sc_enabled(hdev)) {
4286                 struct hci_cp_remote_oob_ext_data_reply cp;
4287
4288                 bacpy(&cp.bdaddr, &ev->bdaddr);
4289                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4290                         memset(cp.hash192, 0, sizeof(cp.hash192));
4291                         memset(cp.rand192, 0, sizeof(cp.rand192));
4292                 } else {
4293                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4294                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4295                 }
4296                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4297                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4298
4299                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4300                              sizeof(cp), &cp);
4301         } else {
4302                 struct hci_cp_remote_oob_data_reply cp;
4303
4304                 bacpy(&cp.bdaddr, &ev->bdaddr);
4305                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4306                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4307
4308                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4309                              sizeof(cp), &cp);
4310         }
4311
4312 unlock:
4313         hci_dev_unlock(hdev);
4314 }
4315
4316 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4317                                       struct sk_buff *skb)
4318 {
4319         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4320         struct hci_conn *hcon, *bredr_hcon;
4321
4322         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4323                ev->status);
4324
4325         hci_dev_lock(hdev);
4326
4327         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4328         if (!hcon) {
4329                 hci_dev_unlock(hdev);
4330                 return;
4331         }
4332
4333         if (ev->status) {
4334                 hci_conn_del(hcon);
4335                 hci_dev_unlock(hdev);
4336                 return;
4337         }
4338
4339         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4340
4341         hcon->state = BT_CONNECTED;
4342         bacpy(&hcon->dst, &bredr_hcon->dst);
4343
4344         hci_conn_hold(hcon);
4345         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4346         hci_conn_drop(hcon);
4347
4348         hci_debugfs_create_conn(hcon);
4349         hci_conn_add_sysfs(hcon);
4350
4351         amp_physical_cfm(bredr_hcon, hcon);
4352
4353         hci_dev_unlock(hdev);
4354 }
4355
4356 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4357 {
4358         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4359         struct hci_conn *hcon;
4360         struct hci_chan *hchan;
4361         struct amp_mgr *mgr;
4362
4363         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4364                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4365                ev->status);
4366
4367         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4368         if (!hcon)
4369                 return;
4370
4371         /* Create AMP hchan */
4372         hchan = hci_chan_create(hcon);
4373         if (!hchan)
4374                 return;
4375
4376         hchan->handle = le16_to_cpu(ev->handle);
4377
4378         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4379
4380         mgr = hcon->amp_mgr;
4381         if (mgr && mgr->bredr_chan) {
4382                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4383
4384                 l2cap_chan_lock(bredr_chan);
4385
4386                 bredr_chan->conn->mtu = hdev->block_mtu;
4387                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4388                 hci_conn_hold(hcon);
4389
4390                 l2cap_chan_unlock(bredr_chan);
4391         }
4392 }
4393
4394 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4395                                              struct sk_buff *skb)
4396 {
4397         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4398         struct hci_chan *hchan;
4399
4400         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4401                le16_to_cpu(ev->handle), ev->status);
4402
4403         if (ev->status)
4404                 return;
4405
4406         hci_dev_lock(hdev);
4407
4408         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4409         if (!hchan)
4410                 goto unlock;
4411
4412         amp_destroy_logical_link(hchan, ev->reason);
4413
4414 unlock:
4415         hci_dev_unlock(hdev);
4416 }
4417
4418 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4419                                              struct sk_buff *skb)
4420 {
4421         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4422         struct hci_conn *hcon;
4423
4424         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4425
4426         if (ev->status)
4427                 return;
4428
4429         hci_dev_lock(hdev);
4430
4431         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4432         if (hcon) {
4433                 hcon->state = BT_CLOSED;
4434                 hci_conn_del(hcon);
4435         }
4436
4437         hci_dev_unlock(hdev);
4438 }
4439
4440 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4441 {
4442         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4443         struct hci_conn_params *params;
4444         struct hci_conn *conn;
4445         struct smp_irk *irk;
4446         u8 addr_type;
4447
4448         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4449
4450         hci_dev_lock(hdev);
4451
4452         /* All controllers implicitly stop advertising in the event of a
4453          * connection, so ensure that the state bit is cleared.
