net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "a2mp.h"
  34 #include "amp.h"
  35
  36 /* Handle HCI Event packets */
  37
  38 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  39 {
  40         __u8 status = *((__u8 *) skb->data);
  41
  42         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  43
  44         if (status)
  45                 return;
  46
  47         clear_bit(HCI_INQUIRY, &hdev->flags);
  48         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  49         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  50
  51         hci_conn_check_pending(hdev);
  52 }
  53
  54 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  55 {
  56         __u8 status = *((__u8 *) skb->data);
  57
  58         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  59
  60         if (status)
  61                 return;
  62
  63         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  64 }
  65
  66 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  67 {
  68         __u8 status = *((__u8 *) skb->data);
  69
  70         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  71
  72         if (status)
  73                 return;
  74
  75         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  76
  77         hci_conn_check_pending(hdev);
  78 }
  79
  80 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  81                                           struct sk_buff *skb)
  82 {
  83         BT_DBG("%s", hdev->name);
  84 }
  85
  86 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  87 {
  88         struct hci_rp_role_discovery *rp = (void *) skb->data;
  89         struct hci_conn *conn;
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
  92
  93         if (rp->status)
  94                 return;
  95
  96         hci_dev_lock(hdev);
  97
  98         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
  99         if (conn) {
 100                 if (rp->role)
 101                         conn->link_mode &= ~HCI_LM_MASTER;
 102                 else
 103                         conn->link_mode |= HCI_LM_MASTER;
 104         }
 105
 106         hci_dev_unlock(hdev);
 107 }
 108
 109 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 110 {
 111         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 112         struct hci_conn *conn;
 113
 114         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 115
 116         if (rp->status)
 117                 return;
 118
 119         hci_dev_lock(hdev);
 120
 121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 122         if (conn)
 123                 conn->link_policy = __le16_to_cpu(rp->policy);
 124
 125         hci_dev_unlock(hdev);
 126 }
 127
 128 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 129 {
 130         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 131         struct hci_conn *conn;
 132         void *sent;
 133
 134         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 135
 136         if (rp->status)
 137                 return;
 138
 139         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 140         if (!sent)
 141                 return;
 142
 143         hci_dev_lock(hdev);
 144
 145         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 146         if (conn)
 147                 conn->link_policy = get_unaligned_le16(sent + 2);
 148
 149         hci_dev_unlock(hdev);
 150 }
 151
 152 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 153                                         struct sk_buff *skb)
 154 {
 155         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 156
 157         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 158
 159         if (rp->status)
 160                 return;
 161
 162         hdev->link_policy = __le16_to_cpu(rp->policy);
 163 }
 164
 165 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 166                                          struct sk_buff *skb)
 167 {
 168         __u8 status = *((__u8 *) skb->data);
 169         void *sent;
 170
 171         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 172
 173         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 174         if (!sent)
 175                 return;
 176
 177         if (!status)
 178                 hdev->link_policy = get_unaligned_le16(sent);
 179 }
 180
 181 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 182 {
 183         __u8 status = *((__u8 *) skb->data);
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 186
 187         clear_bit(HCI_RESET, &hdev->flags);
 188
 189         /* Reset all non-persistent flags */
 190         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 191
 192         hdev->discovery.state = DISCOVERY_STOPPED;
 193         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 194         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 195
 196         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 197         hdev->adv_data_len = 0;
 198
 199         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 200         hdev->scan_rsp_data_len = 0;
 201
 202         hdev->le_scan_type = LE_SCAN_PASSIVE;
 203
 204         hdev->ssp_debug_mode = 0;
 205 }
 206
 207 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 208 {
 209         __u8 status = *((__u8 *) skb->data);
 210         void *sent;
 211
 212         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 213
 214         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 215         if (!sent)
 216                 return;
 217
 218         hci_dev_lock(hdev);
 219
 220         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 221                 mgmt_set_local_name_complete(hdev, sent, status);
 222         else if (!status)
 223                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 224
 225         hci_dev_unlock(hdev);
 226 }
 227
 228 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 229 {
 230         struct hci_rp_read_local_name *rp = (void *) skb->data;
 231
 232         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 233
 234         if (rp->status)
 235                 return;
 236
 237         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 238                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 239 }
 240
 241 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 242 {
 243         __u8 status = *((__u8 *) skb->data);
 244         void *sent;
 245
 246         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 247
 248         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 249         if (!sent)
 250                 return;
 251
 252         if (!status) {
 253                 __u8 param = *((__u8 *) sent);
 254
 255                 if (param == AUTH_ENABLED)
 256                         set_bit(HCI_AUTH, &hdev->flags);
 257                 else
 258                         clear_bit(HCI_AUTH, &hdev->flags);
 259         }
 260
 261         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 262                 mgmt_auth_enable_complete(hdev, status);
 263 }
 264
 265 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 266 {
 267         __u8 status = *((__u8 *) skb->data);
 268         void *sent;
 269
 270         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 271
 272         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 273         if (!sent)
 274                 return;
 275
 276         if (!status) {
 277                 __u8 param = *((__u8 *) sent);
 278
 279                 if (param)
 280                         set_bit(HCI_ENCRYPT, &hdev->flags);
 281                 else
 282                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 283         }
 284 }
 285
 286 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 287 {
 288         __u8 param, status = *((__u8 *) skb->data);
 289         int old_pscan, old_iscan;
 290         void *sent;
 291
 292         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 293
 294         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 295         if (!sent)
 296                 return;
 297
 298         param = *((__u8 *) sent);
 299
 300         hci_dev_lock(hdev);
 301
 302         if (status) {
 303                 mgmt_write_scan_failed(hdev, param, status);
 304                 hdev->discov_timeout = 0;
 305                 goto done;
 306         }
 307
 308         /* We need to ensure that we set this back on if someone changed
 309          * the scan mode through a raw HCI socket.
 310          */
 311         set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
 312
 313         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 314         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 315
 316         if (param & SCAN_INQUIRY) {
 317                 set_bit(HCI_ISCAN, &hdev->flags);
 318                 if (!old_iscan)
 319                         mgmt_discoverable(hdev, 1);
 320         } else if (old_iscan)
 321                 mgmt_discoverable(hdev, 0);
 322
 323         if (param & SCAN_PAGE) {
 324                 set_bit(HCI_PSCAN, &hdev->flags);
 325                 if (!old_pscan)
 326                         mgmt_connectable(hdev, 1);
 327         } else if (old_pscan)
 328                 mgmt_connectable(hdev, 0);
 329
 330 done:
 331         hci_dev_unlock(hdev);
 332 }
 333
 334 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 335 {
 336         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 337
 338         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 339
 340         if (rp->status)
 341                 return;
 342
 343         memcpy(hdev->dev_class, rp->dev_class, 3);
 344
 345         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 346                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 347 }
 348
 349 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 350 {
 351         __u8 status = *((__u8 *) skb->data);
 352         void *sent;
 353
 354         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 355
 356         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 357         if (!sent)
 358                 return;
 359
 360         hci_dev_lock(hdev);
 361
 362         if (status == 0)
 363                 memcpy(hdev->dev_class, sent, 3);
 364
 365         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 366                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 367
 368         hci_dev_unlock(hdev);
 369 }
 370
 371 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 372 {
 373         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 374         __u16 setting;
 375
 376         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 377
 378         if (rp->status)
 379                 return;
 380
 381         setting = __le16_to_cpu(rp->voice_setting);
 382
 383         if (hdev->voice_setting == setting)
 384                 return;
 385
 386         hdev->voice_setting = setting;
 387
 388         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 389
 390         if (hdev->notify)
 391                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 392 }
 393
 394 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 395                                        struct sk_buff *skb)
 396 {
 397         __u8 status = *((__u8 *) skb->data);
 398         __u16 setting;
 399         void *sent;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 402
 403         if (status)
 404                 return;
 405
 406         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 407         if (!sent)
 408                 return;
 409
 410         setting = get_unaligned_le16(sent);
 411
 412         if (hdev->voice_setting == setting)
 413                 return;
 414
 415         hdev->voice_setting = setting;
 416
 417         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 418
 419         if (hdev->notify)
 420                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 421 }
 422
 423 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 424                                           struct sk_buff *skb)
 425 {
 426         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 427
 428         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 429
 430         if (rp->status)
 431                 return;
 432
 433         hdev->num_iac = rp->num_iac;
 434
 435         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 436 }
 437
 438 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         struct hci_cp_write_ssp_mode *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 446         if (!sent)
 447                 return;
 448
 449         if (!status) {
 450                 if (sent->mode)
 451                         hdev->features[1][0] |= LMP_HOST_SSP;
 452                 else
 453                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 454         }
 455
 456         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 457                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 458         else if (!status) {
 459                 if (sent->mode)
 460                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 461                 else
 462                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 463         }
 464 }
 465
 466 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 467 {
 468         u8 status = *((u8 *) skb->data);
 469         struct hci_cp_write_sc_support *sent;
 470
 471         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 472
 473         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 474         if (!sent)
 475                 return;
 476
 477         if (!status) {
 478                 if (sent->support)
 479                         hdev->features[1][0] |= LMP_HOST_SC;
 480                 else
 481                         hdev->features[1][0] &= ~LMP_HOST_SC;
 482         }
 483
 484         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 485                 mgmt_sc_enable_complete(hdev, sent->support, status);
 486         else if (!status) {
 487                 if (sent->support)
 488                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 489                 else
 490                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 491         }
 492 }
 493
 494 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 495 {
 496         struct hci_rp_read_local_version *rp = (void *) skb->data;
 497
 498         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 499
 500         if (rp->status)
 501                 return;
 502
 503         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
 504                 hdev->hci_ver = rp->hci_ver;
 505                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 506                 hdev->lmp_ver = rp->lmp_ver;
 507                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 508                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 509         }
 510 }
 511
 512 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 513                                        struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 518
 519         if (rp->status)
 520                 return;
 521
 522         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 523                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 524 }
 525
 526 static void hci_cc_read_local_features(struct hci_dev *hdev,
 527                                        struct sk_buff *skb)
 528 {
 529         struct hci_rp_read_local_features *rp = (void *) skb->data;
 530
 531         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 532
 533         if (rp->status)
 534                 return;
 535
 536         memcpy(hdev->features, rp->features, 8);
 537
 538         /* Adjust default settings according to features
 539          * supported by device. */
 540
 541         if (hdev->features[0][0] & LMP_3SLOT)
 542                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 543
 544         if (hdev->features[0][0] & LMP_5SLOT)
 545                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 546
 547         if (hdev->features[0][1] & LMP_HV2) {
 548                 hdev->pkt_type  |= (HCI_HV2);
 549                 hdev->esco_type |= (ESCO_HV2);
 550         }
 551
 552         if (hdev->features[0][1] & LMP_HV3) {
 553                 hdev->pkt_type  |= (HCI_HV3);
 554                 hdev->esco_type |= (ESCO_HV3);
 555         }
 556
 557         if (lmp_esco_capable(hdev))
 558                 hdev->esco_type |= (ESCO_EV3);
 559
 560         if (hdev->features[0][4] & LMP_EV4)
 561                 hdev->esco_type |= (ESCO_EV4);
 562
 563         if (hdev->features[0][4] & LMP_EV5)
 564                 hdev->esco_type |= (ESCO_EV5);
 565
 566         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 567                 hdev->esco_type |= (ESCO_2EV3);
 568
 569         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 570                 hdev->esco_type |= (ESCO_3EV3);
 571
 572         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 573                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 574 }
 575
 576 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 577                                            struct sk_buff *skb)
 578 {
 579         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 580
 581         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 582
 583         if (rp->status)
 584                 return;
 585
 586         if (hdev->max_page < rp->max_page)
 587                 hdev->max_page = rp->max_page;
 588
 589         if (rp->page < HCI_MAX_PAGES)
 590                 memcpy(hdev->features[rp->page], rp->features, 8);
 591 }
 592
 593 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 594                                           struct sk_buff *skb)
 595 {
 596         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 597
 598         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 599
 600         if (!rp->status)
 601                 hdev->flow_ctl_mode = rp->mode;
 602 }
 603
 604 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 605 {
 606         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 607
 608         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 609
 610         if (rp->status)
 611                 return;
 612
 613         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 614         hdev->sco_mtu  = rp->sco_mtu;
 615         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 616         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 617
 618         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 619                 hdev->sco_mtu  = 64;
 620                 hdev->sco_pkts = 8;
 621         }
 622
 623         hdev->acl_cnt = hdev->acl_pkts;
 624         hdev->sco_cnt = hdev->sco_pkts;
 625
 626         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 627                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 628 }
 629
 630 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 631 {
 632         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 633
 634         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 635
 636         if (!rp->status)
 637                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 638 }
 639
 640 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 641                                            struct sk_buff *skb)
 642 {
 643         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 644
 645         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 646
 647         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status) {
 648                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 649                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 650         }
 651 }
 652
 653 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 654                                             struct sk_buff *skb)
 655 {
 656         u8 status = *((u8 *) skb->data);
 657         struct hci_cp_write_page_scan_activity *sent;
 658
 659         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 660
 661         if (status)
 662                 return;
 663
 664         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 665         if (!sent)
 666                 return;
 667
 668         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 669         hdev->page_scan_window = __le16_to_cpu(sent->window);
 670 }
 671
 672 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 673                                            struct sk_buff *skb)
 674 {
 675         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 676
 677         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 678
 679         if (test_bit(HCI_INIT, &hdev->flags) && !rp->status)
 680                 hdev->page_scan_type = rp->type;
 681 }
 682
 683 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 684                                         struct sk_buff *skb)
 685 {
 686         u8 status = *((u8 *) skb->data);
 687         u8 *type;
 688
 689         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 690
 691         if (status)
 692                 return;
 693
 694         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 695         if (type)
 696                 hdev->page_scan_type = *type;
 697 }
 698
 699 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 700                                         struct sk_buff *skb)
