linux/net/bluetooth/hci_event.c
<<
>>
Prefs
   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7   This program is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU General Public License version 2 as
   9   published by the Free Software Foundation;
  10
  11   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22   SOFTWARE IS DISCLAIMED.
  23*/
  24
  25/* Bluetooth HCI event handling. */
  26
  27#include <asm/unaligned.h>
  28
  29#include <net/bluetooth/bluetooth.h>
  30#include <net/bluetooth/hci_core.h>
  31#include <net/bluetooth/mgmt.h>
  32
  33#include "hci_request.h"
  34#include "hci_debugfs.h"
  35#include "a2mp.h"
  36#include "amp.h"
  37#include "smp.h"
  38#include "msft.h"
  39
  40#define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                 "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43/* Handle HCI Event packets */
  44
  45static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  46                                  u8 *new_status)
  47{
  48        __u8 status = *((__u8 *) skb->data);
  49
  50        BT_DBG("%s status 0x%2.2x", hdev->name, status);
  51
  52        /* It is possible that we receive Inquiry Complete event right
  53         * before we receive Inquiry Cancel Command Complete event, in
  54         * which case the latter event should have status of Command
  55         * Disallowed (0x0c). This should not be treated as error, since
  56         * we actually achieve what Inquiry Cancel wants to achieve,
  57         * which is to end the last Inquiry session.
  58         */
  59        if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  60                bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  61                status = 0x00;
  62        }
  63
  64        *new_status = status;
  65
  66        if (status)
  67                return;
  68
  69        clear_bit(HCI_INQUIRY, &hdev->flags);
  70        smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  71        wake_up_bit(&hdev->flags, HCI_INQUIRY);
  72
  73        hci_dev_lock(hdev);
  74        /* Set discovery state to stopped if we're not doing LE active
  75         * scanning.
  76         */
  77        if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  78            hdev->le_scan_type != LE_SCAN_ACTIVE)
  79                hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  80        hci_dev_unlock(hdev);
  81
  82        hci_conn_check_pending(hdev);
  83}
  84
  85static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  86{
  87        __u8 status = *((__u8 *) skb->data);
  88
  89        BT_DBG("%s status 0x%2.2x", hdev->name, status);
  90
  91        if (status)
  92                return;
  93
  94        hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  95}
  96
  97static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  98{
  99        __u8 status = *((__u8 *) skb->data);
 100
 101        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 102
 103        if (status)
 104                return;
 105
 106        hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 107
 108        hci_conn_check_pending(hdev);
 109}
 110
 111static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 112                                          struct sk_buff *skb)
 113{
 114        BT_DBG("%s", hdev->name);
 115}
 116
 117static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 118{
 119        struct hci_rp_role_discovery *rp = (void *) skb->data;
 120        struct hci_conn *conn;
 121
 122        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 123
 124        if (rp->status)
 125                return;
 126
 127        hci_dev_lock(hdev);
 128
 129        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 130        if (conn)
 131                conn->role = rp->role;
 132
 133        hci_dev_unlock(hdev);
 134}
 135
 136static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 137{
 138        struct hci_rp_read_link_policy *rp = (void *) skb->data;
 139        struct hci_conn *conn;
 140
 141        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 142
 143        if (rp->status)
 144                return;
 145
 146        hci_dev_lock(hdev);
 147
 148        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 149        if (conn)
 150                conn->link_policy = __le16_to_cpu(rp->policy);
 151
 152        hci_dev_unlock(hdev);
 153}
 154
 155static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 156{
 157        struct hci_rp_write_link_policy *rp = (void *) skb->data;
 158        struct hci_conn *conn;
 159        void *sent;
 160
 161        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 162
 163        if (rp->status)
 164                return;
 165
 166        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 167        if (!sent)
 168                return;
 169
 170        hci_dev_lock(hdev);
 171
 172        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 173        if (conn)
 174                conn->link_policy = get_unaligned_le16(sent + 2);
 175
 176        hci_dev_unlock(hdev);
 177}
 178
 179static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 180                                        struct sk_buff *skb)
 181{
 182        struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 183
 184        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 185
 186        if (rp->status)
 187                return;
 188
 189        hdev->link_policy = __le16_to_cpu(rp->policy);
 190}
 191
 192static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 193                                         struct sk_buff *skb)
 194{
 195        __u8 status = *((__u8 *) skb->data);
 196        void *sent;
 197
 198        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200        if (status)
 201                return;
 202
 203        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 204        if (!sent)
 205                return;
 206
 207        hdev->link_policy = get_unaligned_le16(sent);
 208}
 209
 210static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 211{
 212        __u8 status = *((__u8 *) skb->data);
 213
 214        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 215
 216        clear_bit(HCI_RESET, &hdev->flags);
 217
 218        if (status)
 219                return;
 220
 221        /* Reset all non-persistent flags */
 222        hci_dev_clear_volatile_flags(hdev);
 223
 224        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 225
 226        hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227        hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229        memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230        hdev->adv_data_len = 0;
 231
 232        memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233        hdev->scan_rsp_data_len = 0;
 234
 235        hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237        hdev->ssp_debug_mode = 0;
 238
 239        hci_bdaddr_list_clear(&hdev->le_accept_list);
 240        hci_bdaddr_list_clear(&hdev->le_resolv_list);
 241}
 242
 243static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 244                                        struct sk_buff *skb)
 245{
 246        struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 247        struct hci_cp_read_stored_link_key *sent;
 248
 249        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 250
 251        sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 252        if (!sent)
 253                return;
 254
 255        if (!rp->status && sent->read_all == 0x01) {
 256                hdev->stored_max_keys = rp->max_keys;
 257                hdev->stored_num_keys = rp->num_keys;
 258        }
 259}
 260
 261static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 262                                          struct sk_buff *skb)
 263{
 264        struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 265
 266        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 267
 268        if (rp->status)
 269                return;
 270
 271        if (rp->num_keys <= hdev->stored_num_keys)
 272                hdev->stored_num_keys -= rp->num_keys;
 273        else
 274                hdev->stored_num_keys = 0;
 275}
 276
 277static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 278{
 279        __u8 status = *((__u8 *) skb->data);
 280        void *sent;
 281
 282        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 283
 284        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 285        if (!sent)
 286                return;
 287
 288        hci_dev_lock(hdev);
 289
 290        if (hci_dev_test_flag(hdev, HCI_MGMT))
 291                mgmt_set_local_name_complete(hdev, sent, status);
 292        else if (!status)
 293                memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 294
 295        hci_dev_unlock(hdev);
 296}
 297
 298static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 299{
 300        struct hci_rp_read_local_name *rp = (void *) skb->data;
 301
 302        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 303
 304        if (rp->status)
 305                return;
 306
 307        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 308            hci_dev_test_flag(hdev, HCI_CONFIG))
 309                memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 310}
 311
 312static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 313{
 314        __u8 status = *((__u8 *) skb->data);
 315        void *sent;
 316
 317        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 318
 319        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 320        if (!sent)
 321                return;
 322
 323        hci_dev_lock(hdev);
 324
 325        if (!status) {
 326                __u8 param = *((__u8 *) sent);
 327
 328                if (param == AUTH_ENABLED)
 329                        set_bit(HCI_AUTH, &hdev->flags);
 330                else
 331                        clear_bit(HCI_AUTH, &hdev->flags);
 332        }
 333
 334        if (hci_dev_test_flag(hdev, HCI_MGMT))
 335                mgmt_auth_enable_complete(hdev, status);
 336
 337        hci_dev_unlock(hdev);
 338}
 339
 340static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 341{
 342        __u8 status = *((__u8 *) skb->data);
 343        __u8 param;
 344        void *sent;
 345
 346        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 347
 348        if (status)
 349                return;
 350
 351        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 352        if (!sent)
 353                return;
 354
 355        param = *((__u8 *) sent);
 356
 357        if (param)
 358                set_bit(HCI_ENCRYPT, &hdev->flags);
 359        else
 360                clear_bit(HCI_ENCRYPT, &hdev->flags);
 361}
 362
 363static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 364{
 365        __u8 status = *((__u8 *) skb->data);
 366        __u8 param;
 367        void *sent;
 368
 369        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 370
 371        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 372        if (!sent)
 373                return;
 374
 375        param = *((__u8 *) sent);
 376
 377        hci_dev_lock(hdev);
 378
 379        if (status) {
 380                hdev->discov_timeout = 0;
 381                goto done;
 382        }
 383
 384        if (param & SCAN_INQUIRY)
 385                set_bit(HCI_ISCAN, &hdev->flags);
 386        else
 387                clear_bit(HCI_ISCAN, &hdev->flags);
 388
 389        if (param & SCAN_PAGE)
 390                set_bit(HCI_PSCAN, &hdev->flags);
 391        else
 392                clear_bit(HCI_PSCAN, &hdev->flags);
 393
 394done:
 395        hci_dev_unlock(hdev);
 396}
 397
 398static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 399{
 400        __u8 status = *((__u8 *)skb->data);
 401        struct hci_cp_set_event_filter *cp;
 402        void *sent;
 403
 404        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 405
 406        if (status)
 407                return;
 408
 409        sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 410        if (!sent)
 411                return;
 412
 413        cp = (struct hci_cp_set_event_filter *)sent;
 414
 415        if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 416                hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 417        else
 418                hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 419}
 420
 421static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 422{
 423        struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 424
 425        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 426
 427        if (rp->status)
 428                return;
 429
 430        memcpy(hdev->dev_class, rp->dev_class, 3);
 431
 432        BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 433               hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 434}
 435
 436static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 437{
 438        __u8 status = *((__u8 *) skb->data);
 439        void *sent;
 440
 441        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 442
 443        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 444        if (!sent)
 445                return;
 446
 447        hci_dev_lock(hdev);
 448
 449        if (status == 0)
 450                memcpy(hdev->dev_class, sent, 3);
 451
 452        if (hci_dev_test_flag(hdev, HCI_MGMT))
 453                mgmt_set_class_of_dev_complete(hdev, sent, status);
 454
 455        hci_dev_unlock(hdev);
 456}
 457
 458static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 459{
 460        struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 461        __u16 setting;
 462
 463        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 464
 465        if (rp->status)
 466                return;
 467
 468        setting = __le16_to_cpu(rp->voice_setting);
 469
 470        if (hdev->voice_setting == setting)
 471                return;
 472
 473        hdev->voice_setting = setting;
 474
 475        BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 476
 477        if (hdev->notify)
 478                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 479}
 480
 481static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 482                                       struct sk_buff *skb)
 483{
 484        __u8 status = *((__u8 *) skb->data);
 485        __u16 setting;
 486        void *sent;
 487
 488        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 489
 490        if (status)
 491                return;
 492
 493        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 494        if (!sent)
 495                return;
 496
 497        setting = get_unaligned_le16(sent);
 498
 499        if (hdev->voice_setting == setting)
 500                return;
 501
 502        hdev->voice_setting = setting;
 503
 504        BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 505
 506        if (hdev->notify)
 507                hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 508}
 509
 510static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 511                                          struct sk_buff *skb)
 512{
 513        struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 514
 515        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 516
 517        if (rp->status)
 518                return;
 519
 520        hdev->num_iac = rp->num_iac;
 521
 522        BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 523}
 524
 525static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 526{
 527        __u8 status = *((__u8 *) skb->data);
 528        struct hci_cp_write_ssp_mode *sent;
 529
 530        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 531
 532        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 533        if (!sent)
 534                return;
 535
 536        hci_dev_lock(hdev);
 537
 538        if (!status) {
 539                if (sent->mode)
 540                        hdev->features[1][0] |= LMP_HOST_SSP;
 541                else
 542                        hdev->features[1][0] &= ~LMP_HOST_SSP;
 543        }
 544
 545        if (hci_dev_test_flag(hdev, HCI_MGMT))
 546                mgmt_ssp_enable_complete(hdev, sent->mode, status);
 547        else if (!status) {
 548                if (sent->mode)
 549                        hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 550                else
 551                        hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 552        }
 553
 554        hci_dev_unlock(hdev);
 555}
 556
 557static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 558{
 559        u8 status = *((u8 *) skb->data);
 560        struct hci_cp_write_sc_support *sent;
 561
 562        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 563
 564        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 565        if (!sent)
 566                return;
 567
 568        hci_dev_lock(hdev);
 569
 570        if (!status) {
 571                if (sent->support)
 572                        hdev->features[1][0] |= LMP_HOST_SC;
 573                else
 574                        hdev->features[1][0] &= ~LMP_HOST_SC;
 575        }
 576
 577        if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 578                if (sent->support)
 579                        hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 580                else
 581                        hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 582        }
 583
 584        hci_dev_unlock(hdev);
 585}
 586
 587static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 588{
 589        struct hci_rp_read_local_version *rp = (void *) skb->data;
 590
 591        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 592
 593        if (rp->status)
 594                return;
 595
 596        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 597            hci_dev_test_flag(hdev, HCI_CONFIG)) {
 598                hdev->hci_ver = rp->hci_ver;
 599                hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 600                hdev->lmp_ver = rp->lmp_ver;
 601                hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 602                hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 603        }
 604}
 605
 606static void hci_cc_read_local_commands(struct hci_dev *hdev,
 607                                       struct sk_buff *skb)
 608{
 609        struct hci_rp_read_local_commands *rp = (void *) skb->data;
 610
 611        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 612
 613        if (rp->status)
 614                return;
 615
 616        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 617            hci_dev_test_flag(hdev, HCI_CONFIG))
 618                memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 619}
 620
 621static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 622                                             struct sk_buff *skb)
 623{
 624        struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 625        struct hci_conn *conn;
 626
 627        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 628
 629        if (rp->status)
 630                return;
 631
 632        hci_dev_lock(hdev);
 633
 634        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 635        if (conn)
 636                conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 637
 638        hci_dev_unlock(hdev);
 639}
 640
 641static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 642                                              struct sk_buff *skb)
 643{
 644        struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 645        struct hci_conn *conn;
 646        void *sent;
 647
