net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 /* Handle HCI Event packets */
  44
  45 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  46                                   u8 *new_status)
  47 {
  48         __u8 status = *((__u8 *) skb->data);
  49
  50         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  51
  52         /* It is possible that we receive Inquiry Complete event right
  53          * before we receive Inquiry Cancel Command Complete event, in
  54          * which case the latter event should have status of Command
  55          * Disallowed (0x0c). This should not be treated as error, since
  56          * we actually achieve what Inquiry Cancel wants to achieve,
  57          * which is to end the last Inquiry session.
  58          */
  59         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  60                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  61                 status = 0x00;
  62         }
  63
  64         *new_status = status;
  65
  66         if (status)
  67                 return;
  68
  69         clear_bit(HCI_INQUIRY, &hdev->flags);
  70         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  71         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  72
  73         hci_dev_lock(hdev);
  74         /* Set discovery state to stopped if we're not doing LE active
  75          * scanning.
  76          */
  77         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  78             hdev->le_scan_type != LE_SCAN_ACTIVE)
  79                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  80         hci_dev_unlock(hdev);
  81
  82         hci_conn_check_pending(hdev);
  83 }
  84
  85 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  86 {
  87         __u8 status = *((__u8 *) skb->data);
  88
  89         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  90
  91         if (status)
  92                 return;
  93
  94         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  95 }
  96
  97 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  98 {
  99         __u8 status = *((__u8 *) skb->data);
 100
 101         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 102
 103         if (status)
 104                 return;
 105
 106         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 107
 108         hci_conn_check_pending(hdev);
 109 }
 110
 111 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 112                                           struct sk_buff *skb)
 113 {
 114         BT_DBG("%s", hdev->name);
 115 }
 116
 117 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 118 {
 119         struct hci_rp_role_discovery *rp = (void *) skb->data;
 120         struct hci_conn *conn;
 121
 122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 123
 124         if (rp->status)
 125                 return;
 126
 127         hci_dev_lock(hdev);
 128
 129         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 130         if (conn)
 131                 conn->role = rp->role;
 132
 133         hci_dev_unlock(hdev);
 134 }
 135
 136 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 137 {
 138         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 139         struct hci_conn *conn;
 140
 141         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         hci_dev_lock(hdev);
 147
 148         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 149         if (conn)
 150                 conn->link_policy = __le16_to_cpu(rp->policy);
 151
 152         hci_dev_unlock(hdev);
 153 }
 154
 155 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 156 {
 157         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 158         struct hci_conn *conn;
 159         void *sent;
 160
 161         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 162
 163         if (rp->status)
 164                 return;
 165
 166         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 167         if (!sent)
 168                 return;
 169
 170         hci_dev_lock(hdev);
 171
 172         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 173         if (conn)
 174                 conn->link_policy = get_unaligned_le16(sent + 2);
 175
 176         hci_dev_unlock(hdev);
 177 }
 178
 179 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 180                                         struct sk_buff *skb)
 181 {
 182         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 183
 184         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 185
 186         if (rp->status)
 187                 return;
 188
 189         hdev->link_policy = __le16_to_cpu(rp->policy);
 190 }
 191
 192 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 193                                          struct sk_buff *skb)
 194 {
 195         __u8 status = *((__u8 *) skb->data);
 196         void *sent;
 197
 198         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200         if (status)
 201                 return;
 202
 203         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 204         if (!sent)
 205                 return;
 206
 207         hdev->link_policy = get_unaligned_le16(sent);
 208 }
 209
 210 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 211 {
 212         __u8 status = *((__u8 *) skb->data);
 213
 214         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 215
 216         clear_bit(HCI_RESET, &hdev->flags);
 217
 218         if (status)
 219                 return;
 220
 221         /* Reset all non-persistent flags */
 222         hci_dev_clear_volatile_flags(hdev);
 223
 224         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 225
 226         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230         hdev->adv_data_len = 0;
 231
 232         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233         hdev->scan_rsp_data_len = 0;
 234
 235         hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237         hdev->ssp_debug_mode = 0;
 238
 239         hci_bdaddr_list_clear(&hdev->le_white_list);
 240         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 241 }
 242
 243 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 244                                         struct sk_buff *skb)
 245 {
 246         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 247         struct hci_cp_read_stored_link_key *sent;
 248
 249         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 250
 251         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 252         if (!sent)
 253                 return;
 254
 255         if (!rp->status && sent->read_all == 0x01) {
 256                 hdev->stored_max_keys = rp->max_keys;
 257                 hdev->stored_num_keys = rp->num_keys;
 258         }
 259 }
 260
 261 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 262                                           struct sk_buff *skb)
 263 {
 264         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 267
 268         if (rp->status)
 269                 return;
 270
 271         if (rp->num_keys <= hdev->stored_num_keys)
 272                 hdev->stored_num_keys -= rp->num_keys;
 273         else
 274                 hdev->stored_num_keys = 0;
 275 }
 276
 277 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 278 {
 279         __u8 status = *((__u8 *) skb->data);
 280         void *sent;
 281
 282         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 283
 284         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 285         if (!sent)
 286                 return;
 287
 288         hci_dev_lock(hdev);
 289
 290         if (hci_dev_test_flag(hdev, HCI_MGMT))
 291                 mgmt_set_local_name_complete(hdev, sent, status);
 292         else if (!status)
 293                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 294
 295         hci_dev_unlock(hdev);
 296 }
 297
 298 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 299 {
 300         struct hci_rp_read_local_name *rp = (void *) skb->data;
 301
 302         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 303
 304         if (rp->status)
 305                 return;
 306
 307         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 308             hci_dev_test_flag(hdev, HCI_CONFIG))
 309                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 310 }
 311
 312 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 313 {
 314         __u8 status = *((__u8 *) skb->data);
 315         void *sent;
 316
 317         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 318
 319         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 320         if (!sent)
 321                 return;
 322
 323         hci_dev_lock(hdev);
 324
 325         if (!status) {
 326                 __u8 param = *((__u8 *) sent);
 327
 328                 if (param == AUTH_ENABLED)
 329                         set_bit(HCI_AUTH, &hdev->flags);
 330                 else
 331                         clear_bit(HCI_AUTH, &hdev->flags);
 332         }
 333
 334         if (hci_dev_test_flag(hdev, HCI_MGMT))
 335                 mgmt_auth_enable_complete(hdev, status);
 336
 337         hci_dev_unlock(hdev);
 338 }
 339
 340 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 341 {
 342         __u8 status = *((__u8 *) skb->data);
 343         __u8 param;
 344         void *sent;
 345
 346         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 347
 348         if (status)
 349                 return;
 350
 351         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 352         if (!sent)
 353                 return;
 354
 355         param = *((__u8 *) sent);
 356
 357         if (param)
 358                 set_bit(HCI_ENCRYPT, &hdev->flags);
 359         else
 360                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 361 }
 362
 363 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 364 {
 365         __u8 status = *((__u8 *) skb->data);
 366         __u8 param;
 367         void *sent;
 368
 369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 370
 371         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 372         if (!sent)
 373                 return;
 374
 375         param = *((__u8 *) sent);
 376
 377         hci_dev_lock(hdev);
 378
 379         if (status) {
 380                 hdev->discov_timeout = 0;
 381                 goto done;
 382         }
 383
 384         if (param & SCAN_INQUIRY)
 385                 set_bit(HCI_ISCAN, &hdev->flags);
 386         else
 387                 clear_bit(HCI_ISCAN, &hdev->flags);
 388
 389         if (param & SCAN_PAGE)
 390                 set_bit(HCI_PSCAN, &hdev->flags);
 391         else
 392                 clear_bit(HCI_PSCAN, &hdev->flags);
 393
 394 done:
 395         hci_dev_unlock(hdev);
 396 }
 397
 398 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 399 {
 400         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 403
 404         if (rp->status)
 405                 return;
 406
 407         memcpy(hdev->dev_class, rp->dev_class, 3);
 408
 409         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 410                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 411 }
 412
 413 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416         void *sent;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 419
 420         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 421         if (!sent)
 422                 return;
 423
 424         hci_dev_lock(hdev);
 425
 426         if (status == 0)
 427                 memcpy(hdev->dev_class, sent, 3);
 428
 429         if (hci_dev_test_flag(hdev, HCI_MGMT))
 430                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 431
 432         hci_dev_unlock(hdev);
 433 }
 434
 435 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 436 {
 437         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 438         __u16 setting;
 439
 440         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 441
 442         if (rp->status)
 443                 return;
 444
 445         setting = __le16_to_cpu(rp->voice_setting);
 446
 447         if (hdev->voice_setting == setting)
 448                 return;
 449
 450         hdev->voice_setting = setting;
 451
 452         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 453
 454         if (hdev->notify)
 455                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 456 }
 457
 458 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 459                                        struct sk_buff *skb)
 460 {
 461         __u8 status = *((__u8 *) skb->data);
 462         __u16 setting;
 463         void *sent;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 466
 467         if (status)
 468                 return;
 469
 470         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 471         if (!sent)
 472                 return;
 473
 474         setting = get_unaligned_le16(sent);
 475
 476         if (hdev->voice_setting == setting)
 477                 return;
 478
 479         hdev->voice_setting = setting;
 480
 481         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 482
 483         if (hdev->notify)
 484                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 485 }
 486
 487 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 488                                           struct sk_buff *skb)
 489 {
 490         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 491
 492         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 493
 494         if (rp->status)
 495                 return;
 496
 497         hdev->num_iac = rp->num_iac;
 498
 499         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 500 }
 501
 502 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 503 {
 504         __u8 status = *((__u8 *) skb->data);
 505         struct hci_cp_write_ssp_mode *sent;
 506
 507         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 508
 509         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 510         if (!sent)
 511                 return;
 512
 513         hci_dev_lock(hdev);
 514
 515         if (!status) {
 516                 if (sent->mode)
 517                         hdev->features[1][0] |= LMP_HOST_SSP;
 518                 else
 519                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 520         }
 521
 522         if (hci_dev_test_flag(hdev, HCI_MGMT))
 523                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 524         else if (!status) {
 525                 if (sent->mode)
 526                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 527                 else
 528                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 529         }
 530
 531         hci_dev_unlock(hdev);
 532 }
 533
 534 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 535 {
 536         u8 status = *((u8 *) skb->data);
 537         struct hci_cp_write_sc_support *sent;
 538
 539         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 540
 541         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 542         if (!sent)
 543                 return;
 544
 545         hci_dev_lock(hdev);
 546
 547         if (!status) {
 548                 if (sent->support)
 549                         hdev->features[1][0] |= LMP_HOST_SC;
 550                 else
 551                         hdev->features[1][0] &= ~LMP_HOST_SC;
 552         }
 553
 554         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 555                 if (sent->support)
 556                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 557                 else
 558                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 559         }
 560
 561         hci_dev_unlock(hdev);
 562 }
 563
 564 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 565 {
 566         struct hci_rp_read_local_version *rp = (void *) skb->data;
 567
 568         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 569
 570         if (rp->status)
 571                 return;
 572
 573         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 574             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 575                 hdev->hci_ver = rp->hci_ver;
 576                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 577                 hdev->lmp_ver = rp->lmp_ver;
 578                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 579                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 580         }
 581 }
 582
 583 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 584                                        struct sk_buff *skb)
 585 {
 586         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 587
 588         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 589
 590         if (rp->status)
 591                 return;
 592
 593         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 594             hci_dev_test_flag(hdev, HCI_CONFIG))
 595                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 596 }
 597
 598 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 599                                              struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 602         struct hci_conn *conn;
 603
 604         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 605
 606         if (rp->status)
 607                 return;
 608
 609         hci_dev_lock(hdev);
 610
 611         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 612         if (conn)
 613                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 614
 615         hci_dev_unlock(hdev);
 616 }
 617
 618 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 619                                               struct sk_buff *skb)
 620 {
 621         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 622         struct hci_conn *conn;
 623         void *sent;
 624
 625         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 626
 627         if (rp->status)
 628                 return;
 629
 630         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 631         if (!sent)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_read_local_features(struct hci_dev *hdev,
 644                                        struct sk_buff *skb)
 645 {
 646         struct hci_rp_read_local_features *rp = (void *) skb->data;
 647
 648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650         if (rp->status)
 651                 return;
 652
 653         memcpy(hdev->features, rp->features, 8);
 654
 655         /* Adjust default settings according to features
 656          * supported by device. */
 657
 658         if (hdev->features[0][0] & LMP_3SLOT)
 659                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 660
 661         if (hdev->features[0][0] & LMP_5SLOT)
 662                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 663
 664         if (hdev->features[0][1] & LMP_HV2) {
 665                 hdev->pkt_type  |= (HCI_HV2);
 666                 hdev->esco_type |= (ESCO_HV2);
 667         }
 668
 669         if (hdev->features[0][1] & LMP_HV3) {
 670                 hdev->pkt_type  |= (HCI_HV3);
 671                 hdev->esco_type |= (ESCO_HV3);
 672         }
 673
 674         if (lmp_esco_capable(hdev))
 675                 hdev->esco_type |= (ESCO_EV3);
 676
 677         if (hdev->features[0][4] & LMP_EV4)
 678                 hdev->esco_type |= (ESCO_EV4);
 679
 680         if (hdev->features[0][4] & LMP_EV5)
 681                 hdev->esco_type |= (ESCO_EV5);
 682
 683         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 684                 hdev->esco_type |= (ESCO_2EV3);
 685
 686         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 687                 hdev->esco_type |= (ESCO_3EV3);
 688
 689         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 690                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 691 }
 692
 693 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 694                                            struct sk_buff *skb)
 695 {
 696         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 697
 698         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 699
 700         if (rp->status)
 701                 return;
 702
 703         if (hdev->max_page < rp->max_page)
 704                 hdev->max_page = rp->max_page;
 705
 706         if (rp->page < HCI_MAX_PAGES)
 707                 memcpy(hdev->features[rp->page], rp->features, 8);
 708 }
 709
 710 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 711                                           struct sk_buff *skb)
 712 {
 713         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 714
 715         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 716
 717         if (rp->status)
 718                 return;
 719
 720         hdev->flow_ctl_mode = rp->mode;
 721 }
 722
 723 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 724 {
 725         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 726
 727         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 728
 729         if (rp->status)
 730                 return;
 731
 732         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 733         hdev->sco_mtu  = rp->sco_mtu;
 734         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 735         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 736
 737         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 738                 hdev->sco_mtu  = 64;
 739                 hdev->sco_pkts = 8;
 740         }
 741
 742         hdev->acl_cnt = hdev->acl_pkts;
 743         hdev->sco_cnt = hdev->sco_pkts;
 744
 745         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 746                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 747 }
 748
 749 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 750 {
 751         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 752
 753         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 754
 755         if (rp->status)
 756                 return;
 757
 758         if (test_bit(HCI_INIT, &hdev->flags))
 759                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 760
 761         if (hci_dev_test_flag(hdev, HCI_SETUP))
 762                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 763 }
 764
 765 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 766                                            struct sk_buff *skb)
 767 {
 768         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 769
 770         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 771
 772         if (rp->status)
 773                 return;
 774
 775         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 776             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 777                 hdev->pairing_opts = rp->pairing_opts;
 778                 hdev->max_enc_key_size = rp->max_key_size;
 779         }
 780 }
 781
 782 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 783                                            struct sk_buff *skb)
 784 {
 785         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 786
 787         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 788
 789         if (rp->status)
 790                 return;
 791
 792         if (test_bit(HCI_INIT, &hdev->flags)) {
 793                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 794                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 795         }
 796 }
 797
 798 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 799                                             struct sk_buff *skb)
 800 {
 801         u8 status = *((u8 *) skb->data);
 802         struct hci_cp_write_page_scan_activity *sent;
 803
 804         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 805
 806         if (status)
 807                 return;
 808
 809         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 810         if (!sent)
 811                 return;
 812
 813         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 814         hdev->page_scan_window = __le16_to_cpu(sent->window);
 815 }
 816
 817 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 818                                            struct sk_buff *skb)
 819 {
 820         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 821
 822         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 823
 824         if (rp->status)
 825                 return;
 826
 827         if (test_bit(HCI_INIT, &hdev->flags))
 828                 hdev->page_scan_type = rp->type;
 829 }
 830
 831 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 832                                         struct sk_buff *skb)
 833 {
 834         u8 status = *((u8 *) skb->data);
 835         u8 *type;
 836
 837         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 838
 839         if (status)
 840                 return;
 841
 842         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 843         if (type)
 844                 hdev->page_scan_type = *type;
 845 }
 846
 847 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 848                                         struct sk_buff *skb)
 849 {
 850         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 851
 852         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 853
 854         if (rp->status)
 855                 return;
 856
 857         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 858         hdev->block_len = __le16_to_cpu(rp->block_len);
 859         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 860
 861         hdev->block_cnt = hdev->num_blocks;
 862
 863         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 864                hdev->block_cnt, hdev->block_len);
 865 }
 866
 867 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 868 {
 869         struct hci_rp_read_clock *rp = (void *) skb->data;
 870         struct hci_cp_read_clock *cp;
 871         struct hci_conn *conn;
 872
 873         BT_DBG("%s", hdev->name);
 874
 875         if (skb->len < sizeof(*rp))
 876                 return;
 877
 878         if (rp->status)
 879                 return;
 880
 881         hci_dev_lock(hdev);
 882
 883         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 884         if (!cp)
 885                 goto unlock;
 886
 887         if (cp->which == 0x00) {
 888                 hdev->clock = le32_to_cpu(rp->clock);
 889                 goto unlock;
 890         }
 891
 892         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 893         if (conn) {
 894                 conn->clock = le32_to_cpu(rp->clock);
 895                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 896         }
 897
 898 unlock:
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 903                                        struct sk_buff *skb)
 904 {
 905         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 906
 907         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 908
 909         if (rp->status)
 910                 return;
 911
 912         hdev->amp_status = rp->amp_status;
 913         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 914         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 915         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 916         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 917         hdev->amp_type = rp->amp_type;
 918         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 919         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 920         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 921         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 922 }
 923
 924 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 925                                          struct sk_buff *skb)
 926 {
 927         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 928
 929         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 930
 931         if (rp->status)
 932                 return;
 933
 934         hdev->inq_tx_power = rp->tx_power;
 935 }
 936
 937 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 938                                                struct sk_buff *skb)
 939 {
 940         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 941
 942         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 943
 944         if (rp->status)
 945                 return;
 946
 947         hdev->err_data_reporting = rp->err_data_reporting;
 948 }
 949
 950 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 951                                                 struct sk_buff *skb)
 952 {
 953         __u8 status = *((__u8 *)skb->data);
 954         struct hci_cp_write_def_err_data_reporting *cp;
 955
 956         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 957
 958         if (status)
 959                 return;
 960
 961         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 962         if (!cp)
 963                 return;
 964
 965         hdev->err_data_reporting = cp->err_data_reporting;
 966 }
 967
 968 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 969 {
 970         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 971         struct hci_cp_pin_code_reply *cp;
 972         struct hci_conn *conn;
 973
 974         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 975
 976         hci_dev_lock(hdev);
 977
 978         if (hci_dev_test_flag(hdev, HCI_MGMT))
 979                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 980
 981         if (rp->status)
 982                 goto unlock;
 983
 984         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 985         if (!cp)
 986                 goto unlock;
 987
 988         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 989         if (conn)
 990                 conn->pin_length = cp->pin_len;
 991
 992 unlock:
 993         hci_dev_unlock(hdev);
 994 }
 995
 996 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 997 {
 998         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 999
1000         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1001
1002         hci_dev_lock(hdev);
1003
1004         if (hci_dev_test_flag(hdev, HCI_MGMT))
1005                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1006                                                  rp->status);
1007
1008         hci_dev_unlock(hdev);
1009 }
1010
1011 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1012                                        struct sk_buff *skb)
1013 {
1014         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1015
1016         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1017
1018         if (rp->status)
1019                 return;
1020
1021         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1022         hdev->le_pkts = rp->le_max_pkt;
1023
1024         hdev->le_cnt = hdev->le_pkts;
1025
1026         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1027 }
1028
1029 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1030                                           struct sk_buff *skb)
1031 {
1032         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1033
1034         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1035
1036         if (rp->status)
1037                 return;
1038
1039         memcpy(hdev->le_features, rp->features, 8);
1040 }
1041
1042 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1043                                         struct sk_buff *skb)
1044 {
1045         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1046
1047         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1048
1049         if (rp->status)
1050                 return;
1051
1052         hdev->adv_tx_power = rp->tx_power;
1053 }
1054
1055 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1056 {
1057         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         hci_dev_lock(hdev);
1062
1063         if (hci_dev_test_flag(hdev, HCI_MGMT))
1064                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1065                                                  rp->status);
1066
1067         hci_dev_unlock(hdev);
1068 }
1069
1070 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1071                                           struct sk_buff *skb)
1072 {
1073         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1074
1075         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1076
1077         hci_dev_lock(hdev);
1078
1079         if (hci_dev_test_flag(hdev, HCI_MGMT))
1080                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1081                                                      ACL_LINK, 0, rp->status);
1082
1083         hci_dev_unlock(hdev);
1084 }
1085
1086 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1087 {
1088         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1089
1090         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1091
1092         hci_dev_lock(hdev);
1093
1094         if (hci_dev_test_flag(hdev, HCI_MGMT))
1095                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1096                                                  0, rp->status);
1097
1098         hci_dev_unlock(hdev);
1099 }
1100
1101 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1102                                           struct sk_buff *skb)
1103 {
1104         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1105
1106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1107
1108         hci_dev_lock(hdev);
1109
1110         if (hci_dev_test_flag(hdev, HCI_MGMT))
1111                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1112                                                      ACL_LINK, 0, rp->status);
1113
1114         hci_dev_unlock(hdev);
1115 }
1116
1117 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1118                                        struct sk_buff *skb)
1119 {
1120         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1121
1122         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1123 }
1124
1125 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1126                                            struct sk_buff *skb)
1127 {
1128         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1129
1130         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1131 }
1132
1133 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1134 {
1135         __u8 status = *((__u8 *) skb->data);
1136         bdaddr_t *sent;
1137
1138         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1139
1140         if (status)
1141                 return;
1142
1143         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1144         if (!sent)
1145                 return;
1146
1147         hci_dev_lock(hdev);
1148
1149         bacpy(&hdev->random_addr, sent);
1150
1151         hci_dev_unlock(hdev);
1152 }
1153
1154 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1155 {
1156         __u8 status = *((__u8 *) skb->data);
1157         struct hci_cp_le_set_default_phy *cp;
1158
1159         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1160
1161         if (status)
1162                 return;
1163
1164         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1165         if (!cp)
1166                 return;
1167
1168         hci_dev_lock(hdev);
1169
1170         hdev->le_tx_def_phys = cp->tx_phys;
1171         hdev->le_rx_def_phys = cp->rx_phys;
1172
1173         hci_dev_unlock(hdev);
1174 }
1175
1176 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1177                                               struct sk_buff *skb)
1178 {
1179         __u8 status = *((__u8 *) skb->data);
1180         struct hci_cp_le_set_adv_set_rand_addr *cp;
1181         struct adv_info *adv_instance;
1182
1183         if (status)
1184                 return;
1185
1186         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1187         if (!cp)
1188                 return;
1189
1190         hci_dev_lock(hdev);
1191
1192         if (!hdev->cur_adv_instance) {
1193                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1194                 bacpy(&hdev->random_addr, &cp->bdaddr);
1195         } else {
1196                 adv_instance = hci_find_adv_instance(hdev,
1197                                                      hdev->cur_adv_instance);
1198                 if (adv_instance)
1199                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1200         }
1201
1202         hci_dev_unlock(hdev);
1203 }
1204
1205 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1206                                           struct sk_buff *skb)
1207 {
1208         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1209
1210         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1211
1212         if (rp->status)
1213                 return;
1214
1215         hdev->min_le_tx_power = rp->min_le_tx_power;
1216         hdev->max_le_tx_power = rp->max_le_tx_power;
1217 }
1218
1219 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1220 {
1221         __u8 *sent, status = *((__u8 *) skb->data);
1222
1223         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1224
1225         if (status)
1226                 return;
1227
1228         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1229         if (!sent)
1230                 return;
1231
1232         hci_dev_lock(hdev);
1233
1234         /* If we're doing connection initiation as peripheral. Set a
1235          * timeout in case something goes wrong.
