net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28 #include <linux/crypto.h>
  29 #include <crypto/algapi.h>
  30
  31 #include <net/bluetooth/bluetooth.h>
  32 #include <net/bluetooth/hci_core.h>
  33 #include <net/bluetooth/mgmt.h>
  34
  35 #include "hci_request.h"
  36 #include "hci_debugfs.h"
  37 #include "a2mp.h"
  38 #include "amp.h"
  39 #include "smp.h"
  40
  41 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  42                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  43
  44 /* Handle HCI Event packets */
  45
  46 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  47                                   u8 *new_status)
  48 {
  49         __u8 status = *((__u8 *) skb->data);
  50
  51         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  52
  53         /* It is possible that we receive Inquiry Complete event right
  54          * before we receive Inquiry Cancel Command Complete event, in
  55          * which case the latter event should have status of Command
  56          * Disallowed (0x0c). This should not be treated as error, since
  57          * we actually achieve what Inquiry Cancel wants to achieve,
  58          * which is to end the last Inquiry session.
  59          */
  60         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  61                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  62                 status = 0x00;
  63         }
  64
  65         *new_status = status;
  66
  67         if (status)
  68                 return;
  69
  70         clear_bit(HCI_INQUIRY, &hdev->flags);
  71         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  72         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  73
  74         hci_dev_lock(hdev);
  75         /* Set discovery state to stopped if we're not doing LE active
  76          * scanning.
  77          */
  78         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  79             hdev->le_scan_type != LE_SCAN_ACTIVE)
  80                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  81         hci_dev_unlock(hdev);
  82
  83         hci_conn_check_pending(hdev);
  84 }
  85
  86 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  87 {
  88         __u8 status = *((__u8 *) skb->data);
  89
  90         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  91
  92         if (status)
  93                 return;
  94
  95         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  96 }
  97
  98 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  99 {
 100         __u8 status = *((__u8 *) skb->data);
 101
 102         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 103
 104         if (status)
 105                 return;
 106
 107         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 108
 109         hci_conn_check_pending(hdev);
 110 }
 111
 112 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 113                                           struct sk_buff *skb)
 114 {
 115         BT_DBG("%s", hdev->name);
 116 }
 117
 118 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 119 {
 120         struct hci_rp_role_discovery *rp = (void *) skb->data;
 121         struct hci_conn *conn;
 122
 123         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 124
 125         if (rp->status)
 126                 return;
 127
 128         hci_dev_lock(hdev);
 129
 130         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 131         if (conn)
 132                 conn->role = rp->role;
 133
 134         hci_dev_unlock(hdev);
 135 }
 136
 137 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 138 {
 139         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 140         struct hci_conn *conn;
 141
 142         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 143
 144         if (rp->status)
 145                 return;
 146
 147         hci_dev_lock(hdev);
 148
 149         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 150         if (conn)
 151                 conn->link_policy = __le16_to_cpu(rp->policy);
 152
 153         hci_dev_unlock(hdev);
 154 }
 155
 156 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 157 {
 158         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 159         struct hci_conn *conn;
 160         void *sent;
 161
 162         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 163
 164         if (rp->status)
 165                 return;
 166
 167         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 168         if (!sent)
 169                 return;
 170
 171         hci_dev_lock(hdev);
 172
 173         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 174         if (conn)
 175                 conn->link_policy = get_unaligned_le16(sent + 2);
 176
 177         hci_dev_unlock(hdev);
 178 }
 179
 180 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 181                                         struct sk_buff *skb)
 182 {
 183         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 186
 187         if (rp->status)
 188                 return;
 189
 190         hdev->link_policy = __le16_to_cpu(rp->policy);
 191 }
 192
 193 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 194                                          struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197         void *sent;
 198
 199         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 200
 201         if (status)
 202                 return;
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 205         if (!sent)
 206                 return;
 207
 208         hdev->link_policy = get_unaligned_le16(sent);
 209 }
 210
 211 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 212 {
 213         __u8 status = *((__u8 *) skb->data);
 214
 215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 216
 217         clear_bit(HCI_RESET, &hdev->flags);
 218
 219         if (status)
 220                 return;
 221
 222         /* Reset all non-persistent flags */
 223         hci_dev_clear_volatile_flags(hdev);
 224
 225         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 226
 227         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 228         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 229
 230         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 231         hdev->adv_data_len = 0;
 232
 233         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 234         hdev->scan_rsp_data_len = 0;
 235
 236         hdev->le_scan_type = LE_SCAN_PASSIVE;
 237
 238         hdev->ssp_debug_mode = 0;
 239
 240         hci_bdaddr_list_clear(&hdev->le_white_list);
 241 }
 242
 243 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 244                                         struct sk_buff *skb)
 245 {
 246         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 247         struct hci_cp_read_stored_link_key *sent;
 248
 249         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 250
 251         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 252         if (!sent)
 253                 return;
 254
 255         if (!rp->status && sent->read_all == 0x01) {
 256                 hdev->stored_max_keys = rp->max_keys;
 257                 hdev->stored_num_keys = rp->num_keys;
 258         }
 259 }
 260
 261 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 262                                           struct sk_buff *skb)
 263 {
 264         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 267
 268         if (rp->status)
 269                 return;
 270
 271         if (rp->num_keys <= hdev->stored_num_keys)
 272                 hdev->stored_num_keys -= rp->num_keys;
 273         else
 274                 hdev->stored_num_keys = 0;
 275 }
 276
 277 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 278 {
 279         __u8 status = *((__u8 *) skb->data);
 280         void *sent;
 281
 282         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 283
 284         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 285         if (!sent)
 286                 return;
 287
 288         hci_dev_lock(hdev);
 289
 290         if (hci_dev_test_flag(hdev, HCI_MGMT))
 291                 mgmt_set_local_name_complete(hdev, sent, status);
 292         else if (!status)
 293                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 294
 295         hci_dev_unlock(hdev);
 296 }
 297
 298 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 299 {
 300         struct hci_rp_read_local_name *rp = (void *) skb->data;
 301
 302         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 303
 304         if (rp->status)
 305                 return;
 306
 307         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 308             hci_dev_test_flag(hdev, HCI_CONFIG))
 309                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 310 }
 311
 312 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 313 {
 314         __u8 status = *((__u8 *) skb->data);
 315         void *sent;
 316
 317         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 318
 319         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 320         if (!sent)
 321                 return;
 322
 323         hci_dev_lock(hdev);
 324
 325         if (!status) {
 326                 __u8 param = *((__u8 *) sent);
 327
 328                 if (param == AUTH_ENABLED)
 329                         set_bit(HCI_AUTH, &hdev->flags);
 330                 else
 331                         clear_bit(HCI_AUTH, &hdev->flags);
 332         }
 333
 334         if (hci_dev_test_flag(hdev, HCI_MGMT))
 335                 mgmt_auth_enable_complete(hdev, status);
 336
 337         hci_dev_unlock(hdev);
 338 }
 339
 340 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 341 {
 342         __u8 status = *((__u8 *) skb->data);
 343         __u8 param;
 344         void *sent;
 345
 346         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 347
 348         if (status)
 349                 return;
 350
 351         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 352         if (!sent)
 353                 return;
 354
 355         param = *((__u8 *) sent);
 356
 357         if (param)
 358                 set_bit(HCI_ENCRYPT, &hdev->flags);
 359         else
 360                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 361 }
 362
 363 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 364 {
 365         __u8 status = *((__u8 *) skb->data);
 366         __u8 param;
 367         void *sent;
 368
 369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 370
 371         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 372         if (!sent)
 373                 return;
 374
 375         param = *((__u8 *) sent);
 376
 377         hci_dev_lock(hdev);
 378
 379         if (status) {
 380                 hdev->discov_timeout = 0;
 381                 goto done;
 382         }
 383
 384         if (param & SCAN_INQUIRY)
 385                 set_bit(HCI_ISCAN, &hdev->flags);
 386         else
 387                 clear_bit(HCI_ISCAN, &hdev->flags);
 388
 389         if (param & SCAN_PAGE)
 390                 set_bit(HCI_PSCAN, &hdev->flags);
 391         else
 392                 clear_bit(HCI_PSCAN, &hdev->flags);
 393
 394 done:
 395         hci_dev_unlock(hdev);
 396 }
 397
 398 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 399 {
 400         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 403
 404         if (rp->status)
 405                 return;
 406
 407         memcpy(hdev->dev_class, rp->dev_class, 3);
 408
 409         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 410                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 411 }
 412
 413 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416         void *sent;
 417
 418         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 419
 420         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 421         if (!sent)
 422                 return;
 423
 424         hci_dev_lock(hdev);
 425
 426         if (status == 0)
 427                 memcpy(hdev->dev_class, sent, 3);
 428
 429         if (hci_dev_test_flag(hdev, HCI_MGMT))
 430                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 431
 432         hci_dev_unlock(hdev);
 433 }
 434
 435 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 436 {
 437         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 438         __u16 setting;
 439
 440         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 441
 442         if (rp->status)
 443                 return;
 444
 445         setting = __le16_to_cpu(rp->voice_setting);
 446
 447         if (hdev->voice_setting == setting)
 448                 return;
 449
 450         hdev->voice_setting = setting;
 451
 452         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 453
 454         if (hdev->notify)
 455                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 456 }
 457
 458 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 459                                        struct sk_buff *skb)
 460 {
 461         __u8 status = *((__u8 *) skb->data);
 462         __u16 setting;
 463         void *sent;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 466
 467         if (status)
 468                 return;
 469
 470         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 471         if (!sent)
 472                 return;
 473
 474         setting = get_unaligned_le16(sent);
 475
 476         if (hdev->voice_setting == setting)
 477                 return;
 478
 479         hdev->voice_setting = setting;
 480
 481         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 482
 483         if (hdev->notify)
 484                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 485 }
 486
 487 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 488                                           struct sk_buff *skb)
 489 {
 490         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 491
 492         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 493
 494         if (rp->status)
 495                 return;
 496
 497         hdev->num_iac = rp->num_iac;
 498
 499         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 500 }
 501
 502 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 503 {
 504         __u8 status = *((__u8 *) skb->data);
 505         struct hci_cp_write_ssp_mode *sent;
 506
 507         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 508
 509         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 510         if (!sent)
 511                 return;
 512
 513         hci_dev_lock(hdev);
 514
 515         if (!status) {
 516                 if (sent->mode)
 517                         hdev->features[1][0] |= LMP_HOST_SSP;
 518                 else
 519                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 520         }
 521
 522         if (hci_dev_test_flag(hdev, HCI_MGMT))
 523                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 524         else if (!status) {
 525                 if (sent->mode)
 526                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 527                 else
 528                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 529         }
 530
 531         hci_dev_unlock(hdev);
 532 }
 533
 534 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 535 {
 536         u8 status = *((u8 *) skb->data);
 537         struct hci_cp_write_sc_support *sent;
 538
 539         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 540
 541         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 542         if (!sent)
 543                 return;
 544
 545         hci_dev_lock(hdev);
 546
 547         if (!status) {
 548                 if (sent->support)
 549                         hdev->features[1][0] |= LMP_HOST_SC;
 550                 else
 551                         hdev->features[1][0] &= ~LMP_HOST_SC;
 552         }
 553
 554         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 555                 if (sent->support)
 556                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 557                 else
 558                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 559         }
 560
 561         hci_dev_unlock(hdev);
 562 }
 563
 564 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 565 {
 566         struct hci_rp_read_local_version *rp = (void *) skb->data;
 567
 568         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 569
 570         if (rp->status)
 571                 return;
 572
 573         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 574             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 575                 hdev->hci_ver = rp->hci_ver;
 576                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 577                 hdev->lmp_ver = rp->lmp_ver;
 578                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 579                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 580         }
 581 }
 582
 583 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 584                                        struct sk_buff *skb)
 585 {
 586         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 587
 588         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 589
 590         if (rp->status)
 591                 return;
 592
 593         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 594             hci_dev_test_flag(hdev, HCI_CONFIG))
 595                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 596 }
 597
 598 static void hci_cc_read_local_features(struct hci_dev *hdev,
 599                                        struct sk_buff *skb)
 600 {
 601         struct hci_rp_read_local_features *rp = (void *) skb->data;
 602
 603         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 604
 605         if (rp->status)
 606                 return;
 607
 608         memcpy(hdev->features, rp->features, 8);
 609
 610         /* Adjust default settings according to features
 611          * supported by device. */
 612
 613         if (hdev->features[0][0] & LMP_3SLOT)
 614                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 615
 616         if (hdev->features[0][0] & LMP_5SLOT)
 617                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 618
 619         if (hdev->features[0][1] & LMP_HV2) {
 620                 hdev->pkt_type  |= (HCI_HV2);
 621                 hdev->esco_type |= (ESCO_HV2);
 622         }
 623
 624         if (hdev->features[0][1] & LMP_HV3) {
 625                 hdev->pkt_type  |= (HCI_HV3);
 626                 hdev->esco_type |= (ESCO_HV3);
 627         }
 628
 629         if (lmp_esco_capable(hdev))
 630                 hdev->esco_type |= (ESCO_EV3);
 631
 632         if (hdev->features[0][4] & LMP_EV4)
 633                 hdev->esco_type |= (ESCO_EV4);
 634
 635         if (hdev->features[0][4] & LMP_EV5)
 636                 hdev->esco_type |= (ESCO_EV5);
 637
 638         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 639                 hdev->esco_type |= (ESCO_2EV3);
 640
 641         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 642                 hdev->esco_type |= (ESCO_3EV3);
 643
 644         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 645                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 646 }
 647
 648 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 649                                            struct sk_buff *skb)
 650 {
 651         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 652
 653         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 654
 655         if (rp->status)
 656                 return;
 657
 658         if (hdev->max_page < rp->max_page)
 659                 hdev->max_page = rp->max_page;
 660
 661         if (rp->page < HCI_MAX_PAGES)
 662                 memcpy(hdev->features[rp->page], rp->features, 8);
 663 }
 664
 665 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 666                                           struct sk_buff *skb)
 667 {
 668         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 669
 670         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 671
 672         if (rp->status)
 673                 return;
 674
 675         hdev->flow_ctl_mode = rp->mode;
 676 }
 677
 678 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 679 {
 680         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 681
 682         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 683
 684         if (rp->status)
 685                 return;
 686
 687         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 688         hdev->sco_mtu  = rp->sco_mtu;
 689         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 690         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 691
 692         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 693                 hdev->sco_mtu  = 64;
 694                 hdev->sco_pkts = 8;
 695         }
 696
 697         hdev->acl_cnt = hdev->acl_pkts;
 698         hdev->sco_cnt = hdev->sco_pkts;
 699
 700         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 701                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 702 }
 703
 704 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 705 {
 706         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 707
 708         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 709
 710         if (rp->status)
 711                 return;
 712
 713         if (test_bit(HCI_INIT, &hdev->flags))
 714                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 715
 716         if (hci_dev_test_flag(hdev, HCI_SETUP))
 717                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 718 }
 719
 720 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 721                                            struct sk_buff *skb)
 722 {
 723         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 724
 725         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 726
 727         if (rp->status)
 728                 return;
 729
 730         if (test_bit(HCI_INIT, &hdev->flags)) {
 731                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 732                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 733         }
 734 }
 735
 736 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 737                                             struct sk_buff *skb)
 738 {
 739         u8 status = *((u8 *) skb->data);
 740         struct hci_cp_write_page_scan_activity *sent;
 741
 742         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 743
 744         if (status)
 745                 return;
 746
 747         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 748         if (!sent)
 749                 return;
 750
 751         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 752         hdev->page_scan_window = __le16_to_cpu(sent->window);
 753 }
 754
 755 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 756                                            struct sk_buff *skb)
 757 {
 758         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 759
 760         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 761
 762         if (rp->status)
 763                 return;
 764
 765         if (test_bit(HCI_INIT, &hdev->flags))
 766                 hdev->page_scan_type = rp->type;
 767 }
 768
 769 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 770                                         struct sk_buff *skb)
 771 {
 772         u8 status = *((u8 *) skb->data);
 773         u8 *type;
 774
 775         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 776
 777         if (status)
 778                 return;
 779
 780         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 781         if (type)
 782                 hdev->page_scan_type = *type;
 783 }
 784
 785 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 786                                         struct sk_buff *skb)
 787 {
 788         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 789
 790         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 791
 792         if (rp->status)
 793                 return;
 794
 795         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 796         hdev->block_len = __le16_to_cpu(rp->block_len);
 797         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 798
 799         hdev->block_cnt = hdev->num_blocks;
 800
 801         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 802                hdev->block_cnt, hdev->block_len);
 803 }
 804
 805 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 806 {
 807         struct hci_rp_read_clock *rp = (void *) skb->data;
 808         struct hci_cp_read_clock *cp;
 809         struct hci_conn *conn;
 810
 811         BT_DBG("%s", hdev->name);
 812
 813         if (skb->len < sizeof(*rp))
 814                 return;
 815
 816         if (rp->status)
 817                 return;
 818
 819         hci_dev_lock(hdev);
 820
 821         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 822         if (!cp)
 823                 goto unlock;
 824
 825         if (cp->which == 0x00) {
 826                 hdev->clock = le32_to_cpu(rp->clock);
 827                 goto unlock;
 828         }
 829
 830         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 831         if (conn) {
 832                 conn->clock = le32_to_cpu(rp->clock);
 833                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 834         }
 835
 836 unlock:
 837         hci_dev_unlock(hdev);
 838 }
 839
 840 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 841                                        struct sk_buff *skb)
 842 {
 843         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 844
 845         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 846
 847         if (rp->status)
 848                 return;
 849
 850         hdev->amp_status = rp->amp_status;
 851         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 852         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 853         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 854         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 855         hdev->amp_type = rp->amp_type;
 856         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 857         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 858         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 859         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 860 }
 861
 862 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 863                                          struct sk_buff *skb)
 864 {
 865         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 866
 867         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 868
 869         if (rp->status)
 870                 return;
 871
 872         hdev->inq_tx_power = rp->tx_power;
 873 }
 874
 875 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 876 {
 877         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 878         struct hci_cp_pin_code_reply *cp;
 879         struct hci_conn *conn;
 880
 881         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 882
 883         hci_dev_lock(hdev);
 884
 885         if (hci_dev_test_flag(hdev, HCI_MGMT))
 886                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 887
 888         if (rp->status)
 889                 goto unlock;
 890
 891         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 892         if (!cp)
 893                 goto unlock;
 894
 895         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 896         if (conn)
 897                 conn->pin_length = cp->pin_len;
 898
 899 unlock:
 900         hci_dev_unlock(hdev);
 901 }
 902
 903 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 904 {
 905         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 906
 907         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 908
 909         hci_dev_lock(hdev);
 910
 911         if (hci_dev_test_flag(hdev, HCI_MGMT))
 912                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 913                                                  rp->status);
 914
 915         hci_dev_unlock(hdev);
 916 }
 917
 918 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 919                                        struct sk_buff *skb)
 920 {
 921         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 922
 923         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 924
 925         if (rp->status)
 926                 return;
 927
 928         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 929         hdev->le_pkts = rp->le_max_pkt;
 930
 931         hdev->le_cnt = hdev->le_pkts;
 932
 933         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 934 }
 935
 936 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 937                                           struct sk_buff *skb)
 938 {
 939         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 940
 941         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 942
 943         if (rp->status)
 944                 return;
 945
 946         memcpy(hdev->le_features, rp->features, 8);
 947 }
 948
 949 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 950                                         struct sk_buff *skb)
 951 {
 952         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 953
 954         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 955
 956         if (rp->status)
 957                 return;
 958
 959         hdev->adv_tx_power = rp->tx_power;
 960 }
 961
 962 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (hci_dev_test_flag(hdev, HCI_MGMT))
 971                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 972                                                  rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 978                                           struct sk_buff *skb)
 979 {
 980         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 981
 982         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 983
 984         hci_dev_lock(hdev);
 985
 986         if (hci_dev_test_flag(hdev, HCI_MGMT))
 987                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 988                                                      ACL_LINK, 0, rp->status);
 989
 990         hci_dev_unlock(hdev);
 991 }
 992
 993 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 994 {
 995         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 996
 997         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 998
 999         hci_dev_lock(hdev);
1000
1001         if (hci_dev_test_flag(hdev, HCI_MGMT))
1002                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1003                                                  0, rp->status);
1004
1005         hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1009                                           struct sk_buff *skb)
1010 {
1011         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1012
1013         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1014
1015         hci_dev_lock(hdev);
1016
1017         if (hci_dev_test_flag(hdev, HCI_MGMT))
1018                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1019                                                      ACL_LINK, 0, rp->status);
1020
1021         hci_dev_unlock(hdev);
1022 }
1023
1024 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1025                                        struct sk_buff *skb)
1026 {
1027         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1028
1029         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1030 }
1031
1032 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1033                                            struct sk_buff *skb)
1034 {
1035         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1036
1037         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1038 }
1039
1040 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1041 {
1042         __u8 status = *((__u8 *) skb->data);
1043         bdaddr_t *sent;
1044
1045         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1046
1047         if (status)
1048                 return;
1049
1050         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1051         if (!sent)
1052                 return;
1053
1054         hci_dev_lock(hdev);
1055
1056         bacpy(&hdev->random_addr, sent);
1057
1058         hci_dev_unlock(hdev);
1059 }
1060
1061 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1062 {
1063         __u8 *sent, status = *((__u8 *) skb->data);
1064
1065         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1066
1067         if (status)
1068                 return;
1069
1070         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1071         if (!sent)
1072                 return;
1073
1074         hci_dev_lock(hdev);
1075
1076         /* If we're doing connection initiation as peripheral. Set a
1077          * timeout in case something goes wrong.