4454          */
4455         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4456
4457         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4458         if (!conn) {
4459                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4460                 if (!conn) {
4461                         BT_ERR("No memory for new connection");
4462                         goto unlock;
4463                 }
4464
4465                 conn->dst_type = ev->bdaddr_type;
4466
4467                 /* If we didn't have a hci_conn object previously
4468                  * but we're in master role this must be something
4469                  * initiated using a white list. Since white list based
4470                  * connections are not "first class citizens" we don't
4471                  * have full tracking of them. Therefore, we go ahead
4472                  * with a "best effort" approach of determining the
4473                  * initiator address based on the HCI_PRIVACY flag.
4474                  */
4475                 if (conn->out) {
4476                         conn->resp_addr_type = ev->bdaddr_type;
4477                         bacpy(&conn->resp_addr, &ev->bdaddr);
4478                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4479                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4480                                 bacpy(&conn->init_addr, &hdev->rpa);
4481                         } else {
4482                                 hci_copy_identity_address(hdev,
4483                                                           &conn->init_addr,
4484                                                           &conn->init_addr_type);
4485                         }
4486                 }
4487         } else {
4488                 cancel_delayed_work(&conn->le_conn_timeout);
4489         }
4490
4491         if (!conn->out) {
4492                 /* Set the responder (our side) address type based on
4493                  * the advertising address type.
4494                  */
4495                 conn->resp_addr_type = hdev->adv_addr_type;
4496                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4497                         bacpy(&conn->resp_addr, &hdev->random_addr);
4498                 else
4499                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4500
4501                 conn->init_addr_type = ev->bdaddr_type;
4502                 bacpy(&conn->init_addr, &ev->bdaddr);
4503
4504                 /* For incoming connections, set the default minimum
4505                  * and maximum connection interval. They will be used
4506                  * to check if the parameters are in range and if not
4507                  * trigger the connection update procedure.
4508                  */
4509                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4510                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4511         }
4512
4513         /* Lookup the identity address from the stored connection
4514          * address and address type.
4515          *
4516          * When establishing connections to an identity address, the
4517          * connection procedure will store the resolvable random
4518          * address first. Now if it can be converted back into the
4519          * identity address, start using the identity address from
4520          * now on.
4521          */
4522         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4523         if (irk) {
4524                 bacpy(&conn->dst, &irk->bdaddr);
4525                 conn->dst_type = irk->addr_type;
4526         }
4527
4528         if (ev->status) {
4529                 hci_le_conn_failed(conn, ev->status);
4530                 goto unlock;
4531         }
4532
4533         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4534                 addr_type = BDADDR_LE_PUBLIC;
4535         else
4536                 addr_type = BDADDR_LE_RANDOM;
4537
4538         /* Drop the connection if the device is blocked */
4539         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4540                 hci_conn_drop(conn);
4541                 goto unlock;
4542         }
4543
4544         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4545                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4546
4547         conn->sec_level = BT_SECURITY_LOW;
4548         conn->handle = __le16_to_cpu(ev->handle);
4549         conn->state = BT_CONFIG;
4550
4551         conn->le_conn_interval = le16_to_cpu(ev->interval);
4552         conn->le_conn_latency = le16_to_cpu(ev->latency);
4553         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4554
4555         hci_debugfs_create_conn(conn);
4556         hci_conn_add_sysfs(conn);
4557
4558         if (!ev->status) {
4559                 /* The remote features procedure is defined for master
4560                  * role only. So only in case of an initiated connection
4561                  * request the remote features.
4562                  *
4563                  * If the local controller supports slave-initiated features
4564                  * exchange, then requesting the remote features in slave
4565                  * role is possible. Otherwise just transition into the
4566                  * connected state without requesting the remote features.