1236          */
1237         if (*sent) {
1238                 struct hci_conn *conn;
1239
1240                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1241
1242                 conn = hci_lookup_le_connect(hdev);
1243                 if (conn)
1244                         queue_delayed_work(hdev->workqueue,
1245                                            &conn->le_conn_timeout,
1246                                            conn->conn_timeout);
1247         } else {
1248                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1249         }
1250
1251         hci_dev_unlock(hdev);
1252 }
1253
1254 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1255                                          struct sk_buff *skb)
1256 {
1257         struct hci_cp_le_set_ext_adv_enable *cp;
1258         __u8 status = *((__u8 *) skb->data);
1259
1260         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1261
1262         if (status)
1263                 return;
1264
1265         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1266         if (!cp)
1267                 return;
1268
1269         hci_dev_lock(hdev);
1270
1271         if (cp->enable) {
1272                 struct hci_conn *conn;
1273
1274                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1275
1276                 conn = hci_lookup_le_connect(hdev);
1277                 if (conn)
1278                         queue_delayed_work(hdev->workqueue,
1279                                            &conn->le_conn_timeout,
1280                                            conn->conn_timeout);
1281         } else {
1282                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1283         }
1284
1285         hci_dev_unlock(hdev);
1286 }
1287
1288 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1289 {
1290         struct hci_cp_le_set_scan_param *cp;
1291         __u8 status = *((__u8 *) skb->data);
1292
1293         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1294
1295         if (status)
1296                 return;
1297
1298         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1299         if (!cp)
1300                 return;
1301
1302         hci_dev_lock(hdev);
1303
1304         hdev->le_scan_type = cp->type;
1305
1306         hci_dev_unlock(hdev);
1307 }
1308
1309 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1310                                          struct sk_buff *skb)
1311 {
1312         struct hci_cp_le_set_ext_scan_params *cp;
1313         __u8 status = *((__u8 *) skb->data);
1314         struct hci_cp_le_scan_phy_params *phy_param;
1315
1316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1317
1318         if (status)
1319                 return;
1320
1321         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1322         if (!cp)
1323                 return;
1324
1325         phy_param = (void *)cp->data;
1326
1327         hci_dev_lock(hdev);
1328
1329         hdev->le_scan_type = phy_param->type;
1330
1331         hci_dev_unlock(hdev);
1332 }
1333
1334 static bool has_pending_adv_report(struct hci_dev *hdev)
1335 {
1336         struct discovery_state *d = &hdev->discovery;
1337
1338         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1339 }
1340
1341 static void clear_pending_adv_report(struct hci_dev *hdev)
1342 {
1343         struct discovery_state *d = &hdev->discovery;
1344
1345         bacpy(&d->last_adv_addr, BDADDR_ANY);
1346         d->last_adv_data_len = 0;
1347 }
1348
1349 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1350                                      u8 bdaddr_type, s8 rssi, u32 flags,
1351                                      u8 *data, u8 len)
1352 {
1353         struct discovery_state *d = &hdev->discovery;
1354
1355         if (len > HCI_MAX_AD_LENGTH)
1356                 return;
1357
1358         bacpy(&d->last_adv_addr, bdaddr);
1359         d->last_adv_addr_type = bdaddr_type;
1360         d->last_adv_rssi = rssi;
1361         d->last_adv_flags = flags;
1362         memcpy(d->last_adv_data, data, len);
1363         d->last_adv_data_len = len;
1364 }
1365
1366 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1367 {
1368         hci_dev_lock(hdev);
1369
1370         switch (enable) {
1371         case LE_SCAN_ENABLE:
1372                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1373                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1374                         clear_pending_adv_report(hdev);
1375                 break;
1376
1377         case LE_SCAN_DISABLE:
1378                 /* We do this here instead of when setting DISCOVERY_STOPPED
1379                  * since the latter would potentially require waiting for
1380                  * inquiry to stop too.
1381                  */
1382                 if (has_pending_adv_report(hdev)) {
1383                         struct discovery_state *d = &hdev->discovery;
1384
1385                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1386                                           d->last_adv_addr_type, NULL,
1387                                           d->last_adv_rssi, d->last_adv_flags,
1388                                           d->last_adv_data,
1389                                           d->last_adv_data_len, NULL, 0);
1390                 }
1391
1392                 /* Cancel this timer so that we don't try to disable scanning
1393                  * when it's already disabled.
1394                  */
1395                 cancel_delayed_work(&hdev->le_scan_disable);
1396
1397                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1398
1399                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1400                  * interrupted scanning due to a connect request. Mark
1401                  * therefore discovery as stopped. If this was not
1402                  * because of a connect request advertising might have
1403                  * been disabled because of active scanning, so
1404                  * re-enable it again if necessary.
1405                  */
1406                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1407                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1408                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1409                          hdev->discovery.state == DISCOVERY_FINDING)
1410                         hci_req_reenable_advertising(hdev);
1411
1412                 break;
1413
1414         default:
1415                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1416                            enable);
1417                 break;
1418         }
1419
1420         hci_dev_unlock(hdev);
1421 }
1422
1423 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1424                                       struct sk_buff *skb)
1425 {
1426         struct hci_cp_le_set_scan_enable *cp;
1427         __u8 status = *((__u8 *) skb->data);
1428
1429         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1430
1431         if (status)
1432                 return;
1433
1434         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1435         if (!cp)
1436                 return;
1437
1438         le_set_scan_enable_complete(hdev, cp->enable);
1439 }
1440
1441 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1442                                       struct sk_buff *skb)
1443 {
1444         struct hci_cp_le_set_ext_scan_enable *cp;
1445         __u8 status = *((__u8 *) skb->data);
1446
1447         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1448
1449         if (status)
1450                 return;
1451
1452         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1453         if (!cp)
1454                 return;
1455
1456         le_set_scan_enable_complete(hdev, cp->enable);
1457 }
1458
1459 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1460                                       struct sk_buff *skb)
1461 {
1462         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1463
1464         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1465                rp->num_of_sets);
1466
1467         if (rp->status)
1468                 return;
1469
1470         hdev->le_num_of_adv_sets = rp->num_of_sets;
1471 }
1472
1473 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1474                                            struct sk_buff *skb)
1475 {
1476         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1477
1478         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1479
1480         if (rp->status)
1481                 return;
1482
1483         hdev->le_white_list_size = rp->size;
1484 }
1485
1486 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1487                                        struct sk_buff *skb)
1488 {
1489         __u8 status = *((__u8 *) skb->data);
1490
1491         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1492
1493         if (status)
1494                 return;
1495
1496         hci_bdaddr_list_clear(&hdev->le_white_list);
1497 }
1498
1499 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1500                                         struct sk_buff *skb)
1501 {
1502         struct hci_cp_le_add_to_white_list *sent;
1503         __u8 status = *((__u8 *) skb->data);
1504
1505         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1506
1507         if (status)
1508                 return;
1509
1510         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1511         if (!sent)
1512                 return;
1513
1514         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1515                            sent->bdaddr_type);
1516 }
1517
1518 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1519                                           struct sk_buff *skb)
1520 {
1521         struct hci_cp_le_del_from_white_list *sent;
1522         __u8 status = *((__u8 *) skb->data);
1523
1524         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1525
1526         if (status)
1527                 return;
1528
1529         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1530         if (!sent)
1531                 return;
1532
1533         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1534                             sent->bdaddr_type);
1535 }
1536
1537 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1538                                             struct sk_buff *skb)
1539 {
1540         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1541
1542         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1543
1544         if (rp->status)
1545                 return;
1546
1547         memcpy(hdev->le_states, rp->le_states, 8);
1548 }
1549
1550 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1551                                         struct sk_buff *skb)
1552 {
1553         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1554
1555         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1556
1557         if (rp->status)
1558                 return;
1559
1560         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1561         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1562 }
1563
1564 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1565                                          struct sk_buff *skb)
1566 {
1567         struct hci_cp_le_write_def_data_len *sent;
1568         __u8 status = *((__u8 *) skb->data);
1569
1570         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1571
1572         if (status)
1573                 return;
1574
1575         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1576         if (!sent)
1577                 return;
1578
1579         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1580         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1581 }
1582
1583 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1584                                          struct sk_buff *skb)
1585 {
1586         struct hci_cp_le_add_to_resolv_list *sent;
1587         __u8 status = *((__u8 *) skb->data);
1588
1589         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1590
1591         if (status)
1592                 return;
1593
1594         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1595         if (!sent)
1596                 return;
1597
1598         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1599                                 sent->bdaddr_type, sent->peer_irk,
1600                                 sent->local_irk);
1601 }
1602
1603 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1604                                           struct sk_buff *skb)
1605 {
1606         struct hci_cp_le_del_from_resolv_list *sent;
1607         __u8 status = *((__u8 *) skb->data);
1608
1609         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1610
1611         if (status)
1612                 return;
1613
1614         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1615         if (!sent)
1616                 return;
1617
1618         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1619                             sent->bdaddr_type);
1620 }
1621
1622 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1623                                        struct sk_buff *skb)
1624 {
1625         __u8 status = *((__u8 *) skb->data);
1626
1627         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1628
1629         if (status)
1630                 return;
1631
1632         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1633 }
1634
1635 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1636                                            struct sk_buff *skb)
1637 {
1638         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1639
1640         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1641
1642         if (rp->status)
1643                 return;
1644
1645         hdev->le_resolv_list_size = rp->size;
1646 }
1647
1648 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1649                                                 struct sk_buff *skb)
1650 {
1651         __u8 *sent, status = *((__u8 *) skb->data);
1652
1653         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1654
1655         if (status)
1656                 return;
1657
1658         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1659         if (!sent)
1660                 return;
1661
1662         hci_dev_lock(hdev);
1663
1664         if (*sent)
1665                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1666         else
1667                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1668
1669         hci_dev_unlock(hdev);
1670 }
1671
1672 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1673                                         struct sk_buff *skb)
1674 {
1675         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1676
1677         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1678
1679         if (rp->status)
1680                 return;
1681
1682         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1683         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1684         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1685         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1686 }
1687
1688 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1689                                            struct sk_buff *skb)
1690 {
1691         struct hci_cp_write_le_host_supported *sent;
1692         __u8 status = *((__u8 *) skb->data);
1693
1694         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1695
1696         if (status)
1697                 return;
1698
1699         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1700         if (!sent)
1701                 return;
1702
1703         hci_dev_lock(hdev);
1704
1705         if (sent->le) {
1706                 hdev->features[1][0] |= LMP_HOST_LE;
1707                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1708         } else {
1709                 hdev->features[1][0] &= ~LMP_HOST_LE;
1710                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1711                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1712         }
1713
1714         if (sent->simul)
1715                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1716         else
1717                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1718
1719         hci_dev_unlock(hdev);
1720 }
1721
1722 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1723 {
1724         struct hci_cp_le_set_adv_param *cp;
1725         u8 status = *((u8 *) skb->data);
1726
1727         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1728
1729         if (status)
1730                 return;
1731
1732         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1733         if (!cp)
1734                 return;
1735
1736         hci_dev_lock(hdev);
1737         hdev->adv_addr_type = cp->own_address_type;
1738         hci_dev_unlock(hdev);
1739 }
1740
1741 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1742 {
1743         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1744         struct hci_cp_le_set_ext_adv_params *cp;
1745         struct adv_info *adv_instance;
1746
1747         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1748
1749         if (rp->status)
1750                 return;
1751
1752         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1753         if (!cp)
1754                 return;
1755
1756         hci_dev_lock(hdev);
1757         hdev->adv_addr_type = cp->own_addr_type;
1758         if (!hdev->cur_adv_instance) {
1759                 /* Store in hdev for instance 0 */
1760                 hdev->adv_tx_power = rp->tx_power;
1761         } else {
1762                 adv_instance = hci_find_adv_instance(hdev,
1763                                                      hdev->cur_adv_instance);
1764                 if (adv_instance)
1765                         adv_instance->tx_power = rp->tx_power;
1766         }
1767         /* Update adv data as tx power is known now */
1768         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1769
1770         hci_dev_unlock(hdev);
1771 }
1772
1773 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1774 {
1775         struct hci_rp_read_rssi *rp = (void *) skb->data;
1776         struct hci_conn *conn;
1777
1778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1779
1780         if (rp->status)
1781                 return;
1782
1783         hci_dev_lock(hdev);
1784
1785         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1786         if (conn)
1787                 conn->rssi = rp->rssi;
1788
1789         hci_dev_unlock(hdev);
1790 }
1791
1792 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1793 {
1794         struct hci_cp_read_tx_power *sent;
1795         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1796         struct hci_conn *conn;
1797
1798         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1799
1800         if (rp->status)
1801                 return;
1802
1803         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1804         if (!sent)
1805                 return;
1806
1807         hci_dev_lock(hdev);
1808
1809         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1810         if (!conn)
1811                 goto unlock;
1812
1813         switch (sent->type) {
1814         case 0x00:
1815                 conn->tx_power = rp->tx_power;
1816                 break;
1817         case 0x01:
1818                 conn->max_tx_power = rp->tx_power;
1819                 break;
1820         }
1821
1822 unlock:
1823         hci_dev_unlock(hdev);
1824 }
1825
1826 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1827 {
1828         u8 status = *((u8 *) skb->data);
1829         u8 *mode;
1830
1831         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1832
1833         if (status)
1834                 return;
1835
1836         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1837         if (mode)
1838                 hdev->ssp_debug_mode = *mode;
1839 }
1840
1841 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1842 {
1843         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1844
1845         if (status) {
1846                 hci_conn_check_pending(hdev);
1847                 return;
1848         }
1849
1850         set_bit(HCI_INQUIRY, &hdev->flags);
1851 }
1852
1853 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1854 {
1855         struct hci_cp_create_conn *cp;
1856         struct hci_conn *conn;
1857
1858         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1859
1860         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1861         if (!cp)
1862                 return;
1863
1864         hci_dev_lock(hdev);
1865
1866         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1867
1868         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1869
1870         if (status) {
1871                 if (conn && conn->state == BT_CONNECT) {
1872                         if (status != 0x0c || conn->attempt > 2) {
1873                                 conn->state = BT_CLOSED;
1874                                 hci_connect_cfm(conn, status);
1875                                 hci_conn_del(conn);
1876                         } else
1877                                 conn->state = BT_CONNECT2;
1878                 }
1879         } else {
1880                 if (!conn) {
1881                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1882                                             HCI_ROLE_MASTER);
1883                         if (!conn)
1884                                 bt_dev_err(hdev, "no memory for new connection");
1885                 }
1886         }
1887
1888         hci_dev_unlock(hdev);
1889 }
1890
1891 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1892 {
1893         struct hci_cp_add_sco *cp;
1894         struct hci_conn *acl, *sco;
1895         __u16 handle;
1896
1897         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1898
1899         if (!status)
1900                 return;
1901
1902         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1903         if (!cp)
1904                 return;
1905
1906         handle = __le16_to_cpu(cp->handle);
1907
1908         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1909
1910         hci_dev_lock(hdev);
1911
1912         acl = hci_conn_hash_lookup_handle(hdev, handle);
1913         if (acl) {
1914                 sco = acl->link;
1915                 if (sco) {
1916                         sco->state = BT_CLOSED;
1917
1918                         hci_connect_cfm(sco, status);
1919                         hci_conn_del(sco);
1920                 }
1921         }
1922
1923         hci_dev_unlock(hdev);
1924 }
1925
1926 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1927 {
1928         struct hci_cp_auth_requested *cp;
1929         struct hci_conn *conn;
1930
1931         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1932
1933         if (!status)
1934                 return;
1935
1936         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1937         if (!cp)
1938                 return;
1939
1940         hci_dev_lock(hdev);
1941
1942         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1943         if (conn) {
1944                 if (conn->state == BT_CONFIG) {
1945                         hci_connect_cfm(conn, status);
1946                         hci_conn_drop(conn);
1947                 }
1948         }
1949
1950         hci_dev_unlock(hdev);
1951 }
1952
1953 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1954 {
1955         struct hci_cp_set_conn_encrypt *cp;
1956         struct hci_conn *conn;
1957
1958         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1959
1960         if (!status)
1961                 return;
1962
1963         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1964         if (!cp)
1965                 return;
1966
1967         hci_dev_lock(hdev);
1968
1969         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1970         if (conn) {
1971                 if (conn->state == BT_CONFIG) {
1972                         hci_connect_cfm(conn, status);
1973                         hci_conn_drop(conn);
1974                 }
1975         }
1976
1977         hci_dev_unlock(hdev);
1978 }
1979
1980 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1981                                     struct hci_conn *conn)
1982 {
1983         if (conn->state != BT_CONFIG || !conn->out)
1984                 return 0;
1985
1986         if (conn->pending_sec_level == BT_SECURITY_SDP)
1987                 return 0;
1988
1989         /* Only request authentication for SSP connections or non-SSP
1990          * devices with sec_level MEDIUM or HIGH or if MITM protection
1991          * is requested.
