net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "a2mp.h"
  34 #include "amp.h"
  35 #include "smp.h"
  36
  37 /* Handle HCI Event packets */
  38
  39 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  40 {
  41         __u8 status = *((__u8 *) skb->data);
  42
  43         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  44
  45         if (status)
  46                 return;
  47
  48         clear_bit(HCI_INQUIRY, &hdev->flags);
  49         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  50         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  51
  52         hci_dev_lock(hdev);
  53         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  54         hci_dev_unlock(hdev);
  55
  56         hci_conn_check_pending(hdev);
  57 }
  58
  59 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  60 {
  61         __u8 status = *((__u8 *) skb->data);
  62
  63         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  64
  65         if (status)
  66                 return;
  67
  68         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  69 }
  70
  71 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  72 {
  73         __u8 status = *((__u8 *) skb->data);
  74
  75         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  76
  77         if (status)
  78                 return;
  79
  80         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  86                                           struct sk_buff *skb)
  87 {
  88         BT_DBG("%s", hdev->name);
  89 }
  90
  91 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  92 {
  93         struct hci_rp_role_discovery *rp = (void *) skb->data;
  94         struct hci_conn *conn;
  95
  96         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  97
  98         if (rp->status)
  99                 return;
 100
 101         hci_dev_lock(hdev);
 102
 103         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 104         if (conn) {
 105                 if (rp->role)
 106                         clear_bit(HCI_CONN_MASTER, &conn->flags);
 107                 else
 108                         set_bit(HCI_CONN_MASTER, &conn->flags);
 109         }
 110
 111         hci_dev_unlock(hdev);
 112 }
 113
 114 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 115 {
 116         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 117         struct hci_conn *conn;
 118
 119         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 120
 121         if (rp->status)
 122                 return;
 123
 124         hci_dev_lock(hdev);
 125
 126         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 127         if (conn)
 128                 conn->link_policy = __le16_to_cpu(rp->policy);
 129
 130         hci_dev_unlock(hdev);
 131 }
 132
 133 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 134 {
 135         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 136         struct hci_conn *conn;
 137         void *sent;
 138
 139         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 140
 141         if (rp->status)
 142                 return;
 143
 144         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 145         if (!sent)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = get_unaligned_le16(sent + 2);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 158                                         struct sk_buff *skb)
 159 {
 160         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 161
 162         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 163
 164         if (rp->status)
 165                 return;
 166
 167         hdev->link_policy = __le16_to_cpu(rp->policy);
 168 }
 169
 170 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 171                                          struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184 }
 185
 186 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 187 {
 188         __u8 status = *((__u8 *) skb->data);
 189
 190         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 191
 192         clear_bit(HCI_RESET, &hdev->flags);
 193
 194         /* Reset all non-persistent flags */
 195         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 196
 197         hdev->discovery.state = DISCOVERY_STOPPED;
 198         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 199         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 200
 201         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 202         hdev->adv_data_len = 0;
 203
 204         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 205         hdev->scan_rsp_data_len = 0;
 206
 207         hdev->le_scan_type = LE_SCAN_PASSIVE;
 208
 209         hdev->ssp_debug_mode = 0;
 210 }
 211
 212 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 213 {
 214         __u8 status = *((__u8 *) skb->data);
 215         void *sent;
 216
 217         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 218
 219         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 220         if (!sent)
 221                 return;
 222
 223         hci_dev_lock(hdev);
 224
 225         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 226                 mgmt_set_local_name_complete(hdev, sent, status);
 227         else if (!status)
 228                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 229
 230         hci_dev_unlock(hdev);
 231 }
 232
 233 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 234 {
 235         struct hci_rp_read_local_name *rp = (void *) skb->data;
 236
 237         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 238
 239         if (rp->status)
 240                 return;
 241
 242         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 243                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 244 }
 245
 246 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 247 {
 248         __u8 status = *((__u8 *) skb->data);
 249         void *sent;
 250
 251         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 254         if (!sent)
 255                 return;
 256
 257         if (!status) {
 258                 __u8 param = *((__u8 *) sent);
 259
 260                 if (param == AUTH_ENABLED)
 261                         set_bit(HCI_AUTH, &hdev->flags);
 262                 else
 263                         clear_bit(HCI_AUTH, &hdev->flags);
 264         }
 265
 266         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 267                 mgmt_auth_enable_complete(hdev, status);
 268 }
 269
 270 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 271 {
 272         __u8 status = *((__u8 *) skb->data);
 273         void *sent;
 274
 275         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 276
 277         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 278         if (!sent)
 279                 return;
 280
 281         if (!status) {
 282                 __u8 param = *((__u8 *) sent);
 283
 284                 if (param)
 285                         set_bit(HCI_ENCRYPT, &hdev->flags);
 286                 else
 287                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 288         }
 289 }
 290
 291 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 292 {
 293         __u8 param, status = *((__u8 *) skb->data);
 294         int old_pscan, old_iscan;
 295         void *sent;
 296
 297         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 298
 299         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 300         if (!sent)
 301                 return;
 302
 303         param = *((__u8 *) sent);
 304
 305         hci_dev_lock(hdev);
 306
 307         if (status) {
 308                 mgmt_write_scan_failed(hdev, param, status);
 309                 hdev->discov_timeout = 0;
 310                 goto done;
 311         }
 312
 313         /* We need to ensure that we set this back on if someone changed
 314          * the scan mode through a raw HCI socket.
 315          */
 316         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 317
 318         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 319         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 320
 321         if (param & SCAN_INQUIRY) {
 322                 set_bit(HCI_ISCAN, &hdev->flags);
 323                 if (!old_iscan)
 324                         mgmt_discoverable(hdev, 1);
 325         } else if (old_iscan)
 326                 mgmt_discoverable(hdev, 0);
 327
 328         if (param & SCAN_PAGE) {
 329                 set_bit(HCI_PSCAN, &hdev->flags);
 330                 if (!old_pscan)
 331                         mgmt_connectable(hdev, 1);
 332         } else if (old_pscan)
 333                 mgmt_connectable(hdev, 0);
 334
 335 done:
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 342
 343         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 344
 345         if (rp->status)
 346                 return;
 347
 348         memcpy(hdev->dev_class, rp->dev_class, 3);
 349
 350         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 351                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 352 }
 353
 354 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 355 {
 356         __u8 status = *((__u8 *) skb->data);
 357         void *sent;
 358
 359         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 360
 361         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 362         if (!sent)
 363                 return;
 364
 365         hci_dev_lock(hdev);
 366
 367         if (status == 0)
 368                 memcpy(hdev->dev_class, sent, 3);
 369
 370         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 371                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 372
 373         hci_dev_unlock(hdev);
 374 }
 375
 376 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 377 {
 378         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 379         __u16 setting;
 380
 381         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 382
 383         if (rp->status)
 384                 return;
 385
 386         setting = __le16_to_cpu(rp->voice_setting);
 387
 388         if (hdev->voice_setting == setting)
 389                 return;
 390
 391         hdev->voice_setting = setting;
 392
 393         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 394
 395         if (hdev->notify)
 396                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 397 }
 398
 399 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 400                                        struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *) skb->data);
 403         __u16 setting;
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 412         if (!sent)
 413                 return;
 414
 415         setting = get_unaligned_le16(sent);
 416
 417         if (hdev->voice_setting == setting)
 418                 return;
 419
 420         hdev->voice_setting = setting;
 421
 422         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 423
 424         if (hdev->notify)
 425                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 426 }
 427
 428 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 429                                           struct sk_buff *skb)
 430 {
 431         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 432
 433         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 434
 435         if (rp->status)
 436                 return;
 437
 438         hdev->num_iac = rp->num_iac;
 439
 440         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 441 }
 442
 443 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 444 {
 445         __u8 status = *((__u8 *) skb->data);
 446         struct hci_cp_write_ssp_mode *sent;
 447
 448         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 449
 450         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 451         if (!sent)
 452                 return;
 453
 454         if (!status) {
 455                 if (sent->mode)
 456                         hdev->features[1][0] |= LMP_HOST_SSP;
 457                 else
 458                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 459         }
 460
 461         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 462                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 463         else if (!status) {
 464                 if (sent->mode)
 465                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 466                 else
 467                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 468         }
 469 }
 470
 471 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 472 {
 473         u8 status = *((u8 *) skb->data);
 474         struct hci_cp_write_sc_support *sent;
 475
 476         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 477
 478         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 479         if (!sent)
 480                 return;
 481
 482         if (!status) {
 483                 if (sent->support)
 484                         hdev->features[1][0] |= LMP_HOST_SC;
 485                 else
 486                         hdev->features[1][0] &= ~LMP_HOST_SC;
 487         }
 488
 489         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 490                 mgmt_sc_enable_complete(hdev, sent->support, status);
 491         else if (!status) {
 492                 if (sent->support)
 493                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 494                 else
 495                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 496         }
 497 }
 498
 499 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 500 {
 501         struct hci_rp_read_local_version *rp = (void *) skb->data;
 502
 503         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 504
 505         if (rp->status)
 506                 return;
 507
 508         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
 509                 hdev->hci_ver = rp->hci_ver;
 510                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 511                 hdev->lmp_ver = rp->lmp_ver;
 512                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 513                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 514         }
 515 }
 516
 517 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 518                                        struct sk_buff *skb)
 519 {
 520         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 521
 522         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 523
 524         if (rp->status)
 525                 return;
 526
 527         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 528                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 529 }
 530
 531 static void hci_cc_read_local_features(struct hci_dev *hdev,
 532                                        struct sk_buff *skb)
 533 {
 534         struct hci_rp_read_local_features *rp = (void *) skb->data;
 535
 536         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 537
 538         if (rp->status)
 539                 return;
 540
 541         memcpy(hdev->features, rp->features, 8);
 542
 543         /* Adjust default settings according to features
 544          * supported by device. */
 545
 546         if (hdev->features[0][0] & LMP_3SLOT)
 547                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 548
 549         if (hdev->features[0][0] & LMP_5SLOT)
 550                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 551
 552         if (hdev->features[0][1] & LMP_HV2) {
 553                 hdev->pkt_type  |= (HCI_HV2);
 554                 hdev->esco_type |= (ESCO_HV2);
 555         }
 556
 557         if (hdev->features[0][1] & LMP_HV3) {
 558                 hdev->pkt_type  |= (HCI_HV3);
 559                 hdev->esco_type |= (ESCO_HV3);
 560         }
 561
 562         if (lmp_esco_capable(hdev))
 563                 hdev->esco_type |= (ESCO_EV3);
 564
 565         if (hdev->features[0][4] & LMP_EV4)
 566                 hdev->esco_type |= (ESCO_EV4);
 567
 568         if (hdev->features[0][4] & LMP_EV5)
 569                 hdev->esco_type |= (ESCO_EV5);
 570
 571         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 572                 hdev->esco_type |= (ESCO_2EV3);
 573
 574         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 575                 hdev->esco_type |= (ESCO_3EV3);
 576
 577         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 578                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 579 }
 580
 581 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 582                                            struct sk_buff *skb)
 583 {
 584         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 585
 586         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 587
 588         if (rp->status)
 589                 return;
 590
 591         if (hdev->max_page < rp->max_page)
 592                 hdev->max_page = rp->max_page;
 593
 594         if (rp->page < HCI_MAX_PAGES)
 595                 memcpy(hdev->features[rp->page], rp->features, 8);
 596 }
 597
 598 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 599                                           struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 602
 603         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 604
 605         if (!rp->status)
 606                 hdev->flow_ctl_mode = rp->mode;
 607 }
 608
 609 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 610 {
 611         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 612
 613         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 614
 615         if (rp->status)
 616                 return;
 617
 618         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 619         hdev->sco_mtu  = rp->sco_mtu;
 620         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 621         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 622
 623         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 624                 hdev->sco_mtu  = 64;
 625                 hdev->sco_pkts = 8;
 626         }
 627
 628         hdev->acl_cnt = hdev->acl_pkts;
 629         hdev->sco_cnt = hdev->sco_pkts;
 630
 631         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 632                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 633 }
 634
 635 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 636 {
 637         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 638
 639         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 640
 641         if (!rp->status)
 642                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 643 }
 644
 645 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 646                                            struct sk_buff *skb)
 647 {
 648         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 649
 650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 651
 652         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
 653                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 654                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 655         }
 656 }
 657
 658 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 659                                             struct sk_buff *skb)
 660 {
 661         u8 status = *((u8 *) skb->data);
 662         struct hci_cp_write_page_scan_activity *sent;
 663
 664         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 665
 666         if (status)
 667                 return;
 668
 669         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 670         if (!sent)
 671                 return;
 672
 673         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 674         hdev->page_scan_window = __le16_to_cpu(sent->window);
 675 }
 676
 677 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 678                                            struct sk_buff *skb)
 679 {
 680         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 681
 682         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 683
 684         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
 685                 hdev->page_scan_type = rp->type;
 686 }
 687
 688 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 689                                         struct sk_buff *skb)
 690 {
 691         u8 status = *((u8 *) skb->data);
 692         u8 *type;
 693
 694         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 695
 696         if (status)
 697                 return;
 698
 699         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 700         if (type)
 701                 hdev->page_scan_type = *type;
 702 }
 703
 704 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 705                                         struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 715         hdev->block_len = __le16_to_cpu(rp->block_len);
 716         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 717
 718         hdev->block_cnt = hdev->num_blocks;
 719
 720         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 721                hdev->block_cnt, hdev->block_len);
 722 }
 723
 724 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 725 {
 726         struct hci_rp_read_clock *rp = (void *) skb->data;
 727         struct hci_cp_read_clock *cp;
 728         struct hci_conn *conn;
 729
 730         BT_DBG("%s", hdev->name);
 731
 732         if (skb->len < sizeof(*rp))
 733                 return;
 734
 735         if (rp->status)
 736                 return;
 737
 738         hci_dev_lock(hdev);
 739
 740         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 741         if (!cp)
 742                 goto unlock;
 743
 744         if (cp->which == 0x00) {
 745                 hdev->clock = le32_to_cpu(rp->clock);
 746                 goto unlock;
 747         }
 748
 749         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 750         if (conn) {
 751                 conn->clock = le32_to_cpu(rp->clock);
 752                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 753         }
 754
 755 unlock:
 756         hci_dev_unlock(hdev);
 757 }
 758
 759 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 760                                        struct sk_buff *skb)
 761 {
 762         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 763
 764         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 765
 766         if (rp->status)
 767                 goto a2mp_rsp;
 768
 769         hdev->amp_status = rp->amp_status;
 770         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 771         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 772         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 773         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 774         hdev->amp_type = rp->amp_type;
 775         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 776         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 777         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 778         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 779
 780 a2mp_rsp:
 781         a2mp_send_getinfo_rsp(hdev);
 782 }
 783
 784 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 788         struct amp_assoc *assoc = &hdev->loc_assoc;
 789         size_t rem_len, frag_len;
 790
 791         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 792
 793         if (rp->status)
 794                 goto a2mp_rsp;
 795
 796         frag_len = skb->len - sizeof(*rp);
 797         rem_len = __le16_to_cpu(rp->rem_len);
 798
 799         if (rem_len > frag_len) {
 800                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 801
 802                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 803                 assoc->offset += frag_len;
 804
 805                 /* Read other fragments */
 806                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 807
 808                 return;
 809         }
 810
 811         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 812         assoc->len = assoc->offset + rem_len;
 813         assoc->offset = 0;
 814
 815 a2mp_rsp:
 816         /* Send A2MP Rsp when all fragments are received */
 817         a2mp_send_getampassoc_rsp(hdev, rp->status);
 818         a2mp_send_create_phy_link_req(hdev, rp->status);
 819 }
 820
 821 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 822                                          struct sk_buff *skb)
 823 {
 824         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 825
 826         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 827
 828         if (!rp->status)
 829                 hdev->inq_tx_power = rp->tx_power;
 830 }
 831
 832 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 833 {
 834         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 835         struct hci_cp_pin_code_reply *cp;
 836         struct hci_conn *conn;
 837
 838         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 839
 840         hci_dev_lock(hdev);
 841
 842         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 843                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 844
 845         if (rp->status)
 846                 goto unlock;
 847
 848         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 849         if (!cp)
 850                 goto unlock;
 851
 852         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 853         if (conn)
 854                 conn->pin_length = cp->pin_len;
 855
 856 unlock:
 857         hci_dev_unlock(hdev);
 858 }
 859
 860 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 861 {
 862         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 863
 864         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 865
 866         hci_dev_lock(hdev);
 867
 868         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 869                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 870                                                  rp->status);
 871
 872         hci_dev_unlock(hdev);
 873 }
 874
 875 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 876                                        struct sk_buff *skb)
 877 {
 878         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 879
 880         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 881
 882         if (rp->status)
 883                 return;
 884
 885         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 886         hdev->le_pkts = rp->le_max_pkt;
 887
 888         hdev->le_cnt = hdev->le_pkts;
 889
 890         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 891 }
 892
 893 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 894                                           struct sk_buff *skb)
 895 {
 896         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 897
 898         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 899
 900         if (!rp->status)
 901                 memcpy(hdev->le_features, rp->features, 8);
 902 }
 903
 904 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 905                                         struct sk_buff *skb)
 906 {
 907         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 908
 909         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 910
 911         if (!rp->status)
 912                 hdev->adv_tx_power = rp->tx_power;
 913 }
 914
 915 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 916 {
 917         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 918
 919         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 920
 921         hci_dev_lock(hdev);
 922
 923         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 924                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 925                                                  rp->status);
 926
 927         hci_dev_unlock(hdev);
 928 }
 929
 930 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 931                                           struct sk_buff *skb)
 932 {
 933         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 934
 935         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 936
 937         hci_dev_lock(hdev);
 938
 939         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 940                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 941                                                      ACL_LINK, 0, rp->status);
 942
 943         hci_dev_unlock(hdev);
 944 }
 945
 946 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 947 {
 948         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 949
 950         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 951
 952         hci_dev_lock(hdev);
 953
 954         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 955                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 956                                                  0, rp->status);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 962                                           struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 971                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 972                                                      ACL_LINK, 0, rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
 978                                        struct sk_buff *skb)
 979 {
 980         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 981
 982         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 983
 984         hci_dev_lock(hdev);
 985         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->randomizer,
 986                                           NULL, NULL, rp->status);
 987         hci_dev_unlock(hdev);
 988 }
 989
 990 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
 991                                            struct sk_buff *skb)
 992 {
 993         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
 994
 995         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 996
 997         hci_dev_lock(hdev);
 998         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->randomizer192,
 999                                           rp->hash256, rp->randomizer256,
1000                                           rp->status);
1001         hci_dev_unlock(hdev);
1002 }
1003
1004
1005 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1006 {
1007         __u8 status = *((__u8 *) skb->data);
1008         bdaddr_t *sent;
1009
1010         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1011
1012         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1013         if (!sent)
1014                 return;
1015
1016         hci_dev_lock(hdev);
1017
1018         if (!status)
1019                 bacpy(&hdev->random_addr, sent);
1020
1021         hci_dev_unlock(hdev);
1022 }
1023
1024 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1025 {
1026         __u8 *sent, status = *((__u8 *) skb->data);
1027
1028         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1029
1030         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1031         if (!sent)
1032                 return;
1033
1034         if (status)
1035                 return;
1036
1037         hci_dev_lock(hdev);
1038
1039         /* If we're doing connection initation as peripheral. Set a
1040          * timeout in case something goes wrong.