4567                  */
4568                 if (conn->out ||
4569                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4570                         struct hci_cp_le_read_remote_features cp;
4571
4572                         cp.handle = __cpu_to_le16(conn->handle);
4573
4574                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4575                                      sizeof(cp), &cp);
4576
4577                         hci_conn_hold(conn);
4578                 } else {
4579                         conn->state = BT_CONNECTED;
4580                         hci_connect_cfm(conn, ev->status);
4581                 }
4582         } else {
4583                 hci_connect_cfm(conn, ev->status);
4584         }
4585
4586         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4587                                            conn->dst_type);
4588         if (params) {
4589                 list_del_init(&params->action);
4590                 if (params->conn) {
4591                         hci_conn_drop(params->conn);
4592                         hci_conn_put(params->conn);
4593                         params->conn = NULL;
4594                 }
4595         }
4596
4597 unlock:
4598         hci_update_background_scan(hdev);
4599         hci_dev_unlock(hdev);
4600 }
4601
4602 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4603                                             struct sk_buff *skb)
4604 {
4605         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4606         struct hci_conn *conn;
4607
4608         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4609
4610         if (ev->status)
4611                 return;
4612
4613         hci_dev_lock(hdev);
4614
4615         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4616         if (conn) {
4617                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4618                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4619                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4620         }
4621
4622         hci_dev_unlock(hdev);
4623 }
4624
4625 /* This function requires the caller holds hdev->lock */
4626 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4627                                               bdaddr_t *addr,
4628                                               u8 addr_type, u8 adv_type)
4629 {
4630         struct hci_conn *conn;
4631         struct hci_conn_params *params;
4632
4633         /* If the event is not connectable don't proceed further */
4634         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4635                 return NULL;
4636
4637         /* Ignore if the device is blocked */
4638         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4639                 return NULL;
4640
4641         /* Most controller will fail if we try to create new connections
4642          * while we have an existing one in slave role.
4643          */
4644         if (hdev->conn_hash.le_num_slave > 0)
4645                 return NULL;
4646
4647         /* If we're not connectable only connect devices that we have in
4648          * our pend_le_conns list.
4649          */
4650         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4651                                            addr, addr_type);
4652         if (!params)
4653                 return NULL;
4654
4655         switch (params->auto_connect) {
4656         case HCI_AUTO_CONN_DIRECT:
4657                 /* Only devices advertising with ADV_DIRECT_IND are
4658                  * triggering a connection attempt. This is allowing
4659                  * incoming connections from slave devices.
4660                  */
4661                 if (adv_type != LE_ADV_DIRECT_IND)
4662                         return NULL;
4663                 break;
4664         case HCI_AUTO_CONN_ALWAYS:
4665                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4666                  * are triggering a connection attempt. This means
4667                  * that incoming connectioms from slave device are
4668                  * accepted and also outgoing connections to slave
4669                  * devices are established when found.
4670                  */
4671                 break;
4672         default:
4673                 return NULL;
4674         }
4675
4676         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4677                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4678         if (!IS_ERR(conn)) {
4679                 /* Store the pointer since we don't really have any
4680                  * other owner of the object besides the params that
4681                  * triggered it. This way we can abort the connection if
4682                  * the parameters get removed and keep the reference
4683                  * count consistent once the connection is established.
4684                  */
4685                 params->conn = hci_conn_get(conn);
4686                 return conn;
4687         }
4688
4689         switch (PTR_ERR(conn)) {
4690         case -EBUSY:
4691                 /* If hci_connect() returns -EBUSY it means there is already
4692                  * an LE connection attempt going on. Since controllers don't
4693                  * support more than one connection attempt at the time, we
4694                  * don't consider this an error case.
4695                  */
4696                 break;
4697         default:
4698                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4699                 return NULL;
4700         }
4701
4702         return NULL;
4703 }
4704
4705 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4706                                u8 bdaddr_type, bdaddr_t *direct_addr,
4707                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4708 {
4709         struct discovery_state *d = &hdev->discovery;
4710         struct smp_irk *irk;
4711         struct hci_conn *conn;
4712         bool match;
4713         u32 flags;
4714
4715         /* If the direct address is present, then this report is from
4716          * a LE Direct Advertising Report event. In that case it is
4717          * important to see if the address is matching the local
4718          * controller address.
4719          */
4720         if (direct_addr) {
4721                 /* Only resolvable random addresses are valid for these
4722                  * kind of reports and others can be ignored.
4723                  */
4724                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4725                         return;
4726
4727                 /* If the controller is not using resolvable random
4728                  * addresses, then this report can be ignored.