1992          */
1993         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1994             conn->pending_sec_level != BT_SECURITY_FIPS &&
1995             conn->pending_sec_level != BT_SECURITY_HIGH &&
1996             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1997                 return 0;
1998
1999         return 1;
2000 }
2001
2002 static int hci_resolve_name(struct hci_dev *hdev,
2003                                    struct inquiry_entry *e)
2004 {
2005         struct hci_cp_remote_name_req cp;
2006
2007         memset(&cp, 0, sizeof(cp));
2008
2009         bacpy(&cp.bdaddr, &e->data.bdaddr);
2010         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2011         cp.pscan_mode = e->data.pscan_mode;
2012         cp.clock_offset = e->data.clock_offset;
2013
2014         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2015 }
2016
2017 static bool hci_resolve_next_name(struct hci_dev *hdev)
2018 {
2019         struct discovery_state *discov = &hdev->discovery;
2020         struct inquiry_entry *e;
2021
2022         if (list_empty(&discov->resolve))
2023                 return false;
2024
2025         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2026         if (!e)
2027                 return false;
2028
2029         if (hci_resolve_name(hdev, e) == 0) {
2030                 e->name_state = NAME_PENDING;
2031                 return true;
2032         }
2033
2034         return false;
2035 }
2036
2037 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2038                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2039 {
2040         struct discovery_state *discov = &hdev->discovery;
2041         struct inquiry_entry *e;
2042
2043         /* Update the mgmt connected state if necessary. Be careful with
2044          * conn objects that exist but are not (yet) connected however.
2045          * Only those in BT_CONFIG or BT_CONNECTED states can be
2046          * considered connected.
2047          */
2048         if (conn &&
2049             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2050             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2051                 mgmt_device_connected(hdev, conn, 0, name, name_len);
2052
2053         if (discov->state == DISCOVERY_STOPPED)
2054                 return;
2055
2056         if (discov->state == DISCOVERY_STOPPING)
2057                 goto discov_complete;
2058
2059         if (discov->state != DISCOVERY_RESOLVING)
2060                 return;
2061
2062         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2063         /* If the device was not found in a list of found devices names of which
2064          * are pending. there is no need to continue resolving a next name as it
2065          * will be done upon receiving another Remote Name Request Complete
2066          * Event */
2067         if (!e)
2068                 return;
2069
2070         list_del(&e->list);
2071         if (name) {
2072                 e->name_state = NAME_KNOWN;
2073                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2074                                  e->data.rssi, name, name_len);
2075         } else {
2076                 e->name_state = NAME_NOT_KNOWN;
2077         }
2078
2079         if (hci_resolve_next_name(hdev))
2080                 return;
2081
2082 discov_complete:
2083         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2084 }
2085
2086 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2087 {
2088         struct hci_cp_remote_name_req *cp;
2089         struct hci_conn *conn;
2090
2091         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2092
2093         /* If successful wait for the name req complete event before
2094          * checking for the need to do authentication */
2095         if (!status)
2096                 return;
2097
2098         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2099         if (!cp)
2100                 return;
2101
2102         hci_dev_lock(hdev);
2103
2104         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2105
2106         if (hci_dev_test_flag(hdev, HCI_MGMT))
2107                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2108
2109         if (!conn)
2110                 goto unlock;
2111
2112         if (!hci_outgoing_auth_needed(hdev, conn))
2113                 goto unlock;
2114
2115         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2116                 struct hci_cp_auth_requested auth_cp;
2117
2118                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2119
2120                 auth_cp.handle = __cpu_to_le16(conn->handle);
2121                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2122                              sizeof(auth_cp), &auth_cp);
2123         }
2124
2125 unlock:
2126         hci_dev_unlock(hdev);
2127 }
2128
2129 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2130 {
2131         struct hci_cp_read_remote_features *cp;
2132         struct hci_conn *conn;
2133
2134         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2135
2136         if (!status)
2137                 return;
2138
2139         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2140         if (!cp)
2141                 return;
2142
2143         hci_dev_lock(hdev);
2144
2145         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2146         if (conn) {
2147                 if (conn->state == BT_CONFIG) {
2148                         hci_connect_cfm(conn, status);
2149                         hci_conn_drop(conn);
2150                 }
2151         }
2152
2153         hci_dev_unlock(hdev);
2154 }
2155
2156 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2157 {
2158         struct hci_cp_read_remote_ext_features *cp;
2159         struct hci_conn *conn;
2160
2161         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2162
2163         if (!status)
2164                 return;
2165
2166         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2167         if (!cp)
2168                 return;
2169
2170         hci_dev_lock(hdev);
2171
2172         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2173         if (conn) {
2174                 if (conn->state == BT_CONFIG) {
2175                         hci_connect_cfm(conn, status);
2176                         hci_conn_drop(conn);
2177                 }
2178         }
2179
2180         hci_dev_unlock(hdev);
2181 }
2182
2183 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2184 {
2185         struct hci_cp_setup_sync_conn *cp;
2186         struct hci_conn *acl, *sco;
2187         __u16 handle;
2188
2189         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2190
2191         if (!status)
2192                 return;
2193
2194         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2195         if (!cp)
2196                 return;
2197
2198         handle = __le16_to_cpu(cp->handle);
2199
2200         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2201
2202         hci_dev_lock(hdev);
2203
2204         acl = hci_conn_hash_lookup_handle(hdev, handle);
2205         if (acl) {
2206                 sco = acl->link;
2207                 if (sco) {
2208                         sco->state = BT_CLOSED;
2209
2210                         hci_connect_cfm(sco, status);
2211                         hci_conn_del(sco);
2212                 }
2213         }
2214
2215         hci_dev_unlock(hdev);
2216 }
2217
2218 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2219 {
2220         struct hci_cp_sniff_mode *cp;
2221         struct hci_conn *conn;
2222
2223         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2224
2225         if (!status)
2226                 return;
2227
2228         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2229         if (!cp)
2230                 return;
2231
2232         hci_dev_lock(hdev);
2233
2234         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2235         if (conn) {
2236                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2237
2238                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2239                         hci_sco_setup(conn, status);
2240         }
2241
2242         hci_dev_unlock(hdev);
2243 }
2244
2245 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2246 {
2247         struct hci_cp_exit_sniff_mode *cp;
2248         struct hci_conn *conn;
2249
2250         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2251
2252         if (!status)
2253                 return;
2254
2255         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2256         if (!cp)
2257                 return;
2258
2259         hci_dev_lock(hdev);
2260
2261         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2262         if (conn) {
2263                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2264
2265                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2266                         hci_sco_setup(conn, status);
2267         }
2268
2269         hci_dev_unlock(hdev);
2270 }
2271
2272 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2273 {
2274         struct hci_cp_disconnect *cp;
2275         struct hci_conn *conn;
2276
2277         if (!status)
2278                 return;
2279
2280         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2281         if (!cp)
2282                 return;
2283
2284         hci_dev_lock(hdev);
2285
2286         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2287         if (conn) {
2288                 u8 type = conn->type;
2289
2290                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2291                                        conn->dst_type, status);
2292
2293                 /* If the disconnection failed for any reason, the upper layer
2294                  * does not retry to disconnect in current implementation.
2295                  * Hence, we need to do some basic cleanup here and re-enable
2296                  * advertising if necessary.
2297                  */
2298                 hci_conn_del(conn);
2299                 if (type == LE_LINK)
2300                         hci_req_reenable_advertising(hdev);
2301         }
2302
2303         hci_dev_unlock(hdev);
2304 }
2305
2306 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2307                               u8 peer_addr_type, u8 own_address_type,
2308                               u8 filter_policy)
2309 {
2310         struct hci_conn *conn;
2311
2312         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2313                                        peer_addr_type);
2314         if (!conn)
2315                 return;
2316
2317         /* When using controller based address resolution, then the new
2318          * address types 0x02 and 0x03 are used. These types need to be
2319          * converted back into either public address or random address type
2320          */
2321         if (use_ll_privacy(hdev) &&
2322             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2323                 switch (own_address_type) {
2324                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2325                         own_address_type = ADDR_LE_DEV_PUBLIC;
2326                         break;
2327                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2328                         own_address_type = ADDR_LE_DEV_RANDOM;
2329                         break;
2330                 }
2331         }
2332
2333         /* Store the initiator and responder address information which
2334          * is needed for SMP. These values will not change during the
2335          * lifetime of the connection.
2336          */
2337         conn->init_addr_type = own_address_type;
2338         if (own_address_type == ADDR_LE_DEV_RANDOM)
2339                 bacpy(&conn->init_addr, &hdev->random_addr);
2340         else
2341                 bacpy(&conn->init_addr, &hdev->bdaddr);
2342
2343         conn->resp_addr_type = peer_addr_type;
2344         bacpy(&conn->resp_addr, peer_addr);
2345
2346         /* We don't want the connection attempt to stick around
2347          * indefinitely since LE doesn't have a page timeout concept
2348          * like BR/EDR. Set a timer for any connection that doesn't use
2349          * the white list for connecting.
2350          */
2351         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2352                 queue_delayed_work(conn->hdev->workqueue,
2353                                    &conn->le_conn_timeout,
2354                                    conn->conn_timeout);
2355 }
2356
2357 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2358 {
2359         struct hci_cp_le_create_conn *cp;
2360
2361         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2362
2363         /* All connection failure handling is taken care of by the
2364          * hci_le_conn_failed function which is triggered by the HCI
2365          * request completion callbacks used for connecting.
2366          */
2367         if (status)
2368                 return;
2369
2370         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2371         if (!cp)
2372                 return;
2373
2374         hci_dev_lock(hdev);
2375
2376         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2377                           cp->own_address_type, cp->filter_policy);
2378
2379         hci_dev_unlock(hdev);
2380 }
2381
2382 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2383 {
2384         struct hci_cp_le_ext_create_conn *cp;
2385
2386         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2387
2388         /* All connection failure handling is taken care of by the
2389          * hci_le_conn_failed function which is triggered by the HCI
2390          * request completion callbacks used for connecting.
2391          */
2392         if (status)
2393                 return;
2394
2395         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2396         if (!cp)
2397                 return;
2398
2399         hci_dev_lock(hdev);
2400
2401         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2402                           cp->own_addr_type, cp->filter_policy);
2403
2404         hci_dev_unlock(hdev);
2405 }
2406
2407 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2408 {
2409         struct hci_cp_le_read_remote_features *cp;
2410         struct hci_conn *conn;
2411
2412         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2413
2414         if (!status)
2415                 return;
2416
2417         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2418         if (!cp)
2419                 return;
2420
2421         hci_dev_lock(hdev);
2422
2423         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2424         if (conn) {
2425                 if (conn->state == BT_CONFIG) {
2426                         hci_connect_cfm(conn, status);
2427                         hci_conn_drop(conn);
2428                 }
2429         }
2430
2431         hci_dev_unlock(hdev);
2432 }
2433
2434 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2435 {
2436         struct hci_cp_le_start_enc *cp;
2437         struct hci_conn *conn;
2438
2439         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2440
2441         if (!status)
2442                 return;
2443
2444         hci_dev_lock(hdev);
2445
2446         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2447         if (!cp)
2448                 goto unlock;
2449
2450         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2451         if (!conn)
2452                 goto unlock;
2453
2454         if (conn->state != BT_CONNECTED)
2455                 goto unlock;
2456
2457         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2458         hci_conn_drop(conn);
2459
2460 unlock:
2461         hci_dev_unlock(hdev);
2462 }
2463
2464 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2465 {
2466         struct hci_cp_switch_role *cp;
2467         struct hci_conn *conn;
2468
2469         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2470
2471         if (!status)
2472                 return;
2473
2474         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2475         if (!cp)
2476                 return;
2477
2478         hci_dev_lock(hdev);
2479
2480         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2481         if (conn)
2482                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2483
2484         hci_dev_unlock(hdev);
2485 }
2486
2487 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2488 {
2489         __u8 status = *((__u8 *) skb->data);
2490         struct discovery_state *discov = &hdev->discovery;
2491         struct inquiry_entry *e;
2492
2493         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2494
2495         hci_conn_check_pending(hdev);
2496
2497         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2498                 return;
2499
2500         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2501         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2502
2503         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2504                 return;
2505
2506         hci_dev_lock(hdev);
2507
2508         if (discov->state != DISCOVERY_FINDING)
2509                 goto unlock;
2510
2511         if (list_empty(&discov->resolve)) {
2512                 /* When BR/EDR inquiry is active and no LE scanning is in
2513                  * progress, then change discovery state to indicate completion.
2514                  *
2515                  * When running LE scanning and BR/EDR inquiry simultaneously
2516                  * and the LE scan already finished, then change the discovery
2517                  * state to indicate completion.
2518                  */
2519                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2520                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2521                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2522                 goto unlock;
2523         }
2524
2525         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2526         if (e && hci_resolve_name(hdev, e) == 0) {
2527                 e->name_state = NAME_PENDING;
2528                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2529         } else {
2530                 /* When BR/EDR inquiry is active and no LE scanning is in
2531                  * progress, then change discovery state to indicate completion.
2532                  *
2533                  * When running LE scanning and BR/EDR inquiry simultaneously
2534                  * and the LE scan already finished, then change the discovery
2535                  * state to indicate completion.
2536                  */
2537                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2538                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2539                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2540         }
2541
2542 unlock:
2543         hci_dev_unlock(hdev);
2544 }
2545
2546 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2547 {
2548         struct inquiry_data data;
2549         struct inquiry_info *info = (void *) (skb->data + 1);
2550         int num_rsp = *((__u8 *) skb->data);
2551
2552         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2553
2554         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2555                 return;
2556
2557         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2558                 return;
2559
2560         hci_dev_lock(hdev);
2561
2562         for (; num_rsp; num_rsp--, info++) {
2563                 u32 flags;
2564
2565                 bacpy(&data.bdaddr, &info->bdaddr);
2566                 data.pscan_rep_mode     = info->pscan_rep_mode;
2567                 data.pscan_period_mode  = info->pscan_period_mode;
2568                 data.pscan_mode         = info->pscan_mode;
2569                 memcpy(data.dev_class, info->dev_class, 3);
2570                 data.clock_offset       = info->clock_offset;
2571                 data.rssi               = HCI_RSSI_INVALID;
2572                 data.ssp_mode           = 0x00;
2573
2574                 flags = hci_inquiry_cache_update(hdev, &data, false);
2575
2576                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2577                                   info->dev_class, HCI_RSSI_INVALID,
2578                                   flags, NULL, 0, NULL, 0);
2579         }
2580
2581         hci_dev_unlock(hdev);
2582 }
2583
2584 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2585 {
2586         struct hci_ev_conn_complete *ev = (void *) skb->data;
2587         struct hci_conn *conn;
2588
2589         BT_DBG("%s", hdev->name);
2590
2591         hci_dev_lock(hdev);
2592
2593         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2594         if (!conn) {
2595                 /* Connection may not exist if auto-connected. Check the bredr
2596                  * allowlist to see if this device is allowed to auto connect.
2597                  * If link is an ACL type, create a connection class
2598                  * automatically.
2599                  *
2600                  * Auto-connect will only occur if the event filter is
2601                  * programmed with a given address. Right now, event filter is
2602                  * only used during suspend.
2603                  */
2604                 if (ev->link_type == ACL_LINK &&
2605                     hci_bdaddr_list_lookup_with_flags(&hdev->whitelist,
2606                                                       &ev->bdaddr,
2607                                                       BDADDR_BREDR)) {
2608                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2609                                             HCI_ROLE_SLAVE);
2610                         if (!conn) {
2611                                 bt_dev_err(hdev, "no memory for new conn");
2612                                 goto unlock;
2613                         }
2614                 } else {
2615                         if (ev->link_type != SCO_LINK)
2616                                 goto unlock;
2617
2618                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2619                                                        &ev->bdaddr);
2620                         if (!conn)
2621                                 goto unlock;
2622
2623                         conn->type = SCO_LINK;
2624                 }
2625         }
2626
2627         if (!ev->status) {
2628                 conn->handle = __le16_to_cpu(ev->handle);
2629
2630                 if (conn->type == ACL_LINK) {
2631                         conn->state = BT_CONFIG;
2632                         hci_conn_hold(conn);
2633
2634                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2635                             !hci_find_link_key(hdev, &ev->bdaddr))
2636                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2637                         else
2638                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2639                 } else
2640                         conn->state = BT_CONNECTED;
2641
2642                 hci_debugfs_create_conn(conn);
2643                 hci_conn_add_sysfs(conn);
2644
2645                 if (test_bit(HCI_AUTH, &hdev->flags))
2646                         set_bit(HCI_CONN_AUTH, &conn->flags);
2647
2648                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2649                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2650
2651                 /* Get remote features */
2652                 if (conn->type == ACL_LINK) {
2653                         struct hci_cp_read_remote_features cp;
2654                         cp.handle = ev->handle;
2655                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2656                                      sizeof(cp), &cp);
2657
2658                         hci_req_update_scan(hdev);
2659                 }
2660
2661                 /* Set packet type for incoming connection */
2662                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2663                         struct hci_cp_change_conn_ptype cp;
2664                         cp.handle = ev->handle;
2665                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2666                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2667                                      &cp);
2668                 }
2669         } else {
2670                 conn->state = BT_CLOSED;
2671                 if (conn->type == ACL_LINK)
2672                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2673                                             conn->dst_type, ev->status);
2674         }
2675
2676         if (conn->type == ACL_LINK)
2677                 hci_sco_setup(conn, ev->status);
2678
2679         if (ev->status) {
2680                 hci_connect_cfm(conn, ev->status);
2681                 hci_conn_del(conn);
2682         } else if (ev->link_type == SCO_LINK) {
2683                 switch (conn->setting & SCO_AIRMODE_MASK) {
2684                 case SCO_AIRMODE_CVSD:
2685                         if (hdev->notify)
2686                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2687                         break;
2688                 }
2689
2690                 hci_connect_cfm(conn, ev->status);
2691         }
2692
2693 unlock:
2694         hci_dev_unlock(hdev);
2695
2696         hci_conn_check_pending(hdev);
2697 }
2698
2699 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2700 {
2701         struct hci_cp_reject_conn_req cp;
2702
2703         bacpy(&cp.bdaddr, bdaddr);
2704         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2705         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2706 }
2707
2708 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2709 {
2710         struct hci_ev_conn_request *ev = (void *) skb->data;
2711         int mask = hdev->link_mode;
2712         struct inquiry_entry *ie;
2713         struct hci_conn *conn;
2714         __u8 flags = 0;
2715
2716         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2717                ev->link_type);
2718
2719         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2720                                       &flags);
2721
2722         if (!(mask & HCI_LM_ACCEPT)) {
2723                 hci_reject_conn(hdev, &ev->bdaddr);
2724                 return;
2725         }
2726
2727         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2728                                    BDADDR_BREDR)) {
2729                 hci_reject_conn(hdev, &ev->bdaddr);
2730                 return;
2731         }
2732
2733         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2734          * connection. These features are only touched through mgmt so
2735          * only do the checks if HCI_MGMT is set.
