net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         /* Set discovery state to stopped if we're not doing LE active
  59          * scanning.
  60          */
  61         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  62             hdev->le_scan_type != LE_SCAN_ACTIVE)
  63                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  64         hci_dev_unlock(hdev);
  65
  66         hci_conn_check_pending(hdev);
  67 }
  68
  69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  70 {
  71         __u8 status = *((__u8 *) skb->data);
  72
  73         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  74
  75         if (status)
  76                 return;
  77
  78         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  79 }
  80
  81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  82 {
  83         __u8 status = *((__u8 *) skb->data);
  84
  85         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  86
  87         if (status)
  88                 return;
  89
  90         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  91
  92         hci_conn_check_pending(hdev);
  93 }
  94
  95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  96                                           struct sk_buff *skb)
  97 {
  98         BT_DBG("%s", hdev->name);
  99 }
 100
 101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 102 {
 103         struct hci_rp_role_discovery *rp = (void *) skb->data;
 104         struct hci_conn *conn;
 105
 106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 107
 108         if (rp->status)
 109                 return;
 110
 111         hci_dev_lock(hdev);
 112
 113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 114         if (conn)
 115                 conn->role = rp->role;
 116
 117         hci_dev_unlock(hdev);
 118 }
 119
 120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 121 {
 122         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 123         struct hci_conn *conn;
 124
 125         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 126
 127         if (rp->status)
 128                 return;
 129
 130         hci_dev_lock(hdev);
 131
 132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 133         if (conn)
 134                 conn->link_policy = __le16_to_cpu(rp->policy);
 135
 136         hci_dev_unlock(hdev);
 137 }
 138
 139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 140 {
 141         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 142         struct hci_conn *conn;
 143         void *sent;
 144
 145         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 146
 147         if (rp->status)
 148                 return;
 149
 150         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 151         if (!sent)
 152                 return;
 153
 154         hci_dev_lock(hdev);
 155
 156         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 157         if (conn)
 158                 conn->link_policy = get_unaligned_le16(sent + 2);
 159
 160         hci_dev_unlock(hdev);
 161 }
 162
 163 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 164                                         struct sk_buff *skb)
 165 {
 166         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 167
 168         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 169
 170         if (rp->status)
 171                 return;
 172
 173         hdev->link_policy = __le16_to_cpu(rp->policy);
 174 }
 175
 176 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 177                                          struct sk_buff *skb)
 178 {
 179         __u8 status = *((__u8 *) skb->data);
 180         void *sent;
 181
 182         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 183
 184         if (status)
 185                 return;
 186
 187         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 188         if (!sent)
 189                 return;
 190
 191         hdev->link_policy = get_unaligned_le16(sent);
 192 }
 193
 194 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197
 198         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200         clear_bit(HCI_RESET, &hdev->flags);
 201
 202         if (status)
 203                 return;
 204
 205         /* Reset all non-persistent flags */
 206         hci_dev_clear_volatile_flags(hdev);
 207
 208         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 209
 210         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 211         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 212
 213         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 214         hdev->adv_data_len = 0;
 215
 216         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 217         hdev->scan_rsp_data_len = 0;
 218
 219         hdev->le_scan_type = LE_SCAN_PASSIVE;
 220
 221         hdev->ssp_debug_mode = 0;
 222
 223         hci_bdaddr_list_clear(&hdev->le_white_list);
 224         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 225 }
 226
 227 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 228                                         struct sk_buff *skb)
 229 {
 230         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 231         struct hci_cp_read_stored_link_key *sent;
 232
 233         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 234
 235         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 236         if (!sent)
 237                 return;
 238
 239         if (!rp->status && sent->read_all == 0x01) {
 240                 hdev->stored_max_keys = rp->max_keys;
 241                 hdev->stored_num_keys = rp->num_keys;
 242         }
 243 }
 244
 245 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 246                                           struct sk_buff *skb)
 247 {
 248         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 249
 250         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 251
 252         if (rp->status)
 253                 return;
 254
 255         if (rp->num_keys <= hdev->stored_num_keys)
 256                 hdev->stored_num_keys -= rp->num_keys;
 257         else
 258                 hdev->stored_num_keys = 0;
 259 }
 260
 261 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 262 {
 263         __u8 status = *((__u8 *) skb->data);
 264         void *sent;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 269         if (!sent)
 270                 return;
 271
 272         hci_dev_lock(hdev);
 273
 274         if (hci_dev_test_flag(hdev, HCI_MGMT))
 275                 mgmt_set_local_name_complete(hdev, sent, status);
 276         else if (!status)
 277                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 278
 279         hci_dev_unlock(hdev);
 280 }
 281
 282 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 283 {
 284         struct hci_rp_read_local_name *rp = (void *) skb->data;
 285
 286         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 287
 288         if (rp->status)
 289                 return;
 290
 291         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 292             hci_dev_test_flag(hdev, HCI_CONFIG))
 293                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 294 }
 295
 296 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 297 {
 298         __u8 status = *((__u8 *) skb->data);
 299         void *sent;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 302
 303         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 304         if (!sent)
 305                 return;
 306
 307         hci_dev_lock(hdev);
 308
 309         if (!status) {
 310                 __u8 param = *((__u8 *) sent);
 311
 312                 if (param == AUTH_ENABLED)
 313                         set_bit(HCI_AUTH, &hdev->flags);
 314                 else
 315                         clear_bit(HCI_AUTH, &hdev->flags);
 316         }
 317
 318         if (hci_dev_test_flag(hdev, HCI_MGMT))
 319                 mgmt_auth_enable_complete(hdev, status);
 320
 321         hci_dev_unlock(hdev);
 322 }
 323
 324 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 325 {
 326         __u8 status = *((__u8 *) skb->data);
 327         __u8 param;
 328         void *sent;
 329
 330         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 331
 332         if (status)
 333                 return;
 334
 335         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 336         if (!sent)
 337                 return;
 338
 339         param = *((__u8 *) sent);
 340
 341         if (param)
 342                 set_bit(HCI_ENCRYPT, &hdev->flags);
 343         else
 344                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 345 }
 346
 347 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 348 {
 349         __u8 status = *((__u8 *) skb->data);
 350         __u8 param;
 351         void *sent;
 352
 353         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 356         if (!sent)
 357                 return;
 358
 359         param = *((__u8 *) sent);
 360
 361         hci_dev_lock(hdev);
 362
 363         if (status) {
 364                 hdev->discov_timeout = 0;
 365                 goto done;
 366         }
 367
 368         if (param & SCAN_INQUIRY)
 369                 set_bit(HCI_ISCAN, &hdev->flags);
 370         else
 371                 clear_bit(HCI_ISCAN, &hdev->flags);
 372
 373         if (param & SCAN_PAGE)
 374                 set_bit(HCI_PSCAN, &hdev->flags);
 375         else
 376                 clear_bit(HCI_PSCAN, &hdev->flags);
 377
 378 done:
 379         hci_dev_unlock(hdev);
 380 }
 381
 382 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 383 {
 384         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 385
 386         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 387
 388         if (rp->status)
 389                 return;
 390
 391         memcpy(hdev->dev_class, rp->dev_class, 3);
 392
 393         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 394                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 395 }
 396
 397 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         __u8 status = *((__u8 *) skb->data);
 400         void *sent;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 403
 404         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 405         if (!sent)
 406                 return;
 407
 408         hci_dev_lock(hdev);
 409
 410         if (status == 0)
 411                 memcpy(hdev->dev_class, sent, 3);
 412
 413         if (hci_dev_test_flag(hdev, HCI_MGMT))
 414                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 415
 416         hci_dev_unlock(hdev);
 417 }
 418
 419 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 420 {
 421         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 422         __u16 setting;
 423
 424         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 425
 426         if (rp->status)
 427                 return;
 428
 429         setting = __le16_to_cpu(rp->voice_setting);
 430
 431         if (hdev->voice_setting == setting)
 432                 return;
 433
 434         hdev->voice_setting = setting;
 435
 436         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 437
 438         if (hdev->notify)
 439                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 440 }
 441
 442 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 443                                        struct sk_buff *skb)
 444 {
 445         __u8 status = *((__u8 *) skb->data);
 446         __u16 setting;
 447         void *sent;
 448
 449         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 450
 451         if (status)
 452                 return;
 453
 454         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 455         if (!sent)
 456                 return;
 457
 458         setting = get_unaligned_le16(sent);
 459
 460         if (hdev->voice_setting == setting)
 461                 return;
 462
 463         hdev->voice_setting = setting;
 464
 465         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 466
 467         if (hdev->notify)
 468                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 469 }
 470
 471 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 472                                           struct sk_buff *skb)
 473 {
 474         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 475
 476         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 477
 478         if (rp->status)
 479                 return;
 480
 481         hdev->num_iac = rp->num_iac;
 482
 483         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 484 }
 485
 486 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 487 {
 488         __u8 status = *((__u8 *) skb->data);
 489         struct hci_cp_write_ssp_mode *sent;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 492
 493         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 494         if (!sent)
 495                 return;
 496
 497         hci_dev_lock(hdev);
 498
 499         if (!status) {
 500                 if (sent->mode)
 501                         hdev->features[1][0] |= LMP_HOST_SSP;
 502                 else
 503                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 504         }
 505
 506         if (hci_dev_test_flag(hdev, HCI_MGMT))
 507                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 508         else if (!status) {
 509                 if (sent->mode)
 510                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 511                 else
 512                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 513         }
 514
 515         hci_dev_unlock(hdev);
 516 }
 517
 518 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 519 {
 520         u8 status = *((u8 *) skb->data);
 521         struct hci_cp_write_sc_support *sent;
 522
 523         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 524
 525         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 526         if (!sent)
 527                 return;
 528
 529         hci_dev_lock(hdev);
 530
 531         if (!status) {
 532                 if (sent->support)
 533                         hdev->features[1][0] |= LMP_HOST_SC;
 534                 else
 535                         hdev->features[1][0] &= ~LMP_HOST_SC;
 536         }
 537
 538         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 539                 if (sent->support)
 540                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 541                 else
 542                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 543         }
 544
 545         hci_dev_unlock(hdev);
 546 }
 547
 548 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 549 {
 550         struct hci_rp_read_local_version *rp = (void *) skb->data;
 551
 552         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 553
 554         if (rp->status)
 555                 return;
 556
 557         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 558             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 559                 hdev->hci_ver = rp->hci_ver;
 560                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 561                 hdev->lmp_ver = rp->lmp_ver;
 562                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 563                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 564         }
 565 }
 566
 567 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 568                                        struct sk_buff *skb)
 569 {
 570         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 571
 572         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 573
 574         if (rp->status)
 575                 return;
 576
 577         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 578             hci_dev_test_flag(hdev, HCI_CONFIG))
 579                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 580 }
 581
 582 static void hci_cc_read_local_features(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_features *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         memcpy(hdev->features, rp->features, 8);
 593
 594         /* Adjust default settings according to features
 595          * supported by device. */
 596
 597         if (hdev->features[0][0] & LMP_3SLOT)
 598                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 599
 600         if (hdev->features[0][0] & LMP_5SLOT)
 601                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 602
 603         if (hdev->features[0][1] & LMP_HV2) {
 604                 hdev->pkt_type  |= (HCI_HV2);
 605                 hdev->esco_type |= (ESCO_HV2);
 606         }
 607
 608         if (hdev->features[0][1] & LMP_HV3) {
 609                 hdev->pkt_type  |= (HCI_HV3);
 610                 hdev->esco_type |= (ESCO_HV3);
 611         }
 612
 613         if (lmp_esco_capable(hdev))
 614                 hdev->esco_type |= (ESCO_EV3);
 615
 616         if (hdev->features[0][4] & LMP_EV4)
 617                 hdev->esco_type |= (ESCO_EV4);
 618
 619         if (hdev->features[0][4] & LMP_EV5)
 620                 hdev->esco_type |= (ESCO_EV5);
 621
 622         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 623                 hdev->esco_type |= (ESCO_2EV3);
 624
 625         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 626                 hdev->esco_type |= (ESCO_3EV3);
 627
 628         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 629                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 630 }
 631
 632 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 633                                            struct sk_buff *skb)
 634 {
 635         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 636
 637         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 638
 639         if (rp->status)
 640                 return;
 641
 642         if (hdev->max_page < rp->max_page)
 643                 hdev->max_page = rp->max_page;
 644
 645         if (rp->page < HCI_MAX_PAGES)
 646                 memcpy(hdev->features[rp->page], rp->features, 8);
 647 }
 648
 649 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 650                                           struct sk_buff *skb)
 651 {
 652         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 653
 654         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 655
 656         if (rp->status)
 657                 return;
 658
 659         hdev->flow_ctl_mode = rp->mode;
 660 }
 661
 662 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 663 {
 664         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 665
 666         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 667
 668         if (rp->status)
 669                 return;
 670
 671         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 672         hdev->sco_mtu  = rp->sco_mtu;
 673         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 674         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 675
 676         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 677                 hdev->sco_mtu  = 64;
 678                 hdev->sco_pkts = 8;
 679         }
 680
 681         hdev->acl_cnt = hdev->acl_pkts;
 682         hdev->sco_cnt = hdev->sco_pkts;
 683
 684         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 685                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 686 }
 687
 688 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 689 {
 690         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 691
 692         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 693
 694         if (rp->status)
 695                 return;
 696
 697         if (test_bit(HCI_INIT, &hdev->flags))
 698                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 699
 700         if (hci_dev_test_flag(hdev, HCI_SETUP))
 701                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 702 }
 703
 704 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 705                                            struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         if (test_bit(HCI_INIT, &hdev->flags)) {
 715                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 716                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 717         }
 718 }
 719
 720 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 721                                             struct sk_buff *skb)
 722 {
 723         u8 status = *((u8 *) skb->data);
 724         struct hci_cp_write_page_scan_activity *sent;
 725
 726         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 727
 728         if (status)
 729                 return;
 730
 731         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 732         if (!sent)
 733                 return;
 734
 735         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 736         hdev->page_scan_window = __le16_to_cpu(sent->window);
 737 }
 738
 739 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 740                                            struct sk_buff *skb)
 741 {
 742         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 743
 744         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 745
 746         if (rp->status)
 747                 return;
 748
 749         if (test_bit(HCI_INIT, &hdev->flags))
 750                 hdev->page_scan_type = rp->type;
 751 }
 752
 753 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 754                                         struct sk_buff *skb)
 755 {
 756         u8 status = *((u8 *) skb->data);
 757         u8 *type;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 760
 761         if (status)
 762                 return;
 763
 764         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 765         if (type)
 766                 hdev->page_scan_type = *type;
 767 }
 768
 769 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 770                                         struct sk_buff *skb)
 771 {
 772         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 775
 776         if (rp->status)
 777                 return;
 778
 779         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 780         hdev->block_len = __le16_to_cpu(rp->block_len);
 781         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 782
 783         hdev->block_cnt = hdev->num_blocks;
 784
 785         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 786                hdev->block_cnt, hdev->block_len);
 787 }
 788
 789 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 790 {
 791         struct hci_rp_read_clock *rp = (void *) skb->data;
 792         struct hci_cp_read_clock *cp;
 793         struct hci_conn *conn;
 794
 795         BT_DBG("%s", hdev->name);
 796
 797         if (skb->len < sizeof(*rp))
 798                 return;
 799
 800         if (rp->status)
 801                 return;
 802
 803         hci_dev_lock(hdev);
 804
 805         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 806         if (!cp)
 807                 goto unlock;
 808
 809         if (cp->which == 0x00) {
 810                 hdev->clock = le32_to_cpu(rp->clock);
 811                 goto unlock;
 812         }
 813
 814         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 815         if (conn) {
 816                 conn->clock = le32_to_cpu(rp->clock);
 817                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 818         }
 819
 820 unlock:
 821         hci_dev_unlock(hdev);
 822 }
 823
 824 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 825                                        struct sk_buff *skb)
 826 {
 827         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 830
 831         if (rp->status)
 832                 return;
 833
 834         hdev->amp_status = rp->amp_status;
 835         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 836         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 837         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 838         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 839         hdev->amp_type = rp->amp_type;
 840         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 841         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 842         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 843         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 844 }
 845
 846 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 847                                          struct sk_buff *skb)
 848 {
 849         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 850
 851         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 852
 853         if (rp->status)
 854                 return;
 855
 856         hdev->inq_tx_power = rp->tx_power;
 857 }
 858
 859 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 860 {
 861         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 862         struct hci_cp_pin_code_reply *cp;
 863         struct hci_conn *conn;
 864
 865         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 866
 867         hci_dev_lock(hdev);
 868
 869         if (hci_dev_test_flag(hdev, HCI_MGMT))
 870                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 871
 872         if (rp->status)
 873                 goto unlock;
 874
 875         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 876         if (!cp)
 877                 goto unlock;
 878
 879         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 880         if (conn)
 881                 conn->pin_length = cp->pin_len;
 882
 883 unlock:
 884         hci_dev_unlock(hdev);
 885 }
 886
 887 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 888 {
 889         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 890
 891         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 892
 893         hci_dev_lock(hdev);
 894
 895         if (hci_dev_test_flag(hdev, HCI_MGMT))
 896                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 897                                                  rp->status);
 898
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 903                                        struct sk_buff *skb)
 904 {
 905         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 906
 907         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 908
 909         if (rp->status)
 910                 return;
 911
 912         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 913         hdev->le_pkts = rp->le_max_pkt;
 914
 915         hdev->le_cnt = hdev->le_pkts;
 916
 917         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 918 }
 919
 920 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 921                                           struct sk_buff *skb)
 922 {
 923         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 924
 925         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 926
 927         if (rp->status)
 928                 return;
 929
 930         memcpy(hdev->le_features, rp->features, 8);
 931 }
 932
 933 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 934                                         struct sk_buff *skb)
 935 {
 936         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 937
 938         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 939
 940         if (rp->status)
 941                 return;
 942
 943         hdev->adv_tx_power = rp->tx_power;
 944 }
 945
 946 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 947 {
 948         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 949
 950         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 951
 952         hci_dev_lock(hdev);
 953
 954         if (hci_dev_test_flag(hdev, HCI_MGMT))
 955                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 956                                                  rp->status);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 962                                           struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (hci_dev_test_flag(hdev, HCI_MGMT))
 971                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 972                                                      ACL_LINK, 0, rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (hci_dev_test_flag(hdev, HCI_MGMT))
 986                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 987                                                  0, rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 993                                           struct sk_buff *skb)
 994 {
 995         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 996
 997         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 998
 999         hci_dev_lock(hdev);
1000
1001         if (hci_dev_test_flag(hdev, HCI_MGMT))
1002                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1003                                                      ACL_LINK, 0, rp->status);
1004
1005         hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1009                                        struct sk_buff *skb)
1010 {
1011         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
1013         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1014 }
1015
1016 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1017                                            struct sk_buff *skb)
1018 {
1019         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022 }
1023
1024 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1025 {
1026         __u8 status = *((__u8 *) skb->data);
1027         bdaddr_t *sent;
1028
1029         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1030
1031         if (status)
1032                 return;
1033
1034         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1035         if (!sent)
1036                 return;
1037
1038         hci_dev_lock(hdev);
1039
1040         bacpy(&hdev->random_addr, sent);
1041
1042         hci_dev_unlock(hdev);
1043 }
1044
1045 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1046 {
1047         __u8 status = *((__u8 *) skb->data);
1048         struct hci_cp_le_set_default_phy *cp;
1049
1050         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1051
1052         if (status)
1053                 return;
1054
1055         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1056         if (!cp)
1057                 return;
1058
1059         hci_dev_lock(hdev);
1060
1061         hdev->le_tx_def_phys = cp->tx_phys;
1062         hdev->le_rx_def_phys = cp->rx_phys;
1063
1064         hci_dev_unlock(hdev);
1065 }
1066
1067 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1068                                               struct sk_buff *skb)
1069 {
1070         __u8 status = *((__u8 *) skb->data);
1071         struct hci_cp_le_set_adv_set_rand_addr *cp;
1072         struct adv_info *adv_instance;
1073
1074         if (status)
1075                 return;
1076
1077         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1078         if (!cp)
1079                 return;
1080
1081         hci_dev_lock(hdev);
1082
1083         if (!hdev->cur_adv_instance) {
1084                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1085                 bacpy(&hdev->random_addr, &cp->bdaddr);
1086         } else {
1087                 adv_instance = hci_find_adv_instance(hdev,
1088                                                      hdev->cur_adv_instance);
1089                 if (adv_instance)
1090                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1091         }
1092
1093         hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098         __u8 *sent, status = *((__u8 *) skb->data);
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1101
1102         if (status)
1103                 return;
1104
1105         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1106         if (!sent)
1107                 return;
1108
1109         hci_dev_lock(hdev);
1110
1111         /* If we're doing connection initiation as peripheral. Set a
1112          * timeout in case something goes wrong.