 648        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 649
 650        if (rp->status)
 651                return;
 652
 653        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 654        if (!sent)
 655                return;
 656
 657        hci_dev_lock(hdev);
 658
 659        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 660        if (conn)
 661                conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 662
 663        hci_dev_unlock(hdev);
 664}
 665
 666static void hci_cc_read_local_features(struct hci_dev *hdev,
 667                                       struct sk_buff *skb)
 668{
 669        struct hci_rp_read_local_features *rp = (void *) skb->data;
 670
 671        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 672
 673        if (rp->status)
 674                return;
 675
 676        memcpy(hdev->features, rp->features, 8);
 677
 678        /* Adjust default settings according to features
 679         * supported by device. */
 680
 681        if (hdev->features[0][0] & LMP_3SLOT)
 682                hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 683
 684        if (hdev->features[0][0] & LMP_5SLOT)
 685                hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 686
 687        if (hdev->features[0][1] & LMP_HV2) {
 688                hdev->pkt_type  |= (HCI_HV2);
 689                hdev->esco_type |= (ESCO_HV2);
 690        }
 691
 692        if (hdev->features[0][1] & LMP_HV3) {
 693                hdev->pkt_type  |= (HCI_HV3);
 694                hdev->esco_type |= (ESCO_HV3);
 695        }
 696
 697        if (lmp_esco_capable(hdev))
 698                hdev->esco_type |= (ESCO_EV3);
 699
 700        if (hdev->features[0][4] & LMP_EV4)
 701                hdev->esco_type |= (ESCO_EV4);
 702
 703        if (hdev->features[0][4] & LMP_EV5)
 704                hdev->esco_type |= (ESCO_EV5);
 705
 706        if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 707                hdev->esco_type |= (ESCO_2EV3);
 708
 709        if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 710                hdev->esco_type |= (ESCO_3EV3);
 711
 712        if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 713                hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 714}
 715
 716static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 717                                           struct sk_buff *skb)
 718{
 719        struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 720
 721        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 722
 723        if (rp->status)
 724                return;
 725
 726        if (hdev->max_page < rp->max_page)
 727                hdev->max_page = rp->max_page;
 728
 729        if (rp->page < HCI_MAX_PAGES)
 730                memcpy(hdev->features[rp->page], rp->features, 8);
 731}
 732
 733static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 734                                          struct sk_buff *skb)
 735{
 736        struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 737
 738        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740        if (rp->status)
 741                return;
 742
 743        hdev->flow_ctl_mode = rp->mode;
 744}
 745
 746static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 747{
 748        struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 749
 750        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 751
 752        if (rp->status)
 753                return;
 754
 755        hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 756        hdev->sco_mtu  = rp->sco_mtu;
 757        hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 758        hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 759
 760        if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 761                hdev->sco_mtu  = 64;
 762                hdev->sco_pkts = 8;
 763        }
 764
 765        hdev->acl_cnt = hdev->acl_pkts;
 766        hdev->sco_cnt = hdev->sco_pkts;
 767
 768        BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 769               hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 770}
 771
 772static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 773{
 774        struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 775
 776        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 777
 778        if (rp->status)
 779                return;
 780
 781        if (test_bit(HCI_INIT, &hdev->flags))
 782                bacpy(&hdev->bdaddr, &rp->bdaddr);
 783
 784        if (hci_dev_test_flag(hdev, HCI_SETUP))
 785                bacpy(&hdev->setup_addr, &rp->bdaddr);
 786}
 787
 788static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 789                                           struct sk_buff *skb)
 790{
 791        struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 792
 793        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 794
 795        if (rp->status)
 796                return;
 797
 798        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 799            hci_dev_test_flag(hdev, HCI_CONFIG)) {
 800                hdev->pairing_opts = rp->pairing_opts;
 801                hdev->max_enc_key_size = rp->max_key_size;
 802        }
 803}
 804
 805static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 806                                           struct sk_buff *skb)
 807{
 808        struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 809
 810        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 811
 812        if (rp->status)
 813                return;
 814
 815        if (test_bit(HCI_INIT, &hdev->flags)) {
 816                hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 817                hdev->page_scan_window = __le16_to_cpu(rp->window);
 818        }
 819}
 820
 821static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 822                                            struct sk_buff *skb)
 823{
 824        u8 status = *((u8 *) skb->data);
 825        struct hci_cp_write_page_scan_activity *sent;
 826
 827        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 828
 829        if (status)
 830                return;
 831
 832        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 833        if (!sent)
 834                return;
 835
 836        hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 837        hdev->page_scan_window = __le16_to_cpu(sent->window);
 838}
 839
 840static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 841                                           struct sk_buff *skb)
 842{
 843        struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 844
 845        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 846
 847        if (rp->status)
 848                return;
 849
 850        if (test_bit(HCI_INIT, &hdev->flags))
 851                hdev->page_scan_type = rp->type;
 852}
 853
 854static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 855                                        struct sk_buff *skb)
 856{
 857        u8 status = *((u8 *) skb->data);
 858        u8 *type;
 859
 860        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 861
 862        if (status)
 863                return;
 864
 865        type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 866        if (type)
 867                hdev->page_scan_type = *type;
 868}
 869
 870static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 871                                        struct sk_buff *skb)
 872{
 873        struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 874
 875        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 876
 877        if (rp->status)
 878                return;
 879
 880        hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 881        hdev->block_len = __le16_to_cpu(rp->block_len);
 882        hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 883
 884        hdev->block_cnt = hdev->num_blocks;
 885
 886        BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 887               hdev->block_cnt, hdev->block_len);
 888}
 889
 890static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 891{
 892        struct hci_rp_read_clock *rp = (void *) skb->data;
 893        struct hci_cp_read_clock *cp;
 894        struct hci_conn *conn;
 895
 896        BT_DBG("%s", hdev->name);
 897
 898        if (skb->len < sizeof(*rp))
 899                return;
 900
 901        if (rp->status)
 902                return;
 903
 904        hci_dev_lock(hdev);
 905
 906        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 907        if (!cp)
 908                goto unlock;
 909
 910        if (cp->which == 0x00) {
 911                hdev->clock = le32_to_cpu(rp->clock);
 912                goto unlock;
 913        }
 914
 915        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 916        if (conn) {
 917                conn->clock = le32_to_cpu(rp->clock);
 918                conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 919        }
 920
 921unlock:
 922        hci_dev_unlock(hdev);
 923}
 924
 925static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 926                                       struct sk_buff *skb)
 927{
 928        struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 929
 930        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 931
 932        if (rp->status)
 933                return;
 934
 935        hdev->amp_status = rp->amp_status;
 936        hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 937        hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 938        hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 939        hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 940        hdev->amp_type = rp->amp_type;
 941        hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 942        hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 943        hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 944        hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 945}
 946
 947static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 948                                         struct sk_buff *skb)
 949{
 950        struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 951
 952        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 953
 954        if (rp->status)
 955                return;
 956
 957        hdev->inq_tx_power = rp->tx_power;
 958}
 959
 960static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 961                                               struct sk_buff *skb)
 962{
 963        struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 964
 965        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 966
 967        if (rp->status)
 968                return;
 969
 970        hdev->err_data_reporting = rp->err_data_reporting;
 971}
 972
 973static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 974                                                struct sk_buff *skb)
 975{
 976        __u8 status = *((__u8 *)skb->data);
 977        struct hci_cp_write_def_err_data_reporting *cp;
 978
 979        BT_DBG("%s status 0x%2.2x", hdev->name, status);
 980
 981        if (status)
 982                return;
 983
 984        cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 985        if (!cp)
 986                return;
 987
 988        hdev->err_data_reporting = cp->err_data_reporting;
 989}
 990
 991static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 992{
 993        struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 994        struct hci_cp_pin_code_reply *cp;
 995        struct hci_conn *conn;
 996
 997        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 998
 999        hci_dev_lock(hdev);
1000
1001        if (hci_dev_test_flag(hdev, HCI_MGMT))
1002                mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1003
1004        if (rp->status)
1005                goto unlock;
1006
1007        cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1008        if (!cp)
1009                goto unlock;
1010
1011        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1012        if (conn)
1013                conn->pin_length = cp->pin_len;
1014
1015unlock:
1016        hci_dev_unlock(hdev);
1017}
1018
1019static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1020{
1021        struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1022
1023        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1024
1025        hci_dev_lock(hdev);
1026
1027        if (hci_dev_test_flag(hdev, HCI_MGMT))
1028                mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1029                                                 rp->status);
1030
1031        hci_dev_unlock(hdev);
1032}
1033
1034static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1035                                       struct sk_buff *skb)
1036{
1037        struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1038
1039        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1040
1041        if (rp->status)
1042                return;
1043
1044        hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1045        hdev->le_pkts = rp->le_max_pkt;
1046
1047        hdev->le_cnt = hdev->le_pkts;
1048
1049        BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1050}
1051
1052static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1053                                          struct sk_buff *skb)
1054{
1055        struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1056
1057        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1058
1059        if (rp->status)
1060                return;
1061
1062        memcpy(hdev->le_features, rp->features, 8);
1063}
1064
1065static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1066                                        struct sk_buff *skb)
1067{
1068        struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1069
1070        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1071
1072        if (rp->status)
1073                return;
1074
1075        hdev->adv_tx_power = rp->tx_power;
1076}
1077
1078static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1079{
1080        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1081
1082        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1083
1084        hci_dev_lock(hdev);
1085
1086        if (hci_dev_test_flag(hdev, HCI_MGMT))
1087                mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1088                                                 rp->status);
1089
1090        hci_dev_unlock(hdev);
1091}
1092
1093static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1094                                          struct sk_buff *skb)
1095{
1096        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1097
1098        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1099
1100        hci_dev_lock(hdev);
1101
1102        if (hci_dev_test_flag(hdev, HCI_MGMT))
1103                mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1104                                                     ACL_LINK, 0, rp->status);
1105
1106        hci_dev_unlock(hdev);
1107}
1108
1109static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1110{
1111        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1112
1113        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1114
1115        hci_dev_lock(hdev);
1116
1117        if (hci_dev_test_flag(hdev, HCI_MGMT))
1118                mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1119                                                 0, rp->status);
1120
1121        hci_dev_unlock(hdev);
1122}
1123
1124static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1125                                          struct sk_buff *skb)
1126{
1127        struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1128
1129        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1130
1131        hci_dev_lock(hdev);
1132
1133        if (hci_dev_test_flag(hdev, HCI_MGMT))
1134                mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1135                                                     ACL_LINK, 0, rp->status);
1136
1137        hci_dev_unlock(hdev);
1138}
1139
1140static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1141                                       struct sk_buff *skb)
1142{
1143        struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1144
1145        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1146}
1147
1148static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1149                                           struct sk_buff *skb)
1150{
1151        struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1152
1153        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1154}
1155
1156static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1157{
1158        __u8 status = *((__u8 *) skb->data);
1159        bdaddr_t *sent;
1160
1161        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1162
1163        if (status)
1164                return;
1165
1166        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1167        if (!sent)
1168                return;
1169
1170        hci_dev_lock(hdev);
1171
1172        bacpy(&hdev->random_addr, sent);
1173
1174        hci_dev_unlock(hdev);
1175}
1176
1177static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1178{
1179        __u8 status = *((__u8 *) skb->data);
1180        struct hci_cp_le_set_default_phy *cp;
1181
1182        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1183
1184        if (status)
1185                return;
1186
1187        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1188        if (!cp)
1189                return;
1190
1191        hci_dev_lock(hdev);
1192
1193        hdev->le_tx_def_phys = cp->tx_phys;
1194        hdev->le_rx_def_phys = cp->rx_phys;
1195
1196        hci_dev_unlock(hdev);
1197}
1198
1199static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1200                                              struct sk_buff *skb)
1201{
1202        __u8 status = *((__u8 *) skb->data);
1203        struct hci_cp_le_set_adv_set_rand_addr *cp;
1204        struct adv_info *adv_instance;
1205
1206        if (status)
1207                return;
1208
1209        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1210        if (!cp)
1211                return;
1212
1213        hci_dev_lock(hdev);
1214
1215        if (!cp->handle) {
1216                /* Store in hdev for instance 0 (Set adv and Directed advs) */
1217                bacpy(&hdev->random_addr, &cp->bdaddr);
1218        } else {
1219                adv_instance = hci_find_adv_instance(hdev, cp->handle);
1220                if (adv_instance)
1221                        bacpy(&adv_instance->random_addr, &cp->bdaddr);
1222        }
1223
1224        hci_dev_unlock(hdev);
1225}
1226
1227static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1228                                          struct sk_buff *skb)
1229{
1230        struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1231
1232        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1233
1234        if (rp->status)
1235                return;
1236
1237        hdev->min_le_tx_power = rp->min_le_tx_power;
1238        hdev->max_le_tx_power = rp->max_le_tx_power;
1239}
1240
1241static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1242{
1243        __u8 *sent, status = *((__u8 *) skb->data);
1244
1245        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1246
1247        if (status)
1248                return;
1249
1250        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1251        if (!sent)
1252                return;
1253
1254        hci_dev_lock(hdev);
1255
1256        /* If we're doing connection initiation as peripheral. Set a
1257         * timeout in case something goes wrong.
