net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         /* Set discovery state to stopped if we're not doing LE active
  59          * scanning.
  60          */
  61         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  62             hdev->le_scan_type != LE_SCAN_ACTIVE)
  63                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  64         hci_dev_unlock(hdev);
  65
  66         hci_conn_check_pending(hdev);
  67 }
  68
  69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  70 {
  71         __u8 status = *((__u8 *) skb->data);
  72
  73         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  74
  75         if (status)
  76                 return;
  77
  78         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  79 }
  80
  81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  82 {
  83         __u8 status = *((__u8 *) skb->data);
  84
  85         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  86
  87         if (status)
  88                 return;
  89
  90         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  91
  92         hci_conn_check_pending(hdev);
  93 }
  94
  95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  96                                           struct sk_buff *skb)
  97 {
  98         BT_DBG("%s", hdev->name);
  99 }
 100
 101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 102 {
 103         struct hci_rp_role_discovery *rp = (void *) skb->data;
 104         struct hci_conn *conn;
 105
 106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 107
 108         if (rp->status)
 109                 return;
 110
 111         hci_dev_lock(hdev);
 112
 113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 114         if (conn)
 115                 conn->role = rp->role;
 116
 117         hci_dev_unlock(hdev);
 118 }
 119
 120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 121 {
 122         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 123         struct hci_conn *conn;
 124
 125         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 126
 127         if (rp->status)
 128                 return;
 129
 130         hci_dev_lock(hdev);
 131
 132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 133         if (conn)
 134                 conn->link_policy = __le16_to_cpu(rp->policy);
 135
 136         hci_dev_unlock(hdev);
 137 }
 138
 139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 140 {
 141         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 142         struct hci_conn *conn;
 143         void *sent;
 144
 145         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 146
 147         if (rp->status)
 148                 return;
 149
 150         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 151         if (!sent)
 152                 return;
 153
 154         hci_dev_lock(hdev);
 155
 156         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 157         if (conn)
 158                 conn->link_policy = get_unaligned_le16(sent + 2);
 159
 160         hci_dev_unlock(hdev);
 161 }
 162
 163 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 164                                         struct sk_buff *skb)
 165 {
 166         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 167
 168         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 169
 170         if (rp->status)
 171                 return;
 172
 173         hdev->link_policy = __le16_to_cpu(rp->policy);
 174 }
 175
 176 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 177                                          struct sk_buff *skb)
 178 {
 179         __u8 status = *((__u8 *) skb->data);
 180         void *sent;
 181
 182         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 183
 184         if (status)
 185                 return;
 186
 187         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 188         if (!sent)
 189                 return;
 190
 191         hdev->link_policy = get_unaligned_le16(sent);
 192 }
 193
 194 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197
 198         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200         clear_bit(HCI_RESET, &hdev->flags);
 201
 202         if (status)
 203                 return;
 204
 205         /* Reset all non-persistent flags */
 206         hci_dev_clear_volatile_flags(hdev);
 207
 208         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 209
 210         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 211         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 212
 213         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 214         hdev->adv_data_len = 0;
 215
 216         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 217         hdev->scan_rsp_data_len = 0;
 218
 219         hdev->le_scan_type = LE_SCAN_PASSIVE;
 220
 221         hdev->ssp_debug_mode = 0;
 222
 223         hci_bdaddr_list_clear(&hdev->le_white_list);
 224         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 225 }
 226
 227 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 228                                         struct sk_buff *skb)
 229 {
 230         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 231         struct hci_cp_read_stored_link_key *sent;
 232
 233         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 234
 235         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 236         if (!sent)
 237                 return;
 238
 239         if (!rp->status && sent->read_all == 0x01) {
 240                 hdev->stored_max_keys = rp->max_keys;
 241                 hdev->stored_num_keys = rp->num_keys;
 242         }
 243 }
 244
 245 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 246                                           struct sk_buff *skb)
 247 {
 248         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 249
 250         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 251
 252         if (rp->status)
 253                 return;
 254
 255         if (rp->num_keys <= hdev->stored_num_keys)
 256                 hdev->stored_num_keys -= rp->num_keys;
 257         else
 258                 hdev->stored_num_keys = 0;
 259 }
 260
 261 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 262 {
 263         __u8 status = *((__u8 *) skb->data);
 264         void *sent;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 269         if (!sent)
 270                 return;
 271
 272         hci_dev_lock(hdev);
 273
 274         if (hci_dev_test_flag(hdev, HCI_MGMT))
 275                 mgmt_set_local_name_complete(hdev, sent, status);
 276         else if (!status)
 277                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 278
 279         hci_dev_unlock(hdev);
 280 }
 281
 282 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 283 {
 284         struct hci_rp_read_local_name *rp = (void *) skb->data;
 285
 286         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 287
 288         if (rp->status)
 289                 return;
 290
 291         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 292             hci_dev_test_flag(hdev, HCI_CONFIG))
 293                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 294 }
 295
 296 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 297 {
 298         __u8 status = *((__u8 *) skb->data);
 299         void *sent;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 302
 303         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 304         if (!sent)
 305                 return;
 306
 307         hci_dev_lock(hdev);
 308
 309         if (!status) {
 310                 __u8 param = *((__u8 *) sent);
 311
 312                 if (param == AUTH_ENABLED)
 313                         set_bit(HCI_AUTH, &hdev->flags);
 314                 else
 315                         clear_bit(HCI_AUTH, &hdev->flags);
 316         }
 317
 318         if (hci_dev_test_flag(hdev, HCI_MGMT))
 319                 mgmt_auth_enable_complete(hdev, status);
 320
 321         hci_dev_unlock(hdev);
 322 }
 323
 324 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 325 {
 326         __u8 status = *((__u8 *) skb->data);
 327         __u8 param;
 328         void *sent;
 329
 330         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 331
 332         if (status)
 333                 return;
 334
 335         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 336         if (!sent)
 337                 return;
 338
 339         param = *((__u8 *) sent);
 340
 341         if (param)
 342                 set_bit(HCI_ENCRYPT, &hdev->flags);
 343         else
 344                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 345 }
 346
 347 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 348 {
 349         __u8 status = *((__u8 *) skb->data);
 350         __u8 param;
 351         void *sent;
 352
 353         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 356         if (!sent)
 357                 return;
 358
 359         param = *((__u8 *) sent);
 360
 361         hci_dev_lock(hdev);
 362
 363         if (status) {
 364                 hdev->discov_timeout = 0;
 365                 goto done;
 366         }
 367
 368         if (param & SCAN_INQUIRY)
 369                 set_bit(HCI_ISCAN, &hdev->flags);
 370         else
 371                 clear_bit(HCI_ISCAN, &hdev->flags);
 372
 373         if (param & SCAN_PAGE)
 374                 set_bit(HCI_PSCAN, &hdev->flags);
 375         else
 376                 clear_bit(HCI_PSCAN, &hdev->flags);
 377
 378 done:
 379         hci_dev_unlock(hdev);
 380 }
 381
 382 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 383 {
 384         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 385
 386         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 387
 388         if (rp->status)
 389                 return;
 390
 391         memcpy(hdev->dev_class, rp->dev_class, 3);
 392
 393         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 394                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 395 }
 396
 397 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         __u8 status = *((__u8 *) skb->data);
 400         void *sent;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 403
 404         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 405         if (!sent)
 406                 return;
 407
 408         hci_dev_lock(hdev);
 409
 410         if (status == 0)
 411                 memcpy(hdev->dev_class, sent, 3);
 412
 413         if (hci_dev_test_flag(hdev, HCI_MGMT))
 414                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 415
 416         hci_dev_unlock(hdev);
 417 }
 418
 419 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 420 {
 421         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 422         __u16 setting;
 423
 424         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 425
 426         if (rp->status)
 427                 return;
 428
 429         setting = __le16_to_cpu(rp->voice_setting);
 430
 431         if (hdev->voice_setting == setting)
 432                 return;
 433
 434         hdev->voice_setting = setting;
 435
 436         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 437
 438         if (hdev->notify)
 439                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 440 }
 441
 442 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 443                                        struct sk_buff *skb)
 444 {
 445         __u8 status = *((__u8 *) skb->data);
 446         __u16 setting;
 447         void *sent;
 448
 449         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 450
 451         if (status)
 452                 return;
 453
 454         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 455         if (!sent)
 456                 return;
 457
 458         setting = get_unaligned_le16(sent);
 459
 460         if (hdev->voice_setting == setting)
 461                 return;
 462
 463         hdev->voice_setting = setting;
 464
 465         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 466
 467         if (hdev->notify)
 468                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 469 }
 470
 471 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 472                                           struct sk_buff *skb)
 473 {
 474         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 475
 476         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 477
 478         if (rp->status)
 479                 return;
 480
 481         hdev->num_iac = rp->num_iac;
 482
 483         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 484 }
 485
 486 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 487 {
 488         __u8 status = *((__u8 *) skb->data);
 489         struct hci_cp_write_ssp_mode *sent;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 492
 493         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 494         if (!sent)
 495                 return;
 496
 497         hci_dev_lock(hdev);
 498
 499         if (!status) {
 500                 if (sent->mode)
 501                         hdev->features[1][0] |= LMP_HOST_SSP;
 502                 else
 503                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 504         }
 505
 506         if (hci_dev_test_flag(hdev, HCI_MGMT))
 507                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 508         else if (!status) {
 509                 if (sent->mode)
 510                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 511                 else
 512                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 513         }
 514
 515         hci_dev_unlock(hdev);
 516 }
 517
 518 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 519 {
 520         u8 status = *((u8 *) skb->data);
 521         struct hci_cp_write_sc_support *sent;
 522
 523         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 524
 525         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 526         if (!sent)
 527                 return;
 528
 529         hci_dev_lock(hdev);
 530
 531         if (!status) {
 532                 if (sent->support)
 533                         hdev->features[1][0] |= LMP_HOST_SC;
 534                 else
 535                         hdev->features[1][0] &= ~LMP_HOST_SC;
 536         }
 537
 538         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 539                 if (sent->support)
 540                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 541                 else
 542                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 543         }
 544
 545         hci_dev_unlock(hdev);
 546 }
 547
 548 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 549 {
 550         struct hci_rp_read_local_version *rp = (void *) skb->data;
 551
 552         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 553
 554         if (rp->status)
 555                 return;
 556
 557         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 558             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 559                 hdev->hci_ver = rp->hci_ver;
 560                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 561                 hdev->lmp_ver = rp->lmp_ver;
 562                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 563                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 564         }
 565 }
 566
 567 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 568                                        struct sk_buff *skb)
 569 {
 570         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 571
 572         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 573
 574         if (rp->status)
 575                 return;
 576
 577         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 578             hci_dev_test_flag(hdev, HCI_CONFIG))
 579                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 580 }
 581
 582 static void hci_cc_read_local_features(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_features *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         memcpy(hdev->features, rp->features, 8);