1113          */
1114         if (*sent) {
1115                 struct hci_conn *conn;
1116
1117                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1118
1119                 conn = hci_lookup_le_connect(hdev);
1120                 if (conn)
1121                         queue_delayed_work(hdev->workqueue,
1122                                            &conn->le_conn_timeout,
1123                                            conn->conn_timeout);
1124         } else {
1125                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1126         }
1127
1128         hci_dev_unlock(hdev);
1129 }
1130
1131 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1132                                          struct sk_buff *skb)
1133 {
1134         struct hci_cp_le_set_ext_adv_enable *cp;
1135         __u8 status = *((__u8 *) skb->data);
1136
1137         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1138
1139         if (status)
1140                 return;
1141
1142         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1143         if (!cp)
1144                 return;
1145
1146         hci_dev_lock(hdev);
1147
1148         if (cp->enable) {
1149                 struct hci_conn *conn;
1150
1151                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1152
1153                 conn = hci_lookup_le_connect(hdev);
1154                 if (conn)
1155                         queue_delayed_work(hdev->workqueue,
1156                                            &conn->le_conn_timeout,
1157                                            conn->conn_timeout);
1158         } else {
1159                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1160         }
1161
1162         hci_dev_unlock(hdev);
1163 }
1164
1165 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1166 {
1167         struct hci_cp_le_set_scan_param *cp;
1168         __u8 status = *((__u8 *) skb->data);
1169
1170         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1171
1172         if (status)
1173                 return;
1174
1175         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1176         if (!cp)
1177                 return;
1178
1179         hci_dev_lock(hdev);
1180
1181         hdev->le_scan_type = cp->type;
1182
1183         hci_dev_unlock(hdev);
1184 }
1185
1186 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1187                                          struct sk_buff *skb)
1188 {
1189         struct hci_cp_le_set_ext_scan_params *cp;
1190         __u8 status = *((__u8 *) skb->data);
1191         struct hci_cp_le_scan_phy_params *phy_param;
1192
1193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1194
1195         if (status)
1196                 return;
1197
1198         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1199         if (!cp)
1200                 return;
1201
1202         phy_param = (void *)cp->data;
1203
1204         hci_dev_lock(hdev);
1205
1206         hdev->le_scan_type = phy_param->type;
1207
1208         hci_dev_unlock(hdev);
1209 }
1210
1211 static bool has_pending_adv_report(struct hci_dev *hdev)
1212 {
1213         struct discovery_state *d = &hdev->discovery;
1214
1215         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1216 }
1217
1218 static void clear_pending_adv_report(struct hci_dev *hdev)
1219 {
1220         struct discovery_state *d = &hdev->discovery;
1221
1222         bacpy(&d->last_adv_addr, BDADDR_ANY);
1223         d->last_adv_data_len = 0;
1224 }
1225
1226 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1227                                      u8 bdaddr_type, s8 rssi, u32 flags,
1228                                      u8 *data, u8 len)
1229 {
1230         struct discovery_state *d = &hdev->discovery;
1231
1232         bacpy(&d->last_adv_addr, bdaddr);
1233         d->last_adv_addr_type = bdaddr_type;
1234         d->last_adv_rssi = rssi;
1235         d->last_adv_flags = flags;
1236         memcpy(d->last_adv_data, data, len);
1237         d->last_adv_data_len = len;
1238 }
1239
1240 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1241 {
1242         hci_dev_lock(hdev);
1243
1244         switch (enable) {
1245         case LE_SCAN_ENABLE:
1246                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1247                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1248                         clear_pending_adv_report(hdev);
1249                 break;
1250
1251         case LE_SCAN_DISABLE:
1252                 /* We do this here instead of when setting DISCOVERY_STOPPED
1253                  * since the latter would potentially require waiting for
1254                  * inquiry to stop too.
1255                  */
1256                 if (has_pending_adv_report(hdev)) {
1257                         struct discovery_state *d = &hdev->discovery;
1258
1259                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1260                                           d->last_adv_addr_type, NULL,
1261                                           d->last_adv_rssi, d->last_adv_flags,
1262                                           d->last_adv_data,
1263                                           d->last_adv_data_len, NULL, 0);
1264                 }
1265
1266                 /* Cancel this timer so that we don't try to disable scanning
1267                  * when it's already disabled.
1268                  */
1269                 cancel_delayed_work(&hdev->le_scan_disable);
1270
1271                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1272
1273                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1274                  * interrupted scanning due to a connect request. Mark
1275                  * therefore discovery as stopped. If this was not
1276                  * because of a connect request advertising might have
1277                  * been disabled because of active scanning, so
1278                  * re-enable it again if necessary.
1279                  */
1280                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1281                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1282                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1283                          hdev->discovery.state == DISCOVERY_FINDING)
1284                         hci_req_reenable_advertising(hdev);
1285
1286                 break;
1287
1288         default:
1289                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1290                            enable);
1291                 break;
1292         }
1293
1294         hci_dev_unlock(hdev);
1295 }
1296
1297 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1298                                       struct sk_buff *skb)
1299 {
1300         struct hci_cp_le_set_scan_enable *cp;
1301         __u8 status = *((__u8 *) skb->data);
1302
1303         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1304
1305         if (status)
1306                 return;
1307
1308         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1309         if (!cp)
1310                 return;
1311
1312         le_set_scan_enable_complete(hdev, cp->enable);
1313 }
1314
1315 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1316                                       struct sk_buff *skb)
1317 {
1318         struct hci_cp_le_set_ext_scan_enable *cp;
1319         __u8 status = *((__u8 *) skb->data);
1320
1321         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1322
1323         if (status)
1324                 return;
1325
1326         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1327         if (!cp)
1328                 return;
1329
1330         le_set_scan_enable_complete(hdev, cp->enable);
1331 }
1332
1333 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1334                                       struct sk_buff *skb)
1335 {
1336         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1337
1338         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1339                rp->num_of_sets);
1340
1341         if (rp->status)
1342                 return;
1343
1344         hdev->le_num_of_adv_sets = rp->num_of_sets;
1345 }
1346
1347 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1348                                            struct sk_buff *skb)
1349 {
1350         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1351
1352         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1353
1354         if (rp->status)
1355                 return;
1356
1357         hdev->le_white_list_size = rp->size;
1358 }
1359
1360 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1361                                        struct sk_buff *skb)
1362 {
1363         __u8 status = *((__u8 *) skb->data);
1364
1365         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1366
1367         if (status)
1368                 return;
1369
1370         hci_bdaddr_list_clear(&hdev->le_white_list);
1371 }
1372
1373 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1374                                         struct sk_buff *skb)
1375 {
1376         struct hci_cp_le_add_to_white_list *sent;
1377         __u8 status = *((__u8 *) skb->data);
1378
1379         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1380
1381         if (status)
1382                 return;
1383
1384         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1385         if (!sent)
1386                 return;
1387
1388         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1389                            sent->bdaddr_type);
1390 }
1391
1392 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1393                                           struct sk_buff *skb)
1394 {
1395         struct hci_cp_le_del_from_white_list *sent;
1396         __u8 status = *((__u8 *) skb->data);
1397
1398         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1399
1400         if (status)
1401                 return;
1402
1403         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1404         if (!sent)
1405                 return;
1406
1407         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1408                             sent->bdaddr_type);
1409 }
1410
1411 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1412                                             struct sk_buff *skb)
1413 {
1414         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1415
1416         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1417
1418         if (rp->status)
1419                 return;
1420
1421         memcpy(hdev->le_states, rp->le_states, 8);
1422 }
1423
1424 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1425                                         struct sk_buff *skb)
1426 {
1427         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1428
1429         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1430
1431         if (rp->status)
1432                 return;
1433
1434         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1435         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1436 }
1437
1438 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1439                                          struct sk_buff *skb)
1440 {
1441         struct hci_cp_le_write_def_data_len *sent;
1442         __u8 status = *((__u8 *) skb->data);
1443
1444         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1445
1446         if (status)
1447                 return;
1448
1449         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1450         if (!sent)
1451                 return;
1452
1453         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1454         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1455 }
1456
1457 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1458                                        struct sk_buff *skb)
1459 {
1460         __u8 status = *((__u8 *) skb->data);
1461
1462         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1463
1464         if (status)
1465                 return;
1466
1467         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1468 }
1469
1470 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1471                                            struct sk_buff *skb)
1472 {
1473         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1474
1475         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1476
1477         if (rp->status)
1478                 return;
1479
1480         hdev->le_resolv_list_size = rp->size;
1481 }
1482
1483 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1484                                                 struct sk_buff *skb)
1485 {
1486         __u8 *sent, status = *((__u8 *) skb->data);
1487
1488         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1489
1490         if (status)
1491                 return;
1492
1493         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1494         if (!sent)
1495                 return;
1496
1497         hci_dev_lock(hdev);
1498
1499         if (*sent)
1500                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1501         else
1502                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1503
1504         hci_dev_unlock(hdev);
1505 }
1506
1507 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1508                                         struct sk_buff *skb)
1509 {
1510         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1511
1512         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1513
1514         if (rp->status)
1515                 return;
1516
1517         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1518         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1519         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1520         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1521 }
1522
1523 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1524                                            struct sk_buff *skb)
1525 {
1526         struct hci_cp_write_le_host_supported *sent;
1527         __u8 status = *((__u8 *) skb->data);
1528
1529         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1530
1531         if (status)
1532                 return;
1533
1534         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1535         if (!sent)
1536                 return;
1537
1538         hci_dev_lock(hdev);
1539
1540         if (sent->le) {
1541                 hdev->features[1][0] |= LMP_HOST_LE;
1542                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1543         } else {
1544                 hdev->features[1][0] &= ~LMP_HOST_LE;
1545                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1546                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1547         }
1548
1549         if (sent->simul)
1550                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1551         else
1552                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1553
1554         hci_dev_unlock(hdev);
1555 }
1556
1557 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1558 {
1559         struct hci_cp_le_set_adv_param *cp;
1560         u8 status = *((u8 *) skb->data);
1561
1562         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1563
1564         if (status)
1565                 return;
1566
1567         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1568         if (!cp)
1569                 return;
1570
1571         hci_dev_lock(hdev);
1572         hdev->adv_addr_type = cp->own_address_type;
1573         hci_dev_unlock(hdev);
1574 }
1575
1576 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1577 {
1578         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1579         struct hci_cp_le_set_ext_adv_params *cp;
1580         struct adv_info *adv_instance;
1581
1582         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1583
1584         if (rp->status)
1585                 return;
1586
1587         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1588         if (!cp)
1589                 return;
1590
1591         hci_dev_lock(hdev);
1592         hdev->adv_addr_type = cp->own_addr_type;
1593         if (!hdev->cur_adv_instance) {
1594                 /* Store in hdev for instance 0 */
1595                 hdev->adv_tx_power = rp->tx_power;
1596         } else {
1597                 adv_instance = hci_find_adv_instance(hdev,
1598                                                      hdev->cur_adv_instance);
1599                 if (adv_instance)
1600                         adv_instance->tx_power = rp->tx_power;
1601         }
1602         /* Update adv data as tx power is known now */
1603         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1604         hci_dev_unlock(hdev);
1605 }
1606
1607 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1608 {
1609         struct hci_rp_read_rssi *rp = (void *) skb->data;
1610         struct hci_conn *conn;
1611
1612         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1613
1614         if (rp->status)
1615                 return;
1616
1617         hci_dev_lock(hdev);
1618
1619         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1620         if (conn)
1621                 conn->rssi = rp->rssi;
1622
1623         hci_dev_unlock(hdev);
1624 }
1625
1626 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1627 {
1628         struct hci_cp_read_tx_power *sent;
1629         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1630         struct hci_conn *conn;
1631
1632         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1633
1634         if (rp->status)
1635                 return;
1636
1637         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1638         if (!sent)
1639                 return;
1640
1641         hci_dev_lock(hdev);
1642
1643         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1644         if (!conn)
1645                 goto unlock;
1646
1647         switch (sent->type) {
1648         case 0x00:
1649                 conn->tx_power = rp->tx_power;
1650                 break;
1651         case 0x01:
1652                 conn->max_tx_power = rp->tx_power;
1653                 break;
1654         }
1655
1656 unlock:
1657         hci_dev_unlock(hdev);
1658 }
1659
1660 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1661 {
1662         u8 status = *((u8 *) skb->data);
1663         u8 *mode;
1664
1665         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1666
1667         if (status)
1668                 return;
1669
1670         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1671         if (mode)
1672                 hdev->ssp_debug_mode = *mode;
1673 }
1674
1675 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1676 {
1677         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1678
1679         if (status) {
1680                 hci_conn_check_pending(hdev);
1681                 return;
1682         }
1683
1684         set_bit(HCI_INQUIRY, &hdev->flags);
1685 }
1686
1687 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1688 {
1689         struct hci_cp_create_conn *cp;
1690         struct hci_conn *conn;
1691
1692         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1693
1694         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1695         if (!cp)
1696                 return;
1697
1698         hci_dev_lock(hdev);
1699
1700         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1701
1702         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1703
1704         if (status) {
1705                 if (conn && conn->state == BT_CONNECT) {
1706                         if (status != 0x0c || conn->attempt > 2) {
1707                                 conn->state = BT_CLOSED;
1708                                 hci_connect_cfm(conn, status);
1709                                 hci_conn_del(conn);
1710                         } else
1711                                 conn->state = BT_CONNECT2;
1712                 }
1713         } else {
1714                 if (!conn) {
1715                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1716                                             HCI_ROLE_MASTER);
1717                         if (!conn)
1718                                 bt_dev_err(hdev, "no memory for new connection");
1719                 }
1720         }
1721
1722         hci_dev_unlock(hdev);
1723 }
1724
1725 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1726 {
1727         struct hci_cp_add_sco *cp;
1728         struct hci_conn *acl, *sco;
1729         __u16 handle;
1730
1731         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1732
1733         if (!status)
1734                 return;
1735
1736         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1737         if (!cp)
1738                 return;
1739
1740         handle = __le16_to_cpu(cp->handle);
1741
1742         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1743
1744         hci_dev_lock(hdev);
1745
1746         acl = hci_conn_hash_lookup_handle(hdev, handle);
1747         if (acl) {
1748                 sco = acl->link;
1749                 if (sco) {
1750                         sco->state = BT_CLOSED;
1751
1752                         hci_connect_cfm(sco, status);
1753                         hci_conn_del(sco);
1754                 }
1755         }
1756
1757         hci_dev_unlock(hdev);
1758 }
1759
1760 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1761 {
1762         struct hci_cp_auth_requested *cp;
1763         struct hci_conn *conn;
1764
1765         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1766
1767         if (!status)
1768                 return;
1769
1770         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1771         if (!cp)
1772                 return;
1773
1774         hci_dev_lock(hdev);
1775
1776         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1777         if (conn) {
1778                 if (conn->state == BT_CONFIG) {
1779                         hci_connect_cfm(conn, status);
1780                         hci_conn_drop(conn);
1781                 }
1782         }
1783
1784         hci_dev_unlock(hdev);
1785 }
1786
1787 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1788 {
1789         struct hci_cp_set_conn_encrypt *cp;
1790         struct hci_conn *conn;
1791
1792         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1793
1794         if (!status)
1795                 return;
1796
1797         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1798         if (!cp)
1799                 return;
1800
1801         hci_dev_lock(hdev);
1802
1803         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1804         if (conn) {
1805                 if (conn->state == BT_CONFIG) {
1806                         hci_connect_cfm(conn, status);
1807                         hci_conn_drop(conn);
1808                 }
1809         }
1810
1811         hci_dev_unlock(hdev);
1812 }
1813
1814 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1815                                     struct hci_conn *conn)
1816 {
1817         if (conn->state != BT_CONFIG || !conn->out)
1818                 return 0;
1819
1820         if (conn->pending_sec_level == BT_SECURITY_SDP)
1821                 return 0;
1822
1823         /* Only request authentication for SSP connections or non-SSP
1824          * devices with sec_level MEDIUM or HIGH or if MITM protection
1825          * is requested.
1826          */
1827         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1828             conn->pending_sec_level != BT_SECURITY_FIPS &&
1829             conn->pending_sec_level != BT_SECURITY_HIGH &&
1830             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1831                 return 0;
1832
1833         return 1;
1834 }
1835
1836 static int hci_resolve_name(struct hci_dev *hdev,
1837                                    struct inquiry_entry *e)
1838 {
1839         struct hci_cp_remote_name_req cp;
1840
1841         memset(&cp, 0, sizeof(cp));
1842
1843         bacpy(&cp.bdaddr, &e->data.bdaddr);
1844         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1845         cp.pscan_mode = e->data.pscan_mode;
1846         cp.clock_offset = e->data.clock_offset;
1847
1848         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1849 }
1850
1851 static bool hci_resolve_next_name(struct hci_dev *hdev)
1852 {
1853         struct discovery_state *discov = &hdev->discovery;
1854         struct inquiry_entry *e;
1855
1856         if (list_empty(&discov->resolve))
1857                 return false;
1858
1859         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1860         if (!e)
1861                 return false;
1862
1863         if (hci_resolve_name(hdev, e) == 0) {
1864                 e->name_state = NAME_PENDING;
1865                 return true;
1866         }
1867
1868         return false;
1869 }
1870
1871 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1872                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1873 {
1874         struct discovery_state *discov = &hdev->discovery;
1875         struct inquiry_entry *e;
1876
1877         /* Update the mgmt connected state if necessary. Be careful with
1878          * conn objects that exist but are not (yet) connected however.