2736          */
2737         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2738             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2739             !hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, &ev->bdaddr,
2740                                                BDADDR_BREDR)) {
2741                 hci_reject_conn(hdev, &ev->bdaddr);
2742                 return;
2743         }
2744
2745         /* Connection accepted */
2746
2747         hci_dev_lock(hdev);
2748
2749         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2750         if (ie)
2751                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2752
2753         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2754                         &ev->bdaddr);
2755         if (!conn) {
2756                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2757                                     HCI_ROLE_SLAVE);
2758                 if (!conn) {
2759                         bt_dev_err(hdev, "no memory for new connection");
2760                         hci_dev_unlock(hdev);
2761                         return;
2762                 }
2763         }
2764
2765         memcpy(conn->dev_class, ev->dev_class, 3);
2766
2767         hci_dev_unlock(hdev);
2768
2769         if (ev->link_type == ACL_LINK ||
2770             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2771                 struct hci_cp_accept_conn_req cp;
2772                 conn->state = BT_CONNECT;
2773
2774                 bacpy(&cp.bdaddr, &ev->bdaddr);
2775
2776                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2777                         cp.role = 0x00; /* Become master */
2778                 else
2779                         cp.role = 0x01; /* Remain slave */
2780
2781                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2782         } else if (!(flags & HCI_PROTO_DEFER)) {
2783                 struct hci_cp_accept_sync_conn_req cp;
2784                 conn->state = BT_CONNECT;
2785
2786                 bacpy(&cp.bdaddr, &ev->bdaddr);
2787                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2788
2789                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2790                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2791                 cp.max_latency    = cpu_to_le16(0xffff);
2792                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2793                 cp.retrans_effort = 0xff;
2794
2795                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2796                              &cp);
2797         } else {
2798                 conn->state = BT_CONNECT2;
2799                 hci_connect_cfm(conn, 0);
2800         }
2801 }
2802
2803 static u8 hci_to_mgmt_reason(u8 err)
2804 {
2805         switch (err) {
2806         case HCI_ERROR_CONNECTION_TIMEOUT:
2807                 return MGMT_DEV_DISCONN_TIMEOUT;
2808         case HCI_ERROR_REMOTE_USER_TERM:
2809         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2810         case HCI_ERROR_REMOTE_POWER_OFF:
2811                 return MGMT_DEV_DISCONN_REMOTE;
2812         case HCI_ERROR_LOCAL_HOST_TERM:
2813                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2814         default:
2815                 return MGMT_DEV_DISCONN_UNKNOWN;
2816         }
2817 }
2818
2819 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2820 {
2821         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2822         u8 reason;
2823         struct hci_conn_params *params;
2824         struct hci_conn *conn;
2825         bool mgmt_connected;
2826         u8 type;
2827
2828         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2829
2830         hci_dev_lock(hdev);
2831
2832         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2833         if (!conn)
2834                 goto unlock;
2835
2836         if (ev->status) {
2837                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2838                                        conn->dst_type, ev->status);
2839                 goto unlock;
2840         }
2841
2842         conn->state = BT_CLOSED;
2843
2844         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2845
2846         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2847                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2848         else
2849                 reason = hci_to_mgmt_reason(ev->reason);
2850
2851         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2852                                 reason, mgmt_connected);
2853
2854         if (conn->type == ACL_LINK) {
2855                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2856                         hci_remove_link_key(hdev, &conn->dst);
2857
2858                 hci_req_update_scan(hdev);
2859         }
2860
2861         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2862         if (params) {
2863                 switch (params->auto_connect) {
2864                 case HCI_AUTO_CONN_LINK_LOSS:
2865                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2866                                 break;
2867                         fallthrough;
2868
2869                 case HCI_AUTO_CONN_DIRECT:
2870                 case HCI_AUTO_CONN_ALWAYS:
2871                         list_del_init(&params->action);
2872                         list_add(&params->action, &hdev->pend_le_conns);
2873                         hci_update_background_scan(hdev);
2874                         break;
2875
2876                 default:
2877                         break;
2878                 }
2879         }
2880
2881         type = conn->type;
2882
2883         hci_disconn_cfm(conn, ev->reason);
2884         hci_conn_del(conn);
2885
2886         /* The suspend notifier is waiting for all devices to disconnect so
2887          * clear the bit from pending tasks and inform the wait queue.
2888          */
2889         if (list_empty(&hdev->conn_hash.list) &&
2890             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
2891                 wake_up(&hdev->suspend_wait_q);
2892         }
2893
2894         /* Re-enable advertising if necessary, since it might
2895          * have been disabled by the connection. From the
2896          * HCI_LE_Set_Advertise_Enable command description in
2897          * the core specification (v4.0):
2898          * "The Controller shall continue advertising until the Host
2899          * issues an LE_Set_Advertise_Enable command with
2900          * Advertising_Enable set to 0x00 (Advertising is disabled)
2901          * or until a connection is created or until the Advertising
2902          * is timed out due to Directed Advertising."
2903          */
2904         if (type == LE_LINK)
2905                 hci_req_reenable_advertising(hdev);
2906
2907 unlock:
2908         hci_dev_unlock(hdev);
2909 }
2910
2911 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2912 {
2913         struct hci_ev_auth_complete *ev = (void *) skb->data;
2914         struct hci_conn *conn;
2915
2916         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2917
2918         hci_dev_lock(hdev);
2919
2920         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2921         if (!conn)
2922                 goto unlock;
2923
2924         if (!ev->status) {
2925                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2926
2927                 if (!hci_conn_ssp_enabled(conn) &&
2928                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2929                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2930                 } else {
2931                         set_bit(HCI_CONN_AUTH, &conn->flags);
2932                         conn->sec_level = conn->pending_sec_level;
2933                 }
2934         } else {
2935                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2936                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2937
2938                 mgmt_auth_failed(conn, ev->status);
2939         }
2940
2941         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2942         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2943
2944         if (conn->state == BT_CONFIG) {
2945                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2946                         struct hci_cp_set_conn_encrypt cp;
2947                         cp.handle  = ev->handle;
2948                         cp.encrypt = 0x01;
2949                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2950                                      &cp);
2951                 } else {
2952                         conn->state = BT_CONNECTED;
2953                         hci_connect_cfm(conn, ev->status);
2954                         hci_conn_drop(conn);
2955                 }
2956         } else {
2957                 hci_auth_cfm(conn, ev->status);
2958
2959                 hci_conn_hold(conn);
2960                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2961                 hci_conn_drop(conn);
2962         }
2963
2964         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2965                 if (!ev->status) {
2966                         struct hci_cp_set_conn_encrypt cp;
2967                         cp.handle  = ev->handle;
2968                         cp.encrypt = 0x01;
2969                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2970                                      &cp);
2971                 } else {
2972                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2973                         hci_encrypt_cfm(conn, ev->status);
2974                 }
2975         }
2976
2977 unlock:
2978         hci_dev_unlock(hdev);
2979 }
2980
2981 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2982 {
2983         struct hci_ev_remote_name *ev = (void *) skb->data;
2984         struct hci_conn *conn;
2985
2986         BT_DBG("%s", hdev->name);
2987
2988         hci_conn_check_pending(hdev);
2989
2990         hci_dev_lock(hdev);
2991
2992         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2993
2994         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2995                 goto check_auth;
2996
2997         if (ev->status == 0)
2998                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2999                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3000         else
3001                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3002
3003 check_auth:
3004         if (!conn)
3005                 goto unlock;
3006
3007         if (!hci_outgoing_auth_needed(hdev, conn))
3008                 goto unlock;
3009
3010         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3011                 struct hci_cp_auth_requested cp;
3012
3013                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3014
3015                 cp.handle = __cpu_to_le16(conn->handle);
3016                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3017         }
3018
3019 unlock:
3020         hci_dev_unlock(hdev);
3021 }
3022
3023 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3024                                        u16 opcode, struct sk_buff *skb)
3025 {
3026         const struct hci_rp_read_enc_key_size *rp;
3027         struct hci_conn *conn;
3028         u16 handle;
3029
3030         BT_DBG("%s status 0x%02x", hdev->name, status);
3031
3032         if (!skb || skb->len < sizeof(*rp)) {
3033                 bt_dev_err(hdev, "invalid read key size response");
3034                 return;
3035         }
3036
3037         rp = (void *)skb->data;
3038         handle = le16_to_cpu(rp->handle);
3039
3040         hci_dev_lock(hdev);
3041
3042         conn = hci_conn_hash_lookup_handle(hdev, handle);
3043         if (!conn)
3044                 goto unlock;
3045
3046         /* While unexpected, the read_enc_key_size command may fail. The most
3047          * secure approach is to then assume the key size is 0 to force a
3048          * disconnection.
3049          */
3050         if (rp->status) {
3051                 bt_dev_err(hdev, "failed to read key size for handle %u",
3052                            handle);
3053                 conn->enc_key_size = 0;
3054         } else {
3055                 conn->enc_key_size = rp->key_size;
3056         }
3057
3058         hci_encrypt_cfm(conn, 0);
3059
3060 unlock:
3061         hci_dev_unlock(hdev);
3062 }
3063
3064 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3065 {
3066         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3067         struct hci_conn *conn;
3068
3069         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3070
3071         hci_dev_lock(hdev);
3072
3073         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3074         if (!conn)
3075                 goto unlock;
3076
3077         if (!ev->status) {
3078                 if (ev->encrypt) {
3079                         /* Encryption implies authentication */
3080                         set_bit(HCI_CONN_AUTH, &conn->flags);
3081                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3082                         conn->sec_level = conn->pending_sec_level;
3083
3084                         /* P-256 authentication key implies FIPS */
3085                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3086                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3087
3088                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3089                             conn->type == LE_LINK)
3090                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3091                 } else {
3092                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3093                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3094                 }
3095         }
3096
3097         /* We should disregard the current RPA and generate a new one
3098          * whenever the encryption procedure fails.
3099          */
3100         if (ev->status && conn->type == LE_LINK) {
3101                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3102                 hci_adv_instances_set_rpa_expired(hdev, true);
3103         }
3104
3105         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3106
3107         /* Check link security requirements are met */
3108         if (!hci_conn_check_link_mode(conn))
3109                 ev->status = HCI_ERROR_AUTH_FAILURE;
3110
3111         if (ev->status && conn->state == BT_CONNECTED) {
3112                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3113                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3114
3115                 /* Notify upper layers so they can cleanup before
3116                  * disconnecting.
3117                  */
3118                 hci_encrypt_cfm(conn, ev->status);
3119                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3120                 hci_conn_drop(conn);
3121                 goto unlock;
3122         }
3123
3124         /* Try reading the encryption key size for encrypted ACL links */
3125         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3126                 struct hci_cp_read_enc_key_size cp;
3127                 struct hci_request req;
3128
3129                 /* Only send HCI_Read_Encryption_Key_Size if the
3130                  * controller really supports it. If it doesn't, assume
3131                  * the default size (16).
3132                  */
3133                 if (!(hdev->commands[20] & 0x10)) {
3134                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3135                         goto notify;
3136                 }
3137
3138                 hci_req_init(&req, hdev);
3139
3140                 cp.handle = cpu_to_le16(conn->handle);
3141                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3142
3143                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3144                         bt_dev_err(hdev, "sending read key size failed");
3145                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3146                         goto notify;
3147                 }
3148
3149                 goto unlock;
3150         }
3151
3152         /* Set the default Authenticated Payload Timeout after
3153          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3154          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3155          * sent when the link is active and Encryption is enabled, the conn
3156          * type can be either LE or ACL and controller must support LMP Ping.
3157          * Ensure for AES-CCM encryption as well.
3158          */
3159         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3160             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3161             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3162              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3163                 struct hci_cp_write_auth_payload_to cp;
3164
3165                 cp.handle = cpu_to_le16(conn->handle);
3166                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3167                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3168                              sizeof(cp), &cp);
3169         }
3170
3171 notify:
3172         hci_encrypt_cfm(conn, ev->status);
3173
3174 unlock:
3175         hci_dev_unlock(hdev);
3176 }
3177
3178 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3179                                              struct sk_buff *skb)
3180 {
3181         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3182         struct hci_conn *conn;
3183
3184         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3185
3186         hci_dev_lock(hdev);
3187
3188         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3189         if (conn) {
3190                 if (!ev->status)
3191                         set_bit(HCI_CONN_SECURE, &conn->flags);
3192
3193                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3194
3195                 hci_key_change_cfm(conn, ev->status);
3196         }
3197
3198         hci_dev_unlock(hdev);
3199 }
3200
3201 static void hci_remote_features_evt(struct hci_dev *hdev,
3202                                     struct sk_buff *skb)
3203 {
3204         struct hci_ev_remote_features *ev = (void *) skb->data;
3205         struct hci_conn *conn;
3206
3207         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3208
3209         hci_dev_lock(hdev);
3210
3211         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3212         if (!conn)
3213                 goto unlock;
3214
3215         if (!ev->status)
3216                 memcpy(conn->features[0], ev->features, 8);
3217
3218         if (conn->state != BT_CONFIG)
3219                 goto unlock;
3220
3221         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3222             lmp_ext_feat_capable(conn)) {
3223                 struct hci_cp_read_remote_ext_features cp;
3224                 cp.handle = ev->handle;
3225                 cp.page = 0x01;
3226                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3227                              sizeof(cp), &cp);
3228                 goto unlock;
3229         }
3230
3231         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3232                 struct hci_cp_remote_name_req cp;
3233                 memset(&cp, 0, sizeof(cp));
3234                 bacpy(&cp.bdaddr, &conn->dst);
3235                 cp.pscan_rep_mode = 0x02;
3236                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3237         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3238                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3239
3240         if (!hci_outgoing_auth_needed(hdev, conn)) {
3241                 conn->state = BT_CONNECTED;
3242                 hci_connect_cfm(conn, ev->status);
3243                 hci_conn_drop(conn);
3244         }
3245
3246 unlock:
3247         hci_dev_unlock(hdev);
3248 }
3249
3250 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3251                                  u16 *opcode, u8 *status,
3252                                  hci_req_complete_t *req_complete,
3253                                  hci_req_complete_skb_t *req_complete_skb)
3254 {
3255         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3256
3257         *opcode = __le16_to_cpu(ev->opcode);
3258         *status = skb->data[sizeof(*ev)];
3259
3260         skb_pull(skb, sizeof(*ev));
3261
3262         switch (*opcode) {
3263         case HCI_OP_INQUIRY_CANCEL:
3264                 hci_cc_inquiry_cancel(hdev, skb, status);
3265                 break;
3266
3267         case HCI_OP_PERIODIC_INQ:
3268                 hci_cc_periodic_inq(hdev, skb);
3269                 break;
3270
3271         case HCI_OP_EXIT_PERIODIC_INQ:
3272                 hci_cc_exit_periodic_inq(hdev, skb);
3273                 break;
3274
3275         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3276                 hci_cc_remote_name_req_cancel(hdev, skb);
3277                 break;
3278
3279         case HCI_OP_ROLE_DISCOVERY:
3280                 hci_cc_role_discovery(hdev, skb);
3281                 break;
3282
3283         case HCI_OP_READ_LINK_POLICY:
3284                 hci_cc_read_link_policy(hdev, skb);
3285                 break;
3286
3287         case HCI_OP_WRITE_LINK_POLICY:
3288                 hci_cc_write_link_policy(hdev, skb);
3289                 break;
3290
3291         case HCI_OP_READ_DEF_LINK_POLICY:
3292                 hci_cc_read_def_link_policy(hdev, skb);
3293                 break;
3294
3295         case HCI_OP_WRITE_DEF_LINK_POLICY:
3296                 hci_cc_write_def_link_policy(hdev, skb);
3297                 break;
3298
3299         case HCI_OP_RESET:
3300                 hci_cc_reset(hdev, skb);
3301                 break;
3302
3303         case HCI_OP_READ_STORED_LINK_KEY:
3304                 hci_cc_read_stored_link_key(hdev, skb);
3305                 break;
3306
3307         case HCI_OP_DELETE_STORED_LINK_KEY:
3308                 hci_cc_delete_stored_link_key(hdev, skb);
3309                 break;
3310
3311         case HCI_OP_WRITE_LOCAL_NAME:
3312                 hci_cc_write_local_name(hdev, skb);
3313                 break;
3314
3315         case HCI_OP_READ_LOCAL_NAME:
3316                 hci_cc_read_local_name(hdev, skb);
3317                 break;
3318
3319         case HCI_OP_WRITE_AUTH_ENABLE:
3320                 hci_cc_write_auth_enable(hdev, skb);
3321                 break;
3322
3323         case HCI_OP_WRITE_ENCRYPT_MODE:
3324                 hci_cc_write_encrypt_mode(hdev, skb);
3325                 break;
3326
3327         case HCI_OP_WRITE_SCAN_ENABLE:
3328                 hci_cc_write_scan_enable(hdev, skb);
3329                 break;
3330
3331         case HCI_OP_READ_CLASS_OF_DEV:
3332                 hci_cc_read_class_of_dev(hdev, skb);
3333                 break;
3334
3335         case HCI_OP_WRITE_CLASS_OF_DEV:
3336                 hci_cc_write_class_of_dev(hdev, skb);
3337                 break;
3338
3339         case HCI_OP_READ_VOICE_SETTING:
3340                 hci_cc_read_voice_setting(hdev, skb);
3341                 break;
3342
3343         case HCI_OP_WRITE_VOICE_SETTING:
3344                 hci_cc_write_voice_setting(hdev, skb);
3345                 break;
3346
3347         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3348                 hci_cc_read_num_supported_iac(hdev, skb);
3349                 break;
3350
3351         case HCI_OP_WRITE_SSP_MODE:
3352                 hci_cc_write_ssp_mode(hdev, skb);
3353                 break;
3354
3355         case HCI_OP_WRITE_SC_SUPPORT:
3356                 hci_cc_write_sc_support(hdev, skb);
3357                 break;
3358
3359         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3360                 hci_cc_read_auth_payload_timeout(hdev, skb);
3361                 break;
3362
3363         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3364                 hci_cc_write_auth_payload_timeout(hdev, skb);
3365                 break;
3366
3367         case HCI_OP_READ_LOCAL_VERSION:
3368                 hci_cc_read_local_version(hdev, skb);
3369                 break;
3370
3371         case HCI_OP_READ_LOCAL_COMMANDS:
3372                 hci_cc_read_local_commands(hdev, skb);
3373                 break;
3374
3375         case HCI_OP_READ_LOCAL_FEATURES:
3376                 hci_cc_read_local_features(hdev, skb);
3377                 break;
3378
3379         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3380                 hci_cc_read_local_ext_features(hdev, skb);
3381                 break;
3382
3383         case HCI_OP_READ_BUFFER_SIZE:
3384                 hci_cc_read_buffer_size(hdev, skb);
3385                 break;
3386
3387         case HCI_OP_READ_BD_ADDR:
3388                 hci_cc_read_bd_addr(hdev, skb);
3389                 break;
3390
3391         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3392                 hci_cc_read_local_pairing_opts(hdev, skb);
3393                 break;
3394
3395         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3396                 hci_cc_read_page_scan_activity(hdev, skb);
3397                 break;
3398
3399         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3400                 hci_cc_write_page_scan_activity(hdev, skb);
3401                 break;
3402
3403         case HCI_OP_READ_PAGE_SCAN_TYPE:
3404                 hci_cc_read_page_scan_type(hdev, skb);
3405                 break;
3406
3407         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3408                 hci_cc_write_page_scan_type(hdev, skb);
3409                 break;
3410
3411         case HCI_OP_READ_DATA_BLOCK_SIZE:
3412                 hci_cc_read_data_block_size(hdev, skb);
3413                 break;
3414
3415         case HCI_OP_READ_FLOW_CONTROL_MODE:
3416                 hci_cc_read_flow_control_mode(hdev, skb);
3417                 break;
3418
3419         case HCI_OP_READ_LOCAL_AMP_INFO:
3420                 hci_cc_read_local_amp_info(hdev, skb);
3421                 break;
3422
3423         case HCI_OP_READ_CLOCK:
3424                 hci_cc_read_clock(hdev, skb);
3425                 break;
3426
3427         case HCI_OP_READ_INQ_RSP_TX_POWER:
3428                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3429                 break;
3430
3431         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3432                 hci_cc_read_def_err_data_reporting(hdev, skb);
3433                 break;
3434
3435         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3436                 hci_cc_write_def_err_data_reporting(hdev, skb);
3437                 break;
3438
3439         case HCI_OP_PIN_CODE_REPLY:
3440                 hci_cc_pin_code_reply(hdev, skb);
3441                 break;
3442
3443         case HCI_OP_PIN_CODE_NEG_REPLY:
3444                 hci_cc_pin_code_neg_reply(hdev, skb);
3445                 break;
3446
3447         case HCI_OP_READ_LOCAL_OOB_DATA:
3448                 hci_cc_read_local_oob_data(hdev, skb);
3449                 break;
3450
3451         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3452                 hci_cc_read_local_oob_ext_data(hdev, skb);
3453                 break;
3454
3455         case HCI_OP_LE_READ_BUFFER_SIZE:
3456                 hci_cc_le_read_buffer_size(hdev, skb);
3457                 break;
3458
3459         case HCI_OP_LE_READ_LOCAL_FEATURES:
3460                 hci_cc_le_read_local_features(hdev, skb);
3461                 break;
3462
3463         case HCI_OP_LE_READ_ADV_TX_POWER:
3464                 hci_cc_le_read_adv_tx_power(hdev, skb);
3465                 break;
3466
3467         case HCI_OP_USER_CONFIRM_REPLY:
3468                 hci_cc_user_confirm_reply(hdev, skb);
3469                 break;
3470
3471         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3472                 hci_cc_user_confirm_neg_reply(hdev, skb);
3473                 break;
3474
3475         case HCI_OP_USER_PASSKEY_REPLY:
3476                 hci_cc_user_passkey_reply(hdev, skb);
3477                 break;
3478
3479         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3480                 hci_cc_user_passkey_neg_reply(hdev, skb);
3481                 break;
3482
3483         case HCI_OP_LE_SET_RANDOM_ADDR:
3484                 hci_cc_le_set_random_addr(hdev, skb);
3485                 break;
3486
3487         case HCI_OP_LE_SET_ADV_ENABLE:
3488                 hci_cc_le_set_adv_enable(hdev, skb);
3489                 break;
3490
3491         case HCI_OP_LE_SET_SCAN_PARAM:
3492                 hci_cc_le_set_scan_param(hdev, skb);
3493                 break;
3494
3495         case HCI_OP_LE_SET_SCAN_ENABLE:
3496                 hci_cc_le_set_scan_enable(hdev, skb);
3497                 break;
3498
3499         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3500                 hci_cc_le_read_white_list_size(hdev, skb);
3501                 break;
3502
3503         case HCI_OP_LE_CLEAR_WHITE_LIST:
3504                 hci_cc_le_clear_white_list(hdev, skb);
3505                 break;
3506
3507         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3508                 hci_cc_le_add_to_white_list(hdev, skb);
3509                 break;
3510
3511         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3512                 hci_cc_le_del_from_white_list(hdev, skb);
3513                 break;
3514
3515         case HCI_OP_LE_READ_SUPPORTED_STATES:
3516                 hci_cc_le_read_supported_states(hdev, skb);
3517                 break;
3518
3519         case HCI_OP_LE_READ_DEF_DATA_LEN:
3520                 hci_cc_le_read_def_data_len(hdev, skb);
3521                 break;
3522
3523         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3524                 hci_cc_le_write_def_data_len(hdev, skb);
3525                 break;
3526
3527         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3528                 hci_cc_le_add_to_resolv_list(hdev, skb);
3529                 break;
3530
3531         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3532                 hci_cc_le_del_from_resolv_list(hdev, skb);
3533                 break;
3534
3535         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3536                 hci_cc_le_clear_resolv_list(hdev, skb);
3537                 break;
3538
3539         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3540                 hci_cc_le_read_resolv_list_size(hdev, skb);
3541                 break;
3542
3543         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3544                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3545                 break;
3546
3547         case HCI_OP_LE_READ_MAX_DATA_LEN:
3548                 hci_cc_le_read_max_data_len(hdev, skb);
3549                 break;
3550
3551         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3552                 hci_cc_write_le_host_supported(hdev, skb);
3553                 break;
3554
3555         case HCI_OP_LE_SET_ADV_PARAM:
3556                 hci_cc_set_adv_param(hdev, skb);
3557                 break;
3558
3559         case HCI_OP_READ_RSSI:
3560                 hci_cc_read_rssi(hdev, skb);
3561                 break;
3562
3563         case HCI_OP_READ_TX_POWER:
3564                 hci_cc_read_tx_power(hdev, skb);
3565                 break;
3566
3567         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3568                 hci_cc_write_ssp_debug_mode(hdev, skb);
3569                 break;
3570
3571         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3572                 hci_cc_le_set_ext_scan_param(hdev, skb);
3573                 break;
3574
3575         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3576                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3577                 break;
3578
3579         case HCI_OP_LE_SET_DEFAULT_PHY:
3580                 hci_cc_le_set_default_phy(hdev, skb);
3581                 break;
3582
3583         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3584                 hci_cc_le_read_num_adv_sets(hdev, skb);
3585                 break;
3586
3587         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3588                 hci_cc_set_ext_adv_param(hdev, skb);
3589                 break;
3590
3591         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3592                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3593                 break;
3594
3595         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3596                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3597                 break;
3598
3599         case HCI_OP_LE_READ_TRANSMIT_POWER:
3600                 hci_cc_le_read_transmit_power(hdev, skb);
3601                 break;
3602
3603         default:
3604                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3605                 break;
3606         }
3607
3608         if (*opcode != HCI_OP_NOP)
3609                 cancel_delayed_work(&hdev->cmd_timer);
3610
3611         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3612                 atomic_set(&hdev->cmd_cnt, 1);
3613
3614         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3615                              req_complete_skb);
3616
3617         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3618                 bt_dev_err(hdev,
3619                            "unexpected event for opcode 0x%4.4x", *opcode);
3620                 return;
3621         }
3622
3623         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3624                 queue_work(hdev->workqueue, &hdev->cmd_work);
3625 }
3626
3627 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3628                                u16 *opcode, u8 *status,
3629                                hci_req_complete_t *req_complete,
3630                                hci_req_complete_skb_t *req_complete_skb)
3631 {
3632         struct hci_ev_cmd_status *ev = (void *) skb->data;
3633
3634         skb_pull(skb, sizeof(*ev));
3635
3636         *opcode = __le16_to_cpu(ev->opcode);
3637         *status = ev->status;
3638
3639         switch (*opcode) {
3640         case HCI_OP_INQUIRY:
3641                 hci_cs_inquiry(hdev, ev->status);
3642                 break;
3643
3644         case HCI_OP_CREATE_CONN:
3645                 hci_cs_create_conn(hdev, ev->status);
3646                 break;
3647
3648         case HCI_OP_DISCONNECT:
3649                 hci_cs_disconnect(hdev, ev->status);
3650                 break;
3651
3652         case HCI_OP_ADD_SCO:
3653                 hci_cs_add_sco(hdev, ev->status);
3654                 break;
3655
3656         case HCI_OP_AUTH_REQUESTED:
3657                 hci_cs_auth_requested(hdev, ev->status);
3658                 break;
3659
3660         case HCI_OP_SET_CONN_ENCRYPT:
3661                 hci_cs_set_conn_encrypt(hdev, ev->status);
3662                 break;
3663
3664         case HCI_OP_REMOTE_NAME_REQ:
3665                 hci_cs_remote_name_req(hdev, ev->status);
3666                 break;
3667
3668         case HCI_OP_READ_REMOTE_FEATURES:
3669                 hci_cs_read_remote_features(hdev, ev->status);
3670                 break;
3671
3672         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3673                 hci_cs_read_remote_ext_features(hdev, ev->status);
3674                 break;
3675
3676         case HCI_OP_SETUP_SYNC_CONN:
3677                 hci_cs_setup_sync_conn(hdev, ev->status);
3678                 break;
3679
3680         case HCI_OP_SNIFF_MODE:
3681                 hci_cs_sniff_mode(hdev, ev->status);
3682                 break;
3683
3684         case HCI_OP_EXIT_SNIFF_MODE:
3685                 hci_cs_exit_sniff_mode(hdev, ev->status);
3686                 break;
3687
3688         case HCI_OP_SWITCH_ROLE:
3689                 hci_cs_switch_role(hdev, ev->status);
3690                 break;
3691
3692         case HCI_OP_LE_CREATE_CONN:
3693                 hci_cs_le_create_conn(hdev, ev->status);
3694                 break;
3695
3696         case HCI_OP_LE_READ_REMOTE_FEATURES:
3697                 hci_cs_le_read_remote_features(hdev, ev->status);
3698                 break;
3699
3700         case HCI_OP_LE_START_ENC:
3701                 hci_cs_le_start_enc(hdev, ev->status);
3702                 break;
3703
3704         case HCI_OP_LE_EXT_CREATE_CONN:
3705                 hci_cs_le_ext_create_conn(hdev, ev->status);
3706                 break;
3707
3708         default:
3709                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3710                 break;
3711         }
3712
3713         if (*opcode != HCI_OP_NOP)
3714                 cancel_delayed_work(&hdev->cmd_timer);
3715
3716         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3717                 atomic_set(&hdev->cmd_cnt, 1);
3718
3719         /* Indicate request completion if the command failed. Also, if
3720          * we're not waiting for a special event and we get a success
3721          * command status we should try to flag the request as completed
3722          * (since for this kind of commands there will not be a command
3723          * complete event).
3724          */
3725         if (ev->status ||
3726             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3727                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3728                                      req_complete_skb);
3729
3730         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3731                 bt_dev_err(hdev,
3732                            "unexpected event for opcode 0x%4.4x", *opcode);
3733                 return;
3734         }
3735
3736         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3737                 queue_work(hdev->workqueue, &hdev->cmd_work);
3738 }
3739
3740 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3741 {
3742         struct hci_ev_hardware_error *ev = (void *) skb->data;
3743
3744         hdev->hw_error_code = ev->code;
3745
3746         queue_work(hdev->req_workqueue, &hdev->error_reset);
3747 }
3748
3749 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3750 {
3751         struct hci_ev_role_change *ev = (void *) skb->data;
3752         struct hci_conn *conn;
3753
3754         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3755
3756         hci_dev_lock(hdev);
3757
3758         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3759         if (conn) {
3760                 if (!ev->status)
3761                         conn->role = ev->role;
3762
3763                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3764
3765                 hci_role_switch_cfm(conn, ev->status, ev->role);
3766         }
3767
3768         hci_dev_unlock(hdev);
3769 }
3770
3771 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3772 {
3773         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3774         int i;
3775
3776         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3777                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3778                 return;
3779         }
3780
3781         if (skb->len < sizeof(*ev) ||
3782             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3783                 BT_DBG("%s bad parameters", hdev->name);
3784                 return;
3785         }
3786
3787         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3788
3789         for (i = 0; i < ev->num_hndl; i++) {
3790                 struct hci_comp_pkts_info *info = &ev->handles[i];
3791                 struct hci_conn *conn;
3792                 __u16  handle, count;
3793
3794                 handle = __le16_to_cpu(info->handle);
3795                 count  = __le16_to_cpu(info->count);
3796
3797                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3798                 if (!conn)
3799                         continue;
3800
3801                 conn->sent -= count;
3802
3803                 switch (conn->type) {
3804                 case ACL_LINK:
3805                         hdev->acl_cnt += count;
3806                         if (hdev->acl_cnt > hdev->acl_pkts)
3807                                 hdev->acl_cnt = hdev->acl_pkts;
3808                         break;
3809
3810                 case LE_LINK:
3811                         if (hdev->le_pkts) {
3812                                 hdev->le_cnt += count;
3813                                 if (hdev->le_cnt > hdev->le_pkts)
3814                                         hdev->le_cnt = hdev->le_pkts;
3815                         } else {
3816                                 hdev->acl_cnt += count;
3817                                 if (hdev->acl_cnt > hdev->acl_pkts)
3818                                         hdev->acl_cnt = hdev->acl_pkts;
3819                         }
3820                         break;
3821
3822                 case SCO_LINK:
3823                         hdev->sco_cnt += count;
3824                         if (hdev->sco_cnt > hdev->sco_pkts)
3825                                 hdev->sco_cnt = hdev->sco_pkts;
3826                         break;
3827
3828                 default:
3829                         bt_dev_err(hdev, "unknown type %d conn %p",
3830                                    conn->type, conn);
3831                         break;
3832                 }
3833         }
3834
3835         queue_work(hdev->workqueue, &hdev->tx_work);
3836 }
3837
3838 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3839                                                  __u16 handle)
3840 {
3841         struct hci_chan *chan;
3842
3843         switch (hdev->dev_type) {
3844         case HCI_PRIMARY:
3845                 return hci_conn_hash_lookup_handle(hdev, handle);
3846         case HCI_AMP:
3847                 chan = hci_chan_lookup_handle(hdev, handle);
3848                 if (chan)
3849                         return chan->conn;
3850                 break;
3851         default:
3852                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3853                 break;
3854         }
3855
3856         return NULL;
3857 }
3858
3859 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3860 {
3861         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3862         int i;
3863
3864         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3865                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3866                 return;
3867         }
3868
3869         if (skb->len < sizeof(*ev) ||
3870             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3871                 BT_DBG("%s bad parameters", hdev->name);
3872                 return;
3873         }
3874
3875         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3876                ev->num_hndl);
3877
3878         for (i = 0; i < ev->num_hndl; i++) {
3879                 struct hci_comp_blocks_info *info = &ev->handles[i];
3880                 struct hci_conn *conn = NULL;
3881                 __u16  handle, block_count;
3882
3883                 handle = __le16_to_cpu(info->handle);
3884                 block_count = __le16_to_cpu(info->blocks);
3885
3886                 conn = __hci_conn_lookup_handle(hdev, handle);
3887                 if (!conn)
3888                         continue;
3889
3890                 conn->sent -= block_count;
3891
3892                 switch (conn->type) {
3893                 case ACL_LINK:
3894                 case AMP_LINK:
3895                         hdev->block_cnt += block_count;
3896                         if (hdev->block_cnt > hdev->num_blocks)
3897                                 hdev->block_cnt = hdev->num_blocks;
3898                         break;
3899
3900                 default:
3901                         bt_dev_err(hdev, "unknown type %d conn %p",
3902                                    conn->type, conn);
3903                         break;
3904                 }
3905         }
3906
3907         queue_work(hdev->workqueue, &hdev->tx_work);
3908 }
3909
3910 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3911 {
3912         struct hci_ev_mode_change *ev = (void *) skb->data;
3913         struct hci_conn *conn;
3914
3915         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3916
3917         hci_dev_lock(hdev);
3918
3919         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3920         if (conn) {
3921                 conn->mode = ev->mode;
3922
3923                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3924                                         &conn->flags)) {
3925                         if (conn->mode == HCI_CM_ACTIVE)
3926                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3927                         else
3928                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3929                 }
3930
3931                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3932                         hci_sco_setup(conn, ev->status);
3933         }
3934
3935         hci_dev_unlock(hdev);
3936 }
3937
3938 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3939 {
3940         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3941         struct hci_conn *conn;
3942
3943         BT_DBG("%s", hdev->name);
3944
3945         hci_dev_lock(hdev);
3946
3947         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3948         if (!conn)
3949                 goto unlock;
3950
3951         if (conn->state == BT_CONNECTED) {
3952                 hci_conn_hold(conn);
3953                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3954                 hci_conn_drop(conn);
3955         }
3956
3957         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3958             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3959                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3960                              sizeof(ev->bdaddr), &ev->bdaddr);
3961         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3962                 u8 secure;
3963
3964                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3965                         secure = 1;
3966                 else
3967                         secure = 0;
3968
3969                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3970         }
3971
3972 unlock:
3973         hci_dev_unlock(hdev);
3974 }
3975
3976 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3977 {
3978         if (key_type == HCI_LK_CHANGED_COMBINATION)
3979                 return;
3980
3981         conn->pin_length = pin_len;
3982         conn->key_type = key_type;
3983
3984         switch (key_type) {
3985         case HCI_LK_LOCAL_UNIT:
3986         case HCI_LK_REMOTE_UNIT:
3987         case HCI_LK_DEBUG_COMBINATION:
3988                 return;
3989         case HCI_LK_COMBINATION:
3990                 if (pin_len == 16)
3991                         conn->pending_sec_level = BT_SECURITY_HIGH;
3992                 else
3993                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3994                 break;
3995         case HCI_LK_UNAUTH_COMBINATION_P192:
3996         case HCI_LK_UNAUTH_COMBINATION_P256:
3997                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3998                 break;
3999         case HCI_LK_AUTH_COMBINATION_P192:
4000                 conn->pending_sec_level = BT_SECURITY_HIGH;
4001                 break;
4002         case HCI_LK_AUTH_COMBINATION_P256:
4003                 conn->pending_sec_level = BT_SECURITY_FIPS;
4004                 break;
4005         }
4006 }
4007
4008 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4009 {
4010         struct hci_ev_link_key_req *ev = (void *) skb->data;
4011         struct hci_cp_link_key_reply cp;
4012         struct hci_conn *conn;
4013         struct link_key *key;
4014
4015         BT_DBG("%s", hdev->name);
4016
4017         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4018                 return;
4019
4020         hci_dev_lock(hdev);
4021
4022         key = hci_find_link_key(hdev, &ev->bdaddr);
4023         if (!key) {
4024                 BT_DBG("%s link key not found for %pMR", hdev->name,
4025                        &ev->bdaddr);
4026                 goto not_found;
4027         }
4028
4029         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4030                &ev->bdaddr);
4031
4032         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4033         if (conn) {
4034                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4035
4036                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4037                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4038                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4039                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4040                         goto not_found;
4041                 }
4042
4043                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4044                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4045                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4046                         BT_DBG("%s ignoring key unauthenticated for high security",
4047                                hdev->name);
4048                         goto not_found;
4049                 }
4050
4051                 conn_set_key(conn, key->type, key->pin_len);
4052         }
4053
4054         bacpy(&cp.bdaddr, &ev->bdaddr);
4055         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4056
4057         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4058
4059         hci_dev_unlock(hdev);
4060
4061         return;
4062
4063 not_found:
4064         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4065         hci_dev_unlock(hdev);
4066 }
4067
4068 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4069 {
4070         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4071         struct hci_conn *conn;
4072         struct link_key *key;
4073         bool persistent;
4074         u8 pin_len = 0;
4075
4076         BT_DBG("%s", hdev->name);
4077
4078         hci_dev_lock(hdev);
4079
4080         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4081         if (!conn)
4082                 goto unlock;
4083
4084         hci_conn_hold(conn);
4085         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4086         hci_conn_drop(conn);
4087
4088         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4089         conn_set_key(conn, ev->key_type, conn->pin_length);
4090
4091         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4092                 goto unlock;
4093
4094         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4095                                 ev->key_type, pin_len, &persistent);
4096         if (!key)
4097                 goto unlock;
4098
4099         /* Update connection information since adding the key will have
4100          * fixed up the type in the case of changed combination keys.
4101          */
4102         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4103                 conn_set_key(conn, key->type, key->pin_len);
4104
4105         mgmt_new_link_key(hdev, key, persistent);
4106
4107         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4108          * is set. If it's not set simply remove the key from the kernel
4109          * list (we've still notified user space about it but with
4110          * store_hint being 0).