 701 {
 702         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 703
 704         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 705
 706         if (rp->status)
 707                 return;
 708
 709         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 710         hdev->block_len = __le16_to_cpu(rp->block_len);
 711         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 712
 713         hdev->block_cnt = hdev->num_blocks;
 714
 715         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 716                hdev->block_cnt, hdev->block_len);
 717 }
 718
 719 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 720                                        struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 goto a2mp_rsp;
 728
 729         hdev->amp_status = rp->amp_status;
 730         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 731         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 732         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 733         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 734         hdev->amp_type = rp->amp_type;
 735         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 736         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 737         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 738         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 739
 740 a2mp_rsp:
 741         a2mp_send_getinfo_rsp(hdev);
 742 }
 743
 744 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 745                                         struct sk_buff *skb)
 746 {
 747         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 748         struct amp_assoc *assoc = &hdev->loc_assoc;
 749         size_t rem_len, frag_len;
 750
 751         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 752
 753         if (rp->status)
 754                 goto a2mp_rsp;
 755
 756         frag_len = skb->len - sizeof(*rp);
 757         rem_len = __le16_to_cpu(rp->rem_len);
 758
 759         if (rem_len > frag_len) {
 760                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 761
 762                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 763                 assoc->offset += frag_len;
 764
 765                 /* Read other fragments */
 766                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 767
 768                 return;
 769         }
 770
 771         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 772         assoc->len = assoc->offset + rem_len;
 773         assoc->offset = 0;
 774
 775 a2mp_rsp:
 776         /* Send A2MP Rsp when all fragments are received */
 777         a2mp_send_getampassoc_rsp(hdev, rp->status);
 778         a2mp_send_create_phy_link_req(hdev, rp->status);
 779 }
 780
 781 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 782                                          struct sk_buff *skb)
 783 {
 784         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 785
 786         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 787
 788         if (!rp->status)
 789                 hdev->inq_tx_power = rp->tx_power;
 790 }
 791
 792 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 793 {
 794         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 795         struct hci_cp_pin_code_reply *cp;
 796         struct hci_conn *conn;
 797
 798         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 799
 800         hci_dev_lock(hdev);
 801
 802         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 803                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 804
 805         if (rp->status)
 806                 goto unlock;
 807
 808         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 809         if (!cp)
 810                 goto unlock;
 811
 812         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 813         if (conn)
 814                 conn->pin_length = cp->pin_len;
 815
 816 unlock:
 817         hci_dev_unlock(hdev);
 818 }
 819
 820 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 821 {
 822         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 823
 824         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 825
 826         hci_dev_lock(hdev);
 827
 828         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 829                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 830                                                  rp->status);
 831
 832         hci_dev_unlock(hdev);
 833 }
 834
 835 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 836                                        struct sk_buff *skb)
 837 {
 838         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 839
 840         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 841
 842         if (rp->status)
 843                 return;
 844
 845         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 846         hdev->le_pkts = rp->le_max_pkt;
 847
 848         hdev->le_cnt = hdev->le_pkts;
 849
 850         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 851 }
 852
 853 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 854                                           struct sk_buff *skb)
 855 {
 856         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 857
 858         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 859
 860         if (!rp->status)
 861                 memcpy(hdev->le_features, rp->features, 8);
 862 }
 863
 864 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 865                                         struct sk_buff *skb)
 866 {
 867         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 868
 869         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 870
 871         if (!rp->status)
 872                 hdev->adv_tx_power = rp->tx_power;
 873 }
 874
 875 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 876 {
 877         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 878
 879         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 880
 881         hci_dev_lock(hdev);
 882
 883         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 884                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 885                                                  rp->status);
 886
 887         hci_dev_unlock(hdev);
 888 }
 889
 890 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 891                                           struct sk_buff *skb)
 892 {
 893         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 894
 895         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 896
 897         hci_dev_lock(hdev);
 898
 899         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 900                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 901                                                      ACL_LINK, 0, rp->status);
 902
 903         hci_dev_unlock(hdev);
 904 }
 905
 906 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 907 {
 908         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 909
 910         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 911
 912         hci_dev_lock(hdev);
 913
 914         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 915                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 916                                                  0, rp->status);
 917
 918         hci_dev_unlock(hdev);
 919 }
 920
 921 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 922                                           struct sk_buff *skb)
 923 {
 924         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 925
 926         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 927
 928         hci_dev_lock(hdev);
 929
 930         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 931                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
 932                                                      ACL_LINK, 0, rp->status);
 933
 934         hci_dev_unlock(hdev);
 935 }
 936
 937 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
 938                                        struct sk_buff *skb)
 939 {
 940         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 941
 942         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 943
 944         hci_dev_lock(hdev);
 945         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->randomizer,
 946                                           NULL, NULL, rp->status);
 947         hci_dev_unlock(hdev);
 948 }
 949
 950 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
 951                                            struct sk_buff *skb)
 952 {
 953         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
 954
 955         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 956
 957         hci_dev_lock(hdev);
 958         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->randomizer192,
 959                                           rp->hash256, rp->randomizer256,
 960                                           rp->status);
 961         hci_dev_unlock(hdev);
 962 }
 963
 964
 965 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
 966 {
 967         __u8 status = *((__u8 *) skb->data);
 968         bdaddr_t *sent;
 969
 970         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 971
 972         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
 973         if (!sent)
 974                 return;
 975
 976         hci_dev_lock(hdev);
 977
 978         if (!status)
 979                 bacpy(&hdev->random_addr, sent);
 980
 981         hci_dev_unlock(hdev);
 982 }
 983
 984 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
 985 {
 986         __u8 *sent, status = *((__u8 *) skb->data);
 987
 988         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 989
 990         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
 991         if (!sent)
 992                 return;
 993
 994         hci_dev_lock(hdev);
 995
 996         if (!status)
 997                 mgmt_advertising(hdev, *sent);
 998
 999         hci_dev_unlock(hdev);
1000 }
1001
1002 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1003 {
1004         struct hci_cp_le_set_scan_param *cp;
1005         __u8 status = *((__u8 *) skb->data);
1006
1007         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1008
1009         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1010         if (!cp)
1011                 return;
1012
1013         hci_dev_lock(hdev);
1014
1015         if (!status)
1016                 hdev->le_scan_type = cp->type;
1017
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1022                                       struct sk_buff *skb)
1023 {
1024         struct hci_cp_le_set_scan_enable *cp;
1025         __u8 status = *((__u8 *) skb->data);
1026
1027         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1028
1029         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1030         if (!cp)
1031                 return;
1032
1033         if (status)
1034                 return;
1035
1036         switch (cp->enable) {
1037         case LE_SCAN_ENABLE:
1038                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1039                 break;
1040
1041         case LE_SCAN_DISABLE:
1042                 /* Cancel this timer so that we don't try to disable scanning
1043                  * when it's already disabled.
1044                  */
1045                 cancel_delayed_work(&hdev->le_scan_disable);
1046
1047                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1048                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1049                  * interrupted scanning due to a connect request. Mark
1050                  * therefore discovery as stopped.
1051                  */
1052                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1053                                        &hdev->dev_flags))
1054                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1055                 break;
1056
1057         default:
1058                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1059                 break;
1060         }
1061 }
1062
1063 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1064                                            struct sk_buff *skb)
1065 {
1066         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1067
1068         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1069
1070         if (!rp->status)
1071                 hdev->le_white_list_size = rp->size;
1072 }
1073
1074 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1075                                        struct sk_buff *skb)
1076 {
1077         __u8 status = *((__u8 *) skb->data);
1078
1079         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1080
1081         if (!status)
1082                 hci_white_list_clear(hdev);
1083 }
1084
1085 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1086                                         struct sk_buff *skb)
1087 {
1088         struct hci_cp_le_add_to_white_list *sent;
1089         __u8 status = *((__u8 *) skb->data);
1090
1091         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1092
1093         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1094         if (!sent)
1095                 return;
1096
1097         if (!status)
1098                 hci_white_list_add(hdev, &sent->bdaddr, sent->bdaddr_type);
1099 }
1100
1101 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1102                                           struct sk_buff *skb)
1103 {
1104         struct hci_cp_le_del_from_white_list *sent;
1105         __u8 status = *((__u8 *) skb->data);
1106
1107         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1108
1109         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1110         if (!sent)
1111                 return;
1112
1113         if (!status)
1114                 hci_white_list_del(hdev, &sent->bdaddr, sent->bdaddr_type);
1115 }
1116
1117 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1118                                             struct sk_buff *skb)
1119 {
1120         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1121
1122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1123
1124         if (!rp->status)
1125                 memcpy(hdev->le_states, rp->le_states, 8);
1126 }
1127
1128 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1129                                            struct sk_buff *skb)
1130 {
1131         struct hci_cp_write_le_host_supported *sent;
1132         __u8 status = *((__u8 *) skb->data);
1133
1134         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1135
1136         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1137         if (!sent)
1138                 return;
1139
1140         if (!status) {
1141                 if (sent->le) {
1142                         hdev->features[1][0] |= LMP_HOST_LE;
1143                         set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1144                 } else {
1145                         hdev->features[1][0] &= ~LMP_HOST_LE;
1146                         clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1147                         clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1148                 }
1149
1150                 if (sent->simul)
1151                         hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1152                 else
1153                         hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1154         }
1155 }
1156
1157 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1158 {
1159         struct hci_cp_le_set_adv_param *cp;
1160         u8 status = *((u8 *) skb->data);
1161
1162         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1163
1164         if (status)
1165                 return;
1166
1167         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1168         if (!cp)
1169                 return;
1170
1171         hci_dev_lock(hdev);
1172         hdev->adv_addr_type = cp->own_address_type;
1173         hci_dev_unlock(hdev);
1174 }
1175
1176 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1177                                           struct sk_buff *skb)
1178 {
1179         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1180
1181         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1182                hdev->name, rp->status, rp->phy_handle);
1183
1184         if (rp->status)
1185                 return;
1186
1187         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1188 }
1189
1190 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1191 {
1192         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1193
1194         if (status) {
1195                 hci_conn_check_pending(hdev);
1196                 return;
1197         }
1198
1199         set_bit(HCI_INQUIRY, &hdev->flags);
1200 }
1201
1202 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1203 {
1204         struct hci_cp_create_conn *cp;
1205         struct hci_conn *conn;
1206
1207         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1208
1209         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1210         if (!cp)
1211                 return;
1212
1213         hci_dev_lock(hdev);
1214
1215         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1216
1217         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1218
1219         if (status) {
1220                 if (conn && conn->state == BT_CONNECT) {
1221                         if (status != 0x0c || conn->attempt > 2) {
1222                                 conn->state = BT_CLOSED;
1223                                 hci_proto_connect_cfm(conn, status);
1224                                 hci_conn_del(conn);
1225                         } else
1226                                 conn->state = BT_CONNECT2;
1227                 }
1228         } else {
1229                 if (!conn) {
1230                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1231                         if (conn) {
1232                                 conn->out = true;
1233                                 conn->link_mode |= HCI_LM_MASTER;
1234                         } else
1235                                 BT_ERR("No memory for new connection");
1236                 }
1237         }
1238
1239         hci_dev_unlock(hdev);
1240 }
1241
1242 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1243 {
1244         struct hci_cp_add_sco *cp;
1245         struct hci_conn *acl, *sco;
1246         __u16 handle;
1247
1248         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1249
1250         if (!status)
1251                 return;
1252
1253         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1254         if (!cp)
1255                 return;
1256
1257         handle = __le16_to_cpu(cp->handle);
1258
1259         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1260
1261         hci_dev_lock(hdev);
1262
1263         acl = hci_conn_hash_lookup_handle(hdev, handle);
1264         if (acl) {
1265                 sco = acl->link;
1266                 if (sco) {
1267                         sco->state = BT_CLOSED;
1268
1269                         hci_proto_connect_cfm(sco, status);
1270                         hci_conn_del(sco);
1271                 }
1272         }
1273
1274         hci_dev_unlock(hdev);
1275 }
1276
1277 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1278 {
1279         struct hci_cp_auth_requested *cp;
1280         struct hci_conn *conn;
1281
1282         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1283
1284         if (!status)
1285                 return;
1286
1287         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1288         if (!cp)
1289                 return;
1290
1291         hci_dev_lock(hdev);
1292
1293         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1294         if (conn) {
1295                 if (conn->state == BT_CONFIG) {
1296                         hci_proto_connect_cfm(conn, status);
1297                         hci_conn_drop(conn);
1298                 }
1299         }
1300
1301         hci_dev_unlock(hdev);
1302 }
1303
1304 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1305 {
1306         struct hci_cp_set_conn_encrypt *cp;
1307         struct hci_conn *conn;
1308
1309         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1310
1311         if (!status)
1312                 return;
1313
1314         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1315         if (!cp)
1316                 return;
1317
1318         hci_dev_lock(hdev);
1319
1320         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1321         if (conn) {
1322                 if (conn->state == BT_CONFIG) {
1323                         hci_proto_connect_cfm(conn, status);
1324                         hci_conn_drop(conn);
1325                 }
1326         }
1327
1328         hci_dev_unlock(hdev);
1329 }
1330
1331 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1332                                     struct hci_conn *conn)
1333 {
1334         if (conn->state != BT_CONFIG || !conn->out)
1335                 return 0;
1336
1337         if (conn->pending_sec_level == BT_SECURITY_SDP)
1338                 return 0;
1339
1340         /* Only request authentication for SSP connections or non-SSP
1341          * devices with sec_level MEDIUM or HIGH or if MITM protection
1342          * is requested.