1041          */
1042         if (*sent) {
1043                 struct hci_conn *conn;
1044
1045                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1046                 if (conn)
1047                         queue_delayed_work(hdev->workqueue,
1048                                            &conn->le_conn_timeout,
1049                                            HCI_LE_CONN_TIMEOUT);
1050         }
1051
1052         mgmt_advertising(hdev, *sent);
1053
1054         hci_dev_unlock(hdev);
1055 }
1056
1057 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1058 {
1059         struct hci_cp_le_set_scan_param *cp;
1060         __u8 status = *((__u8 *) skb->data);
1061
1062         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1063
1064         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1065         if (!cp)
1066                 return;
1067
1068         hci_dev_lock(hdev);
1069
1070         if (!status)
1071                 hdev->le_scan_type = cp->type;
1072
1073         hci_dev_unlock(hdev);
1074 }
1075
1076 static bool has_pending_adv_report(struct hci_dev *hdev)
1077 {
1078         struct discovery_state *d = &hdev->discovery;
1079
1080         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1081 }
1082
1083 static void clear_pending_adv_report(struct hci_dev *hdev)
1084 {
1085         struct discovery_state *d = &hdev->discovery;
1086
1087         bacpy(&d->last_adv_addr, BDADDR_ANY);
1088         d->last_adv_data_len = 0;
1089 }
1090
1091 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1092                                      u8 bdaddr_type, s8 rssi, u32 flags,
1093                                      u8 *data, u8 len)
1094 {
1095         struct discovery_state *d = &hdev->discovery;
1096
1097         bacpy(&d->last_adv_addr, bdaddr);
1098         d->last_adv_addr_type = bdaddr_type;
1099         d->last_adv_rssi = rssi;
1100         d->last_adv_flags = flags;
1101         memcpy(d->last_adv_data, data, len);
1102         d->last_adv_data_len = len;
1103 }
1104
1105 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1106                                       struct sk_buff *skb)
1107 {
1108         struct hci_cp_le_set_scan_enable *cp;
1109         __u8 status = *((__u8 *) skb->data);
1110
1111         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1112
1113         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1114         if (!cp)
1115                 return;
1116
1117         if (status)
1118                 return;
1119
1120         switch (cp->enable) {
1121         case LE_SCAN_ENABLE:
1122                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1123                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1124                         clear_pending_adv_report(hdev);
1125                 break;
1126
1127         case LE_SCAN_DISABLE:
1128                 /* We do this here instead of when setting DISCOVERY_STOPPED
1129                  * since the latter would potentially require waiting for
1130                  * inquiry to stop too.
1131                  */
1132                 if (has_pending_adv_report(hdev)) {
1133                         struct discovery_state *d = &hdev->discovery;
1134
1135                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1136                                           d->last_adv_addr_type, NULL,
1137                                           d->last_adv_rssi, d->last_adv_flags,
1138                                           d->last_adv_data,
1139                                           d->last_adv_data_len, NULL, 0);
1140                 }
1141
1142                 /* Cancel this timer so that we don't try to disable scanning
1143                  * when it's already disabled.
1144                  */
1145                 cancel_delayed_work(&hdev->le_scan_disable);
1146
1147                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1148                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1149                  * interrupted scanning due to a connect request. Mark
1150                  * therefore discovery as stopped.
1151                  */
1152                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1153                                        &hdev->dev_flags))
1154                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1155                 break;
1156
1157         default:
1158                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1159                 break;
1160         }
1161 }
1162
1163 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1164                                            struct sk_buff *skb)
1165 {
1166         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1167
1168         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1169
1170         if (!rp->status)
1171                 hdev->le_white_list_size = rp->size;
1172 }
1173
1174 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1175                                        struct sk_buff *skb)
1176 {
1177         __u8 status = *((__u8 *) skb->data);
1178
1179         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1180
1181         if (!status)
1182                 hci_white_list_clear(hdev);
1183 }
1184
1185 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1186                                         struct sk_buff *skb)
1187 {
1188         struct hci_cp_le_add_to_white_list *sent;
1189         __u8 status = *((__u8 *) skb->data);
1190
1191         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1192
1193         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1194         if (!sent)
1195                 return;
1196
1197         if (!status)
1198                 hci_white_list_add(hdev, &sent->bdaddr, sent->bdaddr_type);
1199 }
1200
1201 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1202                                           struct sk_buff *skb)
1203 {
1204         struct hci_cp_le_del_from_white_list *sent;
1205         __u8 status = *((__u8 *) skb->data);
1206
1207         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1208
1209         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1210         if (!sent)
1211                 return;
1212
1213         if (!status)
1214                 hci_white_list_del(hdev, &sent->bdaddr, sent->bdaddr_type);
1215 }
1216
1217 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1218                                             struct sk_buff *skb)
1219 {
1220         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1221
1222         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1223
1224         if (!rp->status)
1225                 memcpy(hdev->le_states, rp->le_states, 8);
1226 }
1227
1228 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1229                                            struct sk_buff *skb)
1230 {
1231         struct hci_cp_write_le_host_supported *sent;
1232         __u8 status = *((__u8 *) skb->data);
1233
1234         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1235
1236         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1237         if (!sent)
1238                 return;
1239
1240         if (!status) {
1241                 if (sent->le) {
1242                         hdev->features[1][0] |= LMP_HOST_LE;
1243                         set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1244                 } else {
1245                         hdev->features[1][0] &= ~LMP_HOST_LE;
1246                         clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1247                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1248                 }
1249
1250                 if (sent->simul)
1251                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1252                 else
1253                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1254         }
1255 }
1256
1257 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1258 {
1259         struct hci_cp_le_set_adv_param *cp;
1260         u8 status = *((u8 *) skb->data);
1261
1262         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1263
1264         if (status)
1265                 return;
1266
1267         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1268         if (!cp)
1269                 return;
1270
1271         hci_dev_lock(hdev);
1272         hdev->adv_addr_type = cp->own_address_type;
1273         hci_dev_unlock(hdev);
1274 }
1275
1276 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1277                                           struct sk_buff *skb)
1278 {
1279         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1280
1281         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1282                hdev->name, rp->status, rp->phy_handle);
1283
1284         if (rp->status)
1285                 return;
1286
1287         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1288 }
1289
1290 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1291 {
1292         struct hci_rp_read_rssi *rp = (void *) skb->data;
1293         struct hci_conn *conn;
1294
1295         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1296
1297         if (rp->status)
1298                 return;
1299
1300         hci_dev_lock(hdev);
1301
1302         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1303         if (conn)
1304                 conn->rssi = rp->rssi;
1305
1306         hci_dev_unlock(hdev);
1307 }
1308
1309 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1310 {
1311         struct hci_cp_read_tx_power *sent;
1312         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1313         struct hci_conn *conn;
1314
1315         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1316
1317         if (rp->status)
1318                 return;
1319
1320         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1321         if (!sent)
1322                 return;
1323
1324         hci_dev_lock(hdev);
1325
1326         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1327         if (!conn)
1328                 goto unlock;
1329
1330         switch (sent->type) {
1331         case 0x00:
1332                 conn->tx_power = rp->tx_power;
1333                 break;
1334         case 0x01:
1335                 conn->max_tx_power = rp->tx_power;
1336                 break;
1337         }
1338
1339 unlock:
1340         hci_dev_unlock(hdev);
1341 }
1342
1343 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1344 {
1345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1346
1347         if (status) {
1348                 hci_conn_check_pending(hdev);
1349                 return;
1350         }
1351
1352         set_bit(HCI_INQUIRY, &hdev->flags);
1353 }
1354
1355 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1356 {
1357         struct hci_cp_create_conn *cp;
1358         struct hci_conn *conn;
1359
1360         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1361
1362         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1363         if (!cp)
1364                 return;
1365
1366         hci_dev_lock(hdev);
1367
1368         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1369
1370         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1371
1372         if (status) {
1373                 if (conn && conn->state == BT_CONNECT) {
1374                         if (status != 0x0c || conn->attempt > 2) {
1375                                 conn->state = BT_CLOSED;
1376                                 hci_proto_connect_cfm(conn, status);
1377                                 hci_conn_del(conn);
1378                         } else
1379                                 conn->state = BT_CONNECT2;
1380                 }
1381         } else {
1382                 if (!conn) {
1383                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1384                         if (conn) {
1385                                 conn->out = true;
1386                                 set_bit(HCI_CONN_MASTER, &conn->flags);
1387                         } else
1388                                 BT_ERR("No memory for new connection");
1389                 }
1390         }
1391
1392         hci_dev_unlock(hdev);
1393 }
1394
1395 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1396 {
1397         struct hci_cp_add_sco *cp;
1398         struct hci_conn *acl, *sco;
1399         __u16 handle;
1400
1401         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1402
1403         if (!status)
1404                 return;
1405
1406         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1407         if (!cp)
1408                 return;
1409
1410         handle = __le16_to_cpu(cp->handle);
1411
1412         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1413
1414         hci_dev_lock(hdev);
1415
1416         acl = hci_conn_hash_lookup_handle(hdev, handle);
1417         if (acl) {
1418                 sco = acl->link;
1419                 if (sco) {
1420                         sco->state = BT_CLOSED;
1421
1422                         hci_proto_connect_cfm(sco, status);
1423                         hci_conn_del(sco);
1424                 }
1425         }
1426
1427         hci_dev_unlock(hdev);
1428 }
1429
1430 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1431 {
1432         struct hci_cp_auth_requested *cp;
1433         struct hci_conn *conn;
1434
1435         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1436
1437         if (!status)
1438                 return;
1439
1440         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1441         if (!cp)
1442                 return;
1443
1444         hci_dev_lock(hdev);
1445
1446         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1447         if (conn) {
1448                 if (conn->state == BT_CONFIG) {
1449                         hci_proto_connect_cfm(conn, status);
1450                         hci_conn_drop(conn);
1451                 }
1452         }
1453
1454         hci_dev_unlock(hdev);
1455 }
1456
1457 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1458 {
1459         struct hci_cp_set_conn_encrypt *cp;
1460         struct hci_conn *conn;
1461
1462         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1463
1464         if (!status)
1465                 return;
1466
1467         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1468         if (!cp)
1469                 return;
1470
1471         hci_dev_lock(hdev);
1472
1473         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1474         if (conn) {
1475                 if (conn->state == BT_CONFIG) {
1476                         hci_proto_connect_cfm(conn, status);
1477                         hci_conn_drop(conn);
1478                 }
1479         }
1480
1481         hci_dev_unlock(hdev);
1482 }
1483
1484 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1485                                     struct hci_conn *conn)
1486 {
1487         if (conn->state != BT_CONFIG || !conn->out)
1488                 return 0;
1489
1490         if (conn->pending_sec_level == BT_SECURITY_SDP)
1491                 return 0;
1492
1493         /* Only request authentication for SSP connections or non-SSP
1494          * devices with sec_level MEDIUM or HIGH or if MITM protection
1495          * is requested.