1078          */
1079         if (*sent) {
1080                 struct hci_conn *conn;
1081
1082                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1083
1084                 conn = hci_lookup_le_connect(hdev);
1085                 if (conn)
1086                         queue_delayed_work(hdev->workqueue,
1087                                            &conn->le_conn_timeout,
1088                                            conn->conn_timeout);
1089         } else {
1090                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1091         }
1092
1093         hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098         struct hci_cp_le_set_scan_param *cp;
1099         __u8 status = *((__u8 *) skb->data);
1100
1101         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1102
1103         if (status)
1104                 return;
1105
1106         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1107         if (!cp)
1108                 return;
1109
1110         hci_dev_lock(hdev);
1111
1112         hdev->le_scan_type = cp->type;
1113
1114         hci_dev_unlock(hdev);
1115 }
1116
1117 static bool has_pending_adv_report(struct hci_dev *hdev)
1118 {
1119         struct discovery_state *d = &hdev->discovery;
1120
1121         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1122 }
1123
1124 static void clear_pending_adv_report(struct hci_dev *hdev)
1125 {
1126         struct discovery_state *d = &hdev->discovery;
1127
1128         bacpy(&d->last_adv_addr, BDADDR_ANY);
1129         d->last_adv_data_len = 0;
1130 }
1131
1132 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1133                                      u8 bdaddr_type, s8 rssi, u32 flags,
1134                                      u8 *data, u8 len)
1135 {
1136         struct discovery_state *d = &hdev->discovery;
1137
1138         if (len > HCI_MAX_AD_LENGTH)
1139                 return;
1140
1141         bacpy(&d->last_adv_addr, bdaddr);
1142         d->last_adv_addr_type = bdaddr_type;
1143         d->last_adv_rssi = rssi;
1144         d->last_adv_flags = flags;
1145         memcpy(d->last_adv_data, data, len);
1146         d->last_adv_data_len = len;
1147 }
1148
1149 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1150                                       struct sk_buff *skb)
1151 {
1152         struct hci_cp_le_set_scan_enable *cp;
1153         __u8 status = *((__u8 *) skb->data);
1154
1155         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1156
1157         if (status)
1158                 return;
1159
1160         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1161         if (!cp)
1162                 return;
1163
1164         hci_dev_lock(hdev);
1165
1166         switch (cp->enable) {
1167         case LE_SCAN_ENABLE:
1168                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1169                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1170                         clear_pending_adv_report(hdev);
1171                 break;
1172
1173         case LE_SCAN_DISABLE:
1174                 /* We do this here instead of when setting DISCOVERY_STOPPED
1175                  * since the latter would potentially require waiting for
1176                  * inquiry to stop too.
1177                  */
1178                 if (has_pending_adv_report(hdev)) {
1179                         struct discovery_state *d = &hdev->discovery;
1180
1181                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1182                                           d->last_adv_addr_type, NULL,
1183                                           d->last_adv_rssi, d->last_adv_flags,
1184                                           d->last_adv_data,
1185                                           d->last_adv_data_len, NULL, 0);
1186                 }
1187
1188                 /* Cancel this timer so that we don't try to disable scanning
1189                  * when it's already disabled.
1190                  */
1191                 cancel_delayed_work(&hdev->le_scan_disable);
1192
1193                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1194
1195                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1196                  * interrupted scanning due to a connect request. Mark
1197                  * therefore discovery as stopped. If this was not
1198                  * because of a connect request advertising might have
1199                  * been disabled because of active scanning, so
1200                  * re-enable it again if necessary.
1201                  */
1202                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1203                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1204                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1205                          hdev->discovery.state == DISCOVERY_FINDING)
1206                         hci_req_reenable_advertising(hdev);
1207
1208                 break;
1209
1210         default:
1211                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1212                 break;
1213         }
1214
1215         hci_dev_unlock(hdev);
1216 }
1217
1218 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1219                                            struct sk_buff *skb)
1220 {
1221         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1222
1223         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1224
1225         if (rp->status)
1226                 return;
1227
1228         hdev->le_white_list_size = rp->size;
1229 }
1230
1231 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1232                                        struct sk_buff *skb)
1233 {
1234         __u8 status = *((__u8 *) skb->data);
1235
1236         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1237
1238         if (status)
1239                 return;
1240
1241         hci_bdaddr_list_clear(&hdev->le_white_list);
1242 }
1243
1244 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1245                                         struct sk_buff *skb)
1246 {
1247         struct hci_cp_le_add_to_white_list *sent;
1248         __u8 status = *((__u8 *) skb->data);
1249
1250         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1251
1252         if (status)
1253                 return;
1254
1255         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1256         if (!sent)
1257                 return;
1258
1259         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1260                            sent->bdaddr_type);
1261 }
1262
1263 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1264                                           struct sk_buff *skb)
1265 {
1266         struct hci_cp_le_del_from_white_list *sent;
1267         __u8 status = *((__u8 *) skb->data);
1268
1269         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1270
1271         if (status)
1272                 return;
1273
1274         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1275         if (!sent)
1276                 return;
1277
1278         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1279                             sent->bdaddr_type);
1280 }
1281
1282 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1283                                             struct sk_buff *skb)
1284 {
1285         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1286
1287         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1288
1289         if (rp->status)
1290                 return;
1291
1292         memcpy(hdev->le_states, rp->le_states, 8);
1293 }
1294
1295 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1296                                         struct sk_buff *skb)
1297 {
1298         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1299
1300         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1301
1302         if (rp->status)
1303                 return;
1304
1305         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1306         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1307 }
1308
1309 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1310                                          struct sk_buff *skb)
1311 {
1312         struct hci_cp_le_write_def_data_len *sent;
1313         __u8 status = *((__u8 *) skb->data);
1314
1315         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1316
1317         if (status)
1318                 return;
1319
1320         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1321         if (!sent)
1322                 return;
1323
1324         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1325         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1326 }
1327
1328 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1329                                         struct sk_buff *skb)
1330 {
1331         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1332
1333         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1334
1335         if (rp->status)
1336                 return;
1337
1338         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1339         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1340         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1341         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1342 }
1343
1344 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1345                                            struct sk_buff *skb)
1346 {
1347         struct hci_cp_write_le_host_supported *sent;
1348         __u8 status = *((__u8 *) skb->data);
1349
1350         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1351
1352         if (status)
1353                 return;
1354
1355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1356         if (!sent)
1357                 return;
1358
1359         hci_dev_lock(hdev);
1360
1361         if (sent->le) {
1362                 hdev->features[1][0] |= LMP_HOST_LE;
1363                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1364         } else {
1365                 hdev->features[1][0] &= ~LMP_HOST_LE;
1366                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1367                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1368         }
1369
1370         if (sent->simul)
1371                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1372         else
1373                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1374
1375         hci_dev_unlock(hdev);
1376 }
1377
1378 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1379 {
1380         struct hci_cp_le_set_adv_param *cp;
1381         u8 status = *((u8 *) skb->data);
1382
1383         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1384
1385         if (status)
1386                 return;
1387
1388         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1389         if (!cp)
1390                 return;
1391
1392         hci_dev_lock(hdev);
1393         hdev->adv_addr_type = cp->own_address_type;
1394         hci_dev_unlock(hdev);
1395 }
1396
1397 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1398 {
1399         struct hci_rp_read_rssi *rp = (void *) skb->data;
1400         struct hci_conn *conn;
1401
1402         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1403
1404         if (rp->status)
1405                 return;
1406
1407         hci_dev_lock(hdev);
1408
1409         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1410         if (conn)
1411                 conn->rssi = rp->rssi;
1412
1413         hci_dev_unlock(hdev);
1414 }
1415
1416 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1417 {
1418         struct hci_cp_read_tx_power *sent;
1419         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1420         struct hci_conn *conn;
1421
1422         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1423
1424         if (rp->status)
1425                 return;
1426
1427         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1428         if (!sent)
1429                 return;
1430
1431         hci_dev_lock(hdev);
1432
1433         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1434         if (!conn)
1435                 goto unlock;
1436
1437         switch (sent->type) {
1438         case 0x00:
1439                 conn->tx_power = rp->tx_power;
1440                 break;
1441         case 0x01:
1442                 conn->max_tx_power = rp->tx_power;
1443                 break;
1444         }
1445
1446 unlock:
1447         hci_dev_unlock(hdev);
1448 }
1449
1450 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1451 {
1452         u8 status = *((u8 *) skb->data);
1453         u8 *mode;
1454
1455         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1456
1457         if (status)
1458                 return;
1459
1460         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1461         if (mode)
1462                 hdev->ssp_debug_mode = *mode;
1463 }
1464
1465 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1466 {
1467         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1468
1469         if (status) {
1470                 hci_conn_check_pending(hdev);
1471                 return;
1472         }
1473
1474         set_bit(HCI_INQUIRY, &hdev->flags);
1475 }
1476
1477 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1478 {
1479         struct hci_cp_create_conn *cp;
1480         struct hci_conn *conn;
1481
1482         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1483
1484         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1485         if (!cp)
1486                 return;
1487
1488         hci_dev_lock(hdev);
1489
1490         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1491
1492         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1493
1494         if (status) {
1495                 if (conn && conn->state == BT_CONNECT) {
1496                         if (status != 0x0c || conn->attempt > 2) {
1497                                 conn->state = BT_CLOSED;
1498                                 hci_connect_cfm(conn, status);
1499                                 hci_conn_del(conn);
1500                         } else
1501                                 conn->state = BT_CONNECT2;
1502                 }
1503         } else {
1504                 if (!conn) {
1505                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1506                                             HCI_ROLE_MASTER);
1507                         if (!conn)
1508                                 BT_ERR("No memory for new connection");
1509                 }
1510         }
1511
1512         hci_dev_unlock(hdev);
1513 }
1514
1515 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1516 {
1517         struct hci_cp_add_sco *cp;
1518         struct hci_conn *acl, *sco;
1519         __u16 handle;
1520
1521         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1522
1523         if (!status)
1524                 return;
1525
1526         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1527         if (!cp)
1528                 return;
1529
1530         handle = __le16_to_cpu(cp->handle);
1531
1532         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1533
1534         hci_dev_lock(hdev);
1535
1536         acl = hci_conn_hash_lookup_handle(hdev, handle);
1537         if (acl) {
1538                 sco = acl->link;
1539                 if (sco) {
1540                         sco->state = BT_CLOSED;
1541
1542                         hci_connect_cfm(sco, status);
1543                         hci_conn_del(sco);
1544                 }
1545         }
1546
1547         hci_dev_unlock(hdev);
1548 }
1549
1550 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1551 {
1552         struct hci_cp_auth_requested *cp;
1553         struct hci_conn *conn;
1554
1555         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1556
1557         if (!status)
1558                 return;
1559
1560         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1561         if (!cp)
1562                 return;
1563
1564         hci_dev_lock(hdev);
1565
1566         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1567         if (conn) {
1568                 if (conn->state == BT_CONFIG) {
1569                         hci_connect_cfm(conn, status);
1570                         hci_conn_drop(conn);
1571                 }
1572         }
1573
1574         hci_dev_unlock(hdev);
1575 }
1576
1577 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1578 {
1579         struct hci_cp_set_conn_encrypt *cp;
1580         struct hci_conn *conn;
1581
1582         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1583
1584         if (!status)
1585                 return;
1586
1587         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1588         if (!cp)
1589                 return;
1590
1591         hci_dev_lock(hdev);
1592
1593         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1594         if (conn) {
1595                 if (conn->state == BT_CONFIG) {
1596                         hci_connect_cfm(conn, status);
1597                         hci_conn_drop(conn);
1598                 }
1599         }
1600
1601         hci_dev_unlock(hdev);
1602 }
1603
1604 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1605                                     struct hci_conn *conn)
1606 {
1607         if (conn->state != BT_CONFIG || !conn->out)
1608                 return 0;
1609
1610         if (conn->pending_sec_level == BT_SECURITY_SDP)
1611                 return 0;
1612
1613         /* Only request authentication for SSP connections or non-SSP
1614          * devices with sec_level MEDIUM or HIGH or if MITM protection
1615          * is requested.
1616          */
1617         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1618             conn->pending_sec_level != BT_SECURITY_FIPS &&
1619             conn->pending_sec_level != BT_SECURITY_HIGH &&
1620             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1621                 return 0;
1622
1623         return 1;
1624 }
1625
1626 static int hci_resolve_name(struct hci_dev *hdev,
1627                                    struct inquiry_entry *e)
1628 {
1629         struct hci_cp_remote_name_req cp;
1630
1631         memset(&cp, 0, sizeof(cp));
1632
1633         bacpy(&cp.bdaddr, &e->data.bdaddr);
1634         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1635         cp.pscan_mode = e->data.pscan_mode;
1636         cp.clock_offset = e->data.clock_offset;
1637
1638         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1639 }
1640
1641 static bool hci_resolve_next_name(struct hci_dev *hdev)
1642 {
1643         struct discovery_state *discov = &hdev->discovery;
1644         struct inquiry_entry *e;
1645
1646         if (list_empty(&discov->resolve))
1647                 return false;
1648
1649         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1650         if (!e)
1651                 return false;
1652
1653         if (hci_resolve_name(hdev, e) == 0) {
1654                 e->name_state = NAME_PENDING;
1655                 return true;
1656         }
1657
1658         return false;
1659 }
1660
1661 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1662                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1663 {
1664         struct discovery_state *discov = &hdev->discovery;
1665         struct inquiry_entry *e;
1666
1667         /* Update the mgmt connected state if necessary. Be careful with
1668          * conn objects that exist but are not (yet) connected however.
1669          * Only those in BT_CONFIG or BT_CONNECTED states can be
1670          * considered connected.