1343          */
1344         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1345             conn->pending_sec_level != BT_SECURITY_HIGH &&
1346             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1347                 return 0;
1348
1349         return 1;
1350 }
1351
1352 static int hci_resolve_name(struct hci_dev *hdev,
1353                                    struct inquiry_entry *e)
1354 {
1355         struct hci_cp_remote_name_req cp;
1356
1357         memset(&cp, 0, sizeof(cp));
1358
1359         bacpy(&cp.bdaddr, &e->data.bdaddr);
1360         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1361         cp.pscan_mode = e->data.pscan_mode;
1362         cp.clock_offset = e->data.clock_offset;
1363
1364         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1365 }
1366
1367 static bool hci_resolve_next_name(struct hci_dev *hdev)
1368 {
1369         struct discovery_state *discov = &hdev->discovery;
1370         struct inquiry_entry *e;
1371
1372         if (list_empty(&discov->resolve))
1373                 return false;
1374
1375         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1376         if (!e)
1377                 return false;
1378
1379         if (hci_resolve_name(hdev, e) == 0) {
1380                 e->name_state = NAME_PENDING;
1381                 return true;
1382         }
1383
1384         return false;
1385 }
1386
1387 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1388                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1389 {
1390         struct discovery_state *discov = &hdev->discovery;
1391         struct inquiry_entry *e;
1392
1393         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1394                 mgmt_device_connected(hdev, bdaddr, ACL_LINK, 0x00, 0, name,
1395                                       name_len, conn->dev_class);
1396
1397         if (discov->state == DISCOVERY_STOPPED)
1398                 return;
1399
1400         if (discov->state == DISCOVERY_STOPPING)
1401                 goto discov_complete;
1402
1403         if (discov->state != DISCOVERY_RESOLVING)
1404                 return;
1405
1406         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1407         /* If the device was not found in a list of found devices names of which
1408          * are pending. there is no need to continue resolving a next name as it
1409          * will be done upon receiving another Remote Name Request Complete
1410          * Event */
1411         if (!e)
1412                 return;
1413
1414         list_del(&e->list);
1415         if (name) {
1416                 e->name_state = NAME_KNOWN;
1417                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1418                                  e->data.rssi, name, name_len);
1419         } else {
1420                 e->name_state = NAME_NOT_KNOWN;
1421         }
1422
1423         if (hci_resolve_next_name(hdev))
1424                 return;
1425
1426 discov_complete:
1427         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1428 }
1429
1430 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1431 {
1432         struct hci_cp_remote_name_req *cp;
1433         struct hci_conn *conn;
1434
1435         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1436
1437         /* If successful wait for the name req complete event before
1438          * checking for the need to do authentication */
1439         if (!status)
1440                 return;
1441
1442         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1443         if (!cp)
1444                 return;
1445
1446         hci_dev_lock(hdev);
1447
1448         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1449
1450         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1451                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1452
1453         if (!conn)
1454                 goto unlock;
1455
1456         if (!hci_outgoing_auth_needed(hdev, conn))
1457                 goto unlock;
1458
1459         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1460                 struct hci_cp_auth_requested auth_cp;
1461
1462                 auth_cp.handle = __cpu_to_le16(conn->handle);
1463                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1464                              sizeof(auth_cp), &auth_cp);
1465         }
1466
1467 unlock:
1468         hci_dev_unlock(hdev);
1469 }
1470
1471 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1472 {
1473         struct hci_cp_read_remote_features *cp;
1474         struct hci_conn *conn;
1475
1476         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1477
1478         if (!status)
1479                 return;
1480
1481         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1482         if (!cp)
1483                 return;
1484
1485         hci_dev_lock(hdev);
1486
1487         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1488         if (conn) {
1489                 if (conn->state == BT_CONFIG) {
1490                         hci_proto_connect_cfm(conn, status);
1491                         hci_conn_drop(conn);
1492                 }
1493         }
1494
1495         hci_dev_unlock(hdev);
1496 }
1497
1498 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1499 {
1500         struct hci_cp_read_remote_ext_features *cp;
1501         struct hci_conn *conn;
1502
1503         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1504
1505         if (!status)
1506                 return;
1507
1508         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1509         if (!cp)
1510                 return;
1511
1512         hci_dev_lock(hdev);
1513
1514         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1515         if (conn) {
1516                 if (conn->state == BT_CONFIG) {
1517                         hci_proto_connect_cfm(conn, status);
1518                         hci_conn_drop(conn);
1519                 }
1520         }
1521
1522         hci_dev_unlock(hdev);
1523 }
1524
1525 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1526 {
1527         struct hci_cp_setup_sync_conn *cp;
1528         struct hci_conn *acl, *sco;
1529         __u16 handle;
1530
1531         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1532
1533         if (!status)
1534                 return;
1535
1536         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1537         if (!cp)
1538                 return;
1539
1540         handle = __le16_to_cpu(cp->handle);
1541
1542         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1543
1544         hci_dev_lock(hdev);
1545
1546         acl = hci_conn_hash_lookup_handle(hdev, handle);
1547         if (acl) {
1548                 sco = acl->link;
1549                 if (sco) {
1550                         sco->state = BT_CLOSED;
1551
1552                         hci_proto_connect_cfm(sco, status);
1553                         hci_conn_del(sco);
1554                 }
1555         }
1556
1557         hci_dev_unlock(hdev);
1558 }
1559
1560 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1561 {
1562         struct hci_cp_sniff_mode *cp;
1563         struct hci_conn *conn;
1564
1565         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1566
1567         if (!status)
1568                 return;
1569
1570         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1571         if (!cp)
1572                 return;
1573
1574         hci_dev_lock(hdev);
1575
1576         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1577         if (conn) {
1578                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1579
1580                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1581                         hci_sco_setup(conn, status);
1582         }
1583
1584         hci_dev_unlock(hdev);
1585 }
1586
1587 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1588 {
1589         struct hci_cp_exit_sniff_mode *cp;
1590         struct hci_conn *conn;
1591
1592         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594         if (!status)
1595                 return;
1596
1597         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1598         if (!cp)
1599                 return;
1600
1601         hci_dev_lock(hdev);
1602
1603         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1604         if (conn) {
1605                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1606
1607                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1608                         hci_sco_setup(conn, status);
1609         }
1610
1611         hci_dev_unlock(hdev);
1612 }
1613
1614 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1615 {
1616         struct hci_cp_disconnect *cp;
1617         struct hci_conn *conn;
1618
1619         if (!status)
1620                 return;
1621
1622         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1623         if (!cp)
1624                 return;
1625
1626         hci_dev_lock(hdev);
1627
1628         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1629         if (conn)
1630                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1631                                        conn->dst_type, status);
1632
1633         hci_dev_unlock(hdev);
1634 }
1635
1636 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
1637 {
1638         struct hci_cp_create_phy_link *cp;
1639
1640         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1641
1642         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
1643         if (!cp)
1644                 return;
1645
1646         hci_dev_lock(hdev);
1647
1648         if (status) {
1649                 struct hci_conn *hcon;
1650
1651                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
1652                 if (hcon)
1653                         hci_conn_del(hcon);
1654         } else {
1655                 amp_write_remote_assoc(hdev, cp->phy_handle);
1656         }
1657
1658         hci_dev_unlock(hdev);
1659 }
1660
1661 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
1662 {
1663         struct hci_cp_accept_phy_link *cp;
1664
1665         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1666
1667         if (status)
1668                 return;
1669
1670         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
1671         if (!cp)
1672                 return;
1673
1674         amp_write_remote_assoc(hdev, cp->phy_handle);
1675 }
1676
1677 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1678 {
1679         struct hci_cp_le_create_conn *cp;
1680         struct hci_conn *conn;
1681
1682         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1683
1684         /* All connection failure handling is taken care of by the
1685          * hci_le_conn_failed function which is triggered by the HCI
1686          * request completion callbacks used for connecting.
1687          */
1688         if (status)
1689                 return;
1690
1691         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1692         if (!cp)
1693                 return;
1694
1695         hci_dev_lock(hdev);
1696
1697         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1698         if (!conn)
1699                 goto unlock;
1700
1701         /* Store the initiator and responder address information which
1702          * is needed for SMP. These values will not change during the
1703          * lifetime of the connection.
1704          */
1705         conn->init_addr_type = cp->own_address_type;
1706         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1707                 bacpy(&conn->init_addr, &hdev->random_addr);
1708         else
1709                 bacpy(&conn->init_addr, &hdev->bdaddr);
1710
1711         conn->resp_addr_type = cp->peer_addr_type;
1712         bacpy(&conn->resp_addr, &cp->peer_addr);
1713
1714         /* We don't want the connection attempt to stick around
1715          * indefinitely since LE doesn't have a page timeout concept
1716          * like BR/EDR. Set a timer for any connection that doesn't use
1717          * the white list for connecting.
1718          */
1719         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1720                 queue_delayed_work(conn->hdev->workqueue,
1721                                    &conn->le_conn_timeout,
1722                                    HCI_LE_CONN_TIMEOUT);
1723
1724 unlock:
1725         hci_dev_unlock(hdev);
1726 }
1727
1728 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1729 {
1730         __u8 status = *((__u8 *) skb->data);
1731         struct discovery_state *discov = &hdev->discovery;
1732         struct inquiry_entry *e;
1733
1734         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1735
1736         hci_conn_check_pending(hdev);
1737
1738         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1739                 return;
1740
1741         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
1742         wake_up_bit(&hdev->flags, HCI_INQUIRY);
1743
1744         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1745                 return;
1746
1747         hci_dev_lock(hdev);
1748
1749         if (discov->state != DISCOVERY_FINDING)
1750                 goto unlock;
1751
1752         if (list_empty(&discov->resolve)) {
1753                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1754                 goto unlock;
1755         }
1756
1757         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1758         if (e && hci_resolve_name(hdev, e) == 0) {
1759                 e->name_state = NAME_PENDING;
1760                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
1761         } else {
1762                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1763         }
1764
1765 unlock:
1766         hci_dev_unlock(hdev);
1767 }
1768
1769 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1770 {
1771         struct inquiry_data data;
1772         struct inquiry_info *info = (void *) (skb->data + 1);
1773         int num_rsp = *((__u8 *) skb->data);
1774
1775         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1776
1777         if (!num_rsp)
1778                 return;
1779
1780         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
1781                 return;
1782
1783         hci_dev_lock(hdev);
1784
1785         for (; num_rsp; num_rsp--, info++) {
1786                 bool name_known, ssp;
1787
1788                 bacpy(&data.bdaddr, &info->bdaddr);
1789                 data.pscan_rep_mode     = info->pscan_rep_mode;
1790                 data.pscan_period_mode  = info->pscan_period_mode;
1791                 data.pscan_mode         = info->pscan_mode;
1792                 memcpy(data.dev_class, info->dev_class, 3);
1793                 data.clock_offset       = info->clock_offset;
1794                 data.rssi               = 0x00;
1795                 data.ssp_mode           = 0x00;
1796
1797                 name_known = hci_inquiry_cache_update(hdev, &data, false, &ssp);
1798                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1799                                   info->dev_class, 0, !name_known, ssp, NULL,
1800                                   0);
1801         }
1802
1803         hci_dev_unlock(hdev);
1804 }
1805
1806 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1807 {
1808         struct hci_ev_conn_complete *ev = (void *) skb->data;
1809         struct hci_conn *conn;
1810
1811         BT_DBG("%s", hdev->name);
1812
1813         hci_dev_lock(hdev);
1814
1815         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1816         if (!conn) {
1817                 if (ev->link_type != SCO_LINK)
1818                         goto unlock;
1819
1820                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1821                 if (!conn)
1822                         goto unlock;
1823
1824                 conn->type = SCO_LINK;
1825         }
1826
1827         if (!ev->status) {
1828                 conn->handle = __le16_to_cpu(ev->handle);
1829
1830                 if (conn->type == ACL_LINK) {
1831                         conn->state = BT_CONFIG;
1832                         hci_conn_hold(conn);
1833
1834                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
1835                             !hci_find_link_key(hdev, &ev->bdaddr))
1836                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
1837                         else
1838                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1839                 } else
1840                         conn->state = BT_CONNECTED;
1841
1842                 hci_conn_add_sysfs(conn);
1843
1844                 if (test_bit(HCI_AUTH, &hdev->flags))
1845                         conn->link_mode |= HCI_LM_AUTH;
1846
1847                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1848                         conn->link_mode |= HCI_LM_ENCRYPT;
1849
1850                 /* Get remote features */
1851                 if (conn->type == ACL_LINK) {
1852                         struct hci_cp_read_remote_features cp;
1853                         cp.handle = ev->handle;
1854                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1855                                      sizeof(cp), &cp);
1856                 }
1857
1858                 /* Set packet type for incoming connection */
1859                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1860                         struct hci_cp_change_conn_ptype cp;
1861                         cp.handle = ev->handle;
1862                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1863                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
1864                                      &cp);
1865                 }
1866         } else {
1867                 conn->state = BT_CLOSED;
1868                 if (conn->type == ACL_LINK)
1869                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
1870                                             conn->dst_type, ev->status);
1871         }
1872
1873         if (conn->type == ACL_LINK)
1874                 hci_sco_setup(conn, ev->status);
1875
1876         if (ev->status) {
1877                 hci_proto_connect_cfm(conn, ev->status);
1878                 hci_conn_del(conn);
1879         } else if (ev->link_type != ACL_LINK)
1880                 hci_proto_connect_cfm(conn, ev->status);
1881
1882 unlock:
1883         hci_dev_unlock(hdev);
1884
1885         hci_conn_check_pending(hdev);
1886 }
1887
1888 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1889 {
1890         struct hci_ev_conn_request *ev = (void *) skb->data;
1891         int mask = hdev->link_mode;
1892         __u8 flags = 0;
1893
1894         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
1895                ev->link_type);
1896
1897         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
1898                                       &flags);
1899
1900         if ((mask & HCI_LM_ACCEPT) &&
1901             !hci_blacklist_lookup(hdev, &ev->bdaddr, BDADDR_BREDR)) {
1902                 /* Connection accepted */
1903                 struct inquiry_entry *ie;
1904                 struct hci_conn *conn;
1905
1906                 hci_dev_lock(hdev);
1907
1908                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1909                 if (ie)
1910                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1911
1912                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
1913                                                &ev->bdaddr);
1914                 if (!conn) {
1915                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1916                         if (!conn) {
1917                                 BT_ERR("No memory for new connection");
1918                                 hci_dev_unlock(hdev);
1919                                 return;
1920                         }
1921                 }
1922
1923                 memcpy(conn->dev_class, ev->dev_class, 3);
1924
1925                 hci_dev_unlock(hdev);
1926
1927                 if (ev->link_type == ACL_LINK ||
1928                     (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
1929                         struct hci_cp_accept_conn_req cp;
1930                         conn->state = BT_CONNECT;
1931
1932                         bacpy(&cp.bdaddr, &ev->bdaddr);
1933
1934                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1935                                 cp.role = 0x00; /* Become master */
1936                         else
1937                                 cp.role = 0x01; /* Remain slave */
1938
1939                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp),
1940                                      &cp);
1941                 } else if (!(flags & HCI_PROTO_DEFER)) {
1942                         struct hci_cp_accept_sync_conn_req cp;
1943                         conn->state = BT_CONNECT;
1944
1945                         bacpy(&cp.bdaddr, &ev->bdaddr);
1946                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1947
1948                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1949                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1950                         cp.max_latency    = cpu_to_le16(0xffff);
1951                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1952                         cp.retrans_effort = 0xff;
1953
1954                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1955                                      sizeof(cp), &cp);
1956                 } else {
1957                         conn->state = BT_CONNECT2;
1958                         hci_proto_connect_cfm(conn, 0);
1959                 }
1960         } else {
1961                 /* Connection rejected */
1962                 struct hci_cp_reject_conn_req cp;
1963
1964                 bacpy(&cp.bdaddr, &ev->bdaddr);
1965                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1966                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1967         }
1968 }
1969
1970 static u8 hci_to_mgmt_reason(u8 err)
1971 {
1972         switch (err) {
1973         case HCI_ERROR_CONNECTION_TIMEOUT:
1974                 return MGMT_DEV_DISCONN_TIMEOUT;
1975         case HCI_ERROR_REMOTE_USER_TERM:
1976         case HCI_ERROR_REMOTE_LOW_RESOURCES:
1977         case HCI_ERROR_REMOTE_POWER_OFF:
1978                 return MGMT_DEV_DISCONN_REMOTE;
1979         case HCI_ERROR_LOCAL_HOST_TERM:
1980                 return MGMT_DEV_DISCONN_LOCAL_HOST;
1981         default:
1982                 return MGMT_DEV_DISCONN_UNKNOWN;
1983         }
1984 }
1985
1986 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1987 {
1988         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1989         u8 reason = hci_to_mgmt_reason(ev->reason);
1990         struct hci_conn_params *params;
1991         struct hci_conn *conn;
1992         bool mgmt_connected;
1993         u8 type;
1994
1995         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
1996
1997         hci_dev_lock(hdev);
1998
1999         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2000         if (!conn)
2001                 goto unlock;
2002
2003         if (ev->status) {
2004                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2005                                        conn->dst_type, ev->status);
2006                 goto unlock;
2007         }
2008
2009         conn->state = BT_CLOSED;
2010
2011         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2012         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2013                                 reason, mgmt_connected);
2014
2015         if (conn->type == ACL_LINK && conn->flush_key)
2016                 hci_remove_link_key(hdev, &conn->dst);
2017
2018         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2019         if (params) {
2020                 switch (params->auto_connect) {
2021                 case HCI_AUTO_CONN_LINK_LOSS:
2022                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2023                                 break;
2024                         /* Fall through */
2025
2026                 case HCI_AUTO_CONN_ALWAYS:
2027                         hci_pend_le_conn_add(hdev, &conn->dst, conn->dst_type);
2028                         break;
2029
2030                 default:
2031                         break;
2032                 }
2033         }
2034
2035         type = conn->type;
2036
2037         hci_proto_disconn_cfm(conn, ev->reason);
2038         hci_conn_del(conn);
2039
2040         /* Re-enable advertising if necessary, since it might
2041          * have been disabled by the connection. From the
2042          * HCI_LE_Set_Advertise_Enable command description in
2043          * the core specification (v4.0):
2044          * "The Controller shall continue advertising until the Host
2045          * issues an LE_Set_Advertise_Enable command with
2046          * Advertising_Enable set to 0x00 (Advertising is disabled)
2047          * or until a connection is created or until the Advertising
2048          * is timed out due to Directed Advertising."