1879          * Only those in BT_CONFIG or BT_CONNECTED states can be
1880          * considered connected.
1881          */
1882         if (conn &&
1883             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1884             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1885                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1886
1887         if (discov->state == DISCOVERY_STOPPED)
1888                 return;
1889
1890         if (discov->state == DISCOVERY_STOPPING)
1891                 goto discov_complete;
1892
1893         if (discov->state != DISCOVERY_RESOLVING)
1894                 return;
1895
1896         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1897         /* If the device was not found in a list of found devices names of which
1898          * are pending. there is no need to continue resolving a next name as it
1899          * will be done upon receiving another Remote Name Request Complete
1900          * Event */
1901         if (!e)
1902                 return;
1903
1904         list_del(&e->list);
1905         if (name) {
1906                 e->name_state = NAME_KNOWN;
1907                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1908                                  e->data.rssi, name, name_len);
1909         } else {
1910                 e->name_state = NAME_NOT_KNOWN;
1911         }
1912
1913         if (hci_resolve_next_name(hdev))
1914                 return;
1915
1916 discov_complete:
1917         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1918 }
1919
1920 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1921 {
1922         struct hci_cp_remote_name_req *cp;
1923         struct hci_conn *conn;
1924
1925         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1926
1927         /* If successful wait for the name req complete event before
1928          * checking for the need to do authentication */
1929         if (!status)
1930                 return;
1931
1932         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1933         if (!cp)
1934                 return;
1935
1936         hci_dev_lock(hdev);
1937
1938         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1939
1940         if (hci_dev_test_flag(hdev, HCI_MGMT))
1941                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1942
1943         if (!conn)
1944                 goto unlock;
1945
1946         if (!hci_outgoing_auth_needed(hdev, conn))
1947                 goto unlock;
1948
1949         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1950                 struct hci_cp_auth_requested auth_cp;
1951
1952                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1953
1954                 auth_cp.handle = __cpu_to_le16(conn->handle);
1955                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1956                              sizeof(auth_cp), &auth_cp);
1957         }
1958
1959 unlock:
1960         hci_dev_unlock(hdev);
1961 }
1962
1963 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1964 {
1965         struct hci_cp_read_remote_features *cp;
1966         struct hci_conn *conn;
1967
1968         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1969
1970         if (!status)
1971                 return;
1972
1973         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1974         if (!cp)
1975                 return;
1976
1977         hci_dev_lock(hdev);
1978
1979         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1980         if (conn) {
1981                 if (conn->state == BT_CONFIG) {
1982                         hci_connect_cfm(conn, status);
1983                         hci_conn_drop(conn);
1984                 }
1985         }
1986
1987         hci_dev_unlock(hdev);
1988 }
1989
1990 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1991 {
1992         struct hci_cp_read_remote_ext_features *cp;
1993         struct hci_conn *conn;
1994
1995         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1996
1997         if (!status)
1998                 return;
1999
2000         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2001         if (!cp)
2002                 return;
2003
2004         hci_dev_lock(hdev);
2005
2006         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2007         if (conn) {
2008                 if (conn->state == BT_CONFIG) {
2009                         hci_connect_cfm(conn, status);
2010                         hci_conn_drop(conn);
2011                 }
2012         }
2013
2014         hci_dev_unlock(hdev);
2015 }
2016
2017 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2018 {
2019         struct hci_cp_setup_sync_conn *cp;
2020         struct hci_conn *acl, *sco;
2021         __u16 handle;
2022
2023         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2024
2025         if (!status)
2026                 return;
2027
2028         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2029         if (!cp)
2030                 return;
2031
2032         handle = __le16_to_cpu(cp->handle);
2033
2034         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2035
2036         hci_dev_lock(hdev);
2037
2038         acl = hci_conn_hash_lookup_handle(hdev, handle);
2039         if (acl) {
2040                 sco = acl->link;
2041                 if (sco) {
2042                         sco->state = BT_CLOSED;
2043
2044                         hci_connect_cfm(sco, status);
2045                         hci_conn_del(sco);
2046                 }
2047         }
2048
2049         hci_dev_unlock(hdev);
2050 }
2051
2052 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2053 {
2054         struct hci_cp_sniff_mode *cp;
2055         struct hci_conn *conn;
2056
2057         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2058
2059         if (!status)
2060                 return;
2061
2062         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2063         if (!cp)
2064                 return;
2065
2066         hci_dev_lock(hdev);
2067
2068         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2069         if (conn) {
2070                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2071
2072                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2073                         hci_sco_setup(conn, status);
2074         }
2075
2076         hci_dev_unlock(hdev);
2077 }
2078
2079 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2080 {
2081         struct hci_cp_exit_sniff_mode *cp;
2082         struct hci_conn *conn;
2083
2084         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2085
2086         if (!status)
2087                 return;
2088
2089         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2090         if (!cp)
2091                 return;
2092
2093         hci_dev_lock(hdev);
2094
2095         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2096         if (conn) {
2097                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2098
2099                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2100                         hci_sco_setup(conn, status);
2101         }
2102
2103         hci_dev_unlock(hdev);
2104 }
2105
2106 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2107 {
2108         struct hci_cp_disconnect *cp;
2109         struct hci_conn *conn;
2110
2111         if (!status)
2112                 return;
2113
2114         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2115         if (!cp)
2116                 return;
2117
2118         hci_dev_lock(hdev);
2119
2120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2121         if (conn)
2122                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2123                                        conn->dst_type, status);
2124
2125         hci_dev_unlock(hdev);
2126 }
2127
2128 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2129                               u8 peer_addr_type, u8 own_address_type,
2130                               u8 filter_policy)
2131 {
2132         struct hci_conn *conn;
2133
2134         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2135                                        peer_addr_type);
2136         if (!conn)
2137                 return;
2138
2139         /* Store the initiator and responder address information which
2140          * is needed for SMP. These values will not change during the
2141          * lifetime of the connection.
2142          */
2143         conn->init_addr_type = own_address_type;
2144         if (own_address_type == ADDR_LE_DEV_RANDOM)
2145                 bacpy(&conn->init_addr, &hdev->random_addr);
2146         else
2147                 bacpy(&conn->init_addr, &hdev->bdaddr);
2148
2149         conn->resp_addr_type = peer_addr_type;
2150         bacpy(&conn->resp_addr, peer_addr);
2151
2152         /* We don't want the connection attempt to stick around
2153          * indefinitely since LE doesn't have a page timeout concept
2154          * like BR/EDR. Set a timer for any connection that doesn't use
2155          * the white list for connecting.
2156          */
2157         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2158                 queue_delayed_work(conn->hdev->workqueue,
2159                                    &conn->le_conn_timeout,
2160                                    conn->conn_timeout);
2161 }
2162
2163 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2164 {
2165         struct hci_cp_le_create_conn *cp;
2166
2167         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2168
2169         /* All connection failure handling is taken care of by the
2170          * hci_le_conn_failed function which is triggered by the HCI
2171          * request completion callbacks used for connecting.
2172          */
2173         if (status)
2174                 return;
2175
2176         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2177         if (!cp)
2178                 return;
2179
2180         hci_dev_lock(hdev);
2181
2182         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2183                           cp->own_address_type, cp->filter_policy);
2184
2185         hci_dev_unlock(hdev);
2186 }
2187
2188 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2189 {
2190         struct hci_cp_le_ext_create_conn *cp;
2191
2192         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2193
2194         /* All connection failure handling is taken care of by the
2195          * hci_le_conn_failed function which is triggered by the HCI
2196          * request completion callbacks used for connecting.
2197          */
2198         if (status)
2199                 return;
2200
2201         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2202         if (!cp)
2203                 return;
2204
2205         hci_dev_lock(hdev);
2206
2207         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2208                           cp->own_addr_type, cp->filter_policy);
2209
2210         hci_dev_unlock(hdev);
2211 }
2212
2213 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2214 {
2215         struct hci_cp_le_read_remote_features *cp;
2216         struct hci_conn *conn;
2217
2218         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2219
2220         if (!status)
2221                 return;
2222
2223         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2224         if (!cp)
2225                 return;
2226
2227         hci_dev_lock(hdev);
2228
2229         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2230         if (conn) {
2231                 if (conn->state == BT_CONFIG) {
2232                         hci_connect_cfm(conn, status);
2233                         hci_conn_drop(conn);
2234                 }
2235         }
2236
2237         hci_dev_unlock(hdev);
2238 }
2239
2240 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2241 {
2242         struct hci_cp_le_start_enc *cp;
2243         struct hci_conn *conn;
2244
2245         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2246
2247         if (!status)
2248                 return;
2249
2250         hci_dev_lock(hdev);
2251
2252         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2253         if (!cp)
2254                 goto unlock;
2255
2256         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2257         if (!conn)
2258                 goto unlock;
2259
2260         if (conn->state != BT_CONNECTED)
2261                 goto unlock;
2262
2263         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2264         hci_conn_drop(conn);
2265
2266 unlock:
2267         hci_dev_unlock(hdev);
2268 }
2269
2270 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2271 {
2272         struct hci_cp_switch_role *cp;
2273         struct hci_conn *conn;
2274
2275         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2276
2277         if (!status)
2278                 return;
2279
2280         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2281         if (!cp)
2282                 return;
2283
2284         hci_dev_lock(hdev);
2285
2286         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2287         if (conn)
2288                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2289
2290         hci_dev_unlock(hdev);
2291 }
2292
2293 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2294 {
2295         __u8 status = *((__u8 *) skb->data);
2296         struct discovery_state *discov = &hdev->discovery;
2297         struct inquiry_entry *e;
2298
2299         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2300
2301         hci_conn_check_pending(hdev);
2302
2303         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2304                 return;
2305
2306         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2307         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2308
2309         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2310                 return;
2311
2312         hci_dev_lock(hdev);
2313
2314         if (discov->state != DISCOVERY_FINDING)
2315                 goto unlock;
2316
2317         if (list_empty(&discov->resolve)) {
2318                 /* When BR/EDR inquiry is active and no LE scanning is in
2319                  * progress, then change discovery state to indicate completion.
2320                  *
2321                  * When running LE scanning and BR/EDR inquiry simultaneously
2322                  * and the LE scan already finished, then change the discovery
2323                  * state to indicate completion.
2324                  */
2325                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2326                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2327                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2328                 goto unlock;
2329         }
2330
2331         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2332         if (e && hci_resolve_name(hdev, e) == 0) {
2333                 e->name_state = NAME_PENDING;
2334                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2335         } else {
2336                 /* When BR/EDR inquiry is active and no LE scanning is in
2337                  * progress, then change discovery state to indicate completion.
2338                  *
2339                  * When running LE scanning and BR/EDR inquiry simultaneously
2340                  * and the LE scan already finished, then change the discovery
2341                  * state to indicate completion.
2342                  */
2343                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2344                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2345                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2346         }
2347
2348 unlock:
2349         hci_dev_unlock(hdev);
2350 }
2351
2352 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2353 {
2354         struct inquiry_data data;
2355         struct inquiry_info *info = (void *) (skb->data + 1);
2356         int num_rsp = *((__u8 *) skb->data);
2357
2358         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2359
2360         if (!num_rsp)
2361                 return;
2362
2363         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2364                 return;
2365
2366         hci_dev_lock(hdev);
2367
2368         for (; num_rsp; num_rsp--, info++) {
2369                 u32 flags;
2370
2371                 bacpy(&data.bdaddr, &info->bdaddr);
2372                 data.pscan_rep_mode     = info->pscan_rep_mode;
2373                 data.pscan_period_mode  = info->pscan_period_mode;
2374                 data.pscan_mode         = info->pscan_mode;
2375                 memcpy(data.dev_class, info->dev_class, 3);
2376                 data.clock_offset       = info->clock_offset;
2377                 data.rssi               = HCI_RSSI_INVALID;
2378                 data.ssp_mode           = 0x00;
2379
2380                 flags = hci_inquiry_cache_update(hdev, &data, false);
2381
2382                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2383                                   info->dev_class, HCI_RSSI_INVALID,
2384                                   flags, NULL, 0, NULL, 0);
2385         }
2386
2387         hci_dev_unlock(hdev);
2388 }
2389
2390 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2391 {
2392         struct hci_ev_conn_complete *ev = (void *) skb->data;
2393         struct hci_conn *conn;
2394
2395         BT_DBG("%s", hdev->name);
2396
2397         hci_dev_lock(hdev);
2398
2399         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2400         if (!conn) {
2401                 if (ev->link_type != SCO_LINK)
2402                         goto unlock;
2403
2404                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2405                 if (!conn)
2406                         goto unlock;
2407
2408                 conn->type = SCO_LINK;
2409         }
2410
2411         if (!ev->status) {
2412                 conn->handle = __le16_to_cpu(ev->handle);
2413
2414                 if (conn->type == ACL_LINK) {
2415                         conn->state = BT_CONFIG;
2416                         hci_conn_hold(conn);
2417
2418                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2419                             !hci_find_link_key(hdev, &ev->bdaddr))
2420                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2421                         else
2422                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2423                 } else
2424                         conn->state = BT_CONNECTED;
2425
2426                 hci_debugfs_create_conn(conn);
2427                 hci_conn_add_sysfs(conn);
2428
2429                 if (test_bit(HCI_AUTH, &hdev->flags))
2430                         set_bit(HCI_CONN_AUTH, &conn->flags);
2431
2432                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2433                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2434
2435                 /* Get remote features */
2436                 if (conn->type == ACL_LINK) {
2437                         struct hci_cp_read_remote_features cp;
2438                         cp.handle = ev->handle;
2439                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2440                                      sizeof(cp), &cp);
2441
2442                         hci_req_update_scan(hdev);
2443                 }
2444
2445                 /* Set packet type for incoming connection */
2446                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2447                         struct hci_cp_change_conn_ptype cp;
2448                         cp.handle = ev->handle;
2449                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2450                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2451                                      &cp);
2452                 }
2453         } else {
2454                 conn->state = BT_CLOSED;
2455                 if (conn->type == ACL_LINK)
2456                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2457                                             conn->dst_type, ev->status);
2458         }
2459
2460         if (conn->type == ACL_LINK)
2461                 hci_sco_setup(conn, ev->status);
2462
2463         if (ev->status) {
2464                 hci_connect_cfm(conn, ev->status);
2465                 hci_conn_del(conn);
2466         } else if (ev->link_type != ACL_LINK)
2467                 hci_connect_cfm(conn, ev->status);
2468
2469 unlock:
2470         hci_dev_unlock(hdev);
2471
2472         hci_conn_check_pending(hdev);
2473 }
2474
2475 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2476 {
2477         struct hci_cp_reject_conn_req cp;
2478
2479         bacpy(&cp.bdaddr, bdaddr);
2480         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2481         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2482 }
2483
2484 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2485 {
2486         struct hci_ev_conn_request *ev = (void *) skb->data;
2487         int mask = hdev->link_mode;
2488         struct inquiry_entry *ie;
2489         struct hci_conn *conn;
2490         __u8 flags = 0;
2491
2492         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2493                ev->link_type);
2494
2495         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2496                                       &flags);
2497
2498         if (!(mask & HCI_LM_ACCEPT)) {
2499                 hci_reject_conn(hdev, &ev->bdaddr);
2500                 return;
2501         }
2502
2503         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2504                                    BDADDR_BREDR)) {
2505                 hci_reject_conn(hdev, &ev->bdaddr);
2506                 return;
2507         }
2508
2509         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2510          * connection. These features are only touched through mgmt so
2511          * only do the checks if HCI_MGMT is set.
2512          */
2513         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2514             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2515             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2516                                     BDADDR_BREDR)) {
2517                     hci_reject_conn(hdev, &ev->bdaddr);
2518                     return;
2519         }
2520
2521         /* Connection accepted */
2522
2523         hci_dev_lock(hdev);
2524
2525         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2526         if (ie)
2527                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2528
2529         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2530                         &ev->bdaddr);
2531         if (!conn) {
2532                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2533                                     HCI_ROLE_SLAVE);
2534                 if (!conn) {
2535                         bt_dev_err(hdev, "no memory for new connection");
2536                         hci_dev_unlock(hdev);
2537                         return;
2538                 }
2539         }
2540
2541         memcpy(conn->dev_class, ev->dev_class, 3);
2542
2543         hci_dev_unlock(hdev);
2544
2545         if (ev->link_type == ACL_LINK ||
2546             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2547                 struct hci_cp_accept_conn_req cp;
2548                 conn->state = BT_CONNECT;
2549
2550                 bacpy(&cp.bdaddr, &ev->bdaddr);
2551
2552                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2553                         cp.role = 0x00; /* Become master */
2554                 else
2555                         cp.role = 0x01; /* Remain slave */
2556
2557                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2558         } else if (!(flags & HCI_PROTO_DEFER)) {
2559                 struct hci_cp_accept_sync_conn_req cp;
2560                 conn->state = BT_CONNECT;
2561
2562                 bacpy(&cp.bdaddr, &ev->bdaddr);
2563                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2564
2565                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2566                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2567                 cp.max_latency    = cpu_to_le16(0xffff);
2568                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2569                 cp.retrans_effort = 0xff;
2570
2571                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2572                              &cp);
2573         } else {
2574                 conn->state = BT_CONNECT2;
2575                 hci_connect_cfm(conn, 0);
2576         }
2577 }
2578
2579 static u8 hci_to_mgmt_reason(u8 err)
2580 {
2581         switch (err) {
2582         case HCI_ERROR_CONNECTION_TIMEOUT:
2583                 return MGMT_DEV_DISCONN_TIMEOUT;
2584         case HCI_ERROR_REMOTE_USER_TERM:
2585         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2586         case HCI_ERROR_REMOTE_POWER_OFF:
2587                 return MGMT_DEV_DISCONN_REMOTE;
2588         case HCI_ERROR_LOCAL_HOST_TERM:
2589                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2590         default:
2591                 return MGMT_DEV_DISCONN_UNKNOWN;
2592         }
2593 }
2594
2595 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2596 {
2597         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2598         u8 reason;
2599         struct hci_conn_params *params;
2600         struct hci_conn *conn;
2601         bool mgmt_connected;
2602         u8 type;
2603
2604         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2605
2606         hci_dev_lock(hdev);
2607
2608         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2609         if (!conn)
2610                 goto unlock;
2611
2612         if (ev->status) {
2613                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2614                                        conn->dst_type, ev->status);
2615                 goto unlock;
2616         }
2617
2618         conn->state = BT_CLOSED;
2619
2620         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2621
2622         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2623                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2624         else
2625                 reason = hci_to_mgmt_reason(ev->reason);
2626
2627         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2628                                 reason, mgmt_connected);
2629
2630         if (conn->type == ACL_LINK) {
2631                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2632                         hci_remove_link_key(hdev, &conn->dst);
2633
2634                 hci_req_update_scan(hdev);
2635         }
2636
2637         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2638         if (params) {
2639                 switch (params->auto_connect) {
2640                 case HCI_AUTO_CONN_LINK_LOSS:
2641                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2642                                 break;
2643                         /* Fall through */
2644
2645                 case HCI_AUTO_CONN_DIRECT:
2646                 case HCI_AUTO_CONN_ALWAYS:
2647                         list_del_init(&params->action);
2648                         list_add(&params->action, &hdev->pend_le_conns);
2649                         hci_update_background_scan(hdev);
2650                         break;
2651
2652                 default:
2653                         break;
2654                 }
2655         }
2656
2657         type = conn->type;
2658
2659         hci_disconn_cfm(conn, ev->reason);
2660         hci_conn_del(conn);
2661
2662         /* Re-enable advertising if necessary, since it might
2663          * have been disabled by the connection. From the
2664          * HCI_LE_Set_Advertise_Enable command description in
2665          * the core specification (v4.0):
2666          * "The Controller shall continue advertising until the Host
2667          * issues an LE_Set_Advertise_Enable command with
2668          * Advertising_Enable set to 0x00 (Advertising is disabled)
2669          * or until a connection is created or until the Advertising
2670          * is timed out due to Directed Advertising."