1671          */
1672         if (conn &&
1673             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1674             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1675                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1676
1677         if (discov->state == DISCOVERY_STOPPED)
1678                 return;
1679
1680         if (discov->state == DISCOVERY_STOPPING)
1681                 goto discov_complete;
1682
1683         if (discov->state != DISCOVERY_RESOLVING)
1684                 return;
1685
1686         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1687         /* If the device was not found in a list of found devices names of which
1688          * are pending. there is no need to continue resolving a next name as it
1689          * will be done upon receiving another Remote Name Request Complete
1690          * Event */
1691         if (!e)
1692                 return;
1693
1694         list_del(&e->list);
1695         if (name) {
1696                 e->name_state = NAME_KNOWN;
1697                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1698                                  e->data.rssi, name, name_len);
1699         } else {
1700                 e->name_state = NAME_NOT_KNOWN;
1701         }
1702
1703         if (hci_resolve_next_name(hdev))
1704                 return;
1705
1706 discov_complete:
1707         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1708 }
1709
1710 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1711 {
1712         struct hci_cp_remote_name_req *cp;
1713         struct hci_conn *conn;
1714
1715         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1716
1717         /* If successful wait for the name req complete event before
1718          * checking for the need to do authentication */
1719         if (!status)
1720                 return;
1721
1722         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1723         if (!cp)
1724                 return;
1725
1726         hci_dev_lock(hdev);
1727
1728         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1729
1730         if (hci_dev_test_flag(hdev, HCI_MGMT))
1731                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1732
1733         if (!conn)
1734                 goto unlock;
1735
1736         if (!hci_outgoing_auth_needed(hdev, conn))
1737                 goto unlock;
1738
1739         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1740                 struct hci_cp_auth_requested auth_cp;
1741
1742                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1743
1744                 auth_cp.handle = __cpu_to_le16(conn->handle);
1745                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1746                              sizeof(auth_cp), &auth_cp);
1747         }
1748
1749 unlock:
1750         hci_dev_unlock(hdev);
1751 }
1752
1753 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1754 {
1755         struct hci_cp_read_remote_features *cp;
1756         struct hci_conn *conn;
1757
1758         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1759
1760         if (!status)
1761                 return;
1762
1763         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1764         if (!cp)
1765                 return;
1766
1767         hci_dev_lock(hdev);
1768
1769         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1770         if (conn) {
1771                 if (conn->state == BT_CONFIG) {
1772                         hci_connect_cfm(conn, status);
1773                         hci_conn_drop(conn);
1774                 }
1775         }
1776
1777         hci_dev_unlock(hdev);
1778 }
1779
1780 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1781 {
1782         struct hci_cp_read_remote_ext_features *cp;
1783         struct hci_conn *conn;
1784
1785         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1786
1787         if (!status)
1788                 return;
1789
1790         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1791         if (!cp)
1792                 return;
1793
1794         hci_dev_lock(hdev);
1795
1796         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1797         if (conn) {
1798                 if (conn->state == BT_CONFIG) {
1799                         hci_connect_cfm(conn, status);
1800                         hci_conn_drop(conn);
1801                 }
1802         }
1803
1804         hci_dev_unlock(hdev);
1805 }
1806
1807 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1808 {
1809         struct hci_cp_setup_sync_conn *cp;
1810         struct hci_conn *acl, *sco;
1811         __u16 handle;
1812
1813         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1814
1815         if (!status)
1816                 return;
1817
1818         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1819         if (!cp)
1820                 return;
1821
1822         handle = __le16_to_cpu(cp->handle);
1823
1824         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1825
1826         hci_dev_lock(hdev);
1827
1828         acl = hci_conn_hash_lookup_handle(hdev, handle);
1829         if (acl) {
1830                 sco = acl->link;
1831                 if (sco) {
1832                         sco->state = BT_CLOSED;
1833
1834                         hci_connect_cfm(sco, status);
1835                         hci_conn_del(sco);
1836                 }
1837         }
1838
1839         hci_dev_unlock(hdev);
1840 }
1841
1842 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1843 {
1844         struct hci_cp_sniff_mode *cp;
1845         struct hci_conn *conn;
1846
1847         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1848
1849         if (!status)
1850                 return;
1851
1852         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1853         if (!cp)
1854                 return;
1855
1856         hci_dev_lock(hdev);
1857
1858         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1859         if (conn) {
1860                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1861
1862                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1863                         hci_sco_setup(conn, status);
1864         }
1865
1866         hci_dev_unlock(hdev);
1867 }
1868
1869 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1870 {
1871         struct hci_cp_exit_sniff_mode *cp;
1872         struct hci_conn *conn;
1873
1874         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1875
1876         if (!status)
1877                 return;
1878
1879         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1880         if (!cp)
1881                 return;
1882
1883         hci_dev_lock(hdev);
1884
1885         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1886         if (conn) {
1887                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1888
1889                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1890                         hci_sco_setup(conn, status);
1891         }
1892
1893         hci_dev_unlock(hdev);
1894 }
1895
1896 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1897 {
1898         struct hci_cp_disconnect *cp;
1899         struct hci_conn *conn;
1900
1901         if (!status)
1902                 return;
1903
1904         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1905         if (!cp)
1906                 return;
1907
1908         hci_dev_lock(hdev);
1909
1910         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1911         if (conn)
1912                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
1913                                        conn->dst_type, status);
1914
1915         hci_dev_unlock(hdev);
1916 }
1917
1918 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
1919 {
1920         struct hci_cp_le_create_conn *cp;
1921         struct hci_conn *conn;
1922
1923         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1924
1925         /* All connection failure handling is taken care of by the
1926          * hci_le_conn_failed function which is triggered by the HCI
1927          * request completion callbacks used for connecting.
1928          */
1929         if (status)
1930                 return;
1931
1932         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1933         if (!cp)
1934                 return;
1935
1936         hci_dev_lock(hdev);
1937
1938         conn = hci_conn_hash_lookup_le(hdev, &cp->peer_addr,
1939                                        cp->peer_addr_type);
1940         if (!conn)
1941                 goto unlock;
1942
1943         /* Store the initiator and responder address information which
1944          * is needed for SMP. These values will not change during the
1945          * lifetime of the connection.
1946          */
1947         conn->init_addr_type = cp->own_address_type;
1948         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
1949                 bacpy(&conn->init_addr, &hdev->random_addr);
1950         else
1951                 bacpy(&conn->init_addr, &hdev->bdaddr);
1952
1953         conn->resp_addr_type = cp->peer_addr_type;
1954         bacpy(&conn->resp_addr, &cp->peer_addr);
1955
1956         /* We don't want the connection attempt to stick around
1957          * indefinitely since LE doesn't have a page timeout concept
1958          * like BR/EDR. Set a timer for any connection that doesn't use
1959          * the white list for connecting.
1960          */
1961         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
1962                 queue_delayed_work(conn->hdev->workqueue,
1963                                    &conn->le_conn_timeout,
1964                                    conn->conn_timeout);
1965
1966 unlock:
1967         hci_dev_unlock(hdev);
1968 }
1969
1970 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
1971 {
1972         struct hci_cp_le_read_remote_features *cp;
1973         struct hci_conn *conn;
1974
1975         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1976
1977         if (!status)
1978                 return;
1979
1980         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
1981         if (!cp)
1982                 return;
1983
1984         hci_dev_lock(hdev);
1985
1986         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1987         if (conn) {
1988                 if (conn->state == BT_CONFIG) {
1989                         hci_connect_cfm(conn, status);
1990                         hci_conn_drop(conn);
1991                 }
1992         }
1993
1994         hci_dev_unlock(hdev);
1995 }
1996
1997 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1998 {
1999         struct hci_cp_le_start_enc *cp;
2000         struct hci_conn *conn;
2001
2002         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2003
2004         if (!status)
2005                 return;
2006
2007         hci_dev_lock(hdev);
2008
2009         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2010         if (!cp)
2011                 goto unlock;
2012
2013         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2014         if (!conn)
2015                 goto unlock;
2016
2017         if (conn->state != BT_CONNECTED)
2018                 goto unlock;
2019
2020         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2021         hci_conn_drop(conn);
2022
2023 unlock:
2024         hci_dev_unlock(hdev);
2025 }
2026
2027 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2028 {
2029         struct hci_cp_switch_role *cp;
2030         struct hci_conn *conn;
2031
2032         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2033
2034         if (!status)
2035                 return;
2036
2037         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2038         if (!cp)
2039                 return;
2040
2041         hci_dev_lock(hdev);
2042
2043         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2044         if (conn)
2045                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2046
2047         hci_dev_unlock(hdev);
2048 }
2049
2050 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2051 {
2052         __u8 status = *((__u8 *) skb->data);
2053         struct discovery_state *discov = &hdev->discovery;
2054         struct inquiry_entry *e;
2055
2056         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2057
2058         hci_conn_check_pending(hdev);
2059
2060         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2061                 return;
2062
2063         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2064         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2065
2066         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2067                 return;
2068
2069         hci_dev_lock(hdev);
2070
2071         if (discov->state != DISCOVERY_FINDING)
2072                 goto unlock;
2073
2074         if (list_empty(&discov->resolve)) {
2075                 /* When BR/EDR inquiry is active and no LE scanning is in
2076                  * progress, then change discovery state to indicate completion.
2077                  *
2078                  * When running LE scanning and BR/EDR inquiry simultaneously
2079                  * and the LE scan already finished, then change the discovery
2080                  * state to indicate completion.
2081                  */
2082                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2083                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2084                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2085                 goto unlock;
2086         }
2087
2088         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2089         if (e && hci_resolve_name(hdev, e) == 0) {
2090                 e->name_state = NAME_PENDING;
2091                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2092         } else {
2093                 /* When BR/EDR inquiry is active and no LE scanning is in
2094                  * progress, then change discovery state to indicate completion.
2095                  *
2096                  * When running LE scanning and BR/EDR inquiry simultaneously
2097                  * and the LE scan already finished, then change the discovery
2098                  * state to indicate completion.
2099                  */
2100                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2101                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2102                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2103         }
2104
2105 unlock:
2106         hci_dev_unlock(hdev);
2107 }
2108
2109 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2110 {
2111         struct inquiry_data data;
2112         struct inquiry_info *info = (void *) (skb->data + 1);
2113         int num_rsp = *((__u8 *) skb->data);
2114
2115         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2116
2117         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2118                 return;
2119
2120         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2121                 return;
2122
2123         hci_dev_lock(hdev);
2124
2125         for (; num_rsp; num_rsp--, info++) {
2126                 u32 flags;
2127
2128                 bacpy(&data.bdaddr, &info->bdaddr);
2129                 data.pscan_rep_mode     = info->pscan_rep_mode;
2130                 data.pscan_period_mode  = info->pscan_period_mode;
2131                 data.pscan_mode         = info->pscan_mode;
2132                 memcpy(data.dev_class, info->dev_class, 3);
2133                 data.clock_offset       = info->clock_offset;
2134                 data.rssi               = HCI_RSSI_INVALID;
2135                 data.ssp_mode           = 0x00;
2136
2137                 flags = hci_inquiry_cache_update(hdev, &data, false);
2138
2139                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2140                                   info->dev_class, HCI_RSSI_INVALID,
2141                                   flags, NULL, 0, NULL, 0);
2142         }
2143
2144         hci_dev_unlock(hdev);
2145 }
2146
2147 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2148 {
2149         struct hci_ev_conn_complete *ev = (void *) skb->data;
2150         struct hci_conn *conn;
2151
2152         BT_DBG("%s", hdev->name);
2153
2154         hci_dev_lock(hdev);
2155
2156         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2157         if (!conn) {
2158                 if (ev->link_type != SCO_LINK)
2159                         goto unlock;
2160
2161                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2162                 if (!conn)
2163                         goto unlock;
2164
2165                 conn->type = SCO_LINK;
2166         }
2167
2168         if (!ev->status) {
2169                 conn->handle = __le16_to_cpu(ev->handle);
2170
2171                 if (conn->type == ACL_LINK) {
2172                         conn->state = BT_CONFIG;
2173                         hci_conn_hold(conn);
2174
2175                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2176                             !hci_find_link_key(hdev, &ev->bdaddr))
2177                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2178                         else
2179                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2180                 } else
2181                         conn->state = BT_CONNECTED;
2182
2183                 hci_debugfs_create_conn(conn);
2184                 hci_conn_add_sysfs(conn);
2185
2186                 if (test_bit(HCI_AUTH, &hdev->flags))
2187                         set_bit(HCI_CONN_AUTH, &conn->flags);
2188
2189                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2190                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2191
2192                 /* Get remote features */
2193                 if (conn->type == ACL_LINK) {
2194                         struct hci_cp_read_remote_features cp;
2195                         cp.handle = ev->handle;
2196                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2197                                      sizeof(cp), &cp);
2198
2199                         hci_req_update_scan(hdev);
2200                 }
2201
2202                 /* Set packet type for incoming connection */
2203                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2204                         struct hci_cp_change_conn_ptype cp;
2205                         cp.handle = ev->handle;
2206                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2207                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2208                                      &cp);
2209                 }
2210         } else {
2211                 conn->state = BT_CLOSED;
2212                 if (conn->type == ACL_LINK)
2213                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2214                                             conn->dst_type, ev->status);
2215         }
2216
2217         if (conn->type == ACL_LINK)
2218                 hci_sco_setup(conn, ev->status);
2219
2220         if (ev->status) {
2221                 hci_connect_cfm(conn, ev->status);
2222                 hci_conn_del(conn);
2223         } else if (ev->link_type != ACL_LINK)
2224                 hci_connect_cfm(conn, ev->status);
2225
2226 unlock:
2227         hci_dev_unlock(hdev);
2228
2229         hci_conn_check_pending(hdev);
2230 }
2231
2232 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2233 {
2234         struct hci_cp_reject_conn_req cp;
2235
2236         bacpy(&cp.bdaddr, bdaddr);
2237         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2238         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2239 }
2240
2241 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2242 {
2243         struct hci_ev_conn_request *ev = (void *) skb->data;
2244         int mask = hdev->link_mode;
2245         struct inquiry_entry *ie;
2246         struct hci_conn *conn;
2247         __u8 flags = 0;
2248
2249         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2250                ev->link_type);
2251
2252         /* Reject incoming connection from device with same BD ADDR against
2253          * CVE-2020-26555
2254          */
2255         if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
2256                 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
2257                            &ev->bdaddr);
2258                 hci_reject_conn(hdev, &ev->bdaddr);
2259                 return;
2260         }
2261
2262         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2263                                       &flags);
2264
2265         if (!(mask & HCI_LM_ACCEPT)) {
2266                 hci_reject_conn(hdev, &ev->bdaddr);
2267                 return;
2268         }
2269
2270         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2271                                    BDADDR_BREDR)) {
2272                 hci_reject_conn(hdev, &ev->bdaddr);
2273                 return;
2274         }
2275
2276         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2277          * connection. These features are only touched through mgmt so
2278          * only do the checks if HCI_MGMT is set.
2279          */
2280         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2281             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2282             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2283                                     BDADDR_BREDR)) {
2284                     hci_reject_conn(hdev, &ev->bdaddr);
2285                     return;
2286         }
2287
2288         /* Connection accepted */
2289
2290         hci_dev_lock(hdev);
2291
2292         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2293         if (ie)
2294                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2295
2296         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2297                         &ev->bdaddr);
2298         if (!conn) {
2299                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2300                                     HCI_ROLE_SLAVE);
2301                 if (!conn) {
2302                         BT_ERR("No memory for new connection");
2303                         hci_dev_unlock(hdev);
2304                         return;
2305                 }
2306         }
2307
2308         memcpy(conn->dev_class, ev->dev_class, 3);
2309
2310         hci_dev_unlock(hdev);
2311
2312         if (ev->link_type == ACL_LINK ||
2313             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2314                 struct hci_cp_accept_conn_req cp;
2315                 conn->state = BT_CONNECT;
2316
2317                 bacpy(&cp.bdaddr, &ev->bdaddr);
2318
2319                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2320                         cp.role = 0x00; /* Become master */
2321                 else
2322                         cp.role = 0x01; /* Remain slave */
2323
2324                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2325         } else if (!(flags & HCI_PROTO_DEFER)) {
2326                 struct hci_cp_accept_sync_conn_req cp;
2327                 conn->state = BT_CONNECT;
2328
2329                 bacpy(&cp.bdaddr, &ev->bdaddr);
2330                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2331
2332                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2333                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2334                 cp.max_latency    = cpu_to_le16(0xffff);
2335                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2336                 cp.retrans_effort = 0xff;
2337
2338                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2339                              &cp);
2340         } else {
2341                 conn->state = BT_CONNECT2;
2342                 hci_connect_cfm(conn, 0);
2343         }
2344 }
2345
2346 static u8 hci_to_mgmt_reason(u8 err)
2347 {
2348         switch (err) {
2349         case HCI_ERROR_CONNECTION_TIMEOUT:
2350                 return MGMT_DEV_DISCONN_TIMEOUT;
2351         case HCI_ERROR_REMOTE_USER_TERM:
2352         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2353         case HCI_ERROR_REMOTE_POWER_OFF:
2354                 return MGMT_DEV_DISCONN_REMOTE;
2355         case HCI_ERROR_LOCAL_HOST_TERM:
2356                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2357         default:
2358                 return MGMT_DEV_DISCONN_UNKNOWN;
2359         }
2360 }
2361
2362 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2363 {
2364         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2365         u8 reason;
2366         struct hci_conn_params *params;
2367         struct hci_conn *conn;
2368         bool mgmt_connected;
2369         u8 type;
2370
2371         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2372
2373         hci_dev_lock(hdev);
2374
2375         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2376         if (!conn)
2377                 goto unlock;
2378
2379         if (ev->status) {
2380                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2381                                        conn->dst_type, ev->status);
2382                 goto unlock;
2383         }
2384
2385         conn->state = BT_CLOSED;
2386
2387         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2388
2389         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2390                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2391         else
2392                 reason = hci_to_mgmt_reason(ev->reason);
2393
2394         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2395                                 reason, mgmt_connected);
2396
2397         if (conn->type == ACL_LINK) {
2398                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2399                         hci_remove_link_key(hdev, &conn->dst);
2400
2401                 hci_req_update_scan(hdev);
2402         }
2403
2404         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2405         if (params) {
2406                 switch (params->auto_connect) {
2407                 case HCI_AUTO_CONN_LINK_LOSS:
2408                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2409                                 break;
2410                         /* Fall through */
2411
2412                 case HCI_AUTO_CONN_DIRECT:
2413                 case HCI_AUTO_CONN_ALWAYS:
2414                         list_del_init(&params->action);
2415                         list_add(&params->action, &hdev->pend_le_conns);
2416                         hci_update_background_scan(hdev);
2417                         break;
2418
2419                 default:
2420                         break;
2421                 }
2422         }
2423
2424         type = conn->type;
2425
2426         hci_disconn_cfm(conn, ev->reason);
2427         hci_conn_del(conn);
2428
2429         /* Re-enable advertising if necessary, since it might
2430          * have been disabled by the connection. From the
2431          * HCI_LE_Set_Advertise_Enable command description in
2432          * the core specification (v4.0):
2433          * "The Controller shall continue advertising until the Host
2434          * issues an LE_Set_Advertise_Enable command with
2435          * Advertising_Enable set to 0x00 (Advertising is disabled)
2436          * or until a connection is created or until the Advertising
2437          * is timed out due to Directed Advertising."