 593
 594         /* Adjust default settings according to features
 595          * supported by device. */
 596
 597         if (hdev->features[0][0] & LMP_3SLOT)
 598                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 599
 600         if (hdev->features[0][0] & LMP_5SLOT)
 601                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 602
 603         if (hdev->features[0][1] & LMP_HV2) {
 604                 hdev->pkt_type  |= (HCI_HV2);
 605                 hdev->esco_type |= (ESCO_HV2);
 606         }
 607
 608         if (hdev->features[0][1] & LMP_HV3) {
 609                 hdev->pkt_type  |= (HCI_HV3);
 610                 hdev->esco_type |= (ESCO_HV3);
 611         }
 612
 613         if (lmp_esco_capable(hdev))
 614                 hdev->esco_type |= (ESCO_EV3);
 615
 616         if (hdev->features[0][4] & LMP_EV4)
 617                 hdev->esco_type |= (ESCO_EV4);
 618
 619         if (hdev->features[0][4] & LMP_EV5)
 620                 hdev->esco_type |= (ESCO_EV5);
 621
 622         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 623                 hdev->esco_type |= (ESCO_2EV3);
 624
 625         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 626                 hdev->esco_type |= (ESCO_3EV3);
 627
 628         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 629                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 630 }
 631
 632 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 633                                            struct sk_buff *skb)
 634 {
 635         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 636
 637         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 638
 639         if (rp->status)
 640                 return;
 641
 642         if (hdev->max_page < rp->max_page)
 643                 hdev->max_page = rp->max_page;
 644
 645         if (rp->page < HCI_MAX_PAGES)
 646                 memcpy(hdev->features[rp->page], rp->features, 8);
 647 }
 648
 649 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 650                                           struct sk_buff *skb)
 651 {
 652         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 653
 654         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 655
 656         if (rp->status)
 657                 return;
 658
 659         hdev->flow_ctl_mode = rp->mode;
 660 }
 661
 662 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 663 {
 664         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 665
 666         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 667
 668         if (rp->status)
 669                 return;
 670
 671         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 672         hdev->sco_mtu  = rp->sco_mtu;
 673         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 674         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 675
 676         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 677                 hdev->sco_mtu  = 64;
 678                 hdev->sco_pkts = 8;
 679         }
 680
 681         hdev->acl_cnt = hdev->acl_pkts;
 682         hdev->sco_cnt = hdev->sco_pkts;
 683
 684         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 685                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 686 }
 687
 688 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 689 {
 690         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 691
 692         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 693
 694         if (rp->status)
 695                 return;
 696
 697         if (test_bit(HCI_INIT, &hdev->flags))
 698                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 699
 700         if (hci_dev_test_flag(hdev, HCI_SETUP))
 701                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 702 }
 703
 704 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 705                                            struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         if (test_bit(HCI_INIT, &hdev->flags)) {
 715                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 716                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 717         }
 718 }
 719
 720 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 721                                             struct sk_buff *skb)
 722 {
 723         u8 status = *((u8 *) skb->data);
 724         struct hci_cp_write_page_scan_activity *sent;
 725
 726         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 727
 728         if (status)
 729                 return;
 730
 731         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 732         if (!sent)
 733                 return;
 734
 735         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 736         hdev->page_scan_window = __le16_to_cpu(sent->window);
 737 }
 738
 739 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 740                                            struct sk_buff *skb)
 741 {
 742         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 743
 744         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 745
 746         if (rp->status)
 747                 return;
 748
 749         if (test_bit(HCI_INIT, &hdev->flags))
 750                 hdev->page_scan_type = rp->type;
 751 }
 752
 753 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 754                                         struct sk_buff *skb)
 755 {
 756         u8 status = *((u8 *) skb->data);
 757         u8 *type;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 760
 761         if (status)
 762                 return;
 763
 764         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 765         if (type)
 766                 hdev->page_scan_type = *type;
 767 }
 768
 769 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 770                                         struct sk_buff *skb)
 771 {
 772         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 775
 776         if (rp->status)
 777                 return;
 778
 779         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 780         hdev->block_len = __le16_to_cpu(rp->block_len);
 781         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 782
 783         hdev->block_cnt = hdev->num_blocks;
 784
 785         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 786                hdev->block_cnt, hdev->block_len);
 787 }
 788
 789 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 790 {
 791         struct hci_rp_read_clock *rp = (void *) skb->data;
 792         struct hci_cp_read_clock *cp;
 793         struct hci_conn *conn;
 794
 795         BT_DBG("%s", hdev->name);
 796
 797         if (skb->len < sizeof(*rp))
 798                 return;
 799
 800         if (rp->status)
 801                 return;
 802
 803         hci_dev_lock(hdev);
 804
 805         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 806         if (!cp)
 807                 goto unlock;
 808
 809         if (cp->which == 0x00) {
 810                 hdev->clock = le32_to_cpu(rp->clock);
 811                 goto unlock;
 812         }
 813
 814         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 815         if (conn) {
 816                 conn->clock = le32_to_cpu(rp->clock);
 817                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 818         }
 819
 820 unlock:
 821         hci_dev_unlock(hdev);
 822 }
 823
 824 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 825                                        struct sk_buff *skb)
 826 {
 827         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 830
 831         if (rp->status)
 832                 return;
 833
 834         hdev->amp_status = rp->amp_status;
 835         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 836         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 837         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 838         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 839         hdev->amp_type = rp->amp_type;
 840         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 841         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 842         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 843         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 844 }
 845
 846 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 847                                          struct sk_buff *skb)
 848 {
 849         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 850
 851         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 852
 853         if (rp->status)
 854                 return;
 855
 856         hdev->inq_tx_power = rp->tx_power;
 857 }
 858
 859 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 860 {
 861         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 862         struct hci_cp_pin_code_reply *cp;
 863         struct hci_conn *conn;
 864
 865         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 866
 867         hci_dev_lock(hdev);
 868
 869         if (hci_dev_test_flag(hdev, HCI_MGMT))
 870                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 871
 872         if (rp->status)
 873                 goto unlock;
 874
 875         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 876         if (!cp)
 877                 goto unlock;
 878
 879         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 880         if (conn)
 881                 conn->pin_length = cp->pin_len;
 882
 883 unlock:
 884         hci_dev_unlock(hdev);
 885 }
 886
 887 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 888 {
 889         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 890
 891         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 892
 893         hci_dev_lock(hdev);
 894
 895         if (hci_dev_test_flag(hdev, HCI_MGMT))
 896                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 897                                                  rp->status);
 898
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 903                                        struct sk_buff *skb)
 904 {
 905         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 906
 907         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 908
 909         if (rp->status)
 910                 return;
 911
 912         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 913         hdev->le_pkts = rp->le_max_pkt;
 914
 915         hdev->le_cnt = hdev->le_pkts;
 916
 917         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 918 }
 919
 920 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 921                                           struct sk_buff *skb)
 922 {
 923         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 924
 925         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 926
 927         if (rp->status)
 928                 return;
 929
 930         memcpy(hdev->le_features, rp->features, 8);
 931 }
 932
 933 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 934                                         struct sk_buff *skb)
 935 {
 936         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 937
 938         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 939
 940         if (rp->status)
 941                 return;
 942
 943         hdev->adv_tx_power = rp->tx_power;
 944 }
 945
 946 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 947 {
 948         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 949
 950         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 951
 952         hci_dev_lock(hdev);
 953
 954         if (hci_dev_test_flag(hdev, HCI_MGMT))
 955                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 956                                                  rp->status);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 962                                           struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (hci_dev_test_flag(hdev, HCI_MGMT))
 971                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 972                                                      ACL_LINK, 0, rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (hci_dev_test_flag(hdev, HCI_MGMT))
 986                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
 987                                                  0, rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 993                                           struct sk_buff *skb)
 994 {
 995         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 996
 997         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 998
 999         hci_dev_lock(hdev);
1000
1001         if (hci_dev_test_flag(hdev, HCI_MGMT))
1002                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1003                                                      ACL_LINK, 0, rp->status);
1004
1005         hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1009                                        struct sk_buff *skb)
1010 {
1011         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
1013         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1014 }
1015
1016 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1017                                            struct sk_buff *skb)
1018 {
1019         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022 }
1023
1024 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1025 {
1026         __u8 status = *((__u8 *) skb->data);
1027         bdaddr_t *sent;
1028
1029         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1030
1031         if (status)
1032                 return;
1033
1034         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1035         if (!sent)
1036                 return;
1037
1038         hci_dev_lock(hdev);
1039
1040         bacpy(&hdev->random_addr, sent);
1041
1042         hci_dev_unlock(hdev);
1043 }
1044
1045 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1046 {
1047         __u8 status = *((__u8 *) skb->data);
1048         struct hci_cp_le_set_default_phy *cp;
1049
1050         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1051
1052         if (status)
1053                 return;
1054
1055         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1056         if (!cp)
1057                 return;
1058
1059         hci_dev_lock(hdev);
1060
1061         hdev->le_tx_def_phys = cp->tx_phys;
1062         hdev->le_rx_def_phys = cp->rx_phys;
1063
1064         hci_dev_unlock(hdev);
1065 }
1066
1067 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1068                                               struct sk_buff *skb)
1069 {
1070         __u8 status = *((__u8 *) skb->data);
1071         struct hci_cp_le_set_adv_set_rand_addr *cp;
1072         struct adv_info *adv_instance;
1073
1074         if (status)
1075                 return;
1076
1077         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1078         if (!cp)
1079                 return;
1080
1081         hci_dev_lock(hdev);
1082
1083         if (!hdev->cur_adv_instance) {
1084                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1085                 bacpy(&hdev->random_addr, &cp->bdaddr);
1086         } else {
1087                 adv_instance = hci_find_adv_instance(hdev,
1088                                                      hdev->cur_adv_instance);
1089                 if (adv_instance)
1090                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1091         }
1092
1093         hci_dev_unlock(hdev);
1094 }
1095
1096 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1097 {
1098         __u8 *sent, status = *((__u8 *) skb->data);
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1101
1102         if (status)
1103                 return;
1104
1105         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1106         if (!sent)
1107                 return;
1108
1109         hci_dev_lock(hdev);
1110
1111         /* If we're doing connection initiation as peripheral. Set a
1112          * timeout in case something goes wrong.