1496          */
1497         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1498             conn->pending_sec_level != BT_SECURITY_FIPS &&
1499             conn->pending_sec_level != BT_SECURITY_HIGH &&
1500             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1501                 return 0;
1502
1503         return 1;
1504 }
1505
1506 static int hci_resolve_name(struct hci_dev *hdev,
1507                                    struct inquiry_entry *e)
1508 {
1509         struct hci_cp_remote_name_req cp;
1510
1511         memset(&cp, 0, sizeof(cp));
1512
1513         bacpy(&cp.bdaddr, &e->data.bdaddr);
1514         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1515         cp.pscan_mode = e->data.pscan_mode;
1516         cp.clock_offset = e->data.clock_offset;
1517
1518         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1519 }
1520
1521 static bool hci_resolve_next_name(struct hci_dev *hdev)
1522 {
1523         struct discovery_state *discov = &hdev->discovery;
1524         struct inquiry_entry *e;
1525
1526         if (list_empty(&discov->resolve))
1527                 return false;
1528
1529         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1530         if (!e)
1531                 return false;
1532
1533         if (hci_resolve_name(hdev, e) == 0) {
1534                 e->name_state = NAME_PENDING;
1535                 return true;
1536         }
1537
1538         return false;
1539 }
1540
1541 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1542                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1543 {
1544         struct discovery_state *discov = &hdev->discovery;
1545         struct inquiry_entry *e;
1546
1547         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1548                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1549                                       name_len, conn->dev_class);
1550
1551         if (discov->state == DISCOVERY_STOPPED)
1552                 return;
1553
1554         if (discov->state == DISCOVERY_STOPPING)
1555                 goto discov_complete;
1556
1557         if (discov->state != DISCOVERY_RESOLVING)
1558                 return;
1559
1560         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1561         /* If the device was not found in a list of found devices names of which
1562          * are pending. there is no need to continue resolving a next name as it
1563          * will be done upon receiving another Remote Name Request Complete
1564          * Event */
1565         if (!e)
1566                 return;
1567
1568         list_del(&e->list);
1569         if (name) {
1570                 e->name_state = NAME_KNOWN;
1571                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1572                                  e->data.rssi, name, name_len);
1573         } else {
1574                 e->name_state = NAME_NOT_KNOWN;
1575         }
1576
1577         if (hci_resolve_next_name(hdev))
1578                 return;
1579
1580 discov_complete:
1581         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1582 }
1583
1584 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1585 {
1586         struct hci_cp_remote_name_req *cp;
1587         struct hci_conn *conn;
1588
1589         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1590
1591         /* If successful wait for the name req complete event before
1592          * checking for the need to do authentication */
1593         if (!status)
1594                 return;
1595
1596         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1597         if (!cp)
1598                 return;
1599
1600         hci_dev_lock(hdev);
1601
1602         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1603
1604         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1605                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1606
1607         if (!conn)
1608                 goto unlock;
1609
1610         if (!hci_outgoing_auth_needed(hdev, conn))
1611                 goto unlock;
1612
1613         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1614                 struct hci_cp_auth_requested auth_cp;
1615
1616                 auth_cp.handle = __cpu_to_le16(conn->handle);
1617                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1618                              sizeof(auth_cp), &auth_cp);
1619         }
1620
1621 unlock:
1622         hci_dev_unlock(hdev);
1623 }
1624
1625 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1626 {
1627         struct hci_cp_read_remote_features *cp;
1628         struct hci_conn *conn;
1629
1630         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1631
1632         if (!status)
1633                 return;
1634
1635         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1636         if (!cp)
1637                 return;
1638
1639         hci_dev_lock(hdev);
1640
1641         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1642         if (conn) {
1643                 if (conn->state == BT_CONFIG) {
1644                         hci_proto_connect_cfm(conn, status);
1645                         hci_conn_drop(conn);
1646                 }
1647         }
1648
1649         hci_dev_unlock(hdev);
1650 }
1651
1652 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1653 {
1654         struct hci_cp_read_remote_ext_features *cp;
1655         struct hci_conn *conn;
1656
1657         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1658
1659         if (!status)
1660                 return;
1661
1662         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1663         if (!cp)
1664                 return;
1665
1666         hci_dev_lock(hdev);
1667
1668         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1669         if (conn) {
1670                 if (conn->state == BT_CONFIG) {
1671                         hci_proto_connect_cfm(conn, status);
1672                         hci_conn_drop(conn);
1673                 }
1674         }
1675
1676         hci_dev_unlock(hdev);
1677 }
1678
1679 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1680 {
1681         struct hci_cp_setup_sync_conn *cp;
1682         struct hci_conn *acl, *sco;
1683         __u16 handle;
1684
1685         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1686
1687         if (!status)
1688                 return;
1689
1690         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1691         if (!cp)
1692                 return;
1693
1694         handle = __le16_to_cpu(cp->handle);
1695
1696         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1697
1698         hci_dev_lock(hdev);
1699
1700         acl = hci_conn_hash_lookup_handle(hdev, handle);
1701         if (acl) {
1702                 sco = acl->link;
1703                 if (sco) {
1704                         sco->state = BT_CLOSED;
1705
1706                         hci_proto_connect_cfm(sco, status);
1707                         hci_conn_del(sco);
1708                 }
1709         }
1710
1711         hci_dev_unlock(hdev);
1712 }
1713
1714 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1715 {
1716         struct hci_cp_sniff_mode *cp;
1717         struct hci_conn *conn;
1718
1719         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1720
1721         if (!status)
1722                 return;
1723
1724         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1725         if (!cp)
1726                 return;
1727
1728         hci_dev_lock(hdev);
1729
1730         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1731         if (conn) {
1732                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1733
1734                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1735                         hci_sco_setup(conn, status);
1736         }
1737
1738         hci_dev_unlock(hdev);
1739 }
1740
1741 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1742 {
1743         struct hci_cp_exit_sniff_mode *cp;
1744         struct hci_conn *conn;
1745
1746         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1747
1748         if (!status)
1749                 return;
1750
1751         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1752         if (!cp)
1753                 return;
1754
1755         hci_dev_lock(hdev);
1756
1757         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1758         if (conn) {
1759                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1760
1761                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1762                         hci_sco_setup(conn, status);
1763         }
1764
1765         hci_dev_unlock(hdev);
1766 }
1767
1768 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1769 {
1770         struct hci_cp_disconnect *cp;
1771         struct hci_conn *conn;
1772
1773         if (!status)
1774                 return;
1775
1776         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1777         if (!cp)
1778                 return;
1779
1780         hci_dev_lock(hdev);
1781
1782         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1783         if (conn)
1784                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1785                                        conn->dst_type, status);
1786
1787         hci_dev_unlock(hdev);
1788 }
1789
1790 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1791 {
1792         struct hci_cp_create_phy_link *cp;
1793
1794         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1795
1796         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1797         if (!cp)
1798                 return;
1799
1800         hci_dev_lock(hdev);
1801
1802         if (status) {
1803                 struct hci_conn *hcon;
1804
1805                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1806                 if (hcon)
1807                         hci_conn_del(hcon);
1808         } else {
1809                 amp_write_remote_assoc(hdev, cp->phy_handle);
1810         }
1811
1812         hci_dev_unlock(hdev);
1813 }
1814
1815 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1816 {
1817         struct hci_cp_accept_phy_link *cp;
1818
1819         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1820
1821         if (status)
1822                 return;
1823
1824         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1825         if (!cp)
1826                 return;
1827
1828         amp_write_remote_assoc(hdev, cp->phy_handle);
1829 }
1830
1831 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1832 {
1833         struct hci_cp_le_create_conn *cp;
1834         struct hci_conn *conn;
1835
1836         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1837
1838         /* All connection failure handling is taken care of by the
1839          * hci_le_conn_failed function which is triggered by the HCI
1840          * request completion callbacks used for connecting.
1841          */
1842         if (status)
1843                 return;
1844
1845         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1846         if (!cp)
1847                 return;
1848
1849         hci_dev_lock(hdev);
1850
1851         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1852         if (!conn)
1853                 goto unlock;
1854
1855         /* Store the initiator and responder address information which
1856          * is needed for SMP. These values will not change during the
1857          * lifetime of the connection.
1858          */
1859         conn->init_addr_type = cp->own_address_type;
1860         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1861                 bacpy(&conn->init_addr, &hdev->random_addr);
1862         else
1863                 bacpy(&conn->init_addr, &hdev->bdaddr);
1864
1865         conn->resp_addr_type = cp->peer_addr_type;
1866         bacpy(&conn->resp_addr, &cp->peer_addr);
1867
1868         /* We don't want the connection attempt to stick around
1869          * indefinitely since LE doesn't have a page timeout concept
1870          * like BR/EDR. Set a timer for any connection that doesn't use
1871          * the white list for connecting.
1872          */
1873         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1874                 queue_delayed_work(conn->hdev->workqueue,
1875                                    &conn->le_conn_timeout,
1876                                    HCI_LE_CONN_TIMEOUT);
1877
1878 unlock:
1879         hci_dev_unlock(hdev);
1880 }
1881
1882 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1883 {
1884         struct hci_cp_le_start_enc *cp;
1885         struct hci_conn *conn;
1886
1887         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1888
1889         if (!status)
1890                 return;
1891
1892         hci_dev_lock(hdev);
1893
1894         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
1895         if (!cp)
1896                 goto unlock;
1897
1898         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1899         if (!conn)
1900                 goto unlock;
1901
1902         if (conn->state != BT_CONNECTED)
1903                 goto unlock;
1904
1905         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
1906         hci_conn_drop(conn);
1907
1908 unlock:
1909         hci_dev_unlock(hdev);
1910 }
1911
1912 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1913 {
1914         __u8 status = *((__u8 *) skb->data);
1915         struct discovery_state *discov = &hdev->discovery;
1916         struct inquiry_entry *e;
1917
1918         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1919
1920         hci_conn_check_pending(hdev);
1921
1922         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1923                 return;
1924
1925         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
1926         wake_up_bit(&hdev->flags, HCI_INQUIRY);
1927
1928         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1929                 return;
1930
1931         hci_dev_lock(hdev);
1932
1933         if (discov->state != DISCOVERY_FINDING)
1934                 goto unlock;
1935
1936         if (list_empty(&discov->resolve)) {
1937                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1938                 goto unlock;
1939         }
1940
1941         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1942         if (e && hci_resolve_name(hdev, e) == 0) {
1943                 e->name_state = NAME_PENDING;
1944                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1945         } else {
1946                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1947         }
1948
1949 unlock:
1950         hci_dev_unlock(hdev);
1951 }
1952
1953 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1954 {
1955         struct inquiry_data data;
1956         struct inquiry_info *info = (void *) (skb->data + 1);
1957         int num_rsp = *((__u8 *) skb->data);
1958
1959         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1960
1961         if (!num_rsp)
1962                 return;
1963
1964         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1965                 return;
1966
1967         hci_dev_lock(hdev);
1968
1969         for (; num_rsp; num_rsp--, info++) {
1970                 u32 flags;
1971
1972                 bacpy(&data.bdaddr, &info->bdaddr);
1973                 data.pscan_rep_mode     = info->pscan_rep_mode;
1974                 data.pscan_period_mode  = info->pscan_period_mode;
1975                 data.pscan_mode         = info->pscan_mode;
1976                 memcpy(data.dev_class, info->dev_class, 3);
1977                 data.clock_offset       = info->clock_offset;
1978                 data.rssi               = 0x00;
1979                 data.ssp_mode           = 0x00;
1980
1981                 flags = hci_inquiry_cache_update(hdev, &data, false);
1982
1983                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1984                                   info->dev_class, 0, flags, NULL, 0, NULL, 0);
1985         }
1986
1987         hci_dev_unlock(hdev);
1988 }
1989
1990 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1991 {
1992         struct hci_ev_conn_complete *ev = (void *) skb->data;
1993         struct hci_conn *conn;
1994
1995         BT_DBG("%s", hdev->name);
1996
1997         hci_dev_lock(hdev);
1998
1999         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2000         if (!conn) {
2001                 if (ev->link_type != SCO_LINK)
2002                         goto unlock;
2003
2004                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2005                 if (!conn)
2006                         goto unlock;
2007
2008                 conn->type = SCO_LINK;
2009         }
2010
2011         if (!ev->status) {
2012                 conn->handle = __le16_to_cpu(ev->handle);
2013
2014                 if (conn->type == ACL_LINK) {
2015                         conn->state = BT_CONFIG;
2016                         hci_conn_hold(conn);
2017
2018                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2019                             !hci_find_link_key(hdev, &ev->bdaddr))
2020                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2021                         else
2022                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2023                 } else
2024                         conn->state = BT_CONNECTED;
2025
2026                 hci_conn_add_sysfs(conn);
2027
2028                 if (test_bit(HCI_AUTH, &hdev->flags))
2029                         set_bit(HCI_CONN_AUTH, &conn->flags);
2030
2031                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2032                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2033
2034                 /* Get remote features */
2035                 if (conn->type == ACL_LINK) {
2036                         struct hci_cp_read_remote_features cp;
2037                         cp.handle = ev->handle;
2038                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2039                                      sizeof(cp), &cp);
2040                 }
2041
2042                 /* Set packet type for incoming connection */
2043                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2044                         struct hci_cp_change_conn_ptype cp;
2045                         cp.handle = ev->handle;
2046                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2047                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2048                                      &cp);
2049                 }
2050         } else {
2051                 conn->state = BT_CLOSED;
2052                 if (conn->type == ACL_LINK)
2053                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2054                                             conn->dst_type, ev->status);
2055         }
2056
2057         if (conn->type == ACL_LINK)
2058                 hci_sco_setup(conn, ev->status);
2059
2060         if (ev->status) {
2061                 hci_proto_connect_cfm(conn, ev->status);
2062                 hci_conn_del(conn);
2063         } else if (ev->link_type != ACL_LINK)
2064                 hci_proto_connect_cfm(conn, ev->status);
2065
2066 unlock:
2067         hci_dev_unlock(hdev);
2068
2069         hci_conn_check_pending(hdev);
2070 }
2071
2072 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2073 {
2074         struct hci_ev_conn_request *ev = (void *) skb->data;
2075         int mask = hdev->link_mode;
2076         __u8 flags = 0;
2077
2078         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2079                ev->link_type);
2080
2081         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2082                                       &flags);
2083
2084         if ((mask & HCI_LM_ACCEPT) &&
2085             !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
2086                 /* Connection accepted */
2087                 struct inquiry_entry *ie;
2088                 struct hci_conn *conn;
2089
2090                 hci_dev_lock(hdev);
2091
2092                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2093                 if (ie)
2094                         memcpy(ie->data.dev_class, ev->dev_class, 3);
2095
2096                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2097                                                &ev->bdaddr);
2098                 if (!conn) {
2099                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
2100                         if (!conn) {
2101                                 BT_ERR("No memory for new connection");
2102                                 hci_dev_unlock(hdev);
2103                                 return;
2104                         }
2105                 }
2106
2107                 memcpy(conn->dev_class, ev->dev_class, 3);
2108
2109                 hci_dev_unlock(hdev);
2110
2111                 if (ev->link_type == ACL_LINK ||
2112                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2113                         struct hci_cp_accept_conn_req cp;
2114                         conn->state = BT_CONNECT;
2115
2116                         bacpy(&cp.bdaddr, &ev->bdaddr);
2117
2118                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2119                                 cp.role = 0x00; /* Become master */
2120                         else
2121                                 cp.role = 0x01; /* Remain slave */
2122
2123                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
2124                                      &cp);
2125                 } else if (!(flags & HCI_PROTO_DEFER)) {
2126                         struct hci_cp_accept_sync_conn_req cp;
2127                         conn->state = BT_CONNECT;
2128
2129                         bacpy(&cp.bdaddr, &ev->bdaddr);
2130                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2131
2132                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2133                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2134                         cp.max_latency    = cpu_to_le16(0xffff);
2135                         cp.content_format = cpu_to_le16(hdev->voice_setting);
2136                         cp.retrans_effort = 0xff;
2137
2138                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
2139                                      sizeof(cp), &cp);
2140                 } else {
2141                         conn->state = BT_CONNECT2;
2142                         hci_proto_connect_cfm(conn, 0);
2143                 }
2144         } else {
2145                 /* Connection rejected */
2146                 struct hci_cp_reject_conn_req cp;
2147
2148                 bacpy(&cp.bdaddr, &ev->bdaddr);
2149                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2150                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2151         }
2152 }
2153
2154 static u8 hci_to_mgmt_reason(u8 err)
2155 {
2156         switch (err) {
2157         case HCI_ERROR_CONNECTION_TIMEOUT:
2158                 return MGMT_DEV_DISCONN_TIMEOUT;
2159         case HCI_ERROR_REMOTE_USER_TERM:
2160         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2161         case HCI_ERROR_REMOTE_POWER_OFF:
2162                 return MGMT_DEV_DISCONN_REMOTE;
2163         case HCI_ERROR_LOCAL_HOST_TERM:
2164                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2165         default:
2166                 return MGMT_DEV_DISCONN_UNKNOWN;
2167         }
2168 }
2169
2170 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2171 {
2172         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2173         u8 reason = hci_to_mgmt_reason(ev->reason);
2174         struct hci_conn_params *params;
2175         struct hci_conn *conn;
2176         bool mgmt_connected;
2177         u8 type;
2178
2179         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2180
2181         hci_dev_lock(hdev);
2182
2183         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2184         if (!conn)
2185                 goto unlock;
2186
2187         if (ev->status) {
2188                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2189                                        conn->dst_type, ev->status);
2190                 goto unlock;
2191         }
2192
2193         conn->state = BT_CLOSED;
2194
2195         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2196         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2197                                 reason, mgmt_connected);
2198
2199         if (conn->type == ACL_LINK &&
2200             test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2201                 hci_remove_link_key(hdev, &conn->dst);
2202
2203         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2204         if (params) {
2205                 switch (params->auto_connect) {
2206                 case HCI_AUTO_CONN_LINK_LOSS:
2207                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2208                                 break;
2209                         /* Fall through */
2210
2211                 case HCI_AUTO_CONN_ALWAYS:
2212                         hci_pend_le_conn_add(hdev, params);
2213                         break;
2214
2215                 default:
2216                         break;
2217                 }
2218         }
2219
2220         type = conn->type;
2221
2222         hci_proto_disconn_cfm(conn, ev->reason);
2223         hci_conn_del(conn);
2224
2225         /* Re-enable advertising if necessary, since it might
2226          * have been disabled by the connection. From the
2227          * HCI_LE_Set_Advertise_Enable command description in
2228          * the core specification (v4.0):
2229          * "The Controller shall continue advertising until the Host
2230          * issues an LE_Set_Advertise_Enable command with
2231          * Advertising_Enable set to 0x00 (Advertising is disabled)
2232          * or until a connection is created or until the Advertising
2233          * is timed out due to Directed Advertising."