1258         */
1259        if (*sent) {
1260                struct hci_conn *conn;
1261
1262                hci_dev_set_flag(hdev, HCI_LE_ADV);
1263
1264                conn = hci_lookup_le_connect(hdev);
1265                if (conn)
1266                        queue_delayed_work(hdev->workqueue,
1267                                           &conn->le_conn_timeout,
1268                                           conn->conn_timeout);
1269        } else {
1270                hci_dev_clear_flag(hdev, HCI_LE_ADV);
1271        }
1272
1273        hci_dev_unlock(hdev);
1274}
1275
1276static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1277                                         struct sk_buff *skb)
1278{
1279        struct hci_cp_le_set_ext_adv_enable *cp;
1280        __u8 status = *((__u8 *) skb->data);
1281
1282        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1283
1284        if (status)
1285                return;
1286
1287        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1288        if (!cp)
1289                return;
1290
1291        hci_dev_lock(hdev);
1292
1293        if (cp->enable) {
1294                struct hci_conn *conn;
1295
1296                hci_dev_set_flag(hdev, HCI_LE_ADV);
1297
1298                conn = hci_lookup_le_connect(hdev);
1299                if (conn)
1300                        queue_delayed_work(hdev->workqueue,
1301                                           &conn->le_conn_timeout,
1302                                           conn->conn_timeout);
1303        } else {
1304                hci_dev_clear_flag(hdev, HCI_LE_ADV);
1305        }
1306
1307        hci_dev_unlock(hdev);
1308}
1309
1310static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1311{
1312        struct hci_cp_le_set_scan_param *cp;
1313        __u8 status = *((__u8 *) skb->data);
1314
1315        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1316
1317        if (status)
1318                return;
1319
1320        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1321        if (!cp)
1322                return;
1323
1324        hci_dev_lock(hdev);
1325
1326        hdev->le_scan_type = cp->type;
1327
1328        hci_dev_unlock(hdev);
1329}
1330
1331static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1332                                         struct sk_buff *skb)
1333{
1334        struct hci_cp_le_set_ext_scan_params *cp;
1335        __u8 status = *((__u8 *) skb->data);
1336        struct hci_cp_le_scan_phy_params *phy_param;
1337
1338        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1339
1340        if (status)
1341                return;
1342
1343        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1344        if (!cp)
1345                return;
1346
1347        phy_param = (void *)cp->data;
1348
1349        hci_dev_lock(hdev);
1350
1351        hdev->le_scan_type = phy_param->type;
1352
1353        hci_dev_unlock(hdev);
1354}
1355
1356static bool has_pending_adv_report(struct hci_dev *hdev)
1357{
1358        struct discovery_state *d = &hdev->discovery;
1359
1360        return bacmp(&d->last_adv_addr, BDADDR_ANY);
1361}
1362
1363static void clear_pending_adv_report(struct hci_dev *hdev)
1364{
1365        struct discovery_state *d = &hdev->discovery;
1366
1367        bacpy(&d->last_adv_addr, BDADDR_ANY);
1368        d->last_adv_data_len = 0;
1369}
1370
1371static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1372                                     u8 bdaddr_type, s8 rssi, u32 flags,
1373                                     u8 *data, u8 len)
1374{
1375        struct discovery_state *d = &hdev->discovery;
1376
1377        if (len > HCI_MAX_AD_LENGTH)
1378                return;
1379
1380        bacpy(&d->last_adv_addr, bdaddr);
1381        d->last_adv_addr_type = bdaddr_type;
1382        d->last_adv_rssi = rssi;
1383        d->last_adv_flags = flags;
1384        memcpy(d->last_adv_data, data, len);
1385        d->last_adv_data_len = len;
1386}
1387
1388static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1389{
1390        hci_dev_lock(hdev);
1391
1392        switch (enable) {
1393        case LE_SCAN_ENABLE:
1394                hci_dev_set_flag(hdev, HCI_LE_SCAN);
1395                if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1396                        clear_pending_adv_report(hdev);
1397                break;
1398
1399        case LE_SCAN_DISABLE:
1400                /* We do this here instead of when setting DISCOVERY_STOPPED
1401                 * since the latter would potentially require waiting for
1402                 * inquiry to stop too.
1403                 */
1404                if (has_pending_adv_report(hdev)) {
1405                        struct discovery_state *d = &hdev->discovery;
1406
1407                        mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1408                                          d->last_adv_addr_type, NULL,
1409                                          d->last_adv_rssi, d->last_adv_flags,
1410                                          d->last_adv_data,
1411                                          d->last_adv_data_len, NULL, 0);
1412                }
1413
1414                /* Cancel this timer so that we don't try to disable scanning
1415                 * when it's already disabled.
1416                 */
1417                cancel_delayed_work(&hdev->le_scan_disable);
1418
1419                hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1420
1421                /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1422                 * interrupted scanning due to a connect request. Mark
1423                 * therefore discovery as stopped. If this was not
1424                 * because of a connect request advertising might have
1425                 * been disabled because of active scanning, so
1426                 * re-enable it again if necessary.
1427                 */
1428                if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1429                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1430                else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1431                         hdev->discovery.state == DISCOVERY_FINDING)
1432                        hci_req_reenable_advertising(hdev);
1433
1434                break;
1435
1436        default:
1437                bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1438                           enable);
1439                break;
1440        }
1441
1442        hci_dev_unlock(hdev);
1443}
1444
1445static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1446                                      struct sk_buff *skb)
1447{
1448        struct hci_cp_le_set_scan_enable *cp;
1449        __u8 status = *((__u8 *) skb->data);
1450
1451        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1452
1453        if (status)
1454                return;
1455
1456        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1457        if (!cp)
1458                return;
1459
1460        le_set_scan_enable_complete(hdev, cp->enable);
1461}
1462
1463static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1464                                      struct sk_buff *skb)
1465{
1466        struct hci_cp_le_set_ext_scan_enable *cp;
1467        __u8 status = *((__u8 *) skb->data);
1468
1469        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1470
1471        if (status)
1472                return;
1473
1474        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1475        if (!cp)
1476                return;
1477
1478        le_set_scan_enable_complete(hdev, cp->enable);
1479}
1480
1481static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1482                                      struct sk_buff *skb)
1483{
1484        struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1485
1486        BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1487               rp->num_of_sets);
1488
1489        if (rp->status)
1490                return;
1491
1492        hdev->le_num_of_adv_sets = rp->num_of_sets;
1493}
1494
1495static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1496                                            struct sk_buff *skb)
1497{
1498        struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1499
1500        BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1501
1502        if (rp->status)
1503                return;
1504
1505        hdev->le_accept_list_size = rp->size;
1506}
1507
1508static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1509                                        struct sk_buff *skb)
1510{
1511        __u8 status = *((__u8 *) skb->data);
1512
1513        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1514
1515        if (status)
1516                return;
1517
1518        hci_bdaddr_list_clear(&hdev->le_accept_list);
1519}
1520
1521static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1522                                         struct sk_buff *skb)
1523{
1524        struct hci_cp_le_add_to_accept_list *sent;
1525        __u8 status = *((__u8 *) skb->data);
1526
1527        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1528
1529        if (status)
1530                return;
1531
1532        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1533        if (!sent)
1534                return;
1535
1536        hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1537                            sent->bdaddr_type);
1538}
1539
1540static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1541                                           struct sk_buff *skb)
1542{
1543        struct hci_cp_le_del_from_accept_list *sent;
1544        __u8 status = *((__u8 *) skb->data);
1545
1546        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1547
1548        if (status)
1549                return;
1550
1551        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1552        if (!sent)
1553                return;
1554
1555        hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1556                            sent->bdaddr_type);
1557}
1558
1559static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1560                                            struct sk_buff *skb)
1561{
1562        struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1563
1564        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1565
1566        if (rp->status)
1567                return;
1568
1569        memcpy(hdev->le_states, rp->le_states, 8);
1570}
1571
1572static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1573                                        struct sk_buff *skb)
1574{
1575        struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1576
1577        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1578
1579        if (rp->status)
1580                return;
1581
1582        hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1583        hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1584}
1585
1586static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1587                                         struct sk_buff *skb)
1588{
1589        struct hci_cp_le_write_def_data_len *sent;
1590        __u8 status = *((__u8 *) skb->data);
1591
1592        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594        if (status)
1595                return;
1596
1597        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1598        if (!sent)
1599                return;
1600
1601        hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1602        hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1603}
1604
1605static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1606                                         struct sk_buff *skb)
1607{
1608        struct hci_cp_le_add_to_resolv_list *sent;
1609        __u8 status = *((__u8 *) skb->data);
1610
1611        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1612
1613        if (status)
1614                return;
1615
1616        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1617        if (!sent)
1618                return;
1619
1620        hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1621                                sent->bdaddr_type, sent->peer_irk,
1622                                sent->local_irk);
1623}
1624
1625static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1626                                          struct sk_buff *skb)
1627{
1628        struct hci_cp_le_del_from_resolv_list *sent;
1629        __u8 status = *((__u8 *) skb->data);
1630
1631        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1632
1633        if (status)
1634                return;
1635
1636        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1637        if (!sent)
1638                return;
1639
1640        hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1641                            sent->bdaddr_type);
1642}
1643
1644static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1645                                       struct sk_buff *skb)
1646{
1647        __u8 status = *((__u8 *) skb->data);
1648
1649        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1650
1651        if (status)
1652                return;
1653
1654        hci_bdaddr_list_clear(&hdev->le_resolv_list);
1655}
1656
1657static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1658                                           struct sk_buff *skb)
1659{
1660        struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1661
1662        BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1663
1664        if (rp->status)
1665                return;
1666
1667        hdev->le_resolv_list_size = rp->size;
1668}
1669
1670static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1671                                                struct sk_buff *skb)
1672{
1673        __u8 *sent, status = *((__u8 *) skb->data);
1674
1675        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1676
1677        if (status)
1678                return;
1679
1680        sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1681        if (!sent)
1682                return;
1683
1684        hci_dev_lock(hdev);
1685
1686        if (*sent)
1687                hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1688        else
1689                hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1690
1691        hci_dev_unlock(hdev);
1692}
1693
1694static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1695                                        struct sk_buff *skb)
1696{
1697        struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1698
1699        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1700
1701        if (rp->status)
1702                return;
1703
1704        hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1705        hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1706        hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1707        hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1708}
1709
1710static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1711                                           struct sk_buff *skb)
1712{
1713        struct hci_cp_write_le_host_supported *sent;
1714        __u8 status = *((__u8 *) skb->data);
1715
1716        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1717
1718        if (status)
1719                return;
1720
1721        sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1722        if (!sent)
1723                return;
1724
1725        hci_dev_lock(hdev);
1726
1727        if (sent->le) {
1728                hdev->features[1][0] |= LMP_HOST_LE;
1729                hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1730        } else {
1731                hdev->features[1][0] &= ~LMP_HOST_LE;
1732                hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1733                hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1734        }
1735
1736        if (sent->simul)
1737                hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1738        else
1739                hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1740
1741        hci_dev_unlock(hdev);
1742}
1743
1744static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1745{
1746        struct hci_cp_le_set_adv_param *cp;
1747        u8 status = *((u8 *) skb->data);
1748
1749        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1750
1751        if (status)
1752                return;
1753
1754        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1755        if (!cp)
1756                return;
1757
1758        hci_dev_lock(hdev);
1759        hdev->adv_addr_type = cp->own_address_type;
1760        hci_dev_unlock(hdev);
1761}
1762
1763static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1764{
1765        struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1766        struct hci_cp_le_set_ext_adv_params *cp;
1767        struct adv_info *adv_instance;
1768
1769        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1770
1771        if (rp->status)
1772                return;
1773
1774        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1775        if (!cp)
1776                return;
1777
1778        hci_dev_lock(hdev);
1779        hdev->adv_addr_type = cp->own_addr_type;
1780        if (!cp->handle) {
1781                /* Store in hdev for instance 0 */
1782                hdev->adv_tx_power = rp->tx_power;
1783        } else {
1784                adv_instance = hci_find_adv_instance(hdev, cp->handle);
1785                if (adv_instance)
1786                        adv_instance->tx_power = rp->tx_power;
1787        }
1788        /* Update adv data as tx power is known now */
1789        hci_req_update_adv_data(hdev, cp->handle);
1790
1791        hci_dev_unlock(hdev);
1792}
1793
1794static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1795{
1796        struct hci_rp_read_rssi *rp = (void *) skb->data;
1797        struct hci_conn *conn;
1798
1799        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1800
1801        if (rp->status)
1802                return;
1803
1804        hci_dev_lock(hdev);
1805
1806        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1807        if (conn)
1808                conn->rssi = rp->rssi;
1809
1810        hci_dev_unlock(hdev);
1811}
1812
1813static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1814{
1815        struct hci_cp_read_tx_power *sent;
1816        struct hci_rp_read_tx_power *rp = (void *) skb->data;
1817        struct hci_conn *conn;
1818
1819        BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1820
1821        if (rp->status)
1822                return;
1823
1824        sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1825        if (!sent)
1826                return;
1827
1828        hci_dev_lock(hdev);
1829
1830        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1831        if (!conn)
1832                goto unlock;
1833
1834        switch (sent->type) {
1835        case 0x00:
1836                conn->tx_power = rp->tx_power;
1837                break;
1838        case 0x01:
1839                conn->max_tx_power = rp->tx_power;
1840                break;
1841        }
1842
1843unlock:
1844        hci_dev_unlock(hdev);
1845}
1846
1847static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1848{
1849        u8 status = *((u8 *) skb->data);
1850        u8 *mode;
1851
1852        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1853
1854        if (status)
1855                return;
1856
1857        mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1858        if (mode)
1859                hdev->ssp_debug_mode = *mode;
1860}
1861
1862static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1863{
1864        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1865
1866        if (status) {
1867                hci_conn_check_pending(hdev);
1868                return;
1869        }
1870
1871        set_bit(HCI_INQUIRY, &hdev->flags);
1872}
1873
1874static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1875{
1876        struct hci_cp_create_conn *cp;
1877        struct hci_conn *conn;
1878
1879        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1880
1881        cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1882        if (!cp)
1883                return;
1884
1885        hci_dev_lock(hdev);
1886
1887        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1888
1889        BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1890
1891        if (status) {
1892                if (conn && conn->state == BT_CONNECT) {
1893                        if (status != 0x0c || conn->attempt > 2) {
1894                                conn->state = BT_CLOSED;
1895                                hci_connect_cfm(conn, status);
1896                                hci_conn_del(conn);
1897                        } else
1898                                conn->state = BT_CONNECT2;
1899                }
1900        } else {
1901                if (!conn) {
1902                        conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1903                                            HCI_ROLE_MASTER);
1904                        if (!conn)
1905                                bt_dev_err(hdev, "no memory for new connection");
1906                }
1907        }
1908
1909        hci_dev_unlock(hdev);
1910}
1911
1912static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1913{
1914        struct hci_cp_add_sco *cp;
1915        struct hci_conn *acl, *sco;
1916        __u16 handle;
1917
1918        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1919
1920        if (!status)
1921                return;
1922
1923        cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1924        if (!cp)
1925                return;
1926
1927        handle = __le16_to_cpu(cp->handle);
1928
1929        BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1930
1931        hci_dev_lock(hdev);
1932
1933        acl = hci_conn_hash_lookup_handle(hdev, handle);
1934        if (acl) {
1935                sco = acl->link;
1936                if (sco) {
1937                        sco->state = BT_CLOSED;
1938
1939                        hci_connect_cfm(sco, status);
1940                        hci_conn_del(sco);
1941                }
1942        }
1943
1944        hci_dev_unlock(hdev);
1945}
1946
1947static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1948{
1949        struct hci_cp_auth_requested *cp;
1950        struct hci_conn *conn;
1951
1952        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1953
1954        if (!status)
1955                return;
1956
1957        cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1958        if (!cp)
1959                return;
1960
1961        hci_dev_lock(hdev);
1962
1963        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1964        if (conn) {
1965                if (conn->state == BT_CONFIG) {
1966                        hci_connect_cfm(conn, status);
1967                        hci_conn_drop(conn);
1968                }
1969        }
1970
1971        hci_dev_unlock(hdev);
1972}
1973
1974static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1975{
1976        struct hci_cp_set_conn_encrypt *cp;
1977        struct hci_conn *conn;
1978
1979        BT_DBG("%s status 0x%2.2x", hdev->name, status);
1980
1981        if (!status)
1982                return;
1983
1984        cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1985        if (!cp)
1986                return;
1987
1988        hci_dev_lock(hdev);
1989
1990        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1991        if (conn) {
1992                if (conn->state == BT_CONFIG) {
1993                        hci_connect_cfm(conn, status);
1994                        hci_conn_drop(conn);
1995                }
1996        }
1997
1998        hci_dev_unlock(hdev);
1999}
2000
2001static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2002                                    struct hci_conn *conn)
2003{
2004        if (conn->state != BT_CONFIG || !conn->out)
2005                return 0;
2006
2007        if (conn->pending_sec_level == BT_SECURITY_SDP)
2008                return 0;
2009
2010        /* Only request authentication for SSP connections or non-SSP
2011         * devices with sec_level MEDIUM or HIGH or if MITM protection
2012         * is requested.