2438          */
2439         if (type == LE_LINK)
2440                 hci_req_reenable_advertising(hdev);
2441
2442 unlock:
2443         hci_dev_unlock(hdev);
2444 }
2445
2446 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2447 {
2448         struct hci_ev_auth_complete *ev = (void *) skb->data;
2449         struct hci_conn *conn;
2450
2451         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2452
2453         hci_dev_lock(hdev);
2454
2455         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2456         if (!conn)
2457                 goto unlock;
2458
2459         if (!ev->status) {
2460                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2461
2462                 if (!hci_conn_ssp_enabled(conn) &&
2463                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2464                         BT_INFO("re-auth of legacy device is not possible.");
2465                 } else {
2466                         set_bit(HCI_CONN_AUTH, &conn->flags);
2467                         conn->sec_level = conn->pending_sec_level;
2468                 }
2469         } else {
2470                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2471                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2472
2473                 mgmt_auth_failed(conn, ev->status);
2474         }
2475
2476         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2477         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2478
2479         if (conn->state == BT_CONFIG) {
2480                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2481                         struct hci_cp_set_conn_encrypt cp;
2482                         cp.handle  = ev->handle;
2483                         cp.encrypt = 0x01;
2484                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2485                                      &cp);
2486                 } else {
2487                         conn->state = BT_CONNECTED;
2488                         hci_connect_cfm(conn, ev->status);
2489                         hci_conn_drop(conn);
2490                 }
2491         } else {
2492                 hci_auth_cfm(conn, ev->status);
2493
2494                 hci_conn_hold(conn);
2495                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2496                 hci_conn_drop(conn);
2497         }
2498
2499         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2500                 if (!ev->status) {
2501                         struct hci_cp_set_conn_encrypt cp;
2502                         cp.handle  = ev->handle;
2503                         cp.encrypt = 0x01;
2504                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2505                                      &cp);
2506                 } else {
2507                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2508                         hci_encrypt_cfm(conn, ev->status);
2509                 }
2510         }
2511
2512 unlock:
2513         hci_dev_unlock(hdev);
2514 }
2515
2516 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2517 {
2518         struct hci_ev_remote_name *ev = (void *) skb->data;
2519         struct hci_conn *conn;
2520
2521         BT_DBG("%s", hdev->name);
2522
2523         hci_conn_check_pending(hdev);
2524
2525         hci_dev_lock(hdev);
2526
2527         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2528
2529         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2530                 goto check_auth;
2531
2532         if (ev->status == 0)
2533                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2534                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2535         else
2536                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2537
2538 check_auth:
2539         if (!conn)
2540                 goto unlock;
2541
2542         if (!hci_outgoing_auth_needed(hdev, conn))
2543                 goto unlock;
2544
2545         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2546                 struct hci_cp_auth_requested cp;
2547
2548                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2549
2550                 cp.handle = __cpu_to_le16(conn->handle);
2551                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2552         }
2553
2554 unlock:
2555         hci_dev_unlock(hdev);
2556 }
2557
2558 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2559                                        u16 opcode, struct sk_buff *skb)
2560 {
2561         const struct hci_rp_read_enc_key_size *rp;
2562         struct hci_conn *conn;
2563         u16 handle;
2564
2565         BT_DBG("%s status 0x%02x", hdev->name, status);
2566
2567         if (!skb || skb->len < sizeof(*rp)) {
2568                 BT_ERR("%s invalid HCI Read Encryption Key Size response",
2569                        hdev->name);
2570                 return;
2571         }
2572
2573         rp = (void *)skb->data;
2574         handle = le16_to_cpu(rp->handle);
2575
2576         hci_dev_lock(hdev);
2577
2578         conn = hci_conn_hash_lookup_handle(hdev, handle);
2579         if (!conn)
2580                 goto unlock;
2581
2582         /* If we fail to read the encryption key size, assume maximum
2583          * (which is the same we do also when this HCI command isn't
2584          * supported.
2585          */
2586         if (rp->status) {
2587                 BT_ERR("%s failed to read key size for handle %u", hdev->name,
2588                        handle);
2589                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2590         } else {
2591                 conn->enc_key_size = rp->key_size;
2592         }
2593
2594         hci_encrypt_cfm(conn, 0);
2595
2596 unlock:
2597         hci_dev_unlock(hdev);
2598 }
2599
2600 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2601 {
2602         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2603         struct hci_conn *conn;
2604
2605         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2606
2607         hci_dev_lock(hdev);
2608
2609         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2610         if (!conn)
2611                 goto unlock;
2612
2613         if (!ev->status) {
2614                 if (ev->encrypt) {
2615                         /* Encryption implies authentication */
2616                         set_bit(HCI_CONN_AUTH, &conn->flags);
2617                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2618                         conn->sec_level = conn->pending_sec_level;
2619
2620                         /* P-256 authentication key implies FIPS */
2621                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2622                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2623
2624                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2625                             conn->type == LE_LINK)
2626                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2627                 } else {
2628                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2629                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2630                 }
2631         }
2632
2633         /* We should disregard the current RPA and generate a new one
2634          * whenever the encryption procedure fails.
2635          */
2636         if (ev->status && conn->type == LE_LINK)
2637                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2638
2639         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2640
2641         /* Check link security requirements are met */
2642         if (!hci_conn_check_link_mode(conn))
2643                 ev->status = HCI_ERROR_AUTH_FAILURE;
2644
2645         if (ev->status && conn->state == BT_CONNECTED) {
2646                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2647                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2648
2649                 /* Notify upper layers so they can cleanup before
2650                  * disconnecting.
2651                  */
2652                 hci_encrypt_cfm(conn, ev->status);
2653                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2654                 hci_conn_drop(conn);
2655                 goto unlock;
2656         }
2657
2658         /* Try reading the encryption key size for encrypted ACL links */
2659         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
2660                 struct hci_cp_read_enc_key_size cp;
2661                 struct hci_request req;
2662
2663                 /* Only send HCI_Read_Encryption_Key_Size if the
2664                  * controller really supports it. If it doesn't, assume
2665                  * the default size (16).
2666                  */
2667                 if (!(hdev->commands[20] & 0x10)) {
2668                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2669                         goto notify;
2670                 }
2671
2672                 hci_req_init(&req, hdev);
2673
2674                 cp.handle = cpu_to_le16(conn->handle);
2675                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
2676
2677                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
2678                         BT_ERR("Sending HCI Read Encryption Key Size failed");
2679                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
2680                         goto notify;
2681                 }
2682
2683                 goto unlock;
2684         }
2685
2686 notify:
2687         hci_encrypt_cfm(conn, ev->status);
2688
2689 unlock:
2690         hci_dev_unlock(hdev);
2691 }
2692
2693 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2694                                              struct sk_buff *skb)
2695 {
2696         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2697         struct hci_conn *conn;
2698
2699         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2700
2701         hci_dev_lock(hdev);
2702
2703         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2704         if (conn) {
2705                 if (!ev->status)
2706                         set_bit(HCI_CONN_SECURE, &conn->flags);
2707
2708                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2709
2710                 hci_key_change_cfm(conn, ev->status);
2711         }
2712
2713         hci_dev_unlock(hdev);
2714 }
2715
2716 static void hci_remote_features_evt(struct hci_dev *hdev,
2717                                     struct sk_buff *skb)
2718 {
2719         struct hci_ev_remote_features *ev = (void *) skb->data;
2720         struct hci_conn *conn;
2721
2722         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2723
2724         hci_dev_lock(hdev);
2725
2726         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2727         if (!conn)
2728                 goto unlock;
2729
2730         if (!ev->status)
2731                 memcpy(conn->features[0], ev->features, 8);
2732
2733         if (conn->state != BT_CONFIG)
2734                 goto unlock;
2735
2736         if (!ev->status && lmp_ext_feat_capable(hdev) &&
2737             lmp_ext_feat_capable(conn)) {
2738                 struct hci_cp_read_remote_ext_features cp;
2739                 cp.handle = ev->handle;
2740                 cp.page = 0x01;
2741                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2742                              sizeof(cp), &cp);
2743                 goto unlock;
2744         }
2745
2746         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2747                 struct hci_cp_remote_name_req cp;
2748                 memset(&cp, 0, sizeof(cp));
2749                 bacpy(&cp.bdaddr, &conn->dst);
2750                 cp.pscan_rep_mode = 0x02;
2751                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2752         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2753                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2754
2755         if (!hci_outgoing_auth_needed(hdev, conn)) {
2756                 conn->state = BT_CONNECTED;
2757                 hci_connect_cfm(conn, ev->status);
2758                 hci_conn_drop(conn);
2759         }
2760
2761 unlock:
2762         hci_dev_unlock(hdev);
2763 }
2764
2765 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
2766                                  u16 *opcode, u8 *status,
2767                                  hci_req_complete_t *req_complete,
2768                                  hci_req_complete_skb_t *req_complete_skb)
2769 {
2770         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2771
2772         *opcode = __le16_to_cpu(ev->opcode);
2773         *status = skb->data[sizeof(*ev)];
2774
2775         skb_pull(skb, sizeof(*ev));
2776
2777         switch (*opcode) {
2778         case HCI_OP_INQUIRY_CANCEL:
2779                 hci_cc_inquiry_cancel(hdev, skb, status);
2780                 break;
2781
2782         case HCI_OP_PERIODIC_INQ:
2783                 hci_cc_periodic_inq(hdev, skb);
2784                 break;
2785
2786         case HCI_OP_EXIT_PERIODIC_INQ:
2787                 hci_cc_exit_periodic_inq(hdev, skb);
2788                 break;
2789
2790         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2791                 hci_cc_remote_name_req_cancel(hdev, skb);
2792                 break;
2793
2794         case HCI_OP_ROLE_DISCOVERY:
2795                 hci_cc_role_discovery(hdev, skb);
2796                 break;
2797
2798         case HCI_OP_READ_LINK_POLICY:
2799                 hci_cc_read_link_policy(hdev, skb);
2800                 break;
2801
2802         case HCI_OP_WRITE_LINK_POLICY:
2803                 hci_cc_write_link_policy(hdev, skb);
2804                 break;
2805
2806         case HCI_OP_READ_DEF_LINK_POLICY:
2807                 hci_cc_read_def_link_policy(hdev, skb);
2808                 break;
2809
2810         case HCI_OP_WRITE_DEF_LINK_POLICY:
2811                 hci_cc_write_def_link_policy(hdev, skb);
2812                 break;
2813
2814         case HCI_OP_RESET:
2815                 hci_cc_reset(hdev, skb);
2816                 break;
2817
2818         case HCI_OP_READ_STORED_LINK_KEY:
2819                 hci_cc_read_stored_link_key(hdev, skb);
2820                 break;
2821
2822         case HCI_OP_DELETE_STORED_LINK_KEY:
2823                 hci_cc_delete_stored_link_key(hdev, skb);
2824                 break;
2825
2826         case HCI_OP_WRITE_LOCAL_NAME:
2827                 hci_cc_write_local_name(hdev, skb);
2828                 break;
2829
2830         case HCI_OP_READ_LOCAL_NAME:
2831                 hci_cc_read_local_name(hdev, skb);
2832                 break;
2833
2834         case HCI_OP_WRITE_AUTH_ENABLE:
2835                 hci_cc_write_auth_enable(hdev, skb);
2836                 break;
2837
2838         case HCI_OP_WRITE_ENCRYPT_MODE:
2839                 hci_cc_write_encrypt_mode(hdev, skb);
2840                 break;
2841
2842         case HCI_OP_WRITE_SCAN_ENABLE:
2843                 hci_cc_write_scan_enable(hdev, skb);
2844                 break;
2845
2846         case HCI_OP_READ_CLASS_OF_DEV:
2847                 hci_cc_read_class_of_dev(hdev, skb);
2848                 break;
2849
2850         case HCI_OP_WRITE_CLASS_OF_DEV:
2851                 hci_cc_write_class_of_dev(hdev, skb);
2852                 break;
2853
2854         case HCI_OP_READ_VOICE_SETTING:
2855                 hci_cc_read_voice_setting(hdev, skb);
2856                 break;
2857
2858         case HCI_OP_WRITE_VOICE_SETTING:
2859                 hci_cc_write_voice_setting(hdev, skb);
2860                 break;
2861
2862         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2863                 hci_cc_read_num_supported_iac(hdev, skb);
2864                 break;
2865
2866         case HCI_OP_WRITE_SSP_MODE:
2867                 hci_cc_write_ssp_mode(hdev, skb);
2868                 break;
2869
2870         case HCI_OP_WRITE_SC_SUPPORT:
2871                 hci_cc_write_sc_support(hdev, skb);
2872                 break;
2873
2874         case HCI_OP_READ_LOCAL_VERSION:
2875                 hci_cc_read_local_version(hdev, skb);
2876                 break;
2877
2878         case HCI_OP_READ_LOCAL_COMMANDS:
2879                 hci_cc_read_local_commands(hdev, skb);
2880                 break;
2881
2882         case HCI_OP_READ_LOCAL_FEATURES:
2883                 hci_cc_read_local_features(hdev, skb);
2884                 break;
2885
2886         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2887                 hci_cc_read_local_ext_features(hdev, skb);
2888                 break;
2889
2890         case HCI_OP_READ_BUFFER_SIZE:
2891                 hci_cc_read_buffer_size(hdev, skb);
2892                 break;
2893
2894         case HCI_OP_READ_BD_ADDR:
2895                 hci_cc_read_bd_addr(hdev, skb);
2896                 break;
2897
2898         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
2899                 hci_cc_read_page_scan_activity(hdev, skb);
2900                 break;
2901
2902         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
2903                 hci_cc_write_page_scan_activity(hdev, skb);
2904                 break;
2905
2906         case HCI_OP_READ_PAGE_SCAN_TYPE:
2907                 hci_cc_read_page_scan_type(hdev, skb);
2908                 break;
2909
2910         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
2911                 hci_cc_write_page_scan_type(hdev, skb);
2912                 break;
2913
2914         case HCI_OP_READ_DATA_BLOCK_SIZE:
2915                 hci_cc_read_data_block_size(hdev, skb);
2916                 break;
2917
2918         case HCI_OP_READ_FLOW_CONTROL_MODE:
2919                 hci_cc_read_flow_control_mode(hdev, skb);
2920                 break;
2921
2922         case HCI_OP_READ_LOCAL_AMP_INFO:
2923                 hci_cc_read_local_amp_info(hdev, skb);
2924                 break;
2925
2926         case HCI_OP_READ_CLOCK:
2927                 hci_cc_read_clock(hdev, skb);
2928                 break;
2929
2930         case HCI_OP_READ_INQ_RSP_TX_POWER:
2931                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2932                 break;
2933
2934         case HCI_OP_PIN_CODE_REPLY:
2935                 hci_cc_pin_code_reply(hdev, skb);
2936                 break;
2937
2938         case HCI_OP_PIN_CODE_NEG_REPLY:
2939                 hci_cc_pin_code_neg_reply(hdev, skb);
2940                 break;
2941
2942         case HCI_OP_READ_LOCAL_OOB_DATA:
2943                 hci_cc_read_local_oob_data(hdev, skb);
2944                 break;
2945
2946         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
2947                 hci_cc_read_local_oob_ext_data(hdev, skb);
2948                 break;
2949
2950         case HCI_OP_LE_READ_BUFFER_SIZE:
2951                 hci_cc_le_read_buffer_size(hdev, skb);
2952                 break;
2953
2954         case HCI_OP_LE_READ_LOCAL_FEATURES:
2955                 hci_cc_le_read_local_features(hdev, skb);
2956                 break;
2957
2958         case HCI_OP_LE_READ_ADV_TX_POWER:
2959                 hci_cc_le_read_adv_tx_power(hdev, skb);
2960                 break;
2961
2962         case HCI_OP_USER_CONFIRM_REPLY:
2963                 hci_cc_user_confirm_reply(hdev, skb);
2964                 break;
2965
2966         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2967                 hci_cc_user_confirm_neg_reply(hdev, skb);
2968                 break;
2969
2970         case HCI_OP_USER_PASSKEY_REPLY:
2971                 hci_cc_user_passkey_reply(hdev, skb);
2972                 break;
2973
2974         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2975                 hci_cc_user_passkey_neg_reply(hdev, skb);
2976                 break;
2977
2978         case HCI_OP_LE_SET_RANDOM_ADDR:
2979                 hci_cc_le_set_random_addr(hdev, skb);
2980                 break;
2981
2982         case HCI_OP_LE_SET_ADV_ENABLE:
2983                 hci_cc_le_set_adv_enable(hdev, skb);
2984                 break;
2985
2986         case HCI_OP_LE_SET_SCAN_PARAM:
2987                 hci_cc_le_set_scan_param(hdev, skb);
2988                 break;
2989
2990         case HCI_OP_LE_SET_SCAN_ENABLE:
2991                 hci_cc_le_set_scan_enable(hdev, skb);
2992                 break;
2993
2994         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
2995                 hci_cc_le_read_white_list_size(hdev, skb);
2996                 break;
2997
2998         case HCI_OP_LE_CLEAR_WHITE_LIST:
2999                 hci_cc_le_clear_white_list(hdev, skb);
3000                 break;
3001
3002         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3003                 hci_cc_le_add_to_white_list(hdev, skb);
3004                 break;
3005
3006         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3007                 hci_cc_le_del_from_white_list(hdev, skb);
3008                 break;
3009
3010         case HCI_OP_LE_READ_SUPPORTED_STATES:
3011                 hci_cc_le_read_supported_states(hdev, skb);
3012                 break;
3013
3014         case HCI_OP_LE_READ_DEF_DATA_LEN:
3015                 hci_cc_le_read_def_data_len(hdev, skb);
3016                 break;
3017
3018         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3019                 hci_cc_le_write_def_data_len(hdev, skb);
3020                 break;
3021
3022         case HCI_OP_LE_READ_MAX_DATA_LEN:
3023                 hci_cc_le_read_max_data_len(hdev, skb);
3024                 break;
3025
3026         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3027                 hci_cc_write_le_host_supported(hdev, skb);
3028                 break;
3029
3030         case HCI_OP_LE_SET_ADV_PARAM:
3031                 hci_cc_set_adv_param(hdev, skb);
3032                 break;
3033
3034         case HCI_OP_READ_RSSI:
3035                 hci_cc_read_rssi(hdev, skb);
3036                 break;
3037
3038         case HCI_OP_READ_TX_POWER:
3039                 hci_cc_read_tx_power(hdev, skb);
3040                 break;
3041
3042         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3043                 hci_cc_write_ssp_debug_mode(hdev, skb);
3044                 break;
3045
3046         default:
3047                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3048                 break;
3049         }
3050
3051         if (*opcode != HCI_OP_NOP)
3052                 cancel_delayed_work(&hdev->cmd_timer);
3053
3054         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3055                 atomic_set(&hdev->cmd_cnt, 1);
3056
3057         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3058                              req_complete_skb);
3059
3060         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3061                 queue_work(hdev->workqueue, &hdev->cmd_work);
3062 }
3063
3064 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3065                                u16 *opcode, u8 *status,
3066                                hci_req_complete_t *req_complete,
3067                                hci_req_complete_skb_t *req_complete_skb)
3068 {
3069         struct hci_ev_cmd_status *ev = (void *) skb->data;
3070
3071         skb_pull(skb, sizeof(*ev));
3072
3073         *opcode = __le16_to_cpu(ev->opcode);
3074         *status = ev->status;
3075
3076         switch (*opcode) {
3077         case HCI_OP_INQUIRY:
3078                 hci_cs_inquiry(hdev, ev->status);
3079                 break;
3080
3081         case HCI_OP_CREATE_CONN:
3082                 hci_cs_create_conn(hdev, ev->status);
3083                 break;
3084
3085         case HCI_OP_DISCONNECT:
3086                 hci_cs_disconnect(hdev, ev->status);
3087                 break;
3088
3089         case HCI_OP_ADD_SCO:
3090                 hci_cs_add_sco(hdev, ev->status);
3091                 break;
3092
3093         case HCI_OP_AUTH_REQUESTED:
3094                 hci_cs_auth_requested(hdev, ev->status);
3095                 break;
3096
3097         case HCI_OP_SET_CONN_ENCRYPT:
3098                 hci_cs_set_conn_encrypt(hdev, ev->status);
3099                 break;
3100
3101         case HCI_OP_REMOTE_NAME_REQ:
3102                 hci_cs_remote_name_req(hdev, ev->status);
3103                 break;
3104
3105         case HCI_OP_READ_REMOTE_FEATURES:
3106                 hci_cs_read_remote_features(hdev, ev->status);
3107                 break;
3108
3109         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3110                 hci_cs_read_remote_ext_features(hdev, ev->status);
3111                 break;
3112
3113         case HCI_OP_SETUP_SYNC_CONN:
3114                 hci_cs_setup_sync_conn(hdev, ev->status);
3115                 break;
3116
3117         case HCI_OP_SNIFF_MODE:
3118                 hci_cs_sniff_mode(hdev, ev->status);
3119                 break;
3120
3121         case HCI_OP_EXIT_SNIFF_MODE:
3122                 hci_cs_exit_sniff_mode(hdev, ev->status);
3123                 break;
3124
3125         case HCI_OP_SWITCH_ROLE:
3126                 hci_cs_switch_role(hdev, ev->status);
3127                 break;
3128
3129         case HCI_OP_LE_CREATE_CONN:
3130                 hci_cs_le_create_conn(hdev, ev->status);
3131                 break;
3132
3133         case HCI_OP_LE_READ_REMOTE_FEATURES:
3134                 hci_cs_le_read_remote_features(hdev, ev->status);
3135                 break;
3136
3137         case HCI_OP_LE_START_ENC:
3138                 hci_cs_le_start_enc(hdev, ev->status);
3139                 break;
3140
3141         default:
3142                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3143                 break;
3144         }
3145
3146         if (*opcode != HCI_OP_NOP)
3147                 cancel_delayed_work(&hdev->cmd_timer);
3148
3149         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3150                 atomic_set(&hdev->cmd_cnt, 1);
3151
3152         /* Indicate request completion if the command failed. Also, if
3153          * we're not waiting for a special event and we get a success
3154          * command status we should try to flag the request as completed
3155          * (since for this kind of commands there will not be a command
3156          * complete event).
3157          */
3158         if (ev->status ||
3159             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3160                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3161                                      req_complete_skb);
3162
3163         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3164                 queue_work(hdev->workqueue, &hdev->cmd_work);
3165 }
3166
3167 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3168 {
3169         struct hci_ev_hardware_error *ev = (void *) skb->data;
3170
3171         hdev->hw_error_code = ev->code;
3172
3173         queue_work(hdev->req_workqueue, &hdev->error_reset);
3174 }
3175
3176 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3177 {
3178         struct hci_ev_role_change *ev = (void *) skb->data;
3179         struct hci_conn *conn;
3180
3181         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3182
3183         hci_dev_lock(hdev);
3184
3185         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3186         if (conn) {
3187                 if (!ev->status)
3188                         conn->role = ev->role;
3189
3190                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3191
3192                 hci_role_switch_cfm(conn, ev->status, ev->role);
3193         }
3194
3195         hci_dev_unlock(hdev);
3196 }
3197
3198 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3199 {
3200         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3201         int i;
3202
3203         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3204                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3205                 return;
3206         }
3207
3208         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3209             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3210                 BT_DBG("%s bad parameters", hdev->name);
3211                 return;
3212         }
3213
3214         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3215
3216         for (i = 0; i < ev->num_hndl; i++) {
3217                 struct hci_comp_pkts_info *info = &ev->handles[i];
3218                 struct hci_conn *conn;
3219                 __u16  handle, count;
3220
3221                 handle = __le16_to_cpu(info->handle);
3222                 count  = __le16_to_cpu(info->count);
3223
3224                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3225                 if (!conn)
3226                         continue;
3227
3228                 conn->sent -= count;
3229
3230                 switch (conn->type) {
3231                 case ACL_LINK:
3232                         hdev->acl_cnt += count;
3233                         if (hdev->acl_cnt > hdev->acl_pkts)
3234                                 hdev->acl_cnt = hdev->acl_pkts;
3235                         break;
3236
3237                 case LE_LINK:
3238                         if (hdev->le_pkts) {
3239                                 hdev->le_cnt += count;
3240                                 if (hdev->le_cnt > hdev->le_pkts)
3241                                         hdev->le_cnt = hdev->le_pkts;
3242                         } else {
3243                                 hdev->acl_cnt += count;
3244                                 if (hdev->acl_cnt > hdev->acl_pkts)
3245                                         hdev->acl_cnt = hdev->acl_pkts;
3246                         }
3247                         break;
3248
3249                 case SCO_LINK:
3250                         hdev->sco_cnt += count;
3251                         if (hdev->sco_cnt > hdev->sco_pkts)
3252                                 hdev->sco_cnt = hdev->sco_pkts;
3253                         break;
3254
3255                 default:
3256                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3257                         break;
3258                 }
3259         }
3260
3261         queue_work(hdev->workqueue, &hdev->tx_work);
3262 }
3263
3264 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3265                                                  __u16 handle)
3266 {
3267         struct hci_chan *chan;
3268
3269         switch (hdev->dev_type) {
3270         case HCI_PRIMARY:
3271                 return hci_conn_hash_lookup_handle(hdev, handle);
3272         case HCI_AMP:
3273                 chan = hci_chan_lookup_handle(hdev, handle);
3274                 if (chan)
3275                         return chan->conn;
3276                 break;
3277         default:
3278                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3279                 break;
3280         }
3281
3282         return NULL;
3283 }
3284
3285 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3286 {
3287         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3288         int i;
3289
3290         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3291                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3292                 return;
3293         }
3294
3295         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3296             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3297                 BT_DBG("%s bad parameters", hdev->name);
3298                 return;
3299         }
3300
3301         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3302                ev->num_hndl);
3303
3304         for (i = 0; i < ev->num_hndl; i++) {
3305                 struct hci_comp_blocks_info *info = &ev->handles[i];
3306                 struct hci_conn *conn = NULL;
3307                 __u16  handle, block_count;
3308
3309                 handle = __le16_to_cpu(info->handle);
3310                 block_count = __le16_to_cpu(info->blocks);
3311
3312                 conn = __hci_conn_lookup_handle(hdev, handle);
3313                 if (!conn)
3314                         continue;
3315
3316                 conn->sent -= block_count;
3317
3318                 switch (conn->type) {
3319                 case ACL_LINK:
3320                 case AMP_LINK:
3321                         hdev->block_cnt += block_count;
3322                         if (hdev->block_cnt > hdev->num_blocks)
3323                                 hdev->block_cnt = hdev->num_blocks;
3324                         break;
3325
3326                 default:
3327                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3328                         break;
3329                 }
3330         }
3331
3332         queue_work(hdev->workqueue, &hdev->tx_work);
3333 }
3334
3335 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3336 {
3337         struct hci_ev_mode_change *ev = (void *) skb->data;
3338         struct hci_conn *conn;
3339
3340         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3341
3342         hci_dev_lock(hdev);
3343
3344         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3345         if (conn) {
3346                 conn->mode = ev->mode;
3347
3348                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3349                                         &conn->flags)) {
3350                         if (conn->mode == HCI_CM_ACTIVE)
3351                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3352                         else
3353                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3354                 }
3355
3356                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3357                         hci_sco_setup(conn, ev->status);
3358         }
3359
3360         hci_dev_unlock(hdev);
3361 }
3362
3363 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3364 {
3365         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3366         struct hci_conn *conn;
3367
3368         BT_DBG("%s", hdev->name);
3369
3370         hci_dev_lock(hdev);
3371
3372         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3373         if (!conn)
3374                 goto unlock;
3375
3376         if (conn->state == BT_CONNECTED) {
3377                 hci_conn_hold(conn);
3378                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3379                 hci_conn_drop(conn);
3380         }
3381
3382         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3383             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3384                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3385                              sizeof(ev->bdaddr), &ev->bdaddr);
3386         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3387                 u8 secure;
3388
3389                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3390                         secure = 1;
3391                 else
3392                         secure = 0;
3393
3394                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3395         }
3396
3397 unlock:
3398         hci_dev_unlock(hdev);
3399 }
3400
3401 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3402 {
3403         if (key_type == HCI_LK_CHANGED_COMBINATION)
3404                 return;
3405
3406         conn->pin_length = pin_len;
3407         conn->key_type = key_type;
3408
3409         switch (key_type) {
3410         case HCI_LK_LOCAL_UNIT:
3411         case HCI_LK_REMOTE_UNIT:
3412         case HCI_LK_DEBUG_COMBINATION:
3413                 return;
3414         case HCI_LK_COMBINATION:
3415                 if (pin_len == 16)
3416                         conn->pending_sec_level = BT_SECURITY_HIGH;
3417                 else
3418                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3419                 break;
3420         case HCI_LK_UNAUTH_COMBINATION_P192:
3421         case HCI_LK_UNAUTH_COMBINATION_P256:
3422                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3423                 break;
3424         case HCI_LK_AUTH_COMBINATION_P192:
3425                 conn->pending_sec_level = BT_SECURITY_HIGH;
3426                 break;
3427         case HCI_LK_AUTH_COMBINATION_P256:
3428                 conn->pending_sec_level = BT_SECURITY_FIPS;
3429                 break;
3430         }
3431 }
3432
3433 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3434 {
3435         struct hci_ev_link_key_req *ev = (void *) skb->data;
3436         struct hci_cp_link_key_reply cp;
3437         struct hci_conn *conn;
3438         struct link_key *key;
3439
3440         BT_DBG("%s", hdev->name);
3441
3442         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3443                 return;
3444
3445         hci_dev_lock(hdev);
3446
3447         key = hci_find_link_key(hdev, &ev->bdaddr);
3448         if (!key) {
3449                 BT_DBG("%s link key not found for %pMR", hdev->name,
3450                        &ev->bdaddr);
3451                 goto not_found;
3452         }
3453
3454         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3455                &ev->bdaddr);
3456
3457         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3458         if (conn) {
3459                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3460
3461                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3462                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3463                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3464                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3465                         goto not_found;
3466                 }
3467
3468                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3469                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3470                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3471                         BT_DBG("%s ignoring key unauthenticated for high security",
3472                                hdev->name);
3473                         goto not_found;
3474                 }
3475
3476                 conn_set_key(conn, key->type, key->pin_len);
3477         }
3478
3479         bacpy(&cp.bdaddr, &ev->bdaddr);
3480         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3481
3482         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3483
3484         hci_dev_unlock(hdev);
3485
3486         return;
3487
3488 not_found:
3489         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3490         hci_dev_unlock(hdev);
3491 }
3492
3493 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3494 {
3495         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3496         struct hci_conn *conn;
3497         struct link_key *key;
3498         bool persistent;
3499         u8 pin_len = 0;
3500
3501         BT_DBG("%s", hdev->name);
3502
3503         hci_dev_lock(hdev);
3504
3505         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3506         if (!conn)
3507                 goto unlock;
3508
3509         /* Ignore NULL link key against CVE-2020-26555 */
3510         if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
3511                 bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
3512                            &ev->bdaddr);
3513                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3514                 hci_conn_drop(conn);
3515                 goto unlock;
3516         }
3517
3518         hci_conn_hold(conn);
3519         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3520         hci_conn_drop(conn);
3521
3522         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3523         conn_set_key(conn, ev->key_type, conn->pin_length);
3524
3525         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3526                 goto unlock;
3527
3528         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3529                                 ev->key_type, pin_len, &persistent);
3530         if (!key)
3531                 goto unlock;
3532
3533         /* Update connection information since adding the key will have
3534          * fixed up the type in the case of changed combination keys.
3535          */
3536         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3537                 conn_set_key(conn, key->type, key->pin_len);
3538
3539         mgmt_new_link_key(hdev, key, persistent);
3540
3541         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3542          * is set. If it's not set simply remove the key from the kernel
3543          * list (we've still notified user space about it but with
3544          * store_hint being 0).
3545          */
3546         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3547             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3548                 list_del_rcu(&key->list);
3549                 kfree_rcu(key, rcu);
3550                 goto unlock;
3551         }
3552
3553         if (persistent)
3554                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3555         else
3556                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3557
3558 unlock:
3559         hci_dev_unlock(hdev);
3560 }
3561
3562 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3563 {
3564         struct hci_ev_clock_offset *ev = (void *) skb->data;
3565         struct hci_conn *conn;
3566
3567         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3568
3569         hci_dev_lock(hdev);
3570
3571         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3572         if (conn && !ev->status) {
3573                 struct inquiry_entry *ie;
3574
3575                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3576                 if (ie) {
3577                         ie->data.clock_offset = ev->clock_offset;
3578                         ie->timestamp = jiffies;
3579                 }
3580         }
3581
3582         hci_dev_unlock(hdev);
3583 }
3584
3585 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3586 {
3587         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3588         struct hci_conn *conn;
3589
3590         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3591
3592         hci_dev_lock(hdev);
3593
3594         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3595         if (conn && !ev->status)
3596                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3597
3598         hci_dev_unlock(hdev);
3599 }
3600
3601 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3602 {
3603         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3604         struct inquiry_entry *ie;
3605
3606         BT_DBG("%s", hdev->name);
3607
3608         hci_dev_lock(hdev);
3609
3610         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3611         if (ie) {
3612                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3613                 ie->timestamp = jiffies;
3614         }
3615
3616         hci_dev_unlock(hdev);
3617 }
3618
3619 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3620                                              struct sk_buff *skb)
3621 {
3622         struct inquiry_data data;
3623         int num_rsp = *((__u8 *) skb->data);
3624
3625         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3626
3627         if (!num_rsp)
3628                 return;
3629
3630         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3631                 return;
3632
3633         hci_dev_lock(hdev);
3634
3635         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3636                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3637                 info = (void *) (skb->data + 1);
3638
3639                 if (skb->len < num_rsp * sizeof(*info) + 1)
3640                         goto unlock;
3641
3642                 for (; num_rsp; num_rsp--, info++) {
3643                         u32 flags;
3644
3645                         bacpy(&data.bdaddr, &info->bdaddr);
3646                         data.pscan_rep_mode     = info->pscan_rep_mode;
3647                         data.pscan_period_mode  = info->pscan_period_mode;
3648                         data.pscan_mode         = info->pscan_mode;
3649                         memcpy(data.dev_class, info->dev_class, 3);
3650                         data.clock_offset       = info->clock_offset;
3651                         data.rssi               = info->rssi;
3652                         data.ssp_mode           = 0x00;
3653
3654                         flags = hci_inquiry_cache_update(hdev, &data, false);
3655
3656                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3657                                           info->dev_class, info->rssi,
3658                                           flags, NULL, 0, NULL, 0);
3659                 }
3660         } else {
3661                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3662
3663                 if (skb->len < num_rsp * sizeof(*info) + 1)
3664                         goto unlock;
3665
3666                 for (; num_rsp; num_rsp--, info++) {
3667                         u32 flags;
3668
3669                         bacpy(&data.bdaddr, &info->bdaddr);
3670                         data.pscan_rep_mode     = info->pscan_rep_mode;
3671                         data.pscan_period_mode  = info->pscan_period_mode;
3672                         data.pscan_mode         = 0x00;
3673                         memcpy(data.dev_class, info->dev_class, 3);
3674                         data.clock_offset       = info->clock_offset;
3675                         data.rssi               = info->rssi;
3676                         data.ssp_mode           = 0x00;
3677
3678                         flags = hci_inquiry_cache_update(hdev, &data, false);
3679
3680                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3681                                           info->dev_class, info->rssi,
3682                                           flags, NULL, 0, NULL, 0);
3683                 }
3684         }
3685
3686 unlock:
3687         hci_dev_unlock(hdev);
3688 }
3689
3690 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3691                                         struct sk_buff *skb)
3692 {
3693         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3694         struct hci_conn *conn;
3695
3696         BT_DBG("%s", hdev->name);
3697
3698         hci_dev_lock(hdev);
3699
3700         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3701         if (!conn)
3702                 goto unlock;
3703
3704         if (ev->page < HCI_MAX_PAGES)
3705                 memcpy(conn->features[ev->page], ev->features, 8);
3706
3707         if (!ev->status && ev->page == 0x01) {
3708                 struct inquiry_entry *ie;
3709
3710                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3711                 if (ie)
3712                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3713
3714                 if (ev->features[0] & LMP_HOST_SSP) {
3715                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3716                 } else {
3717                         /* It is mandatory by the Bluetooth specification that
3718                          * Extended Inquiry Results are only used when Secure
3719                          * Simple Pairing is enabled, but some devices violate
3720                          * this.