2049          */
2050         if (type == LE_LINK)
2051                 mgmt_reenable_advertising(hdev);
2052
2053 unlock:
2054         hci_dev_unlock(hdev);
2055 }
2056
2057 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2058 {
2059         struct hci_ev_auth_complete *ev = (void *) skb->data;
2060         struct hci_conn *conn;
2061
2062         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2063
2064         hci_dev_lock(hdev);
2065
2066         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2067         if (!conn)
2068                 goto unlock;
2069
2070         if (!ev->status) {
2071                 if (!hci_conn_ssp_enabled(conn) &&
2072                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2073                         BT_INFO("re-auth of legacy device is not possible.");
2074                 } else {
2075                         conn->link_mode |= HCI_LM_AUTH;
2076                         conn->sec_level = conn->pending_sec_level;
2077                 }
2078         } else {
2079                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
2080                                  ev->status);
2081         }
2082
2083         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2084         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2085
2086         if (conn->state == BT_CONFIG) {
2087                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2088                         struct hci_cp_set_conn_encrypt cp;
2089                         cp.handle  = ev->handle;
2090                         cp.encrypt = 0x01;
2091                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2092                                      &cp);
2093                 } else {
2094                         conn->state = BT_CONNECTED;
2095                         hci_proto_connect_cfm(conn, ev->status);
2096                         hci_conn_drop(conn);
2097                 }
2098         } else {
2099                 hci_auth_cfm(conn, ev->status);
2100
2101                 hci_conn_hold(conn);
2102                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2103                 hci_conn_drop(conn);
2104         }
2105
2106         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2107                 if (!ev->status) {
2108                         struct hci_cp_set_conn_encrypt cp;
2109                         cp.handle  = ev->handle;
2110                         cp.encrypt = 0x01;
2111                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2112                                      &cp);
2113                 } else {
2114                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2115                         hci_encrypt_cfm(conn, ev->status, 0x00);
2116                 }
2117         }
2118
2119 unlock:
2120         hci_dev_unlock(hdev);
2121 }
2122
2123 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2124 {
2125         struct hci_ev_remote_name *ev = (void *) skb->data;
2126         struct hci_conn *conn;
2127
2128         BT_DBG("%s", hdev->name);
2129
2130         hci_conn_check_pending(hdev);
2131
2132         hci_dev_lock(hdev);
2133
2134         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2135
2136         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2137                 goto check_auth;
2138
2139         if (ev->status == 0)
2140                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2141                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2142         else
2143                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2144
2145 check_auth:
2146         if (!conn)
2147                 goto unlock;
2148
2149         if (!hci_outgoing_auth_needed(hdev, conn))
2150                 goto unlock;
2151
2152         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2153                 struct hci_cp_auth_requested cp;
2154                 cp.handle = __cpu_to_le16(conn->handle);
2155                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2156         }
2157
2158 unlock:
2159         hci_dev_unlock(hdev);
2160 }
2161
2162 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2163 {
2164         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2165         struct hci_conn *conn;
2166
2167         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2168
2169         hci_dev_lock(hdev);
2170
2171         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2172         if (!conn)
2173                 goto unlock;
2174
2175         if (!ev->status) {
2176                 if (ev->encrypt) {
2177                         /* Encryption implies authentication */
2178                         conn->link_mode |= HCI_LM_AUTH;
2179                         conn->link_mode |= HCI_LM_ENCRYPT;
2180                         conn->sec_level = conn->pending_sec_level;
2181
2182                         /* P-256 authentication key implies FIPS */
2183                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2184                                 conn->link_mode |= HCI_LM_FIPS;
2185
2186                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2187                             conn->type == LE_LINK)
2188                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2189                 } else {
2190                         conn->link_mode &= ~HCI_LM_ENCRYPT;
2191                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2192                 }
2193         }
2194
2195         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2196
2197         if (ev->status && conn->state == BT_CONNECTED) {
2198                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2199                 hci_conn_drop(conn);
2200                 goto unlock;
2201         }
2202
2203         if (conn->state == BT_CONFIG) {
2204                 if (!ev->status)
2205                         conn->state = BT_CONNECTED;
2206
2207                 /* In Secure Connections Only mode, do not allow any
2208                  * connections that are not encrypted with AES-CCM
2209                  * using a P-256 authenticated combination key.
2210                  */
2211                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2212                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2213                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2214                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2215                         hci_conn_drop(conn);
2216                         goto unlock;
2217                 }
2218
2219                 hci_proto_connect_cfm(conn, ev->status);
2220                 hci_conn_drop(conn);
2221         } else
2222                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2223
2224 unlock:
2225         hci_dev_unlock(hdev);
2226 }
2227
2228 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2229                                              struct sk_buff *skb)
2230 {
2231         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2232         struct hci_conn *conn;
2233
2234         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2235
2236         hci_dev_lock(hdev);
2237
2238         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2239         if (conn) {
2240                 if (!ev->status)
2241                         conn->link_mode |= HCI_LM_SECURE;
2242
2243                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2244
2245                 hci_key_change_cfm(conn, ev->status);
2246         }
2247
2248         hci_dev_unlock(hdev);
2249 }
2250
2251 static void hci_remote_features_evt(struct hci_dev *hdev,
2252                                     struct sk_buff *skb)
2253 {
2254         struct hci_ev_remote_features *ev = (void *) skb->data;
2255         struct hci_conn *conn;
2256
2257         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2258
2259         hci_dev_lock(hdev);
2260
2261         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2262         if (!conn)
2263                 goto unlock;
2264
2265         if (!ev->status)
2266                 memcpy(conn->features[0], ev->features, 8);
2267
2268         if (conn->state != BT_CONFIG)
2269                 goto unlock;
2270
2271         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2272                 struct hci_cp_read_remote_ext_features cp;
2273                 cp.handle = ev->handle;
2274                 cp.page = 0x01;
2275                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2276                              sizeof(cp), &cp);
2277                 goto unlock;
2278         }
2279
2280         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2281                 struct hci_cp_remote_name_req cp;
2282                 memset(&cp, 0, sizeof(cp));
2283                 bacpy(&cp.bdaddr, &conn->dst);
2284                 cp.pscan_rep_mode = 0x02;
2285                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2286         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2287                 mgmt_device_connected(hdev, &conn->dst, conn->type,
2288                                       conn->dst_type, 0, NULL, 0,
2289                                       conn->dev_class);
2290
2291         if (!hci_outgoing_auth_needed(hdev, conn)) {
2292                 conn->state = BT_CONNECTED;
2293                 hci_proto_connect_cfm(conn, ev->status);
2294                 hci_conn_drop(conn);
2295         }
2296
2297 unlock:
2298         hci_dev_unlock(hdev);
2299 }
2300
2301 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2302 {
2303         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2304         u8 status = skb->data[sizeof(*ev)];
2305         __u16 opcode;
2306
2307         skb_pull(skb, sizeof(*ev));
2308
2309         opcode = __le16_to_cpu(ev->opcode);
2310
2311         switch (opcode) {
2312         case HCI_OP_INQUIRY_CANCEL:
2313                 hci_cc_inquiry_cancel(hdev, skb);
2314                 break;
2315
2316         case HCI_OP_PERIODIC_INQ:
2317                 hci_cc_periodic_inq(hdev, skb);
2318                 break;
2319
2320         case HCI_OP_EXIT_PERIODIC_INQ:
2321                 hci_cc_exit_periodic_inq(hdev, skb);
2322                 break;
2323
2324         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2325                 hci_cc_remote_name_req_cancel(hdev, skb);
2326                 break;
2327
2328         case HCI_OP_ROLE_DISCOVERY:
2329                 hci_cc_role_discovery(hdev, skb);
2330                 break;
2331
2332         case HCI_OP_READ_LINK_POLICY:
2333                 hci_cc_read_link_policy(hdev, skb);
2334                 break;
2335
2336         case HCI_OP_WRITE_LINK_POLICY:
2337                 hci_cc_write_link_policy(hdev, skb);
2338                 break;
2339
2340         case HCI_OP_READ_DEF_LINK_POLICY:
2341                 hci_cc_read_def_link_policy(hdev, skb);
2342                 break;
2343
2344         case HCI_OP_WRITE_DEF_LINK_POLICY:
2345                 hci_cc_write_def_link_policy(hdev, skb);
2346                 break;
2347
2348         case HCI_OP_RESET:
2349                 hci_cc_reset(hdev, skb);
2350                 break;
2351
2352         case HCI_OP_WRITE_LOCAL_NAME:
2353                 hci_cc_write_local_name(hdev, skb);
2354                 break;
2355
2356         case HCI_OP_READ_LOCAL_NAME:
2357                 hci_cc_read_local_name(hdev, skb);
2358                 break;
2359
2360         case HCI_OP_WRITE_AUTH_ENABLE:
2361                 hci_cc_write_auth_enable(hdev, skb);
2362                 break;
2363
2364         case HCI_OP_WRITE_ENCRYPT_MODE:
2365                 hci_cc_write_encrypt_mode(hdev, skb);
2366                 break;
2367
2368         case HCI_OP_WRITE_SCAN_ENABLE:
2369                 hci_cc_write_scan_enable(hdev, skb);
2370                 break;
2371
2372         case HCI_OP_READ_CLASS_OF_DEV:
2373                 hci_cc_read_class_of_dev(hdev, skb);
2374                 break;
2375
2376         case HCI_OP_WRITE_CLASS_OF_DEV:
2377                 hci_cc_write_class_of_dev(hdev, skb);
2378                 break;
2379
2380         case HCI_OP_READ_VOICE_SETTING:
2381                 hci_cc_read_voice_setting(hdev, skb);
2382                 break;
2383
2384         case HCI_OP_WRITE_VOICE_SETTING:
2385                 hci_cc_write_voice_setting(hdev, skb);
2386                 break;
2387
2388         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2389                 hci_cc_read_num_supported_iac(hdev, skb);
2390                 break;
2391
2392         case HCI_OP_WRITE_SSP_MODE:
2393                 hci_cc_write_ssp_mode(hdev, skb);
2394                 break;
2395
2396         case HCI_OP_WRITE_SC_SUPPORT:
2397                 hci_cc_write_sc_support(hdev, skb);
2398                 break;
2399
2400         case HCI_OP_READ_LOCAL_VERSION:
2401                 hci_cc_read_local_version(hdev, skb);
2402                 break;
2403
2404         case HCI_OP_READ_LOCAL_COMMANDS:
2405                 hci_cc_read_local_commands(hdev, skb);
2406                 break;
2407
2408         case HCI_OP_READ_LOCAL_FEATURES:
2409                 hci_cc_read_local_features(hdev, skb);
2410                 break;
2411
2412         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2413                 hci_cc_read_local_ext_features(hdev, skb);
2414                 break;
2415
2416         case HCI_OP_READ_BUFFER_SIZE:
2417                 hci_cc_read_buffer_size(hdev, skb);
2418                 break;
2419
2420         case HCI_OP_READ_BD_ADDR:
2421                 hci_cc_read_bd_addr(hdev, skb);
2422                 break;
2423
2424         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2425                 hci_cc_read_page_scan_activity(hdev, skb);
2426                 break;
2427
2428         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2429                 hci_cc_write_page_scan_activity(hdev, skb);
2430                 break;
2431
2432         case HCI_OP_READ_PAGE_SCAN_TYPE:
2433                 hci_cc_read_page_scan_type(hdev, skb);
2434                 break;
2435
2436         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2437                 hci_cc_write_page_scan_type(hdev, skb);
2438                 break;
2439
2440         case HCI_OP_READ_DATA_BLOCK_SIZE:
2441                 hci_cc_read_data_block_size(hdev, skb);
2442                 break;
2443
2444         case HCI_OP_READ_FLOW_CONTROL_MODE:
2445                 hci_cc_read_flow_control_mode(hdev, skb);
2446                 break;
2447
2448         case HCI_OP_READ_LOCAL_AMP_INFO:
2449                 hci_cc_read_local_amp_info(hdev, skb);
2450                 break;
2451
2452         case HCI_OP_READ_LOCAL_AMP_ASSOC:
2453                 hci_cc_read_local_amp_assoc(hdev, skb);
2454                 break;
2455
2456         case HCI_OP_READ_INQ_RSP_TX_POWER:
2457                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2458                 break;
2459
2460         case HCI_OP_PIN_CODE_REPLY:
2461                 hci_cc_pin_code_reply(hdev, skb);
2462                 break;
2463
2464         case HCI_OP_PIN_CODE_NEG_REPLY:
2465                 hci_cc_pin_code_neg_reply(hdev, skb);
2466                 break;
2467
2468         case HCI_OP_READ_LOCAL_OOB_DATA:
2469                 hci_cc_read_local_oob_data(hdev, skb);
2470                 break;
2471
2472         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2473                 hci_cc_read_local_oob_ext_data(hdev, skb);
2474                 break;
2475
2476         case HCI_OP_LE_READ_BUFFER_SIZE:
2477                 hci_cc_le_read_buffer_size(hdev, skb);
2478                 break;
2479
2480         case HCI_OP_LE_READ_LOCAL_FEATURES:
2481                 hci_cc_le_read_local_features(hdev, skb);
2482                 break;
2483
2484         case HCI_OP_LE_READ_ADV_TX_POWER:
2485                 hci_cc_le_read_adv_tx_power(hdev, skb);
2486                 break;
2487
2488         case HCI_OP_USER_CONFIRM_REPLY:
2489                 hci_cc_user_confirm_reply(hdev, skb);
2490                 break;
2491
2492         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2493                 hci_cc_user_confirm_neg_reply(hdev, skb);
2494                 break;
2495
2496         case HCI_OP_USER_PASSKEY_REPLY:
2497                 hci_cc_user_passkey_reply(hdev, skb);