2013         */
2014        if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2015            conn->pending_sec_level != BT_SECURITY_FIPS &&
2016            conn->pending_sec_level != BT_SECURITY_HIGH &&
2017            conn->pending_sec_level != BT_SECURITY_MEDIUM)
2018                return 0;
2019
2020        return 1;
2021}
2022
2023static int hci_resolve_name(struct hci_dev *hdev,
2024                                   struct inquiry_entry *e)
2025{
2026        struct hci_cp_remote_name_req cp;
2027
2028        memset(&cp, 0, sizeof(cp));
2029
2030        bacpy(&cp.bdaddr, &e->data.bdaddr);
2031        cp.pscan_rep_mode = e->data.pscan_rep_mode;
2032        cp.pscan_mode = e->data.pscan_mode;
2033        cp.clock_offset = e->data.clock_offset;
2034
2035        return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2036}
2037
2038static bool hci_resolve_next_name(struct hci_dev *hdev)
2039{
2040        struct discovery_state *discov = &hdev->discovery;
2041        struct inquiry_entry *e;
2042
2043        if (list_empty(&discov->resolve))
2044                return false;
2045
2046        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2047        if (!e)
2048                return false;
2049
2050        if (hci_resolve_name(hdev, e) == 0) {
2051                e->name_state = NAME_PENDING;
2052                return true;
2053        }
2054
2055        return false;
2056}
2057
2058static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2059                                   bdaddr_t *bdaddr, u8 *name, u8 name_len)
2060{
2061        struct discovery_state *discov = &hdev->discovery;
2062        struct inquiry_entry *e;
2063
2064        /* Update the mgmt connected state if necessary. Be careful with
2065         * conn objects that exist but are not (yet) connected however.
2066         * Only those in BT_CONFIG or BT_CONNECTED states can be
2067         * considered connected.
2068         */
2069        if (conn &&
2070            (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2071            !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2072                mgmt_device_connected(hdev, conn, name, name_len);
2073
2074        if (discov->state == DISCOVERY_STOPPED)
2075                return;
2076
2077        if (discov->state == DISCOVERY_STOPPING)
2078                goto discov_complete;
2079
2080        if (discov->state != DISCOVERY_RESOLVING)
2081                return;
2082
2083        e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2084        /* If the device was not found in a list of found devices names of which
2085         * are pending. there is no need to continue resolving a next name as it
2086         * will be done upon receiving another Remote Name Request Complete
2087         * Event */
2088        if (!e)
2089                return;
2090
2091        list_del(&e->list);
2092        if (name) {
2093                e->name_state = NAME_KNOWN;
2094                mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2095                                 e->data.rssi, name, name_len);
2096        } else {
2097                e->name_state = NAME_NOT_KNOWN;
2098        }
2099
2100        if (hci_resolve_next_name(hdev))
2101                return;
2102
2103discov_complete:
2104        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2105}
2106
2107static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2108{
2109        struct hci_cp_remote_name_req *cp;
2110        struct hci_conn *conn;
2111
2112        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2113
2114        /* If successful wait for the name req complete event before
2115         * checking for the need to do authentication */
2116        if (!status)
2117                return;
2118
2119        cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2120        if (!cp)
2121                return;
2122
2123        hci_dev_lock(hdev);
2124
2125        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2126
2127        if (hci_dev_test_flag(hdev, HCI_MGMT))
2128                hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2129
2130        if (!conn)
2131                goto unlock;
2132
2133        if (!hci_outgoing_auth_needed(hdev, conn))
2134                goto unlock;
2135
2136        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2137                struct hci_cp_auth_requested auth_cp;
2138
2139                set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2140
2141                auth_cp.handle = __cpu_to_le16(conn->handle);
2142                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2143                             sizeof(auth_cp), &auth_cp);
2144        }
2145
2146unlock:
2147        hci_dev_unlock(hdev);
2148}
2149
2150static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2151{
2152        struct hci_cp_read_remote_features *cp;
2153        struct hci_conn *conn;
2154
2155        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2156
2157        if (!status)
2158                return;
2159
2160        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2161        if (!cp)
2162                return;
2163
2164        hci_dev_lock(hdev);
2165
2166        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2167        if (conn) {
2168                if (conn->state == BT_CONFIG) {
2169                        hci_connect_cfm(conn, status);
2170                        hci_conn_drop(conn);
2171                }
2172        }
2173
2174        hci_dev_unlock(hdev);
2175}
2176
2177static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2178{
2179        struct hci_cp_read_remote_ext_features *cp;
2180        struct hci_conn *conn;
2181
2182        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2183
2184        if (!status)
2185                return;
2186
2187        cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2188        if (!cp)
2189                return;
2190
2191        hci_dev_lock(hdev);
2192
2193        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2194        if (conn) {
2195                if (conn->state == BT_CONFIG) {
2196                        hci_connect_cfm(conn, status);
2197                        hci_conn_drop(conn);
2198                }
2199        }
2200
2201        hci_dev_unlock(hdev);
2202}
2203
2204static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2205{
2206        struct hci_cp_setup_sync_conn *cp;
2207        struct hci_conn *acl, *sco;
2208        __u16 handle;
2209
2210        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2211
2212        if (!status)
2213                return;
2214
2215        cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2216        if (!cp)
2217                return;
2218
2219        handle = __le16_to_cpu(cp->handle);
2220
2221        BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2222
2223        hci_dev_lock(hdev);
2224
2225        acl = hci_conn_hash_lookup_handle(hdev, handle);
2226        if (acl) {
2227                sco = acl->link;
2228                if (sco) {
2229                        sco->state = BT_CLOSED;
2230
2231                        hci_connect_cfm(sco, status);
2232                        hci_conn_del(sco);
2233                }
2234        }
2235
2236        hci_dev_unlock(hdev);
2237}
2238
2239static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2240{
2241        struct hci_cp_sniff_mode *cp;
2242        struct hci_conn *conn;
2243
2244        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2245
2246        if (!status)
2247                return;
2248
2249        cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2250        if (!cp)
2251                return;
2252
2253        hci_dev_lock(hdev);
2254
2255        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2256        if (conn) {
2257                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2258
2259                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2260                        hci_sco_setup(conn, status);
2261        }
2262
2263        hci_dev_unlock(hdev);
2264}
2265
2266static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2267{
2268        struct hci_cp_exit_sniff_mode *cp;
2269        struct hci_conn *conn;
2270
2271        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2272
2273        if (!status)
2274                return;
2275
2276        cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2277        if (!cp)
2278                return;
2279
2280        hci_dev_lock(hdev);
2281
2282        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2283        if (conn) {
2284                clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2285
2286                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2287                        hci_sco_setup(conn, status);
2288        }
2289
2290        hci_dev_unlock(hdev);
2291}
2292
2293static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2294{
2295        struct hci_cp_disconnect *cp;
2296        struct hci_conn *conn;
2297
2298        if (!status)
2299                return;
2300
2301        cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2302        if (!cp)
2303                return;
2304
2305        hci_dev_lock(hdev);
2306
2307        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2308        if (conn) {
2309                u8 type = conn->type;
2310
2311                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2312                                       conn->dst_type, status);
2313
2314                /* If the disconnection failed for any reason, the upper layer
2315                 * does not retry to disconnect in current implementation.
2316                 * Hence, we need to do some basic cleanup here and re-enable
2317                 * advertising if necessary.
2318                 */
2319                hci_conn_del(conn);
2320                if (type == LE_LINK)
2321                        hci_req_reenable_advertising(hdev);
2322        }
2323
2324        hci_dev_unlock(hdev);
2325}
2326
2327static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2328                              u8 peer_addr_type, u8 own_address_type,
2329                              u8 filter_policy)
2330{
2331        struct hci_conn *conn;
2332
2333        conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2334                                       peer_addr_type);
2335        if (!conn)
2336                return;
2337
2338        /* When using controller based address resolution, then the new
2339         * address types 0x02 and 0x03 are used. These types need to be
2340         * converted back into either public address or random address type
2341         */
2342        if (use_ll_privacy(hdev) &&
2343            hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2344                switch (own_address_type) {
2345                case ADDR_LE_DEV_PUBLIC_RESOLVED:
2346                        own_address_type = ADDR_LE_DEV_PUBLIC;
2347                        break;
2348                case ADDR_LE_DEV_RANDOM_RESOLVED:
2349                        own_address_type = ADDR_LE_DEV_RANDOM;
2350                        break;
2351                }
2352        }
2353
2354        /* Store the initiator and responder address information which
2355         * is needed for SMP. These values will not change during the
2356         * lifetime of the connection.
2357         */
2358        conn->init_addr_type = own_address_type;
2359        if (own_address_type == ADDR_LE_DEV_RANDOM)
2360                bacpy(&conn->init_addr, &hdev->random_addr);
2361        else
2362                bacpy(&conn->init_addr, &hdev->bdaddr);
2363
2364        conn->resp_addr_type = peer_addr_type;
2365        bacpy(&conn->resp_addr, peer_addr);
2366
2367        /* We don't want the connection attempt to stick around
2368         * indefinitely since LE doesn't have a page timeout concept
2369         * like BR/EDR. Set a timer for any connection that doesn't use
2370         * the accept list for connecting.
2371         */
2372        if (filter_policy == HCI_LE_USE_PEER_ADDR)
2373                queue_delayed_work(conn->hdev->workqueue,
2374                                   &conn->le_conn_timeout,
2375                                   conn->conn_timeout);
2376}
2377
2378static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2379{
2380        struct hci_cp_le_create_conn *cp;
2381
2382        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2383
2384        /* All connection failure handling is taken care of by the
2385         * hci_le_conn_failed function which is triggered by the HCI
2386         * request completion callbacks used for connecting.
2387         */
2388        if (status)
2389                return;
2390
2391        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2392        if (!cp)
2393                return;
2394
2395        hci_dev_lock(hdev);
2396
2397        cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2398                          cp->own_address_type, cp->filter_policy);
2399
2400        hci_dev_unlock(hdev);
2401}
2402
2403static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2404{
2405        struct hci_cp_le_ext_create_conn *cp;
2406
2407        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2408
2409        /* All connection failure handling is taken care of by the
2410         * hci_le_conn_failed function which is triggered by the HCI
2411         * request completion callbacks used for connecting.