4111          */
4112         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4113             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4114                 list_del_rcu(&key->list);
4115                 kfree_rcu(key, rcu);
4116                 goto unlock;
4117         }
4118
4119         if (persistent)
4120                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4121         else
4122                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4123
4124 unlock:
4125         hci_dev_unlock(hdev);
4126 }
4127
4128 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4129 {
4130         struct hci_ev_clock_offset *ev = (void *) skb->data;
4131         struct hci_conn *conn;
4132
4133         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4134
4135         hci_dev_lock(hdev);
4136
4137         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4138         if (conn && !ev->status) {
4139                 struct inquiry_entry *ie;
4140
4141                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4142                 if (ie) {
4143                         ie->data.clock_offset = ev->clock_offset;
4144                         ie->timestamp = jiffies;
4145                 }
4146         }
4147
4148         hci_dev_unlock(hdev);
4149 }
4150
4151 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4152 {
4153         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4154         struct hci_conn *conn;
4155
4156         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4157
4158         hci_dev_lock(hdev);
4159
4160         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4161         if (conn && !ev->status)
4162                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4163
4164         hci_dev_unlock(hdev);
4165 }
4166
4167 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4168 {
4169         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4170         struct inquiry_entry *ie;
4171
4172         BT_DBG("%s", hdev->name);
4173
4174         hci_dev_lock(hdev);
4175
4176         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4177         if (ie) {
4178                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4179                 ie->timestamp = jiffies;
4180         }
4181
4182         hci_dev_unlock(hdev);
4183 }
4184
4185 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4186                                              struct sk_buff *skb)
4187 {
4188         struct inquiry_data data;
4189         int num_rsp = *((__u8 *) skb->data);
4190
4191         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4192
4193         if (!num_rsp)
4194                 return;
4195
4196         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4197                 return;
4198
4199         hci_dev_lock(hdev);
4200
4201         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4202                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4203                 info = (void *) (skb->data + 1);
4204
4205                 if (skb->len < num_rsp * sizeof(*info) + 1)
4206                         goto unlock;
4207
4208                 for (; num_rsp; num_rsp--, info++) {
4209                         u32 flags;
4210
4211                         bacpy(&data.bdaddr, &info->bdaddr);
4212                         data.pscan_rep_mode     = info->pscan_rep_mode;
4213                         data.pscan_period_mode  = info->pscan_period_mode;
4214                         data.pscan_mode         = info->pscan_mode;
4215                         memcpy(data.dev_class, info->dev_class, 3);
4216                         data.clock_offset       = info->clock_offset;
4217                         data.rssi               = info->rssi;
4218                         data.ssp_mode           = 0x00;
4219
4220                         flags = hci_inquiry_cache_update(hdev, &data, false);
4221
4222                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4223                                           info->dev_class, info->rssi,
4224                                           flags, NULL, 0, NULL, 0);
4225                 }
4226         } else {
4227                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4228
4229                 if (skb->len < num_rsp * sizeof(*info) + 1)
4230                         goto unlock;
4231
4232                 for (; num_rsp; num_rsp--, info++) {
4233                         u32 flags;
4234
4235                         bacpy(&data.bdaddr, &info->bdaddr);
4236                         data.pscan_rep_mode     = info->pscan_rep_mode;
4237                         data.pscan_period_mode  = info->pscan_period_mode;
4238                         data.pscan_mode         = 0x00;
4239                         memcpy(data.dev_class, info->dev_class, 3);
4240                         data.clock_offset       = info->clock_offset;
4241                         data.rssi               = info->rssi;
4242                         data.ssp_mode           = 0x00;
4243
4244                         flags = hci_inquiry_cache_update(hdev, &data, false);
4245
4246                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4247                                           info->dev_class, info->rssi,
4248                                           flags, NULL, 0, NULL, 0);
4249                 }
4250         }
4251
4252 unlock:
4253         hci_dev_unlock(hdev);
4254 }
4255
4256 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4257                                         struct sk_buff *skb)
4258 {
4259         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4260         struct hci_conn *conn;
4261
4262         BT_DBG("%s", hdev->name);
4263
4264         hci_dev_lock(hdev);
4265
4266         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4267         if (!conn)
4268                 goto unlock;
4269
4270         if (ev->page < HCI_MAX_PAGES)
4271                 memcpy(conn->features[ev->page], ev->features, 8);
4272
4273         if (!ev->status && ev->page == 0x01) {
4274                 struct inquiry_entry *ie;
4275
4276                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4277                 if (ie)
4278                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4279
4280                 if (ev->features[0] & LMP_HOST_SSP) {
4281                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4282                 } else {
4283                         /* It is mandatory by the Bluetooth specification that
4284                          * Extended Inquiry Results are only used when Secure
4285                          * Simple Pairing is enabled, but some devices violate
4286                          * this.
4287                          *
4288                          * To make these devices work, the internal SSP
4289                          * enabled flag needs to be cleared if the remote host
4290                          * features do not indicate SSP support */
4291                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4292                 }
4293
4294                 if (ev->features[0] & LMP_HOST_SC)
4295                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4296         }
4297
4298         if (conn->state != BT_CONFIG)
4299                 goto unlock;
4300
4301         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4302                 struct hci_cp_remote_name_req cp;
4303                 memset(&cp, 0, sizeof(cp));
4304                 bacpy(&cp.bdaddr, &conn->dst);
4305                 cp.pscan_rep_mode = 0x02;
4306                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4307         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4308                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4309
4310         if (!hci_outgoing_auth_needed(hdev, conn)) {
4311                 conn->state = BT_CONNECTED;
4312                 hci_connect_cfm(conn, ev->status);
4313                 hci_conn_drop(conn);
4314         }
4315
4316 unlock:
4317         hci_dev_unlock(hdev);
4318 }
4319
4320 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4321                                        struct sk_buff *skb)
4322 {
4323         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4324         struct hci_conn *conn;
4325
4326         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4327
4328         hci_dev_lock(hdev);
4329
4330         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4331         if (!conn) {
4332                 if (ev->link_type == ESCO_LINK)
4333                         goto unlock;
4334
4335                 /* When the link type in the event indicates SCO connection
4336                  * and lookup of the connection object fails, then check
4337                  * if an eSCO connection object exists.
4338                  *
4339                  * The core limits the synchronous connections to either
4340                  * SCO or eSCO. The eSCO connection is preferred and tried
4341                  * to be setup first and until successfully established,
4342                  * the link type will be hinted as eSCO.
4343                  */
4344                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4345                 if (!conn)
4346                         goto unlock;
4347         }
4348
4349         switch (ev->status) {
4350         case 0x00:
4351                 conn->handle = __le16_to_cpu(ev->handle);
4352                 conn->state  = BT_CONNECTED;
4353                 conn->type   = ev->link_type;
4354
4355                 hci_debugfs_create_conn(conn);
4356                 hci_conn_add_sysfs(conn);
4357                 break;
4358
4359         case 0x10:      /* Connection Accept Timeout */
4360         case 0x0d:      /* Connection Rejected due to Limited Resources */
4361         case 0x11:      /* Unsupported Feature or Parameter Value */
4362         case 0x1c:      /* SCO interval rejected */
4363         case 0x1a:      /* Unsupported Remote Feature */
4364         case 0x1e:      /* Invalid LMP Parameters */
4365         case 0x1f:      /* Unspecified error */
4366         case 0x20:      /* Unsupported LMP Parameter value */
4367                 if (conn->out) {
4368                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4369                                         (hdev->esco_type & EDR_ESCO_MASK);
4370                         if (hci_setup_sync(conn, conn->link->handle))
4371                                 goto unlock;
4372                 }
4373                 fallthrough;
4374
4375         default:
4376                 conn->state = BT_CLOSED;
4377                 break;
4378         }
4379
4380         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4381
4382         switch (conn->setting & SCO_AIRMODE_MASK) {
4383         case SCO_AIRMODE_CVSD:
4384                 if (hdev->notify)
4385                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4386                 break;
4387         case SCO_AIRMODE_TRANSP:
4388                 if (hdev->notify)
4389                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4390                 break;
4391         }
4392
4393         hci_connect_cfm(conn, ev->status);
4394         if (ev->status)
4395                 hci_conn_del(conn);
4396
4397 unlock:
4398         hci_dev_unlock(hdev);
4399 }
4400
4401 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4402 {
4403         size_t parsed = 0;
4404
4405         while (parsed < eir_len) {
4406                 u8 field_len = eir[0];
4407
4408                 if (field_len == 0)
4409                         return parsed;
4410
4411                 parsed += field_len + 1;
4412                 eir += field_len + 1;
4413         }
4414
4415         return eir_len;
4416 }
4417
4418 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4419                                             struct sk_buff *skb)
4420 {
4421         struct inquiry_data data;
4422         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4423         int num_rsp = *((__u8 *) skb->data);
4424         size_t eir_len;
4425
4426         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4427
4428         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4429                 return;
4430
4431         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4432                 return;
4433
4434         hci_dev_lock(hdev);
4435
4436         for (; num_rsp; num_rsp--, info++) {
4437                 u32 flags;
4438                 bool name_known;
4439
4440                 bacpy(&data.bdaddr, &info->bdaddr);
4441                 data.pscan_rep_mode     = info->pscan_rep_mode;
4442                 data.pscan_period_mode  = info->pscan_period_mode;
4443                 data.pscan_mode         = 0x00;
4444                 memcpy(data.dev_class, info->dev_class, 3);
4445                 data.clock_offset       = info->clock_offset;
4446                 data.rssi               = info->rssi;
4447                 data.ssp_mode           = 0x01;
4448
4449                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4450                         name_known = eir_get_data(info->data,
4451                                                   sizeof(info->data),
4452                                                   EIR_NAME_COMPLETE, NULL);
4453                 else
4454                         name_known = true;
4455
4456                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4457
4458                 eir_len = eir_get_length(info->data, sizeof(info->data));
4459
4460                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4461                                   info->dev_class, info->rssi,
4462                                   flags, info->data, eir_len, NULL, 0);
4463         }
4464
4465         hci_dev_unlock(hdev);
4466 }
4467
4468 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4469                                          struct sk_buff *skb)
4470 {
4471         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4472         struct hci_conn *conn;
4473
4474         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4475                __le16_to_cpu(ev->handle));
4476
4477         hci_dev_lock(hdev);
4478
4479         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4480         if (!conn)
4481                 goto unlock;
4482
4483         /* For BR/EDR the necessary steps are taken through the
4484          * auth_complete event.
4485          */
4486         if (conn->type != LE_LINK)
4487                 goto unlock;
4488
4489         if (!ev->status)
4490                 conn->sec_level = conn->pending_sec_level;
4491
4492         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4493
4494         if (ev->status && conn->state == BT_CONNECTED) {
4495                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4496                 hci_conn_drop(conn);
4497                 goto unlock;
4498         }
4499
4500         if (conn->state == BT_CONFIG) {
4501                 if (!ev->status)
4502                         conn->state = BT_CONNECTED;
4503
4504                 hci_connect_cfm(conn, ev->status);
4505                 hci_conn_drop(conn);
4506         } else {
4507                 hci_auth_cfm(conn, ev->status);
4508
4509                 hci_conn_hold(conn);
4510                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4511                 hci_conn_drop(conn);
4512         }
4513
4514 unlock:
4515         hci_dev_unlock(hdev);
4516 }
4517
4518 static u8 hci_get_auth_req(struct hci_conn *conn)
4519 {
4520         /* If remote requests no-bonding follow that lead */
4521         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4522             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4523                 return conn->remote_auth | (conn->auth_type & 0x01);
4524
4525         /* If both remote and local have enough IO capabilities, require
4526          * MITM protection
4527          */
4528         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4529             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4530                 return conn->remote_auth | 0x01;
4531
4532         /* No MITM protection possible so ignore remote requirement */
4533         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4534 }
4535
4536 static u8 bredr_oob_data_present(struct hci_conn *conn)
4537 {
4538         struct hci_dev *hdev = conn->hdev;
4539         struct oob_data *data;
4540
4541         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4542         if (!data)
4543                 return 0x00;
4544
4545         if (bredr_sc_enabled(hdev)) {
4546                 /* When Secure Connections is enabled, then just
4547                  * return the present value stored with the OOB
4548                  * data. The stored value contains the right present
4549                  * information. However it can only be trusted when
4550                  * not in Secure Connection Only mode.
4551                  */
4552                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4553                         return data->present;
4554
4555                 /* When Secure Connections Only mode is enabled, then
4556                  * the P-256 values are required. If they are not
4557                  * available, then do not declare that OOB data is
4558                  * present.
4559                  */
4560                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4561                     !memcmp(data->hash256, ZERO_KEY, 16))
4562                         return 0x00;
4563
4564                 return 0x02;
4565         }
4566
4567         /* When Secure Connections is not enabled or actually
4568          * not supported by the hardware, then check that if
4569          * P-192 data values are present.
4570          */
4571         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4572             !memcmp(data->hash192, ZERO_KEY, 16))
4573                 return 0x00;
4574
4575         return 0x01;
4576 }
4577
4578 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4579 {
4580         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4581         struct hci_conn *conn;
4582
4583         BT_DBG("%s", hdev->name);
4584
4585         hci_dev_lock(hdev);
4586
4587         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4588         if (!conn)
4589                 goto unlock;
4590
4591         hci_conn_hold(conn);
4592
4593         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4594                 goto unlock;
4595
4596         /* Allow pairing if we're pairable, the initiators of the
4597          * pairing or if the remote is not requesting bonding.
4598          */
4599         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4600             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4601             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4602                 struct hci_cp_io_capability_reply cp;
4603
4604                 bacpy(&cp.bdaddr, &ev->bdaddr);
4605                 /* Change the IO capability from KeyboardDisplay
4606                  * to DisplayYesNo as it is not supported by BT spec. */
4607                 cp.capability = (conn->io_capability == 0x04) ?
4608                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4609
4610                 /* If we are initiators, there is no remote information yet */
4611                 if (conn->remote_auth == 0xff) {
4612                         /* Request MITM protection if our IO caps allow it
4613                          * except for the no-bonding case.
4614                          */
4615                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4616                             conn->auth_type != HCI_AT_NO_BONDING)
4617                                 conn->auth_type |= 0x01;
4618                 } else {
4619                         conn->auth_type = hci_get_auth_req(conn);
4620                 }
4621
4622                 /* If we're not bondable, force one of the non-bondable
4623                  * authentication requirement values.
4624                  */
4625                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4626                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4627
4628                 cp.authentication = conn->auth_type;
4629                 cp.oob_data = bredr_oob_data_present(conn);
4630
4631                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4632                              sizeof(cp), &cp);
4633         } else {
4634                 struct hci_cp_io_capability_neg_reply cp;
4635
4636                 bacpy(&cp.bdaddr, &ev->bdaddr);
4637                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4638
4639                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4640                              sizeof(cp), &cp);
4641         }
4642
4643 unlock:
4644         hci_dev_unlock(hdev);
4645 }
4646
4647 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4648 {
4649         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4650         struct hci_conn *conn;
4651
4652         BT_DBG("%s", hdev->name);
4653
4654         hci_dev_lock(hdev);
4655
4656         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4657         if (!conn)
4658                 goto unlock;
4659
4660         conn->remote_cap = ev->capability;
4661         conn->remote_auth = ev->authentication;
4662
4663 unlock:
4664         hci_dev_unlock(hdev);
4665 }
4666
4667 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4668                                          struct sk_buff *skb)
4669 {
4670         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4671         int loc_mitm, rem_mitm, confirm_hint = 0;
4672         struct hci_conn *conn;
4673
4674         BT_DBG("%s", hdev->name);
4675
4676         hci_dev_lock(hdev);
4677
4678         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4679                 goto unlock;
4680
4681         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4682         if (!conn)
4683                 goto unlock;
4684
4685         loc_mitm = (conn->auth_type & 0x01);
4686         rem_mitm = (conn->remote_auth & 0x01);
4687
4688         /* If we require MITM but the remote device can't provide that
4689          * (it has NoInputNoOutput) then reject the confirmation
4690          * request. We check the security level here since it doesn't
4691          * necessarily match conn->auth_type.
4692          */
4693         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4694             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4695                 BT_DBG("Rejecting request: remote device can't provide MITM");
4696                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4697                              sizeof(ev->bdaddr), &ev->bdaddr);
4698                 goto unlock;
4699         }
4700
4701         /* If no side requires MITM protection; auto-accept */
4702         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4703             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4704
4705                 /* If we're not the initiators request authorization to
4706                  * proceed from user space (mgmt_user_confirm with
4707                  * confirm_hint set to 1). The exception is if neither
4708                  * side had MITM or if the local IO capability is
4709                  * NoInputNoOutput, in which case we do auto-accept
4710                  */
4711                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4712                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4713                     (loc_mitm || rem_mitm)) {
4714                         BT_DBG("Confirming auto-accept as acceptor");
4715                         confirm_hint = 1;
4716                         goto confirm;
4717                 }
4718
4719                 /* If there already exists link key in local host, leave the
4720                  * decision to user space since the remote device could be
4721                  * legitimate or malicious.
4722                  */
4723                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4724                         bt_dev_dbg(hdev, "Local host already has link key");
4725                         confirm_hint = 1;
4726                         goto confirm;
4727                 }
4728
4729                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4730                        hdev->auto_accept_delay);
4731
4732                 if (hdev->auto_accept_delay > 0) {
4733                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4734                         queue_delayed_work(conn->hdev->workqueue,
4735                                            &conn->auto_accept_work, delay);
4736                         goto unlock;
4737                 }
4738
4739                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4740                              sizeof(ev->bdaddr), &ev->bdaddr);
4741                 goto unlock;
4742         }
4743
4744 confirm:
4745         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4746                                   le32_to_cpu(ev->passkey), confirm_hint);
4747
4748 unlock:
4749         hci_dev_unlock(hdev);
4750 }
4751
4752 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4753                                          struct sk_buff *skb)
4754 {
4755         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4756
4757         BT_DBG("%s", hdev->name);
4758
4759         if (hci_dev_test_flag(hdev, HCI_MGMT))
4760                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4761 }
4762
4763 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4764                                         struct sk_buff *skb)
4765 {
4766         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4767         struct hci_conn *conn;
4768
4769         BT_DBG("%s", hdev->name);
4770
4771         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4772         if (!conn)
4773                 return;
4774
4775         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4776         conn->passkey_entered = 0;
4777
4778         if (hci_dev_test_flag(hdev, HCI_MGMT))
4779                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4780                                          conn->dst_type, conn->passkey_notify,
4781                                          conn->passkey_entered);
4782 }
4783
4784 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4785 {
4786         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4787         struct hci_conn *conn;
4788
4789         BT_DBG("%s", hdev->name);
4790
4791         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4792         if (!conn)
4793                 return;
4794
4795         switch (ev->type) {
4796         case HCI_KEYPRESS_STARTED:
4797                 conn->passkey_entered = 0;
4798                 return;
4799
4800         case HCI_KEYPRESS_ENTERED:
4801                 conn->passkey_entered++;
4802                 break;
4803
4804         case HCI_KEYPRESS_ERASED:
4805                 conn->passkey_entered--;
4806                 break;
4807
4808         case HCI_KEYPRESS_CLEARED:
4809                 conn->passkey_entered = 0;
4810                 break;
4811
4812         case HCI_KEYPRESS_COMPLETED:
4813                 return;
4814         }
4815
4816         if (hci_dev_test_flag(hdev, HCI_MGMT))
4817                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4818                                          conn->dst_type, conn->passkey_notify,
4819                                          conn->passkey_entered);
4820 }
4821
4822 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4823                                          struct sk_buff *skb)
4824 {
4825         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4826         struct hci_conn *conn;
4827
4828         BT_DBG("%s", hdev->name);
4829
4830         hci_dev_lock(hdev);
4831
4832         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4833         if (!conn)
4834                 goto unlock;
4835
4836         /* Reset the authentication requirement to unknown */
4837         conn->remote_auth = 0xff;
4838
4839         /* To avoid duplicate auth_failed events to user space we check
4840          * the HCI_CONN_AUTH_PEND flag which will be set if we
4841          * initiated the authentication. A traditional auth_complete
4842          * event gets always produced as initiator and is also mapped to
4843          * the mgmt_auth_failed event */
4844         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4845                 mgmt_auth_failed(conn, ev->status);
4846
4847         hci_conn_drop(conn);
4848
4849 unlock:
4850         hci_dev_unlock(hdev);
4851 }
4852
4853 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4854                                          struct sk_buff *skb)
4855 {
4856         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4857         struct inquiry_entry *ie;
4858         struct hci_conn *conn;
4859
4860         BT_DBG("%s", hdev->name);
4861
4862         hci_dev_lock(hdev);
4863
4864         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4865         if (conn)
4866                 memcpy(conn->features[1], ev->features, 8);
4867
4868         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4869         if (ie)
4870                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4871
4872         hci_dev_unlock(hdev);
4873 }
4874
4875 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4876                                             struct sk_buff *skb)
4877 {
4878         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4879         struct oob_data *data;
4880
4881         BT_DBG("%s", hdev->name);
4882
4883         hci_dev_lock(hdev);
4884
4885         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4886                 goto unlock;
4887
4888         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4889         if (!data) {
4890                 struct hci_cp_remote_oob_data_neg_reply cp;
4891
4892                 bacpy(&cp.bdaddr, &ev->bdaddr);
4893                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4894                              sizeof(cp), &cp);
4895                 goto unlock;
4896         }
4897
4898         if (bredr_sc_enabled(hdev)) {
4899                 struct hci_cp_remote_oob_ext_data_reply cp;
4900
4901                 bacpy(&cp.bdaddr, &ev->bdaddr);
4902                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4903                         memset(cp.hash192, 0, sizeof(cp.hash192));
4904                         memset(cp.rand192, 0, sizeof(cp.rand192));
4905                 } else {
4906                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4907                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4908                 }
4909                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4910                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4911
4912                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4913                              sizeof(cp), &cp);
4914         } else {
4915                 struct hci_cp_remote_oob_data_reply cp;
4916
4917                 bacpy(&cp.bdaddr, &ev->bdaddr);
4918                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4919                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4920
4921                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4922                              sizeof(cp), &cp);
4923         }
4924
4925 unlock:
4926         hci_dev_unlock(hdev);
4927 }
4928
4929 #if IS_ENABLED(CONFIG_BT_HS)
4930 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4931 {
4932         struct hci_ev_channel_selected *ev = (void *)skb->data;
4933         struct hci_conn *hcon;
4934
4935         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4936
4937         skb_pull(skb, sizeof(*ev));
4938
4939         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4940         if (!hcon)
4941                 return;
4942
4943         amp_read_loc_assoc_final_data(hdev, hcon);
4944 }
4945
4946 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4947                                       struct sk_buff *skb)
4948 {
4949         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4950         struct hci_conn *hcon, *bredr_hcon;
4951
4952         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4953                ev->status);
4954
4955         hci_dev_lock(hdev);
4956
4957         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4958         if (!hcon)
4959                 goto unlock;
4960
4961         if (!hcon->amp_mgr)
4962                 goto unlock;
4963
4964         if (ev->status) {
4965                 hci_conn_del(hcon);
4966                 goto unlock;
4967         }
4968
4969         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4970
4971         hcon->state = BT_CONNECTED;
4972         bacpy(&hcon->dst, &bredr_hcon->dst);
4973
4974         hci_conn_hold(hcon);
4975         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4976         hci_conn_drop(hcon);
4977
4978         hci_debugfs_create_conn(hcon);
4979         hci_conn_add_sysfs(hcon);
4980
4981         amp_physical_cfm(bredr_hcon, hcon);
4982
4983 unlock:
4984         hci_dev_unlock(hdev);
4985 }
4986
4987 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4988 {
4989         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4990         struct hci_conn *hcon;
4991         struct hci_chan *hchan;
4992         struct amp_mgr *mgr;
4993
4994         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4995                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4996                ev->status);
4997
4998         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4999         if (!hcon)
5000                 return;
5001
5002         /* Create AMP hchan */
5003         hchan = hci_chan_create(hcon);
5004         if (!hchan)
5005                 return;
5006
5007         hchan->handle = le16_to_cpu(ev->handle);
5008
5009         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5010
5011         mgr = hcon->amp_mgr;
5012         if (mgr && mgr->bredr_chan) {
5013                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5014
5015                 l2cap_chan_lock(bredr_chan);
5016
5017                 bredr_chan->conn->mtu = hdev->block_mtu;
5018                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5019                 hci_conn_hold(hcon);
5020
5021                 l2cap_chan_unlock(bredr_chan);
5022         }
5023 }
5024
5025 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5026                                              struct sk_buff *skb)
5027 {
5028         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5029         struct hci_chan *hchan;
5030
5031         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5032                le16_to_cpu(ev->handle), ev->status);
5033
5034         if (ev->status)
5035                 return;
5036
5037         hci_dev_lock(hdev);
5038
5039         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5040         if (!hchan)
5041                 goto unlock;
5042
5043         amp_destroy_logical_link(hchan, ev->reason);
5044
5045 unlock:
5046         hci_dev_unlock(hdev);
5047 }
5048
5049 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5050                                              struct sk_buff *skb)
5051 {
5052         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5053         struct hci_conn *hcon;
5054
5055         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5056
5057         if (ev->status)
5058                 return;
5059
5060         hci_dev_lock(hdev);
5061
5062         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5063         if (hcon) {
5064                 hcon->state = BT_CLOSED;
5065                 hci_conn_del(hcon);
5066         }
5067
5068         hci_dev_unlock(hdev);
5069 }
5070 #endif
5071
5072 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5073                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
5074                         u16 interval, u16 latency, u16 supervision_timeout)
5075 {
5076         struct hci_conn_params *params;
5077         struct hci_conn *conn;
5078         struct smp_irk *irk;
5079         u8 addr_type;
5080
5081         hci_dev_lock(hdev);
5082
5083         /* All controllers implicitly stop advertising in the event of a
5084          * connection, so ensure that the state bit is cleared.