2671          */
2672         if (type == LE_LINK)
2673                 hci_req_reenable_advertising(hdev);
2674
2675 unlock:
2676         hci_dev_unlock(hdev);
2677 }
2678
2679 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2680 {
2681         struct hci_ev_auth_complete *ev = (void *) skb->data;
2682         struct hci_conn *conn;
2683
2684         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2685
2686         hci_dev_lock(hdev);
2687
2688         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2689         if (!conn)
2690                 goto unlock;
2691
2692         if (!ev->status) {
2693                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2694
2695                 if (!hci_conn_ssp_enabled(conn) &&
2696                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2697                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2698                 } else {
2699                         set_bit(HCI_CONN_AUTH, &conn->flags);
2700                         conn->sec_level = conn->pending_sec_level;
2701                 }
2702         } else {
2703                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2704                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2705
2706                 mgmt_auth_failed(conn, ev->status);
2707         }
2708
2709         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2710         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2711
2712         if (conn->state == BT_CONFIG) {
2713                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2714                         struct hci_cp_set_conn_encrypt cp;
2715                         cp.handle  = ev->handle;
2716                         cp.encrypt = 0x01;
2717                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2718                                      &cp);
2719                 } else {
2720                         conn->state = BT_CONNECTED;
2721                         hci_connect_cfm(conn, ev->status);
2722                         hci_conn_drop(conn);
2723                 }
2724         } else {
2725                 hci_auth_cfm(conn, ev->status);
2726
2727                 hci_conn_hold(conn);
2728                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2729                 hci_conn_drop(conn);
2730         }
2731
2732         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2733                 if (!ev->status) {
2734                         struct hci_cp_set_conn_encrypt cp;
2735                         cp.handle  = ev->handle;
2736                         cp.encrypt = 0x01;
2737                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2738                                      &cp);
2739                 } else {
2740                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2741                         hci_encrypt_cfm(conn, ev->status, 0x00);
2742                 }
2743         }
2744
2745 unlock:
2746         hci_dev_unlock(hdev);
2747 }
2748
2749 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2750 {
2751         struct hci_ev_remote_name *ev = (void *) skb->data;
2752         struct hci_conn *conn;
2753
2754         BT_DBG("%s", hdev->name);
2755
2756         hci_conn_check_pending(hdev);
2757
2758         hci_dev_lock(hdev);
2759
2760         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2761
2762         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2763                 goto check_auth;
2764
2765         if (ev->status == 0)
2766                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2767                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2768         else
2769                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2770
2771 check_auth:
2772         if (!conn)
2773                 goto unlock;
2774
2775         if (!hci_outgoing_auth_needed(hdev, conn))
2776                 goto unlock;
2777
2778         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2779                 struct hci_cp_auth_requested cp;
2780
2781                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2782
2783                 cp.handle = __cpu_to_le16(conn->handle);
2784                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2785         }
2786
2787 unlock:
2788         hci_dev_unlock(hdev);
2789 }
2790
2791 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2792                                        u16 opcode, struct sk_buff *skb)
2793 {
2794         const struct hci_rp_read_enc_key_size *rp;
2795         struct hci_conn *conn;
2796         u16 handle;
2797
2798         BT_DBG("%s status 0x%02x", hdev->name, status);
2799
2800         if (!skb || skb->len < sizeof(*rp)) {
2801                 bt_dev_err(hdev, "invalid read key size response");
2802                 return;
2803         }
2804
2805         rp = (void *)skb->data;
2806         handle = le16_to_cpu(rp->handle);
2807
2808         hci_dev_lock(hdev);
2809
2810         conn = hci_conn_hash_lookup_handle(hdev, handle);
2811         if (!conn)
2812                 goto unlock;
2813
2814         /* If we fail to read the encryption key size, assume maximum
2815          * (which is the same we do also when this HCI command isn't
2816          * supported.
2817          */
2818         if (rp->status) {
2819                 bt_dev_err(hdev, "failed to read key size for handle %u",
2820                            handle);
2821                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2822         } else {
2823                 conn->enc_key_size = rp->key_size;
2824         }
2825
2826         if (conn->state == BT_CONFIG) {
2827                 conn->state = BT_CONNECTED;
2828                 hci_connect_cfm(conn, 0);
2829                 hci_conn_drop(conn);
2830         } else {
2831                 u8 encrypt;
2832
2833                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2834                         encrypt = 0x00;
2835                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2836                         encrypt = 0x02;
2837                 else
2838                         encrypt = 0x01;
2839
2840                 hci_encrypt_cfm(conn, 0, encrypt);
2841         }
2842
2843 unlock:
2844         hci_dev_unlock(hdev);
2845 }
2846
2847 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2848 {
2849         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2850         struct hci_conn *conn;
2851
2852         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2853
2854         hci_dev_lock(hdev);
2855
2856         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2857         if (!conn)
2858                 goto unlock;
2859
2860         if (!ev->status) {
2861                 if (ev->encrypt) {
2862                         /* Encryption implies authentication */
2863                         set_bit(HCI_CONN_AUTH, &conn->flags);
2864                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2865                         conn->sec_level = conn->pending_sec_level;
2866
2867                         /* P-256 authentication key implies FIPS */
2868                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2869                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2870
2871                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2872                             conn->type == LE_LINK)
2873                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2874                 } else {
2875                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2876                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2877                 }
2878         }
2879
2880         /* We should disregard the current RPA and generate a new one
2881          * whenever the encryption procedure fails.
2882          */
2883         if (ev->status && conn->type == LE_LINK) {
2884                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2885                 hci_adv_instances_set_rpa_expired(hdev, true);
2886         }
2887
2888         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2889
2890         if (ev->status && conn->state == BT_CONNECTED) {
2891                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2892                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2893
2894                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2895                 hci_conn_drop(conn);
2896                 goto unlock;
2897         }
2898
2899         /* In Secure Connections Only mode, do not allow any connections
2900          * that are not encrypted with AES-CCM using a P-256 authenticated
2901          * combination key.
2902          */
2903         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2904             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2905              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2906                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2907                 hci_conn_drop(conn);
2908                 goto unlock;
2909         }
2910
2911         /* Try reading the encryption key size for encrypted ACL links */
2912         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2913                 struct hci_cp_read_enc_key_size cp;
2914                 struct hci_request req;
2915
2916                 /* Only send HCI_Read_Encryption_Key_Size if the
2917                  * controller really supports it. If it doesn't, assume
2918                  * the default size (16).
2919                  */
2920                 if (!(hdev->commands[20] & 0x10)) {
2921                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2922                         goto notify;
2923                 }
2924
2925                 hci_req_init(&req, hdev);
2926
2927                 cp.handle = cpu_to_le16(conn->handle);
2928                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2929
2930                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2931                         bt_dev_err(hdev, "sending read key size failed");
2932                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2933                         goto notify;
2934                 }
2935
2936                 goto unlock;
2937         }
2938
2939 notify:
2940         if (conn->state == BT_CONFIG) {
2941                 if (!ev->status)
2942                         conn->state = BT_CONNECTED;
2943
2944                 hci_connect_cfm(conn, ev->status);
2945                 hci_conn_drop(conn);
2946         } else
2947                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2948
2949 unlock:
2950         hci_dev_unlock(hdev);
2951 }
2952
2953 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2954                                              struct sk_buff *skb)
2955 {
2956         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2957         struct hci_conn *conn;
2958
2959         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2960
2961         hci_dev_lock(hdev);
2962
2963         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2964         if (conn) {
2965                 if (!ev->status)
2966                         set_bit(HCI_CONN_SECURE, &conn->flags);
2967
2968                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2969
2970                 hci_key_change_cfm(conn, ev->status);
2971         }
2972
2973         hci_dev_unlock(hdev);
2974 }
2975
2976 static void hci_remote_features_evt(struct hci_dev *hdev,
2977                                     struct sk_buff *skb)
2978 {
2979         struct hci_ev_remote_features *ev = (void *) skb->data;
2980         struct hci_conn *conn;
2981
2982         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2983
2984         hci_dev_lock(hdev);
2985
2986         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2987         if (!conn)
2988                 goto unlock;
2989
2990         if (!ev->status)
2991                 memcpy(conn->features[0], ev->features, 8);
2992
2993         if (conn->state != BT_CONFIG)
2994                 goto unlock;
2995
2996         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2997             lmp_ext_feat_capable(conn)) {
2998                 struct hci_cp_read_remote_ext_features cp;
2999                 cp.handle = ev->handle;
3000                 cp.page = 0x01;
3001                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3002                              sizeof(cp), &cp);
3003                 goto unlock;
3004         }
3005
3006         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3007                 struct hci_cp_remote_name_req cp;
3008                 memset(&cp, 0, sizeof(cp));
3009                 bacpy(&cp.bdaddr, &conn->dst);
3010                 cp.pscan_rep_mode = 0x02;
3011                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3012         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3013                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3014
3015         if (!hci_outgoing_auth_needed(hdev, conn)) {
3016                 conn->state = BT_CONNECTED;
3017                 hci_connect_cfm(conn, ev->status);
3018                 hci_conn_drop(conn);
3019         }
3020
3021 unlock:
3022         hci_dev_unlock(hdev);
3023 }
3024
3025 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3026                                  u16 *opcode, u8 *status,
3027                                  hci_req_complete_t *req_complete,
3028                                  hci_req_complete_skb_t *req_complete_skb)
3029 {
3030         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3031
3032         *opcode = __le16_to_cpu(ev->opcode);
3033         *status = skb->data[sizeof(*ev)];
3034
3035         skb_pull(skb, sizeof(*ev));
3036
3037         switch (*opcode) {
3038         case HCI_OP_INQUIRY_CANCEL:
3039                 hci_cc_inquiry_cancel(hdev, skb);
3040                 break;
3041
3042         case HCI_OP_PERIODIC_INQ:
3043                 hci_cc_periodic_inq(hdev, skb);
3044                 break;
3045
3046         case HCI_OP_EXIT_PERIODIC_INQ:
3047                 hci_cc_exit_periodic_inq(hdev, skb);
3048                 break;
3049
3050         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3051                 hci_cc_remote_name_req_cancel(hdev, skb);
3052                 break;
3053
3054         case HCI_OP_ROLE_DISCOVERY:
3055                 hci_cc_role_discovery(hdev, skb);
3056                 break;
3057
3058         case HCI_OP_READ_LINK_POLICY:
3059                 hci_cc_read_link_policy(hdev, skb);
3060                 break;
3061
3062         case HCI_OP_WRITE_LINK_POLICY:
3063                 hci_cc_write_link_policy(hdev, skb);
3064                 break;
3065
3066         case HCI_OP_READ_DEF_LINK_POLICY:
3067                 hci_cc_read_def_link_policy(hdev, skb);
3068                 break;
3069
3070         case HCI_OP_WRITE_DEF_LINK_POLICY:
3071                 hci_cc_write_def_link_policy(hdev, skb);
3072                 break;
3073
3074         case HCI_OP_RESET:
3075                 hci_cc_reset(hdev, skb);
3076                 break;
3077
3078         case HCI_OP_READ_STORED_LINK_KEY:
3079                 hci_cc_read_stored_link_key(hdev, skb);
3080                 break;
3081
3082         case HCI_OP_DELETE_STORED_LINK_KEY:
3083                 hci_cc_delete_stored_link_key(hdev, skb);
3084                 break;
3085
3086         case HCI_OP_WRITE_LOCAL_NAME:
3087                 hci_cc_write_local_name(hdev, skb);
3088                 break;
3089
3090         case HCI_OP_READ_LOCAL_NAME:
3091                 hci_cc_read_local_name(hdev, skb);
3092                 break;
3093
3094         case HCI_OP_WRITE_AUTH_ENABLE:
3095                 hci_cc_write_auth_enable(hdev, skb);
3096                 break;
3097
3098         case HCI_OP_WRITE_ENCRYPT_MODE:
3099                 hci_cc_write_encrypt_mode(hdev, skb);
3100                 break;
3101
3102         case HCI_OP_WRITE_SCAN_ENABLE:
3103                 hci_cc_write_scan_enable(hdev, skb);
3104                 break;
3105
3106         case HCI_OP_READ_CLASS_OF_DEV:
3107                 hci_cc_read_class_of_dev(hdev, skb);
3108                 break;
3109
3110         case HCI_OP_WRITE_CLASS_OF_DEV:
3111                 hci_cc_write_class_of_dev(hdev, skb);
3112                 break;
3113
3114         case HCI_OP_READ_VOICE_SETTING:
3115                 hci_cc_read_voice_setting(hdev, skb);
3116                 break;
3117
3118         case HCI_OP_WRITE_VOICE_SETTING:
3119                 hci_cc_write_voice_setting(hdev, skb);
3120                 break;
3121
3122         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3123                 hci_cc_read_num_supported_iac(hdev, skb);
3124                 break;
3125
3126         case HCI_OP_WRITE_SSP_MODE:
3127                 hci_cc_write_ssp_mode(hdev, skb);
3128                 break;
3129
3130         case HCI_OP_WRITE_SC_SUPPORT:
3131                 hci_cc_write_sc_support(hdev, skb);
3132                 break;
3133
3134         case HCI_OP_READ_LOCAL_VERSION:
3135                 hci_cc_read_local_version(hdev, skb);
3136                 break;
3137
3138         case HCI_OP_READ_LOCAL_COMMANDS:
3139                 hci_cc_read_local_commands(hdev, skb);
3140                 break;
3141
3142         case HCI_OP_READ_LOCAL_FEATURES:
3143                 hci_cc_read_local_features(hdev, skb);
3144                 break;
3145
3146         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3147                 hci_cc_read_local_ext_features(hdev, skb);
3148                 break;
3149
3150         case HCI_OP_READ_BUFFER_SIZE:
3151                 hci_cc_read_buffer_size(hdev, skb);
3152                 break;
3153
3154         case HCI_OP_READ_BD_ADDR:
3155                 hci_cc_read_bd_addr(hdev, skb);
3156                 break;
3157
3158         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3159                 hci_cc_read_page_scan_activity(hdev, skb);
3160                 break;
3161
3162         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3163                 hci_cc_write_page_scan_activity(hdev, skb);
3164                 break;
3165
3166         case HCI_OP_READ_PAGE_SCAN_TYPE:
3167                 hci_cc_read_page_scan_type(hdev, skb);
3168                 break;
3169
3170         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3171                 hci_cc_write_page_scan_type(hdev, skb);
3172                 break;
3173
3174         case HCI_OP_READ_DATA_BLOCK_SIZE:
3175                 hci_cc_read_data_block_size(hdev, skb);
3176                 break;
3177
3178         case HCI_OP_READ_FLOW_CONTROL_MODE:
3179                 hci_cc_read_flow_control_mode(hdev, skb);
3180                 break;
3181
3182         case HCI_OP_READ_LOCAL_AMP_INFO:
3183                 hci_cc_read_local_amp_info(hdev, skb);
3184                 break;
3185
3186         case HCI_OP_READ_CLOCK:
3187                 hci_cc_read_clock(hdev, skb);
3188                 break;
3189
3190         case HCI_OP_READ_INQ_RSP_TX_POWER:
3191                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3192                 break;
3193
3194         case HCI_OP_PIN_CODE_REPLY:
3195                 hci_cc_pin_code_reply(hdev, skb);
3196                 break;
3197
3198         case HCI_OP_PIN_CODE_NEG_REPLY:
3199                 hci_cc_pin_code_neg_reply(hdev, skb);
3200                 break;
3201
3202         case HCI_OP_READ_LOCAL_OOB_DATA:
3203                 hci_cc_read_local_oob_data(hdev, skb);
3204                 break;
3205
3206         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3207                 hci_cc_read_local_oob_ext_data(hdev, skb);
3208                 break;
3209
3210         case HCI_OP_LE_READ_BUFFER_SIZE:
3211                 hci_cc_le_read_buffer_size(hdev, skb);
3212                 break;
3213
3214         case HCI_OP_LE_READ_LOCAL_FEATURES:
3215                 hci_cc_le_read_local_features(hdev, skb);
3216                 break;
3217
3218         case HCI_OP_LE_READ_ADV_TX_POWER:
3219                 hci_cc_le_read_adv_tx_power(hdev, skb);
3220                 break;
3221
3222         case HCI_OP_USER_CONFIRM_REPLY:
3223                 hci_cc_user_confirm_reply(hdev, skb);
3224                 break;
3225
3226         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3227                 hci_cc_user_confirm_neg_reply(hdev, skb);
3228                 break;
3229
3230         case HCI_OP_USER_PASSKEY_REPLY:
3231                 hci_cc_user_passkey_reply(hdev, skb);
3232                 break;
3233
3234         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3235                 hci_cc_user_passkey_neg_reply(hdev, skb);
3236                 break;
3237
3238         case HCI_OP_LE_SET_RANDOM_ADDR:
3239                 hci_cc_le_set_random_addr(hdev, skb);
3240                 break;
3241
3242         case HCI_OP_LE_SET_ADV_ENABLE:
3243                 hci_cc_le_set_adv_enable(hdev, skb);
3244                 break;
3245
3246         case HCI_OP_LE_SET_SCAN_PARAM:
3247                 hci_cc_le_set_scan_param(hdev, skb);
3248                 break;
3249
3250         case HCI_OP_LE_SET_SCAN_ENABLE:
3251                 hci_cc_le_set_scan_enable(hdev, skb);
3252                 break;
3253
3254         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3255                 hci_cc_le_read_white_list_size(hdev, skb);
3256                 break;
3257
3258         case HCI_OP_LE_CLEAR_WHITE_LIST:
3259                 hci_cc_le_clear_white_list(hdev, skb);
3260                 break;
3261
3262         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3263                 hci_cc_le_add_to_white_list(hdev, skb);