4729                  */
4730                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4731                         return;
4732
4733                 /* If the local IRK of the controller does not match
4734                  * with the resolvable random address provided, then
4735                  * this report can be ignored.
4736                  */
4737                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4738                         return;
4739         }
4740
4741         /* Check if we need to convert to identity address */
4742         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4743         if (irk) {
4744                 bdaddr = &irk->bdaddr;
4745                 bdaddr_type = irk->addr_type;
4746         }
4747
4748         /* Check if we have been requested to connect to this device */
4749         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4750         if (conn && type == LE_ADV_IND) {
4751                 /* Store report for later inclusion by
4752                  * mgmt_device_connected
4753                  */
4754                 memcpy(conn->le_adv_data, data, len);
4755                 conn->le_adv_data_len = len;
4756         }
4757
4758         /* Passive scanning shouldn't trigger any device found events,
4759          * except for devices marked as CONN_REPORT for which we do send
4760          * device found events.
4761          */
4762         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4763                 if (type == LE_ADV_DIRECT_IND)
4764                         return;
4765
4766                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4767                                                bdaddr, bdaddr_type))
4768                         return;
4769
4770                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4771                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4772                 else
4773                         flags = 0;
4774                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4775                                   rssi, flags, data, len, NULL, 0);
4776                 return;
4777         }
4778
4779         /* When receiving non-connectable or scannable undirected
4780          * advertising reports, this means that the remote device is
4781          * not connectable and then clearly indicate this in the
4782          * device found event.
4783          *
4784          * When receiving a scan response, then there is no way to
4785          * know if the remote device is connectable or not. However
4786          * since scan responses are merged with a previously seen
4787          * advertising report, the flags field from that report
4788          * will be used.
4789          *
4790          * In the really unlikely case that a controller get confused
4791          * and just sends a scan response event, then it is marked as
4792          * not connectable as well.
4793          */
4794         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4795             type == LE_ADV_SCAN_RSP)
4796                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4797         else
4798                 flags = 0;
4799
4800         /* If there's nothing pending either store the data from this
4801          * event or send an immediate device found event if the data
4802          * should not be stored for later.
4803          */
4804         if (!has_pending_adv_report(hdev)) {
4805                 /* If the report will trigger a SCAN_REQ store it for
4806                  * later merging.
4807                  */
4808                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4809                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4810                                                  rssi, flags, data, len);
4811                         return;
4812                 }
4813
4814                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4815                                   rssi, flags, data, len, NULL, 0);
4816                 return;
4817         }
4818
4819         /* Check if the pending report is for the same device as the new one */
4820         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4821                  bdaddr_type == d->last_adv_addr_type);
4822
4823         /* If the pending data doesn't match this report or this isn't a
4824          * scan response (e.g. we got a duplicate ADV_IND) then force
4825          * sending of the pending data.
4826          */
4827         if (type != LE_ADV_SCAN_RSP || !match) {
4828                 /* Send out whatever is in the cache, but skip duplicates */
4829                 if (!match)
4830                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4831                                           d->last_adv_addr_type, NULL,
4832                                           d->last_adv_rssi, d->last_adv_flags,
4833                                           d->last_adv_data,
4834                                           d->last_adv_data_len, NULL, 0);
4835
4836                 /* If the new report will trigger a SCAN_REQ store it for
4837                  * later merging.
4838                  */
4839                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4840                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4841                                                  rssi, flags, data, len);
4842                         return;
4843                 }
4844
4845                 /* The advertising reports cannot be merged, so clear
4846                  * the pending report and send out a device found event.
4847                  */
4848                 clear_pending_adv_report(hdev);
4849                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4850                                   rssi, flags, data, len, NULL, 0);
4851                 return;
4852         }
4853
4854         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4855          * the new event is a SCAN_RSP. We can therefore proceed with
4856          * sending a merged device found event.