1113          */
1114         if (*sent) {
1115                 struct hci_conn *conn;
1116
1117                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1118
1119                 conn = hci_lookup_le_connect(hdev);
1120                 if (conn)
1121                         queue_delayed_work(hdev->workqueue,
1122                                            &conn->le_conn_timeout,
1123                                            conn->conn_timeout);
1124         } else {
1125                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1126         }
1127
1128         hci_dev_unlock(hdev);
1129 }
1130
1131 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1132                                          struct sk_buff *skb)
1133 {
1134         struct hci_cp_le_set_ext_adv_enable *cp;
1135         __u8 status = *((__u8 *) skb->data);
1136
1137         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1138
1139         if (status)
1140                 return;
1141
1142         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1143         if (!cp)
1144                 return;
1145
1146         hci_dev_lock(hdev);
1147
1148         if (cp->enable) {
1149                 struct hci_conn *conn;
1150
1151                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1152
1153                 conn = hci_lookup_le_connect(hdev);
1154                 if (conn)
1155                         queue_delayed_work(hdev->workqueue,
1156                                            &conn->le_conn_timeout,
1157                                            conn->conn_timeout);
1158         } else {
1159                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1160         }
1161
1162         hci_dev_unlock(hdev);
1163 }
1164
1165 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1166 {
1167         struct hci_cp_le_set_scan_param *cp;
1168         __u8 status = *((__u8 *) skb->data);
1169
1170         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1171
1172         if (status)
1173                 return;
1174
1175         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1176         if (!cp)
1177                 return;
1178
1179         hci_dev_lock(hdev);
1180
1181         hdev->le_scan_type = cp->type;
1182
1183         hci_dev_unlock(hdev);
1184 }
1185
1186 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1187                                          struct sk_buff *skb)
1188 {
1189         struct hci_cp_le_set_ext_scan_params *cp;
1190         __u8 status = *((__u8 *) skb->data);
1191         struct hci_cp_le_scan_phy_params *phy_param;
1192
1193         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1194
1195         if (status)
1196                 return;
1197
1198         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1199         if (!cp)
1200                 return;
1201
1202         phy_param = (void *)cp->data;
1203
1204         hci_dev_lock(hdev);
1205
1206         hdev->le_scan_type = phy_param->type;
1207
1208         hci_dev_unlock(hdev);
1209 }
1210
1211 static bool has_pending_adv_report(struct hci_dev *hdev)
1212 {
1213         struct discovery_state *d = &hdev->discovery;
1214
1215         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1216 }
1217
1218 static void clear_pending_adv_report(struct hci_dev *hdev)
1219 {
1220         struct discovery_state *d = &hdev->discovery;
1221
1222         bacpy(&d->last_adv_addr, BDADDR_ANY);
1223         d->last_adv_data_len = 0;
1224 }
1225
1226 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1227                                      u8 bdaddr_type, s8 rssi, u32 flags,
1228                                      u8 *data, u8 len)
1229 {
1230         struct discovery_state *d = &hdev->discovery;
1231
1232         bacpy(&d->last_adv_addr, bdaddr);
1233         d->last_adv_addr_type = bdaddr_type;
1234         d->last_adv_rssi = rssi;
1235         d->last_adv_flags = flags;
1236         memcpy(d->last_adv_data, data, len);
1237         d->last_adv_data_len = len;
1238 }
1239
1240 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1241 {
1242         hci_dev_lock(hdev);
1243
1244         switch (enable) {
1245         case LE_SCAN_ENABLE:
1246                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1247                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1248                         clear_pending_adv_report(hdev);
1249                 break;
1250
1251         case LE_SCAN_DISABLE:
1252                 /* We do this here instead of when setting DISCOVERY_STOPPED
1253                  * since the latter would potentially require waiting for
1254                  * inquiry to stop too.
1255                  */
1256                 if (has_pending_adv_report(hdev)) {
1257                         struct discovery_state *d = &hdev->discovery;
1258
1259                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1260                                           d->last_adv_addr_type, NULL,
1261                                           d->last_adv_rssi, d->last_adv_flags,
1262                                           d->last_adv_data,
1263                                           d->last_adv_data_len, NULL, 0);
1264                 }
1265
1266                 /* Cancel this timer so that we don't try to disable scanning
1267                  * when it's already disabled.
1268                  */
1269                 cancel_delayed_work(&hdev->le_scan_disable);
1270
1271                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1272
1273                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1274                  * interrupted scanning due to a connect request. Mark
1275                  * therefore discovery as stopped. If this was not
1276                  * because of a connect request advertising might have
1277                  * been disabled because of active scanning, so
1278                  * re-enable it again if necessary.
1279                  */
1280                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1281 #ifndef TIZEN_BT /* The below line is kernel bug. */
1282                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1283 #else
1284                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1285 #endif
1286                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1287                          hdev->discovery.state == DISCOVERY_FINDING)
1288                         hci_req_reenable_advertising(hdev);
1289
1290                 break;
1291
1292         default:
1293                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1294                            enable);
1295                 break;
1296         }
1297
1298         hci_dev_unlock(hdev);
1299 }
1300
1301 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1302                                       struct sk_buff *skb)
1303 {
1304         struct hci_cp_le_set_scan_enable *cp;
1305         __u8 status = *((__u8 *) skb->data);
1306
1307         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1308
1309         if (status)
1310                 return;
1311
1312         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1313         if (!cp)
1314                 return;
1315
1316         le_set_scan_enable_complete(hdev, cp->enable);
1317 }
1318
1319 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1320                                       struct sk_buff *skb)
1321 {
1322         struct hci_cp_le_set_ext_scan_enable *cp;
1323         __u8 status = *((__u8 *) skb->data);
1324
1325         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1326
1327         if (status)
1328                 return;
1329
1330         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1331         if (!cp)
1332                 return;
1333
1334         le_set_scan_enable_complete(hdev, cp->enable);
1335 }
1336
1337 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1338                                       struct sk_buff *skb)
1339 {
1340         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1341
1342         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1343                rp->num_of_sets);
1344
1345         if (rp->status)
1346                 return;
1347
1348         hdev->le_num_of_adv_sets = rp->num_of_sets;
1349 }
1350
1351 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1352                                            struct sk_buff *skb)
1353 {
1354         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1355
1356         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1357
1358         if (rp->status)
1359                 return;
1360
1361         hdev->le_white_list_size = rp->size;
1362 }
1363
1364 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1365                                        struct sk_buff *skb)
1366 {
1367         __u8 status = *((__u8 *) skb->data);
1368
1369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1370
1371         if (status)
1372                 return;
1373
1374         hci_bdaddr_list_clear(&hdev->le_white_list);
1375 }
1376
1377 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1378                                         struct sk_buff *skb)
1379 {
1380         struct hci_cp_le_add_to_white_list *sent;
1381         __u8 status = *((__u8 *) skb->data);
1382
1383         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1384
1385         if (status)
1386                 return;
1387
1388         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1389         if (!sent)
1390                 return;
1391
1392         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1393                            sent->bdaddr_type);
1394 }
1395
1396 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1397                                           struct sk_buff *skb)
1398 {
1399         struct hci_cp_le_del_from_white_list *sent;
1400         __u8 status = *((__u8 *) skb->data);
1401
1402         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1403
1404         if (status)
1405                 return;
1406
1407         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1408         if (!sent)
1409                 return;
1410
1411         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1412                             sent->bdaddr_type);
1413 }
1414
1415 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1416                                             struct sk_buff *skb)
1417 {
1418         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1419
1420         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1421
1422         if (rp->status)
1423                 return;
1424
1425         memcpy(hdev->le_states, rp->le_states, 8);
1426 }
1427
1428 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1429                                         struct sk_buff *skb)
1430 {
1431         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1432
1433         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1434
1435         if (rp->status)
1436                 return;
1437
1438         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1439         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1440 }
1441
1442 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1443                                          struct sk_buff *skb)
1444 {
1445         struct hci_cp_le_write_def_data_len *sent;
1446         __u8 status = *((__u8 *) skb->data);
1447
1448         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1449
1450         if (status)
1451                 return;
1452
1453         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1454         if (!sent)
1455                 return;
1456
1457         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1458         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1459 }
1460
1461 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1462                                        struct sk_buff *skb)
1463 {
1464         __u8 status = *((__u8 *) skb->data);
1465
1466         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1467
1468         if (status)
1469                 return;
1470
1471         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1472 }
1473
1474 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1475                                            struct sk_buff *skb)
1476 {
1477         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1478
1479         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1480
1481         if (rp->status)
1482                 return;
1483
1484         hdev->le_resolv_list_size = rp->size;
1485 }
1486
1487 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1488                                                 struct sk_buff *skb)
1489 {
1490         __u8 *sent, status = *((__u8 *) skb->data);
1491
1492         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1493
1494         if (status)
1495                 return;
1496
1497         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1498         if (!sent)
1499                 return;
1500
1501         hci_dev_lock(hdev);