3264                 break;
3265
3266         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3267                 hci_cc_le_del_from_white_list(hdev, skb);
3268                 break;
3269
3270         case HCI_OP_LE_READ_SUPPORTED_STATES:
3271                 hci_cc_le_read_supported_states(hdev, skb);
3272                 break;
3273
3274         case HCI_OP_LE_READ_DEF_DATA_LEN:
3275                 hci_cc_le_read_def_data_len(hdev, skb);
3276                 break;
3277
3278         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3279                 hci_cc_le_write_def_data_len(hdev, skb);
3280                 break;
3281
3282         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3283                 hci_cc_le_clear_resolv_list(hdev, skb);
3284                 break;
3285
3286         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3287                 hci_cc_le_read_resolv_list_size(hdev, skb);
3288                 break;
3289
3290         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3291                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3292                 break;
3293
3294         case HCI_OP_LE_READ_MAX_DATA_LEN:
3295                 hci_cc_le_read_max_data_len(hdev, skb);
3296                 break;
3297
3298         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3299                 hci_cc_write_le_host_supported(hdev, skb);
3300                 break;
3301
3302         case HCI_OP_LE_SET_ADV_PARAM:
3303                 hci_cc_set_adv_param(hdev, skb);
3304                 break;
3305
3306         case HCI_OP_READ_RSSI:
3307                 hci_cc_read_rssi(hdev, skb);
3308                 break;
3309
3310         case HCI_OP_READ_TX_POWER:
3311                 hci_cc_read_tx_power(hdev, skb);
3312                 break;
3313
3314         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3315                 hci_cc_write_ssp_debug_mode(hdev, skb);
3316                 break;
3317
3318         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3319                 hci_cc_le_set_ext_scan_param(hdev, skb);
3320                 break;
3321
3322         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3323                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3324                 break;
3325
3326         case HCI_OP_LE_SET_DEFAULT_PHY:
3327                 hci_cc_le_set_default_phy(hdev, skb);
3328                 break;
3329
3330         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3331                 hci_cc_le_read_num_adv_sets(hdev, skb);
3332                 break;
3333
3334         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3335                 hci_cc_set_ext_adv_param(hdev, skb);
3336                 break;
3337
3338         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3339                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3340                 break;
3341
3342         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3343                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3344                 break;
3345
3346         default:
3347                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3348                 break;
3349         }
3350
3351         if (*opcode != HCI_OP_NOP)
3352                 cancel_delayed_work(&hdev->cmd_timer);
3353
3354         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3355                 atomic_set(&hdev->cmd_cnt, 1);
3356
3357         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3358                              req_complete_skb);
3359
3360         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3361                 bt_dev_err(hdev,
3362                            "unexpected event for opcode 0x%4.4x", *opcode);
3363                 return;
3364         }
3365
3366         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3367                 queue_work(hdev->workqueue, &hdev->cmd_work);
3368 }
3369
3370 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3371                                u16 *opcode, u8 *status,
3372                                hci_req_complete_t *req_complete,
3373                                hci_req_complete_skb_t *req_complete_skb)
3374 {
3375         struct hci_ev_cmd_status *ev = (void *) skb->data;
3376
3377         skb_pull(skb, sizeof(*ev));
3378
3379         *opcode = __le16_to_cpu(ev->opcode);
3380         *status = ev->status;
3381
3382         switch (*opcode) {
3383         case HCI_OP_INQUIRY:
3384                 hci_cs_inquiry(hdev, ev->status);
3385                 break;
3386
3387         case HCI_OP_CREATE_CONN:
3388                 hci_cs_create_conn(hdev, ev->status);
3389                 break;
3390
3391         case HCI_OP_DISCONNECT:
3392                 hci_cs_disconnect(hdev, ev->status);
3393                 break;
3394
3395         case HCI_OP_ADD_SCO:
3396                 hci_cs_add_sco(hdev, ev->status);
3397                 break;
3398
3399         case HCI_OP_AUTH_REQUESTED:
3400                 hci_cs_auth_requested(hdev, ev->status);
3401                 break;
3402
3403         case HCI_OP_SET_CONN_ENCRYPT:
3404                 hci_cs_set_conn_encrypt(hdev, ev->status);
3405                 break;
3406
3407         case HCI_OP_REMOTE_NAME_REQ:
3408                 hci_cs_remote_name_req(hdev, ev->status);
3409                 break;
3410
3411         case HCI_OP_READ_REMOTE_FEATURES:
3412                 hci_cs_read_remote_features(hdev, ev->status);
3413                 break;
3414
3415         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3416                 hci_cs_read_remote_ext_features(hdev, ev->status);
3417                 break;
3418
3419         case HCI_OP_SETUP_SYNC_CONN:
3420                 hci_cs_setup_sync_conn(hdev, ev->status);
3421                 break;
3422
3423         case HCI_OP_SNIFF_MODE:
3424                 hci_cs_sniff_mode(hdev, ev->status);
3425                 break;
3426
3427         case HCI_OP_EXIT_SNIFF_MODE:
3428                 hci_cs_exit_sniff_mode(hdev, ev->status);
3429                 break;
3430
3431         case HCI_OP_SWITCH_ROLE:
3432                 hci_cs_switch_role(hdev, ev->status);
3433                 break;
3434
3435         case HCI_OP_LE_CREATE_CONN:
3436                 hci_cs_le_create_conn(hdev, ev->status);
3437                 break;
3438
3439         case HCI_OP_LE_READ_REMOTE_FEATURES:
3440                 hci_cs_le_read_remote_features(hdev, ev->status);
3441                 break;
3442
3443         case HCI_OP_LE_START_ENC:
3444                 hci_cs_le_start_enc(hdev, ev->status);
3445                 break;
3446
3447         case HCI_OP_LE_EXT_CREATE_CONN:
3448                 hci_cs_le_ext_create_conn(hdev, ev->status);
3449                 break;
3450
3451         default:
3452                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3453                 break;
3454         }
3455
3456         if (*opcode != HCI_OP_NOP)
3457                 cancel_delayed_work(&hdev->cmd_timer);
3458
3459         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3460                 atomic_set(&hdev->cmd_cnt, 1);
3461
3462         /* Indicate request completion if the command failed. Also, if
3463          * we're not waiting for a special event and we get a success
3464          * command status we should try to flag the request as completed
3465          * (since for this kind of commands there will not be a command
3466          * complete event).
3467          */
3468         if (ev->status ||
3469             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3470                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3471                                      req_complete_skb);
3472
3473         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3474                 bt_dev_err(hdev,
3475                            "unexpected event for opcode 0x%4.4x", *opcode);
3476                 return;
3477         }
3478
3479         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3480                 queue_work(hdev->workqueue, &hdev->cmd_work);
3481 }
3482
3483 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3484 {
3485         struct hci_ev_hardware_error *ev = (void *) skb->data;
3486
3487         hdev->hw_error_code = ev->code;
3488
3489         queue_work(hdev->req_workqueue, &hdev->error_reset);
3490 }
3491
3492 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3493 {
3494         struct hci_ev_role_change *ev = (void *) skb->data;
3495         struct hci_conn *conn;
3496
3497         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3498
3499         hci_dev_lock(hdev);
3500
3501         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3502         if (conn) {
3503                 if (!ev->status)
3504                         conn->role = ev->role;
3505
3506                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3507
3508                 hci_role_switch_cfm(conn, ev->status, ev->role);
3509         }
3510
3511         hci_dev_unlock(hdev);
3512 }
3513
3514 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3515 {
3516         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3517         int i;
3518
3519         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3520                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3521                 return;
3522         }
3523
3524         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3525             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3526                 BT_DBG("%s bad parameters", hdev->name);
3527                 return;
3528         }
3529
3530         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3531
3532         for (i = 0; i < ev->num_hndl; i++) {
3533                 struct hci_comp_pkts_info *info = &ev->handles[i];
3534                 struct hci_conn *conn;
3535                 __u16  handle, count;
3536
3537                 handle = __le16_to_cpu(info->handle);
3538                 count  = __le16_to_cpu(info->count);
3539
3540                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3541                 if (!conn)
3542                         continue;
3543
3544                 conn->sent -= count;
3545
3546                 switch (conn->type) {
3547                 case ACL_LINK:
3548                         hdev->acl_cnt += count;
3549                         if (hdev->acl_cnt > hdev->acl_pkts)
3550                                 hdev->acl_cnt = hdev->acl_pkts;
3551                         break;
3552
3553                 case LE_LINK:
3554                         if (hdev->le_pkts) {
3555                                 hdev->le_cnt += count;
3556                                 if (hdev->le_cnt > hdev->le_pkts)
3557                                         hdev->le_cnt = hdev->le_pkts;
3558                         } else {
3559                                 hdev->acl_cnt += count;
3560                                 if (hdev->acl_cnt > hdev->acl_pkts)
3561                                         hdev->acl_cnt = hdev->acl_pkts;
3562                         }
3563                         break;
3564
3565                 case SCO_LINK:
3566                         hdev->sco_cnt += count;
3567                         if (hdev->sco_cnt > hdev->sco_pkts)
3568                                 hdev->sco_cnt = hdev->sco_pkts;
3569                         break;
3570
3571                 default:
3572                         bt_dev_err(hdev, "unknown type %d conn %p",
3573                                    conn->type, conn);
3574                         break;
3575                 }
3576         }
3577
3578         queue_work(hdev->workqueue, &hdev->tx_work);
3579 }
3580
3581 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3582                                                  __u16 handle)
3583 {
3584         struct hci_chan *chan;
3585
3586         switch (hdev->dev_type) {
3587         case HCI_PRIMARY:
3588                 return hci_conn_hash_lookup_handle(hdev, handle);
3589         case HCI_AMP:
3590                 chan = hci_chan_lookup_handle(hdev, handle);
3591                 if (chan)
3592                         return chan->conn;
3593                 break;
3594         default:
3595                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3596                 break;
3597         }
3598
3599         return NULL;
3600 }
3601
3602 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3603 {
3604         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3605         int i;
3606
3607         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3608                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3609                 return;
3610         }
3611
3612         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3613             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3614                 BT_DBG("%s bad parameters", hdev->name);
3615                 return;
3616         }
3617
3618         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3619                ev->num_hndl);
3620
3621         for (i = 0; i < ev->num_hndl; i++) {
3622                 struct hci_comp_blocks_info *info = &ev->handles[i];
3623                 struct hci_conn *conn = NULL;
3624                 __u16  handle, block_count;
3625
3626                 handle = __le16_to_cpu(info->handle);
3627                 block_count = __le16_to_cpu(info->blocks);
3628
3629                 conn = __hci_conn_lookup_handle(hdev, handle);
3630                 if (!conn)
3631                         continue;
3632
3633                 conn->sent -= block_count;
3634
3635                 switch (conn->type) {
3636                 case ACL_LINK:
3637                 case AMP_LINK:
3638                         hdev->block_cnt += block_count;
3639                         if (hdev->block_cnt > hdev->num_blocks)
3640                                 hdev->block_cnt = hdev->num_blocks;
3641                         break;
3642
3643                 default:
3644                         bt_dev_err(hdev, "unknown type %d conn %p",
3645                                    conn->type, conn);
3646                         break;
3647                 }
3648         }
3649
3650         queue_work(hdev->workqueue, &hdev->tx_work);
3651 }
3652
3653 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3654 {
3655         struct hci_ev_mode_change *ev = (void *) skb->data;
3656         struct hci_conn *conn;
3657
3658         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3659
3660         hci_dev_lock(hdev);
3661
3662         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3663         if (conn) {
3664                 conn->mode = ev->mode;
3665
3666                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3667                                         &conn->flags)) {
3668                         if (conn->mode == HCI_CM_ACTIVE)
3669                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3670                         else
3671                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3672                 }
3673
3674                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3675                         hci_sco_setup(conn, ev->status);
3676         }
3677
3678         hci_dev_unlock(hdev);
3679 }
3680
3681 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3682 {
3683         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3684         struct hci_conn *conn;
3685
3686         BT_DBG("%s", hdev->name);
3687
3688         hci_dev_lock(hdev);
3689
3690         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3691         if (!conn)
3692                 goto unlock;
3693
3694         if (conn->state == BT_CONNECTED) {
3695                 hci_conn_hold(conn);
3696                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3697                 hci_conn_drop(conn);
3698         }
3699
3700         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3701             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3702                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3703                              sizeof(ev->bdaddr), &ev->bdaddr);
3704         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3705                 u8 secure;
3706
3707                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3708                         secure = 1;
3709                 else
3710                         secure = 0;
3711
3712                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3713         }
3714
3715 unlock:
3716         hci_dev_unlock(hdev);
3717 }
3718
3719 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3720 {
3721         if (key_type == HCI_LK_CHANGED_COMBINATION)
3722                 return;
3723
3724         conn->pin_length = pin_len;
3725         conn->key_type = key_type;
3726
3727         switch (key_type) {
3728         case HCI_LK_LOCAL_UNIT:
3729         case HCI_LK_REMOTE_UNIT:
3730         case HCI_LK_DEBUG_COMBINATION:
3731                 return;
3732         case HCI_LK_COMBINATION:
3733                 if (pin_len == 16)
3734                         conn->pending_sec_level = BT_SECURITY_HIGH;
3735                 else
3736                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3737                 break;
3738         case HCI_LK_UNAUTH_COMBINATION_P192:
3739         case HCI_LK_UNAUTH_COMBINATION_P256:
3740                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3741                 break;
3742         case HCI_LK_AUTH_COMBINATION_P192:
3743                 conn->pending_sec_level = BT_SECURITY_HIGH;
3744                 break;
3745         case HCI_LK_AUTH_COMBINATION_P256:
3746                 conn->pending_sec_level = BT_SECURITY_FIPS;
3747                 break;
3748         }
3749 }
3750
3751 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3752 {
3753         struct hci_ev_link_key_req *ev = (void *) skb->data;
3754         struct hci_cp_link_key_reply cp;
3755         struct hci_conn *conn;
3756         struct link_key *key;
3757
3758         BT_DBG("%s", hdev->name);
3759
3760         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3761                 return;
3762
3763         hci_dev_lock(hdev);
3764
3765         key = hci_find_link_key(hdev, &ev->bdaddr);
3766         if (!key) {
3767                 BT_DBG("%s link key not found for %pMR", hdev->name,
3768                        &ev->bdaddr);
3769                 goto not_found;
3770         }
3771
3772         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3773                &ev->bdaddr);
3774
3775         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3776         if (conn) {
3777                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3778
3779                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3780                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3781                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3782                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3783                         goto not_found;
3784                 }
3785
3786                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3787                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3788                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3789                         BT_DBG("%s ignoring key unauthenticated for high security",
3790                                hdev->name);
3791                         goto not_found;
3792                 }
3793
3794                 conn_set_key(conn, key->type, key->pin_len);
3795         }
3796
3797         bacpy(&cp.bdaddr, &ev->bdaddr);
3798         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3799
3800         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3801
3802         hci_dev_unlock(hdev);
3803
3804         return;
3805
3806 not_found:
3807         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3808         hci_dev_unlock(hdev);
3809 }
3810
3811 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3812 {
3813         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3814         struct hci_conn *conn;
3815         struct link_key *key;
3816         bool persistent;
3817         u8 pin_len = 0;
3818
3819         BT_DBG("%s", hdev->name);
3820
3821         hci_dev_lock(hdev);
3822
3823         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3824         if (!conn)
3825                 goto unlock;
3826
3827         hci_conn_hold(conn);
3828         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3829         hci_conn_drop(conn);
3830
3831         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3832         conn_set_key(conn, ev->key_type, conn->pin_length);
3833
3834         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3835                 goto unlock;
3836
3837         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3838                                 ev->key_type, pin_len, &persistent);
3839         if (!key)
3840                 goto unlock;
3841
3842         /* Update connection information since adding the key will have
3843          * fixed up the type in the case of changed combination keys.
3844          */
3845         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3846                 conn_set_key(conn, key->type, key->pin_len);
3847
3848         mgmt_new_link_key(hdev, key, persistent);
3849
3850         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3851          * is set. If it's not set simply remove the key from the kernel
3852          * list (we've still notified user space about it but with
3853          * store_hint being 0).