2412         */
2413        if (status)
2414                return;
2415
2416        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2417        if (!cp)
2418                return;
2419
2420        hci_dev_lock(hdev);
2421
2422        cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2423                          cp->own_addr_type, cp->filter_policy);
2424
2425        hci_dev_unlock(hdev);
2426}
2427
2428static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2429{
2430        struct hci_cp_le_read_remote_features *cp;
2431        struct hci_conn *conn;
2432
2433        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2434
2435        if (!status)
2436                return;
2437
2438        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2439        if (!cp)
2440                return;
2441
2442        hci_dev_lock(hdev);
2443
2444        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2445        if (conn) {
2446                if (conn->state == BT_CONFIG) {
2447                        hci_connect_cfm(conn, status);
2448                        hci_conn_drop(conn);
2449                }
2450        }
2451
2452        hci_dev_unlock(hdev);
2453}
2454
2455static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2456{
2457        struct hci_cp_le_start_enc *cp;
2458        struct hci_conn *conn;
2459
2460        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2461
2462        if (!status)
2463                return;
2464
2465        hci_dev_lock(hdev);
2466
2467        cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2468        if (!cp)
2469                goto unlock;
2470
2471        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2472        if (!conn)
2473                goto unlock;
2474
2475        if (conn->state != BT_CONNECTED)
2476                goto unlock;
2477
2478        hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2479        hci_conn_drop(conn);
2480
2481unlock:
2482        hci_dev_unlock(hdev);
2483}
2484
2485static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2486{
2487        struct hci_cp_switch_role *cp;
2488        struct hci_conn *conn;
2489
2490        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2491
2492        if (!status)
2493                return;
2494
2495        cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2496        if (!cp)
2497                return;
2498
2499        hci_dev_lock(hdev);
2500
2501        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2502        if (conn)
2503                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2504
2505        hci_dev_unlock(hdev);
2506}
2507
2508static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2509{
2510        __u8 status = *((__u8 *) skb->data);
2511        struct discovery_state *discov = &hdev->discovery;
2512        struct inquiry_entry *e;
2513
2514        BT_DBG("%s status 0x%2.2x", hdev->name, status);
2515
2516        hci_conn_check_pending(hdev);
2517
2518        if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2519                return;
2520
2521        smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2522        wake_up_bit(&hdev->flags, HCI_INQUIRY);
2523
2524        if (!hci_dev_test_flag(hdev, HCI_MGMT))
2525                return;
2526
2527        hci_dev_lock(hdev);
2528
2529        if (discov->state != DISCOVERY_FINDING)
2530                goto unlock;
2531
2532        if (list_empty(&discov->resolve)) {
2533                /* When BR/EDR inquiry is active and no LE scanning is in
2534                 * progress, then change discovery state to indicate completion.
2535                 *
2536                 * When running LE scanning and BR/EDR inquiry simultaneously
2537                 * and the LE scan already finished, then change the discovery
2538                 * state to indicate completion.
2539                 */
2540                if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2541                    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2542                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2543                goto unlock;
2544        }
2545
2546        e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2547        if (e && hci_resolve_name(hdev, e) == 0) {
2548                e->name_state = NAME_PENDING;
2549                hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2550        } else {
2551                /* When BR/EDR inquiry is active and no LE scanning is in
2552                 * progress, then change discovery state to indicate completion.
2553                 *
2554                 * When running LE scanning and BR/EDR inquiry simultaneously
2555                 * and the LE scan already finished, then change the discovery
2556                 * state to indicate completion.
2557                 */
2558                if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2559                    !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2560                        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2561        }
2562
2563unlock:
2564        hci_dev_unlock(hdev);
2565}
2566
2567static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2568{
2569        struct inquiry_data data;
2570        struct inquiry_info *info = (void *) (skb->data + 1);
2571        int num_rsp = *((__u8 *) skb->data);
2572
2573        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2574
2575        if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2576                return;
2577
2578        if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2579                return;
2580
2581        hci_dev_lock(hdev);
2582
2583        for (; num_rsp; num_rsp--, info++) {
2584                u32 flags;
2585
2586                bacpy(&data.bdaddr, &info->bdaddr);
2587                data.pscan_rep_mode     = info->pscan_rep_mode;
2588                data.pscan_period_mode  = info->pscan_period_mode;
2589                data.pscan_mode         = info->pscan_mode;
2590                memcpy(data.dev_class, info->dev_class, 3);
2591                data.clock_offset       = info->clock_offset;
2592                data.rssi               = HCI_RSSI_INVALID;
2593                data.ssp_mode           = 0x00;
2594
2595                flags = hci_inquiry_cache_update(hdev, &data, false);
2596
2597                mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2598                                  info->dev_class, HCI_RSSI_INVALID,
2599                                  flags, NULL, 0, NULL, 0);
2600        }
2601
2602        hci_dev_unlock(hdev);
2603}
2604
2605static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2606{
2607        struct hci_ev_conn_complete *ev = (void *) skb->data;
2608        struct hci_conn *conn;
2609
2610        BT_DBG("%s", hdev->name);
2611
2612        hci_dev_lock(hdev);
2613
2614        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2615        if (!conn) {
2616                /* Connection may not exist if auto-connected. Check the bredr
2617                 * allowlist to see if this device is allowed to auto connect.
2618                 * If link is an ACL type, create a connection class
2619                 * automatically.
2620                 *
2621                 * Auto-connect will only occur if the event filter is
2622                 * programmed with a given address. Right now, event filter is
2623                 * only used during suspend.
2624                 */
2625                if (ev->link_type == ACL_LINK &&
2626                    hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2627                                                      &ev->bdaddr,
2628                                                      BDADDR_BREDR)) {
2629                        conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2630                                            HCI_ROLE_SLAVE);
2631                        if (!conn) {
2632                                bt_dev_err(hdev, "no memory for new conn");
2633                                goto unlock;
2634                        }
2635                } else {
2636                        if (ev->link_type != SCO_LINK)
2637                                goto unlock;
2638
2639                        conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2640                                                       &ev->bdaddr);
2641                        if (!conn)
2642                                goto unlock;
2643
2644                        conn->type = SCO_LINK;
2645                }
2646        }
2647
2648        if (!ev->status) {
2649                conn->handle = __le16_to_cpu(ev->handle);
2650
2651                if (conn->type == ACL_LINK) {
2652                        conn->state = BT_CONFIG;
2653                        hci_conn_hold(conn);
2654
2655                        if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2656                            !hci_find_link_key(hdev, &ev->bdaddr))
2657                                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2658                        else
2659                                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2660                } else
2661                        conn->state = BT_CONNECTED;
2662
2663                hci_debugfs_create_conn(conn);
2664                hci_conn_add_sysfs(conn);
2665
2666                if (test_bit(HCI_AUTH, &hdev->flags))
2667                        set_bit(HCI_CONN_AUTH, &conn->flags);
2668
2669                if (test_bit(HCI_ENCRYPT, &hdev->flags))
2670                        set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2671
2672                /* Get remote features */
2673                if (conn->type == ACL_LINK) {
2674                        struct hci_cp_read_remote_features cp;
2675                        cp.handle = ev->handle;
2676                        hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2677                                     sizeof(cp), &cp);
2678
2679                        hci_req_update_scan(hdev);
2680                }
2681
2682                /* Set packet type for incoming connection */
2683                if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2684                        struct hci_cp_change_conn_ptype cp;
2685                        cp.handle = ev->handle;
2686                        cp.pkt_type = cpu_to_le16(conn->pkt_type);
2687                        hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2688                                     &cp);
2689                }
2690        } else {
2691                conn->state = BT_CLOSED;
2692                if (conn->type == ACL_LINK)
2693                        mgmt_connect_failed(hdev, &conn->dst, conn->type,
2694                                            conn->dst_type, ev->status);
2695        }
2696
2697        if (conn->type == ACL_LINK)
2698                hci_sco_setup(conn, ev->status);
2699
2700        if (ev->status) {
2701                hci_connect_cfm(conn, ev->status);
2702                hci_conn_del(conn);
2703        } else if (ev->link_type == SCO_LINK) {
2704                switch (conn->setting & SCO_AIRMODE_MASK) {
2705                case SCO_AIRMODE_CVSD:
2706                        if (hdev->notify)
2707                                hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2708                        break;
2709                }
2710
2711                hci_connect_cfm(conn, ev->status);
2712        }
2713
2714unlock:
2715        hci_dev_unlock(hdev);
2716
2717        hci_conn_check_pending(hdev);
2718}
2719
2720static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2721{
2722        struct hci_cp_reject_conn_req cp;
2723
2724        bacpy(&cp.bdaddr, bdaddr);
2725        cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2726        hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2727}
2728
2729static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2730{
2731        struct hci_ev_conn_request *ev = (void *) skb->data;
2732        int mask = hdev->link_mode;
2733        struct inquiry_entry *ie;
2734        struct hci_conn *conn;
2735        __u8 flags = 0;
2736
2737        BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2738               ev->link_type);
2739
2740        mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2741                                      &flags);
2742
2743        if (!(mask & HCI_LM_ACCEPT)) {
2744                hci_reject_conn(hdev, &ev->bdaddr);
2745                return;
2746        }
2747
2748        if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2749                                   BDADDR_BREDR)) {
2750                hci_reject_conn(hdev, &ev->bdaddr);
2751                return;
2752        }
2753
2754        /* Require HCI_CONNECTABLE or an accept list entry to accept the
2755         * connection. These features are only touched through mgmt so
2756         * only do the checks if HCI_MGMT is set.
2757         */
2758        if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2759            !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2760            !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2761                                               BDADDR_BREDR)) {
2762                hci_reject_conn(hdev, &ev->bdaddr);
2763                return;
2764        }
2765
2766        /* Connection accepted */
2767
2768        hci_dev_lock(hdev);
2769
2770        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2771        if (ie)
2772                memcpy(ie->data.dev_class, ev->dev_class, 3);
2773
2774        conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2775                        &ev->bdaddr);
2776        if (!conn) {
2777                conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2778                                    HCI_ROLE_SLAVE);
2779                if (!conn) {
2780                        bt_dev_err(hdev, "no memory for new connection");
2781                        hci_dev_unlock(hdev);
2782                        return;
2783                }
2784        }
2785
2786        memcpy(conn->dev_class, ev->dev_class, 3);
2787
2788        hci_dev_unlock(hdev);
2789
2790        if (ev->link_type == ACL_LINK ||
2791            (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2792                struct hci_cp_accept_conn_req cp;
2793                conn->state = BT_CONNECT;
2794
2795                bacpy(&cp.bdaddr, &ev->bdaddr);
2796
2797                if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2798                        cp.role = 0x00; /* Become central */
2799                else
2800                        cp.role = 0x01; /* Remain peripheral */
2801
2802                hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2803        } else if (!(flags & HCI_PROTO_DEFER)) {
2804                struct hci_cp_accept_sync_conn_req cp;
2805                conn->state = BT_CONNECT;
2806
2807                bacpy(&cp.bdaddr, &ev->bdaddr);
2808                cp.pkt_type = cpu_to_le16(conn->pkt_type);
2809
2810                cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2811                cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2812                cp.max_latency    = cpu_to_le16(0xffff);
2813                cp.content_format = cpu_to_le16(hdev->voice_setting);
2814                cp.retrans_effort = 0xff;
2815
2816                hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2817                             &cp);
2818        } else {
2819                conn->state = BT_CONNECT2;
2820                hci_connect_cfm(conn, 0);
2821        }
2822}
2823
2824static u8 hci_to_mgmt_reason(u8 err)
2825{
2826        switch (err) {
2827        case HCI_ERROR_CONNECTION_TIMEOUT:
2828                return MGMT_DEV_DISCONN_TIMEOUT;
2829        case HCI_ERROR_REMOTE_USER_TERM:
2830        case HCI_ERROR_REMOTE_LOW_RESOURCES:
2831        case HCI_ERROR_REMOTE_POWER_OFF:
2832                return MGMT_DEV_DISCONN_REMOTE;
2833        case HCI_ERROR_LOCAL_HOST_TERM:
2834                return MGMT_DEV_DISCONN_LOCAL_HOST;
2835        default:
2836                return MGMT_DEV_DISCONN_UNKNOWN;
2837        }
2838}
2839
2840static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2841{
2842        struct hci_ev_disconn_complete *ev = (void *) skb->data;
2843        u8 reason;
2844        struct hci_conn_params *params;
2845        struct hci_conn *conn;
2846        bool mgmt_connected;
2847        u8 type;
2848
2849        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2850
2851        hci_dev_lock(hdev);
2852
2853        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2854        if (!conn)
2855                goto unlock;
2856
2857        if (ev->status) {
2858                mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2859                                       conn->dst_type, ev->status);
2860                goto unlock;
2861        }
2862
2863        conn->state = BT_CLOSED;
2864
2865        mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2866
2867        if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2868                reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2869        else
2870                reason = hci_to_mgmt_reason(ev->reason);
2871
2872        mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2873                                reason, mgmt_connected);
2874
2875        if (conn->type == ACL_LINK) {
2876                if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2877                        hci_remove_link_key(hdev, &conn->dst);
2878
2879                hci_req_update_scan(hdev);
2880        }
2881
2882        params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2883        if (params) {
2884                switch (params->auto_connect) {
2885                case HCI_AUTO_CONN_LINK_LOSS:
2886                        if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2887                                break;
2888                        fallthrough;
2889
2890                case HCI_AUTO_CONN_DIRECT:
2891                case HCI_AUTO_CONN_ALWAYS:
2892                        list_del_init(&params->action);
2893                        list_add(&params->action, &hdev->pend_le_conns);
2894                        hci_update_background_scan(hdev);
2895                        break;
2896
2897                default:
2898                        break;
2899                }
2900        }
2901
2902        type = conn->type;
2903
2904        hci_disconn_cfm(conn, ev->reason);
2905        hci_conn_del(conn);
2906
2907        /* The suspend notifier is waiting for all devices to disconnect so
2908         * clear the bit from pending tasks and inform the wait queue.
2909         */
2910        if (list_empty(&hdev->conn_hash.list) &&
2911            test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
2912                wake_up(&hdev->suspend_wait_q);
2913        }
2914
2915        /* Re-enable advertising if necessary, since it might
2916         * have been disabled by the connection. From the
2917         * HCI_LE_Set_Advertise_Enable command description in
2918         * the core specification (v4.0):
2919         * "The Controller shall continue advertising until the Host
2920         * issues an LE_Set_Advertise_Enable command with
2921         * Advertising_Enable set to 0x00 (Advertising is disabled)
2922         * or until a connection is created or until the Advertising
2923         * is timed out due to Directed Advertising."