2498                 break;
2499
2500         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2501                 hci_cc_user_passkey_neg_reply(hdev, skb);
2502                 break;
2503
2504         case HCI_OP_LE_SET_RANDOM_ADDR:
2505                 hci_cc_le_set_random_addr(hdev, skb);
2506                 break;
2507
2508         case HCI_OP_LE_SET_ADV_ENABLE:
2509                 hci_cc_le_set_adv_enable(hdev, skb);
2510                 break;
2511
2512         case HCI_OP_LE_SET_SCAN_PARAM:
2513                 hci_cc_le_set_scan_param(hdev, skb);
2514                 break;
2515
2516         case HCI_OP_LE_SET_SCAN_ENABLE:
2517                 hci_cc_le_set_scan_enable(hdev, skb);
2518                 break;
2519
2520         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2521                 hci_cc_le_read_white_list_size(hdev, skb);
2522                 break;
2523
2524         case HCI_OP_LE_CLEAR_WHITE_LIST:
2525                 hci_cc_le_clear_white_list(hdev, skb);
2526                 break;
2527
2528         case HCI_OP_LE_ADD_TO_WHITE_LIST:
2529                 hci_cc_le_add_to_white_list(hdev, skb);
2530                 break;
2531
2532         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
2533                 hci_cc_le_del_from_white_list(hdev, skb);
2534                 break;
2535
2536         case HCI_OP_LE_READ_SUPPORTED_STATES:
2537                 hci_cc_le_read_supported_states(hdev, skb);
2538                 break;
2539
2540         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2541                 hci_cc_write_le_host_supported(hdev, skb);
2542                 break;
2543
2544         case HCI_OP_LE_SET_ADV_PARAM:
2545                 hci_cc_set_adv_param(hdev, skb);
2546                 break;
2547
2548         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
2549                 hci_cc_write_remote_amp_assoc(hdev, skb);
2550                 break;
2551
2552         default:
2553                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2554                 break;
2555         }
2556
2557         if (opcode != HCI_OP_NOP)
2558                 del_timer(&hdev->cmd_timer);
2559
2560         hci_req_cmd_complete(hdev, opcode, status);
2561
2562         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2563                 atomic_set(&hdev->cmd_cnt, 1);
2564                 if (!skb_queue_empty(&hdev->cmd_q))
2565                         queue_work(hdev->workqueue, &hdev->cmd_work);
2566         }
2567 }
2568
2569 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2570 {
2571         struct hci_ev_cmd_status *ev = (void *) skb->data;
2572         __u16 opcode;
2573
2574         skb_pull(skb, sizeof(*ev));
2575
2576         opcode = __le16_to_cpu(ev->opcode);
2577
2578         switch (opcode) {
2579         case HCI_OP_INQUIRY:
2580                 hci_cs_inquiry(hdev, ev->status);
2581                 break;
2582
2583         case HCI_OP_CREATE_CONN:
2584                 hci_cs_create_conn(hdev, ev->status);
2585                 break;
2586
2587         case HCI_OP_ADD_SCO:
2588                 hci_cs_add_sco(hdev, ev->status);
2589                 break;
2590
2591         case HCI_OP_AUTH_REQUESTED:
2592                 hci_cs_auth_requested(hdev, ev->status);
2593                 break;
2594
2595         case HCI_OP_SET_CONN_ENCRYPT:
2596                 hci_cs_set_conn_encrypt(hdev, ev->status);
2597                 break;
2598
2599         case HCI_OP_REMOTE_NAME_REQ:
2600                 hci_cs_remote_name_req(hdev, ev->status);
2601                 break;
2602
2603         case HCI_OP_READ_REMOTE_FEATURES:
2604                 hci_cs_read_remote_features(hdev, ev->status);
2605                 break;
2606
2607         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2608                 hci_cs_read_remote_ext_features(hdev, ev->status);
2609                 break;
2610
2611         case HCI_OP_SETUP_SYNC_CONN:
2612                 hci_cs_setup_sync_conn(hdev, ev->status);
2613                 break;
2614
2615         case HCI_OP_SNIFF_MODE:
2616                 hci_cs_sniff_mode(hdev, ev->status);
2617                 break;
2618
2619         case HCI_OP_EXIT_SNIFF_MODE:
2620                 hci_cs_exit_sniff_mode(hdev, ev->status);
2621                 break;
2622
2623         case HCI_OP_DISCONNECT:
2624                 hci_cs_disconnect(hdev, ev->status);
2625                 break;
2626
2627         case HCI_OP_CREATE_PHY_LINK:
2628                 hci_cs_create_phylink(hdev, ev->status);
2629                 break;
2630
2631         case HCI_OP_ACCEPT_PHY_LINK:
2632                 hci_cs_accept_phylink(hdev, ev->status);
2633                 break;
2634
2635         case HCI_OP_LE_CREATE_CONN:
2636                 hci_cs_le_create_conn(hdev, ev->status);
2637                 break;
2638
2639         default:
2640                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2641                 break;
2642         }
2643
2644         if (opcode != HCI_OP_NOP)
2645                 del_timer(&hdev->cmd_timer);
2646
2647         if (ev->status ||
2648             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
2649                 hci_req_cmd_complete(hdev, opcode, ev->status);
2650
2651         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2652                 atomic_set(&hdev->cmd_cnt, 1);
2653                 if (!skb_queue_empty(&hdev->cmd_q))
2654                         queue_work(hdev->workqueue, &hdev->cmd_work);
2655         }
2656 }
2657
2658 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2659 {
2660         struct hci_ev_role_change *ev = (void *) skb->data;
2661         struct hci_conn *conn;
2662
2663         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2664
2665         hci_dev_lock(hdev);
2666
2667         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2668         if (conn) {
2669                 if (!ev->status) {
2670                         if (ev->role)
2671                                 conn->link_mode &= ~HCI_LM_MASTER;
2672                         else
2673                                 conn->link_mode |= HCI_LM_MASTER;
2674                 }
2675
2676                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2677
2678                 hci_role_switch_cfm(conn, ev->status, ev->role);
2679         }
2680
2681         hci_dev_unlock(hdev);
2682 }
2683
2684 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2685 {
2686         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2687         int i;
2688
2689         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2690                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2691                 return;
2692         }
2693
2694         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2695             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
2696                 BT_DBG("%s bad parameters", hdev->name);
2697                 return;
2698         }
2699
2700         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2701
2702         for (i = 0; i < ev->num_hndl; i++) {
2703                 struct hci_comp_pkts_info *info = &ev->handles[i];
2704                 struct hci_conn *conn;
2705                 __u16  handle, count;
2706
2707                 handle = __le16_to_cpu(info->handle);
2708                 count  = __le16_to_cpu(info->count);
2709
2710                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2711                 if (!conn)
2712                         continue;
2713
2714                 conn->sent -= count;
2715
2716                 switch (conn->type) {
2717                 case ACL_LINK:
2718                         hdev->acl_cnt += count;
2719                         if (hdev->acl_cnt > hdev->acl_pkts)
2720                                 hdev->acl_cnt = hdev->acl_pkts;
2721                         break;
2722
2723                 case LE_LINK:
2724                         if (hdev->le_pkts) {
2725                                 hdev->le_cnt += count;
2726                                 if (hdev->le_cnt > hdev->le_pkts)
2727                                         hdev->le_cnt = hdev->le_pkts;
2728                         } else {
2729                                 hdev->acl_cnt += count;
2730                                 if (hdev->acl_cnt > hdev->acl_pkts)
2731                                         hdev->acl_cnt = hdev->acl_pkts;
2732                         }
2733                         break;
2734
2735                 case SCO_LINK:
2736                         hdev->sco_cnt += count;
2737                         if (hdev->sco_cnt > hdev->sco_pkts)
2738                                 hdev->sco_cnt = hdev->sco_pkts;
2739                         break;
2740
2741                 default:
2742                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2743                         break;
2744                 }
2745         }
2746
2747         queue_work(hdev->workqueue, &hdev->tx_work);
2748 }
2749
2750 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
2751                                                  __u16 handle)
2752 {
2753         struct hci_chan *chan;
2754
2755         switch (hdev->dev_type) {
2756         case HCI_BREDR:
2757                 return hci_conn_hash_lookup_handle(hdev, handle);
2758         case HCI_AMP:
2759                 chan = hci_chan_lookup_handle(hdev, handle);
2760                 if (chan)
2761                         return chan->conn;
2762                 break;
2763         default:
2764                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2765                 break;
2766         }
2767
2768         return NULL;
2769 }
2770
2771 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
2772 {
2773         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
2774         int i;
2775
2776         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
2777                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2778                 return;
2779         }
2780
2781         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
2782             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
2783                 BT_DBG("%s bad parameters", hdev->name);
2784                 return;
2785         }
2786
2787         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
2788                ev->num_hndl);
2789
2790         for (i = 0; i < ev->num_hndl; i++) {
2791                 struct hci_comp_blocks_info *info = &ev->handles[i];
2792                 struct hci_conn *conn = NULL;
2793                 __u16  handle, block_count;
2794
2795                 handle = __le16_to_cpu(info->handle);
2796                 block_count = __le16_to_cpu(info->blocks);
2797
2798                 conn = __hci_conn_lookup_handle(hdev, handle);
2799                 if (!conn)
2800                         continue;
2801
2802                 conn->sent -= block_count;
2803
2804                 switch (conn->type) {
2805                 case ACL_LINK:
2806                 case AMP_LINK:
2807                         hdev->block_cnt += block_count;
2808                         if (hdev->block_cnt > hdev->num_blocks)
2809                                 hdev->block_cnt = hdev->num_blocks;
2810                         break;
2811
2812                 default:
2813                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2814                         break;
2815                 }
2816         }
2817
2818         queue_work(hdev->workqueue, &hdev->tx_work);
2819 }
2820
2821 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2822 {
2823         struct hci_ev_mode_change *ev = (void *) skb->data;
2824         struct hci_conn *conn;
2825
2826         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2827
2828         hci_dev_lock(hdev);
2829
2830         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2831         if (conn) {
2832                 conn->mode = ev->mode;
2833
2834                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
2835                                         &conn->flags)) {
2836                         if (conn->mode == HCI_CM_ACTIVE)
2837                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2838                         else
2839                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
2840                 }
2841
2842                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2843                         hci_sco_setup(conn, ev->status);
2844         }
2845
2846         hci_dev_unlock(hdev);
2847 }
2848
2849 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2850 {
2851         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2852         struct hci_conn *conn;
2853
2854         BT_DBG("%s", hdev->name);
2855
2856         hci_dev_lock(hdev);
2857
2858         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2859         if (!conn)
2860                 goto unlock;
2861
2862         if (conn->state == BT_CONNECTED) {
2863                 hci_conn_hold(conn);
2864                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2865                 hci_conn_drop(conn);
2866         }
2867
2868         if (!test_bit(HCI_PAIRABLE, &hdev->dev_flags))
2869                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2870                              sizeof(ev->bdaddr), &ev->bdaddr);
2871         else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
2872                 u8 secure;
2873
2874                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2875                         secure = 1;
2876                 else
2877                         secure = 0;
2878
2879                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2880         }
2881
2882 unlock:
2883         hci_dev_unlock(hdev);
2884 }
2885
2886 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2887 {
2888         struct hci_ev_link_key_req *ev = (void *) skb->data;
2889         struct hci_cp_link_key_reply cp;
2890         struct hci_conn *conn;
2891         struct link_key *key;
2892
2893         BT_DBG("%s", hdev->name);
2894
2895         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2896                 return;
2897
2898         hci_dev_lock(hdev);
2899
2900         key = hci_find_link_key(hdev, &ev->bdaddr);
2901         if (!key) {
2902                 BT_DBG("%s link key not found for %pMR", hdev->name,
2903                        &ev->bdaddr);
2904                 goto not_found;
2905         }
2906
2907         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
2908                &ev->bdaddr);
2909
2910         if (!test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) &&
2911             key->type == HCI_LK_DEBUG_COMBINATION) {
2912                 BT_DBG("%s ignoring debug key", hdev->name);
2913                 goto not_found;
2914         }
2915
2916         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2917         if (conn) {
2918                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
2919                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
2920                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
2921                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2922                         goto not_found;
2923                 }
2924
2925                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2926                     conn->pending_sec_level == BT_SECURITY_HIGH) {
2927                         BT_DBG("%s ignoring key unauthenticated for high security",
2928                                hdev->name);
2929                         goto not_found;
2930                 }
2931
2932                 conn->key_type = key->type;
2933                 conn->pin_length = key->pin_len;
2934         }
2935
2936         bacpy(&cp.bdaddr, &ev->bdaddr);
2937         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
2938
2939         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2940
2941         hci_dev_unlock(hdev);
2942
2943         return;
2944
2945 not_found:
2946         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2947         hci_dev_unlock(hdev);
2948 }
2949
2950 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2951 {
2952         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2953         struct hci_conn *conn;
2954         u8 pin_len = 0;
2955
2956         BT_DBG("%s", hdev->name);
2957