1502
1503         if (*sent)
1504                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1505         else
1506                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1507
1508         hci_dev_unlock(hdev);
1509 }
1510
1511 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1512                                         struct sk_buff *skb)
1513 {
1514         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1515
1516         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1517
1518         if (rp->status)
1519                 return;
1520
1521         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1522         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1523         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1524         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1525 }
1526
1527 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1528                                            struct sk_buff *skb)
1529 {
1530         struct hci_cp_write_le_host_supported *sent;
1531         __u8 status = *((__u8 *) skb->data);
1532
1533         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1534
1535         if (status)
1536                 return;
1537
1538         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1539         if (!sent)
1540                 return;
1541
1542         hci_dev_lock(hdev);
1543
1544         if (sent->le) {
1545                 hdev->features[1][0] |= LMP_HOST_LE;
1546                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1547         } else {
1548                 hdev->features[1][0] &= ~LMP_HOST_LE;
1549                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1550                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1551         }
1552
1553         if (sent->simul)
1554                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1555         else
1556                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1557
1558         hci_dev_unlock(hdev);
1559 }
1560
1561 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1562 {
1563         struct hci_cp_le_set_adv_param *cp;
1564         u8 status = *((u8 *) skb->data);
1565
1566         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1567
1568         if (status)
1569                 return;
1570
1571         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1572         if (!cp)
1573                 return;
1574
1575         hci_dev_lock(hdev);
1576         hdev->adv_addr_type = cp->own_address_type;
1577         hci_dev_unlock(hdev);
1578 }
1579
1580 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1581 {
1582         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1583         struct hci_cp_le_set_ext_adv_params *cp;
1584         struct adv_info *adv_instance;
1585
1586         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1587
1588         if (rp->status)
1589                 return;
1590
1591         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1592         if (!cp)
1593                 return;
1594
1595         hci_dev_lock(hdev);
1596         hdev->adv_addr_type = cp->own_addr_type;
1597         if (!hdev->cur_adv_instance) {
1598                 /* Store in hdev for instance 0 */
1599                 hdev->adv_tx_power = rp->tx_power;
1600         } else {
1601                 adv_instance = hci_find_adv_instance(hdev,
1602                                                      hdev->cur_adv_instance);
1603                 if (adv_instance)
1604                         adv_instance->tx_power = rp->tx_power;
1605         }
1606         /* Update adv data as tx power is known now */
1607         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1608         hci_dev_unlock(hdev);
1609 }
1610
1611 #ifdef TIZEN_BT
1612 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1613                                           struct sk_buff *skb)
1614 {
1615         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1616
1617         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1618                hdev->name, rp->status, rp->le_ext_opcode);
1619
1620         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1621 }
1622
1623 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1624                                           struct sk_buff *skb)
1625 {
1626         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1627
1628         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1629                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1630
1631         mgmt_raw_rssi_response(hdev, rp, rp->status);
1632 }
1633
1634 static void hci_vendor_ext_rssi_link_alert_evt(struct hci_dev *hdev,
1635                                                struct sk_buff *skb)
1636 {
1637         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
1638
1639         BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X", LE_RSSI_LINK_ALERT);
1640
1641         mgmt_rssi_alert_evt(hdev, ev->conn_handle, ev->alert_type,
1642                             ev->rssi_dbm);
1643 }
1644
1645 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1646                                               struct sk_buff *skb)
1647 {
1648         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1649         __u8 event_le_ext_sub_code;
1650
1651         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1652                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1653
1654         skb_pull(skb, sizeof(*ev));
1655         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1656
1657         switch (event_le_ext_sub_code) {
1658         case LE_RSSI_LINK_ALERT:
1659                 hci_vendor_ext_rssi_link_alert_evt(hdev, skb);
1660                 break;
1661
1662         default:
1663                 break;
1664         }
1665 }
1666
1667 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1668 {
1669         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1670         __u8 event_sub_code;
1671
1672         BT_DBG("hci_vendor_specific_evt");
1673
1674         skb_pull(skb, sizeof(*ev));
1675         event_sub_code = ev->event_sub_code;
1676
1677         switch (event_sub_code) {
1678         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1679                 hci_vendor_specific_group_ext_evt(hdev, skb);
1680                 break;
1681
1682         default:
1683                 break;
1684         }
1685 }
1686 #endif
1687
1688 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1689 {
1690         struct hci_rp_read_rssi *rp = (void *) skb->data;
1691         struct hci_conn *conn;
1692
1693         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1694
1695         if (rp->status)
1696                 return;
1697
1698         hci_dev_lock(hdev);
1699
1700         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1701         if (conn)
1702                 conn->rssi = rp->rssi;
1703
1704         hci_dev_unlock(hdev);
1705 }
1706
1707 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1708 {
1709         struct hci_cp_read_tx_power *sent;
1710         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1711         struct hci_conn *conn;
1712
1713         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1714
1715         if (rp->status)
1716                 return;
1717
1718         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1719         if (!sent)
1720                 return;
1721
1722         hci_dev_lock(hdev);
1723
1724         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1725         if (!conn)
1726                 goto unlock;
1727
1728         switch (sent->type) {
1729         case 0x00:
1730                 conn->tx_power = rp->tx_power;
1731                 break;
1732         case 0x01:
1733                 conn->max_tx_power = rp->tx_power;
1734                 break;
1735         }
1736
1737 unlock:
1738         hci_dev_unlock(hdev);
1739 }
1740
1741 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1742 {
1743         u8 status = *((u8 *) skb->data);
1744         u8 *mode;
1745
1746         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1747
1748         if (status)
1749                 return;
1750
1751         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1752         if (mode)
1753                 hdev->ssp_debug_mode = *mode;
1754 }
1755
1756 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1757 {
1758         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1759
1760         if (status) {
1761                 hci_conn_check_pending(hdev);
1762                 return;
1763         }
1764
1765         set_bit(HCI_INQUIRY, &hdev->flags);
1766 }
1767
1768 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1769 {
1770         struct hci_cp_create_conn *cp;
1771         struct hci_conn *conn;
1772
1773         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1774
1775         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1776         if (!cp)
1777                 return;
1778
1779         hci_dev_lock(hdev);
1780
1781         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1782
1783         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1784
1785         if (status) {
1786                 if (conn && conn->state == BT_CONNECT) {
1787                         if (status != 0x0c || conn->attempt > 2) {
1788                                 conn->state = BT_CLOSED;
1789                                 hci_connect_cfm(conn, status);
1790                                 hci_conn_del(conn);
1791                         } else
1792                                 conn->state = BT_CONNECT2;
1793                 }
1794         } else {
1795                 if (!conn) {
1796                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1797                                             HCI_ROLE_MASTER);
1798                         if (!conn)
1799                                 bt_dev_err(hdev, "no memory for new connection");
1800                 }
1801         }
1802
1803         hci_dev_unlock(hdev);
1804 }
1805
1806 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1807 {
1808         struct hci_cp_add_sco *cp;
1809         struct hci_conn *acl, *sco;
1810         __u16 handle;
1811
1812         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1813
1814         if (!status)
1815                 return;
1816
1817         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1818         if (!cp)
1819                 return;
1820
1821         handle = __le16_to_cpu(cp->handle);
1822
1823         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1824
1825         hci_dev_lock(hdev);
1826
1827         acl = hci_conn_hash_lookup_handle(hdev, handle);
1828         if (acl) {
1829                 sco = acl->link;
1830                 if (sco) {
1831                         sco->state = BT_CLOSED;
1832
1833                         hci_connect_cfm(sco, status);
1834                         hci_conn_del(sco);
1835                 }
1836         }
1837
1838         hci_dev_unlock(hdev);
1839 }
1840
1841 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1842 {
1843         struct hci_cp_auth_requested *cp;
1844         struct hci_conn *conn;
1845
1846         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1847
1848         if (!status)
1849                 return;
1850
1851         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1852         if (!cp)
1853                 return;
1854
1855         hci_dev_lock(hdev);
1856
1857         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1858         if (conn) {
1859                 if (conn->state == BT_CONFIG) {
1860                         hci_connect_cfm(conn, status);
1861                         hci_conn_drop(conn);
1862                 }
1863         }
1864
1865         hci_dev_unlock(hdev);
1866 }
1867
1868 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1869 {
1870         struct hci_cp_set_conn_encrypt *cp;
1871         struct hci_conn *conn;
1872
1873         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1874
1875         if (!status)
1876                 return;
1877
1878         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1879         if (!cp)
1880                 return;
1881
1882         hci_dev_lock(hdev);
1883
1884         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1885         if (conn) {
1886                 if (conn->state == BT_CONFIG) {
1887                         hci_connect_cfm(conn, status);
1888                         hci_conn_drop(conn);
1889                 }
1890         }
1891
1892         hci_dev_unlock(hdev);
1893 }
1894
1895 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1896                                     struct hci_conn *conn)
1897 {
1898         if (conn->state != BT_CONFIG || !conn->out)
1899                 return 0;
1900
1901         if (conn->pending_sec_level == BT_SECURITY_SDP)
1902                 return 0;
1903
1904         /* Only request authentication for SSP connections or non-SSP
1905          * devices with sec_level MEDIUM or HIGH or if MITM protection
1906          * is requested.