2924         */
2925        if (type == LE_LINK)
2926                hci_req_reenable_advertising(hdev);
2927
2928unlock:
2929        hci_dev_unlock(hdev);
2930}
2931
2932static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2933{
2934        struct hci_ev_auth_complete *ev = (void *) skb->data;
2935        struct hci_conn *conn;
2936
2937        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2938
2939        hci_dev_lock(hdev);
2940
2941        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2942        if (!conn)
2943                goto unlock;
2944
2945        if (!ev->status) {
2946                clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2947
2948                if (!hci_conn_ssp_enabled(conn) &&
2949                    test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2950                        bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2951                } else {
2952                        set_bit(HCI_CONN_AUTH, &conn->flags);
2953                        conn->sec_level = conn->pending_sec_level;
2954                }
2955        } else {
2956                if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2957                        set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2958
2959                mgmt_auth_failed(conn, ev->status);
2960        }
2961
2962        clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2963        clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2964
2965        if (conn->state == BT_CONFIG) {
2966                if (!ev->status && hci_conn_ssp_enabled(conn)) {
2967                        struct hci_cp_set_conn_encrypt cp;
2968                        cp.handle  = ev->handle;
2969                        cp.encrypt = 0x01;
2970                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2971                                     &cp);
2972                } else {
2973                        conn->state = BT_CONNECTED;
2974                        hci_connect_cfm(conn, ev->status);
2975                        hci_conn_drop(conn);
2976                }
2977        } else {
2978                hci_auth_cfm(conn, ev->status);
2979
2980                hci_conn_hold(conn);
2981                conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2982                hci_conn_drop(conn);
2983        }
2984
2985        if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2986                if (!ev->status) {
2987                        struct hci_cp_set_conn_encrypt cp;
2988                        cp.handle  = ev->handle;
2989                        cp.encrypt = 0x01;
2990                        hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2991                                     &cp);
2992                } else {
2993                        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2994                        hci_encrypt_cfm(conn, ev->status);
2995                }
2996        }
2997
2998unlock:
2999        hci_dev_unlock(hdev);
3000}
3001
3002static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3003{
3004        struct hci_ev_remote_name *ev = (void *) skb->data;
3005        struct hci_conn *conn;
3006
3007        BT_DBG("%s", hdev->name);
3008
3009        hci_conn_check_pending(hdev);
3010
3011        hci_dev_lock(hdev);
3012
3013        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3014
3015        if (!hci_dev_test_flag(hdev, HCI_MGMT))
3016                goto check_auth;
3017
3018        if (ev->status == 0)
3019                hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3020                                       strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3021        else
3022                hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3023
3024check_auth:
3025        if (!conn)
3026                goto unlock;
3027
3028        if (!hci_outgoing_auth_needed(hdev, conn))
3029                goto unlock;
3030
3031        if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3032                struct hci_cp_auth_requested cp;
3033
3034                set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3035
3036                cp.handle = __cpu_to_le16(conn->handle);
3037                hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3038        }
3039
3040unlock:
3041        hci_dev_unlock(hdev);
3042}
3043
3044static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3045                                       u16 opcode, struct sk_buff *skb)
3046{
3047        const struct hci_rp_read_enc_key_size *rp;
3048        struct hci_conn *conn;
3049        u16 handle;
3050
3051        BT_DBG("%s status 0x%02x", hdev->name, status);
3052
3053        if (!skb || skb->len < sizeof(*rp)) {
3054                bt_dev_err(hdev, "invalid read key size response");
3055                return;
3056        }
3057
3058        rp = (void *)skb->data;
3059        handle = le16_to_cpu(rp->handle);
3060
3061        hci_dev_lock(hdev);
3062
3063        conn = hci_conn_hash_lookup_handle(hdev, handle);
3064        if (!conn)
3065                goto unlock;
3066
3067        /* While unexpected, the read_enc_key_size command may fail. The most
3068         * secure approach is to then assume the key size is 0 to force a
3069         * disconnection.
3070         */
3071        if (rp->status) {
3072                bt_dev_err(hdev, "failed to read key size for handle %u",
3073                           handle);
3074                conn->enc_key_size = 0;
3075        } else {
3076                conn->enc_key_size = rp->key_size;
3077        }
3078
3079        hci_encrypt_cfm(conn, 0);
3080
3081unlock:
3082        hci_dev_unlock(hdev);
3083}
3084
3085static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3086{
3087        struct hci_ev_encrypt_change *ev = (void *) skb->data;
3088        struct hci_conn *conn;
3089
3090        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3091
3092        hci_dev_lock(hdev);
3093
3094        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3095        if (!conn)
3096                goto unlock;
3097
3098        if (!ev->status) {
3099                if (ev->encrypt) {
3100                        /* Encryption implies authentication */
3101                        set_bit(HCI_CONN_AUTH, &conn->flags);
3102                        set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3103                        conn->sec_level = conn->pending_sec_level;
3104
3105                        /* P-256 authentication key implies FIPS */
3106                        if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3107                                set_bit(HCI_CONN_FIPS, &conn->flags);
3108
3109                        if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3110                            conn->type == LE_LINK)
3111                                set_bit(HCI_CONN_AES_CCM, &conn->flags);
3112                } else {
3113                        clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3114                        clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3115                }
3116        }
3117
3118        /* We should disregard the current RPA and generate a new one
3119         * whenever the encryption procedure fails.
3120         */
3121        if (ev->status && conn->type == LE_LINK) {
3122                hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3123                hci_adv_instances_set_rpa_expired(hdev, true);
3124        }
3125
3126        clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3127
3128        /* Check link security requirements are met */
3129        if (!hci_conn_check_link_mode(conn))
3130                ev->status = HCI_ERROR_AUTH_FAILURE;
3131
3132        if (ev->status && conn->state == BT_CONNECTED) {
3133                if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3134                        set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3135
3136                /* Notify upper layers so they can cleanup before
3137                 * disconnecting.
3138                 */
3139                hci_encrypt_cfm(conn, ev->status);
3140                hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3141                hci_conn_drop(conn);
3142                goto unlock;
3143        }
3144
3145        /* Try reading the encryption key size for encrypted ACL links */
3146        if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3147                struct hci_cp_read_enc_key_size cp;
3148                struct hci_request req;
3149
3150                /* Only send HCI_Read_Encryption_Key_Size if the
3151                 * controller really supports it. If it doesn't, assume
3152                 * the default size (16).
3153                 */
3154                if (!(hdev->commands[20] & 0x10)) {
3155                        conn->enc_key_size = HCI_LINK_KEY_SIZE;
3156                        goto notify;
3157                }
3158
3159                hci_req_init(&req, hdev);
3160
3161                cp.handle = cpu_to_le16(conn->handle);
3162                hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3163
3164                if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3165                        bt_dev_err(hdev, "sending read key size failed");
3166                        conn->enc_key_size = HCI_LINK_KEY_SIZE;
3167                        goto notify;
3168                }
3169
3170                goto unlock;
3171        }
3172
3173        /* Set the default Authenticated Payload Timeout after
3174         * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3175         * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3176         * sent when the link is active and Encryption is enabled, the conn
3177         * type can be either LE or ACL and controller must support LMP Ping.
3178         * Ensure for AES-CCM encryption as well.
3179         */
3180        if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3181            test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3182            ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3183             (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3184                struct hci_cp_write_auth_payload_to cp;
3185
3186                cp.handle = cpu_to_le16(conn->handle);
3187                cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3188                hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3189                             sizeof(cp), &cp);
3190        }
3191
3192notify:
3193        hci_encrypt_cfm(conn, ev->status);
3194
3195unlock:
3196        hci_dev_unlock(hdev);
3197}
3198
3199static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3200                                             struct sk_buff *skb)
3201{
3202        struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3203        struct hci_conn *conn;
3204
3205        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3206
3207        hci_dev_lock(hdev);
3208
3209        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3210        if (conn) {
3211                if (!ev->status)
3212                        set_bit(HCI_CONN_SECURE, &conn->flags);
3213
3214                clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3215
3216                hci_key_change_cfm(conn, ev->status);
3217        }
3218
3219        hci_dev_unlock(hdev);
3220}
3221
3222static void hci_remote_features_evt(struct hci_dev *hdev,
3223                                    struct sk_buff *skb)
3224{
3225        struct hci_ev_remote_features *ev = (void *) skb->data;
3226        struct hci_conn *conn;
3227
3228        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3229
3230        hci_dev_lock(hdev);
3231
3232        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3233        if (!conn)
3234                goto unlock;
3235
3236        if (!ev->status)
3237                memcpy(conn->features[0], ev->features, 8);
3238
3239        if (conn->state != BT_CONFIG)
3240                goto unlock;
3241
3242        if (!ev->status && lmp_ext_feat_capable(hdev) &&
3243            lmp_ext_feat_capable(conn)) {
3244                struct hci_cp_read_remote_ext_features cp;
3245                cp.handle = ev->handle;
3246                cp.page = 0x01;
3247                hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3248                             sizeof(cp), &cp);
3249                goto unlock;
3250        }
3251
3252        if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3253                struct hci_cp_remote_name_req cp;
3254                memset(&cp, 0, sizeof(cp));
3255                bacpy(&cp.bdaddr, &conn->dst);
3256                cp.pscan_rep_mode = 0x02;
3257                hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3258        } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3259                mgmt_device_connected(hdev, conn, NULL, 0);
3260
3261        if (!hci_outgoing_auth_needed(hdev, conn)) {
3262                conn->state = BT_CONNECTED;
3263                hci_connect_cfm(conn, ev->status);
3264                hci_conn_drop(conn);
3265        }
3266
3267unlock:
3268        hci_dev_unlock(hdev);
3269}
3270
3271static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev,
3272                                            u16 opcode, u8 ncmd)
3273{
3274        if (opcode != HCI_OP_NOP)
3275                cancel_delayed_work(&hdev->cmd_timer);
3276
3277        if (!test_bit(HCI_RESET, &hdev->flags)) {
3278                if (ncmd) {
3279                        cancel_delayed_work(&hdev->ncmd_timer);
3280                        atomic_set(&hdev->cmd_cnt, 1);
3281                } else {
3282                        schedule_delayed_work(&hdev->ncmd_timer,
3283                                              HCI_NCMD_TIMEOUT);
3284                }
3285        }
3286}
3287
3288static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3289                                 u16 *opcode, u8 *status,
3290                                 hci_req_complete_t *req_complete,
3291                                 hci_req_complete_skb_t *req_complete_skb)
3292{
3293        struct hci_ev_cmd_complete *ev = (void *) skb->data;
3294
3295        *opcode = __le16_to_cpu(ev->opcode);
3296        *status = skb->data[sizeof(*ev)];
3297
3298        skb_pull(skb, sizeof(*ev));
3299
3300        switch (*opcode) {
3301        case HCI_OP_INQUIRY_CANCEL:
3302                hci_cc_inquiry_cancel(hdev, skb, status);
3303                break;
3304
3305        case HCI_OP_PERIODIC_INQ:
3306                hci_cc_periodic_inq(hdev, skb);
3307                break;
3308
3309        case HCI_OP_EXIT_PERIODIC_INQ:
3310                hci_cc_exit_periodic_inq(hdev, skb);
3311                break;
3312
3313        case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3314                hci_cc_remote_name_req_cancel(hdev, skb);
3315                break;
3316
3317        case HCI_OP_ROLE_DISCOVERY:
3318                hci_cc_role_discovery(hdev, skb);
3319                break;
3320
3321        case HCI_OP_READ_LINK_POLICY:
3322                hci_cc_read_link_policy(hdev, skb);
3323                break;
3324
3325        case HCI_OP_WRITE_LINK_POLICY:
3326                hci_cc_write_link_policy(hdev, skb);