3854          */
3855         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3856             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3857                 list_del_rcu(&key->list);
3858                 kfree_rcu(key, rcu);
3859                 goto unlock;
3860         }
3861
3862         if (persistent)
3863                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3864         else
3865                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3866
3867 unlock:
3868         hci_dev_unlock(hdev);
3869 }
3870
3871 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3872 {
3873         struct hci_ev_clock_offset *ev = (void *) skb->data;
3874         struct hci_conn *conn;
3875
3876         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3877
3878         hci_dev_lock(hdev);
3879
3880         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3881         if (conn && !ev->status) {
3882                 struct inquiry_entry *ie;
3883
3884                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3885                 if (ie) {
3886                         ie->data.clock_offset = ev->clock_offset;
3887                         ie->timestamp = jiffies;
3888                 }
3889         }
3890
3891         hci_dev_unlock(hdev);
3892 }
3893
3894 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3895 {
3896         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3897         struct hci_conn *conn;
3898
3899         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3900
3901         hci_dev_lock(hdev);
3902
3903         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3904         if (conn && !ev->status)
3905                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3906
3907         hci_dev_unlock(hdev);
3908 }
3909
3910 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3911 {
3912         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3913         struct inquiry_entry *ie;
3914
3915         BT_DBG("%s", hdev->name);
3916
3917         hci_dev_lock(hdev);
3918
3919         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3920         if (ie) {
3921                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3922                 ie->timestamp = jiffies;
3923         }
3924
3925         hci_dev_unlock(hdev);
3926 }
3927
3928 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3929                                              struct sk_buff *skb)
3930 {
3931         struct inquiry_data data;
3932         int num_rsp = *((__u8 *) skb->data);
3933
3934         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3935
3936         if (!num_rsp)
3937                 return;
3938
3939         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3940                 return;
3941
3942         hci_dev_lock(hdev);
3943
3944         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3945                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3946                 info = (void *) (skb->data + 1);
3947
3948                 for (; num_rsp; num_rsp--, info++) {
3949                         u32 flags;
3950
3951                         bacpy(&data.bdaddr, &info->bdaddr);
3952                         data.pscan_rep_mode     = info->pscan_rep_mode;
3953                         data.pscan_period_mode  = info->pscan_period_mode;
3954                         data.pscan_mode         = info->pscan_mode;
3955                         memcpy(data.dev_class, info->dev_class, 3);
3956                         data.clock_offset       = info->clock_offset;
3957                         data.rssi               = info->rssi;
3958                         data.ssp_mode           = 0x00;
3959
3960                         flags = hci_inquiry_cache_update(hdev, &data, false);
3961
3962                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3963                                           info->dev_class, info->rssi,
3964                                           flags, NULL, 0, NULL, 0);
3965                 }
3966         } else {
3967                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3968
3969                 for (; num_rsp; num_rsp--, info++) {
3970                         u32 flags;
3971
3972                         bacpy(&data.bdaddr, &info->bdaddr);
3973                         data.pscan_rep_mode     = info->pscan_rep_mode;
3974                         data.pscan_period_mode  = info->pscan_period_mode;
3975                         data.pscan_mode         = 0x00;
3976                         memcpy(data.dev_class, info->dev_class, 3);
3977                         data.clock_offset       = info->clock_offset;
3978                         data.rssi               = info->rssi;
3979                         data.ssp_mode           = 0x00;
3980
3981                         flags = hci_inquiry_cache_update(hdev, &data, false);
3982
3983                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3984                                           info->dev_class, info->rssi,
3985                                           flags, NULL, 0, NULL, 0);
3986                 }
3987         }
3988
3989         hci_dev_unlock(hdev);
3990 }
3991
3992 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3993                                         struct sk_buff *skb)
3994 {
3995         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3996         struct hci_conn *conn;
3997
3998         BT_DBG("%s", hdev->name);
3999
4000         hci_dev_lock(hdev);
4001
4002         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4003         if (!conn)
4004                 goto unlock;
4005
4006         if (ev->page < HCI_MAX_PAGES)
4007                 memcpy(conn->features[ev->page], ev->features, 8);
4008
4009         if (!ev->status && ev->page == 0x01) {
4010                 struct inquiry_entry *ie;
4011
4012                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4013                 if (ie)
4014                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4015
4016                 if (ev->features[0] & LMP_HOST_SSP) {
4017                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4018                 } else {
4019                         /* It is mandatory by the Bluetooth specification that
4020                          * Extended Inquiry Results are only used when Secure
4021                          * Simple Pairing is enabled, but some devices violate
4022                          * this.
4023                          *
4024                          * To make these devices work, the internal SSP
4025                          * enabled flag needs to be cleared if the remote host
4026                          * features do not indicate SSP support */
4027                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4028                 }
4029
4030                 if (ev->features[0] & LMP_HOST_SC)
4031                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4032         }
4033
4034         if (conn->state != BT_CONFIG)
4035                 goto unlock;
4036
4037         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4038                 struct hci_cp_remote_name_req cp;
4039                 memset(&cp, 0, sizeof(cp));
4040                 bacpy(&cp.bdaddr, &conn->dst);
4041                 cp.pscan_rep_mode = 0x02;
4042                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4043         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4044                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4045
4046         if (!hci_outgoing_auth_needed(hdev, conn)) {
4047                 conn->state = BT_CONNECTED;
4048                 hci_connect_cfm(conn, ev->status);
4049                 hci_conn_drop(conn);
4050         }
4051
4052 unlock:
4053         hci_dev_unlock(hdev);
4054 }
4055
4056 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4057                                        struct sk_buff *skb)
4058 {
4059         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4060         struct hci_conn *conn;
4061
4062         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4063
4064         hci_dev_lock(hdev);
4065
4066         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4067         if (!conn) {
4068                 if (ev->link_type == ESCO_LINK)
4069                         goto unlock;
4070
4071                 /* When the link type in the event indicates SCO connection
4072                  * and lookup of the connection object fails, then check
4073                  * if an eSCO connection object exists.
4074                  *
4075                  * The core limits the synchronous connections to either
4076                  * SCO or eSCO. The eSCO connection is preferred and tried
4077                  * to be setup first and until successfully established,
4078                  * the link type will be hinted as eSCO.
4079                  */
4080                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4081                 if (!conn)
4082                         goto unlock;
4083         }
4084
4085         switch (ev->status) {
4086         case 0x00:
4087                 conn->handle = __le16_to_cpu(ev->handle);
4088                 conn->state  = BT_CONNECTED;
4089                 conn->type   = ev->link_type;
4090
4091                 hci_debugfs_create_conn(conn);
4092                 hci_conn_add_sysfs(conn);
4093                 break;
4094
4095         case 0x10:      /* Connection Accept Timeout */
4096         case 0x0d:      /* Connection Rejected due to Limited Resources */
4097         case 0x11:      /* Unsupported Feature or Parameter Value */
4098         case 0x1c:      /* SCO interval rejected */
4099         case 0x1a:      /* Unsupported Remote Feature */
4100         case 0x1f:      /* Unspecified error */
4101         case 0x20:      /* Unsupported LMP Parameter value */
4102                 if (conn->out) {
4103                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4104                                         (hdev->esco_type & EDR_ESCO_MASK);
4105                         if (hci_setup_sync(conn, conn->link->handle))
4106                                 goto unlock;
4107                 }
4108                 /* fall through */
4109
4110         default:
4111                 conn->state = BT_CLOSED;
4112                 break;
4113         }
4114
4115         hci_connect_cfm(conn, ev->status);
4116         if (ev->status)
4117                 hci_conn_del(conn);
4118
4119 unlock:
4120         hci_dev_unlock(hdev);
4121 }
4122
4123 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4124 {
4125         size_t parsed = 0;
4126
4127         while (parsed < eir_len) {
4128                 u8 field_len = eir[0];
4129
4130                 if (field_len == 0)
4131                         return parsed;
4132
4133                 parsed += field_len + 1;
4134                 eir += field_len + 1;
4135         }
4136
4137         return eir_len;
4138 }
4139
4140 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4141                                             struct sk_buff *skb)
4142 {
4143         struct inquiry_data data;
4144         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4145         int num_rsp = *((__u8 *) skb->data);
4146         size_t eir_len;
4147
4148         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4149
4150         if (!num_rsp)
4151                 return;
4152
4153         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4154                 return;
4155
4156         hci_dev_lock(hdev);
4157
4158         for (; num_rsp; num_rsp--, info++) {
4159                 u32 flags;
4160                 bool name_known;
4161
4162                 bacpy(&data.bdaddr, &info->bdaddr);
4163                 data.pscan_rep_mode     = info->pscan_rep_mode;
4164                 data.pscan_period_mode  = info->pscan_period_mode;
4165                 data.pscan_mode         = 0x00;
4166                 memcpy(data.dev_class, info->dev_class, 3);
4167                 data.clock_offset       = info->clock_offset;
4168                 data.rssi               = info->rssi;
4169                 data.ssp_mode           = 0x01;
4170
4171                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4172                         name_known = eir_get_data(info->data,
4173                                                   sizeof(info->data),
4174                                                   EIR_NAME_COMPLETE, NULL);
4175                 else
4176                         name_known = true;
4177
4178                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4179
4180                 eir_len = eir_get_length(info->data, sizeof(info->data));
4181
4182                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4183                                   info->dev_class, info->rssi,
4184                                   flags, info->data, eir_len, NULL, 0);
4185         }
4186
4187         hci_dev_unlock(hdev);
4188 }
4189
4190 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4191                                          struct sk_buff *skb)
4192 {
4193         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4194         struct hci_conn *conn;
4195
4196         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4197                __le16_to_cpu(ev->handle));
4198
4199         hci_dev_lock(hdev);
4200
4201         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4202         if (!conn)
4203                 goto unlock;
4204
4205         /* For BR/EDR the necessary steps are taken through the
4206          * auth_complete event.
4207          */
4208         if (conn->type != LE_LINK)
4209                 goto unlock;
4210
4211         if (!ev->status)
4212                 conn->sec_level = conn->pending_sec_level;
4213
4214         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4215
4216         if (ev->status && conn->state == BT_CONNECTED) {
4217                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4218                 hci_conn_drop(conn);
4219                 goto unlock;
4220         }
4221
4222         if (conn->state == BT_CONFIG) {
4223                 if (!ev->status)
4224                         conn->state = BT_CONNECTED;
4225
4226                 hci_connect_cfm(conn, ev->status);
4227                 hci_conn_drop(conn);
4228         } else {
4229                 hci_auth_cfm(conn, ev->status);
4230
4231                 hci_conn_hold(conn);
4232                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4233                 hci_conn_drop(conn);
4234         }
4235
4236 unlock:
4237         hci_dev_unlock(hdev);
4238 }
4239
4240 static u8 hci_get_auth_req(struct hci_conn *conn)
4241 {
4242         /* If remote requests no-bonding follow that lead */
4243         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4244             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4245                 return conn->remote_auth | (conn->auth_type & 0x01);
4246
4247         /* If both remote and local have enough IO capabilities, require
4248          * MITM protection
4249          */
4250         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4251             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4252                 return conn->remote_auth | 0x01;
4253
4254         /* No MITM protection possible so ignore remote requirement */
4255         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4256 }
4257
4258 static u8 bredr_oob_data_present(struct hci_conn *conn)
4259 {
4260         struct hci_dev *hdev = conn->hdev;
4261         struct oob_data *data;
4262
4263         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4264         if (!data)
4265                 return 0x00;
4266
4267         if (bredr_sc_enabled(hdev)) {
4268                 /* When Secure Connections is enabled, then just
4269                  * return the present value stored with the OOB
4270                  * data. The stored value contains the right present
4271                  * information. However it can only be trusted when
4272                  * not in Secure Connection Only mode.
4273                  */
4274                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4275                         return data->present;
4276
4277                 /* When Secure Connections Only mode is enabled, then
4278                  * the P-256 values are required. If they are not
4279                  * available, then do not declare that OOB data is
4280                  * present.
4281                  */
4282                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4283                     !memcmp(data->hash256, ZERO_KEY, 16))
4284                         return 0x00;
4285
4286                 return 0x02;
4287         }
4288
4289         /* When Secure Connections is not enabled or actually
4290          * not supported by the hardware, then check that if
4291          * P-192 data values are present.
4292          */
4293         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4294             !memcmp(data->hash192, ZERO_KEY, 16))
4295                 return 0x00;
4296
4297         return 0x01;
4298 }
4299
4300 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4301 {
4302         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4303         struct hci_conn *conn;
4304
4305         BT_DBG("%s", hdev->name);
4306
4307         hci_dev_lock(hdev);
4308
4309         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4310         if (!conn)
4311                 goto unlock;
4312
4313         hci_conn_hold(conn);
4314
4315         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4316                 goto unlock;
4317
4318         /* Allow pairing if we're pairable, the initiators of the
4319          * pairing or if the remote is not requesting bonding.
4320          */
4321         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4322             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4323             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4324                 struct hci_cp_io_capability_reply cp;
4325
4326                 bacpy(&cp.bdaddr, &ev->bdaddr);
4327                 /* Change the IO capability from KeyboardDisplay
4328                  * to DisplayYesNo as it is not supported by BT spec. */
4329                 cp.capability = (conn->io_capability == 0x04) ?
4330                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4331
4332                 /* If we are initiators, there is no remote information yet */
4333                 if (conn->remote_auth == 0xff) {
4334                         /* Request MITM protection if our IO caps allow it
4335                          * except for the no-bonding case.
4336                          */
4337                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4338                             conn->auth_type != HCI_AT_NO_BONDING)
4339                                 conn->auth_type |= 0x01;
4340                 } else {
4341                         conn->auth_type = hci_get_auth_req(conn);
4342                 }
4343
4344                 /* If we're not bondable, force one of the non-bondable
4345                  * authentication requirement values.
4346                  */
4347                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4348                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4349
4350                 cp.authentication = conn->auth_type;
4351                 cp.oob_data = bredr_oob_data_present(conn);
4352
4353                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4354                              sizeof(cp), &cp);
4355         } else {
4356                 struct hci_cp_io_capability_neg_reply cp;
4357
4358                 bacpy(&cp.bdaddr, &ev->bdaddr);
4359                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4360
4361                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4362                              sizeof(cp), &cp);
4363         }
4364
4365 unlock:
4366         hci_dev_unlock(hdev);
4367 }
4368
4369 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4370 {
4371         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4372         struct hci_conn *conn;
4373
4374         BT_DBG("%s", hdev->name);
4375
4376         hci_dev_lock(hdev);
4377
4378         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4379         if (!conn)
4380                 goto unlock;
4381
4382         conn->remote_cap = ev->capability;
4383         conn->remote_auth = ev->authentication;
4384
4385 unlock:
4386         hci_dev_unlock(hdev);
4387 }
4388
4389 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4390                                          struct sk_buff *skb)
4391 {
4392         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4393         int loc_mitm, rem_mitm, confirm_hint = 0;
4394         struct hci_conn *conn;
4395
4396         BT_DBG("%s", hdev->name);
4397
4398         hci_dev_lock(hdev);
4399
4400         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4401                 goto unlock;
4402
4403         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4404         if (!conn)
4405                 goto unlock;
4406
4407         loc_mitm = (conn->auth_type & 0x01);
4408         rem_mitm = (conn->remote_auth & 0x01);
4409
4410         /* If we require MITM but the remote device can't provide that
4411          * (it has NoInputNoOutput) then reject the confirmation
4412          * request. We check the security level here since it doesn't
4413          * necessarily match conn->auth_type.
4414          */
4415         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4416             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4417                 BT_DBG("Rejecting request: remote device can't provide MITM");
4418                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4419                              sizeof(ev->bdaddr), &ev->bdaddr);
4420                 goto unlock;
4421         }
4422
4423         /* If no side requires MITM protection; auto-accept */
4424         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4425             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4426
4427                 /* If we're not the initiators request authorization to
4428                  * proceed from user space (mgmt_user_confirm with
4429                  * confirm_hint set to 1). The exception is if neither
4430                  * side had MITM or if the local IO capability is
4431                  * NoInputNoOutput, in which case we do auto-accept
4432                  */
4433                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4434                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4435                     (loc_mitm || rem_mitm)) {
4436                         BT_DBG("Confirming auto-accept as acceptor");
4437                         confirm_hint = 1;
4438                         goto confirm;
4439                 }
4440
4441                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4442                        hdev->auto_accept_delay);
4443
4444                 if (hdev->auto_accept_delay > 0) {
4445                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4446                         queue_delayed_work(conn->hdev->workqueue,
4447                                            &conn->auto_accept_work, delay);
4448                         goto unlock;
4449                 }
4450
4451                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4452                              sizeof(ev->bdaddr), &ev->bdaddr);
4453                 goto unlock;
4454         }
4455
4456 confirm:
4457         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4458                                   le32_to_cpu(ev->passkey), confirm_hint);
4459
4460 unlock:
4461         hci_dev_unlock(hdev);
4462 }
4463
4464 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4465                                          struct sk_buff *skb)
4466 {
4467         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4468
4469         BT_DBG("%s", hdev->name);
4470
4471         if (hci_dev_test_flag(hdev, HCI_MGMT))
4472                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4473 }
4474
4475 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4476                                         struct sk_buff *skb)
4477 {
4478         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4479         struct hci_conn *conn;
4480
4481         BT_DBG("%s", hdev->name);
4482
4483         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4484         if (!conn)
4485                 return;
4486
4487         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4488         conn->passkey_entered = 0;
4489
4490         if (hci_dev_test_flag(hdev, HCI_MGMT))
4491                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4492                                          conn->dst_type, conn->passkey_notify,
4493                                          conn->passkey_entered);
4494 }
4495
4496 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4497 {
4498         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4499         struct hci_conn *conn;
4500
4501         BT_DBG("%s", hdev->name);
4502
4503         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4504         if (!conn)
4505                 return;
4506
4507         switch (ev->type) {
4508         case HCI_KEYPRESS_STARTED:
4509                 conn->passkey_entered = 0;
4510                 return;
4511
4512         case HCI_KEYPRESS_ENTERED:
4513                 conn->passkey_entered++;
4514                 break;
4515
4516         case HCI_KEYPRESS_ERASED:
4517                 conn->passkey_entered--;
4518                 break;
4519
4520         case HCI_KEYPRESS_CLEARED:
4521                 conn->passkey_entered = 0;
4522                 break;
4523
4524         case HCI_KEYPRESS_COMPLETED:
4525                 return;
4526         }
4527
4528         if (hci_dev_test_flag(hdev, HCI_MGMT))
4529                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4530                                          conn->dst_type, conn->passkey_notify,
4531                                          conn->passkey_entered);
4532 }
4533
4534 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4535                                          struct sk_buff *skb)
4536 {
4537         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4538         struct hci_conn *conn;
4539
4540         BT_DBG("%s", hdev->name);
4541
4542         hci_dev_lock(hdev);
4543
4544         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4545         if (!conn)
4546                 goto unlock;
4547
4548         /* Reset the authentication requirement to unknown */
4549         conn->remote_auth = 0xff;
4550
4551         /* To avoid duplicate auth_failed events to user space we check
4552          * the HCI_CONN_AUTH_PEND flag which will be set if we
4553          * initiated the authentication. A traditional auth_complete
4554          * event gets always produced as initiator and is also mapped to
4555          * the mgmt_auth_failed event */
4556         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4557                 mgmt_auth_failed(conn, ev->status);
4558
4559         hci_conn_drop(conn);
4560
4561 unlock:
4562         hci_dev_unlock(hdev);
4563 }
4564
4565 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4566                                          struct sk_buff *skb)
4567 {
4568         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4569         struct inquiry_entry *ie;
4570         struct hci_conn *conn;
4571
4572         BT_DBG("%s", hdev->name);
4573
4574         hci_dev_lock(hdev);
4575
4576         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4577         if (conn)
4578                 memcpy(conn->features[1], ev->features, 8);
4579
4580         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4581         if (ie)
4582                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4583
4584         hci_dev_unlock(hdev);
4585 }
4586
4587 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4588                                             struct sk_buff *skb)
4589 {
4590         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4591         struct oob_data *data;
4592
4593         BT_DBG("%s", hdev->name);
4594
4595         hci_dev_lock(hdev);
4596
4597         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4598                 goto unlock;
4599
4600         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4601         if (!data) {
4602                 struct hci_cp_remote_oob_data_neg_reply cp;
4603
4604                 bacpy(&cp.bdaddr, &ev->bdaddr);
4605                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4606                              sizeof(cp), &cp);
4607                 goto unlock;
4608         }
4609
4610         if (bredr_sc_enabled(hdev)) {
4611                 struct hci_cp_remote_oob_ext_data_reply cp;
4612
4613                 bacpy(&cp.bdaddr, &ev->bdaddr);
4614                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4615                         memset(cp.hash192, 0, sizeof(cp.hash192));
4616                         memset(cp.rand192, 0, sizeof(cp.rand192));
4617                 } else {
4618                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4619                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4620                 }
4621                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4622                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4623
4624                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4625                              sizeof(cp), &cp);
4626         } else {
4627                 struct hci_cp_remote_oob_data_reply cp;
4628
4629                 bacpy(&cp.bdaddr, &ev->bdaddr);
4630                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4631                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4632
4633                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4634                              sizeof(cp), &cp);
4635         }
4636
4637 unlock:
4638         hci_dev_unlock(hdev);
4639 }
4640
4641 #if IS_ENABLED(CONFIG_BT_HS)
4642 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4643 {
4644         struct hci_ev_channel_selected *ev = (void *)skb->data;
4645         struct hci_conn *hcon;
4646
4647         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4648
4649         skb_pull(skb, sizeof(*ev));
4650
4651         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4652         if (!hcon)
4653                 return;
4654
4655         amp_read_loc_assoc_final_data(hdev, hcon);
4656 }
4657
4658 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4659                                       struct sk_buff *skb)
4660 {
4661         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4662         struct hci_conn *hcon, *bredr_hcon;
4663
4664         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4665                ev->status);
4666
4667         hci_dev_lock(hdev);
4668
4669         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4670         if (!hcon) {
4671                 hci_dev_unlock(hdev);
4672                 return;
4673         }
4674
4675         if (ev->status) {
4676                 hci_conn_del(hcon);
4677                 hci_dev_unlock(hdev);
4678                 return;
4679         }
4680
4681         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4682
4683         hcon->state = BT_CONNECTED;
4684         bacpy(&hcon->dst, &bredr_hcon->dst);
4685
4686         hci_conn_hold(hcon);
4687         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4688         hci_conn_drop(hcon);
4689
4690         hci_debugfs_create_conn(hcon);
4691         hci_conn_add_sysfs(hcon);
4692
4693         amp_physical_cfm(bredr_hcon, hcon);
4694
4695         hci_dev_unlock(hdev);
4696 }
4697
4698 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4699 {
4700         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4701         struct hci_conn *hcon;
4702         struct hci_chan *hchan;
4703         struct amp_mgr *mgr;
4704
4705         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4706                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4707                ev->status);
4708
4709         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4710         if (!hcon)
4711                 return;
4712
4713         /* Create AMP hchan */
4714         hchan = hci_chan_create(hcon);
4715         if (!hchan)
4716                 return;
4717
4718         hchan->handle = le16_to_cpu(ev->handle);
4719
4720         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4721
4722         mgr = hcon->amp_mgr;
4723         if (mgr && mgr->bredr_chan) {
4724                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4725
4726                 l2cap_chan_lock(bredr_chan);
4727
4728                 bredr_chan->conn->mtu = hdev->block_mtu;
4729                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4730                 hci_conn_hold(hcon);
4731
4732                 l2cap_chan_unlock(bredr_chan);
4733         }
4734 }
4735
4736 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4737                                              struct sk_buff *skb)
4738 {
4739         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4740         struct hci_chan *hchan;
4741
4742         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4743                le16_to_cpu(ev->handle), ev->status);
4744
4745         if (ev->status)
4746                 return;
4747
4748         hci_dev_lock(hdev);
4749
4750         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4751         if (!hchan)
4752                 goto unlock;
4753
4754         amp_destroy_logical_link(hchan, ev->reason);
4755
4756 unlock:
4757         hci_dev_unlock(hdev);
4758 }
4759
4760 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4761                                              struct sk_buff *skb)
4762 {
4763         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4764         struct hci_conn *hcon;
4765
4766         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4767
4768         if (ev->status)
4769                 return;
4770
4771         hci_dev_lock(hdev);
4772
4773         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4774         if (hcon) {
4775                 hcon->state = BT_CLOSED;
4776                 hci_conn_del(hcon);
4777         }
4778
4779         hci_dev_unlock(hdev);
4780 }
4781 #endif
4782
4783 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4784                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4785                         u16 interval, u16 latency, u16 supervision_timeout)
4786 {
4787         struct hci_conn_params *params;
4788         struct hci_conn *conn;
4789         struct smp_irk *irk;
4790         u8 addr_type;
4791
4792         hci_dev_lock(hdev);
4793
4794         /* All controllers implicitly stop advertising in the event of a
4795          * connection, so ensure that the state bit is cleared.