1907          */
1908         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1909             conn->pending_sec_level != BT_SECURITY_FIPS &&
1910             conn->pending_sec_level != BT_SECURITY_HIGH &&
1911             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1912                 return 0;
1913
1914         return 1;
1915 }
1916
1917 static int hci_resolve_name(struct hci_dev *hdev,
1918                                    struct inquiry_entry *e)
1919 {
1920         struct hci_cp_remote_name_req cp;
1921
1922         memset(&cp, 0, sizeof(cp));
1923
1924         bacpy(&cp.bdaddr, &e->data.bdaddr);
1925         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1926         cp.pscan_mode = e->data.pscan_mode;
1927         cp.clock_offset = e->data.clock_offset;
1928
1929         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1930 }
1931
1932 static bool hci_resolve_next_name(struct hci_dev *hdev)
1933 {
1934         struct discovery_state *discov = &hdev->discovery;
1935         struct inquiry_entry *e;
1936
1937         if (list_empty(&discov->resolve))
1938                 return false;
1939
1940         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1941         if (!e)
1942                 return false;
1943
1944         if (hci_resolve_name(hdev, e) == 0) {
1945                 e->name_state = NAME_PENDING;
1946                 return true;
1947         }
1948
1949         return false;
1950 }
1951
1952 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1953                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1954 {
1955         struct discovery_state *discov = &hdev->discovery;
1956         struct inquiry_entry *e;
1957
1958 #ifdef TIZEN_BT
1959         /* Update the mgmt connected state if necessary. Be careful with
1960          * conn objects that exist but are not (yet) connected however.
1961          * Only those in BT_CONFIG or BT_CONNECTED states can be
1962          * considered connected.
1963          */
1964         if (conn &&
1965             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1966                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1967                         mgmt_device_connected(hdev, conn, 0, name, name_len);
1968                 else
1969                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
1970         }
1971 #else
1972         if (conn &&
1973             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
1974             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1975                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1976 #endif
1977
1978         if (discov->state == DISCOVERY_STOPPED)
1979                 return;
1980
1981         if (discov->state == DISCOVERY_STOPPING)
1982                 goto discov_complete;
1983
1984         if (discov->state != DISCOVERY_RESOLVING)
1985                 return;
1986
1987         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1988         /* If the device was not found in a list of found devices names of which
1989          * are pending. there is no need to continue resolving a next name as it
1990          * will be done upon receiving another Remote Name Request Complete
1991          * Event */
1992         if (!e)
1993                 return;
1994
1995         list_del(&e->list);
1996         if (name) {
1997                 e->name_state = NAME_KNOWN;
1998                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1999                                  e->data.rssi, name, name_len);
2000         } else {
2001                 e->name_state = NAME_NOT_KNOWN;
2002         }
2003
2004         if (hci_resolve_next_name(hdev))
2005                 return;
2006
2007 discov_complete:
2008         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2009 }
2010
2011 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2012 {
2013         struct hci_cp_remote_name_req *cp;
2014         struct hci_conn *conn;
2015
2016         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2017
2018         /* If successful wait for the name req complete event before
2019          * checking for the need to do authentication */
2020         if (!status)
2021                 return;
2022
2023         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2024         if (!cp)
2025                 return;
2026
2027         hci_dev_lock(hdev);
2028
2029         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2030
2031         if (hci_dev_test_flag(hdev, HCI_MGMT))
2032                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2033
2034         if (!conn)
2035                 goto unlock;
2036
2037         if (!hci_outgoing_auth_needed(hdev, conn))
2038                 goto unlock;
2039
2040         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2041                 struct hci_cp_auth_requested auth_cp;
2042
2043                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2044
2045                 auth_cp.handle = __cpu_to_le16(conn->handle);
2046                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2047                              sizeof(auth_cp), &auth_cp);
2048         }
2049
2050 unlock:
2051         hci_dev_unlock(hdev);
2052 }
2053
2054 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2055 {
2056         struct hci_cp_read_remote_features *cp;
2057         struct hci_conn *conn;
2058
2059         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2060
2061         if (!status)
2062                 return;
2063
2064         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2065         if (!cp)
2066                 return;
2067
2068         hci_dev_lock(hdev);
2069
2070         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2071         if (conn) {
2072                 if (conn->state == BT_CONFIG) {
2073                         hci_connect_cfm(conn, status);
2074                         hci_conn_drop(conn);
2075                 }
2076         }
2077
2078         hci_dev_unlock(hdev);
2079 }
2080
2081 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2082 {
2083         struct hci_cp_read_remote_ext_features *cp;
2084         struct hci_conn *conn;
2085
2086         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2087
2088         if (!status)
2089                 return;
2090
2091         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2092         if (!cp)
2093                 return;
2094
2095         hci_dev_lock(hdev);
2096
2097         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2098         if (conn) {
2099                 if (conn->state == BT_CONFIG) {
2100                         hci_connect_cfm(conn, status);
2101                         hci_conn_drop(conn);
2102                 }
2103         }
2104
2105         hci_dev_unlock(hdev);
2106 }
2107
2108 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2109 {
2110         struct hci_cp_setup_sync_conn *cp;
2111         struct hci_conn *acl, *sco;
2112         __u16 handle;
2113
2114         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2115
2116         if (!status)
2117                 return;
2118
2119         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2120         if (!cp)
2121                 return;
2122
2123         handle = __le16_to_cpu(cp->handle);
2124
2125         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2126
2127         hci_dev_lock(hdev);
2128
2129         acl = hci_conn_hash_lookup_handle(hdev, handle);
2130         if (acl) {
2131                 sco = acl->link;
2132                 if (sco) {
2133                         sco->state = BT_CLOSED;
2134
2135                         hci_connect_cfm(sco, status);
2136                         hci_conn_del(sco);
2137                 }
2138         }
2139
2140         hci_dev_unlock(hdev);
2141 }
2142
2143 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2144 {
2145         struct hci_cp_sniff_mode *cp;
2146         struct hci_conn *conn;
2147
2148         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2149
2150         if (!status)
2151                 return;
2152
2153         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2154         if (!cp)
2155                 return;
2156
2157         hci_dev_lock(hdev);
2158
2159         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2160         if (conn) {
2161                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2162
2163                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2164                         hci_sco_setup(conn, status);
2165         }
2166
2167         hci_dev_unlock(hdev);
2168 }
2169
2170 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2171 {
2172         struct hci_cp_exit_sniff_mode *cp;
2173         struct hci_conn *conn;
2174
2175         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2176
2177         if (!status)
2178                 return;
2179
2180         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2181         if (!cp)
2182                 return;
2183
2184         hci_dev_lock(hdev);
2185
2186         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2187         if (conn) {
2188                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2189
2190                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2191                         hci_sco_setup(conn, status);
2192         }
2193
2194         hci_dev_unlock(hdev);
2195 }
2196
2197 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2198 {
2199         struct hci_cp_disconnect *cp;
2200         struct hci_conn *conn;
2201
2202         if (!status)
2203                 return;
2204
2205         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2206         if (!cp)
2207                 return;
2208
2209         hci_dev_lock(hdev);
2210
2211         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2212         if (conn)
2213                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2214                                        conn->dst_type, status);
2215
2216         hci_dev_unlock(hdev);
2217 }
2218
2219 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2220                               u8 peer_addr_type, u8 own_address_type,
2221                               u8 filter_policy)
2222 {
2223         struct hci_conn *conn;
2224
2225         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2226                                        peer_addr_type);
2227         if (!conn)
2228                 return;
2229
2230         /* Store the initiator and responder address information which
2231          * is needed for SMP. These values will not change during the
2232          * lifetime of the connection.
2233          */
2234         conn->init_addr_type = own_address_type;
2235         if (own_address_type == ADDR_LE_DEV_RANDOM)
2236                 bacpy(&conn->init_addr, &hdev->random_addr);
2237         else
2238                 bacpy(&conn->init_addr, &hdev->bdaddr);
2239
2240         conn->resp_addr_type = peer_addr_type;
2241         bacpy(&conn->resp_addr, peer_addr);
2242
2243         /* We don't want the connection attempt to stick around
2244          * indefinitely since LE doesn't have a page timeout concept
2245          * like BR/EDR. Set a timer for any connection that doesn't use
2246          * the white list for connecting.
2247          */
2248         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2249                 queue_delayed_work(conn->hdev->workqueue,
2250                                    &conn->le_conn_timeout,
2251                                    conn->conn_timeout);
2252 }
2253
2254 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2255 {
2256         struct hci_cp_le_create_conn *cp;
2257
2258         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2259
2260         /* All connection failure handling is taken care of by the
2261          * hci_le_conn_failed function which is triggered by the HCI
2262          * request completion callbacks used for connecting.
2263          */
2264         if (status)
2265                 return;
2266
2267         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2268         if (!cp)
2269                 return;
2270
2271         hci_dev_lock(hdev);
2272
2273         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2274                           cp->own_address_type, cp->filter_policy);
2275
2276         hci_dev_unlock(hdev);
2277 }
2278
2279 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2280 {
2281         struct hci_cp_le_ext_create_conn *cp;
2282
2283         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2284
2285         /* All connection failure handling is taken care of by the
2286          * hci_le_conn_failed function which is triggered by the HCI
2287          * request completion callbacks used for connecting.