3327                break;
3328
3329        case HCI_OP_READ_DEF_LINK_POLICY:
3330                hci_cc_read_def_link_policy(hdev, skb);
3331                break;
3332
3333        case HCI_OP_WRITE_DEF_LINK_POLICY:
3334                hci_cc_write_def_link_policy(hdev, skb);
3335                break;
3336
3337        case HCI_OP_RESET:
3338                hci_cc_reset(hdev, skb);
3339                break;
3340
3341        case HCI_OP_READ_STORED_LINK_KEY:
3342                hci_cc_read_stored_link_key(hdev, skb);
3343                break;
3344
3345        case HCI_OP_DELETE_STORED_LINK_KEY:
3346                hci_cc_delete_stored_link_key(hdev, skb);
3347                break;
3348
3349        case HCI_OP_WRITE_LOCAL_NAME:
3350                hci_cc_write_local_name(hdev, skb);
3351                break;
3352
3353        case HCI_OP_READ_LOCAL_NAME:
3354                hci_cc_read_local_name(hdev, skb);
3355                break;
3356
3357        case HCI_OP_WRITE_AUTH_ENABLE:
3358                hci_cc_write_auth_enable(hdev, skb);
3359                break;
3360
3361        case HCI_OP_WRITE_ENCRYPT_MODE:
3362                hci_cc_write_encrypt_mode(hdev, skb);
3363                break;
3364
3365        case HCI_OP_WRITE_SCAN_ENABLE:
3366                hci_cc_write_scan_enable(hdev, skb);
3367                break;
3368
3369        case HCI_OP_SET_EVENT_FLT:
3370                hci_cc_set_event_filter(hdev, skb);
3371                break;
3372
3373        case HCI_OP_READ_CLASS_OF_DEV:
3374                hci_cc_read_class_of_dev(hdev, skb);
3375                break;
3376
3377        case HCI_OP_WRITE_CLASS_OF_DEV:
3378                hci_cc_write_class_of_dev(hdev, skb);
3379                break;
3380
3381        case HCI_OP_READ_VOICE_SETTING:
3382                hci_cc_read_voice_setting(hdev, skb);
3383                break;
3384
3385        case HCI_OP_WRITE_VOICE_SETTING:
3386                hci_cc_write_voice_setting(hdev, skb);
3387                break;
3388
3389        case HCI_OP_READ_NUM_SUPPORTED_IAC:
3390                hci_cc_read_num_supported_iac(hdev, skb);
3391                break;
3392
3393        case HCI_OP_WRITE_SSP_MODE:
3394                hci_cc_write_ssp_mode(hdev, skb);
3395                break;
3396
3397        case HCI_OP_WRITE_SC_SUPPORT:
3398                hci_cc_write_sc_support(hdev, skb);
3399                break;
3400
3401        case HCI_OP_READ_AUTH_PAYLOAD_TO:
3402                hci_cc_read_auth_payload_timeout(hdev, skb);
3403                break;
3404
3405        case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3406                hci_cc_write_auth_payload_timeout(hdev, skb);
3407                break;
3408
3409        case HCI_OP_READ_LOCAL_VERSION:
3410                hci_cc_read_local_version(hdev, skb);
3411                break;
3412
3413        case HCI_OP_READ_LOCAL_COMMANDS:
3414                hci_cc_read_local_commands(hdev, skb);
3415                break;
3416
3417        case HCI_OP_READ_LOCAL_FEATURES:
3418                hci_cc_read_local_features(hdev, skb);
3419                break;
3420
3421        case HCI_OP_READ_LOCAL_EXT_FEATURES:
3422                hci_cc_read_local_ext_features(hdev, skb);
3423                break;
3424
3425        case HCI_OP_READ_BUFFER_SIZE:
3426                hci_cc_read_buffer_size(hdev, skb);
3427                break;
3428
3429        case HCI_OP_READ_BD_ADDR:
3430                hci_cc_read_bd_addr(hdev, skb);
3431                break;
3432
3433        case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3434                hci_cc_read_local_pairing_opts(hdev, skb);
3435                break;
3436
3437        case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3438                hci_cc_read_page_scan_activity(hdev, skb);
3439                break;
3440
3441        case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3442                hci_cc_write_page_scan_activity(hdev, skb);
3443                break;
3444
3445        case HCI_OP_READ_PAGE_SCAN_TYPE:
3446                hci_cc_read_page_scan_type(hdev, skb);
3447                break;
3448
3449        case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3450                hci_cc_write_page_scan_type(hdev, skb);
3451                break;
3452
3453        case HCI_OP_READ_DATA_BLOCK_SIZE:
3454                hci_cc_read_data_block_size(hdev, skb);
3455                break;
3456
3457        case HCI_OP_READ_FLOW_CONTROL_MODE:
3458                hci_cc_read_flow_control_mode(hdev, skb);
3459                break;
3460
3461        case HCI_OP_READ_LOCAL_AMP_INFO:
3462                hci_cc_read_local_amp_info(hdev, skb);
3463                break;
3464
3465        case HCI_OP_READ_CLOCK:
3466                hci_cc_read_clock(hdev, skb);
3467                break;
3468
3469        case HCI_OP_READ_INQ_RSP_TX_POWER:
3470                hci_cc_read_inq_rsp_tx_power(hdev, skb);
3471                break;
3472
3473        case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3474                hci_cc_read_def_err_data_reporting(hdev, skb);
3475                break;
3476
3477        case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3478                hci_cc_write_def_err_data_reporting(hdev, skb);
3479                break;
3480
3481        case HCI_OP_PIN_CODE_REPLY:
3482                hci_cc_pin_code_reply(hdev, skb);
3483                break;
3484
3485        case HCI_OP_PIN_CODE_NEG_REPLY:
3486                hci_cc_pin_code_neg_reply(hdev, skb);
3487                break;
3488
3489        case HCI_OP_READ_LOCAL_OOB_DATA:
3490                hci_cc_read_local_oob_data(hdev, skb);
3491                break;
3492
3493        case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3494                hci_cc_read_local_oob_ext_data(hdev, skb);
3495                break;
3496
3497        case HCI_OP_LE_READ_BUFFER_SIZE:
3498                hci_cc_le_read_buffer_size(hdev, skb);
3499                break;
3500
3501        case HCI_OP_LE_READ_LOCAL_FEATURES:
3502                hci_cc_le_read_local_features(hdev, skb);
3503                break;
3504
3505        case HCI_OP_LE_READ_ADV_TX_POWER:
3506                hci_cc_le_read_adv_tx_power(hdev, skb);
3507                break;
3508
3509        case HCI_OP_USER_CONFIRM_REPLY:
3510                hci_cc_user_confirm_reply(hdev, skb);
3511                break;
3512
3513        case HCI_OP_USER_CONFIRM_NEG_REPLY:
3514                hci_cc_user_confirm_neg_reply(hdev, skb);
3515                break;
3516
3517        case HCI_OP_USER_PASSKEY_REPLY:
3518                hci_cc_user_passkey_reply(hdev, skb);
3519                break;
3520
3521        case HCI_OP_USER_PASSKEY_NEG_REPLY:
3522                hci_cc_user_passkey_neg_reply(hdev, skb);
3523                break;
3524
3525        case HCI_OP_LE_SET_RANDOM_ADDR:
3526                hci_cc_le_set_random_addr(hdev, skb);
3527                break;
3528
3529        case HCI_OP_LE_SET_ADV_ENABLE:
3530                hci_cc_le_set_adv_enable(hdev, skb);
3531                break;
3532
3533        case HCI_OP_LE_SET_SCAN_PARAM:
3534                hci_cc_le_set_scan_param(hdev, skb);
3535                break;
3536
3537        case HCI_OP_LE_SET_SCAN_ENABLE:
3538                hci_cc_le_set_scan_enable(hdev, skb);
3539                break;
3540
3541        case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3542                hci_cc_le_read_accept_list_size(hdev, skb);
3543                break;
3544
3545        case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3546                hci_cc_le_clear_accept_list(hdev, skb);
3547                break;
3548
3549        case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3550                hci_cc_le_add_to_accept_list(hdev, skb);
3551                break;
3552
3553        case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3554                hci_cc_le_del_from_accept_list(hdev, skb);
3555                break;
3556
3557        case HCI_OP_LE_READ_SUPPORTED_STATES:
3558                hci_cc_le_read_supported_states(hdev, skb);
3559                break;
3560
3561        case HCI_OP_LE_READ_DEF_DATA_LEN:
3562                hci_cc_le_read_def_data_len(hdev, skb);
3563                break;
3564
3565        case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3566                hci_cc_le_write_def_data_len(hdev, skb);
3567                break;
3568
3569        case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3570                hci_cc_le_add_to_resolv_list(hdev, skb);
3571                break;
3572
3573        case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3574                hci_cc_le_del_from_resolv_list(hdev, skb);
3575                break;
3576
3577        case HCI_OP_LE_CLEAR_RESOLV_LIST:
3578                hci_cc_le_clear_resolv_list(hdev, skb);
3579                break;
3580
3581        case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3582                hci_cc_le_read_resolv_list_size(hdev, skb);
3583                break;
3584
3585        case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3586                hci_cc_le_set_addr_resolution_enable(hdev, skb);
3587                break;
3588
3589        case HCI_OP_LE_READ_MAX_DATA_LEN:
3590                hci_cc_le_read_max_data_len(hdev, skb);
3591                break;
3592
3593        case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3594                hci_cc_write_le_host_supported(hdev, skb);
3595                break;
3596
3597        case HCI_OP_LE_SET_ADV_PARAM:
3598                hci_cc_set_adv_param(hdev, skb);
3599                break;
3600
3601        case HCI_OP_READ_RSSI:
3602                hci_cc_read_rssi(hdev, skb);
3603                break;
3604
3605        case HCI_OP_READ_TX_POWER:
3606                hci_cc_read_tx_power(hdev, skb);
3607                break;
3608
3609        case HCI_OP_WRITE_SSP_DEBUG_MODE:
3610                hci_cc_write_ssp_debug_mode(hdev, skb);
3611                break;
3612
3613        case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3614                hci_cc_le_set_ext_scan_param(hdev, skb);
3615                break;
3616
3617        case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3618                hci_cc_le_set_ext_scan_enable(hdev, skb);
3619                break;
3620
3621        case HCI_OP_LE_SET_DEFAULT_PHY:
3622                hci_cc_le_set_default_phy(hdev, skb);
3623                break;
3624
3625        case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3626                hci_cc_le_read_num_adv_sets(hdev, skb);
3627                break;
3628
3629        case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3630                hci_cc_set_ext_adv_param(hdev, skb);
3631                break;
3632
3633        case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3634                hci_cc_le_set_ext_adv_enable(hdev, skb);
3635                break;
3636
3637        case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3638                hci_cc_le_set_adv_set_random_addr(hdev, skb);
3639                break;
3640
3641        case HCI_OP_LE_READ_TRANSMIT_POWER:
3642                hci_cc_le_read_transmit_power(hdev, skb);
3643                break;
3644
3645        default:
3646                BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3647                break;
3648        }
3649
3650        handle_cmd_cnt_and_timer(hdev, *opcode, ev->ncmd);
3651
3652        hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3653                             req_complete_skb);
3654
3655        if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3656                bt_dev_err(hdev,
3657                           "unexpected event for opcode 0x%4.4x", *opcode);
3658                return;
3659        }
3660
3661        if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3662                queue_work(hdev->workqueue, &hdev->cmd_work);
3663}
3664
3665static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3666                               u16 *opcode, u8 *status,
3667                               hci_req_complete_t *req_complete,
3668                               hci_req_complete_skb_t *req_complete_skb)
3669{
3670        struct hci_ev_cmd_status *ev = (void *) skb->data;
3671
3672        skb_pull(skb, sizeof(*ev));
3673
3674        *opcode = __le16_to_cpu(ev->opcode);
3675        *status = ev->status;
3676
3677        switch (*opcode) {
3678        case HCI_OP_INQUIRY:
3679                hci_cs_inquiry(hdev, ev->status);
3680                break;
3681
3682        case HCI_OP_CREATE_CONN:
3683                hci_cs_create_conn(hdev, ev->status);
3684                break;
3685
3686        case HCI_OP_DISCONNECT:
3687                hci_cs_disconnect(hdev, ev->status);
3688                break;
3689
3690        case HCI_OP_ADD_SCO:
3691                hci_cs_add_sco(hdev, ev->status);
3692                break;
3693
3694        case HCI_OP_AUTH_REQUESTED:
3695                hci_cs_auth_requested(hdev, ev->status);
3696                break;
3697
3698        case HCI_OP_SET_CONN_ENCRYPT:
3699                hci_cs_set_conn_encrypt(hdev, ev->status);
3700                break;
3701
3702        case HCI_OP_REMOTE_NAME_REQ:
3703                hci_cs_remote_name_req(hdev, ev->status);
3704                break;
3705
3706        case HCI_OP_READ_REMOTE_FEATURES:
3707                hci_cs_read_remote_features(hdev, ev->status);
3708                break;
3709
3710        case HCI_OP_READ_REMOTE_EXT_FEATURES:
3711                hci_cs_read_remote_ext_features(hdev, ev->status);
3712                break;
3713
3714        case HCI_OP_SETUP_SYNC_CONN:
3715                hci_cs_setup_sync_conn(hdev, ev->status);
3716                break;
3717
3718        case HCI_OP_SNIFF_MODE:
3719                hci_cs_sniff_mode(hdev, ev->status);
3720                break;
3721
3722        case HCI_OP_EXIT_SNIFF_MODE:
3723                hci_cs_exit_sniff_mode(hdev, ev->status);
3724                break;
3725
3726        case HCI_OP_SWITCH_ROLE:
3727                hci_cs_switch_role(hdev, ev->status);
3728                break;
3729
3730        case HCI_OP_LE_CREATE_CONN:
3731                hci_cs_le_create_conn(hdev, ev->status);
3732                break;
3733
3734        case HCI_OP_LE_READ_REMOTE_FEATURES:
3735                hci_cs_le_read_remote_features(hdev, ev->status);
3736                break;
3737
3738        case HCI_OP_LE_START_ENC:
3739                hci_cs_le_start_enc(hdev, ev->status);
3740                break;
3741
3742        case HCI_OP_LE_EXT_CREATE_CONN:
3743                hci_cs_le_ext_create_conn(hdev, ev->status);
3744                break;
3745
3746        default:
3747                BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3748                break;
3749        }
3750
3751        handle_cmd_cnt_and_timer(hdev, *opcode, ev->ncmd);
3752
3753        /* Indicate request completion if the command failed. Also, if
3754         * we're not waiting for a special event and we get a success
3755         * command status we should try to flag the request as completed
3756         * (since for this kind of commands there will not be a command
3757         * complete event).