5085          */
5086         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5087
5088         conn = hci_lookup_le_connect(hdev);
5089         if (!conn) {
5090                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5091                 if (!conn) {
5092                         bt_dev_err(hdev, "no memory for new connection");
5093                         goto unlock;
5094                 }
5095
5096                 conn->dst_type = bdaddr_type;
5097
5098                 /* If we didn't have a hci_conn object previously
5099                  * but we're in master role this must be something
5100                  * initiated using a white list. Since white list based
5101                  * connections are not "first class citizens" we don't
5102                  * have full tracking of them. Therefore, we go ahead
5103                  * with a "best effort" approach of determining the
5104                  * initiator address based on the HCI_PRIVACY flag.
5105                  */
5106                 if (conn->out) {
5107                         conn->resp_addr_type = bdaddr_type;
5108                         bacpy(&conn->resp_addr, bdaddr);
5109                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5110                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5111                                 bacpy(&conn->init_addr, &hdev->rpa);
5112                         } else {
5113                                 hci_copy_identity_address(hdev,
5114                                                           &conn->init_addr,
5115                                                           &conn->init_addr_type);
5116                         }
5117                 }
5118         } else {
5119                 cancel_delayed_work(&conn->le_conn_timeout);
5120         }
5121
5122         if (!conn->out) {
5123                 /* Set the responder (our side) address type based on
5124                  * the advertising address type.
5125                  */
5126                 conn->resp_addr_type = hdev->adv_addr_type;
5127                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5128                         /* In case of ext adv, resp_addr will be updated in
5129                          * Adv Terminated event.
5130                          */
5131                         if (!ext_adv_capable(hdev))
5132                                 bacpy(&conn->resp_addr, &hdev->random_addr);
5133                 } else {
5134                         bacpy(&conn->resp_addr, &hdev->bdaddr);
5135                 }
5136
5137                 conn->init_addr_type = bdaddr_type;
5138                 bacpy(&conn->init_addr, bdaddr);
5139
5140                 /* For incoming connections, set the default minimum
5141                  * and maximum connection interval. They will be used
5142                  * to check if the parameters are in range and if not
5143                  * trigger the connection update procedure.
5144                  */
5145                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
5146                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
5147         }
5148
5149         /* Lookup the identity address from the stored connection
5150          * address and address type.
5151          *
5152          * When establishing connections to an identity address, the
5153          * connection procedure will store the resolvable random
5154          * address first. Now if it can be converted back into the
5155          * identity address, start using the identity address from
5156          * now on.
5157          */
5158         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5159         if (irk) {
5160                 bacpy(&conn->dst, &irk->bdaddr);
5161                 conn->dst_type = irk->addr_type;
5162         }
5163
5164         if (status) {
5165                 hci_le_conn_failed(conn, status);
5166                 goto unlock;
5167         }
5168
5169         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5170                 addr_type = BDADDR_LE_PUBLIC;
5171         else
5172                 addr_type = BDADDR_LE_RANDOM;
5173
5174         /* Drop the connection if the device is blocked */
5175         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5176                 hci_conn_drop(conn);
5177                 goto unlock;
5178         }
5179
5180         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5181                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
5182
5183         conn->sec_level = BT_SECURITY_LOW;
5184         conn->handle = handle;
5185         conn->state = BT_CONFIG;
5186
5187         conn->le_conn_interval = interval;
5188         conn->le_conn_latency = latency;
5189         conn->le_supv_timeout = supervision_timeout;
5190
5191         hci_debugfs_create_conn(conn);
5192         hci_conn_add_sysfs(conn);
5193
5194         /* The remote features procedure is defined for master
5195          * role only. So only in case of an initiated connection
5196          * request the remote features.
5197          *
5198          * If the local controller supports slave-initiated features
5199          * exchange, then requesting the remote features in slave
5200          * role is possible. Otherwise just transition into the
5201          * connected state without requesting the remote features.
5202          */
5203         if (conn->out ||
5204             (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5205                 struct hci_cp_le_read_remote_features cp;
5206
5207                 cp.handle = __cpu_to_le16(conn->handle);
5208
5209                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5210                              sizeof(cp), &cp);
5211
5212                 hci_conn_hold(conn);
5213         } else {
5214                 conn->state = BT_CONNECTED;
5215                 hci_connect_cfm(conn, status);
5216         }
5217
5218         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5219                                            conn->dst_type);
5220         if (params) {
5221                 list_del_init(&params->action);
5222                 if (params->conn) {
5223                         hci_conn_drop(params->conn);
5224                         hci_conn_put(params->conn);
5225                         params->conn = NULL;
5226                 }
5227         }
5228
5229 unlock:
5230         hci_update_background_scan(hdev);
5231         hci_dev_unlock(hdev);
5232 }
5233
5234 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5235 {
5236         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5237
5238         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5239
5240         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5241                              ev->role, le16_to_cpu(ev->handle),
5242                              le16_to_cpu(ev->interval),
5243                              le16_to_cpu(ev->latency),
5244                              le16_to_cpu(ev->supervision_timeout));
5245 }
5246
5247 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5248                                          struct sk_buff *skb)
5249 {
5250         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5251
5252         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5253
5254         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5255                              ev->role, le16_to_cpu(ev->handle),
5256                              le16_to_cpu(ev->interval),
5257                              le16_to_cpu(ev->latency),
5258                              le16_to_cpu(ev->supervision_timeout));
5259
5260         if (use_ll_privacy(hdev) &&
5261             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5262             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5263                 hci_req_disable_address_resolution(hdev);
5264 }
5265
5266 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5267 {
5268         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5269         struct hci_conn *conn;
5270
5271         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5272
5273         if (ev->status)
5274                 return;
5275
5276         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5277         if (conn) {
5278                 struct adv_info *adv_instance;
5279
5280                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5281                         return;
5282
5283                 if (!hdev->cur_adv_instance) {
5284                         bacpy(&conn->resp_addr, &hdev->random_addr);
5285                         return;
5286                 }
5287
5288                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5289                 if (adv_instance)
5290                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5291         }
5292 }
5293
5294 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5295                                             struct sk_buff *skb)
5296 {
5297         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5298         struct hci_conn *conn;
5299
5300         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5301
5302         if (ev->status)
5303                 return;
5304
5305         hci_dev_lock(hdev);
5306
5307         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5308         if (conn) {
5309                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5310                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5311                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5312         }
5313
5314         hci_dev_unlock(hdev);
5315 }
5316
5317 /* This function requires the caller holds hdev->lock */
5318 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5319                                               bdaddr_t *addr,
5320                                               u8 addr_type, u8 adv_type,
5321                                               bdaddr_t *direct_rpa)
5322 {
5323         struct hci_conn *conn;
5324         struct hci_conn_params *params;
5325
5326         /* If the event is not connectable don't proceed further */
5327         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5328                 return NULL;
5329
5330         /* Ignore if the device is blocked */
5331         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5332                 return NULL;
5333
5334         /* Most controller will fail if we try to create new connections
5335          * while we have an existing one in slave role.
5336          */
5337         if (hdev->conn_hash.le_num_slave > 0 &&
5338             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5339              !(hdev->le_states[3] & 0x10)))
5340                 return NULL;
5341
5342         /* If we're not connectable only connect devices that we have in
5343          * our pend_le_conns list.
5344          */
5345         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5346                                            addr_type);
5347         if (!params)
5348                 return NULL;
5349
5350         if (!params->explicit_connect) {
5351                 switch (params->auto_connect) {
5352                 case HCI_AUTO_CONN_DIRECT:
5353                         /* Only devices advertising with ADV_DIRECT_IND are
5354                          * triggering a connection attempt. This is allowing
5355                          * incoming connections from slave devices.
5356                          */
5357                         if (adv_type != LE_ADV_DIRECT_IND)
5358                                 return NULL;
5359                         break;
5360                 case HCI_AUTO_CONN_ALWAYS:
5361                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5362                          * are triggering a connection attempt. This means
5363                          * that incoming connections from slave device are
5364                          * accepted and also outgoing connections to slave
5365                          * devices are established when found.
5366                          */
5367                         break;
5368                 default:
5369                         return NULL;
5370                 }
5371         }
5372
5373         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5374                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5375                               direct_rpa);
5376         if (!IS_ERR(conn)) {
5377                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5378                  * by higher layer that tried to connect, if no then
5379                  * store the pointer since we don't really have any
5380                  * other owner of the object besides the params that
5381                  * triggered it. This way we can abort the connection if
5382                  * the parameters get removed and keep the reference
5383                  * count consistent once the connection is established.
5384                  */
5385
5386                 if (!params->explicit_connect)
5387                         params->conn = hci_conn_get(conn);
5388
5389                 return conn;
5390         }
5391
5392         switch (PTR_ERR(conn)) {
5393         case -EBUSY:
5394                 /* If hci_connect() returns -EBUSY it means there is already
5395                  * an LE connection attempt going on. Since controllers don't
5396                  * support more than one connection attempt at the time, we
5397                  * don't consider this an error case.
5398                  */
5399                 break;
5400         default:
5401                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5402                 return NULL;
5403         }
5404
5405         return NULL;
5406 }
5407
5408 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5409                                u8 bdaddr_type, bdaddr_t *direct_addr,
5410                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5411                                bool ext_adv)
5412 {
5413         struct discovery_state *d = &hdev->discovery;
5414         struct smp_irk *irk;
5415         struct hci_conn *conn;
5416         bool match;
5417         u32 flags;
5418         u8 *ptr, real_len;
5419
5420         switch (type) {
5421         case LE_ADV_IND:
5422         case LE_ADV_DIRECT_IND:
5423         case LE_ADV_SCAN_IND:
5424         case LE_ADV_NONCONN_IND:
5425         case LE_ADV_SCAN_RSP:
5426                 break;
5427         default:
5428                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5429                                        "type: 0x%02x", type);
5430                 return;
5431         }
5432
5433         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5434                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5435                 return;
5436         }
5437
5438         /* Find the end of the data in case the report contains padded zero
5439          * bytes at the end causing an invalid length value.
5440          *
5441          * When data is NULL, len is 0 so there is no need for extra ptr
5442          * check as 'ptr < data + 0' is already false in such case.
5443          */
5444         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5445                 if (ptr + 1 + *ptr > data + len)
5446                         break;
5447         }
5448
5449         real_len = ptr - data;
5450
5451         /* Adjust for actual length */
5452         if (len != real_len) {
5453                 bt_dev_err_ratelimited(hdev, "advertising data len corrected %u -> %u",
5454                                        len, real_len);
5455                 len = real_len;
5456         }
5457
5458         /* If the direct address is present, then this report is from
5459          * a LE Direct Advertising Report event. In that case it is
5460          * important to see if the address is matching the local
5461          * controller address.
5462          */
5463         if (direct_addr) {
5464                 /* Only resolvable random addresses are valid for these
5465                  * kind of reports and others can be ignored.
5466                  */
5467                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5468                         return;
5469
5470                 /* If the controller is not using resolvable random
5471                  * addresses, then this report can be ignored.
5472                  */
5473                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5474                         return;
5475
5476                 /* If the local IRK of the controller does not match
5477                  * with the resolvable random address provided, then
5478                  * this report can be ignored.
5479                  */
5480                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5481                         return;
5482         }
5483
5484         /* Check if we need to convert to identity address */
5485         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5486         if (irk) {
5487                 bdaddr = &irk->bdaddr;
5488                 bdaddr_type = irk->addr_type;
5489         }
5490
5491         /* Check if we have been requested to connect to this device.
5492          *
5493          * direct_addr is set only for directed advertising reports (it is NULL
5494          * for advertising reports) and is already verified to be RPA above.
5495          */
5496         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5497                                                                 direct_addr);
5498         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5499                 /* Store report for later inclusion by
5500                  * mgmt_device_connected
5501                  */
5502                 memcpy(conn->le_adv_data, data, len);
5503                 conn->le_adv_data_len = len;
5504         }
5505
5506         /* Passive scanning shouldn't trigger any device found events,
5507          * except for devices marked as CONN_REPORT for which we do send
5508          * device found events, or advertisement monitoring requested.
5509          */
5510         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5511                 if (type == LE_ADV_DIRECT_IND)
5512                         return;
5513
5514                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5515                                                bdaddr, bdaddr_type) &&
5516                     idr_is_empty(&hdev->adv_monitors_idr))
5517                         return;
5518
5519                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5520                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5521                 else
5522                         flags = 0;
5523                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5524                                   rssi, flags, data, len, NULL, 0);
5525                 return;
5526         }
5527
5528         /* When receiving non-connectable or scannable undirected
5529          * advertising reports, this means that the remote device is
5530          * not connectable and then clearly indicate this in the
5531          * device found event.
5532          *
5533          * When receiving a scan response, then there is no way to
5534          * know if the remote device is connectable or not. However
5535          * since scan responses are merged with a previously seen
5536          * advertising report, the flags field from that report
5537          * will be used.
5538          *
5539          * In the really unlikely case that a controller get confused
5540          * and just sends a scan response event, then it is marked as
5541          * not connectable as well.
5542          */
5543         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5544             type == LE_ADV_SCAN_RSP)
5545                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5546         else
5547                 flags = 0;
5548
5549         /* If there's nothing pending either store the data from this
5550          * event or send an immediate device found event if the data
5551          * should not be stored for later.
5552          */
5553         if (!ext_adv && !has_pending_adv_report(hdev)) {
5554                 /* If the report will trigger a SCAN_REQ store it for
5555                  * later merging.
5556                  */
5557                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5558                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5559                                                  rssi, flags, data, len);
5560                         return;
5561                 }
5562
5563                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5564                                   rssi, flags, data, len, NULL, 0);
5565                 return;
5566         }
5567
5568         /* Check if the pending report is for the same device as the new one */
5569         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5570                  bdaddr_type == d->last_adv_addr_type);
5571
5572         /* If the pending data doesn't match this report or this isn't a
5573          * scan response (e.g. we got a duplicate ADV_IND) then force
5574          * sending of the pending data.
5575          */
5576         if (type != LE_ADV_SCAN_RSP || !match) {
5577                 /* Send out whatever is in the cache, but skip duplicates */
5578                 if (!match)
5579                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5580                                           d->last_adv_addr_type, NULL,
5581                                           d->last_adv_rssi, d->last_adv_flags,
5582                                           d->last_adv_data,
5583                                           d->last_adv_data_len, NULL, 0);
5584
5585                 /* If the new report will trigger a SCAN_REQ store it for
5586                  * later merging.
5587                  */
5588                 if (!ext_adv && (type == LE_ADV_IND ||
5589                                  type == LE_ADV_SCAN_IND)) {
5590                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5591                                                  rssi, flags, data, len);
5592                         return;
5593                 }
5594
5595                 /* The advertising reports cannot be merged, so clear
5596                  * the pending report and send out a device found event.
5597                  */
5598                 clear_pending_adv_report(hdev);
5599                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5600                                   rssi, flags, data, len, NULL, 0);
5601                 return;
5602         }
5603
5604         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5605          * the new event is a SCAN_RSP. We can therefore proceed with
5606          * sending a merged device found event.