4796          */
4797         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4798
4799         conn = hci_lookup_le_connect(hdev);
4800         if (!conn) {
4801                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4802                 if (!conn) {
4803                         bt_dev_err(hdev, "no memory for new connection");
4804                         goto unlock;
4805                 }
4806
4807                 conn->dst_type = bdaddr_type;
4808
4809                 /* If we didn't have a hci_conn object previously
4810                  * but we're in master role this must be something
4811                  * initiated using a white list. Since white list based
4812                  * connections are not "first class citizens" we don't
4813                  * have full tracking of them. Therefore, we go ahead
4814                  * with a "best effort" approach of determining the
4815                  * initiator address based on the HCI_PRIVACY flag.
4816                  */
4817                 if (conn->out) {
4818                         conn->resp_addr_type = bdaddr_type;
4819                         bacpy(&conn->resp_addr, bdaddr);
4820                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4821                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4822                                 bacpy(&conn->init_addr, &hdev->rpa);
4823                         } else {
4824                                 hci_copy_identity_address(hdev,
4825                                                           &conn->init_addr,
4826                                                           &conn->init_addr_type);
4827                         }
4828                 }
4829         } else {
4830                 cancel_delayed_work(&conn->le_conn_timeout);
4831         }
4832
4833         if (!conn->out) {
4834                 /* Set the responder (our side) address type based on
4835                  * the advertising address type.
4836                  */
4837                 conn->resp_addr_type = hdev->adv_addr_type;
4838                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4839                         /* In case of ext adv, resp_addr will be updated in
4840                          * Adv Terminated event.
4841                          */
4842                         if (!ext_adv_capable(hdev))
4843                                 bacpy(&conn->resp_addr, &hdev->random_addr);
4844                 } else {
4845                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4846                 }
4847
4848                 conn->init_addr_type = bdaddr_type;
4849                 bacpy(&conn->init_addr, bdaddr);
4850
4851                 /* For incoming connections, set the default minimum
4852                  * and maximum connection interval. They will be used
4853                  * to check if the parameters are in range and if not
4854                  * trigger the connection update procedure.
4855                  */
4856                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4857                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4858         }
4859
4860         /* Lookup the identity address from the stored connection
4861          * address and address type.
4862          *
4863          * When establishing connections to an identity address, the
4864          * connection procedure will store the resolvable random
4865          * address first. Now if it can be converted back into the
4866          * identity address, start using the identity address from
4867          * now on.
4868          */
4869         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4870         if (irk) {
4871                 bacpy(&conn->dst, &irk->bdaddr);
4872                 conn->dst_type = irk->addr_type;
4873         }
4874
4875         if (status) {
4876                 hci_le_conn_failed(conn, status);
4877                 goto unlock;
4878         }
4879
4880         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4881                 addr_type = BDADDR_LE_PUBLIC;
4882         else
4883                 addr_type = BDADDR_LE_RANDOM;
4884
4885         /* Drop the connection if the device is blocked */
4886         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4887                 hci_conn_drop(conn);
4888                 goto unlock;
4889         }
4890
4891         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4892                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4893
4894         conn->sec_level = BT_SECURITY_LOW;
4895         conn->handle = handle;
4896         conn->state = BT_CONFIG;
4897
4898         conn->le_conn_interval = interval;
4899         conn->le_conn_latency = latency;
4900         conn->le_supv_timeout = supervision_timeout;
4901
4902         hci_debugfs_create_conn(conn);
4903         hci_conn_add_sysfs(conn);
4904
4905         if (!status) {
4906                 /* The remote features procedure is defined for master
4907                  * role only. So only in case of an initiated connection
4908                  * request the remote features.
4909                  *
4910                  * If the local controller supports slave-initiated features
4911                  * exchange, then requesting the remote features in slave
4912                  * role is possible. Otherwise just transition into the
4913                  * connected state without requesting the remote features.
4914                  */
4915                 if (conn->out ||
4916                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4917                         struct hci_cp_le_read_remote_features cp;
4918
4919                         cp.handle = __cpu_to_le16(conn->handle);
4920
4921                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4922                                      sizeof(cp), &cp);
4923
4924                         hci_conn_hold(conn);
4925                 } else {
4926                         conn->state = BT_CONNECTED;
4927                         hci_connect_cfm(conn, status);
4928                 }
4929         } else {
4930                 hci_connect_cfm(conn, status);
4931         }
4932
4933         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4934                                            conn->dst_type);
4935         if (params) {
4936                 list_del_init(&params->action);
4937                 if (params->conn) {
4938                         hci_conn_drop(params->conn);
4939                         hci_conn_put(params->conn);
4940                         params->conn = NULL;
4941                 }
4942         }
4943
4944 unlock:
4945         hci_update_background_scan(hdev);
4946         hci_dev_unlock(hdev);
4947 }
4948
4949 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4950 {
4951         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4952
4953         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4954
4955         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
4956                              ev->role, le16_to_cpu(ev->handle),
4957                              le16_to_cpu(ev->interval),
4958                              le16_to_cpu(ev->latency),
4959                              le16_to_cpu(ev->supervision_timeout));
4960 }
4961
4962 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
4963                                          struct sk_buff *skb)
4964 {
4965         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
4966
4967         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4968
4969         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
4970                              ev->role, le16_to_cpu(ev->handle),
4971                              le16_to_cpu(ev->interval),
4972                              le16_to_cpu(ev->latency),
4973                              le16_to_cpu(ev->supervision_timeout));
4974 }
4975
4976 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
4977 {
4978         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
4979         struct hci_conn *conn;
4980
4981         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4982
4983         if (ev->status)
4984                 return;
4985
4986         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
4987         if (conn) {
4988                 struct adv_info *adv_instance;
4989
4990                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
4991                         return;
4992
4993                 if (!hdev->cur_adv_instance) {
4994                         bacpy(&conn->resp_addr, &hdev->random_addr);
4995                         return;
4996                 }
4997
4998                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
4999                 if (adv_instance)
5000                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5001         }
5002 }
5003
5004 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5005                                             struct sk_buff *skb)
5006 {
5007         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5008         struct hci_conn *conn;
5009
5010         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5011
5012         if (ev->status)
5013                 return;
5014
5015         hci_dev_lock(hdev);
5016
5017         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5018         if (conn) {
5019                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5020                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5021                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5022         }
5023
5024         hci_dev_unlock(hdev);
5025 }
5026
5027 /* This function requires the caller holds hdev->lock */
5028 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5029                                               bdaddr_t *addr,
5030                                               u8 addr_type, u8 adv_type,
5031                                               bdaddr_t *direct_rpa)
5032 {
5033         struct hci_conn *conn;
5034         struct hci_conn_params *params;
5035
5036         /* If the event is not connectable don't proceed further */
5037         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5038                 return NULL;
5039
5040         /* Ignore if the device is blocked */
5041         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5042                 return NULL;
5043
5044         /* Most controller will fail if we try to create new connections
5045          * while we have an existing one in slave role.
5046          */
5047         if (hdev->conn_hash.le_num_slave > 0)
5048                 return NULL;
5049
5050         /* If we're not connectable only connect devices that we have in
5051          * our pend_le_conns list.
5052          */
5053         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5054                                            addr_type);
5055         if (!params)
5056                 return NULL;
5057
5058         if (!params->explicit_connect) {
5059                 switch (params->auto_connect) {
5060                 case HCI_AUTO_CONN_DIRECT:
5061                         /* Only devices advertising with ADV_DIRECT_IND are
5062                          * triggering a connection attempt. This is allowing
5063                          * incoming connections from slave devices.
5064                          */
5065                         if (adv_type != LE_ADV_DIRECT_IND)
5066                                 return NULL;
5067                         break;
5068                 case HCI_AUTO_CONN_ALWAYS:
5069                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5070                          * are triggering a connection attempt. This means
5071                          * that incoming connectioms from slave device are
5072                          * accepted and also outgoing connections to slave
5073                          * devices are established when found.
5074                          */
5075                         break;
5076                 default:
5077                         return NULL;
5078                 }
5079         }
5080
5081         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5082                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5083                               direct_rpa);
5084         if (!IS_ERR(conn)) {
5085                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5086                  * by higher layer that tried to connect, if no then
5087                  * store the pointer since we don't really have any
5088                  * other owner of the object besides the params that
5089                  * triggered it. This way we can abort the connection if
5090                  * the parameters get removed and keep the reference
5091                  * count consistent once the connection is established.
5092                  */
5093
5094                 if (!params->explicit_connect)
5095                         params->conn = hci_conn_get(conn);
5096
5097                 return conn;
5098         }
5099
5100         switch (PTR_ERR(conn)) {
5101         case -EBUSY:
5102                 /* If hci_connect() returns -EBUSY it means there is already
5103                  * an LE connection attempt going on. Since controllers don't
5104                  * support more than one connection attempt at the time, we
5105                  * don't consider this an error case.
5106                  */
5107                 break;
5108         default:
5109                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5110                 return NULL;
5111         }
5112
5113         return NULL;
5114 }
5115
5116 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5117                                u8 bdaddr_type, bdaddr_t *direct_addr,
5118                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5119 {
5120         struct discovery_state *d = &hdev->discovery;
5121         struct smp_irk *irk;
5122         struct hci_conn *conn;
5123         bool match;
5124         u32 flags;
5125         u8 *ptr, real_len;
5126
5127         switch (type) {
5128         case LE_ADV_IND:
5129         case LE_ADV_DIRECT_IND:
5130         case LE_ADV_SCAN_IND:
5131         case LE_ADV_NONCONN_IND:
5132         case LE_ADV_SCAN_RSP:
5133                 break;
5134         default:
5135                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5136                                        "type: 0x%02x", type);
5137                 return;
5138         }
5139
5140         /* Find the end of the data in case the report contains padded zero
5141          * bytes at the end causing an invalid length value.
5142          *
5143          * When data is NULL, len is 0 so there is no need for extra ptr
5144          * check as 'ptr < data + 0' is already false in such case.
5145          */
5146         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5147                 if (ptr + 1 + *ptr > data + len)
5148                         break;
5149         }
5150
5151         real_len = ptr - data;
5152
5153         /* Adjust for actual length */
5154         if (len != real_len) {
5155                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5156                 len = real_len;
5157         }
5158
5159         /* If the direct address is present, then this report is from
5160          * a LE Direct Advertising Report event. In that case it is
5161          * important to see if the address is matching the local
5162          * controller address.
5163          */
5164         if (direct_addr) {
5165                 /* Only resolvable random addresses are valid for these
5166                  * kind of reports and others can be ignored.
5167                  */
5168                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5169                         return;
5170
5171                 /* If the controller is not using resolvable random
5172                  * addresses, then this report can be ignored.
5173                  */
5174                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5175                         return;
5176
5177                 /* If the local IRK of the controller does not match
5178                  * with the resolvable random address provided, then
5179                  * this report can be ignored.
5180                  */
5181                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5182                         return;
5183         }
5184
5185         /* Check if we need to convert to identity address */
5186         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5187         if (irk) {
5188                 bdaddr = &irk->bdaddr;
5189                 bdaddr_type = irk->addr_type;
5190         }
5191
5192         /* Check if we have been requested to connect to this device.
5193          *
5194          * direct_addr is set only for directed advertising reports (it is NULL
5195          * for advertising reports) and is already verified to be RPA above.
5196          */
5197         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5198                                                                 direct_addr);
5199         if (conn && type == LE_ADV_IND) {
5200                 /* Store report for later inclusion by
5201                  * mgmt_device_connected
5202                  */
5203                 memcpy(conn->le_adv_data, data, len);
5204                 conn->le_adv_data_len = len;
5205         }
5206
5207         /* Passive scanning shouldn't trigger any device found events,
5208          * except for devices marked as CONN_REPORT for which we do send
5209          * device found events.
5210          */
5211         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5212                 if (type == LE_ADV_DIRECT_IND)
5213                         return;
5214
5215                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5216                                                bdaddr, bdaddr_type))
5217                         return;
5218
5219                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5220                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5221                 else
5222                         flags = 0;
5223                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5224                                   rssi, flags, data, len, NULL, 0);
5225                 return;
5226         }
5227
5228         /* When receiving non-connectable or scannable undirected
5229          * advertising reports, this means that the remote device is
5230          * not connectable and then clearly indicate this in the
5231          * device found event.
5232          *
5233          * When receiving a scan response, then there is no way to
5234          * know if the remote device is connectable or not. However
5235          * since scan responses are merged with a previously seen
5236          * advertising report, the flags field from that report
5237          * will be used.
5238          *
5239          * In the really unlikely case that a controller get confused
5240          * and just sends a scan response event, then it is marked as
5241          * not connectable as well.
5242          */
5243         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5244             type == LE_ADV_SCAN_RSP)
5245                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5246         else
5247                 flags = 0;
5248
5249         /* If there's nothing pending either store the data from this
5250          * event or send an immediate device found event if the data
5251          * should not be stored for later.
5252          */
5253         if (!has_pending_adv_report(hdev)) {
5254                 /* If the report will trigger a SCAN_REQ store it for
5255                  * later merging.
5256                  */
5257                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5258                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5259                                                  rssi, flags, data, len);
5260                         return;
5261                 }
5262
5263                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5264                                   rssi, flags, data, len, NULL, 0);
5265                 return;
5266         }
5267
5268         /* Check if the pending report is for the same device as the new one */
5269         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5270                  bdaddr_type == d->last_adv_addr_type);
5271
5272         /* If the pending data doesn't match this report or this isn't a
5273          * scan response (e.g. we got a duplicate ADV_IND) then force
5274          * sending of the pending data.
5275          */
5276         if (type != LE_ADV_SCAN_RSP || !match) {
5277                 /* Send out whatever is in the cache, but skip duplicates */
5278                 if (!match)
5279                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5280                                           d->last_adv_addr_type, NULL,
5281                                           d->last_adv_rssi, d->last_adv_flags,
5282                                           d->last_adv_data,
5283                                           d->last_adv_data_len, NULL, 0);
5284
5285                 /* If the new report will trigger a SCAN_REQ store it for
5286                  * later merging.
5287                  */
5288                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5289                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5290                                                  rssi, flags, data, len);
5291                         return;
5292                 }
5293
5294                 /* The advertising reports cannot be merged, so clear
5295                  * the pending report and send out a device found event.
5296                  */
5297                 clear_pending_adv_report(hdev);
5298                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5299                                   rssi, flags, data, len, NULL, 0);
5300                 return;
5301         }
5302
5303         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5304          * the new event is a SCAN_RSP. We can therefore proceed with
5305          * sending a merged device found event.