2958         hci_dev_lock(hdev);
2959
2960         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2961         if (conn) {
2962                 hci_conn_hold(conn);
2963                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2964                 pin_len = conn->pin_length;
2965
2966                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2967                         conn->key_type = ev->key_type;
2968
2969                 hci_conn_drop(conn);
2970         }
2971
2972         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2973                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2974                                  ev->key_type, pin_len);
2975
2976         hci_dev_unlock(hdev);
2977 }
2978
2979 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2980 {
2981         struct hci_ev_clock_offset *ev = (void *) skb->data;
2982         struct hci_conn *conn;
2983
2984         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2985
2986         hci_dev_lock(hdev);
2987
2988         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2989         if (conn && !ev->status) {
2990                 struct inquiry_entry *ie;
2991
2992                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2993                 if (ie) {
2994                         ie->data.clock_offset = ev->clock_offset;
2995                         ie->timestamp = jiffies;
2996                 }
2997         }
2998
2999         hci_dev_unlock(hdev);
3000 }
3001
3002 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3003 {
3004         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3005         struct hci_conn *conn;
3006
3007         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3008
3009         hci_dev_lock(hdev);
3010
3011         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3012         if (conn && !ev->status)
3013                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3014
3015         hci_dev_unlock(hdev);
3016 }
3017
3018 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3019 {
3020         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3021         struct inquiry_entry *ie;
3022
3023         BT_DBG("%s", hdev->name);
3024
3025         hci_dev_lock(hdev);
3026
3027         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3028         if (ie) {
3029                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3030                 ie->timestamp = jiffies;
3031         }
3032
3033         hci_dev_unlock(hdev);
3034 }
3035
3036 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3037                                              struct sk_buff *skb)
3038 {
3039         struct inquiry_data data;
3040         int num_rsp = *((__u8 *) skb->data);
3041         bool name_known, ssp;
3042
3043         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3044
3045         if (!num_rsp)
3046                 return;
3047
3048         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3049                 return;
3050
3051         hci_dev_lock(hdev);
3052
3053         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3054                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3055                 info = (void *) (skb->data + 1);
3056
3057                 for (; num_rsp; num_rsp--, info++) {
3058                         bacpy(&data.bdaddr, &info->bdaddr);
3059                         data.pscan_rep_mode     = info->pscan_rep_mode;
3060                         data.pscan_period_mode  = info->pscan_period_mode;
3061                         data.pscan_mode         = info->pscan_mode;
3062                         memcpy(data.dev_class, info->dev_class, 3);
3063                         data.clock_offset       = info->clock_offset;
3064                         data.rssi               = info->rssi;
3065                         data.ssp_mode           = 0x00;
3066
3067                         name_known = hci_inquiry_cache_update(hdev, &data,
3068                                                               false, &ssp);
3069                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3070                                           info->dev_class, info->rssi,
3071                                           !name_known, ssp, NULL, 0);
3072                 }
3073         } else {
3074                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3075
3076                 for (; num_rsp; num_rsp--, info++) {
3077                         bacpy(&data.bdaddr, &info->bdaddr);
3078                         data.pscan_rep_mode     = info->pscan_rep_mode;
3079                         data.pscan_period_mode  = info->pscan_period_mode;
3080                         data.pscan_mode         = 0x00;
3081                         memcpy(data.dev_class, info->dev_class, 3);
3082                         data.clock_offset       = info->clock_offset;
3083                         data.rssi               = info->rssi;
3084                         data.ssp_mode           = 0x00;
3085                         name_known = hci_inquiry_cache_update(hdev, &data,
3086                                                               false, &ssp);
3087                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3088                                           info->dev_class, info->rssi,
3089                                           !name_known, ssp, NULL, 0);
3090                 }
3091         }
3092
3093         hci_dev_unlock(hdev);
3094 }
3095
3096 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3097                                         struct sk_buff *skb)
3098 {
3099         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3100         struct hci_conn *conn;
3101
3102         BT_DBG("%s", hdev->name);
3103
3104         hci_dev_lock(hdev);
3105
3106         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3107         if (!conn)
3108                 goto unlock;
3109
3110         if (ev->page < HCI_MAX_PAGES)
3111                 memcpy(conn->features[ev->page], ev->features, 8);
3112
3113         if (!ev->status && ev->page == 0x01) {
3114                 struct inquiry_entry *ie;
3115
3116                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3117                 if (ie)
3118                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3119
3120                 if (ev->features[0] & LMP_HOST_SSP) {
3121                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3122                 } else {
3123                         /* It is mandatory by the Bluetooth specification that
3124                          * Extended Inquiry Results are only used when Secure
3125                          * Simple Pairing is enabled, but some devices violate
3126                          * this.
3127                          *
3128                          * To make these devices work, the internal SSP
3129                          * enabled flag needs to be cleared if the remote host
3130                          * features do not indicate SSP support */
3131                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3132                 }
3133
3134                 if (ev->features[0] & LMP_HOST_SC)
3135                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3136         }
3137
3138         if (conn->state != BT_CONFIG)
3139                 goto unlock;
3140
3141         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3142                 struct hci_cp_remote_name_req cp;
3143                 memset(&cp, 0, sizeof(cp));
3144                 bacpy(&cp.bdaddr, &conn->dst);
3145                 cp.pscan_rep_mode = 0x02;
3146                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3147         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3148                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3149                                       conn->dst_type, 0, NULL, 0,
3150                                       conn->dev_class);
3151
3152         if (!hci_outgoing_auth_needed(hdev, conn)) {
3153                 conn->state = BT_CONNECTED;
3154                 hci_proto_connect_cfm(conn, ev->status);
3155                 hci_conn_drop(conn);
3156         }
3157
3158 unlock:
3159         hci_dev_unlock(hdev);
3160 }
3161
3162 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3163                                        struct sk_buff *skb)
3164 {
3165         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3166         struct hci_conn *conn;
3167
3168         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3169
3170         hci_dev_lock(hdev);
3171
3172         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3173         if (!conn) {
3174                 if (ev->link_type == ESCO_LINK)
3175                         goto unlock;
3176
3177                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3178                 if (!conn)
3179                         goto unlock;
3180
3181                 conn->type = SCO_LINK;
3182         }
3183
3184         switch (ev->status) {
3185         case 0x00:
3186                 conn->handle = __le16_to_cpu(ev->handle);
3187                 conn->state  = BT_CONNECTED;
3188
3189                 hci_conn_add_sysfs(conn);
3190                 break;
3191
3192         case 0x0d:      /* Connection Rejected due to Limited Resources */
3193         case 0x11:      /* Unsupported Feature or Parameter Value */
3194         case 0x1c:      /* SCO interval rejected */
3195         case 0x1a:      /* Unsupported Remote Feature */
3196         case 0x1f:      /* Unspecified error */
3197         case 0x20:      /* Unsupported LMP Parameter value */
3198                 if (conn->out) {
3199                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3200                                         (hdev->esco_type & EDR_ESCO_MASK);
3201                         if (hci_setup_sync(conn, conn->link->handle))
3202                                 goto unlock;
3203                 }
3204                 /* fall through */
3205
3206         default:
3207                 conn->state = BT_CLOSED;
3208                 break;
3209         }
3210
3211         hci_proto_connect_cfm(conn, ev->status);
3212         if (ev->status)
3213                 hci_conn_del(conn);
3214
3215 unlock:
3216         hci_dev_unlock(hdev);
3217 }
3218
3219 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3220 {
3221         size_t parsed = 0;
3222
3223         while (parsed < eir_len) {
3224                 u8 field_len = eir[0];
3225
3226                 if (field_len == 0)
3227                         return parsed;
3228
3229                 parsed += field_len + 1;
3230                 eir += field_len + 1;
3231         }
3232
3233         return eir_len;
3234 }
3235
3236 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3237                                             struct sk_buff *skb)
3238 {
3239         struct inquiry_data data;
3240         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3241         int num_rsp = *((__u8 *) skb->data);
3242         size_t eir_len;
3243
3244         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3245
3246         if (!num_rsp)
3247                 return;
3248
3249         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3250                 return;
3251
3252         hci_dev_lock(hdev);
3253
3254         for (; num_rsp; num_rsp--, info++) {
3255                 bool name_known, ssp;
3256
3257                 bacpy(&data.bdaddr, &info->bdaddr);
3258                 data.pscan_rep_mode     = info->pscan_rep_mode;
3259                 data.pscan_period_mode  = info->pscan_period_mode;
3260                 data.pscan_mode         = 0x00;
3261                 memcpy(data.dev_class, info->dev_class, 3);
3262                 data.clock_offset       = info->clock_offset;
3263                 data.rssi               = info->rssi;
3264                 data.ssp_mode           = 0x01;
3265
3266                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
3267                         name_known = eir_has_data_type(info->data,
3268                                                        sizeof(info->data),
3269                                                        EIR_NAME_COMPLETE);
3270                 else
3271                         name_known = true;
3272
3273                 name_known = hci_inquiry_cache_update(hdev, &data, name_known,
3274                                                       &ssp);
3275                 eir_len = eir_get_length(info->data, sizeof(info->data));
3276                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3277                                   info->dev_class, info->rssi, !name_known,
3278                                   ssp, info->data, eir_len);
3279         }
3280
3281         hci_dev_unlock(hdev);
3282 }
3283
3284 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3285                                          struct sk_buff *skb)
3286 {
3287         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3288         struct hci_conn *conn;
3289
3290         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3291                __le16_to_cpu(ev->handle));
3292
3293         hci_dev_lock(hdev);
3294
3295         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3296         if (!conn)
3297                 goto unlock;
3298
3299         if (!ev->status)
3300                 conn->sec_level = conn->pending_sec_level;
3301
3302         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3303
3304         if (ev->status && conn->state == BT_CONNECTED) {
3305                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3306                 hci_conn_drop(conn);
3307                 goto unlock;
3308         }
3309
3310         if (conn->state == BT_CONFIG) {
3311                 if (!ev->status)
3312                         conn->state = BT_CONNECTED;
3313
3314                 hci_proto_connect_cfm(conn, ev->status);
3315                 hci_conn_drop(conn);
3316         } else {
3317                 hci_auth_cfm(conn, ev->status);
3318
3319                 hci_conn_hold(conn);
3320                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3321                 hci_conn_drop(conn);
3322         }
3323
3324 unlock:
3325         hci_dev_unlock(hdev);
3326 }
3327
3328 static u8 hci_get_auth_req(struct hci_conn *conn)
3329 {
3330         /* If remote requests dedicated bonding follow that lead */
3331         if (conn->remote_auth == HCI_AT_DEDICATED_BONDING ||
3332             conn->remote_auth == HCI_AT_DEDICATED_BONDING_MITM) {
3333                 /* If both remote and local IO capabilities allow MITM
3334                  * protection then require it, otherwise don't */
3335                 if (conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT ||
3336                     conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)
3337                         return HCI_AT_DEDICATED_BONDING;
3338                 else
3339                         return HCI_AT_DEDICATED_BONDING_MITM;
3340         }
3341
3342         /* If remote requests no-bonding follow that lead */
3343         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3344             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3345                 return conn->remote_auth | (conn->auth_type & 0x01);
3346
3347         return conn->auth_type;
3348 }
3349
3350 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3351 {
3352         struct hci_ev_io_capa_request *ev = (void *) skb->data;
3353         struct hci_conn *conn;
3354
3355         BT_DBG("%s", hdev->name);
3356
3357         hci_dev_lock(hdev);
3358
3359         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3360         if (!conn)
3361                 goto unlock;
3362
3363         hci_conn_hold(conn);
3364
3365         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3366                 goto unlock;
3367
3368         if (test_bit(HCI_PAIRABLE, &hdev->dev_flags) ||
3369             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
3370                 struct hci_cp_io_capability_reply cp;
3371
3372                 bacpy(&cp.bdaddr, &ev->bdaddr);
3373                 /* Change the IO capability from KeyboardDisplay
3374                  * to DisplayYesNo as it is not supported by BT spec. */
3375                 cp.capability = (conn->io_capability == 0x04) ?