2288          */
2289         if (status)
2290                 return;
2291
2292         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2293         if (!cp)
2294                 return;
2295
2296         hci_dev_lock(hdev);
2297
2298         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2299                           cp->own_addr_type, cp->filter_policy);
2300
2301         hci_dev_unlock(hdev);
2302 }
2303
2304 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2305 {
2306         struct hci_cp_le_read_remote_features *cp;
2307         struct hci_conn *conn;
2308
2309         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2310
2311         if (!status)
2312                 return;
2313
2314         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2315         if (!cp)
2316                 return;
2317
2318         hci_dev_lock(hdev);
2319
2320         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2321         if (conn) {
2322                 if (conn->state == BT_CONFIG) {
2323                         hci_connect_cfm(conn, status);
2324                         hci_conn_drop(conn);
2325                 }
2326         }
2327
2328         hci_dev_unlock(hdev);
2329 }
2330
2331 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2332 {
2333         struct hci_cp_le_start_enc *cp;
2334         struct hci_conn *conn;
2335
2336         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2337
2338         if (!status)
2339                 return;
2340
2341         hci_dev_lock(hdev);
2342
2343         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2344         if (!cp)
2345                 goto unlock;
2346
2347         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2348         if (!conn)
2349                 goto unlock;
2350
2351         if (conn->state != BT_CONNECTED)
2352                 goto unlock;
2353
2354         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2355         hci_conn_drop(conn);
2356
2357 unlock:
2358         hci_dev_unlock(hdev);
2359 }
2360
2361 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2362 {
2363         struct hci_cp_switch_role *cp;
2364         struct hci_conn *conn;
2365
2366         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2367
2368         if (!status)
2369                 return;
2370
2371         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2372         if (!cp)
2373                 return;
2374
2375         hci_dev_lock(hdev);
2376
2377         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2378         if (conn)
2379                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2380
2381         hci_dev_unlock(hdev);
2382 }
2383
2384 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2385 {
2386         __u8 status = *((__u8 *) skb->data);
2387         struct discovery_state *discov = &hdev->discovery;
2388         struct inquiry_entry *e;
2389
2390         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2391
2392         hci_conn_check_pending(hdev);
2393
2394         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2395                 return;
2396
2397         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2398         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2399
2400         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2401                 return;
2402
2403         hci_dev_lock(hdev);
2404
2405         if (discov->state != DISCOVERY_FINDING)
2406                 goto unlock;
2407
2408         if (list_empty(&discov->resolve)) {
2409                 /* When BR/EDR inquiry is active and no LE scanning is in
2410                  * progress, then change discovery state to indicate completion.
2411                  *
2412                  * When running LE scanning and BR/EDR inquiry simultaneously
2413                  * and the LE scan already finished, then change the discovery
2414                  * state to indicate completion.
2415                  */
2416                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2417                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2418                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2419                 goto unlock;
2420         }
2421
2422         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2423         if (e && hci_resolve_name(hdev, e) == 0) {
2424                 e->name_state = NAME_PENDING;
2425                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2426         } else {
2427                 /* When BR/EDR inquiry is active and no LE scanning is in
2428                  * progress, then change discovery state to indicate completion.
2429                  *
2430                  * When running LE scanning and BR/EDR inquiry simultaneously
2431                  * and the LE scan already finished, then change the discovery
2432                  * state to indicate completion.
2433                  */
2434                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2435                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2436                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2437         }
2438
2439 unlock:
2440         hci_dev_unlock(hdev);
2441 }
2442
2443 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2444 {
2445         struct inquiry_data data;
2446         struct inquiry_info *info = (void *) (skb->data + 1);
2447         int num_rsp = *((__u8 *) skb->data);
2448
2449         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2450
2451         if (!num_rsp)
2452                 return;
2453
2454         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2455                 return;
2456
2457         hci_dev_lock(hdev);
2458
2459         for (; num_rsp; num_rsp--, info++) {
2460                 u32 flags;
2461
2462                 bacpy(&data.bdaddr, &info->bdaddr);
2463                 data.pscan_rep_mode     = info->pscan_rep_mode;
2464                 data.pscan_period_mode  = info->pscan_period_mode;
2465                 data.pscan_mode         = info->pscan_mode;
2466                 memcpy(data.dev_class, info->dev_class, 3);
2467                 data.clock_offset       = info->clock_offset;
2468                 data.rssi               = HCI_RSSI_INVALID;
2469                 data.ssp_mode           = 0x00;
2470
2471                 flags = hci_inquiry_cache_update(hdev, &data, false);
2472
2473                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2474                                   info->dev_class, HCI_RSSI_INVALID,
2475                                   flags, NULL, 0, NULL, 0);
2476         }
2477
2478         hci_dev_unlock(hdev);
2479 }
2480
2481 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2482 {
2483         struct hci_ev_conn_complete *ev = (void *) skb->data;
2484         struct hci_conn *conn;
2485
2486         BT_DBG("%s", hdev->name);
2487
2488         hci_dev_lock(hdev);
2489
2490         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2491         if (!conn) {
2492                 if (ev->link_type != SCO_LINK)
2493                         goto unlock;
2494
2495                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2496                 if (!conn)
2497                         goto unlock;
2498
2499                 conn->type = SCO_LINK;
2500         }
2501
2502         if (!ev->status) {
2503                 conn->handle = __le16_to_cpu(ev->handle);
2504
2505                 if (conn->type == ACL_LINK) {
2506                         conn->state = BT_CONFIG;
2507                         hci_conn_hold(conn);
2508
2509                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2510                             !hci_find_link_key(hdev, &ev->bdaddr))
2511                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2512                         else
2513                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2514                 } else
2515                         conn->state = BT_CONNECTED;
2516
2517                 hci_debugfs_create_conn(conn);
2518                 hci_conn_add_sysfs(conn);
2519
2520                 if (test_bit(HCI_AUTH, &hdev->flags))
2521                         set_bit(HCI_CONN_AUTH, &conn->flags);
2522
2523                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2524                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2525
2526                 /* Get remote features */
2527                 if (conn->type == ACL_LINK) {
2528                         struct hci_cp_read_remote_features cp;
2529                         cp.handle = ev->handle;
2530                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2531                                      sizeof(cp), &cp);
2532
2533                         hci_req_update_scan(hdev);
2534                 }
2535
2536                 /* Set packet type for incoming connection */
2537                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2538                         struct hci_cp_change_conn_ptype cp;
2539                         cp.handle = ev->handle;
2540                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2541                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2542                                      &cp);
2543                 }
2544         } else {
2545                 conn->state = BT_CLOSED;
2546                 if (conn->type == ACL_LINK)
2547                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2548                                             conn->dst_type, ev->status);
2549         }
2550
2551         if (conn->type == ACL_LINK)
2552                 hci_sco_setup(conn, ev->status);
2553
2554         if (ev->status) {
2555                 hci_connect_cfm(conn, ev->status);
2556                 hci_conn_del(conn);
2557         } else if (ev->link_type != ACL_LINK)
2558                 hci_connect_cfm(conn, ev->status);
2559
2560 unlock:
2561         hci_dev_unlock(hdev);
2562
2563         hci_conn_check_pending(hdev);
2564 }
2565
2566 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2567 {
2568         struct hci_cp_reject_conn_req cp;
2569
2570         bacpy(&cp.bdaddr, bdaddr);
2571         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2572         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2573 }
2574
2575 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2576 {
2577         struct hci_ev_conn_request *ev = (void *) skb->data;
2578         int mask = hdev->link_mode;
2579         struct inquiry_entry *ie;
2580         struct hci_conn *conn;
2581         __u8 flags = 0;
2582
2583         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2584                ev->link_type);
2585
2586         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2587                                       &flags);
2588
2589         if (!(mask & HCI_LM_ACCEPT)) {
2590                 hci_reject_conn(hdev, &ev->bdaddr);
2591                 return;
2592         }
2593
2594         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2595                                    BDADDR_BREDR)) {
2596                 hci_reject_conn(hdev, &ev->bdaddr);
2597                 return;
2598         }
2599
2600         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2601          * connection. These features are only touched through mgmt so
2602          * only do the checks if HCI_MGMT is set.