4857          */
4858         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4859                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4860                           d->last_adv_data, d->last_adv_data_len, data, len);
4861         clear_pending_adv_report(hdev);
4862 }
4863
4864 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4865 {
4866         u8 num_reports = skb->data[0];
4867         void *ptr = &skb->data[1];
4868
4869         hci_dev_lock(hdev);
4870
4871         while (num_reports--) {
4872                 struct hci_ev_le_advertising_info *ev = ptr;
4873                 s8 rssi;
4874
4875                 rssi = ev->data[ev->length];
4876                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4877                                    ev->bdaddr_type, NULL, 0, rssi,
4878                                    ev->data, ev->length);
4879
4880                 ptr += sizeof(*ev) + ev->length + 1;
4881         }
4882
4883         hci_dev_unlock(hdev);
4884 }
4885
4886 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
4887                                             struct sk_buff *skb)
4888 {
4889         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
4890         struct hci_conn *conn;
4891
4892         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4893
4894         hci_dev_lock(hdev);
4895
4896         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4897         if (conn) {
4898                 if (!ev->status)
4899                         memcpy(conn->features[0], ev->features, 8);
4900
4901                 if (conn->state == BT_CONFIG) {
4902                         __u8 status;
4903
4904                         /* If the local controller supports slave-initiated
4905                          * features exchange, but the remote controller does
4906                          * not, then it is possible that the error code 0x1a
4907                          * for unsupported remote feature gets returned.
4908                          *
4909                          * In this specific case, allow the connection to
4910                          * transition into connected state and mark it as
4911                          * successful.
4912                          */
4913                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
4914                             !conn->out && ev->status == 0x1a)
4915                                 status = 0x00;
4916                         else
4917                                 status = ev->status;
4918
4919                         conn->state = BT_CONNECTED;
4920                         hci_connect_cfm(conn, status);
4921                         hci_conn_drop(conn);
4922                 }
4923         }
4924
4925         hci_dev_unlock(hdev);
4926 }
4927
4928 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4929 {
4930         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4931         struct hci_cp_le_ltk_reply cp;
4932         struct hci_cp_le_ltk_neg_reply neg;
4933         struct hci_conn *conn;
4934         struct smp_ltk *ltk;
4935
4936         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4937
4938         hci_dev_lock(hdev);
4939
4940         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4941         if (conn == NULL)
4942                 goto not_found;
4943
4944         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
4945         if (!ltk)
4946                 goto not_found;
4947
4948         if (smp_ltk_is_sc(ltk)) {
4949                 /* With SC both EDiv and Rand are set to zero */
4950                 if (ev->ediv || ev->rand)
4951                         goto not_found;
4952         } else {
4953                 /* For non-SC keys check that EDiv and Rand match */
4954                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
4955                         goto not_found;
4956         }
4957
4958         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
4959         cp.handle = cpu_to_le16(conn->handle);
4960
4961         conn->pending_sec_level = smp_ltk_sec_level(ltk);
4962
4963         conn->enc_key_size = ltk->enc_size;
4964
4965         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4966
4967         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4968          * temporary key used to encrypt a connection following
4969          * pairing. It is used during the Encrypted Session Setup to
4970          * distribute the keys. Later, security can be re-established
4971          * using a distributed LTK.