3376                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
3377                 conn->auth_type = hci_get_auth_req(conn);
3378                 cp.authentication = conn->auth_type;
3379
3380                 if (hci_find_remote_oob_data(hdev, &conn->dst) &&
3381                     (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags)))
3382                         cp.oob_data = 0x01;
3383                 else
3384                         cp.oob_data = 0x00;
3385
3386                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
3387                              sizeof(cp), &cp);
3388         } else {
3389                 struct hci_cp_io_capability_neg_reply cp;
3390
3391                 bacpy(&cp.bdaddr, &ev->bdaddr);
3392                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
3393
3394                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
3395                              sizeof(cp), &cp);
3396         }
3397
3398 unlock:
3399         hci_dev_unlock(hdev);
3400 }
3401
3402 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
3403 {
3404         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
3405         struct hci_conn *conn;
3406
3407         BT_DBG("%s", hdev->name);
3408
3409         hci_dev_lock(hdev);
3410
3411         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3412         if (!conn)
3413                 goto unlock;
3414
3415         conn->remote_cap = ev->capability;
3416         conn->remote_auth = ev->authentication;
3417         if (ev->oob_data)
3418                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
3419
3420 unlock:
3421         hci_dev_unlock(hdev);
3422 }
3423
3424 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
3425                                          struct sk_buff *skb)
3426 {
3427         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
3428         int loc_mitm, rem_mitm, confirm_hint = 0;
3429         struct hci_conn *conn;
3430
3431         BT_DBG("%s", hdev->name);
3432
3433         hci_dev_lock(hdev);
3434
3435         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3436                 goto unlock;
3437
3438         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3439         if (!conn)
3440                 goto unlock;
3441
3442         loc_mitm = (conn->auth_type & 0x01);
3443         rem_mitm = (conn->remote_auth & 0x01);
3444
3445         /* If we require MITM but the remote device can't provide that
3446          * (it has NoInputNoOutput) then reject the confirmation
3447          * request. The only exception is when we're dedicated bonding
3448          * initiators (connect_cfm_cb set) since then we always have the MITM
3449          * bit set. */
3450         if (!conn->connect_cfm_cb && loc_mitm &&
3451             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
3452                 BT_DBG("Rejecting request: remote device can't provide MITM");
3453                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
3454                              sizeof(ev->bdaddr), &ev->bdaddr);
3455                 goto unlock;
3456         }
3457
3458         /* If no side requires MITM protection; auto-accept */
3459         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
3460             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
3461
3462                 /* If we're not the initiators request authorization to
3463                  * proceed from user space (mgmt_user_confirm with
3464                  * confirm_hint set to 1). */
3465                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3466                         BT_DBG("Confirming auto-accept as acceptor");
3467                         confirm_hint = 1;
3468                         goto confirm;
3469                 }
3470
3471                 BT_DBG("Auto-accept of user confirmation with %ums delay",
3472                        hdev->auto_accept_delay);
3473
3474                 if (hdev->auto_accept_delay > 0) {
3475                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
3476                         queue_delayed_work(conn->hdev->workqueue,
3477                                            &conn->auto_accept_work, delay);
3478                         goto unlock;
3479                 }
3480
3481                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
3482                              sizeof(ev->bdaddr), &ev->bdaddr);
3483                 goto unlock;
3484         }
3485
3486 confirm:
3487         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
3488                                   le32_to_cpu(ev->passkey), confirm_hint);
3489
3490 unlock:
3491         hci_dev_unlock(hdev);
3492 }
3493
3494 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
3495                                          struct sk_buff *skb)
3496 {
3497         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
3498
3499         BT_DBG("%s", hdev->name);
3500
3501         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3502                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
3503 }
3504
3505 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
3506                                         struct sk_buff *skb)
3507 {
3508         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
3509         struct hci_conn *conn;
3510
3511         BT_DBG("%s", hdev->name);
3512
3513         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3514         if (!conn)
3515                 return;
3516
3517         conn->passkey_notify = __le32_to_cpu(ev->passkey);
3518         conn->passkey_entered = 0;
3519
3520         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3521                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3522                                          conn->dst_type, conn->passkey_notify,
3523                                          conn->passkey_entered);
3524 }
3525
3526 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3527 {
3528         struct hci_ev_keypress_notify *ev = (void *) skb->data;
3529         struct hci_conn *conn;
3530
3531         BT_DBG("%s", hdev->name);
3532
3533         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3534         if (!conn)
3535                 return;
3536
3537         switch (ev->type) {
3538         case HCI_KEYPRESS_STARTED:
3539                 conn->passkey_entered = 0;
3540                 return;
3541
3542         case HCI_KEYPRESS_ENTERED:
3543                 conn->passkey_entered++;
3544                 break;
3545
3546         case HCI_KEYPRESS_ERASED:
3547                 conn->passkey_entered--;
3548                 break;
3549
3550         case HCI_KEYPRESS_CLEARED:
3551                 conn->passkey_entered = 0;
3552                 break;
3553
3554         case HCI_KEYPRESS_COMPLETED:
3555                 return;
3556         }
3557
3558         if (test_bit(HCI_MGMT, &hdev->dev_flags))
3559                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
3560                                          conn->dst_type, conn->passkey_notify,
3561                                          conn->passkey_entered);
3562 }
3563
3564 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
3565                                          struct sk_buff *skb)
3566 {
3567         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
3568         struct hci_conn *conn;
3569
3570         BT_DBG("%s", hdev->name);
3571
3572         hci_dev_lock(hdev);
3573
3574         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3575         if (!conn)
3576                 goto unlock;
3577
3578         /* To avoid duplicate auth_failed events to user space we check
3579          * the HCI_CONN_AUTH_PEND flag which will be set if we
3580          * initiated the authentication. A traditional auth_complete
3581          * event gets always produced as initiator and is also mapped to
3582          * the mgmt_auth_failed event */
3583         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
3584                 mgmt_auth_failed(hdev, &conn->dst, conn->type, conn->dst_type,
3585                                  ev->status);
3586
3587         hci_conn_drop(conn);
3588
3589 unlock:
3590         hci_dev_unlock(hdev);
3591 }
3592
3593 static void hci_remote_host_features_evt(struct hci_dev *hdev,
3594                                          struct sk_buff *skb)
3595 {
3596         struct hci_ev_remote_host_features *ev = (void *) skb->data;
3597         struct inquiry_entry *ie;
3598         struct hci_conn *conn;
3599
3600         BT_DBG("%s", hdev->name);
3601
3602         hci_dev_lock(hdev);
3603
3604         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3605         if (conn)
3606                 memcpy(conn->features[1], ev->features, 8);
3607
3608         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3609         if (ie)
3610                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3611
3612         hci_dev_unlock(hdev);
3613 }
3614
3615 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
3616                                             struct sk_buff *skb)
3617 {
3618         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
3619         struct oob_data *data;
3620
3621         BT_DBG("%s", hdev->name);
3622
3623         hci_dev_lock(hdev);
3624
3625         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3626                 goto unlock;
3627
3628         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
3629         if (data) {
3630                 if (test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
3631                         struct hci_cp_remote_oob_ext_data_reply cp;
3632
3633                         bacpy(&cp.bdaddr, &ev->bdaddr);
3634                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
3635                         memcpy(cp.randomizer192, data->randomizer192,
3636                                sizeof(cp.randomizer192));
3637                         memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
3638                         memcpy(cp.randomizer256, data->randomizer256,
3639                                sizeof(cp.randomizer256));
3640
3641                         hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
3642                                      sizeof(cp), &cp);
3643                 } else {
3644                         struct hci_cp_remote_oob_data_reply cp;
3645
3646                         bacpy(&cp.bdaddr, &ev->bdaddr);
3647                         memcpy(cp.hash, data->hash192, sizeof(cp.hash));
3648                         memcpy(cp.randomizer, data->randomizer192,
3649                                sizeof(cp.randomizer));
3650
3651                         hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
3652                                      sizeof(cp), &cp);
3653                 }
3654         } else {
3655                 struct hci_cp_remote_oob_data_neg_reply cp;
3656
3657                 bacpy(&cp.bdaddr, &ev->bdaddr);
3658                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
3659                              sizeof(cp), &cp);
3660         }
3661
3662 unlock:
3663         hci_dev_unlock(hdev);
3664 }
3665
3666 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
3667                                       struct sk_buff *skb)
3668 {
3669         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
3670         struct hci_conn *hcon, *bredr_hcon;
3671
3672         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
3673                ev->status);
3674
3675         hci_dev_lock(hdev);
3676
3677         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3678         if (!hcon) {
3679                 hci_dev_unlock(hdev);
3680                 return;
3681         }
3682
3683         if (ev->status) {
3684                 hci_conn_del(hcon);
3685                 hci_dev_unlock(hdev);
3686                 return;
3687         }
3688
3689         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
3690
3691         hcon->state = BT_CONNECTED;
3692         bacpy(&hcon->dst, &bredr_hcon->dst);
3693
3694         hci_conn_hold(hcon);
3695         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
3696         hci_conn_drop(hcon);
3697
3698         hci_conn_add_sysfs(hcon);
3699
3700         amp_physical_cfm(bredr_hcon, hcon);
3701
3702         hci_dev_unlock(hdev);
3703 }
3704
3705 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3706 {
3707         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
3708         struct hci_conn *hcon;
3709         struct hci_chan *hchan;
3710         struct amp_mgr *mgr;
3711
3712         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
3713                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
3714                ev->status);
3715
3716         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3717         if (!hcon)
3718                 return;
3719
3720         /* Create AMP hchan */
3721         hchan = hci_chan_create(hcon);
3722         if (!hchan)
3723                 return;
3724
3725         hchan->handle = le16_to_cpu(ev->handle);
3726
3727         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
3728
3729         mgr = hcon->amp_mgr;
3730         if (mgr && mgr->bredr_chan) {
3731                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
3732
3733                 l2cap_chan_lock(bredr_chan);
3734
3735                 bredr_chan->conn->mtu = hdev->block_mtu;
3736                 l2cap_logical_cfm(bredr_chan, hchan, 0);
3737                 hci_conn_hold(hcon);
3738
3739                 l2cap_chan_unlock(bredr_chan);
3740         }
3741 }
3742
3743 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
3744                                              struct sk_buff *skb)
3745 {
3746         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
3747         struct hci_chan *hchan;
3748
3749         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
3750                le16_to_cpu(ev->handle), ev->status);
3751
3752         if (ev->status)
3753                 return;
3754
3755         hci_dev_lock(hdev);
3756
3757         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
3758         if (!hchan)
3759                 goto unlock;
3760
3761         amp_destroy_logical_link(hchan, ev->reason);
3762
3763 unlock:
3764         hci_dev_unlock(hdev);
3765 }
3766
3767 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
3768                                              struct sk_buff *skb)
3769 {
3770         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
3771         struct hci_conn *hcon;
3772
3773         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3774
3775         if (ev->status)
3776                 return;
3777
3778         hci_dev_lock(hdev);
3779
3780         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
3781         if (hcon) {
3782                 hcon->state = BT_CLOSED;
3783                 hci_conn_del(hcon);
3784         }
3785
3786         hci_dev_unlock(hdev);
3787 }
3788
3789 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3790 {
3791         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
3792         struct hci_conn *conn;
3793         struct smp_irk *irk;
3794
3795         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3796
3797         hci_dev_lock(hdev);
3798
3799         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
3800         if (!conn) {
3801                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3802                 if (!conn) {
3803                         BT_ERR("No memory for new connection");
3804                         goto unlock;
3805                 }
3806
3807                 conn->dst_type = ev->bdaddr_type;
3808
3809                 /* The advertising parameters for own address type
3810                  * define which source address and source address
3811                  * type this connections has.
3812                  */
3813                 if (bacmp(&conn->src, BDADDR_ANY)) {
3814                         conn->src_type = ADDR_LE_DEV_PUBLIC;
3815                 } else {
3816                         bacpy(&conn->src, &hdev->static_addr);
3817                         conn->src_type = ADDR_LE_DEV_RANDOM;
3818                 }
3819
3820                 if (ev->role == LE_CONN_ROLE_MASTER) {
3821                         conn->out = true;
3822                         conn->link_mode |= HCI_LM_MASTER;
3823                 }
3824
3825                 /* If we didn't have a hci_conn object previously
3826                  * but we're in master role this must be something
3827                  * initiated using a white list. Since white list based
3828                  * connections are not "first class citizens" we don't
3829                  * have full tracking of them. Therefore, we go ahead
3830                  * with a "best effort" approach of determining the
3831                  * initiator address based on the HCI_PRIVACY flag.
3832                  */
3833                 if (conn->out) {
3834                         conn->resp_addr_type = ev->bdaddr_type;
3835                         bacpy(&conn->resp_addr, &ev->bdaddr);
3836                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
3837                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
3838                                 bacpy(&conn->init_addr, &hdev->rpa);
3839                         } else {
3840                                 hci_copy_identity_address(hdev,
3841                                                           &conn->init_addr,
3842                                                           &conn->init_addr_type);
3843                         }
3844                 } else {
3845                         /* Set the responder (our side) address type based on
3846                          * the advertising address type.