2234          */
2235         if (type == LE_LINK)
2236                 mgmt_reenable_advertising(hdev);
2237
2238 unlock:
2239         hci_dev_unlock(hdev);
2240 }
2241
2242 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2243 {
2244         struct hci_ev_auth_complete *ev = (void *) skb->data;
2245         struct hci_conn *conn;
2246
2247         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2248
2249         hci_dev_lock(hdev);
2250
2251         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2252         if (!conn)
2253                 goto unlock;
2254
2255         if (!ev->status) {
2256                 if (!hci_conn_ssp_enabled(conn) &&
2257                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2258                         BT_INFO("re-auth of legacy device is not possible.");
2259                 } else {
2260                         set_bit(HCI_CONN_AUTH, &conn->flags);
2261                         conn->sec_level = conn->pending_sec_level;
2262                 }
2263         } else {
2264                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
2265                                  ev->status);
2266         }
2267
2268         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2269         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2270
2271         if (conn->state == BT_CONFIG) {
2272                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2273                         struct hci_cp_set_conn_encrypt cp;
2274                         cp.handle  = ev->handle;
2275                         cp.encrypt = 0x01;
2276                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2277                                      &cp);
2278                 } else {
2279                         conn->state = BT_CONNECTED;
2280                         hci_proto_connect_cfm(conn, ev->status);
2281                         hci_conn_drop(conn);
2282                 }
2283         } else {
2284                 hci_auth_cfm(conn, ev->status);
2285
2286                 hci_conn_hold(conn);
2287                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2288                 hci_conn_drop(conn);
2289         }
2290
2291         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2292                 if (!ev->status) {
2293                         struct hci_cp_set_conn_encrypt cp;
2294                         cp.handle  = ev->handle;
2295                         cp.encrypt = 0x01;
2296                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2297                                      &cp);
2298                 } else {
2299                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2300                         hci_encrypt_cfm(conn, ev->status, 0x00);
2301                 }
2302         }
2303
2304 unlock:
2305         hci_dev_unlock(hdev);
2306 }
2307
2308 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2309 {
2310         struct hci_ev_remote_name *ev = (void *) skb->data;
2311         struct hci_conn *conn;
2312
2313         BT_DBG("%s", hdev->name);
2314
2315         hci_conn_check_pending(hdev);
2316
2317         hci_dev_lock(hdev);
2318
2319         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2320
2321         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2322                 goto check_auth;
2323
2324         if (ev->status == 0)
2325                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2326                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2327         else
2328                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2329
2330 check_auth:
2331         if (!conn)
2332                 goto unlock;
2333
2334         if (!hci_outgoing_auth_needed(hdev, conn))
2335                 goto unlock;
2336
2337         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2338                 struct hci_cp_auth_requested cp;
2339                 cp.handle = __cpu_to_le16(conn->handle);
2340                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2341         }
2342
2343 unlock:
2344         hci_dev_unlock(hdev);
2345 }
2346
2347 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2348 {
2349         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2350         struct hci_conn *conn;
2351
2352         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2353
2354         hci_dev_lock(hdev);
2355
2356         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2357         if (!conn)
2358                 goto unlock;
2359
2360         if (!ev->status) {
2361                 if (ev->encrypt) {
2362                         /* Encryption implies authentication */
2363                         set_bit(HCI_CONN_AUTH, &conn->flags);
2364                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2365                         conn->sec_level = conn->pending_sec_level;
2366
2367                         /* P-256 authentication key implies FIPS */
2368                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2369                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2370
2371                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2372                             conn->type == LE_LINK)
2373                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2374                 } else {
2375                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2376                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2377                 }
2378         }
2379
2380         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2381
2382         if (ev->status && conn->state == BT_CONNECTED) {
2383                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2384                 hci_conn_drop(conn);
2385                 goto unlock;
2386         }
2387
2388         if (conn->state == BT_CONFIG) {
2389                 if (!ev->status)
2390                         conn->state = BT_CONNECTED;
2391
2392                 /* In Secure Connections Only mode, do not allow any
2393                  * connections that are not encrypted with AES-CCM
2394                  * using a P-256 authenticated combination key.
2395                  */
2396                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2397                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2398                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2399                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2400                         hci_conn_drop(conn);
2401                         goto unlock;
2402                 }
2403
2404                 hci_proto_connect_cfm(conn, ev->status);
2405                 hci_conn_drop(conn);
2406         } else
2407                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2408
2409 unlock:
2410         hci_dev_unlock(hdev);
2411 }
2412
2413 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2414                                              struct sk_buff *skb)
2415 {
2416         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2417         struct hci_conn *conn;
2418
2419         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2420
2421         hci_dev_lock(hdev);
2422
2423         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2424         if (conn) {
2425                 if (!ev->status)
2426                         set_bit(HCI_CONN_SECURE, &conn->flags);
2427
2428                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2429
2430                 hci_key_change_cfm(conn, ev->status);
2431         }
2432
2433         hci_dev_unlock(hdev);
2434 }
2435
2436 static void hci_remote_features_evt(struct hci_dev *hdev,
2437                                     struct sk_buff *skb)
2438 {
2439         struct hci_ev_remote_features *ev = (void *) skb->data;
2440         struct hci_conn *conn;
2441
2442         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2443
2444         hci_dev_lock(hdev);
2445
2446         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2447         if (!conn)
2448                 goto unlock;
2449
2450         if (!ev->status)
2451                 memcpy(conn->features[0], ev->features, 8);
2452
2453         if (conn->state != BT_CONFIG)
2454                 goto unlock;
2455
2456         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2457                 struct hci_cp_read_remote_ext_features cp;
2458                 cp.handle = ev->handle;
2459                 cp.page = 0x01;
2460                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2461                              sizeof(cp), &cp);
2462                 goto unlock;
2463         }
2464
2465         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2466                 struct hci_cp_remote_name_req cp;
2467                 memset(&cp, 0, sizeof(cp));
2468                 bacpy(&cp.bdaddr, &conn->dst);
2469                 cp.pscan_rep_mode = 0x02;
2470                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2471         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2472                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2473                                       conn->dst_type, 0, NULL, 0,
2474                                       conn->dev_class);
2475
2476         if (!hci_outgoing_auth_needed(hdev, conn)) {
2477                 conn->state = BT_CONNECTED;
2478                 hci_proto_connect_cfm(conn, ev->status);
2479                 hci_conn_drop(conn);
2480         }
2481
2482 unlock:
2483         hci_dev_unlock(hdev);
2484 }
2485
2486 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2487 {
2488         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2489         u8 status = skb->data[sizeof(*ev)];
2490         __u16 opcode;
2491
2492         skb_pull(skb, sizeof(*ev));
2493
2494         opcode = __le16_to_cpu(ev->opcode);
2495
2496         switch (opcode) {
2497         case HCI_OP_INQUIRY_CANCEL:
2498                 hci_cc_inquiry_cancel(hdev, skb);
2499                 break;
2500
2501         case HCI_OP_PERIODIC_INQ:
2502                 hci_cc_periodic_inq(hdev, skb);
2503                 break;
2504
2505         case HCI_OP_EXIT_PERIODIC_INQ:
2506                 hci_cc_exit_periodic_inq(hdev, skb);
2507                 break;
2508
2509         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2510                 hci_cc_remote_name_req_cancel(hdev, skb);
2511                 break;
2512
2513         case HCI_OP_ROLE_DISCOVERY:
2514                 hci_cc_role_discovery(hdev, skb);
2515                 break;
2516
2517         case HCI_OP_READ_LINK_POLICY:
2518                 hci_cc_read_link_policy(hdev, skb);
2519                 break;
2520
2521         case HCI_OP_WRITE_LINK_POLICY:
2522                 hci_cc_write_link_policy(hdev, skb);
2523                 break;
2524
2525         case HCI_OP_READ_DEF_LINK_POLICY:
2526                 hci_cc_read_def_link_policy(hdev, skb);
2527                 break;
2528
2529         case HCI_OP_WRITE_DEF_LINK_POLICY:
2530                 hci_cc_write_def_link_policy(hdev, skb);
2531                 break;
2532
2533         case HCI_OP_RESET:
2534                 hci_cc_reset(hdev, skb);
2535                 break;
2536
2537         case HCI_OP_WRITE_LOCAL_NAME:
2538                 hci_cc_write_local_name(hdev, skb);
2539                 break;
2540
2541         case HCI_OP_READ_LOCAL_NAME:
2542                 hci_cc_read_local_name(hdev, skb);
2543                 break;
2544
2545         case HCI_OP_WRITE_AUTH_ENABLE:
2546                 hci_cc_write_auth_enable(hdev, skb);
2547                 break;
2548
2549         case HCI_OP_WRITE_ENCRYPT_MODE:
2550                 hci_cc_write_encrypt_mode(hdev, skb);
2551                 break;
2552
2553         case HCI_OP_WRITE_SCAN_ENABLE:
2554                 hci_cc_write_scan_enable(hdev, skb);
2555                 break;
2556
2557         case HCI_OP_READ_CLASS_OF_DEV:
2558                 hci_cc_read_class_of_dev(hdev, skb);
2559                 break;
2560
2561         case HCI_OP_WRITE_CLASS_OF_DEV:
2562                 hci_cc_write_class_of_dev(hdev, skb);
2563                 break;
2564
2565         case HCI_OP_READ_VOICE_SETTING:
2566                 hci_cc_read_voice_setting(hdev, skb);
2567                 break;
2568
2569         case HCI_OP_WRITE_VOICE_SETTING:
2570                 hci_cc_write_voice_setting(hdev, skb);
2571                 break;
2572
2573         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2574                 hci_cc_read_num_supported_iac(hdev, skb);
2575                 break;
2576
2577         case HCI_OP_WRITE_SSP_MODE:
2578                 hci_cc_write_ssp_mode(hdev, skb);
2579                 break;
2580
2581         case HCI_OP_WRITE_SC_SUPPORT:
2582                 hci_cc_write_sc_support(hdev, skb);
2583                 break;
2584
2585         case HCI_OP_READ_LOCAL_VERSION:
2586                 hci_cc_read_local_version(hdev, skb);
2587                 break;
2588
2589         case HCI_OP_READ_LOCAL_COMMANDS:
2590                 hci_cc_read_local_commands(hdev, skb);
2591                 break;
2592
2593         case HCI_OP_READ_LOCAL_FEATURES:
2594                 hci_cc_read_local_features(hdev, skb);
2595                 break;
2596
2597         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2598                 hci_cc_read_local_ext_features(hdev, skb);
2599                 break;
2600
2601         case HCI_OP_READ_BUFFER_SIZE:
2602                 hci_cc_read_buffer_size(hdev, skb);
2603                 break;
2604
2605         case HCI_OP_READ_BD_ADDR:
2606                 hci_cc_read_bd_addr(hdev, skb);
2607                 break;
2608
2609         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2610                 hci_cc_read_page_scan_activity(hdev, skb);
2611                 break;
2612
2613         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2614                 hci_cc_write_page_scan_activity(hdev, skb);
2615                 break;
2616
2617         case HCI_OP_READ_PAGE_SCAN_TYPE:
2618                 hci_cc_read_page_scan_type(hdev, skb);
2619                 break;
2620
2621         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2622                 hci_cc_write_page_scan_type(hdev, skb);
2623                 break;
2624
2625         case HCI_OP_READ_DATA_BLOCK_SIZE:
2626                 hci_cc_read_data_block_size(hdev, skb);
2627                 break;
2628
2629         case HCI_OP_READ_FLOW_CONTROL_MODE:
2630                 hci_cc_read_flow_control_mode(hdev, skb);
2631                 break;
2632
2633         case HCI_OP_READ_LOCAL_AMP_INFO:
2634                 hci_cc_read_local_amp_info(hdev, skb);
2635                 break;
2636
2637         case HCI_OP_READ_CLOCK:
2638                 hci_cc_read_clock(hdev, skb);
2639                 break;
2640
2641         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2642                 hci_cc_read_local_amp_assoc(hdev, skb);
2643                 break;
2644
2645         case HCI_OP_READ_INQ_RSP_TX_POWER:
2646                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2647                 break;
2648
2649         case HCI_OP_PIN_CODE_REPLY:
2650                 hci_cc_pin_code_reply(hdev, skb);
2651                 break;
2652
2653         case HCI_OP_PIN_CODE_NEG_REPLY:
2654                 hci_cc_pin_code_neg_reply(hdev, skb);
2655                 break;
2656
2657         case HCI_OP_READ_LOCAL_OOB_DATA:
2658                 hci_cc_read_local_oob_data(hdev, skb);
2659                 break;
2660
2661         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2662                 hci_cc_read_local_oob_ext_data(hdev, skb);
2663                 break;
2664
2665         case HCI_OP_LE_READ_BUFFER_SIZE:
2666                 hci_cc_le_read_buffer_size(hdev, skb);
2667                 break;
2668
2669         case HCI_OP_LE_READ_LOCAL_FEATURES:
2670                 hci_cc_le_read_local_features(hdev, skb);
2671                 break;
2672
2673         case HCI_OP_LE_READ_ADV_TX_POWER:
2674                 hci_cc_le_read_adv_tx_power(hdev, skb);
2675                 break;
2676
2677         case HCI_OP_USER_CONFIRM_REPLY:
2678                 hci_cc_user_confirm_reply(hdev, skb);
2679                 break;
2680
2681         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2682                 hci_cc_user_confirm_neg_reply(hdev, skb);
2683                 break;
2684
2685         case HCI_OP_USER_PASSKEY_REPLY:
2686                 hci_cc_user_passkey_reply(hdev, skb);
2687                 break;
2688
2689         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2690                 hci_cc_user_passkey_neg_reply(hdev, skb);
2691                 break;
2692
2693         case HCI_OP_LE_SET_RANDOM_ADDR:
2694                 hci_cc_le_set_random_addr(hdev, skb);
2695                 break;
2696
2697         case HCI_OP_LE_SET_ADV_ENABLE:
2698                 hci_cc_le_set_adv_enable(hdev, skb);
2699                 break;
2700
2701         case HCI_OP_LE_SET_SCAN_PARAM:
2702                 hci_cc_le_set_scan_param(hdev, skb);
2703                 break;
2704
2705         case HCI_OP_LE_SET_SCAN_ENABLE:
2706                 hci_cc_le_set_scan_enable(hdev, skb);
2707                 break;
2708
2709         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2710                 hci_cc_le_read_white_list_size(hdev, skb);
2711                 break;
2712
2713         case HCI_OP_LE_CLEAR_WHITE_LIST:
2714                 hci_cc_le_clear_white_list(hdev, skb);
2715                 break;
2716
2717         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2718                 hci_cc_le_add_to_white_list(hdev, skb);
2719                 break;
2720
2721         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2722                 hci_cc_le_del_from_white_list(hdev, skb);
2723                 break;
2724
2725         case HCI_OP_LE_READ_SUPPORTED_STATES:
2726                 hci_cc_le_read_supported_states(hdev, skb);
2727                 break;
2728
2729         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2730                 hci_cc_write_le_host_supported(hdev, skb);
2731                 break;
2732
2733         case HCI_OP_LE_SET_ADV_PARAM:
2734                 hci_cc_set_adv_param(hdev, skb);
2735                 break;
2736
2737         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2738                 hci_cc_write_remote_amp_assoc(hdev, skb);
2739                 break;
2740
2741         case HCI_OP_READ_RSSI:
2742                 hci_cc_read_rssi(hdev, skb);
2743                 break;
2744
2745         case HCI_OP_READ_TX_POWER:
2746                 hci_cc_read_tx_power(hdev, skb);
2747                 break;
2748
2749         default:
2750                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2751                 break;
2752         }
2753
2754         if (opcode != HCI_OP_NOP)
2755                 cancel_delayed_work(&hdev->cmd_timer);
2756
2757         hci_req_cmd_complete(hdev, opcode, status);
2758
2759         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2760                 atomic_set(&hdev->cmd_cnt, 1);
2761                 if (!skb_queue_empty(&hdev->cmd_q))
2762                         queue_work(hdev->workqueue, &hdev->cmd_work);
2763         }
2764 }
2765
2766 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2767 {
2768         struct hci_ev_cmd_status *ev = (void *) skb->data;
2769         __u16 opcode;
2770
2771         skb_pull(skb, sizeof(*ev));
2772
2773         opcode = __le16_to_cpu(ev->opcode);
2774
2775         switch (opcode) {
2776         case HCI_OP_INQUIRY:
2777                 hci_cs_inquiry(hdev, ev->status);
2778                 break;
2779
2780         case HCI_OP_CREATE_CONN:
2781                 hci_cs_create_conn(hdev, ev->status);
2782                 break;
2783
2784         case HCI_OP_ADD_SCO:
2785                 hci_cs_add_sco(hdev, ev->status);
2786                 break;
2787
2788         case HCI_OP_AUTH_REQUESTED:
2789                 hci_cs_auth_requested(hdev, ev->status);
2790                 break;
2791
2792         case HCI_OP_SET_CONN_ENCRYPT:
2793                 hci_cs_set_conn_encrypt(hdev, ev->status);
2794                 break;
2795
2796         case HCI_OP_REMOTE_NAME_REQ:
2797                 hci_cs_remote_name_req(hdev, ev->status);
2798                 break;
2799
2800         case HCI_OP_READ_REMOTE_FEATURES:
2801                 hci_cs_read_remote_features(hdev, ev->status);
2802                 break;
2803
2804         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2805                 hci_cs_read_remote_ext_features(hdev, ev->status);
2806                 break;
2807
2808         case HCI_OP_SETUP_SYNC_CONN:
2809                 hci_cs_setup_sync_conn(hdev, ev->status);
2810                 break;
2811
2812         case HCI_OP_SNIFF_MODE:
2813                 hci_cs_sniff_mode(hdev, ev->status);
2814                 break;
2815
2816         case HCI_OP_EXIT_SNIFF_MODE:
2817                 hci_cs_exit_sniff_mode(hdev, ev->status);
2818                 break;
2819
2820         case HCI_OP_DISCONNECT:
2821                 hci_cs_disconnect(hdev, ev->status);
2822                 break;
2823
2824         case HCI_OP_CREATE_PHY_LINK:
2825                 hci_cs_create_phylink(hdev, ev->status);
2826                 break;
2827
2828         case HCI_OP_ACCEPT_PHY_LINK:
2829                 hci_cs_accept_phylink(hdev, ev->status);
2830                 break;
2831
2832         case HCI_OP_LE_CREATE_CONN:
2833                 hci_cs_le_create_conn(hdev, ev->status);
2834                 break;
2835
2836         case HCI_OP_LE_START_ENC:
2837                 hci_cs_le_start_enc(hdev, ev->status);
2838                 break;
2839
2840         default:
2841                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2842                 break;
2843         }
2844
2845         if (opcode != HCI_OP_NOP)
2846                 cancel_delayed_work(&hdev->cmd_timer);
2847
2848         if (ev->status ||
2849             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2850                 hci_req_cmd_complete(hdev, opcode, ev->status);
2851
2852         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2853                 atomic_set(&hdev->cmd_cnt, 1);
2854                 if (!skb_queue_empty(&hdev->cmd_q))
2855                         queue_work(hdev->workqueue, &hdev->cmd_work);
2856         }
2857 }
2858
2859 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2860 {
2861         struct hci_ev_role_change *ev = (void *) skb->data;
2862         struct hci_conn *conn;
2863
2864         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2865
2866         hci_dev_lock(hdev);
2867
2868         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2869         if (conn) {
2870                 if (!ev->status) {
2871                         if (ev->role)
2872                                 clear_bit(HCI_CONN_MASTER, &conn->flags);
2873                         else
2874                                 set_bit(HCI_CONN_MASTER, &conn->flags);
2875                 }
2876
2877                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2878
2879                 hci_role_switch_cfm(conn, ev->status, ev->role);
2880         }
2881
2882         hci_dev_unlock(hdev);
2883 }
2884
2885 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2886 {
2887         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2888         int i;
2889
2890         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2891                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2892                 return;
2893         }
2894
2895         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2896             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2897                 BT_DBG("%s bad parameters", hdev->name);
2898                 return;
2899         }
2900
2901         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2902
2903         for (i = 0; i < ev->num_hndl; i++) {
2904                 struct hci_comp_pkts_info *info = &ev->handles[i];
2905                 struct hci_conn *conn;
2906                 __u16  handle, count;
2907
2908                 handle = __le16_to_cpu(info->handle);
2909                 count  = __le16_to_cpu(info->count);
2910
2911                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2912                 if (!conn)
2913                         continue;
2914
2915                 conn->sent -= count;
2916
2917                 switch (conn->type) {
2918                 case ACL_LINK:
2919                         hdev->acl_cnt += count;
2920                         if (hdev->acl_cnt > hdev->acl_pkts)
2921                                 hdev->acl_cnt = hdev->acl_pkts;
2922                         break;
2923
2924                 case LE_LINK:
2925                         if (hdev->le_pkts) {
2926                                 hdev->le_cnt += count;
2927                                 if (hdev->le_cnt > hdev->le_pkts)
2928                                         hdev->le_cnt = hdev->le_pkts;
2929                         } else {
2930                                 hdev->acl_cnt += count;
2931                                 if (hdev->acl_cnt > hdev->acl_pkts)
2932                                         hdev->acl_cnt = hdev->acl_pkts;
2933                         }
2934                         break;
2935
2936                 case SCO_LINK:
2937                         hdev->sco_cnt += count;
2938                         if (hdev->sco_cnt > hdev->sco_pkts)
2939                                 hdev->sco_cnt = hdev->sco_pkts;
2940                         break;
2941
2942                 default:
2943                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2944                         break;
2945                 }
2946         }
2947
2948         queue_work(hdev->workqueue, &hdev->tx_work);
2949 }
2950
2951 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2952                                                  __u16 handle)
2953 {
2954         struct hci_chan *chan;
2955
2956         switch (hdev->dev_type) {
2957         case HCI_BREDR:
2958                 return hci_conn_hash_lookup_handle(hdev, handle);
2959         case HCI_AMP:
2960                 chan = hci_chan_lookup_handle(hdev, handle);
2961                 if (chan)
2962                         return chan->conn;
2963                 break;
2964         default:
2965                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2966                 break;
2967         }
2968
2969         return NULL;
2970 }
2971
2972 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2973 {
2974         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2975         int i;
2976
2977         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2978                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2979                 return;
2980         }
2981
2982         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2983             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2984                 BT_DBG("%s bad parameters", hdev->name);
2985                 return;
2986         }
2987
2988         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2989                ev->num_hndl);
2990
2991         for (i = 0; i < ev->num_hndl; i++) {
2992                 struct hci_comp_blocks_info *info = &ev->handles[i];
2993                 struct hci_conn *conn = NULL;
2994                 __u16  handle, block_count;
2995
2996                 handle = __le16_to_cpu(info->handle);
2997                 block_count = __le16_to_cpu(info->blocks);
2998
2999                 conn = __hci_conn_lookup_handle(hdev, handle);
3000                 if (!conn)
3001                         continue;
3002
3003                 conn->sent -= block_count;
3004
3005                 switch (conn->type) {
3006                 case ACL_LINK:
3007                 case AMP_LINK:
3008                         hdev->block_cnt += block_count;
3009                         if (hdev->block_cnt > hdev->num_blocks)
3010                                 hdev->block_cnt = hdev->num_blocks;
3011                         break;
3012
3013                 default:
3014                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3015                         break;
3016                 }
3017         }
3018
3019         queue_work(hdev->workqueue, &hdev->tx_work);
3020 }
3021
3022 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3023 {
3024         struct hci_ev_mode_change *ev = (void *) skb->data;
3025         struct hci_conn *conn;
3026
3027         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3028
3029         hci_dev_lock(hdev);
3030
3031         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3032         if (conn) {
3033                 conn->mode = ev->mode;
3034
3035                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3036                                         &conn->flags)) {
3037                         if (conn->mode == HCI_CM_ACTIVE)
3038                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3039                         else
3040                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3041                 }
3042
3043                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3044                         hci_sco_setup(conn, ev->status);
3045         }
3046
3047         hci_dev_unlock(hdev);
3048 }
3049
3050 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3051 {
3052         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3053         struct hci_conn *conn;
3054
3055         BT_DBG("%s", hdev->name);
3056
3057         hci_dev_lock(hdev);
3058
3059         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3060         if (!conn)
3061                 goto unlock;
3062
3063         if (conn->state == BT_CONNECTED) {
3064                 hci_conn_hold(conn);
3065                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3066                 hci_conn_drop(conn);
3067         }
3068
3069         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
3070                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3071                              sizeof(ev->bdaddr), &ev->bdaddr);
3072         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3073                 u8 secure;
3074
3075                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3076                         secure = 1;
3077                 else
3078                         secure = 0;
3079
3080                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3081         }
3082
3083 unlock:
3084         hci_dev_unlock(hdev);
3085 }
3086
3087 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3088 {
3089         struct hci_ev_link_key_req *ev = (void *) skb->data;
3090         struct hci_cp_link_key_reply cp;
3091         struct hci_conn *conn;
3092         struct link_key *key;
3093
3094         BT_DBG("%s", hdev->name);
3095
3096         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3097                 return;
3098
3099         hci_dev_lock(hdev);
3100
3101         key = hci_find_link_key(hdev, &ev->bdaddr);
3102         if (!key) {
3103                 BT_DBG("%s link key not found for %pMR", hdev->name,
3104                        &ev->bdaddr);
3105                 goto not_found;
3106         }
3107
3108         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3109                &ev->bdaddr);
3110
3111         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3112         if (conn) {
3113                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3114                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3115                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3116                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3117                         goto not_found;
3118                 }
3119
3120                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3121                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3122                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3123                         BT_DBG("%s ignoring key unauthenticated for high security",
3124                                hdev->name);
3125                         goto not_found;
3126                 }
3127
3128                 conn->key_type = key->type;
3129                 conn->pin_length = key->pin_len;
3130         }
3131
3132         bacpy(&cp.bdaddr, &ev->bdaddr);
3133         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3134
3135         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3136
3137         hci_dev_unlock(hdev);
3138
3139         return;
3140
3141 not_found:
3142         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3143         hci_dev_unlock(hdev);
3144 }
3145
3146 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3147 {
3148         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3149         struct hci_conn *conn;
3150         struct link_key *key;
3151         bool persistent;
3152         u8 pin_len = 0;
3153
3154         BT_DBG("%s", hdev->name);
3155
3156         hci_dev_lock(hdev);
3157
3158         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3159         if (conn) {
3160                 hci_conn_hold(conn);
3161                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3162                 pin_len = conn->pin_length;
3163
3164                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
3165                         conn->key_type = ev->key_type;
3166
3167                 hci_conn_drop(conn);
3168         }
3169
3170         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3171                 goto unlock;
3172
3173         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3174                                 ev->key_type, pin_len, &persistent);
3175         if (!key)
3176                 goto unlock;
3177
3178         mgmt_new_link_key(hdev, key, persistent);
3179
3180         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3181          * is set. If it's not set simply remove the key from the kernel
3182          * list (we've still notified user space about it but with
3183          * store_hint being 0).