2603          */
2604         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2605             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2606             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2607                                     BDADDR_BREDR)) {
2608                     hci_reject_conn(hdev, &ev->bdaddr);
2609                     return;
2610         }
2611
2612         /* Connection accepted */
2613
2614         hci_dev_lock(hdev);
2615
2616         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2617         if (ie)
2618                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2619
2620         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2621                         &ev->bdaddr);
2622         if (!conn) {
2623                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2624                                     HCI_ROLE_SLAVE);
2625                 if (!conn) {
2626                         bt_dev_err(hdev, "no memory for new connection");
2627                         hci_dev_unlock(hdev);
2628                         return;
2629                 }
2630         }
2631
2632         memcpy(conn->dev_class, ev->dev_class, 3);
2633
2634         hci_dev_unlock(hdev);
2635
2636         if (ev->link_type == ACL_LINK ||
2637             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2638                 struct hci_cp_accept_conn_req cp;
2639                 conn->state = BT_CONNECT;
2640
2641                 bacpy(&cp.bdaddr, &ev->bdaddr);
2642
2643                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2644                         cp.role = 0x00; /* Become master */
2645                 else
2646                         cp.role = 0x01; /* Remain slave */
2647
2648                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2649         } else if (!(flags & HCI_PROTO_DEFER)) {
2650                 struct hci_cp_accept_sync_conn_req cp;
2651                 conn->state = BT_CONNECT;
2652
2653                 bacpy(&cp.bdaddr, &ev->bdaddr);
2654                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2655
2656                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2657                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2658                 cp.max_latency    = cpu_to_le16(0xffff);
2659                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2660                 cp.retrans_effort = 0xff;
2661
2662                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2663                              &cp);
2664         } else {
2665                 conn->state = BT_CONNECT2;
2666                 hci_connect_cfm(conn, 0);
2667         }
2668 }
2669
2670 static u8 hci_to_mgmt_reason(u8 err)
2671 {
2672         switch (err) {
2673         case HCI_ERROR_CONNECTION_TIMEOUT:
2674                 return MGMT_DEV_DISCONN_TIMEOUT;
2675         case HCI_ERROR_REMOTE_USER_TERM:
2676         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2677         case HCI_ERROR_REMOTE_POWER_OFF:
2678                 return MGMT_DEV_DISCONN_REMOTE;
2679         case HCI_ERROR_LOCAL_HOST_TERM:
2680                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2681         default:
2682                 return MGMT_DEV_DISCONN_UNKNOWN;
2683         }
2684 }
2685
2686 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2687 {
2688         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2689         u8 reason;
2690         struct hci_conn_params *params;
2691         struct hci_conn *conn;
2692         bool mgmt_connected;
2693         u8 type;
2694
2695         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2696
2697         hci_dev_lock(hdev);
2698
2699         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2700         if (!conn)
2701                 goto unlock;
2702
2703         if (ev->status) {
2704                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2705                                        conn->dst_type, ev->status);
2706                 goto unlock;
2707         }
2708
2709         conn->state = BT_CLOSED;
2710
2711         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2712
2713         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2714                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2715         else
2716                 reason = hci_to_mgmt_reason(ev->reason);
2717
2718         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2719                                 reason, mgmt_connected);
2720
2721         if (conn->type == ACL_LINK) {
2722                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2723                         hci_remove_link_key(hdev, &conn->dst);
2724
2725                 hci_req_update_scan(hdev);
2726         }
2727
2728         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2729         if (params) {
2730                 switch (params->auto_connect) {
2731                 case HCI_AUTO_CONN_LINK_LOSS:
2732                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2733                                 break;
2734                         /* Fall through */
2735
2736                 case HCI_AUTO_CONN_DIRECT:
2737                 case HCI_AUTO_CONN_ALWAYS:
2738                         list_del_init(&params->action);
2739                         list_add(&params->action, &hdev->pend_le_conns);
2740                         hci_update_background_scan(hdev);
2741                         break;
2742
2743                 default:
2744                         break;
2745                 }
2746         }
2747
2748         type = conn->type;
2749
2750         hci_disconn_cfm(conn, ev->reason);
2751         hci_conn_del(conn);
2752
2753         /* Re-enable advertising if necessary, since it might
2754          * have been disabled by the connection. From the
2755          * HCI_LE_Set_Advertise_Enable command description in
2756          * the core specification (v4.0):
2757          * "The Controller shall continue advertising until the Host
2758          * issues an LE_Set_Advertise_Enable command with
2759          * Advertising_Enable set to 0x00 (Advertising is disabled)
2760          * or until a connection is created or until the Advertising
2761          * is timed out due to Directed Advertising."
2762          */
2763         if (type == LE_LINK)
2764                 hci_req_reenable_advertising(hdev);
2765
2766 unlock:
2767         hci_dev_unlock(hdev);
2768 }
2769
2770 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2771 {
2772         struct hci_ev_auth_complete *ev = (void *) skb->data;
2773         struct hci_conn *conn;
2774
2775         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2776
2777         hci_dev_lock(hdev);
2778
2779         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2780         if (!conn)
2781                 goto unlock;
2782
2783         if (!ev->status) {
2784                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2785
2786                 if (!hci_conn_ssp_enabled(conn) &&
2787                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2788                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2789                 } else {
2790                         set_bit(HCI_CONN_AUTH, &conn->flags);
2791                         conn->sec_level = conn->pending_sec_level;
2792                 }
2793         } else {
2794                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2795                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2796
2797                 mgmt_auth_failed(conn, ev->status);
2798         }
2799
2800         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2801         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2802
2803         if (conn->state == BT_CONFIG) {
2804                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2805                         struct hci_cp_set_conn_encrypt cp;
2806                         cp.handle  = ev->handle;
2807                         cp.encrypt = 0x01;
2808                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2809                                      &cp);
2810                 } else {
2811                         conn->state = BT_CONNECTED;
2812                         hci_connect_cfm(conn, ev->status);
2813                         hci_conn_drop(conn);
2814                 }
2815         } else {
2816                 hci_auth_cfm(conn, ev->status);
2817
2818                 hci_conn_hold(conn);
2819                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2820                 hci_conn_drop(conn);
2821         }
2822
2823         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2824                 if (!ev->status) {
2825                         struct hci_cp_set_conn_encrypt cp;
2826                         cp.handle  = ev->handle;
2827                         cp.encrypt = 0x01;
2828                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2829                                      &cp);
2830                 } else {
2831                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2832                         hci_encrypt_cfm(conn, ev->status, 0x00);
2833                 }
2834         }
2835
2836 unlock:
2837         hci_dev_unlock(hdev);
2838 }
2839
2840 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2841 {
2842         struct hci_ev_remote_name *ev = (void *) skb->data;
2843         struct hci_conn *conn;
2844
2845         BT_DBG("%s", hdev->name);
2846
2847         hci_conn_check_pending(hdev);
2848
2849         hci_dev_lock(hdev);
2850
2851         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2852
2853         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2854                 goto check_auth;
2855
2856         if (ev->status == 0)
2857                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2858                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2859         else
2860                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2861
2862 check_auth:
2863         if (!conn)
2864                 goto unlock;
2865
2866         if (!hci_outgoing_auth_needed(hdev, conn))
2867                 goto unlock;
2868
2869         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2870                 struct hci_cp_auth_requested cp;
2871
2872                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2873
2874                 cp.handle = __cpu_to_le16(conn->handle);
2875                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2876         }
2877
2878 unlock:
2879         hci_dev_unlock(hdev);
2880 }
2881
2882 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2883                                        u16 opcode, struct sk_buff *skb)
2884 {
2885         const struct hci_rp_read_enc_key_size *rp;
2886         struct hci_conn *conn;
2887         u16 handle;
2888
2889         BT_DBG("%s status 0x%02x", hdev->name, status);
2890
2891         if (!skb || skb->len < sizeof(*rp)) {
2892                 bt_dev_err(hdev, "invalid read key size response");
2893                 return;
2894         }
2895
2896         rp = (void *)skb->data;
2897         handle = le16_to_cpu(rp->handle);
2898
2899         hci_dev_lock(hdev);
2900
2901         conn = hci_conn_hash_lookup_handle(hdev, handle);
2902         if (!conn)
2903                 goto unlock;
2904
2905         /* If we fail to read the encryption key size, assume maximum
2906          * (which is the same we do also when this HCI command isn't
2907          * supported.
2908          */
2909         if (rp->status) {
2910                 bt_dev_err(hdev, "failed to read key size for handle %u",
2911                            handle);
2912                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2913         } else {
2914                 conn->enc_key_size = rp->key_size;
2915         }
2916
2917         if (conn->state == BT_CONFIG) {
2918                 conn->state = BT_CONNECTED;
2919                 hci_connect_cfm(conn, 0);
2920                 hci_conn_drop(conn);
2921         } else {
2922                 u8 encrypt;
2923
2924                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2925                         encrypt = 0x00;
2926                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2927                         encrypt = 0x02;
2928                 else
2929                         encrypt = 0x01;
2930
2931                 hci_encrypt_cfm(conn, 0, encrypt);
2932         }
2933
2934 unlock:
2935         hci_dev_unlock(hdev);
2936 }
2937
2938 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2939 {
2940         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2941         struct hci_conn *conn;
2942
2943         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2944
2945         hci_dev_lock(hdev);
2946
2947         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2948         if (!conn)
2949                 goto unlock;
2950
2951         if (!ev->status) {
2952                 if (ev->encrypt) {
2953                         /* Encryption implies authentication */
2954                         set_bit(HCI_CONN_AUTH, &conn->flags);
2955                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2956                         conn->sec_level = conn->pending_sec_level;
2957
2958                         /* P-256 authentication key implies FIPS */
2959                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2960                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2961
2962                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2963                             conn->type == LE_LINK)
2964                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2965                 } else {
2966                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2967                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2968                 }
2969         }
2970
2971         /* We should disregard the current RPA and generate a new one
2972          * whenever the encryption procedure fails.
2973          */
2974         if (ev->status && conn->type == LE_LINK) {
2975                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2976                 hci_adv_instances_set_rpa_expired(hdev, true);
2977         }
2978
2979         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2980
2981         if (ev->status && conn->state == BT_CONNECTED) {
2982                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2983                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2984
2985                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2986                 hci_conn_drop(conn);
2987                 goto unlock;
2988         }
2989
2990         /* In Secure Connections Only mode, do not allow any connections
2991          * that are not encrypted with AES-CCM using a P-256 authenticated
2992          * combination key.
2993          */
2994         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
2995             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2996              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2997                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2998                 hci_conn_drop(conn);
2999                 goto unlock;
3000         }
3001
3002         /* Try reading the encryption key size for encrypted ACL links */
3003         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3004                 struct hci_cp_read_enc_key_size cp;
3005                 struct hci_request req;
3006
3007                 /* Only send HCI_Read_Encryption_Key_Size if the
3008                  * controller really supports it. If it doesn't, assume
3009                  * the default size (16).