3847                          */
3848                         conn->resp_addr_type = hdev->adv_addr_type;
3849                         if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
3850                                 bacpy(&conn->resp_addr, &hdev->random_addr);
3851                         else
3852                                 bacpy(&conn->resp_addr, &hdev->bdaddr);
3853
3854                         conn->init_addr_type = ev->bdaddr_type;
3855                         bacpy(&conn->init_addr, &ev->bdaddr);
3856                 }
3857         } else {
3858                 cancel_delayed_work(&conn->le_conn_timeout);
3859         }
3860
3861         /* Ensure that the hci_conn contains the identity address type
3862          * regardless of which address the connection was made with.
3863          */
3864         hci_copy_identity_address(hdev, &conn->src, &conn->src_type);
3865
3866         /* Lookup the identity address from the stored connection
3867          * address and address type.
3868          *
3869          * When establishing connections to an identity address, the
3870          * connection procedure will store the resolvable random
3871          * address first. Now if it can be converted back into the
3872          * identity address, start using the identity address from
3873          * now on.
3874          */
3875         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
3876         if (irk) {
3877                 bacpy(&conn->dst, &irk->bdaddr);
3878                 conn->dst_type = irk->addr_type;
3879         }
3880
3881         if (ev->status) {
3882                 hci_le_conn_failed(conn, ev->status);
3883                 goto unlock;
3884         }
3885
3886         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3887                 mgmt_device_connected(hdev, &conn->dst, conn->type,
3888                                       conn->dst_type, 0, NULL, 0, NULL);
3889
3890         conn->sec_level = BT_SECURITY_LOW;
3891         conn->handle = __le16_to_cpu(ev->handle);
3892         conn->state = BT_CONNECTED;
3893
3894         if (test_bit(HCI_6LOWPAN_ENABLED, &hdev->dev_flags))
3895                 set_bit(HCI_CONN_6LOWPAN, &conn->flags);
3896
3897         hci_conn_add_sysfs(conn);
3898
3899         hci_proto_connect_cfm(conn, ev->status);
3900
3901         hci_pend_le_conn_del(hdev, &conn->dst, conn->dst_type);
3902
3903 unlock:
3904         hci_dev_unlock(hdev);
3905 }
3906
3907 /* This function requires the caller holds hdev->lock */
3908 static void check_pending_le_conn(struct hci_dev *hdev, bdaddr_t *addr,
3909                                   u8 addr_type)
3910 {
3911         struct hci_conn *conn;
3912         struct smp_irk *irk;
3913
3914         /* If this is a resolvable address, we should resolve it and then
3915          * update address and address type variables.
3916          */
3917         irk = hci_get_irk(hdev, addr, addr_type);
3918         if (irk) {
3919                 addr = &irk->bdaddr;
3920                 addr_type = irk->addr_type;
3921         }
3922
3923         if (!hci_pend_le_conn_lookup(hdev, addr, addr_type))
3924                 return;
3925
3926         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
3927                               HCI_AT_NO_BONDING);
3928         if (!IS_ERR(conn))
3929                 return;
3930
3931         switch (PTR_ERR(conn)) {
3932         case -EBUSY:
3933                 /* If hci_connect() returns -EBUSY it means there is already
3934                  * an LE connection attempt going on. Since controllers don't
3935                  * support more than one connection attempt at the time, we
3936                  * don't consider this an error case.
3937                  */
3938                 break;
3939         default:
3940                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
3941         }
3942 }
3943
3944 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
3945 {
3946         u8 num_reports = skb->data[0];
3947         void *ptr = &skb->data[1];
3948         s8 rssi;
3949
3950         hci_dev_lock(hdev);
3951
3952         while (num_reports--) {
3953                 struct hci_ev_le_advertising_info *ev = ptr;
3954
3955                 if (ev->evt_type == LE_ADV_IND ||
3956                     ev->evt_type == LE_ADV_DIRECT_IND)
3957                         check_pending_le_conn(hdev, &ev->bdaddr,
3958                                               ev->bdaddr_type);
3959
3960                 rssi = ev->data[ev->length];
3961                 mgmt_device_found(hdev, &ev->bdaddr, LE_LINK, ev->bdaddr_type,
3962                                   NULL, rssi, 0, 1, ev->data, ev->length);
3963
3964                 ptr += sizeof(*ev) + ev->length + 1;
3965         }
3966
3967         hci_dev_unlock(hdev);
3968 }
3969
3970 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3971 {
3972         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3973         struct hci_cp_le_ltk_reply cp;
3974         struct hci_cp_le_ltk_neg_reply neg;
3975         struct hci_conn *conn;
3976         struct smp_ltk *ltk;
3977
3978         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
3979
3980         hci_dev_lock(hdev);
3981
3982         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3983         if (conn == NULL)
3984                 goto not_found;
3985
3986         ltk = hci_find_ltk(hdev, ev->ediv, ev->rand, conn->out);
3987         if (ltk == NULL)
3988                 goto not_found;
3989
3990         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3991         cp.handle = cpu_to_le16(conn->handle);
3992
3993         if (ltk->authenticated)
3994                 conn->pending_sec_level = BT_SECURITY_HIGH;
3995         else
3996                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3997
3998         conn->enc_key_size = ltk->enc_size;
3999
4000         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
4001
4002         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
4003          * temporary key used to encrypt a connection following
4004          * pairing. It is used during the Encrypted Session Setup to
4005          * distribute the keys. Later, security can be re-established
4006          * using a distributed LTK.
4007          */
4008         if (ltk->type == HCI_SMP_STK_SLAVE) {
4009                 list_del(&ltk->list);
4010                 kfree(ltk);
4011         }
4012
4013         hci_dev_unlock(hdev);
4014
4015         return;
4016
4017 not_found:
4018         neg.handle = ev->handle;
4019         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
4020         hci_dev_unlock(hdev);
4021 }
4022
4023 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
4024 {
4025         struct hci_ev_le_meta *le_ev = (void *) skb->data;
4026
4027         skb_pull(skb, sizeof(*le_ev));
4028
4029         switch (le_ev->subevent) {
4030         case HCI_EV_LE_CONN_COMPLETE:
4031                 hci_le_conn_complete_evt(hdev, skb);
4032                 break;
4033
4034         case HCI_EV_LE_ADVERTISING_REPORT:
4035                 hci_le_adv_report_evt(hdev, skb);
4036                 break;
4037
4038         case HCI_EV_LE_LTK_REQ:
4039                 hci_le_ltk_request_evt(hdev, skb);
4040                 break;
4041
4042         default:
4043                 break;
4044         }
4045 }
4046
4047 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4048 {
4049         struct hci_ev_channel_selected *ev = (void *) skb->data;
4050         struct hci_conn *hcon;
4051
4052         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4053
4054         skb_pull(skb, sizeof(*ev));
4055
4056         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4057         if (!hcon)
4058                 return;
4059
4060         amp_read_loc_assoc_final_data(hdev, hcon);
4061 }
4062
4063 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
4064 {
4065         struct hci_event_hdr *hdr = (void *) skb->data;
4066         __u8 event = hdr->evt;
4067
4068         hci_dev_lock(hdev);
4069
4070         /* Received events are (currently) only needed when a request is
4071          * ongoing so avoid unnecessary memory allocation.
4072          */
4073         if (hdev->req_status == HCI_REQ_PEND) {
4074                 kfree_skb(hdev->recv_evt);
4075                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
4076         }
4077
4078         hci_dev_unlock(hdev);
4079
4080         skb_pull(skb, HCI_EVENT_HDR_SIZE);
4081
4082         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
4083                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
4084                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
4085
4086                 hci_req_cmd_complete(hdev, opcode, 0);
4087         }
4088
4089         switch (event) {
4090         case HCI_EV_INQUIRY_COMPLETE:
4091                 hci_inquiry_complete_evt(hdev, skb);
4092                 break;
4093
4094         case HCI_EV_INQUIRY_RESULT:
4095                 hci_inquiry_result_evt(hdev, skb);
4096                 break;
4097
4098         case HCI_EV_CONN_COMPLETE:
4099                 hci_conn_complete_evt(hdev, skb);
4100                 break;
4101
4102         case HCI_EV_CONN_REQUEST:
4103                 hci_conn_request_evt(hdev, skb);
4104                 break;
4105
4106         case HCI_EV_DISCONN_COMPLETE:
4107                 hci_disconn_complete_evt(hdev, skb);
4108                 break;
4109
4110         case HCI_EV_AUTH_COMPLETE:
4111                 hci_auth_complete_evt(hdev, skb);
4112                 break;
4113
4114         case HCI_EV_REMOTE_NAME:
4115                 hci_remote_name_evt(hdev, skb);
4116                 break;
4117
4118         case HCI_EV_ENCRYPT_CHANGE:
4119                 hci_encrypt_change_evt(hdev, skb);
4120                 break;
4121
4122         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
4123                 hci_change_link_key_complete_evt(hdev, skb);
4124                 break;
4125
4126         case HCI_EV_REMOTE_FEATURES:
4127                 hci_remote_features_evt(hdev, skb);
4128                 break;
4129
4130         case HCI_EV_CMD_COMPLETE:
4131                 hci_cmd_complete_evt(hdev, skb);
4132                 break;
4133
4134         case HCI_EV_CMD_STATUS:
4135                 hci_cmd_status_evt(hdev, skb);
4136                 break;
4137
4138         case HCI_EV_ROLE_CHANGE:
4139                 hci_role_change_evt(hdev, skb);
4140                 break;
4141
4142         case HCI_EV_NUM_COMP_PKTS:
4143                 hci_num_comp_pkts_evt(hdev, skb);
4144                 break;
4145
4146         case HCI_EV_MODE_CHANGE:
4147                 hci_mode_change_evt(hdev, skb);
4148                 break;
4149
4150         case HCI_EV_PIN_CODE_REQ:
4151                 hci_pin_code_request_evt(hdev, skb);
4152                 break;
4153
4154         case HCI_EV_LINK_KEY_REQ:
4155                 hci_link_key_request_evt(hdev, skb);
4156                 break;
4157
4158         case HCI_EV_LINK_KEY_NOTIFY:
4159                 hci_link_key_notify_evt(hdev, skb);
4160                 break;
4161
4162         case HCI_EV_CLOCK_OFFSET:
4163                 hci_clock_offset_evt(hdev, skb);
4164                 break;
4165
4166         case HCI_EV_PKT_TYPE_CHANGE:
4167                 hci_pkt_type_change_evt(hdev, skb);
4168                 break;
4169
4170         case HCI_EV_PSCAN_REP_MODE:
4171                 hci_pscan_rep_mode_evt(hdev, skb);
4172                 break;
4173
4174         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
4175                 hci_inquiry_result_with_rssi_evt(hdev, skb);
4176                 break;
4177
4178         case HCI_EV_REMOTE_EXT_FEATURES:
4179                 hci_remote_ext_features_evt(hdev, skb);
4180                 break;
4181
4182         case HCI_EV_SYNC_CONN_COMPLETE:
4183                 hci_sync_conn_complete_evt(hdev, skb);
4184                 break;
4185
4186         case HCI_EV_EXTENDED_INQUIRY_RESULT:
4187                 hci_extended_inquiry_result_evt(hdev, skb);
4188                 break;
4189
4190         case HCI_EV_KEY_REFRESH_COMPLETE:
4191                 hci_key_refresh_complete_evt(hdev, skb);
4192                 break;
4193
4194         case HCI_EV_IO_CAPA_REQUEST:
4195                 hci_io_capa_request_evt(hdev, skb);
4196                 break;
4197
4198         case HCI_EV_IO_CAPA_REPLY:
4199                 hci_io_capa_reply_evt(hdev, skb);
4200                 break;
4201
4202         case HCI_EV_USER_CONFIRM_REQUEST:
4203                 hci_user_confirm_request_evt(hdev, skb);
4204                 break;
4205
4206         case HCI_EV_USER_PASSKEY_REQUEST:
4207                 hci_user_passkey_request_evt(hdev, skb);
4208                 break;
4209
4210         case HCI_EV_USER_PASSKEY_NOTIFY:
4211                 hci_user_passkey_notify_evt(hdev, skb);
4212                 break;
4213
4214         case HCI_EV_KEYPRESS_NOTIFY:
4215                 hci_keypress_notify_evt(hdev, skb);
4216                 break;
4217
4218         case HCI_EV_SIMPLE_PAIR_COMPLETE:
4219                 hci_simple_pair_complete_evt(hdev, skb);
4220                 break;
4221
4222         case HCI_EV_REMOTE_HOST_FEATURES:
4223                 hci_remote_host_features_evt(hdev, skb);
4224                 break;
4225
4226         case HCI_EV_LE_META:
4227                 hci_le_meta_evt(hdev, skb);
4228                 break;
4229
4230         case HCI_EV_CHANNEL_SELECTED:
4231                 hci_chan_selected_evt(hdev, skb);
4232                 break;
4233
4234         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
4235                 hci_remote_oob_data_request_evt(hdev, skb);
4236                 break;
4237
4238         case HCI_EV_PHY_LINK_COMPLETE:
4239                 hci_phy_link_complete_evt(hdev, skb);
4240                 break;
4241
4242         case HCI_EV_LOGICAL_LINK_COMPLETE:
4243                 hci_loglink_complete_evt(hdev, skb);
4244                 break;
4245
4246         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
4247                 hci_disconn_loglink_complete_evt(hdev, skb);
4248                 break;
4249
4250         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
4251                 hci_disconn_phylink_complete_evt(hdev, skb);
4252                 break;
4253
4254         case HCI_EV_NUM_COMP_BLOCKS:
4255                 hci_num_comp_blocks_evt(hdev, skb);
4256                 break;
4257
4258         default:
4259                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
4260                 break;
4261         }
4262
4263         kfree_skb(skb);
4264         hdev->stat.evt_rx++;
4265 }