3721                          *
3722                          * To make these devices work, the internal SSP
3723                          * enabled flag needs to be cleared if the remote host
3724                          * features do not indicate SSP support */
3725                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3726                 }
3727
3728                 if (ev->features[0] & LMP_HOST_SC)
3729                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3730         }
3731
3732         if (conn->state != BT_CONFIG)
3733                 goto unlock;
3734
3735         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3736                 struct hci_cp_remote_name_req cp;
3737                 memset(&cp, 0, sizeof(cp));
3738                 bacpy(&cp.bdaddr, &conn->dst);
3739                 cp.pscan_rep_mode = 0x02;
3740                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3741         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3742                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3743
3744         if (!hci_outgoing_auth_needed(hdev, conn)) {
3745                 conn->state = BT_CONNECTED;
3746                 hci_connect_cfm(conn, ev->status);
3747                 hci_conn_drop(conn);
3748         }
3749
3750 unlock:
3751         hci_dev_unlock(hdev);
3752 }
3753
3754 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3755                                        struct sk_buff *skb)
3756 {
3757         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3758         struct hci_conn *conn;
3759
3760         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3761
3762         hci_dev_lock(hdev);
3763
3764         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3765         if (!conn) {
3766                 if (ev->link_type == ESCO_LINK)
3767                         goto unlock;
3768
3769                 /* When the link type in the event indicates SCO connection
3770                  * and lookup of the connection object fails, then check
3771                  * if an eSCO connection object exists.
3772                  *
3773                  * The core limits the synchronous connections to either
3774                  * SCO or eSCO. The eSCO connection is preferred and tried
3775                  * to be setup first and until successfully established,
3776                  * the link type will be hinted as eSCO.
3777                  */
3778                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3779                 if (!conn)
3780                         goto unlock;
3781         }
3782
3783         switch (ev->status) {
3784         case 0x00:
3785                 /* The synchronous connection complete event should only be
3786                  * sent once per new connection. Receiving a successful
3787                  * complete event when the connection status is already
3788                  * BT_CONNECTED means that the device is misbehaving and sent
3789                  * multiple complete event packets for the same new connection.
3790                  *
3791                  * Registering the device more than once can corrupt kernel
3792                  * memory, hence upon detecting this invalid event, we report
3793                  * an error and ignore the packet.
3794                  */
3795                 if (conn->state == BT_CONNECTED) {
3796                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
3797                         goto unlock;
3798                 }
3799
3800                 conn->handle = __le16_to_cpu(ev->handle);
3801                 conn->state  = BT_CONNECTED;
3802                 conn->type   = ev->link_type;
3803
3804                 hci_debugfs_create_conn(conn);
3805                 hci_conn_add_sysfs(conn);
3806                 break;
3807
3808         case 0x10:      /* Connection Accept Timeout */
3809         case 0x0d:      /* Connection Rejected due to Limited Resources */
3810         case 0x11:      /* Unsupported Feature or Parameter Value */
3811         case 0x1c:      /* SCO interval rejected */
3812         case 0x1a:      /* Unsupported Remote Feature */
3813         case 0x1e:      /* Invalid LMP Parameters */
3814         case 0x1f:      /* Unspecified error */
3815         case 0x20:      /* Unsupported LMP Parameter value */
3816                 if (conn->out) {
3817                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3818                                         (hdev->esco_type & EDR_ESCO_MASK);
3819                         if (hci_setup_sync(conn, conn->link->handle))
3820                                 goto unlock;
3821                 }
3822                 /* fall through */
3823
3824         default:
3825                 conn->state = BT_CLOSED;
3826                 break;
3827         }
3828
3829         hci_connect_cfm(conn, ev->status);
3830         if (ev->status)
3831                 hci_conn_del(conn);
3832
3833 unlock:
3834         hci_dev_unlock(hdev);
3835 }
3836
3837 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
3838 {
3839         size_t parsed = 0;
3840
3841         while (parsed < eir_len) {
3842                 u8 field_len = eir[0];
3843
3844                 if (field_len == 0)
3845                         return parsed;
3846
3847                 parsed += field_len + 1;
3848                 eir += field_len + 1;
3849         }
3850
3851         return eir_len;
3852 }
3853
3854 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
3855                                             struct sk_buff *skb)
3856 {
3857         struct inquiry_data data;
3858         struct extended_inquiry_info *info = (void *) (skb->data + 1);
3859         int num_rsp = *((__u8 *) skb->data);
3860         size_t eir_len;
3861
3862         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3863
3864         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
3865                 return;
3866
3867         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3868                 return;
3869
3870         hci_dev_lock(hdev);
3871
3872         for (; num_rsp; num_rsp--, info++) {
3873                 u32 flags;
3874                 bool name_known;
3875
3876                 bacpy(&data.bdaddr, &info->bdaddr);
3877                 data.pscan_rep_mode     = info->pscan_rep_mode;
3878                 data.pscan_period_mode  = info->pscan_period_mode;
3879                 data.pscan_mode         = 0x00;
3880                 memcpy(data.dev_class, info->dev_class, 3);
3881                 data.clock_offset       = info->clock_offset;
3882                 data.rssi               = info->rssi;
3883                 data.ssp_mode           = 0x01;
3884
3885                 if (hci_dev_test_flag(hdev, HCI_MGMT))
3886                         name_known = eir_get_data(info->data,
3887                                                   sizeof(info->data),
3888                                                   EIR_NAME_COMPLETE, NULL);
3889                 else
3890                         name_known = true;
3891
3892                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
3893
3894                 eir_len = eir_get_length(info->data, sizeof(info->data));
3895
3896                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3897                                   info->dev_class, info->rssi,
3898                                   flags, info->data, eir_len, NULL, 0);
3899         }
3900
3901         hci_dev_unlock(hdev);
3902 }
3903
3904 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3905                                          struct sk_buff *skb)
3906 {
3907         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3908         struct hci_conn *conn;
3909
3910         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
3911                __le16_to_cpu(ev->handle));
3912
3913         hci_dev_lock(hdev);
3914
3915         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3916         if (!conn)
3917                 goto unlock;
3918
3919         /* For BR/EDR the necessary steps are taken through the
3920          * auth_complete event.
3921          */
3922         if (conn->type != LE_LINK)
3923                 goto unlock;
3924
3925         if (!ev->status)
3926                 conn->sec_level = conn->pending_sec_level;
3927
3928         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3929
3930         if (ev->status && conn->state == BT_CONNECTED) {
3931                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3932                 hci_conn_drop(conn);
3933                 goto unlock;
3934         }
3935
3936         if (conn->state == BT_CONFIG) {
3937                 if (!ev->status)
3938                         conn->state = BT_CONNECTED;
3939
3940                 hci_connect_cfm(conn, ev->status);
3941                 hci_conn_drop(conn);
3942         } else {
3943                 hci_auth_cfm(conn, ev->status);
3944
3945                 hci_conn_hold(conn);
3946                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3947                 hci_conn_drop(conn);
3948         }
3949
3950 unlock:
3951         hci_dev_unlock(hdev);
3952 }
3953
3954 static u8 hci_get_auth_req(struct hci_conn *conn)
3955 {
3956         /* If remote requests no-bonding follow that lead */
3957         if (conn->remote_auth == HCI_AT_NO_BONDING ||
3958             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
3959                 return conn->remote_auth | (conn->auth_type & 0x01);
3960
3961         /* If both remote and local have enough IO capabilities, require
3962          * MITM protection
3963          */
3964         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
3965             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
3966                 return conn->remote_auth | 0x01;
3967
3968         /* No MITM protection possible so ignore remote requirement */
3969         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
3970 }
3971
3972 static u8 bredr_oob_data_present(struct hci_conn *conn)
3973 {
3974         struct hci_dev *hdev = conn->hdev;
3975         struct oob_data *data;
3976
3977         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
3978         if (!data)
3979                 return 0x00;
3980
3981         if (bredr_sc_enabled(hdev)) {
3982                 /* When Secure Connections is enabled, then just
3983                  * return the present value stored with the OOB
3984                  * data. The stored value contains the right present
3985                  * information. However it can only be trusted when
3986                  * not in Secure Connection Only mode.
3987                  */
3988                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
3989                         return data->present;
3990
3991                 /* When Secure Connections Only mode is enabled, then
3992                  * the P-256 values are required. If they are not
3993                  * available, then do not declare that OOB data is
3994                  * present.
3995                  */
3996                 if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
3997                     !crypto_memneq(data->hash256, ZERO_KEY, 16))
3998                         return 0x00;
3999
4000                 return 0x02;
4001         }
4002
4003         /* When Secure Connections is not enabled or actually
4004          * not supported by the hardware, then check that if
4005          * P-192 data values are present.
4006          */
4007         if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
4008             !crypto_memneq(data->hash192, ZERO_KEY, 16))
4009                 return 0x00;
4010
4011         return 0x01;
4012 }
4013
4014 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4015 {
4016         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4017         struct hci_conn *conn;
4018
4019         BT_DBG("%s", hdev->name);
4020
4021         hci_dev_lock(hdev);
4022
4023         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4024         if (!conn || !hci_conn_ssp_enabled(conn))
4025                 goto unlock;
4026
4027         hci_conn_hold(conn);
4028
4029         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4030                 goto unlock;
4031
4032         /* Allow pairing if we're pairable, the initiators of the
4033          * pairing or if the remote is not requesting bonding.
4034          */
4035         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4036             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4037             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4038                 struct hci_cp_io_capability_reply cp;
4039
4040                 bacpy(&cp.bdaddr, &ev->bdaddr);
4041                 /* Change the IO capability from KeyboardDisplay
4042                  * to DisplayYesNo as it is not supported by BT spec. */
4043                 cp.capability = (conn->io_capability == 0x04) ?
4044                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4045
4046                 /* If we are initiators, there is no remote information yet */
4047                 if (conn->remote_auth == 0xff) {
4048                         /* Request MITM protection if our IO caps allow it
4049                          * except for the no-bonding case.
4050                          */
4051                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4052                             conn->auth_type != HCI_AT_NO_BONDING)
4053                                 conn->auth_type |= 0x01;
4054                 } else {
4055                         conn->auth_type = hci_get_auth_req(conn);
4056                 }
4057
4058                 /* If we're not bondable, force one of the non-bondable
4059                  * authentication requirement values.
4060                  */
4061                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4062                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4063
4064                 cp.authentication = conn->auth_type;
4065                 cp.oob_data = bredr_oob_data_present(conn);
4066
4067                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4068                              sizeof(cp), &cp);
4069         } else {
4070                 struct hci_cp_io_capability_neg_reply cp;
4071
4072                 bacpy(&cp.bdaddr, &ev->bdaddr);
4073                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4074
4075                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4076                              sizeof(cp), &cp);
4077         }
4078
4079 unlock:
4080         hci_dev_unlock(hdev);
4081 }
4082
4083 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4084 {
4085         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4086         struct hci_conn *conn;
4087
4088         BT_DBG("%s", hdev->name);
4089
4090         hci_dev_lock(hdev);
4091
4092         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4093         if (!conn)
4094                 goto unlock;
4095
4096         conn->remote_cap = ev->capability;
4097         conn->remote_auth = ev->authentication;
4098
4099 unlock:
4100         hci_dev_unlock(hdev);
4101 }
4102
4103 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4104                                          struct sk_buff *skb)
4105 {
4106         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4107         int loc_mitm, rem_mitm, confirm_hint = 0;
4108         struct hci_conn *conn;
4109
4110         BT_DBG("%s", hdev->name);
4111
4112         hci_dev_lock(hdev);
4113
4114         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4115                 goto unlock;
4116
4117         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4118         if (!conn)
4119                 goto unlock;
4120
4121         loc_mitm = (conn->auth_type & 0x01);
4122         rem_mitm = (conn->remote_auth & 0x01);
4123
4124         /* If we require MITM but the remote device can't provide that
4125          * (it has NoInputNoOutput) then reject the confirmation
4126          * request. We check the security level here since it doesn't
4127          * necessarily match conn->auth_type.