3184          */
3185         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3186             !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3187                 list_del(&key->list);
3188                 kfree(key);
3189         } else if (conn) {
3190                 if (persistent)
3191                         clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3192                 else
3193                         set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3194         }
3195
3196 unlock:
3197         hci_dev_unlock(hdev);
3198 }
3199
3200 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3201 {
3202         struct hci_ev_clock_offset *ev = (void *) skb->data;
3203         struct hci_conn *conn;
3204
3205         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3206
3207         hci_dev_lock(hdev);
3208
3209         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3210         if (conn && !ev->status) {
3211                 struct inquiry_entry *ie;
3212
3213                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3214                 if (ie) {
3215                         ie->data.clock_offset = ev->clock_offset;
3216                         ie->timestamp = jiffies;
3217                 }
3218         }
3219
3220         hci_dev_unlock(hdev);
3221 }
3222
3223 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3224 {
3225         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3226         struct hci_conn *conn;
3227
3228         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3229
3230         hci_dev_lock(hdev);
3231
3232         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3233         if (conn && !ev->status)
3234                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3235
3236         hci_dev_unlock(hdev);
3237 }
3238
3239 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3240 {
3241         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3242         struct inquiry_entry *ie;
3243
3244         BT_DBG("%s", hdev->name);
3245
3246         hci_dev_lock(hdev);
3247
3248         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3249         if (ie) {
3250                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3251                 ie->timestamp = jiffies;
3252         }
3253
3254         hci_dev_unlock(hdev);
3255 }
3256
3257 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3258                                              struct sk_buff *skb)
3259 {
3260         struct inquiry_data data;
3261         int num_rsp = *((__u8 *) skb->data);
3262
3263         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3264
3265         if (!num_rsp)
3266                 return;
3267
3268         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3269                 return;
3270
3271         hci_dev_lock(hdev);
3272
3273         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3274                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3275                 info = (void *) (skb->data + 1);
3276
3277                 for (; num_rsp; num_rsp--, info++) {
3278                         u32 flags;
3279
3280                         bacpy(&data.bdaddr, &info->bdaddr);
3281                         data.pscan_rep_mode     = info->pscan_rep_mode;
3282                         data.pscan_period_mode  = info->pscan_period_mode;
3283                         data.pscan_mode         = info->pscan_mode;
3284                         memcpy(data.dev_class, info->dev_class, 3);
3285                         data.clock_offset       = info->clock_offset;
3286                         data.rssi               = info->rssi;
3287                         data.ssp_mode           = 0x00;
3288
3289                         flags = hci_inquiry_cache_update(hdev, &data, false);
3290
3291                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3292                                           info->dev_class, info->rssi,
3293                                           flags, NULL, 0, NULL, 0);
3294                 }
3295         } else {
3296                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3297
3298                 for (; num_rsp; num_rsp--, info++) {
3299                         u32 flags;
3300
3301                         bacpy(&data.bdaddr, &info->bdaddr);
3302                         data.pscan_rep_mode     = info->pscan_rep_mode;
3303                         data.pscan_period_mode  = info->pscan_period_mode;
3304                         data.pscan_mode         = 0x00;
3305                         memcpy(data.dev_class, info->dev_class, 3);
3306                         data.clock_offset       = info->clock_offset;
3307                         data.rssi               = info->rssi;
3308                         data.ssp_mode           = 0x00;
3309
3310                         flags = hci_inquiry_cache_update(hdev, &data, false);
3311
3312                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3313                                           info->dev_class, info->rssi,
3314                                           flags, NULL, 0, NULL, 0);
3315                 }
3316         }
3317
3318         hci_dev_unlock(hdev);
3319 }
3320
3321 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3322                                         struct sk_buff *skb)
3323 {
3324         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3325         struct hci_conn *conn;
3326
3327         BT_DBG("%s", hdev->name);
3328
3329         hci_dev_lock(hdev);
3330
3331         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3332         if (!conn)
3333                 goto unlock;
3334
3335         if (ev->page < HCI_MAX_PAGES)
3336                 memcpy(conn->features[ev->page], ev->features, 8);
3337
3338         if (!ev->status && ev->page == 0x01) {
3339                 struct inquiry_entry *ie;
3340
3341                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3342                 if (ie)
3343                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3344
3345                 if (ev->features[0] & LMP_HOST_SSP) {
3346                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3347                 } else {
3348                         /* It is mandatory by the Bluetooth specification that
3349                          * Extended Inquiry Results are only used when Secure
3350                          * Simple Pairing is enabled, but some devices violate
3351                          * this.
3352                          *
3353                          * To make these devices work, the internal SSP
3354                          * enabled flag needs to be cleared if the remote host
3355                          * features do not indicate SSP support */
3356                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3357                 }
3358
3359                 if (ev->features[0] & LMP_HOST_SC)
3360                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3361         }
3362
3363         if (conn->state != BT_CONFIG)
3364                 goto unlock;
3365
3366         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3367                 struct hci_cp_remote_name_req cp;
3368                 memset(&cp, 0, sizeof(cp));
3369                 bacpy(&cp.bdaddr, &conn->dst);
3370                 cp.pscan_rep_mode = 0x02;
3371                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3372         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3373                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3374                                       conn->dst_type, 0, NULL, 0,
3375                                       conn->dev_class);
3376
3377         if (!hci_outgoing_auth_needed(hdev, conn)) {
3378                 conn->state = BT_CONNECTED;
3379                 hci_proto_connect_cfm(conn, ev->status);
3380                 hci_conn_drop(conn);
3381         }
3382
3383 unlock:
3384         hci_dev_unlock(hdev);
3385 }
3386
3387 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3388                                        struct sk_buff *skb)
3389 {
3390         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3391         struct hci_conn *conn;
3392
3393         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3394
3395         hci_dev_lock(hdev);
3396
3397         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3398         if (!conn) {
3399                 if (ev->link_type == ESCO_LINK)
3400                         goto unlock;
3401
3402                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3403                 if (!conn)
3404                         goto unlock;
3405
3406                 conn->type = SCO_LINK;
3407         }
3408
3409         switch (ev->status) {
3410         case 0x00:
3411                 conn->handle = __le16_to_cpu(ev->handle);
3412                 conn->state  = BT_CONNECTED;
3413
3414                 hci_conn_add_sysfs(conn);
3415                 break;
3416
3417         case 0x10:      /* Connection Accept Timeout */
3418         case 0x0d:      /* Connection Rejected due to Limited Resources */
3419         case 0x11:      /* Unsupported Feature or Parameter Value */
3420         case 0x1c:      /* SCO interval rejected */
3421         case 0x1a:      /* Unsupported Remote Feature */
3422         case 0x1f:      /* Unspecified error */
3423         case 0x20:      /* Unsupported LMP Parameter value */
3424                 if (conn->out) {
3425                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3426                                         (hdev->esco_type & EDR_ESCO_MASK);
3427                         if (hci_setup_sync(conn, conn->link->handle))
3428                                 goto unlock;
3429                 }
3430                 /* fall through */
3431
3432         default:
3433                 conn->state = BT_CLOSED;
3434                 break;
3435         }
3436
3437         hci_proto_connect_cfm(conn, ev->status);
3438         if (ev->status)
3439                 hci_conn_del(conn);
3440
3441 unlock:
3442         hci_dev_unlock(hdev);
3443 }
3444
3445 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3446 {
3447         size_t parsed = 0;
3448
3449         while (parsed < eir_len) {
3450                 u8 field_len = eir[0];
3451
3452                 if (field_len == 0)
3453                         return parsed;
3454
3455                 parsed += field_len + 1;
3456                 eir += field_len + 1;
3457         }
3458
3459         return eir_len;
3460 }
3461
3462 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3463                                             struct sk_buff *skb)
3464 {
3465         struct inquiry_data data;
3466         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3467         int num_rsp = *((__u8 *) skb->data);
3468         size_t eir_len;
3469
3470         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3471
3472         if (!num_rsp)
3473                 return;
3474
3475         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3476                 return;
3477
3478         hci_dev_lock(hdev);
3479
3480         for (; num_rsp; num_rsp--, info++) {
3481                 u32 flags;
3482                 bool name_known;
3483
3484                 bacpy(&data.bdaddr, &info->bdaddr);
3485                 data.pscan_rep_mode     = info->pscan_rep_mode;
3486                 data.pscan_period_mode  = info->pscan_period_mode;
3487                 data.pscan_mode         = 0x00;
3488                 memcpy(data.dev_class, info->dev_class, 3);
3489                 data.clock_offset       = info->clock_offset;
3490                 data.rssi               = info->rssi;
3491                 data.ssp_mode           = 0x01;
3492
3493                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3494                         name_known = eir_has_data_type(info->data,
3495                                                        sizeof(info->data),
3496                                                        EIR_NAME_COMPLETE);
3497                 else
3498                         name_known = true;
3499
3500                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3501
3502                 eir_len = eir_get_length(info->data, sizeof(info->data));
3503
3504                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3505                                   info->dev_class, info->rssi,
3506                                   flags, info->data, eir_len, NULL, 0);
3507         }
3508
3509         hci_dev_unlock(hdev);
3510 }
3511
3512 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3513                                          struct sk_buff *skb)
3514 {
3515         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3516         struct hci_conn *conn;
3517
3518         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3519                __le16_to_cpu(ev->handle));
3520
3521         hci_dev_lock(hdev);
3522
3523         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3524         if (!conn)
3525                 goto unlock;
3526
3527         /* For BR/EDR the necessary steps are taken through the
3528          * auth_complete event.
3529          */
3530         if (conn->type != LE_LINK)
3531                 goto unlock;
3532
3533         if (!ev->status)
3534                 conn->sec_level = conn->pending_sec_level;
3535
3536         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3537
3538         if (ev->status && conn->state == BT_CONNECTED) {
3539                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3540                 hci_conn_drop(conn);
3541                 goto unlock;
3542         }
3543
3544         if (conn->state == BT_CONFIG) {
3545                 if (!ev->status)
3546                         conn->state = BT_CONNECTED;
3547
3548                 hci_proto_connect_cfm(conn, ev->status);
3549                 hci_conn_drop(conn);
3550         } else {
3551                 hci_auth_cfm(conn, ev->status);
3552
3553                 hci_conn_hold(conn);
3554                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3555                 hci_conn_drop(conn);
3556         }
3557
3558 unlock:
3559         hci_dev_unlock(hdev);
3560 }
3561
3562 static u8 hci_get_auth_req(struct hci_conn *conn)
3563 {
3564         /* If remote requests no-bonding follow that lead */
3565         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3566             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3567                 return conn->remote_auth | (conn->auth_type & 0x01);
3568
3569         /* If both remote and local have enough IO capabilities, require
3570          * MITM protection
3571          */
3572         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3573             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3574                 return conn->remote_auth | 0x01;
3575
3576         /* No MITM protection possible so ignore remote requirement */
3577         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3578 }
3579
3580 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3581 {
3582         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3583         struct hci_conn *conn;
3584
3585         BT_DBG("%s", hdev->name);
3586
3587         hci_dev_lock(hdev);
3588
3589         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3590         if (!conn)
3591                 goto unlock;
3592
3593         hci_conn_hold(conn);
3594
3595         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3596                 goto unlock;
3597
3598         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3599             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3600                 struct hci_cp_io_capability_reply cp;
3601
3602                 bacpy(&cp.bdaddr, &ev->bdaddr);
3603                 /* Change the IO capability from KeyboardDisplay
3604                  * to DisplayYesNo as it is not supported by BT spec. */
3605                 cp.capability = (conn->io_capability == 0x04) ?
3606                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3607
3608                 /* If we are initiators, there is no remote information yet */
3609                 if (conn->remote_auth == 0xff) {
3610                         cp.authentication = conn->auth_type;
3611
3612                         /* Request MITM protection if our IO caps allow it
3613                          * except for the no-bonding case.
3614                          * conn->auth_type is not updated here since
3615                          * that might cause the user confirmation to be
3616                          * rejected in case the remote doesn't have the
3617                          * IO capabilities for MITM.
3618                          */
3619                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
3620                             cp.authentication != HCI_AT_NO_BONDING)
3621                                 cp.authentication |= 0x01;
3622                 } else {
3623                         conn->auth_type = hci_get_auth_req(conn);
3624                         cp.authentication = conn->auth_type;
3625                 }
3626
3627                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3628                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3629                         cp.oob_data = 0x01;
3630                 else
3631                         cp.oob_data = 0x00;
3632
3633                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3634                              sizeof(cp), &cp);
3635         } else {
3636                 struct hci_cp_io_capability_neg_reply cp;
3637
3638                 bacpy(&cp.bdaddr, &ev->bdaddr);
3639                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3640
3641                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3642                              sizeof(cp), &cp);
3643         }
3644
3645 unlock:
3646         hci_dev_unlock(hdev);
3647 }
3648
3649 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3650 {
3651         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3652         struct hci_conn *conn;
3653
3654         BT_DBG("%s", hdev->name);
3655
3656         hci_dev_lock(hdev);
3657
3658         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3659         if (!conn)
3660                 goto unlock;
3661
3662         conn->remote_cap = ev->capability;
3663         conn->remote_auth = ev->authentication;
3664         if (ev->oob_data)
3665                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3666
3667 unlock:
3668         hci_dev_unlock(hdev);
3669 }
3670
3671 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3672                                          struct sk_buff *skb)
3673 {
3674         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3675         int loc_mitm, rem_mitm, confirm_hint = 0;
3676         struct hci_conn *conn;
3677
3678         BT_DBG("%s", hdev->name);
3679
3680         hci_dev_lock(hdev);
3681
3682         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3683                 goto unlock;
3684
3685         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3686         if (!conn)
3687                 goto unlock;
3688
3689         loc_mitm = (conn->auth_type & 0x01);
3690         rem_mitm = (conn->remote_auth & 0x01);
3691
3692         /* If we require MITM but the remote device can't provide that
3693          * (it has NoInputNoOutput) then reject the confirmation request
3694          */
3695         if (loc_mitm && conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3696                 BT_DBG("Rejecting request: remote device can't provide MITM");
3697                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3698                              sizeof(ev->bdaddr), &ev->bdaddr);
3699                 goto unlock;
3700         }
3701
3702         /* If no side requires MITM protection; auto-accept */
3703         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3704             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3705
3706                 /* If we're not the initiators request authorization to
3707                  * proceed from user space (mgmt_user_confirm with
3708                  * confirm_hint set to 1). The exception is if neither
3709                  * side had MITM in which case we do auto-accept.