4972          */
4973         if (ltk->type == SMP_STK) {
4974                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4975                 list_del_rcu(&ltk->list);
4976                 kfree_rcu(ltk, rcu);
4977         } else {
4978                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4979         }
4980
4981         hci_dev_unlock(hdev);
4982
4983         return;
4984
4985 not_found:
4986         neg.handle = ev->handle;
4987         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4988         hci_dev_unlock(hdev);
4989 }
4990
4991 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4992                                       u8 reason)
4993 {
4994         struct hci_cp_le_conn_param_req_neg_reply cp;
4995
4996         cp.handle = cpu_to_le16(handle);
4997         cp.reason = reason;
4998
4999         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5000                      &cp);
5001 }
5002
5003 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5004                                              struct sk_buff *skb)
5005 {
5006         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5007         struct hci_cp_le_conn_param_req_reply cp;
5008         struct hci_conn *hcon;
5009         u16 handle, min, max, latency, timeout;
5010
5011         handle = le16_to_cpu(ev->handle);
5012         min = le16_to_cpu(ev->interval_min);
5013         max = le16_to_cpu(ev->interval_max);
5014         latency = le16_to_cpu(ev->latency);
5015         timeout = le16_to_cpu(ev->timeout);
5016
5017         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5018         if (!hcon || hcon->state != BT_CONNECTED)
5019                 return send_conn_param_neg_reply(hdev, handle,
5020                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5021
5022         if (hci_check_conn_params(min, max, latency, timeout))
5023                 return send_conn_param_neg_reply(hdev, handle,
5024                                                  HCI_ERROR_INVALID_LL_PARAMS);
5025
5026         if (hcon->role == HCI_ROLE_MASTER) {
5027                 struct hci_conn_params *params;
5028                 u8 store_hint;
5029
5030                 hci_dev_lock(hdev);
5031
5032                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5033                                                 hcon->dst_type);
5034                 if (params) {
5035                         params->conn_min_interval = min;
5036                         params->conn_max_interval = max;
5037                         params->conn_latency = latency;
5038                         params->supervision_timeout = timeout;
5039                         store_hint = 0x01;
5040                 } else{
5041                         store_hint = 0x00;
5042                 }
5043
5044                 hci_dev_unlock(hdev);
5045
5046                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5047                                     store_hint, min, max, latency, timeout);
5048         }
5049
5050         cp.handle = ev->handle;
5051         cp.interval_min = ev->interval_min;
5052         cp.interval_max = ev->interval_max;
5053         cp.latency = ev->latency;
5054         cp.timeout = ev->timeout;
5055         cp.min_ce_len = 0;
5056         cp.max_ce_len = 0;
5057
5058         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5059 }
5060
5061 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5062                                          struct sk_buff *skb)
5063 {
5064         u8 num_reports = skb->data[0];
5065         void *ptr = &skb->data[1];
5066
5067         hci_dev_lock(hdev);
5068
5069         while (num_reports--) {
5070                 struct hci_ev_le_direct_adv_info *ev = ptr;
5071
5072                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5073                                    ev->bdaddr_type, &ev->direct_addr,
5074                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5075
5076                 ptr += sizeof(*ev);
5077         }
5078
5079         hci_dev_unlock(hdev);
5080 }
5081
5082 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5083 {
5084         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5085
5086         skb_pull(skb, sizeof(*le_ev));
5087
5088         switch (le_ev->subevent) {
5089         case HCI_EV_LE_CONN_COMPLETE:
5090                 hci_le_conn_complete_evt(hdev, skb);
5091                 break;
5092
5093         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5094                 hci_le_conn_update_complete_evt(hdev, skb);
5095                 break;
5096
5097         case HCI_EV_LE_ADVERTISING_REPORT:
5098                 hci_le_adv_report_evt(hdev, skb);
5099                 break;
5100
5101         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5102                 hci_le_remote_feat_complete_evt(hdev, skb);
5103                 break;
5104
5105         case HCI_EV_LE_LTK_REQ:
5106                 hci_le_ltk_request_evt(hdev, skb);
5107                 break;
5108
5109         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5110                 hci_le_remote_conn_param_req_evt(hdev, skb);