4128          */
4129         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4130             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4131                 BT_DBG("Rejecting request: remote device can't provide MITM");
4132                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4133                              sizeof(ev->bdaddr), &ev->bdaddr);
4134                 goto unlock;
4135         }
4136
4137         /* If no side requires MITM protection; auto-accept */
4138         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4139             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4140
4141                 /* If we're not the initiators request authorization to
4142                  * proceed from user space (mgmt_user_confirm with
4143                  * confirm_hint set to 1). The exception is if neither
4144                  * side had MITM or if the local IO capability is
4145                  * NoInputNoOutput, in which case we do auto-accept
4146                  */
4147                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4148                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4149                     (loc_mitm || rem_mitm)) {
4150                         BT_DBG("Confirming auto-accept as acceptor");
4151                         confirm_hint = 1;
4152                         goto confirm;
4153                 }
4154
4155                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4156                        hdev->auto_accept_delay);
4157
4158                 if (hdev->auto_accept_delay > 0) {
4159                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4160                         queue_delayed_work(conn->hdev->workqueue,
4161                                            &conn->auto_accept_work, delay);
4162                         goto unlock;
4163                 }
4164
4165                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4166                              sizeof(ev->bdaddr), &ev->bdaddr);
4167                 goto unlock;
4168         }
4169
4170 confirm:
4171         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4172                                   le32_to_cpu(ev->passkey), confirm_hint);
4173
4174 unlock:
4175         hci_dev_unlock(hdev);
4176 }
4177
4178 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4179                                          struct sk_buff *skb)
4180 {
4181         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4182
4183         BT_DBG("%s", hdev->name);
4184
4185         if (hci_dev_test_flag(hdev, HCI_MGMT))
4186                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4187 }
4188
4189 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4190                                         struct sk_buff *skb)
4191 {
4192         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4193         struct hci_conn *conn;
4194
4195         BT_DBG("%s", hdev->name);
4196
4197         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4198         if (!conn)
4199                 return;
4200
4201         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4202         conn->passkey_entered = 0;
4203
4204         if (hci_dev_test_flag(hdev, HCI_MGMT))
4205                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4206                                          conn->dst_type, conn->passkey_notify,
4207                                          conn->passkey_entered);
4208 }
4209
4210 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4211 {
4212         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4213         struct hci_conn *conn;
4214
4215         BT_DBG("%s", hdev->name);
4216
4217         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4218         if (!conn)
4219                 return;
4220
4221         switch (ev->type) {
4222         case HCI_KEYPRESS_STARTED:
4223                 conn->passkey_entered = 0;
4224                 return;
4225
4226         case HCI_KEYPRESS_ENTERED:
4227                 conn->passkey_entered++;
4228                 break;
4229
4230         case HCI_KEYPRESS_ERASED:
4231                 conn->passkey_entered--;
4232                 break;
4233
4234         case HCI_KEYPRESS_CLEARED:
4235                 conn->passkey_entered = 0;
4236                 break;
4237
4238         case HCI_KEYPRESS_COMPLETED:
4239                 return;
4240         }
4241
4242         if (hci_dev_test_flag(hdev, HCI_MGMT))
4243                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4244                                          conn->dst_type, conn->passkey_notify,
4245                                          conn->passkey_entered);
4246 }
4247
4248 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4249                                          struct sk_buff *skb)
4250 {
4251         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4252         struct hci_conn *conn;
4253
4254         BT_DBG("%s", hdev->name);
4255
4256         hci_dev_lock(hdev);
4257
4258         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4259         if (!conn || !hci_conn_ssp_enabled(conn))
4260                 goto unlock;
4261
4262         /* Reset the authentication requirement to unknown */
4263         conn->remote_auth = 0xff;
4264
4265         /* To avoid duplicate auth_failed events to user space we check
4266          * the HCI_CONN_AUTH_PEND flag which will be set if we
4267          * initiated the authentication. A traditional auth_complete
4268          * event gets always produced as initiator and is also mapped to
4269          * the mgmt_auth_failed event */
4270         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4271                 mgmt_auth_failed(conn, ev->status);
4272
4273         hci_conn_drop(conn);
4274
4275 unlock:
4276         hci_dev_unlock(hdev);
4277 }
4278
4279 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4280                                          struct sk_buff *skb)
4281 {
4282         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4283         struct inquiry_entry *ie;
4284         struct hci_conn *conn;
4285
4286         BT_DBG("%s", hdev->name);
4287
4288         hci_dev_lock(hdev);
4289
4290         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4291         if (conn)
4292                 memcpy(conn->features[1], ev->features, 8);
4293
4294         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4295         if (ie)
4296                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4297
4298         hci_dev_unlock(hdev);
4299 }
4300
4301 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4302                                             struct sk_buff *skb)
4303 {
4304         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4305         struct oob_data *data;
4306
4307         BT_DBG("%s", hdev->name);
4308
4309         hci_dev_lock(hdev);
4310
4311         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4312                 goto unlock;
4313
4314         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4315         if (!data) {
4316                 struct hci_cp_remote_oob_data_neg_reply cp;
4317
4318                 bacpy(&cp.bdaddr, &ev->bdaddr);
4319                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4320                              sizeof(cp), &cp);
4321                 goto unlock;
4322         }
4323
4324         if (bredr_sc_enabled(hdev)) {
4325                 struct hci_cp_remote_oob_ext_data_reply cp;
4326
4327                 bacpy(&cp.bdaddr, &ev->bdaddr);
4328                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4329                         memset(cp.hash192, 0, sizeof(cp.hash192));
4330                         memset(cp.rand192, 0, sizeof(cp.rand192));
4331                 } else {
4332                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4333                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4334                 }
4335                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4336                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4337
4338                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4339                              sizeof(cp), &cp);
4340         } else {
4341                 struct hci_cp_remote_oob_data_reply cp;
4342
4343                 bacpy(&cp.bdaddr, &ev->bdaddr);
4344                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4345                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4346
4347                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4348                              sizeof(cp), &cp);
4349         }
4350
4351 unlock:
4352         hci_dev_unlock(hdev);
4353 }
4354
4355 #if IS_ENABLED(CONFIG_BT_HS)
4356 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4357 {
4358         struct hci_ev_channel_selected *ev = (void *)skb->data;
4359         struct hci_conn *hcon;
4360
4361         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4362
4363         skb_pull(skb, sizeof(*ev));
4364
4365         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4366         if (!hcon)
4367                 return;
4368
4369         amp_read_loc_assoc_final_data(hdev, hcon);
4370 }
4371
4372 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4373                                       struct sk_buff *skb)
4374 {
4375         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4376         struct hci_conn *hcon, *bredr_hcon;
4377
4378         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4379                ev->status);
4380
4381         hci_dev_lock(hdev);
4382
4383         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4384         if (!hcon) {
4385                 hci_dev_unlock(hdev);
4386                 return;
4387         }
4388
4389         if (!hcon->amp_mgr) {
4390                 hci_dev_unlock(hdev);
4391                 return;
4392         }
4393
4394         if (ev->status) {
4395                 hci_conn_del(hcon);
4396                 hci_dev_unlock(hdev);
4397                 return;
4398         }
4399
4400         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4401
4402         hcon->state = BT_CONNECTED;
4403         bacpy(&hcon->dst, &bredr_hcon->dst);
4404
4405         hci_conn_hold(hcon);
4406         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4407         hci_conn_drop(hcon);
4408
4409         hci_debugfs_create_conn(hcon);
4410         hci_conn_add_sysfs(hcon);
4411
4412         amp_physical_cfm(bredr_hcon, hcon);
4413
4414         hci_dev_unlock(hdev);
4415 }
4416
4417 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4418 {
4419         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4420         struct hci_conn *hcon;
4421         struct hci_chan *hchan;
4422         struct amp_mgr *mgr;
4423
4424         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4425                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4426                ev->status);
4427
4428         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4429         if (!hcon)
4430                 return;
4431
4432         /* Create AMP hchan */
4433         hchan = hci_chan_create(hcon);
4434         if (!hchan)
4435                 return;
4436
4437         hchan->handle = le16_to_cpu(ev->handle);
4438         hchan->amp = true;
4439
4440         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4441
4442         mgr = hcon->amp_mgr;
4443         if (mgr && mgr->bredr_chan) {
4444                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4445
4446                 l2cap_chan_lock(bredr_chan);
4447
4448                 bredr_chan->conn->mtu = hdev->block_mtu;
4449                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4450                 hci_conn_hold(hcon);
4451
4452                 l2cap_chan_unlock(bredr_chan);
4453         }
4454 }
4455
4456 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4457                                              struct sk_buff *skb)
4458 {
4459         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4460         struct hci_chan *hchan;
4461
4462         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4463                le16_to_cpu(ev->handle), ev->status);
4464
4465         if (ev->status)
4466                 return;
4467
4468         hci_dev_lock(hdev);
4469
4470         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4471         if (!hchan || !hchan->amp)
4472                 goto unlock;
4473
4474         amp_destroy_logical_link(hchan, ev->reason);
4475
4476 unlock:
4477         hci_dev_unlock(hdev);
4478 }
4479
4480 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4481                                              struct sk_buff *skb)
4482 {
4483         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4484         struct hci_conn *hcon;
4485
4486         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4487
4488         if (ev->status)
4489                 return;
4490
4491         hci_dev_lock(hdev);
4492
4493         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4494         if (hcon && hcon->type == AMP_LINK) {
4495                 hcon->state = BT_CLOSED;
4496                 hci_disconn_cfm(hcon, ev->reason);
4497                 hci_conn_del(hcon);
4498         }
4499
4500         hci_dev_unlock(hdev);
4501 }
4502 #endif
4503
4504 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4505 {
4506         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4507         struct hci_conn_params *params;
4508         struct hci_conn *conn;
4509         struct smp_irk *irk;
4510         u8 addr_type;
4511
4512         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4513
4514         hci_dev_lock(hdev);
4515
4516         /* All controllers implicitly stop advertising in the event of a
4517          * connection, so ensure that the state bit is cleared.
4518          */
4519         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4520
4521         conn = hci_lookup_le_connect(hdev);
4522         if (!conn) {
4523                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4524                 if (!conn) {
4525                         BT_ERR("No memory for new connection");
4526                         goto unlock;
4527                 }
4528
4529                 conn->dst_type = ev->bdaddr_type;
4530
4531                 /* If we didn't have a hci_conn object previously
4532                  * but we're in master role this must be something
4533                  * initiated using a white list. Since white list based
4534                  * connections are not "first class citizens" we don't
4535                  * have full tracking of them. Therefore, we go ahead
4536                  * with a "best effort" approach of determining the
4537                  * initiator address based on the HCI_PRIVACY flag.
4538                  */
4539                 if (conn->out) {
4540                         conn->resp_addr_type = ev->bdaddr_type;
4541                         bacpy(&conn->resp_addr, &ev->bdaddr);
4542                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4543                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4544                                 bacpy(&conn->init_addr, &hdev->rpa);
4545                         } else {
4546                                 hci_copy_identity_address(hdev,
4547                                                           &conn->init_addr,
4548                                                           &conn->init_addr_type);
4549                         }
4550                 }
4551         } else {
4552                 cancel_delayed_work(&conn->le_conn_timeout);
4553         }
4554
4555         if (!conn->out) {
4556                 /* Set the responder (our side) address type based on
4557                  * the advertising address type.
4558                  */
4559                 conn->resp_addr_type = hdev->adv_addr_type;
4560                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4561                         bacpy(&conn->resp_addr, &hdev->random_addr);
4562                 else
4563                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4564
4565                 conn->init_addr_type = ev->bdaddr_type;
4566                 bacpy(&conn->init_addr, &ev->bdaddr);
4567
4568                 /* For incoming connections, set the default minimum
4569                  * and maximum connection interval. They will be used
4570                  * to check if the parameters are in range and if not
4571                  * trigger the connection update procedure.
4572                  */
4573                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4574                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4575         }
4576
4577         /* Lookup the identity address from the stored connection
4578          * address and address type.
4579          *
4580          * When establishing connections to an identity address, the
4581          * connection procedure will store the resolvable random
4582          * address first. Now if it can be converted back into the
4583          * identity address, start using the identity address from
4584          * now on.
4585          */
4586         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4587         if (irk) {
4588                 bacpy(&conn->dst, &irk->bdaddr);
4589                 conn->dst_type = irk->addr_type;
4590         }
4591
4592         if (ev->status) {
4593                 hci_le_conn_failed(conn, ev->status);
4594                 goto unlock;
4595         }
4596
4597         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4598                 addr_type = BDADDR_LE_PUBLIC;
4599         else
4600                 addr_type = BDADDR_LE_RANDOM;
4601
4602         /* Drop the connection if the device is blocked */
4603         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4604                 hci_conn_drop(conn);
4605                 goto unlock;
4606         }
4607
4608         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4609                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4610
4611         conn->sec_level = BT_SECURITY_LOW;
4612         conn->handle = __le16_to_cpu(ev->handle);
4613         conn->state = BT_CONFIG;
4614
4615         conn->le_conn_interval = le16_to_cpu(ev->interval);
4616         conn->le_conn_latency = le16_to_cpu(ev->latency);
4617         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4618
4619         hci_debugfs_create_conn(conn);
4620         hci_conn_add_sysfs(conn);
4621
4622         if (!ev->status) {
4623                 /* The remote features procedure is defined for master
4624                  * role only. So only in case of an initiated connection
4625                  * request the remote features.
4626                  *
4627                  * If the local controller supports slave-initiated features
4628                  * exchange, then requesting the remote features in slave
4629                  * role is possible. Otherwise just transition into the
4630                  * connected state without requesting the remote features.
4631                  */
4632                 if (conn->out ||
4633                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
4634                         struct hci_cp_le_read_remote_features cp;
4635
4636                         cp.handle = __cpu_to_le16(conn->handle);
4637
4638                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
4639                                      sizeof(cp), &cp);
4640
4641                         hci_conn_hold(conn);
4642                 } else {
4643                         conn->state = BT_CONNECTED;
4644                         hci_connect_cfm(conn, ev->status);
4645                 }
4646         } else {
4647                 hci_connect_cfm(conn, ev->status);
4648         }
4649
4650         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4651                                            conn->dst_type);
4652         if (params) {
4653                 list_del_init(&params->action);
4654                 if (params->conn) {
4655                         hci_conn_drop(params->conn);
4656                         hci_conn_put(params->conn);
4657                         params->conn = NULL;
4658                 }
4659         }
4660
4661 unlock:
4662         hci_update_background_scan(hdev);
4663         hci_dev_unlock(hdev);
4664 }
4665
4666 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4667                                             struct sk_buff *skb)
4668 {
4669         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4670         struct hci_conn *conn;
4671
4672         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4673
4674         if (ev->status)
4675                 return;
4676
4677         hci_dev_lock(hdev);
4678
4679         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4680         if (conn) {
4681                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4682                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4683                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4684         }
4685
4686         hci_dev_unlock(hdev);
4687 }
4688
4689 /* This function requires the caller holds hdev->lock */
4690 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4691                                               bdaddr_t *addr,
4692                                               u8 addr_type, u8 adv_type,
4693                                               bdaddr_t *direct_rpa)
4694 {
4695         struct hci_conn *conn;
4696         struct hci_conn_params *params;
4697
4698         /* If the event is not connectable don't proceed further */
4699         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4700                 return NULL;
4701
4702         /* Ignore if the device is blocked */
4703         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4704                 return NULL;
4705
4706         /* Most controller will fail if we try to create new connections
4707          * while we have an existing one in slave role.
4708          */
4709         if (hdev->conn_hash.le_num_slave > 0)
4710                 return NULL;
4711
4712         /* If we're not connectable only connect devices that we have in
4713          * our pend_le_conns list.
4714          */
4715         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
4716                                            addr_type);
4717         if (!params)
4718                 return NULL;
4719
4720         if (!params->explicit_connect) {
4721                 switch (params->auto_connect) {
4722                 case HCI_AUTO_CONN_DIRECT:
4723                         /* Only devices advertising with ADV_DIRECT_IND are
4724                          * triggering a connection attempt. This is allowing
4725                          * incoming connections from slave devices.
4726                          */
4727                         if (adv_type != LE_ADV_DIRECT_IND)
4728                                 return NULL;
4729                         break;
4730                 case HCI_AUTO_CONN_ALWAYS:
4731                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4732                          * are triggering a connection attempt. This means
4733                          * that incoming connectioms from slave device are
4734                          * accepted and also outgoing connections to slave
4735                          * devices are established when found.
4736                          */
4737                         break;
4738                 default:
4739                         return NULL;
4740                 }
4741         }
4742
4743         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4744                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
4745                               direct_rpa);
4746         if (!IS_ERR(conn)) {
4747                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
4748                  * by higher layer that tried to connect, if no then
4749                  * store the pointer since we don't really have any
4750                  * other owner of the object besides the params that
4751                  * triggered it. This way we can abort the connection if
4752                  * the parameters get removed and keep the reference
4753                  * count consistent once the connection is established.
4754                  */
4755
4756                 if (!params->explicit_connect)
4757                         params->conn = hci_conn_get(conn);
4758
4759                 return conn;
4760         }
4761
4762         switch (PTR_ERR(conn)) {
4763         case -EBUSY:
4764                 /* If hci_connect() returns -EBUSY it means there is already
4765                  * an LE connection attempt going on. Since controllers don't
4766                  * support more than one connection attempt at the time, we
4767                  * don't consider this an error case.
4768                  */
4769                 break;
4770         default:
4771                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4772                 return NULL;
4773         }
4774
4775         return NULL;
4776 }
4777
4778 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4779                                u8 bdaddr_type, bdaddr_t *direct_addr,
4780                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4781 {
4782         struct discovery_state *d = &hdev->discovery;
4783         struct smp_irk *irk;
4784         struct hci_conn *conn;
4785         bool match;
4786         u32 flags;
4787         u8 *ptr, real_len;
4788
4789         switch (type) {
4790         case LE_ADV_IND:
4791         case LE_ADV_DIRECT_IND:
4792         case LE_ADV_SCAN_IND:
4793         case LE_ADV_NONCONN_IND:
4794         case LE_ADV_SCAN_RSP:
4795                 break;
4796         default:
4797                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
4798                                    type);
4799                 return;
4800         }
4801
4802         if (len > HCI_MAX_AD_LENGTH) {
4803                 pr_err_ratelimited("legacy adv larger than 31 bytes");
4804                 return;
4805         }
4806
4807         /* Find the end of the data in case the report contains padded zero
4808          * bytes at the end causing an invalid length value.
4809          *
4810          * When data is NULL, len is 0 so there is no need for extra ptr
4811          * check as 'ptr < data + 0' is already false in such case.
4812          */
4813         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
4814                 if (ptr + 1 + *ptr > data + len)
4815                         break;
4816         }
4817
4818         real_len = ptr - data;
4819
4820         /* Adjust for actual length */
4821         if (len != real_len) {
4822                 BT_ERR_RATELIMITED("%s advertising data length corrected",
4823                                    hdev->name);
4824                 len = real_len;
4825         }
4826
4827         /* If the direct address is present, then this report is from
4828          * a LE Direct Advertising Report event. In that case it is
4829          * important to see if the address is matching the local
4830          * controller address.
4831          */
4832         if (direct_addr) {
4833                 /* Only resolvable random addresses are valid for these
4834                  * kind of reports and others can be ignored.
4835                  */
4836                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4837                         return;
4838
4839                 /* If the controller is not using resolvable random
4840                  * addresses, then this report can be ignored.
4841                  */
4842                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
4843                         return;
4844
4845                 /* If the local IRK of the controller does not match
4846                  * with the resolvable random address provided, then
4847                  * this report can be ignored.
4848                  */
4849                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4850                         return;
4851         }
4852
4853         /* Check if we need to convert to identity address */
4854         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4855         if (irk) {
4856                 bdaddr = &irk->bdaddr;
4857                 bdaddr_type = irk->addr_type;
4858         }
4859
4860         /* Check if we have been requested to connect to this device.
4861          *
4862          * direct_addr is set only for directed advertising reports (it is NULL
4863          * for advertising reports) and is already verified to be RPA above.
4864          */
4865         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
4866                                                                 direct_addr);
4867         if (conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
4868                 /* Store report for later inclusion by
4869                  * mgmt_device_connected
4870                  */
4871                 memcpy(conn->le_adv_data, data, len);
4872                 conn->le_adv_data_len = len;
4873         }
4874
4875         /* Passive scanning shouldn't trigger any device found events,
4876          * except for devices marked as CONN_REPORT for which we do send
4877          * device found events.
4878          */
4879         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4880                 if (type == LE_ADV_DIRECT_IND)
4881                         return;
4882
4883                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4884                                                bdaddr, bdaddr_type))
4885                         return;
4886
4887                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4888                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4889                 else
4890                         flags = 0;
4891                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4892                                   rssi, flags, data, len, NULL, 0);
4893                 return;
4894         }
4895
4896         /* When receiving non-connectable or scannable undirected
4897          * advertising reports, this means that the remote device is
4898          * not connectable and then clearly indicate this in the
4899          * device found event.
4900          *
4901          * When receiving a scan response, then there is no way to
4902          * know if the remote device is connectable or not. However
4903          * since scan responses are merged with a previously seen
4904          * advertising report, the flags field from that report
4905          * will be used.
4906          *
4907          * In the really unlikely case that a controller get confused
4908          * and just sends a scan response event, then it is marked as
4909          * not connectable as well.
4910          */
4911         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4912             type == LE_ADV_SCAN_RSP)
4913                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4914         else
4915                 flags = 0;
4916
4917         /* If there's nothing pending either store the data from this
4918          * event or send an immediate device found event if the data
4919          * should not be stored for later.
4920          */
4921         if (!has_pending_adv_report(hdev)) {
4922                 /* If the report will trigger a SCAN_REQ store it for
4923                  * later merging.