3758         */
3759        if (ev->status ||
3760            (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3761                hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3762                                     req_complete_skb);
3763
3764        if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3765                bt_dev_err(hdev,
3766                           "unexpected event for opcode 0x%4.4x", *opcode);
3767                return;
3768        }
3769
3770        if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3771                queue_work(hdev->workqueue, &hdev->cmd_work);
3772}
3773
3774static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3775{
3776        struct hci_ev_hardware_error *ev = (void *) skb->data;
3777
3778        hdev->hw_error_code = ev->code;
3779
3780        queue_work(hdev->req_workqueue, &hdev->error_reset);
3781}
3782
3783static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3784{
3785        struct hci_ev_role_change *ev = (void *) skb->data;
3786        struct hci_conn *conn;
3787
3788        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3789
3790        hci_dev_lock(hdev);
3791
3792        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3793        if (conn) {
3794                if (!ev->status)
3795                        conn->role = ev->role;
3796
3797                clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3798
3799                hci_role_switch_cfm(conn, ev->status, ev->role);
3800        }
3801
3802        hci_dev_unlock(hdev);
3803}
3804
3805static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3806{
3807        struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3808        int i;
3809
3810        if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3811                bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3812                return;
3813        }
3814
3815        if (skb->len < sizeof(*ev) ||
3816            skb->len < struct_size(ev, handles, ev->num_hndl)) {
3817                BT_DBG("%s bad parameters", hdev->name);
3818                return;
3819        }
3820
3821        BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3822
3823        for (i = 0; i < ev->num_hndl; i++) {
3824                struct hci_comp_pkts_info *info = &ev->handles[i];
3825                struct hci_conn *conn;
3826                __u16  handle, count;
3827
3828                handle = __le16_to_cpu(info->handle);
3829                count  = __le16_to_cpu(info->count);
3830
3831                conn = hci_conn_hash_lookup_handle(hdev, handle);
3832                if (!conn)
3833                        continue;
3834
3835                conn->sent -= count;
3836
3837                switch (conn->type) {
3838                case ACL_LINK:
3839                        hdev->acl_cnt += count;
3840                        if (hdev->acl_cnt > hdev->acl_pkts)
3841                                hdev->acl_cnt = hdev->acl_pkts;
3842                        break;
3843
3844                case LE_LINK:
3845                        if (hdev->le_pkts) {
3846                                hdev->le_cnt += count;
3847                                if (hdev->le_cnt > hdev->le_pkts)
3848                                        hdev->le_cnt = hdev->le_pkts;
3849                        } else {
3850                                hdev->acl_cnt += count;
3851                                if (hdev->acl_cnt > hdev->acl_pkts)
3852                                        hdev->acl_cnt = hdev->acl_pkts;
3853                        }
3854                        break;
3855
3856                case SCO_LINK:
3857                        hdev->sco_cnt += count;
3858                        if (hdev->sco_cnt > hdev->sco_pkts)
3859                                hdev->sco_cnt = hdev->sco_pkts;
3860                        break;
3861
3862                default:
3863                        bt_dev_err(hdev, "unknown type %d conn %p",
3864                                   conn->type, conn);
3865                        break;
3866                }
3867        }
3868
3869        queue_work(hdev->workqueue, &hdev->tx_work);
3870}
3871
3872static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3873                                                 __u16 handle)
3874{
3875        struct hci_chan *chan;
3876
3877        switch (hdev->dev_type) {
3878        case HCI_PRIMARY:
3879                return hci_conn_hash_lookup_handle(hdev, handle);
3880        case HCI_AMP:
3881                chan = hci_chan_lookup_handle(hdev, handle);
3882                if (chan)
3883                        return chan->conn;
3884                break;
3885        default:
3886                bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3887                break;
3888        }
3889
3890        return NULL;
3891}
3892
3893static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3894{
3895        struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3896        int i;
3897
3898        if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3899                bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3900                return;
3901        }
3902
3903        if (skb->len < sizeof(*ev) ||
3904            skb->len < struct_size(ev, handles, ev->num_hndl)) {
3905                BT_DBG("%s bad parameters", hdev->name);
3906                return;
3907        }
3908
3909        BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3910               ev->num_hndl);
3911
3912        for (i = 0; i < ev->num_hndl; i++) {
3913                struct hci_comp_blocks_info *info = &ev->handles[i];
3914                struct hci_conn *conn = NULL;
3915                __u16  handle, block_count;
3916
3917                handle = __le16_to_cpu(info->handle);
3918                block_count = __le16_to_cpu(info->blocks);
3919
3920                conn = __hci_conn_lookup_handle(hdev, handle);
3921                if (!conn)
3922                        continue;
3923
3924                conn->sent -= block_count;
3925
3926                switch (conn->type) {
3927                case ACL_LINK:
3928                case AMP_LINK:
3929                        hdev->block_cnt += block_count;
3930                        if (hdev->block_cnt > hdev->num_blocks)
3931                                hdev->block_cnt = hdev->num_blocks;
3932                        break;
3933
3934                default:
3935                        bt_dev_err(hdev, "unknown type %d conn %p",
3936                                   conn->type, conn);
3937                        break;
3938                }
3939        }
3940
3941        queue_work(hdev->workqueue, &hdev->tx_work);
3942}
3943
3944static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3945{
3946        struct hci_ev_mode_change *ev = (void *) skb->data;
3947        struct hci_conn *conn;
3948
3949        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3950
3951        hci_dev_lock(hdev);
3952
3953        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3954        if (conn) {
3955                conn->mode = ev->mode;
3956
3957                if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3958                                        &conn->flags)) {
3959                        if (conn->mode == HCI_CM_ACTIVE)
3960                                set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3961                        else
3962                                clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3963                }
3964
3965                if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3966                        hci_sco_setup(conn, ev->status);
3967        }
3968
3969        hci_dev_unlock(hdev);
3970}
3971
3972static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3973{
3974        struct hci_ev_pin_code_req *ev = (void *) skb->data;
3975        struct hci_conn *conn;
3976
3977        BT_DBG("%s", hdev->name);
3978
3979        hci_dev_lock(hdev);
3980
3981        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3982        if (!conn)
3983                goto unlock;
3984
3985        if (conn->state == BT_CONNECTED) {
3986                hci_conn_hold(conn);
3987                conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3988                hci_conn_drop(conn);
3989        }
3990
3991        if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3992            !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3993                hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3994                             sizeof(ev->bdaddr), &ev->bdaddr);
3995        } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3996                u8 secure;
3997
3998                if (conn->pending_sec_level == BT_SECURITY_HIGH)
3999                        secure = 1;
4000                else
4001                        secure = 0;
4002
4003                mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4004        }
4005
4006unlock:
4007        hci_dev_unlock(hdev);
4008}
4009
4010static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4011{
4012        if (key_type == HCI_LK_CHANGED_COMBINATION)
4013                return;
4014
4015        conn->pin_length = pin_len;
4016        conn->key_type = key_type;
4017
4018        switch (key_type) {
4019        case HCI_LK_LOCAL_UNIT:
4020        case HCI_LK_REMOTE_UNIT:
4021        case HCI_LK_DEBUG_COMBINATION:
4022                return;
4023        case HCI_LK_COMBINATION:
4024                if (pin_len == 16)
4025                        conn->pending_sec_level = BT_SECURITY_HIGH;
4026                else
4027                        conn->pending_sec_level = BT_SECURITY_MEDIUM;
4028                break;
4029        case HCI_LK_UNAUTH_COMBINATION_P192:
4030        case HCI_LK_UNAUTH_COMBINATION_P256:
4031                conn->pending_sec_level = BT_SECURITY_MEDIUM;
4032                break;
4033        case HCI_LK_AUTH_COMBINATION_P192:
4034                conn->pending_sec_level = BT_SECURITY_HIGH;
4035                break;
4036        case HCI_LK_AUTH_COMBINATION_P256:
4037                conn->pending_sec_level = BT_SECURITY_FIPS;
4038                break;
4039        }
4040}
4041
4042static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4043{
4044        struct hci_ev_link_key_req *ev = (void *) skb->data;
4045        struct hci_cp_link_key_reply cp;
4046        struct hci_conn *conn;
4047        struct link_key *key;
4048
4049        BT_DBG("%s", hdev->name);
4050
4051        if (!hci_dev_test_flag(hdev, HCI_MGMT))
4052                return;
4053
4054        hci_dev_lock(hdev);
4055
4056        key = hci_find_link_key(hdev, &ev->bdaddr);
4057        if (!key) {
4058                BT_DBG("%s link key not found for %pMR", hdev->name,
4059                       &ev->bdaddr);
4060                goto not_found;
4061        }
4062
4063        BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4064               &ev->bdaddr);
4065
4066        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4067        if (conn) {
4068                clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4069
4070                if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4071                     key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4072                    conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4073                        BT_DBG("%s ignoring unauthenticated key", hdev->name);
4074                        goto not_found;
4075                }
4076
4077                if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4078                    (conn->pending_sec_level == BT_SECURITY_HIGH ||
4079                     conn->pending_sec_level == BT_SECURITY_FIPS)) {
4080                        BT_DBG("%s ignoring key unauthenticated for high security",
4081                               hdev->name);
4082                        goto not_found;
4083                }
4084
4085                conn_set_key(conn, key->type, key->pin_len);
4086        }
4087
4088        bacpy(&cp.bdaddr, &ev->bdaddr);
4089        memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4090
4091        hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4092
4093        hci_dev_unlock(hdev);
4094
4095        return;
4096
4097not_found:
4098        hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4099        hci_dev_unlock(hdev);
4100}
4101
4102static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4103{
4104        struct hci_ev_link_key_notify *ev = (void *) skb->data;
4105        struct hci_conn *conn;
4106        struct link_key *key;
4107        bool persistent;
4108        u8 pin_len = 0;
4109
4110        BT_DBG("%s", hdev->name);
4111
4112        hci_dev_lock(hdev);
4113
4114        conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4115        if (!conn)
4116                goto unlock;
4117
4118        hci_conn_hold(conn);
4119        conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4120        hci_conn_drop(conn);
4121
4122        set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4123        conn_set_key(conn, ev->key_type, conn->pin_length);
4124
4125        if (!hci_dev_test_flag(hdev, HCI_MGMT))
4126                goto unlock;
4127
4128        key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4129                                ev->key_type, pin_len, &persistent);
4130        if (!key)
4131                goto unlock;
4132
4133        /* Update connection information since adding the key will have
4134         * fixed up the type in the case of changed combination keys.
4135         */
4136        if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4137                conn_set_key(conn, key->type, key->pin_len);
4138
4139        mgmt_new_link_key(hdev, key, persistent);
4140
4141        /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4142         * is set. If it's not set simply remove the key from the kernel
4143         * list (we've still notified user space about it but with
4144         * store_hint being 0).
4145         */
4146        if (key->type == HCI_LK_DEBUG_COMBINATION &&
4147            !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4148                list_del_rcu(&key->list);
4149                kfree_rcu(key, rcu);
4150                goto unlock;
4151        }
4152
4153        if (persistent)
4154                clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4155        else
4156                set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4157
4158unlock:
4159        hci_dev_unlock(hdev);
4160}
4161
4162static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4163{
4164        struct hci_ev_clock_offset *ev = (void *) skb->data;
4165        struct hci_conn *conn;
4166
4167        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4168
4169        hci_dev_lock(hdev);
4170
4171        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4172        if (conn && !ev->status) {
4173                struct inquiry_entry *ie;
4174
4175                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4176                if (ie) {
4177                        ie->data.clock_offset = ev->clock_offset;
4178                        ie->timestamp = jiffies;
4179                }
4180        }
4181
4182        hci_dev_unlock(hdev);
4183}
4184
4185static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4186{
4187        struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4188        struct hci_conn *conn;
4189
4190        BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4191
4192        hci_dev_lock(hdev);
4193
4194        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4195        if (conn && !ev->status)
4196                conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4197
4198        hci_dev_unlock(hdev);
4199}
4200
4201static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4202{
4203        struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4204        struct inquiry_entry *ie;
4205
4206        BT_DBG("%s", hdev->name);
4207
4208        hci_dev_lock(hdev);
4209
4210        ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4211        if (ie) {
4212                ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4213                ie->timestamp = jiffies;
4214        }
4215
4216        hci_dev_unlock(hdev);
4217}
4218
4219static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4220                                             struct sk_buff *skb)
4221{
4222        struct inquiry_data data;
4223        int num_rsp = *((__u8 *) skb->data);
4224
4225        BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4226
4227        if (!num_rsp)
4228                return;
4229
4230        if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4231                return;
4232
4233        hci_dev_lock(hdev);
4234
4235        if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4236                struct inquiry_info_with_rssi_and_pscan_mode *info;
4237                info = (void *) (skb->data + 1);
4238
4239                if (skb->len < num_rsp * sizeof(*info) + 1)
4240                        goto unlock;
4241
4242                for (; num_rsp; num_rsp--, info++) {
4243                        u32 flags;
4244
4245                        bacpy(&data.bdaddr, &info->bdaddr);
4246                        data.pscan_rep_mode     = info->pscan_rep_mode;
4247                        data.pscan_period_mode  = info->pscan_period_mode;
4248                        data.pscan_mode         = info->pscan_mode;
4249                        memcpy(data.dev_class, info->dev_class, 3);
4250                        data.clock_offset       = info->clock_offset;
4251                        data.rssi               = info->rssi;
4252                        data.ssp_mode           = 0x00;
4253
4254                        flags = hci_inquiry_cache_update(hdev, &data, false);
4255
4256                        mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4257                                          info->dev_class, info->rssi,
4258                                          flags, NULL, 0, NULL, 0);
4259                }
4260        } else {
4261                struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4262
4263                if (skb->len < num_rsp * sizeof(*info) + 1)
4264                        goto unlock;
4265
4266                for (; num_rsp; num_rsp--, info++) {
4267                        u32 flags;
4268
4269                        bacpy(&data.bdaddr, &info->bdaddr);
4270                        data.pscan_rep_mode     = info->pscan_rep_mode;
4271                        data.pscan_period_mode  = info->pscan_period_mode;
4272                        data.pscan_mode         = 0x00;
4273                        memcpy(data.dev_class, info->dev_class, 3);
4274                        data.clock_offset       = info->clock_offset;
4275                        data.rssi               = info->rssi;
4276                        data.ssp_mode           = 0x00;
4277
4278                        flags = hci_inquiry_cache_update(hdev, &data, false);
4279
4280                        mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4281                                          info->dev_class, info->rssi,
4282                                          flags, NULL, 0, NULL, 0);
4283                }
4284        }
4285
4286unlock:
4287        hci_dev_unlock(hdev);
4288}
4289
4290static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4291                                        struct sk_buff *skb)
4292{
4293        struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4294        struct hci_conn *conn;
4295
4296        BT_DBG("%s", hdev->name);
4297
4298        hci_dev_lock(hdev);
4299
4300        conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4301        if (!conn)
4302                goto unlock;
4303
4304        if (ev->page < HCI_MAX_PAGES)
4305                memcpy(conn->features[ev->page], ev->features, 8);
4306
4307        if (!ev->status && ev->page == 0x01) {
4308                struct inquiry_entry *ie;
4309
4310                ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4311                if (ie)
4312                        ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4313
4314