3710                  */
3711                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
3712                     (loc_mitm || rem_mitm)) {
3713                         BT_DBG("Confirming auto-accept as acceptor");
3714                         confirm_hint = 1;
3715                         goto confirm;
3716                 }
3717
3718                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3719                        hdev->auto_accept_delay);
3720
3721                 if (hdev->auto_accept_delay > 0) {
3722                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3723                         queue_delayed_work(conn->hdev->workqueue,
3724                                            &conn->auto_accept_work, delay);
3725                         goto unlock;
3726                 }
3727
3728                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3729                              sizeof(ev->bdaddr), &ev->bdaddr);
3730                 goto unlock;
3731         }
3732
3733 confirm:
3734         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
3735                                   le32_to_cpu(ev->passkey), confirm_hint);
3736
3737 unlock:
3738         hci_dev_unlock(hdev);
3739 }
3740
3741 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3742                                          struct sk_buff *skb)
3743 {
3744         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3745
3746         BT_DBG("%s", hdev->name);
3747
3748         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3749                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3750 }
3751
3752 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3753                                         struct sk_buff *skb)
3754 {
3755         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3756         struct hci_conn *conn;
3757
3758         BT_DBG("%s", hdev->name);
3759
3760         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3761         if (!conn)
3762                 return;
3763
3764         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3765         conn->passkey_entered = 0;
3766
3767         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3768                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3769                                          conn->dst_type, conn->passkey_notify,
3770                                          conn->passkey_entered);
3771 }
3772
3773 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3774 {
3775         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3776         struct hci_conn *conn;
3777
3778         BT_DBG("%s", hdev->name);
3779
3780         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3781         if (!conn)
3782                 return;
3783
3784         switch (ev->type) {
3785         case HCI_KEYPRESS_STARTED:
3786                 conn->passkey_entered = 0;
3787                 return;
3788
3789         case HCI_KEYPRESS_ENTERED:
3790                 conn->passkey_entered++;
3791                 break;
3792
3793         case HCI_KEYPRESS_ERASED:
3794                 conn->passkey_entered--;
3795                 break;
3796
3797         case HCI_KEYPRESS_CLEARED:
3798                 conn->passkey_entered = 0;
3799                 break;
3800
3801         case HCI_KEYPRESS_COMPLETED:
3802                 return;
3803         }
3804
3805         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3806                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3807                                          conn->dst_type, conn->passkey_notify,
3808                                          conn->passkey_entered);
3809 }
3810
3811 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3812                                          struct sk_buff *skb)
3813 {
3814         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3815         struct hci_conn *conn;
3816
3817         BT_DBG("%s", hdev->name);
3818
3819         hci_dev_lock(hdev);
3820
3821         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3822         if (!conn)
3823                 goto unlock;
3824
3825         /* To avoid duplicate auth_failed events to user space we check
3826          * the HCI_CONN_AUTH_PEND flag which will be set if we
3827          * initiated the authentication. A traditional auth_complete
3828          * event gets always produced as initiator and is also mapped to
3829          * the mgmt_auth_failed event */
3830         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3831                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3832                                  ev->status);
3833
3834         hci_conn_drop(conn);
3835
3836 unlock:
3837         hci_dev_unlock(hdev);
3838 }
3839
3840 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3841                                          struct sk_buff *skb)
3842 {
3843         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3844         struct inquiry_entry *ie;
3845         struct hci_conn *conn;
3846
3847         BT_DBG("%s", hdev->name);
3848
3849         hci_dev_lock(hdev);
3850
3851         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3852         if (conn)
3853                 memcpy(conn->features[1], ev->features, 8);
3854
3855         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3856         if (ie)
3857                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3858
3859         hci_dev_unlock(hdev);
3860 }
3861
3862 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3863                                             struct sk_buff *skb)
3864 {
3865         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3866         struct oob_data *data;
3867
3868         BT_DBG("%s", hdev->name);
3869
3870         hci_dev_lock(hdev);
3871
3872         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3873                 goto unlock;
3874
3875         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3876         if (data) {
3877                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
3878                         struct hci_cp_remote_oob_ext_data_reply cp;
3879
3880                         bacpy(&cp.bdaddr, &ev->bdaddr);
3881                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
3882                         memcpy(cp.randomizer192, data->randomizer192,
3883                                sizeof(cp.randomizer192));
3884                         memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
3885                         memcpy(cp.randomizer256, data->randomizer256,
3886                                sizeof(cp.randomizer256));
3887
3888                         hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
3889                                      sizeof(cp), &cp);
3890                 } else {
3891                         struct hci_cp_remote_oob_data_reply cp;
3892
3893                         bacpy(&cp.bdaddr, &ev->bdaddr);
3894                         memcpy(cp.hash, data->hash192, sizeof(cp.hash));
3895                         memcpy(cp.randomizer, data->randomizer192,
3896                                sizeof(cp.randomizer));
3897
3898                         hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
3899                                      sizeof(cp), &cp);
3900                 }
3901         } else {
3902                 struct hci_cp_remote_oob_data_neg_reply cp;
3903
3904                 bacpy(&cp.bdaddr, &ev->bdaddr);
3905                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
3906                              sizeof(cp), &cp);
3907         }
3908
3909 unlock:
3910         hci_dev_unlock(hdev);
3911 }
3912
3913 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3914                                       struct sk_buff *skb)
3915 {
3916         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3917         struct hci_conn *hcon, *bredr_hcon;
3918
3919         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3920                ev->status);
3921
3922         hci_dev_lock(hdev);
3923
3924         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3925         if (!hcon) {
3926                 hci_dev_unlock(hdev);
3927                 return;
3928         }
3929
3930         if (ev->status) {
3931                 hci_conn_del(hcon);
3932                 hci_dev_unlock(hdev);
3933                 return;
3934         }
3935
3936         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3937
3938         hcon->state = BT_CONNECTED;
3939         bacpy(&hcon->dst, &bredr_hcon->dst);
3940
3941         hci_conn_hold(hcon);
3942         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3943         hci_conn_drop(hcon);
3944
3945         hci_conn_add_sysfs(hcon);
3946
3947         amp_physical_cfm(bredr_hcon, hcon);
3948
3949         hci_dev_unlock(hdev);
3950 }
3951
3952 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3953 {
3954         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3955         struct hci_conn *hcon;
3956         struct hci_chan *hchan;
3957         struct amp_mgr *mgr;
3958
3959         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3960                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3961                ev->status);
3962
3963         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3964         if (!hcon)
3965                 return;
3966
3967         /* Create AMP hchan */
3968         hchan = hci_chan_create(hcon);
3969         if (!hchan)
3970                 return;
3971
3972         hchan->handle = le16_to_cpu(ev->handle);
3973
3974         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3975
3976         mgr = hcon->amp_mgr;
3977         if (mgr && mgr->bredr_chan) {
3978                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3979
3980                 l2cap_chan_lock(bredr_chan);
3981
3982                 bredr_chan->conn->mtu = hdev->block_mtu;
3983                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3984                 hci_conn_hold(hcon);
3985
3986                 l2cap_chan_unlock(bredr_chan);
3987         }
3988 }
3989
3990 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3991                                              struct sk_buff *skb)
3992 {
3993         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3994         struct hci_chan *hchan;
3995
3996         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3997                le16_to_cpu(ev->handle), ev->status);
3998
3999         if (ev->status)
4000                 return;
4001
4002         hci_dev_lock(hdev);
4003
4004         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4005         if (!hchan)
4006                 goto unlock;
4007
4008         amp_destroy_logical_link(hchan, ev->reason);
4009
4010 unlock:
4011         hci_dev_unlock(hdev);
4012 }
4013
4014 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4015                                              struct sk_buff *skb)
4016 {
4017         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4018         struct hci_conn *hcon;
4019
4020         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4021
4022         if (ev->status)
4023                 return;
4024
4025         hci_dev_lock(hdev);
4026
4027         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4028         if (hcon) {
4029                 hcon->state = BT_CLOSED;
4030                 hci_conn_del(hcon);
4031         }
4032
4033         hci_dev_unlock(hdev);
4034 }
4035
4036 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4037 {
4038         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4039         struct hci_conn_params *params;
4040         struct hci_conn *conn;
4041         struct smp_irk *irk;
4042         u8 addr_type;
4043
4044         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4045
4046         hci_dev_lock(hdev);
4047
4048         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4049         if (!conn) {
4050                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
4051                 if (!conn) {
4052                         BT_ERR("No memory for new connection");
4053                         goto unlock;
4054                 }
4055
4056                 conn->dst_type = ev->bdaddr_type;
4057
4058                 if (ev->role == LE_CONN_ROLE_MASTER) {
4059                         conn->out = true;
4060                         set_bit(HCI_CONN_MASTER, &conn->flags);
4061                 }
4062
4063                 /* If we didn't have a hci_conn object previously
4064                  * but we're in master role this must be something
4065                  * initiated using a white list. Since white list based
4066                  * connections are not "first class citizens" we don't
4067                  * have full tracking of them. Therefore, we go ahead
4068                  * with a "best effort" approach of determining the
4069                  * initiator address based on the HCI_PRIVACY flag.
4070                  */
4071                 if (conn->out) {
4072                         conn->resp_addr_type = ev->bdaddr_type;
4073                         bacpy(&conn->resp_addr, &ev->bdaddr);
4074                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4075                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4076                                 bacpy(&conn->init_addr, &hdev->rpa);
4077                         } else {
4078                                 hci_copy_identity_address(hdev,
4079                                                           &conn->init_addr,
4080                                                           &conn->init_addr_type);
4081                         }
4082                 }
4083         } else {
4084                 cancel_delayed_work(&conn->le_conn_timeout);
4085         }
4086
4087         if (!conn->out) {
4088                 /* Set the responder (our side) address type based on
4089                  * the advertising address type.
4090                  */
4091                 conn->resp_addr_type = hdev->adv_addr_type;
4092                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4093                         bacpy(&conn->resp_addr, &hdev->random_addr);
4094                 else
4095                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4096
4097                 conn->init_addr_type = ev->bdaddr_type;
4098                 bacpy(&conn->init_addr, &ev->bdaddr);
4099
4100                 /* For incoming connections, set the default minimum
4101                  * and maximum connection interval. They will be used
4102                  * to check if the parameters are in range and if not
4103                  * trigger the connection update procedure.
4104                  */
4105                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4106                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4107         }
4108
4109         /* Lookup the identity address from the stored connection
4110          * address and address type.
4111          *
4112          * When establishing connections to an identity address, the
4113          * connection procedure will store the resolvable random
4114          * address first. Now if it can be converted back into the
4115          * identity address, start using the identity address from
4116          * now on.
4117          */
4118         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4119         if (irk) {
4120                 bacpy(&conn->dst, &irk->bdaddr);
4121                 conn->dst_type = irk->addr_type;
4122         }
4123
4124         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4125                 addr_type = BDADDR_LE_PUBLIC;
4126         else
4127                 addr_type = BDADDR_LE_RANDOM;
4128
4129         /* Drop the connection if he device is blocked */
4130         if (hci_blacklist_lookup(hdev, &conn->dst, addr_type)) {
4131                 hci_conn_drop(conn);
4132                 goto unlock;
4133         }
4134
4135         if (ev->status) {
4136                 hci_le_conn_failed(conn, ev->status);
4137                 goto unlock;
4138         }
4139
4140         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4141                 mgmt_device_connected(hdev, &conn->dst, conn->type,
4142                                       conn->dst_type, 0, NULL, 0, NULL);
4143
4144         conn->sec_level = BT_SECURITY_LOW;
4145         conn->handle = __le16_to_cpu(ev->handle);
4146         conn->state = BT_CONNECTED;
4147
4148         conn->le_conn_interval = le16_to_cpu(ev->interval);
4149         conn->le_conn_latency = le16_to_cpu(ev->latency);
4150         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4151
4152         hci_conn_add_sysfs(conn);
4153
4154         hci_proto_connect_cfm(conn, ev->status);
4155
4156         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
4157         if (params)
4158                 hci_pend_le_conn_del(hdev, params);
4159
4160 unlock:
4161         hci_dev_unlock(hdev);
4162 }
4163
4164 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4165                                             struct sk_buff *skb)
4166 {
4167         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4168         struct hci_conn *conn;
4169
4170         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4171
4172         if (ev->status)
4173                 return;
4174
4175         hci_dev_lock(hdev);
4176
4177         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4178         if (conn) {
4179                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4180                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4181                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4182         }
4183
4184         hci_dev_unlock(hdev);
4185 }
4186
4187 /* This function requires the caller holds hdev->lock */
4188 static bool check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
4189                                   u8 addr_type)
4190 {
4191         struct hci_conn *conn;
4192
4193         if (!hci_pend_le_conn_lookup(hdev, addr, addr_type))
4194                 return false;
4195
4196         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4197                               HCI_AT_NO_BONDING);
4198         if (!IS_ERR(conn))
4199                 return true;
4200
4201         switch (PTR_ERR(conn)) {
4202         case -EBUSY:
4203                 /* If hci_connect() returns -EBUSY it means there is already
4204                  * an LE connection attempt going on. Since controllers don't
4205                  * support more than one connection attempt at the time, we
4206                  * don't consider this an error case.
4207                  */
4208                 break;
4209         default:
4210                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4211         }
4212
4213         return true;
4214 }
4215
4216 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4217                                u8 bdaddr_type, s8 rssi, u8 *data, u8 len)
4218 {
4219         struct discovery_state *d = &hdev->discovery;
4220         bool match;
4221         u32 flags;
4222
4223         /* Passive scanning shouldn't trigger any device found events,
4224          * except for devices marked as CONN_REPORT for which we do send
4225          * device found events.
4226          */
4227         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4228                 struct hci_conn_params *param;
4229                 struct smp_irk *irk;
4230
4231                 /* Check if we need to convert to identity address */
4232                 irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4233                 if (irk) {
4234                         bdaddr = &irk->bdaddr;
4235                         bdaddr_type = irk->addr_type;
4236                 }
4237
4238                 if (type == LE_ADV_IND || type == LE_ADV_DIRECT_IND) {
4239                         if (check_pending_le_conn(hdev, bdaddr, bdaddr_type))
4240                                 return;
4241                 }
4242
4243                 if (list_empty(&hdev->pend_le_reports))
4244                         return;
4245
4246                 if (type == LE_ADV_DIRECT_IND)
4247                         return;
4248
4249                 param = hci_conn_params_lookup(hdev, bdaddr, bdaddr_type);
4250                 if (!param || param->auto_connect != HCI_AUTO_CONN_REPORT)
4251                         return;
4252
4253                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4254                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4255                 else
4256                         flags = 0;
4257                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4258                                   rssi, flags, data, len, NULL, 0);
4259                 return;
4260         }
4261
4262         /* When receiving non-connectable or scannable undirected
4263          * advertising reports, this means that the remote device is
4264          * not connectable and then clearly indicate this in the
4265          * device found event.