5306          */
5307         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5308                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5309                           d->last_adv_data, d->last_adv_data_len, data, len);
5310         clear_pending_adv_report(hdev);
5311 }
5312
5313 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5314 {
5315         u8 num_reports = skb->data[0];
5316         void *ptr = &skb->data[1];
5317
5318         hci_dev_lock(hdev);
5319
5320         while (num_reports--) {
5321                 struct hci_ev_le_advertising_info *ev = ptr;
5322                 s8 rssi;
5323
5324                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5325                         rssi = ev->data[ev->length];
5326                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5327                                            ev->bdaddr_type, NULL, 0, rssi,
5328                                            ev->data, ev->length);
5329                 } else {
5330                         bt_dev_err(hdev, "Dropping invalid advertising data");
5331                 }
5332
5333                 ptr += sizeof(*ev) + ev->length + 1;
5334         }
5335
5336         hci_dev_unlock(hdev);
5337 }
5338
5339 static u8 ext_evt_type_to_legacy(u16 evt_type)
5340 {
5341         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5342                 switch (evt_type) {
5343                 case LE_LEGACY_ADV_IND:
5344                         return LE_ADV_IND;
5345                 case LE_LEGACY_ADV_DIRECT_IND:
5346                         return LE_ADV_DIRECT_IND;
5347                 case LE_LEGACY_ADV_SCAN_IND:
5348                         return LE_ADV_SCAN_IND;
5349                 case LE_LEGACY_NONCONN_IND:
5350                         return LE_ADV_NONCONN_IND;
5351                 case LE_LEGACY_SCAN_RSP_ADV:
5352                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5353                         return LE_ADV_SCAN_RSP;
5354                 }
5355
5356                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5357                                    evt_type);
5358
5359                 return LE_ADV_INVALID;
5360         }
5361
5362         if (evt_type & LE_EXT_ADV_CONN_IND) {
5363                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5364                         return LE_ADV_DIRECT_IND;
5365
5366                 return LE_ADV_IND;
5367         }
5368
5369         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5370                 return LE_ADV_SCAN_RSP;
5371
5372         if (evt_type & LE_EXT_ADV_SCAN_IND)
5373                 return LE_ADV_SCAN_IND;
5374
5375         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5376             evt_type & LE_EXT_ADV_DIRECT_IND)
5377                 return LE_ADV_NONCONN_IND;
5378
5379         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5380                                    evt_type);
5381
5382         return LE_ADV_INVALID;
5383 }
5384
5385 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5386 {
5387         u8 num_reports = skb->data[0];
5388         void *ptr = &skb->data[1];
5389
5390         hci_dev_lock(hdev);
5391
5392         while (num_reports--) {
5393                 struct hci_ev_le_ext_adv_report *ev = ptr;
5394                 u8 legacy_evt_type;
5395                 u16 evt_type;
5396
5397                 evt_type = __le16_to_cpu(ev->evt_type);
5398                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5399                 if (legacy_evt_type != LE_ADV_INVALID) {
5400                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5401                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5402                                            ev->data, ev->length);
5403                 }
5404
5405                 ptr += sizeof(*ev) + ev->length + 1;
5406         }
5407
5408         hci_dev_unlock(hdev);
5409 }
5410
5411 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5412                                             struct sk_buff *skb)
5413 {
5414         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5415         struct hci_conn *conn;
5416
5417         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5418
5419         hci_dev_lock(hdev);
5420
5421         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5422         if (conn) {
5423                 if (!ev->status)
5424                         memcpy(conn->features[0], ev->features, 8);
5425
5426                 if (conn->state == BT_CONFIG) {
5427                         __u8 status;
5428
5429                         /* If the local controller supports slave-initiated
5430                          * features exchange, but the remote controller does
5431                          * not, then it is possible that the error code 0x1a
5432                          * for unsupported remote feature gets returned.
5433                          *
5434                          * In this specific case, allow the connection to
5435                          * transition into connected state and mark it as
5436                          * successful.
5437                          */
5438                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5439                             !conn->out && ev->status == 0x1a)
5440                                 status = 0x00;
5441                         else
5442                                 status = ev->status;
5443
5444                         conn->state = BT_CONNECTED;
5445                         hci_connect_cfm(conn, status);
5446                         hci_conn_drop(conn);
5447                 }
5448         }
5449
5450         hci_dev_unlock(hdev);
5451 }
5452
5453 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5454 {
5455         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5456         struct hci_cp_le_ltk_reply cp;
5457         struct hci_cp_le_ltk_neg_reply neg;
5458         struct hci_conn *conn;
5459         struct smp_ltk *ltk;
5460
5461         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5462
5463         hci_dev_lock(hdev);
5464
5465         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5466         if (conn == NULL)
5467                 goto not_found;
5468
5469         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5470         if (!ltk)
5471                 goto not_found;
5472
5473         if (smp_ltk_is_sc(ltk)) {
5474                 /* With SC both EDiv and Rand are set to zero */
5475                 if (ev->ediv || ev->rand)
5476                         goto not_found;
5477         } else {
5478                 /* For non-SC keys check that EDiv and Rand match */
5479                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5480                         goto not_found;
5481         }
5482
5483         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5484         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5485         cp.handle = cpu_to_le16(conn->handle);
5486
5487         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5488
5489         conn->enc_key_size = ltk->enc_size;
5490
5491         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5492
5493         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5494          * temporary key used to encrypt a connection following
5495          * pairing. It is used during the Encrypted Session Setup to
5496          * distribute the keys. Later, security can be re-established
5497          * using a distributed LTK.
5498          */
5499         if (ltk->type == SMP_STK) {
5500                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5501                 list_del_rcu(&ltk->list);
5502                 kfree_rcu(ltk, rcu);
5503         } else {
5504                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5505         }
5506
5507         hci_dev_unlock(hdev);
5508
5509         return;
5510
5511 not_found:
5512         neg.handle = ev->handle;
5513         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5514         hci_dev_unlock(hdev);
5515 }
5516
5517 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5518                                       u8 reason)
5519 {
5520         struct hci_cp_le_conn_param_req_neg_reply cp;
5521
5522         cp.handle = cpu_to_le16(handle);
5523         cp.reason = reason;
5524
5525         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5526                      &cp);
5527 }
5528
5529 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5530                                              struct sk_buff *skb)
5531 {
5532         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5533         struct hci_cp_le_conn_param_req_reply cp;
5534         struct hci_conn *hcon;
5535         u16 handle, min, max, latency, timeout;
5536
5537         handle = le16_to_cpu(ev->handle);
5538         min = le16_to_cpu(ev->interval_min);
5539         max = le16_to_cpu(ev->interval_max);
5540         latency = le16_to_cpu(ev->latency);
5541         timeout = le16_to_cpu(ev->timeout);
5542
5543         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5544         if (!hcon || hcon->state != BT_CONNECTED)
5545                 return send_conn_param_neg_reply(hdev, handle,
5546                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5547
5548         if (min < hcon->le_conn_min_interval ||
5549             max > hcon->le_conn_max_interval)
5550                 return send_conn_param_neg_reply(hdev, handle,
5551                                                  HCI_ERROR_INVALID_LL_PARAMS);
5552
5553         if (hci_check_conn_params(min, max, latency, timeout))
5554                 return send_conn_param_neg_reply(hdev, handle,
5555                                                  HCI_ERROR_INVALID_LL_PARAMS);
5556
5557         if (hcon->role == HCI_ROLE_MASTER) {
5558                 struct hci_conn_params *params;
5559                 u8 store_hint;
5560
5561                 hci_dev_lock(hdev);
5562
5563                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5564                                                 hcon->dst_type);
5565                 if (params) {
5566                         params->conn_min_interval = min;
5567                         params->conn_max_interval = max;
5568                         params->conn_latency = latency;
5569                         params->supervision_timeout = timeout;
5570                         store_hint = 0x01;
5571                 } else{
5572                         store_hint = 0x00;
5573                 }
5574
5575                 hci_dev_unlock(hdev);
5576
5577                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5578                                     store_hint, min, max, latency, timeout);
5579         }
5580
5581         cp.handle = ev->handle;
5582         cp.interval_min = ev->interval_min;
5583         cp.interval_max = ev->interval_max;
5584         cp.latency = ev->latency;
5585         cp.timeout = ev->timeout;
5586         cp.min_ce_len = 0;
5587         cp.max_ce_len = 0;
5588
5589         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5590 }
5591
5592 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5593                                          struct sk_buff *skb)
5594 {
5595         u8 num_reports = skb->data[0];
5596         void *ptr = &skb->data[1];
5597
5598         hci_dev_lock(hdev);
5599
5600         while (num_reports--) {
5601                 struct hci_ev_le_direct_adv_info *ev = ptr;
5602
5603                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5604                                    ev->bdaddr_type, &ev->direct_addr,
5605                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5606
5607                 ptr += sizeof(*ev);
5608         }
5609
5610         hci_dev_unlock(hdev);
5611 }
5612
5613 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5614 {
5615         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5616
5617         skb_pull(skb, sizeof(*le_ev));
5618
5619         switch (le_ev->subevent) {
5620         case HCI_EV_LE_CONN_COMPLETE:
5621                 hci_le_conn_complete_evt(hdev, skb);
5622                 break;
5623
5624         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5625                 hci_le_conn_update_complete_evt(hdev, skb);
5626                 break;
5627
5628         case HCI_EV_LE_ADVERTISING_REPORT:
5629                 hci_le_adv_report_evt(hdev, skb);
5630                 break;
5631
5632         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5633                 hci_le_remote_feat_complete_evt(hdev, skb);
5634                 break;
5635
5636         case HCI_EV_LE_LTK_REQ:
5637                 hci_le_ltk_request_evt(hdev, skb);
5638                 break;
5639
5640         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5641                 hci_le_remote_conn_param_req_evt(hdev, skb);
5642                 break;
5643
5644         case HCI_EV_LE_DIRECT_ADV_REPORT:
5645                 hci_le_direct_adv_report_evt(hdev, skb);
5646                 break;
5647
5648         case HCI_EV_LE_EXT_ADV_REPORT:
5649                 hci_le_ext_adv_report_evt(hdev, skb);
5650                 break;
5651
5652         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5653                 hci_le_enh_conn_complete_evt(hdev, skb);
5654                 break;
5655
5656         case HCI_EV_LE_EXT_ADV_SET_TERM:
5657                 hci_le_ext_adv_term_evt(hdev, skb);
5658                 break;
5659
5660         default:
5661                 break;
5662         }
5663 }
5664
5665 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5666                                  u8 event, struct sk_buff *skb)
5667 {
5668         struct hci_ev_cmd_complete *ev;
5669         struct hci_event_hdr *hdr;
5670
5671         if (!skb)
5672                 return false;
5673
5674         if (skb->len < sizeof(*hdr)) {
5675                 bt_dev_err(hdev, "too short HCI event");
5676                 return false;
5677         }
5678
5679         hdr = (void *) skb->data;
5680         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5681
5682         if (event) {
5683                 if (hdr->evt != event)
5684                         return false;
5685                 return true;
5686         }
5687
5688         /* Check if request ended in Command Status - no way to retreive
5689          * any extra parameters in this case.
5690          */
5691         if (hdr->evt == HCI_EV_CMD_STATUS)
5692                 return false;
5693
5694         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5695                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5696                            hdr->evt);
5697                 return false;
5698         }
5699
5700         if (skb->len < sizeof(*ev)) {
5701                 bt_dev_err(hdev, "too short cmd_complete event");
5702                 return false;
5703         }
5704
5705         ev = (void *) skb->data;
5706         skb_pull(skb, sizeof(*ev));
5707
5708         if (opcode != __le16_to_cpu(ev->opcode)) {
5709                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5710                        __le16_to_cpu(ev->opcode));
5711                 return false;
5712         }
5713
5714         return true;
5715 }
5716
5717 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5718 {
5719         struct hci_event_hdr *hdr = (void *) skb->data;
5720         hci_req_complete_t req_complete = NULL;
5721         hci_req_complete_skb_t req_complete_skb = NULL;
5722         struct sk_buff *orig_skb = NULL;
5723         u8 status = 0, event = hdr->evt, req_evt = 0;
5724         u16 opcode = HCI_OP_NOP;
5725
5726         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5727                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5728                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5729                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5730                                      &req_complete_skb);
5731                 req_evt = event;
5732         }
5733
5734         /* If it looks like we might end up having to call
5735          * req_complete_skb, store a pristine copy of the skb since the
5736          * various handlers may modify the original one through
5737          * skb_pull() calls, etc.
5738          */
5739         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5740             event == HCI_EV_CMD_COMPLETE)
5741                 orig_skb = skb_clone(skb, GFP_KERNEL);
5742
5743         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5744
5745         switch (event) {
5746         case HCI_EV_INQUIRY_COMPLETE:
5747                 hci_inquiry_complete_evt(hdev, skb);
5748                 break;
5749
5750         case HCI_EV_INQUIRY_RESULT:
5751                 hci_inquiry_result_evt(hdev, skb);
5752                 break;
5753
5754         case HCI_EV_CONN_COMPLETE:
5755                 hci_conn_complete_evt(hdev, skb);
5756                 break;
5757
5758         case HCI_EV_CONN_REQUEST:
5759                 hci_conn_request_evt(hdev, skb);
5760                 break;
5761
5762         case HCI_EV_DISCONN_COMPLETE:
5763                 hci_disconn_complete_evt(hdev, skb);
5764                 break;
5765
5766         case HCI_EV_AUTH_COMPLETE:
5767                 hci_auth_complete_evt(hdev, skb);
5768                 break;
5769
5770         case HCI_EV_REMOTE_NAME:
5771                 hci_remote_name_evt(hdev, skb);
5772                 break;
5773
5774         case HCI_EV_ENCRYPT_CHANGE:
5775                 hci_encrypt_change_evt(hdev, skb);
5776                 break;
5777
5778         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5779                 hci_change_link_key_complete_evt(hdev, skb);
5780                 break;
5781
5782         case HCI_EV_REMOTE_FEATURES:
5783                 hci_remote_features_evt(hdev, skb);
5784                 break;
5785
5786         case HCI_EV_CMD_COMPLETE:
5787                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5788                                      &req_complete, &req_complete_skb);
5789                 break;
5790
5791         case HCI_EV_CMD_STATUS:
5792                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5793                                    &req_complete_skb);
5794                 break;
5795
5796         case HCI_EV_HARDWARE_ERROR:
5797                 hci_hardware_error_evt(hdev, skb);
5798                 break;
5799
5800         case HCI_EV_ROLE_CHANGE:
5801                 hci_role_change_evt(hdev, skb);
5802                 break;
5803
5804         case HCI_EV_NUM_COMP_PKTS:
5805                 hci_num_comp_pkts_evt(hdev, skb);
5806                 break;
5807
5808         case HCI_EV_MODE_CHANGE:
5809                 hci_mode_change_evt(hdev, skb);
5810                 break;
5811
5812         case HCI_EV_PIN_CODE_REQ:
5813                 hci_pin_code_request_evt(hdev, skb);
5814                 break;
5815
5816         case HCI_EV_LINK_KEY_REQ:
5817                 hci_link_key_request_evt(hdev, skb);
5818                 break;
5819
5820         case HCI_EV_LINK_KEY_NOTIFY:
5821                 hci_link_key_notify_evt(hdev, skb);
5822                 break;
5823
5824         case HCI_EV_CLOCK_OFFSET:
5825                 hci_clock_offset_evt(hdev, skb);
5826                 break;
5827
5828         case HCI_EV_PKT_TYPE_CHANGE:
5829                 hci_pkt_type_change_evt(hdev, skb);
5830                 break;
5831
5832         case HCI_EV_PSCAN_REP_MODE:
5833                 hci_pscan_rep_mode_evt(hdev, skb);
5834                 break;
5835
5836         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5837                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5838                 break;
5839
5840         case HCI_EV_REMOTE_EXT_FEATURES:
5841                 hci_remote_ext_features_evt(hdev, skb);
5842                 break;
5843
5844         case HCI_EV_SYNC_CONN_COMPLETE:
5845                 hci_sync_conn_complete_evt(hdev, skb);
5846                 break;
5847
5848         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5849                 hci_extended_inquiry_result_evt(hdev, skb);
5850                 break;
5851
5852         case HCI_EV_KEY_REFRESH_COMPLETE:
5853                 hci_key_refresh_complete_evt(hdev, skb);
5854                 break;
5855
5856         case HCI_EV_IO_CAPA_REQUEST:
5857                 hci_io_capa_request_evt(hdev, skb);
5858                 break;
5859
5860         case HCI_EV_IO_CAPA_REPLY:
5861                 hci_io_capa_reply_evt(hdev, skb);
5862                 break;
5863
5864         case HCI_EV_USER_CONFIRM_REQUEST:
5865                 hci_user_confirm_request_evt(hdev, skb);
5866                 break;
5867
5868         case HCI_EV_USER_PASSKEY_REQUEST:
5869                 hci_user_passkey_request_evt(hdev, skb);
5870                 break;
5871
5872         case HCI_EV_USER_PASSKEY_NOTIFY:
5873                 hci_user_passkey_notify_evt(hdev, skb);
5874                 break;
5875
5876         case HCI_EV_KEYPRESS_NOTIFY:
5877                 hci_keypress_notify_evt(hdev, skb);
5878                 break;
5879
5880         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5881                 hci_simple_pair_complete_evt(hdev, skb);
5882                 break;
5883
5884         case HCI_EV_REMOTE_HOST_FEATURES:
5885                 hci_remote_host_features_evt(hdev, skb);
5886                 break;
5887
5888         case HCI_EV_LE_META:
5889                 hci_le_meta_evt(hdev, skb);
5890                 break;
5891
5892         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5893                 hci_remote_oob_data_request_evt(hdev, skb);
5894                 break;
5895
5896 #if IS_ENABLED(CONFIG_BT_HS)
5897         case HCI_EV_CHANNEL_SELECTED:
5898                 hci_chan_selected_evt(hdev, skb);
5899                 break;
5900
5901         case HCI_EV_PHY_LINK_COMPLETE:
5902                 hci_phy_link_complete_evt(hdev, skb);
5903                 break;
5904
5905         case HCI_EV_LOGICAL_LINK_COMPLETE:
5906                 hci_loglink_complete_evt(hdev, skb);
5907                 break;
5908
5909         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5910                 hci_disconn_loglink_complete_evt(hdev, skb);
5911                 break;
5912
5913         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5914                 hci_disconn_phylink_complete_evt(hdev, skb);
5915                 break;
5916 #endif
5917
5918         case HCI_EV_NUM_COMP_BLOCKS:
5919                 hci_num_comp_blocks_evt(hdev, skb);
5920                 break;
5921
5922         default:
5923                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5924                 break;
5925         }
5926
5927         if (req_complete) {
5928                 req_complete(hdev, status, opcode);
5929         } else if (req_complete_skb) {
5930                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5931                         kfree_skb(orig_skb);
5932                         orig_skb = NULL;
5933                 }
5934                 req_complete_skb(hdev, status, opcode, orig_skb);
5935         }
5936
5937         kfree_skb(orig_skb);
5938         kfree_skb(skb);
5939         hdev->stat.evt_rx++;
5940 }