5607          */
5608         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5609                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5610                           d->last_adv_data, d->last_adv_data_len, data, len);
5611         clear_pending_adv_report(hdev);
5612 }
5613
5614 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5615 {
5616         u8 num_reports = skb->data[0];
5617         void *ptr = &skb->data[1];
5618
5619         hci_dev_lock(hdev);
5620
5621         while (num_reports--) {
5622                 struct hci_ev_le_advertising_info *ev = ptr;
5623                 s8 rssi;
5624
5625                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5626                         rssi = ev->data[ev->length];
5627                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5628                                            ev->bdaddr_type, NULL, 0, rssi,
5629                                            ev->data, ev->length, false);
5630                 } else {
5631                         bt_dev_err(hdev, "Dropping invalid advertising data");
5632                 }
5633
5634                 ptr += sizeof(*ev) + ev->length + 1;
5635         }
5636
5637         hci_dev_unlock(hdev);
5638 }
5639
5640 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5641 {
5642         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5643                 switch (evt_type) {
5644                 case LE_LEGACY_ADV_IND:
5645                         return LE_ADV_IND;
5646                 case LE_LEGACY_ADV_DIRECT_IND:
5647                         return LE_ADV_DIRECT_IND;
5648                 case LE_LEGACY_ADV_SCAN_IND:
5649                         return LE_ADV_SCAN_IND;
5650                 case LE_LEGACY_NONCONN_IND:
5651                         return LE_ADV_NONCONN_IND;
5652                 case LE_LEGACY_SCAN_RSP_ADV:
5653                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5654                         return LE_ADV_SCAN_RSP;
5655                 }
5656
5657                 goto invalid;
5658         }
5659
5660         if (evt_type & LE_EXT_ADV_CONN_IND) {
5661                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5662                         return LE_ADV_DIRECT_IND;
5663
5664                 return LE_ADV_IND;
5665         }
5666
5667         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5668                 return LE_ADV_SCAN_RSP;
5669
5670         if (evt_type & LE_EXT_ADV_SCAN_IND)
5671                 return LE_ADV_SCAN_IND;
5672
5673         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5674             evt_type & LE_EXT_ADV_DIRECT_IND)
5675                 return LE_ADV_NONCONN_IND;
5676
5677 invalid:
5678         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5679                                evt_type);
5680
5681         return LE_ADV_INVALID;
5682 }
5683
5684 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5685 {
5686         u8 num_reports = skb->data[0];
5687         void *ptr = &skb->data[1];
5688
5689         hci_dev_lock(hdev);
5690
5691         while (num_reports--) {
5692                 struct hci_ev_le_ext_adv_report *ev = ptr;
5693                 u8 legacy_evt_type;
5694                 u16 evt_type;
5695
5696                 evt_type = __le16_to_cpu(ev->evt_type);
5697                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5698                 if (legacy_evt_type != LE_ADV_INVALID) {
5699                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5700                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5701                                            ev->data, ev->length,
5702                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5703                 }
5704
5705                 ptr += sizeof(*ev) + ev->length;
5706         }
5707
5708         hci_dev_unlock(hdev);
5709 }
5710
5711 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5712                                             struct sk_buff *skb)
5713 {
5714         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5715         struct hci_conn *conn;
5716
5717         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5718
5719         hci_dev_lock(hdev);
5720
5721         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5722         if (conn) {
5723                 if (!ev->status)
5724                         memcpy(conn->features[0], ev->features, 8);
5725
5726                 if (conn->state == BT_CONFIG) {
5727                         __u8 status;
5728
5729                         /* If the local controller supports slave-initiated
5730                          * features exchange, but the remote controller does
5731                          * not, then it is possible that the error code 0x1a
5732                          * for unsupported remote feature gets returned.
5733                          *
5734                          * In this specific case, allow the connection to
5735                          * transition into connected state and mark it as
5736                          * successful.
5737                          */
5738                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5739                             !conn->out && ev->status == 0x1a)
5740                                 status = 0x00;
5741                         else
5742                                 status = ev->status;
5743
5744                         conn->state = BT_CONNECTED;
5745                         hci_connect_cfm(conn, status);
5746                         hci_conn_drop(conn);
5747                 }
5748         }
5749
5750         hci_dev_unlock(hdev);
5751 }
5752
5753 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5754 {
5755         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5756         struct hci_cp_le_ltk_reply cp;
5757         struct hci_cp_le_ltk_neg_reply neg;
5758         struct hci_conn *conn;
5759         struct smp_ltk *ltk;
5760
5761         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5762
5763         hci_dev_lock(hdev);
5764
5765         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5766         if (conn == NULL)
5767                 goto not_found;
5768
5769         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5770         if (!ltk)
5771                 goto not_found;
5772
5773         if (smp_ltk_is_sc(ltk)) {
5774                 /* With SC both EDiv and Rand are set to zero */
5775                 if (ev->ediv || ev->rand)
5776                         goto not_found;
5777         } else {
5778                 /* For non-SC keys check that EDiv and Rand match */
5779                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5780                         goto not_found;
5781         }
5782
5783         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5784         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5785         cp.handle = cpu_to_le16(conn->handle);
5786
5787         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5788
5789         conn->enc_key_size = ltk->enc_size;
5790
5791         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5792
5793         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5794          * temporary key used to encrypt a connection following
5795          * pairing. It is used during the Encrypted Session Setup to
5796          * distribute the keys. Later, security can be re-established
5797          * using a distributed LTK.
5798          */
5799         if (ltk->type == SMP_STK) {
5800                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5801                 list_del_rcu(&ltk->list);
5802                 kfree_rcu(ltk, rcu);
5803         } else {
5804                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5805         }
5806
5807         hci_dev_unlock(hdev);
5808
5809         return;
5810
5811 not_found:
5812         neg.handle = ev->handle;
5813         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5814         hci_dev_unlock(hdev);
5815 }
5816
5817 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5818                                       u8 reason)
5819 {
5820         struct hci_cp_le_conn_param_req_neg_reply cp;
5821
5822         cp.handle = cpu_to_le16(handle);
5823         cp.reason = reason;
5824
5825         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5826                      &cp);
5827 }
5828
5829 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5830                                              struct sk_buff *skb)
5831 {
5832         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5833         struct hci_cp_le_conn_param_req_reply cp;
5834         struct hci_conn *hcon;
5835         u16 handle, min, max, latency, timeout;
5836
5837         handle = le16_to_cpu(ev->handle);
5838         min = le16_to_cpu(ev->interval_min);
5839         max = le16_to_cpu(ev->interval_max);
5840         latency = le16_to_cpu(ev->latency);
5841         timeout = le16_to_cpu(ev->timeout);
5842
5843         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5844         if (!hcon || hcon->state != BT_CONNECTED)
5845                 return send_conn_param_neg_reply(hdev, handle,
5846                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5847
5848         if (hci_check_conn_params(min, max, latency, timeout))
5849                 return send_conn_param_neg_reply(hdev, handle,
5850                                                  HCI_ERROR_INVALID_LL_PARAMS);
5851
5852         if (hcon->role == HCI_ROLE_MASTER) {
5853                 struct hci_conn_params *params;
5854                 u8 store_hint;
5855
5856                 hci_dev_lock(hdev);
5857
5858                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5859                                                 hcon->dst_type);
5860                 if (params) {
5861                         params->conn_min_interval = min;
5862                         params->conn_max_interval = max;
5863                         params->conn_latency = latency;
5864                         params->supervision_timeout = timeout;
5865                         store_hint = 0x01;
5866                 } else{
5867                         store_hint = 0x00;
5868                 }
5869
5870                 hci_dev_unlock(hdev);
5871
5872                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5873                                     store_hint, min, max, latency, timeout);
5874         }
5875
5876         cp.handle = ev->handle;
5877         cp.interval_min = ev->interval_min;
5878         cp.interval_max = ev->interval_max;
5879         cp.latency = ev->latency;
5880         cp.timeout = ev->timeout;
5881         cp.min_ce_len = 0;
5882         cp.max_ce_len = 0;
5883
5884         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5885 }
5886
5887 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5888                                          struct sk_buff *skb)
5889 {
5890         u8 num_reports = skb->data[0];
5891         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
5892
5893         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
5894                 return;
5895
5896         hci_dev_lock(hdev);
5897
5898         for (; num_reports; num_reports--, ev++)
5899                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5900                                    ev->bdaddr_type, &ev->direct_addr,
5901                                    ev->direct_addr_type, ev->rssi, NULL, 0,
5902                                    false);
5903
5904         hci_dev_unlock(hdev);
5905 }
5906
5907 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
5908 {
5909         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
5910         struct hci_conn *conn;
5911
5912         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5913
5914         if (!ev->status)
5915                 return;
5916
5917         hci_dev_lock(hdev);
5918
5919         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5920         if (!conn)
5921                 goto unlock;
5922
5923         conn->le_tx_phy = ev->tx_phy;
5924         conn->le_rx_phy = ev->rx_phy;
5925
5926 unlock:
5927         hci_dev_unlock(hdev);
5928 }
5929
5930 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5931 {
5932         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5933
5934         skb_pull(skb, sizeof(*le_ev));
5935
5936         switch (le_ev->subevent) {
5937         case HCI_EV_LE_CONN_COMPLETE:
5938                 hci_le_conn_complete_evt(hdev, skb);
5939                 break;
5940
5941         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5942                 hci_le_conn_update_complete_evt(hdev, skb);
5943                 break;
5944
5945         case HCI_EV_LE_ADVERTISING_REPORT:
5946                 hci_le_adv_report_evt(hdev, skb);
5947                 break;
5948
5949         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5950                 hci_le_remote_feat_complete_evt(hdev, skb);
5951                 break;
5952
5953         case HCI_EV_LE_LTK_REQ:
5954                 hci_le_ltk_request_evt(hdev, skb);
5955                 break;
5956
5957         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5958                 hci_le_remote_conn_param_req_evt(hdev, skb);
5959                 break;
5960
5961         case HCI_EV_LE_DIRECT_ADV_REPORT:
5962                 hci_le_direct_adv_report_evt(hdev, skb);
5963                 break;
5964
5965         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
5966                 hci_le_phy_update_evt(hdev, skb);
5967                 break;
5968
5969         case HCI_EV_LE_EXT_ADV_REPORT:
5970                 hci_le_ext_adv_report_evt(hdev, skb);
5971                 break;
5972
5973         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5974                 hci_le_enh_conn_complete_evt(hdev, skb);
5975                 break;
5976
5977         case HCI_EV_LE_EXT_ADV_SET_TERM:
5978                 hci_le_ext_adv_term_evt(hdev, skb);
5979                 break;
5980
5981         default:
5982                 break;
5983         }
5984 }
5985
5986 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5987                                  u8 event, struct sk_buff *skb)
5988 {
5989         struct hci_ev_cmd_complete *ev;
5990         struct hci_event_hdr *hdr;
5991
5992         if (!skb)
5993                 return false;
5994
5995         if (skb->len < sizeof(*hdr)) {
5996                 bt_dev_err(hdev, "too short HCI event");
5997                 return false;
5998         }
5999
6000         hdr = (void *) skb->data;
6001         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6002
6003         if (event) {
6004                 if (hdr->evt != event)
6005                         return false;
6006                 return true;
6007         }
6008
6009         /* Check if request ended in Command Status - no way to retreive
6010          * any extra parameters in this case.
6011          */
6012         if (hdr->evt == HCI_EV_CMD_STATUS)
6013                 return false;
6014
6015         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6016                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6017                            hdr->evt);
6018                 return false;
6019         }
6020
6021         if (skb->len < sizeof(*ev)) {
6022                 bt_dev_err(hdev, "too short cmd_complete event");
6023                 return false;
6024         }
6025
6026         ev = (void *) skb->data;
6027         skb_pull(skb, sizeof(*ev));
6028
6029         if (opcode != __le16_to_cpu(ev->opcode)) {
6030                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6031                        __le16_to_cpu(ev->opcode));
6032                 return false;
6033         }
6034
6035         return true;
6036 }
6037
6038 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6039                                   struct sk_buff *skb)
6040 {
6041         struct hci_ev_le_advertising_info *adv;
6042         struct hci_ev_le_direct_adv_info *direct_adv;
6043         struct hci_ev_le_ext_adv_report *ext_adv;
6044         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6045         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6046
6047         hci_dev_lock(hdev);
6048
6049         /* If we are currently suspended and this is the first BT event seen,
6050          * save the wake reason associated with the event.
6051          */
6052         if (!hdev->suspended || hdev->wake_reason)
6053                 goto unlock;
6054
6055         /* Default to remote wake. Values for wake_reason are documented in the
6056          * Bluez mgmt api docs.
6057          */
6058         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6059
6060         /* Once configured for remote wakeup, we should only wake up for
6061          * reconnections. It's useful to see which device is waking us up so
6062          * keep track of the bdaddr of the connection event that woke us up.
6063          */
6064         if (event == HCI_EV_CONN_REQUEST) {
6065                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6066                 hdev->wake_addr_type = BDADDR_BREDR;
6067         } else if (event == HCI_EV_CONN_COMPLETE) {
6068                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6069                 hdev->wake_addr_type = BDADDR_BREDR;
6070         } else if (event == HCI_EV_LE_META) {
6071                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6072                 u8 subevent = le_ev->subevent;
6073                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6074                 u8 num_reports = *ptr;
6075
6076                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6077                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6078                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6079                     num_reports) {
6080                         adv = (void *)(ptr + 1);
6081                         direct_adv = (void *)(ptr + 1);
6082                         ext_adv = (void *)(ptr + 1);
6083
6084                         switch (subevent) {
6085                         case HCI_EV_LE_ADVERTISING_REPORT:
6086                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6087                                 hdev->wake_addr_type = adv->bdaddr_type;
6088                                 break;
6089                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6090                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6091                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6092                                 break;
6093                         case HCI_EV_LE_EXT_ADV_REPORT:
6094                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6095                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6096                                 break;
6097                         }
6098                 }
6099         } else {
6100                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6101         }
6102
6103 unlock:
6104         hci_dev_unlock(hdev);
6105 }
6106
6107 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6108 {
6109         struct hci_event_hdr *hdr = (void *) skb->data;
6110         hci_req_complete_t req_complete = NULL;
6111         hci_req_complete_skb_t req_complete_skb = NULL;
6112         struct sk_buff *orig_skb = NULL;
6113         u8 status = 0, event = hdr->evt, req_evt = 0;
6114         u16 opcode = HCI_OP_NOP;
6115
6116         if (!event) {
6117                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6118                 goto done;
6119         }
6120
6121         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6122                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6123                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6124                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6125                                      &req_complete_skb);
6126                 req_evt = event;
6127         }
6128
6129         /* If it looks like we might end up having to call
6130          * req_complete_skb, store a pristine copy of the skb since the
6131          * various handlers may modify the original one through
6132          * skb_pull() calls, etc.
6133          */
6134         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6135             event == HCI_EV_CMD_COMPLETE)
6136                 orig_skb = skb_clone(skb, GFP_KERNEL);
6137
6138         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6139
6140         /* Store wake reason if we're suspended */
6141         hci_store_wake_reason(hdev, event, skb);
6142
6143         switch (event) {
6144         case HCI_EV_INQUIRY_COMPLETE:
6145                 hci_inquiry_complete_evt(hdev, skb);
6146                 break;
6147
6148         case HCI_EV_INQUIRY_RESULT:
6149                 hci_inquiry_result_evt(hdev, skb);
6150                 break;
6151
6152         case HCI_EV_CONN_COMPLETE:
6153                 hci_conn_complete_evt(hdev, skb);
6154                 break;
6155
6156         case HCI_EV_CONN_REQUEST:
6157                 hci_conn_request_evt(hdev, skb);
6158                 break;
6159
6160         case HCI_EV_DISCONN_COMPLETE:
6161                 hci_disconn_complete_evt(hdev, skb);
6162                 break;
6163
6164         case HCI_EV_AUTH_COMPLETE:
6165                 hci_auth_complete_evt(hdev, skb);
6166                 break;
6167
6168         case HCI_EV_REMOTE_NAME:
6169                 hci_remote_name_evt(hdev, skb);
6170                 break;
6171
6172         case HCI_EV_ENCRYPT_CHANGE:
6173                 hci_encrypt_change_evt(hdev, skb);
6174                 break;
6175
6176         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6177                 hci_change_link_key_complete_evt(hdev, skb);
6178                 break;
6179
6180         case HCI_EV_REMOTE_FEATURES:
6181                 hci_remote_features_evt(hdev, skb);
6182                 break;
6183
6184         case HCI_EV_CMD_COMPLETE:
6185                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6186                                      &req_complete, &req_complete_skb);
6187                 break;
6188
6189         case HCI_EV_CMD_STATUS:
6190                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6191                                    &req_complete_skb);
6192                 break;
6193
6194         case HCI_EV_HARDWARE_ERROR:
6195                 hci_hardware_error_evt(hdev, skb);
6196                 break;
6197
6198         case HCI_EV_ROLE_CHANGE:
6199                 hci_role_change_evt(hdev, skb);
6200                 break;
6201
6202         case HCI_EV_NUM_COMP_PKTS:
6203                 hci_num_comp_pkts_evt(hdev, skb);
6204                 break;
6205
6206         case HCI_EV_MODE_CHANGE:
6207                 hci_mode_change_evt(hdev, skb);
6208                 break;
6209
6210         case HCI_EV_PIN_CODE_REQ:
6211                 hci_pin_code_request_evt(hdev, skb);
6212                 break;
6213
6214         case HCI_EV_LINK_KEY_REQ:
6215                 hci_link_key_request_evt(hdev, skb);
6216                 break;
6217
6218         case HCI_EV_LINK_KEY_NOTIFY:
6219                 hci_link_key_notify_evt(hdev, skb);
6220                 break;
6221
6222         case HCI_EV_CLOCK_OFFSET:
6223                 hci_clock_offset_evt(hdev, skb);
6224                 break;
6225
6226         case HCI_EV_PKT_TYPE_CHANGE:
6227                 hci_pkt_type_change_evt(hdev, skb);
6228                 break;
6229
6230         case HCI_EV_PSCAN_REP_MODE:
6231                 hci_pscan_rep_mode_evt(hdev, skb);
6232                 break;
6233
6234         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6235                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6236                 break;
6237
6238         case HCI_EV_REMOTE_EXT_FEATURES:
6239                 hci_remote_ext_features_evt(hdev, skb);
6240                 break;
6241
6242         case HCI_EV_SYNC_CONN_COMPLETE:
6243                 hci_sync_conn_complete_evt(hdev, skb);
6244                 break;
6245
6246         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6247                 hci_extended_inquiry_result_evt(hdev, skb);
6248                 break;
6249
6250         case HCI_EV_KEY_REFRESH_COMPLETE:
6251                 hci_key_refresh_complete_evt(hdev, skb);
6252                 break;
6253
6254         case HCI_EV_IO_CAPA_REQUEST:
6255                 hci_io_capa_request_evt(hdev, skb);
6256                 break;
6257
6258         case HCI_EV_IO_CAPA_REPLY:
6259                 hci_io_capa_reply_evt(hdev, skb);
6260                 break;
6261
6262         case HCI_EV_USER_CONFIRM_REQUEST:
6263                 hci_user_confirm_request_evt(hdev, skb);
6264                 break;
6265
6266         case HCI_EV_USER_PASSKEY_REQUEST:
6267                 hci_user_passkey_request_evt(hdev, skb);
6268                 break;
6269
6270         case HCI_EV_USER_PASSKEY_NOTIFY:
6271                 hci_user_passkey_notify_evt(hdev, skb);
6272                 break;
6273
6274         case HCI_EV_KEYPRESS_NOTIFY:
6275                 hci_keypress_notify_evt(hdev, skb);
6276                 break;
6277
6278         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6279                 hci_simple_pair_complete_evt(hdev, skb);
6280                 break;
6281
6282         case HCI_EV_REMOTE_HOST_FEATURES:
6283                 hci_remote_host_features_evt(hdev, skb);
6284                 break;
6285
6286         case HCI_EV_LE_META:
6287                 hci_le_meta_evt(hdev, skb);
6288                 break;
6289
6290         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6291                 hci_remote_oob_data_request_evt(hdev, skb);
6292                 break;
6293
6294 #if IS_ENABLED(CONFIG_BT_HS)
6295         case HCI_EV_CHANNEL_SELECTED:
6296                 hci_chan_selected_evt(hdev, skb);
6297                 break;
6298
6299         case HCI_EV_PHY_LINK_COMPLETE:
6300                 hci_phy_link_complete_evt(hdev, skb);
6301                 break;
6302
6303         case HCI_EV_LOGICAL_LINK_COMPLETE:
6304                 hci_loglink_complete_evt(hdev, skb);
6305                 break;
6306
6307         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6308                 hci_disconn_loglink_complete_evt(hdev, skb);
6309                 break;
6310
6311         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6312                 hci_disconn_phylink_complete_evt(hdev, skb);
6313                 break;
6314 #endif
6315
6316         case HCI_EV_NUM_COMP_BLOCKS:
6317                 hci_num_comp_blocks_evt(hdev, skb);
6318                 break;
6319
6320         case HCI_EV_VENDOR:
6321                 msft_vendor_evt(hdev, skb);
6322                 break;
6323
6324         default:
6325                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6326                 break;
6327         }
6328
6329         if (req_complete) {
6330                 req_complete(hdev, status, opcode);
6331         } else if (req_complete_skb) {
6332                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6333                         kfree_skb(orig_skb);
6334                         orig_skb = NULL;
6335                 }
6336                 req_complete_skb(hdev, status, opcode, orig_skb);
6337         }
6338
6339 done:
6340         kfree_skb(orig_skb);
6341         kfree_skb(skb);
6342         hdev->stat.evt_rx++;
6343 }