5111                 break;
5112
5113         case HCI_EV_LE_DIRECT_ADV_REPORT:
5114                 hci_le_direct_adv_report_evt(hdev, skb);
5115                 break;
5116
5117         default:
5118                 break;
5119         }
5120 }
5121
5122 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5123 {
5124         struct hci_ev_channel_selected *ev = (void *) skb->data;
5125         struct hci_conn *hcon;
5126
5127         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5128
5129         skb_pull(skb, sizeof(*ev));
5130
5131         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5132         if (!hcon)
5133                 return;
5134
5135         amp_read_loc_assoc_final_data(hdev, hcon);
5136 }
5137
5138 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5139                                  u8 event, struct sk_buff *skb)
5140 {
5141         struct hci_ev_cmd_complete *ev;
5142         struct hci_event_hdr *hdr;
5143
5144         if (!skb)
5145                 return false;
5146
5147         if (skb->len < sizeof(*hdr)) {
5148                 BT_ERR("Too short HCI event");
5149                 return false;
5150         }
5151
5152         hdr = (void *) skb->data;
5153         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5154
5155         if (event) {
5156                 if (hdr->evt != event)
5157                         return false;
5158                 return true;
5159         }
5160
5161         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5162                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5163                 return false;
5164         }
5165
5166         if (skb->len < sizeof(*ev)) {
5167                 BT_ERR("Too short cmd_complete event");
5168                 return false;
5169         }
5170
5171         ev = (void *) skb->data;
5172         skb_pull(skb, sizeof(*ev));
5173
5174         if (opcode != __le16_to_cpu(ev->opcode)) {
5175                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5176                        __le16_to_cpu(ev->opcode));
5177                 return false;
5178         }
5179
5180         return true;
5181 }
5182
5183 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5184 {
5185         struct hci_event_hdr *hdr = (void *) skb->data;
5186         hci_req_complete_t req_complete = NULL;
5187         hci_req_complete_skb_t req_complete_skb = NULL;
5188         struct sk_buff *orig_skb = NULL;
5189         u8 status = 0, event = hdr->evt, req_evt = 0;
5190         u16 opcode = HCI_OP_NOP;
5191
5192         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5193                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5194                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5195                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5196                                      &req_complete_skb);
5197                 req_evt = event;
5198         }
5199
5200         /* If it looks like we might end up having to call
5201          * req_complete_skb, store a pristine copy of the skb since the
5202          * various handlers may modify the original one through
5203          * skb_pull() calls, etc.
5204          */
5205         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5206             event == HCI_EV_CMD_COMPLETE)
5207                 orig_skb = skb_clone(skb, GFP_KERNEL);
5208
5209         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5210
5211         switch (event) {
5212         case HCI_EV_INQUIRY_COMPLETE:
5213                 hci_inquiry_complete_evt(hdev, skb);
5214                 break;
5215
5216         case HCI_EV_INQUIRY_RESULT:
5217                 hci_inquiry_result_evt(hdev, skb);
5218                 break;
5219
5220         case HCI_EV_CONN_COMPLETE:
5221                 hci_conn_complete_evt(hdev, skb);
5222                 break;
5223
5224         case HCI_EV_CONN_REQUEST:
5225                 hci_conn_request_evt(hdev, skb);
5226                 break;
5227
5228         case HCI_EV_DISCONN_COMPLETE:
5229                 hci_disconn_complete_evt(hdev, skb);
5230                 break;
5231
5232         case HCI_EV_AUTH_COMPLETE:
5233                 hci_auth_complete_evt(hdev, skb);
5234                 break;
5235
5236         case HCI_EV_REMOTE_NAME:
5237                 hci_remote_name_evt(hdev, skb);
5238                 break;
5239
5240         case HCI_EV_ENCRYPT_CHANGE:
5241                 hci_encrypt_change_evt(hdev, skb);
5242                 break;
5243
5244         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5245                 hci_change_link_key_complete_evt(hdev, skb);
5246                 break;
5247
5248         case HCI_EV_REMOTE_FEATURES:
5249                 hci_remote_features_evt(hdev, skb);
5250                 break;
5251
5252         case HCI_EV_CMD_COMPLETE:
5253                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5254                                      &req_complete, &req_complete_skb);
5255                 break;
5256
5257         case HCI_EV_CMD_STATUS:
5258                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5259                                    &req_complete_skb);
5260                 break;
5261
5262         case HCI_EV_HARDWARE_ERROR:
5263                 hci_hardware_error_evt(hdev, skb);
5264                 break;
5265
5266         case HCI_EV_ROLE_CHANGE:
5267                 hci_role_change_evt(hdev, skb);
5268                 break;
5269
5270         case HCI_EV_NUM_COMP_PKTS:
5271                 hci_num_comp_pkts_evt(hdev, skb);
5272                 break;
5273
5274         case HCI_EV_MODE_CHANGE:
5275                 hci_mode_change_evt(hdev, skb);
5276                 break;
5277
5278         case HCI_EV_PIN_CODE_REQ:
5279                 hci_pin_code_request_evt(hdev, skb);
5280                 break;
5281
5282         case HCI_EV_LINK_KEY_REQ:
5283                 hci_link_key_request_evt(hdev, skb);
5284                 break;
5285
5286         case HCI_EV_LINK_KEY_NOTIFY:
5287                 hci_link_key_notify_evt(hdev, skb);
5288                 break;
5289
5290         case HCI_EV_CLOCK_OFFSET:
5291                 hci_clock_offset_evt(hdev, skb);
5292                 break;
5293
5294         case HCI_EV_PKT_TYPE_CHANGE:
5295                 hci_pkt_type_change_evt(hdev, skb);
5296                 break;
5297
5298         case HCI_EV_PSCAN_REP_MODE:
5299                 hci_pscan_rep_mode_evt(hdev, skb);
5300                 break;
5301
5302         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5303                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5304                 break;
5305
5306         case HCI_EV_REMOTE_EXT_FEATURES:
5307                 hci_remote_ext_features_evt(hdev, skb);
5308                 break;
5309
5310         case HCI_EV_SYNC_CONN_COMPLETE:
5311                 hci_sync_conn_complete_evt(hdev, skb);
5312                 break;
5313
5314         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5315                 hci_extended_inquiry_result_evt(hdev, skb);
5316                 break;
5317
5318         case HCI_EV_KEY_REFRESH_COMPLETE:
5319                 hci_key_refresh_complete_evt(hdev, skb);
5320                 break;
5321
5322         case HCI_EV_IO_CAPA_REQUEST:
5323                 hci_io_capa_request_evt(hdev, skb);
5324                 break;
5325
5326         case HCI_EV_IO_CAPA_REPLY:
5327                 hci_io_capa_reply_evt(hdev, skb);
5328                 break;
5329
5330         case HCI_EV_USER_CONFIRM_REQUEST:
5331                 hci_user_confirm_request_evt(hdev, skb);
5332                 break;
5333
5334         case HCI_EV_USER_PASSKEY_REQUEST:
5335                 hci_user_passkey_request_evt(hdev, skb);
5336                 break;
5337
5338         case HCI_EV_USER_PASSKEY_NOTIFY:
5339                 hci_user_passkey_notify_evt(hdev, skb);
5340                 break;
5341
5342         case HCI_EV_KEYPRESS_NOTIFY:
5343                 hci_keypress_notify_evt(hdev, skb);
5344                 break;
5345
5346         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5347                 hci_simple_pair_complete_evt(hdev, skb);
5348                 break;
5349
5350         case HCI_EV_REMOTE_HOST_FEATURES:
5351                 hci_remote_host_features_evt(hdev, skb);
5352                 break;
5353
5354         case HCI_EV_LE_META:
5355                 hci_le_meta_evt(hdev, skb);
5356                 break;
5357
5358         case HCI_EV_CHANNEL_SELECTED:
5359                 hci_chan_selected_evt(hdev, skb);
5360                 break;
5361
5362         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5363                 hci_remote_oob_data_request_evt(hdev, skb);
5364                 break;
5365
5366         case HCI_EV_PHY_LINK_COMPLETE:
5367                 hci_phy_link_complete_evt(hdev, skb);
5368                 break;
5369
5370         case HCI_EV_LOGICAL_LINK_COMPLETE:
5371                 hci_loglink_complete_evt(hdev, skb);
5372                 break;
5373
5374         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5375                 hci_disconn_loglink_complete_evt(hdev, skb);
5376                 break;
5377
5378         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5379                 hci_disconn_phylink_complete_evt(hdev, skb);
5380                 break;
5381
5382         case HCI_EV_NUM_COMP_BLOCKS:
5383                 hci_num_comp_blocks_evt(hdev, skb);
5384                 break;
5385
5386         default:
5387                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5388                 break;
5389         }
5390
5391         if (req_complete) {
5392                 req_complete(hdev, status, opcode);
5393         } else if (req_complete_skb) {
5394                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5395                         kfree_skb(orig_skb);
5396                         orig_skb = NULL;
5397                 }
5398                 req_complete_skb(hdev, status, opcode, orig_skb);
5399         }
5400
5401         kfree_skb(orig_skb);
5402         kfree_skb(skb);
5403         hdev->stat.evt_rx++;
5404 }