4266          *
4267          * When receiving a scan response, then there is no way to
4268          * know if the remote device is connectable or not. However
4269          * since scan responses are merged with a previously seen
4270          * advertising report, the flags field from that report
4271          * will be used.
4272          *
4273          * In the really unlikely case that a controller get confused
4274          * and just sends a scan response event, then it is marked as
4275          * not connectable as well.
4276          */
4277         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4278             type == LE_ADV_SCAN_RSP)
4279                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4280         else
4281                 flags = 0;
4282
4283         /* If there's nothing pending either store the data from this
4284          * event or send an immediate device found event if the data
4285          * should not be stored for later.
4286          */
4287         if (!has_pending_adv_report(hdev)) {
4288                 /* If the report will trigger a SCAN_REQ store it for
4289                  * later merging.
4290                  */
4291                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4292                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4293                                                  rssi, flags, data, len);
4294                         return;
4295                 }
4296
4297                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4298                                   rssi, flags, data, len, NULL, 0);
4299                 return;
4300         }
4301
4302         /* Check if the pending report is for the same device as the new one */
4303         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4304                  bdaddr_type == d->last_adv_addr_type);
4305
4306         /* If the pending data doesn't match this report or this isn't a
4307          * scan response (e.g. we got a duplicate ADV_IND) then force
4308          * sending of the pending data.
4309          */
4310         if (type != LE_ADV_SCAN_RSP || !match) {
4311                 /* Send out whatever is in the cache, but skip duplicates */
4312                 if (!match)
4313                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4314                                           d->last_adv_addr_type, NULL,
4315                                           d->last_adv_rssi, d->last_adv_flags,
4316                                           d->last_adv_data,
4317                                           d->last_adv_data_len, NULL, 0);
4318
4319                 /* If the new report will trigger a SCAN_REQ store it for
4320                  * later merging.
4321                  */
4322                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4323                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4324                                                  rssi, flags, data, len);
4325                         return;
4326                 }
4327
4328                 /* The advertising reports cannot be merged, so clear
4329                  * the pending report and send out a device found event.
4330                  */
4331                 clear_pending_adv_report(hdev);
4332                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4333                                   rssi, flags, data, len, NULL, 0);
4334                 return;
4335         }
4336
4337         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4338          * the new event is a SCAN_RSP. We can therefore proceed with
4339          * sending a merged device found event.
4340          */
4341         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4342                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4343                           d->last_adv_data, d->last_adv_data_len, data, len);
4344         clear_pending_adv_report(hdev);
4345 }
4346
4347 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4348 {
4349         u8 num_reports = skb->data[0];
4350         void *ptr = &skb->data[1];
4351
4352         hci_dev_lock(hdev);
4353
4354         while (num_reports--) {
4355                 struct hci_ev_le_advertising_info *ev = ptr;
4356                 s8 rssi;
4357
4358                 rssi = ev->data[ev->length];
4359                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
4360                                    ev->bdaddr_type, rssi, ev->data, ev->length);
4361
4362                 ptr += sizeof(*ev) + ev->length + 1;
4363         }
4364
4365         hci_dev_unlock(hdev);
4366 }
4367
4368 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4369 {
4370         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
4371         struct hci_cp_le_ltk_reply cp;
4372         struct hci_cp_le_ltk_neg_reply neg;
4373         struct hci_conn *conn;
4374         struct smp_ltk *ltk;
4375
4376         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
4377
4378         hci_dev_lock(hdev);
4379
4380         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4381         if (conn == NULL)
4382                 goto not_found;
4383
4384         ltk = hci_find_ltk(hdev, ev->ediv, ev->rand, conn->out);
4385         if (ltk == NULL)
4386                 goto not_found;
4387
4388         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
4389         cp.handle = cpu_to_le16(conn->handle);
4390
4391         if (ltk->authenticated)
4392                 conn->pending_sec_level = BT_SECURITY_HIGH;
4393         else
4394                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4395
4396         conn->enc_key_size = ltk->enc_size;
4397
4398         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4399
4400         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4401          * temporary key used to encrypt a connection following
4402          * pairing. It is used during the Encrypted Session Setup to
4403          * distribute the keys. Later, security can be re-established
4404          * using a distributed LTK.
4405          */
4406         if (ltk->type == SMP_STK) {
4407                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4408                 list_del(&ltk->list);
4409                 kfree(ltk);
4410         } else {
4411                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
4412         }
4413
4414         hci_dev_unlock(hdev);
4415
4416         return;
4417
4418 not_found:
4419         neg.handle = ev->handle;
4420         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4421         hci_dev_unlock(hdev);
4422 }
4423
4424 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
4425                                       u8 reason)
4426 {
4427         struct hci_cp_le_conn_param_req_neg_reply cp;
4428
4429         cp.handle = cpu_to_le16(handle);
4430         cp.reason = reason;
4431
4432         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
4433                      &cp);
4434 }
4435
4436 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
4437                                              struct sk_buff *skb)
4438 {
4439         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
4440         struct hci_cp_le_conn_param_req_reply cp;
4441         struct hci_conn *hcon;
4442         u16 handle, min, max, latency, timeout;
4443
4444         handle = le16_to_cpu(ev->handle);
4445         min = le16_to_cpu(ev->interval_min);
4446         max = le16_to_cpu(ev->interval_max);
4447         latency = le16_to_cpu(ev->latency);
4448         timeout = le16_to_cpu(ev->timeout);
4449
4450         hcon = hci_conn_hash_lookup_handle(hdev, handle);
4451         if (!hcon || hcon->state != BT_CONNECTED)
4452                 return send_conn_param_neg_reply(hdev, handle,
4453                                                  HCI_ERROR_UNKNOWN_CONN_ID);
4454
4455         if (hci_check_conn_params(min, max, latency, timeout))
4456                 return send_conn_param_neg_reply(hdev, handle,
4457                                                  HCI_ERROR_INVALID_LL_PARAMS);
4458
4459         if (test_bit(HCI_CONN_MASTER, &hcon->flags)) {
4460                 struct hci_conn_params *params;
4461                 u8 store_hint;
4462
4463                 hci_dev_lock(hdev);
4464
4465                 params = hci_conn_params_lookup(hdev, &hcon->dst,
4466                                                 hcon->dst_type);
4467                 if (params) {
4468                         params->conn_min_interval = min;
4469                         params->conn_max_interval = max;
4470                         params->conn_latency = latency;
4471                         params->supervision_timeout = timeout;
4472                         store_hint = 0x01;
4473                 } else{
4474                         store_hint = 0x00;
4475                 }
4476
4477                 hci_dev_unlock(hdev);
4478
4479                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
4480                                     store_hint, min, max, latency, timeout);
4481         }
4482
4483         cp.handle = ev->handle;
4484         cp.interval_min = ev->interval_min;
4485         cp.interval_max = ev->interval_max;
4486         cp.latency = ev->latency;
4487         cp.timeout = ev->timeout;
4488         cp.min_ce_len = 0;
4489         cp.max_ce_len = 0;
4490
4491         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
4492 }
4493
4494 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
4495 {
4496         struct hci_ev_le_meta *le_ev = (void *) skb->data;
4497
4498         skb_pull(skb, sizeof(*le_ev));
4499
4500         switch (le_ev->subevent) {
4501         case HCI_EV_LE_CONN_COMPLETE:
4502                 hci_le_conn_complete_evt(hdev, skb);
4503                 break;
4504
4505         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
4506                 hci_le_conn_update_complete_evt(hdev, skb);
4507                 break;
4508
4509         case HCI_EV_LE_ADVERTISING_REPORT:
4510                 hci_le_adv_report_evt(hdev, skb);
4511                 break;
4512
4513         case HCI_EV_LE_LTK_REQ:
4514                 hci_le_ltk_request_evt(hdev, skb);
4515                 break;
4516
4517         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
4518                 hci_le_remote_conn_param_req_evt(hdev, skb);
4519                 break;
4520
4521         default:
4522                 break;
4523         }
4524 }
4525
4526 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4527 {
4528         struct hci_ev_channel_selected *ev = (void *) skb->data;
4529         struct hci_conn *hcon;
4530
4531         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4532
4533         skb_pull(skb, sizeof(*ev));
4534
4535         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4536         if (!hcon)
4537                 return;
4538
4539         amp_read_loc_assoc_final_data(hdev, hcon);
4540 }
4541
4542 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4543 {
4544         struct hci_event_hdr *hdr = (void *) skb->data;
4545         __u8 event = hdr->evt;
4546
4547         hci_dev_lock(hdev);
4548
4549         /* Received events are (currently) only needed when a request is
4550          * ongoing so avoid unnecessary memory allocation.
4551          */
4552         if (hdev->req_status == HCI_REQ_PEND) {
4553                 kfree_skb(hdev->recv_evt);
4554                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4555         }
4556
4557         hci_dev_unlock(hdev);
4558
4559         skb_pull(skb, HCI_EVENT_HDR_SIZE);
4560
4561         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
4562                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
4563                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
4564
4565                 hci_req_cmd_complete(hdev, opcode, 0);
4566         }
4567
4568         switch (event) {
4569         case HCI_EV_INQUIRY_COMPLETE:
4570                 hci_inquiry_complete_evt(hdev, skb);
4571                 break;
4572
4573         case HCI_EV_INQUIRY_RESULT:
4574                 hci_inquiry_result_evt(hdev, skb);
4575                 break;
4576
4577         case HCI_EV_CONN_COMPLETE:
4578                 hci_conn_complete_evt(hdev, skb);
4579                 break;
4580
4581         case HCI_EV_CONN_REQUEST:
4582                 hci_conn_request_evt(hdev, skb);
4583                 break;
4584
4585         case HCI_EV_DISCONN_COMPLETE:
4586                 hci_disconn_complete_evt(hdev, skb);
4587                 break;
4588
4589         case HCI_EV_AUTH_COMPLETE:
4590                 hci_auth_complete_evt(hdev, skb);
4591                 break;
4592
4593         case HCI_EV_REMOTE_NAME:
4594                 hci_remote_name_evt(hdev, skb);
4595                 break;
4596
4597         case HCI_EV_ENCRYPT_CHANGE:
4598                 hci_encrypt_change_evt(hdev, skb);
4599                 break;
4600
4601         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
4602                 hci_change_link_key_complete_evt(hdev, skb);
4603                 break;
4604
4605         case HCI_EV_REMOTE_FEATURES:
4606                 hci_remote_features_evt(hdev, skb);
4607                 break;
4608
4609         case HCI_EV_CMD_COMPLETE:
4610                 hci_cmd_complete_evt(hdev, skb);
4611                 break;
4612
4613         case HCI_EV_CMD_STATUS:
4614                 hci_cmd_status_evt(hdev, skb);
4615                 break;
4616
4617         case HCI_EV_ROLE_CHANGE:
4618                 hci_role_change_evt(hdev, skb);
4619                 break;
4620
4621         case HCI_EV_NUM_COMP_PKTS:
4622                 hci_num_comp_pkts_evt(hdev, skb);
4623                 break;
4624
4625         case HCI_EV_MODE_CHANGE:
4626                 hci_mode_change_evt(hdev, skb);
4627                 break;
4628
4629         case HCI_EV_PIN_CODE_REQ:
4630                 hci_pin_code_request_evt(hdev, skb);
4631                 break;
4632
4633         case HCI_EV_LINK_KEY_REQ:
4634                 hci_link_key_request_evt(hdev, skb);
4635                 break;
4636
4637         case HCI_EV_LINK_KEY_NOTIFY:
4638                 hci_link_key_notify_evt(hdev, skb);
4639                 break;
4640
4641         case HCI_EV_CLOCK_OFFSET:
4642                 hci_clock_offset_evt(hdev, skb);
4643                 break;
4644
4645         case HCI_EV_PKT_TYPE_CHANGE:
4646                 hci_pkt_type_change_evt(hdev, skb);
4647                 break;
4648
4649         case HCI_EV_PSCAN_REP_MODE:
4650                 hci_pscan_rep_mode_evt(hdev, skb);
4651                 break;
4652
4653         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
4654                 hci_inquiry_result_with_rssi_evt(hdev, skb);
4655                 break;
4656
4657         case HCI_EV_REMOTE_EXT_FEATURES:
4658                 hci_remote_ext_features_evt(hdev, skb);
4659                 break;
4660
4661         case HCI_EV_SYNC_CONN_COMPLETE:
4662                 hci_sync_conn_complete_evt(hdev, skb);
4663                 break;
4664
4665         case HCI_EV_EXTENDED_INQUIRY_RESULT:
4666                 hci_extended_inquiry_result_evt(hdev, skb);
4667                 break;
4668
4669         case HCI_EV_KEY_REFRESH_COMPLETE:
4670                 hci_key_refresh_complete_evt(hdev, skb);
4671                 break;
4672
4673         case HCI_EV_IO_CAPA_REQUEST:
4674                 hci_io_capa_request_evt(hdev, skb);
4675                 break;
4676
4677         case HCI_EV_IO_CAPA_REPLY:
4678                 hci_io_capa_reply_evt(hdev, skb);
4679                 break;
4680
4681         case HCI_EV_USER_CONFIRM_REQUEST:
4682                 hci_user_confirm_request_evt(hdev, skb);
4683                 break;
4684
4685         case HCI_EV_USER_PASSKEY_REQUEST:
4686                 hci_user_passkey_request_evt(hdev, skb);
4687                 break;
4688
4689         case HCI_EV_USER_PASSKEY_NOTIFY:
4690                 hci_user_passkey_notify_evt(hdev, skb);
4691                 break;
4692
4693         case HCI_EV_KEYPRESS_NOTIFY:
4694                 hci_keypress_notify_evt(hdev, skb);
4695                 break;
4696
4697         case HCI_EV_SIMPLE_PAIR_COMPLETE:
4698                 hci_simple_pair_complete_evt(hdev, skb);
4699                 break;
4700
4701         case HCI_EV_REMOTE_HOST_FEATURES:
4702                 hci_remote_host_features_evt(hdev, skb);
4703                 break;
4704
4705         case HCI_EV_LE_META:
4706                 hci_le_meta_evt(hdev, skb);
4707                 break;
4708
4709         case HCI_EV_CHANNEL_SELECTED:
4710                 hci_chan_selected_evt(hdev, skb);
4711                 break;
4712
4713         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4714                 hci_remote_oob_data_request_evt(hdev, skb);
4715                 break;
4716
4717         case HCI_EV_PHY_LINK_COMPLETE:
4718                 hci_phy_link_complete_evt(hdev, skb);
4719                 break;
4720
4721         case HCI_EV_LOGICAL_LINK_COMPLETE:
4722                 hci_loglink_complete_evt(hdev, skb);
4723                 break;
4724
4725         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
4726                 hci_disconn_loglink_complete_evt(hdev, skb);
4727                 break;
4728
4729         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
4730                 hci_disconn_phylink_complete_evt(hdev, skb);
4731                 break;
4732
4733         case HCI_EV_NUM_COMP_BLOCKS:
4734                 hci_num_comp_blocks_evt(hdev, skb);
4735                 break;
4736
4737         default:
4738                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
4739                 break;
4740         }
4741
4742         kfree_skb(skb);
4743         hdev->stat.evt_rx++;
4744 }