4924                  */
4925                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4926                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4927                                                  rssi, flags, data, len);
4928                         return;
4929                 }
4930
4931                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4932                                   rssi, flags, data, len, NULL, 0);
4933                 return;
4934         }
4935
4936         /* Check if the pending report is for the same device as the new one */
4937         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
4938                  bdaddr_type == d->last_adv_addr_type);
4939
4940         /* If the pending data doesn't match this report or this isn't a
4941          * scan response (e.g. we got a duplicate ADV_IND) then force
4942          * sending of the pending data.
4943          */
4944         if (type != LE_ADV_SCAN_RSP || !match) {
4945                 /* Send out whatever is in the cache, but skip duplicates */
4946                 if (!match)
4947                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4948                                           d->last_adv_addr_type, NULL,
4949                                           d->last_adv_rssi, d->last_adv_flags,
4950                                           d->last_adv_data,
4951                                           d->last_adv_data_len, NULL, 0);
4952
4953                 /* If the new report will trigger a SCAN_REQ store it for
4954                  * later merging.
4955                  */
4956                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
4957                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
4958                                                  rssi, flags, data, len);
4959                         return;
4960                 }
4961
4962                 /* The advertising reports cannot be merged, so clear
4963                  * the pending report and send out a device found event.
4964                  */
4965                 clear_pending_adv_report(hdev);
4966                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4967                                   rssi, flags, data, len, NULL, 0);
4968                 return;
4969         }
4970
4971         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
4972          * the new event is a SCAN_RSP. We can therefore proceed with
4973          * sending a merged device found event.
4974          */
4975         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
4976                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
4977                           d->last_adv_data, d->last_adv_data_len, data, len);
4978         clear_pending_adv_report(hdev);
4979 }
4980
4981 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
4982 {
4983         u8 num_reports = skb->data[0];
4984         void *ptr = &skb->data[1];
4985
4986         hci_dev_lock(hdev);
4987
4988         while (num_reports--) {
4989                 struct hci_ev_le_advertising_info *ev = ptr;
4990                 s8 rssi;
4991
4992                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
4993                         bt_dev_err(hdev, "Malicious advertising data.");
4994                         break;
4995                 }
4996
4997                 if (ev->length <= HCI_MAX_AD_LENGTH &&
4998                     ev->data + ev->length <= skb_tail_pointer(skb)) {
4999                         rssi = ev->data[ev->length];
5000                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5001                                            ev->bdaddr_type, NULL, 0, rssi,
5002                                            ev->data, ev->length);
5003                 } else {
5004                         bt_dev_err(hdev, "Dropping invalid advertising data");
5005                 }
5006
5007                 ptr += sizeof(*ev) + ev->length + 1;
5008         }
5009
5010         hci_dev_unlock(hdev);
5011 }
5012
5013 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5014                                             struct sk_buff *skb)
5015 {
5016         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5017         struct hci_conn *conn;
5018
5019         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5020
5021         hci_dev_lock(hdev);
5022
5023         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5024         if (conn) {
5025                 if (!ev->status)
5026                         memcpy(conn->features[0], ev->features, 8);
5027
5028                 if (conn->state == BT_CONFIG) {
5029                         __u8 status;
5030
5031                         /* If the local controller supports slave-initiated
5032                          * features exchange, but the remote controller does
5033                          * not, then it is possible that the error code 0x1a
5034                          * for unsupported remote feature gets returned.
5035                          *
5036                          * In this specific case, allow the connection to
5037                          * transition into connected state and mark it as
5038                          * successful.
5039                          */
5040                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5041                             !conn->out && ev->status == 0x1a)
5042                                 status = 0x00;
5043                         else
5044                                 status = ev->status;
5045
5046                         conn->state = BT_CONNECTED;
5047                         hci_connect_cfm(conn, status);
5048                         hci_conn_drop(conn);
5049                 }
5050         }
5051
5052         hci_dev_unlock(hdev);
5053 }
5054
5055 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5056 {
5057         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5058         struct hci_cp_le_ltk_reply cp;
5059         struct hci_cp_le_ltk_neg_reply neg;
5060         struct hci_conn *conn;
5061         struct smp_ltk *ltk;
5062
5063         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5064
5065         hci_dev_lock(hdev);
5066
5067         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5068         if (conn == NULL)
5069                 goto not_found;
5070
5071         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5072         if (!ltk)
5073                 goto not_found;
5074
5075         if (smp_ltk_is_sc(ltk)) {
5076                 /* With SC both EDiv and Rand are set to zero */
5077                 if (ev->ediv || ev->rand)
5078                         goto not_found;
5079         } else {
5080                 /* For non-SC keys check that EDiv and Rand match */
5081                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5082                         goto not_found;
5083         }
5084
5085         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5086         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5087         cp.handle = cpu_to_le16(conn->handle);
5088
5089         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5090
5091         conn->enc_key_size = ltk->enc_size;
5092
5093         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5094
5095         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5096          * temporary key used to encrypt a connection following
5097          * pairing. It is used during the Encrypted Session Setup to
5098          * distribute the keys. Later, security can be re-established
5099          * using a distributed LTK.
5100          */
5101         if (ltk->type == SMP_STK) {
5102                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5103                 list_del_rcu(&ltk->list);
5104                 kfree_rcu(ltk, rcu);
5105         } else {
5106                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5107         }
5108
5109         hci_dev_unlock(hdev);
5110
5111         return;
5112
5113 not_found:
5114         neg.handle = ev->handle;
5115         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5116         hci_dev_unlock(hdev);
5117 }
5118
5119 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5120                                       u8 reason)
5121 {
5122         struct hci_cp_le_conn_param_req_neg_reply cp;
5123
5124         cp.handle = cpu_to_le16(handle);
5125         cp.reason = reason;
5126
5127         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5128                      &cp);
5129 }
5130
5131 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5132                                              struct sk_buff *skb)
5133 {
5134         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5135         struct hci_cp_le_conn_param_req_reply cp;
5136         struct hci_conn *hcon;
5137         u16 handle, min, max, latency, timeout;
5138
5139         handle = le16_to_cpu(ev->handle);
5140         min = le16_to_cpu(ev->interval_min);
5141         max = le16_to_cpu(ev->interval_max);
5142         latency = le16_to_cpu(ev->latency);
5143         timeout = le16_to_cpu(ev->timeout);
5144
5145         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5146         if (!hcon || hcon->state != BT_CONNECTED)
5147                 return send_conn_param_neg_reply(hdev, handle,
5148                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5149
5150         if (hci_check_conn_params(min, max, latency, timeout))
5151                 return send_conn_param_neg_reply(hdev, handle,
5152                                                  HCI_ERROR_INVALID_LL_PARAMS);
5153
5154         if (hcon->role == HCI_ROLE_MASTER) {
5155                 struct hci_conn_params *params;
5156                 u8 store_hint;
5157
5158                 hci_dev_lock(hdev);
5159
5160                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5161                                                 hcon->dst_type);
5162                 if (params) {
5163                         params->conn_min_interval = min;
5164                         params->conn_max_interval = max;
5165                         params->conn_latency = latency;
5166                         params->supervision_timeout = timeout;
5167                         store_hint = 0x01;
5168                 } else{
5169                         store_hint = 0x00;
5170                 }
5171
5172                 hci_dev_unlock(hdev);
5173
5174                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5175                                     store_hint, min, max, latency, timeout);
5176         }
5177
5178         cp.handle = ev->handle;
5179         cp.interval_min = ev->interval_min;
5180         cp.interval_max = ev->interval_max;
5181         cp.latency = ev->latency;
5182         cp.timeout = ev->timeout;
5183         cp.min_ce_len = 0;
5184         cp.max_ce_len = 0;
5185
5186         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5187 }
5188
5189 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5190                                          struct sk_buff *skb)
5191 {
5192         u8 num_reports = skb->data[0];
5193         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
5194
5195         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
5196                 return;
5197
5198         hci_dev_lock(hdev);
5199
5200         for (; num_reports; num_reports--, ev++)
5201                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5202                                    ev->bdaddr_type, &ev->direct_addr,
5203                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5204
5205         hci_dev_unlock(hdev);
5206 }
5207
5208 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5209 {
5210         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5211
5212         skb_pull(skb, sizeof(*le_ev));
5213
5214         switch (le_ev->subevent) {
5215         case HCI_EV_LE_CONN_COMPLETE:
5216                 hci_le_conn_complete_evt(hdev, skb);
5217                 break;
5218
5219         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5220                 hci_le_conn_update_complete_evt(hdev, skb);
5221                 break;
5222
5223         case HCI_EV_LE_ADVERTISING_REPORT:
5224                 hci_le_adv_report_evt(hdev, skb);
5225                 break;
5226
5227         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5228                 hci_le_remote_feat_complete_evt(hdev, skb);
5229                 break;
5230
5231         case HCI_EV_LE_LTK_REQ:
5232                 hci_le_ltk_request_evt(hdev, skb);
5233                 break;
5234
5235         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5236                 hci_le_remote_conn_param_req_evt(hdev, skb);
5237                 break;
5238
5239         case HCI_EV_LE_DIRECT_ADV_REPORT:
5240                 hci_le_direct_adv_report_evt(hdev, skb);
5241                 break;
5242
5243         default:
5244                 break;
5245         }
5246 }
5247
5248 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5249                                  u8 event, struct sk_buff *skb)
5250 {
5251         struct hci_ev_cmd_complete *ev;
5252         struct hci_event_hdr *hdr;
5253
5254         if (!skb)
5255                 return false;
5256
5257         if (skb->len < sizeof(*hdr)) {
5258                 BT_ERR("Too short HCI event");
5259                 return false;
5260         }
5261
5262         hdr = (void *) skb->data;
5263         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5264
5265         if (event) {
5266                 if (hdr->evt != event)
5267                         return false;
5268                 return true;
5269         }
5270
5271         /* Check if request ended in Command Status - no way to retreive
5272          * any extra parameters in this case.
5273          */
5274         if (hdr->evt == HCI_EV_CMD_STATUS)
5275                 return false;
5276
5277         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5278                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
5279                 return false;
5280         }
5281
5282         if (skb->len < sizeof(*ev)) {
5283                 BT_ERR("Too short cmd_complete event");
5284                 return false;
5285         }
5286
5287         ev = (void *) skb->data;
5288         skb_pull(skb, sizeof(*ev));
5289
5290         if (opcode != __le16_to_cpu(ev->opcode)) {
5291                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5292                        __le16_to_cpu(ev->opcode));
5293                 return false;
5294         }
5295
5296         return true;
5297 }
5298
5299 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5300 {
5301         struct hci_event_hdr *hdr = (void *) skb->data;
5302         hci_req_complete_t req_complete = NULL;
5303         hci_req_complete_skb_t req_complete_skb = NULL;
5304         struct sk_buff *orig_skb = NULL;
5305         u8 status = 0, event = hdr->evt, req_evt = 0;
5306         u16 opcode = HCI_OP_NOP;
5307
5308         if (!event) {
5309                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
5310                 goto done;
5311         }
5312
5313         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5314                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5315                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5316                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5317                                      &req_complete_skb);
5318                 req_evt = event;
5319         }
5320
5321         /* If it looks like we might end up having to call
5322          * req_complete_skb, store a pristine copy of the skb since the
5323          * various handlers may modify the original one through
5324          * skb_pull() calls, etc.
5325          */
5326         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5327             event == HCI_EV_CMD_COMPLETE)
5328                 orig_skb = skb_clone(skb, GFP_KERNEL);
5329
5330         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5331
5332         switch (event) {
5333         case HCI_EV_INQUIRY_COMPLETE:
5334                 hci_inquiry_complete_evt(hdev, skb);
5335                 break;
5336
5337         case HCI_EV_INQUIRY_RESULT:
5338                 hci_inquiry_result_evt(hdev, skb);
5339                 break;
5340
5341         case HCI_EV_CONN_COMPLETE:
5342                 hci_conn_complete_evt(hdev, skb);
5343                 break;
5344
5345         case HCI_EV_CONN_REQUEST:
5346                 hci_conn_request_evt(hdev, skb);
5347                 break;
5348
5349         case HCI_EV_DISCONN_COMPLETE:
5350                 hci_disconn_complete_evt(hdev, skb);
5351                 break;
5352
5353         case HCI_EV_AUTH_COMPLETE:
5354                 hci_auth_complete_evt(hdev, skb);
5355                 break;
5356
5357         case HCI_EV_REMOTE_NAME:
5358                 hci_remote_name_evt(hdev, skb);
5359                 break;
5360
5361         case HCI_EV_ENCRYPT_CHANGE:
5362                 hci_encrypt_change_evt(hdev, skb);
5363                 break;
5364
5365         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5366                 hci_change_link_key_complete_evt(hdev, skb);
5367                 break;
5368
5369         case HCI_EV_REMOTE_FEATURES:
5370                 hci_remote_features_evt(hdev, skb);
5371                 break;
5372
5373         case HCI_EV_CMD_COMPLETE:
5374                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5375                                      &req_complete, &req_complete_skb);
5376                 break;
5377
5378         case HCI_EV_CMD_STATUS:
5379                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5380                                    &req_complete_skb);
5381                 break;
5382
5383         case HCI_EV_HARDWARE_ERROR:
5384                 hci_hardware_error_evt(hdev, skb);
5385                 break;
5386
5387         case HCI_EV_ROLE_CHANGE:
5388                 hci_role_change_evt(hdev, skb);
5389                 break;
5390
5391         case HCI_EV_NUM_COMP_PKTS:
5392                 hci_num_comp_pkts_evt(hdev, skb);
5393                 break;
5394
5395         case HCI_EV_MODE_CHANGE:
5396                 hci_mode_change_evt(hdev, skb);
5397                 break;
5398
5399         case HCI_EV_PIN_CODE_REQ:
5400                 hci_pin_code_request_evt(hdev, skb);
5401                 break;
5402
5403         case HCI_EV_LINK_KEY_REQ:
5404                 hci_link_key_request_evt(hdev, skb);
5405                 break;
5406
5407         case HCI_EV_LINK_KEY_NOTIFY:
5408                 hci_link_key_notify_evt(hdev, skb);
5409                 break;
5410
5411         case HCI_EV_CLOCK_OFFSET:
5412                 hci_clock_offset_evt(hdev, skb);
5413                 break;
5414
5415         case HCI_EV_PKT_TYPE_CHANGE:
5416                 hci_pkt_type_change_evt(hdev, skb);
5417                 break;
5418
5419         case HCI_EV_PSCAN_REP_MODE:
5420                 hci_pscan_rep_mode_evt(hdev, skb);
5421                 break;
5422
5423         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5424                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5425                 break;
5426
5427         case HCI_EV_REMOTE_EXT_FEATURES:
5428                 hci_remote_ext_features_evt(hdev, skb);
5429                 break;
5430
5431         case HCI_EV_SYNC_CONN_COMPLETE:
5432                 hci_sync_conn_complete_evt(hdev, skb);
5433                 break;
5434
5435         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5436                 hci_extended_inquiry_result_evt(hdev, skb);
5437                 break;
5438
5439         case HCI_EV_KEY_REFRESH_COMPLETE:
5440                 hci_key_refresh_complete_evt(hdev, skb);
5441                 break;
5442
5443         case HCI_EV_IO_CAPA_REQUEST:
5444                 hci_io_capa_request_evt(hdev, skb);
5445                 break;
5446
5447         case HCI_EV_IO_CAPA_REPLY:
5448                 hci_io_capa_reply_evt(hdev, skb);
5449                 break;
5450
5451         case HCI_EV_USER_CONFIRM_REQUEST:
5452                 hci_user_confirm_request_evt(hdev, skb);
5453                 break;
5454
5455         case HCI_EV_USER_PASSKEY_REQUEST:
5456                 hci_user_passkey_request_evt(hdev, skb);
5457                 break;
5458
5459         case HCI_EV_USER_PASSKEY_NOTIFY:
5460                 hci_user_passkey_notify_evt(hdev, skb);
5461                 break;
5462
5463         case HCI_EV_KEYPRESS_NOTIFY:
5464                 hci_keypress_notify_evt(hdev, skb);
5465                 break;
5466
5467         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5468                 hci_simple_pair_complete_evt(hdev, skb);
5469                 break;
5470
5471         case HCI_EV_REMOTE_HOST_FEATURES:
5472                 hci_remote_host_features_evt(hdev, skb);
5473                 break;
5474
5475         case HCI_EV_LE_META:
5476                 hci_le_meta_evt(hdev, skb);
5477                 break;
5478
5479         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5480                 hci_remote_oob_data_request_evt(hdev, skb);
5481                 break;
5482
5483 #if IS_ENABLED(CONFIG_BT_HS)
5484         case HCI_EV_CHANNEL_SELECTED:
5485                 hci_chan_selected_evt(hdev, skb);
5486                 break;
5487
5488         case HCI_EV_PHY_LINK_COMPLETE:
5489                 hci_phy_link_complete_evt(hdev, skb);
5490                 break;
5491
5492         case HCI_EV_LOGICAL_LINK_COMPLETE:
5493                 hci_loglink_complete_evt(hdev, skb);
5494                 break;
5495
5496         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5497                 hci_disconn_loglink_complete_evt(hdev, skb);
5498                 break;
5499
5500         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5501                 hci_disconn_phylink_complete_evt(hdev, skb);
5502                 break;
5503 #endif
5504
5505         case HCI_EV_NUM_COMP_BLOCKS:
5506                 hci_num_comp_blocks_evt(hdev, skb);
5507                 break;
5508
5509         default:
5510                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5511                 break;
5512         }
5513
5514         if (req_complete) {
5515                 req_complete(hdev, status, opcode);
5516         } else if (req_complete_skb) {
5517                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
5518                         kfree_skb(orig_skb);
5519                         orig_skb = NULL;
5520                 }
5521                 req_complete_skb(hdev, status, opcode, orig_skb);
5522         }
5523
5524 done:
5525         kfree_skb(orig_skb);
5526         kfree_skb(skb);
5527         hdev->stat.evt_rx++;
5528 }