3010                  */
3011                 if (!(hdev->commands[20] & 0x10)) {
3012                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3013                         goto notify;
3014                 }
3015
3016                 hci_req_init(&req, hdev);
3017
3018                 cp.handle = cpu_to_le16(conn->handle);
3019                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3020
3021                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3022                         bt_dev_err(hdev, "sending read key size failed");
3023                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3024                         goto notify;
3025                 }
3026
3027                 goto unlock;
3028         }
3029
3030 notify:
3031         if (conn->state == BT_CONFIG) {
3032                 if (!ev->status)
3033                         conn->state = BT_CONNECTED;
3034
3035                 hci_connect_cfm(conn, ev->status);
3036                 hci_conn_drop(conn);
3037         } else
3038                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
3039
3040 unlock:
3041         hci_dev_unlock(hdev);
3042 }
3043
3044 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3045                                              struct sk_buff *skb)
3046 {
3047         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3048         struct hci_conn *conn;
3049
3050         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3051
3052         hci_dev_lock(hdev);
3053
3054         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3055         if (conn) {
3056                 if (!ev->status)
3057                         set_bit(HCI_CONN_SECURE, &conn->flags);
3058
3059                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3060
3061                 hci_key_change_cfm(conn, ev->status);
3062         }
3063
3064         hci_dev_unlock(hdev);
3065 }
3066
3067 static void hci_remote_features_evt(struct hci_dev *hdev,
3068                                     struct sk_buff *skb)
3069 {
3070         struct hci_ev_remote_features *ev = (void *) skb->data;
3071         struct hci_conn *conn;
3072
3073         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3074
3075         hci_dev_lock(hdev);
3076
3077         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3078         if (!conn)
3079                 goto unlock;
3080
3081         if (!ev->status)
3082                 memcpy(conn->features[0], ev->features, 8);
3083
3084         if (conn->state != BT_CONFIG)
3085                 goto unlock;
3086
3087         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3088             lmp_ext_feat_capable(conn)) {
3089                 struct hci_cp_read_remote_ext_features cp;
3090                 cp.handle = ev->handle;
3091                 cp.page = 0x01;
3092                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3093                              sizeof(cp), &cp);
3094                 goto unlock;
3095         }
3096
3097         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3098                 struct hci_cp_remote_name_req cp;
3099                 memset(&cp, 0, sizeof(cp));
3100                 bacpy(&cp.bdaddr, &conn->dst);
3101                 cp.pscan_rep_mode = 0x02;
3102                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3103         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3104                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3105
3106         if (!hci_outgoing_auth_needed(hdev, conn)) {
3107                 conn->state = BT_CONNECTED;
3108                 hci_connect_cfm(conn, ev->status);
3109                 hci_conn_drop(conn);
3110         }
3111
3112 unlock:
3113         hci_dev_unlock(hdev);
3114 }
3115
3116 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3117                                  u16 *opcode, u8 *status,
3118                                  hci_req_complete_t *req_complete,
3119                                  hci_req_complete_skb_t *req_complete_skb)
3120 {
3121         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3122
3123         *opcode = __le16_to_cpu(ev->opcode);
3124         *status = skb->data[sizeof(*ev)];
3125
3126         skb_pull(skb, sizeof(*ev));
3127
3128         switch (*opcode) {
3129         case HCI_OP_INQUIRY_CANCEL:
3130                 hci_cc_inquiry_cancel(hdev, skb);
3131                 break;
3132
3133         case HCI_OP_PERIODIC_INQ:
3134                 hci_cc_periodic_inq(hdev, skb);
3135                 break;
3136
3137         case HCI_OP_EXIT_PERIODIC_INQ:
3138                 hci_cc_exit_periodic_inq(hdev, skb);
3139                 break;
3140
3141         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3142                 hci_cc_remote_name_req_cancel(hdev, skb);
3143                 break;
3144
3145         case HCI_OP_ROLE_DISCOVERY:
3146                 hci_cc_role_discovery(hdev, skb);
3147                 break;
3148
3149         case HCI_OP_READ_LINK_POLICY:
3150                 hci_cc_read_link_policy(hdev, skb);
3151                 break;
3152
3153         case HCI_OP_WRITE_LINK_POLICY:
3154                 hci_cc_write_link_policy(hdev, skb);
3155                 break;
3156
3157         case HCI_OP_READ_DEF_LINK_POLICY:
3158                 hci_cc_read_def_link_policy(hdev, skb);
3159                 break;
3160
3161         case HCI_OP_WRITE_DEF_LINK_POLICY:
3162                 hci_cc_write_def_link_policy(hdev, skb);
3163                 break;
3164
3165         case HCI_OP_RESET:
3166                 hci_cc_reset(hdev, skb);
3167                 break;
3168
3169         case HCI_OP_READ_STORED_LINK_KEY:
3170                 hci_cc_read_stored_link_key(hdev, skb);
3171                 break;
3172
3173         case HCI_OP_DELETE_STORED_LINK_KEY:
3174                 hci_cc_delete_stored_link_key(hdev, skb);
3175                 break;
3176
3177         case HCI_OP_WRITE_LOCAL_NAME:
3178                 hci_cc_write_local_name(hdev, skb);
3179                 break;
3180
3181         case HCI_OP_READ_LOCAL_NAME:
3182                 hci_cc_read_local_name(hdev, skb);
3183                 break;
3184
3185         case HCI_OP_WRITE_AUTH_ENABLE:
3186                 hci_cc_write_auth_enable(hdev, skb);
3187                 break;
3188
3189         case HCI_OP_WRITE_ENCRYPT_MODE:
3190                 hci_cc_write_encrypt_mode(hdev, skb);
3191                 break;
3192
3193         case HCI_OP_WRITE_SCAN_ENABLE:
3194                 hci_cc_write_scan_enable(hdev, skb);
3195                 break;
3196
3197         case HCI_OP_READ_CLASS_OF_DEV:
3198                 hci_cc_read_class_of_dev(hdev, skb);
3199                 break;
3200
3201         case HCI_OP_WRITE_CLASS_OF_DEV:
3202                 hci_cc_write_class_of_dev(hdev, skb);
3203                 break;
3204
3205         case HCI_OP_READ_VOICE_SETTING:
3206                 hci_cc_read_voice_setting(hdev, skb);
3207                 break;
3208
3209         case HCI_OP_WRITE_VOICE_SETTING:
3210                 hci_cc_write_voice_setting(hdev, skb);
3211                 break;
3212
3213         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3214                 hci_cc_read_num_supported_iac(hdev, skb);
3215                 break;
3216
3217         case HCI_OP_WRITE_SSP_MODE:
3218                 hci_cc_write_ssp_mode(hdev, skb);
3219                 break;
3220
3221         case HCI_OP_WRITE_SC_SUPPORT:
3222                 hci_cc_write_sc_support(hdev, skb);
3223                 break;
3224
3225         case HCI_OP_READ_LOCAL_VERSION:
3226                 hci_cc_read_local_version(hdev, skb);
3227                 break;
3228
3229         case HCI_OP_READ_LOCAL_COMMANDS:
3230                 hci_cc_read_local_commands(hdev, skb);
3231                 break;
3232
3233         case HCI_OP_READ_LOCAL_FEATURES:
3234                 hci_cc_read_local_features(hdev, skb);
3235                 break;
3236
3237         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3238                 hci_cc_read_local_ext_features(hdev, skb);
3239                 break;
3240
3241         case HCI_OP_READ_BUFFER_SIZE:
3242                 hci_cc_read_buffer_size(hdev, skb);
3243                 break;
3244
3245         case HCI_OP_READ_BD_ADDR:
3246                 hci_cc_read_bd_addr(hdev, skb);
3247                 break;
3248
3249         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3250                 hci_cc_read_page_scan_activity(hdev, skb);
3251                 break;
3252
3253         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3254                 hci_cc_write_page_scan_activity(hdev, skb);
3255                 break;
3256
3257         case HCI_OP_READ_PAGE_SCAN_TYPE:
3258                 hci_cc_read_page_scan_type(hdev, skb);
3259                 break;
3260
3261         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3262                 hci_cc_write_page_scan_type(hdev, skb);
3263                 break;
3264
3265         case HCI_OP_READ_DATA_BLOCK_SIZE:
3266                 hci_cc_read_data_block_size(hdev, skb);
3267                 break;
3268
3269         case HCI_OP_READ_FLOW_CONTROL_MODE:
3270                 hci_cc_read_flow_control_mode(hdev, skb);
3271                 break;
3272
3273         case HCI_OP_READ_LOCAL_AMP_INFO:
3274                 hci_cc_read_local_amp_info(hdev, skb);
3275                 break;
3276
3277         case HCI_OP_READ_CLOCK:
3278                 hci_cc_read_clock(hdev, skb);
3279                 break;
3280
3281         case HCI_OP_READ_INQ_RSP_TX_POWER:
3282                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3283                 break;
3284
3285         case HCI_OP_PIN_CODE_REPLY:
3286                 hci_cc_pin_code_reply(hdev, skb);
3287                 break;
3288
3289         case HCI_OP_PIN_CODE_NEG_REPLY:
3290                 hci_cc_pin_code_neg_reply(hdev, skb);
3291                 break;
3292
3293         case HCI_OP_READ_LOCAL_OOB_DATA:
3294                 hci_cc_read_local_oob_data(hdev, skb);
3295                 break;
3296
3297         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3298                 hci_cc_read_local_oob_ext_data(hdev, skb);
3299                 break;
3300
3301         case HCI_OP_LE_READ_BUFFER_SIZE:
3302                 hci_cc_le_read_buffer_size(hdev, skb);
3303                 break;
3304
3305         case HCI_OP_LE_READ_LOCAL_FEATURES:
3306                 hci_cc_le_read_local_features(hdev, skb);
3307                 break;
3308
3309         case HCI_OP_LE_READ_ADV_TX_POWER:
3310                 hci_cc_le_read_adv_tx_power(hdev, skb);
3311                 break;
3312
3313         case HCI_OP_USER_CONFIRM_REPLY:
3314                 hci_cc_user_confirm_reply(hdev, skb);
3315                 break;
3316
3317         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3318                 hci_cc_user_confirm_neg_reply(hdev, skb);
3319                 break;
3320
3321         case HCI_OP_USER_PASSKEY_REPLY:
3322                 hci_cc_user_passkey_reply(hdev, skb);
3323                 break;
3324
3325         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3326                 hci_cc_user_passkey_neg_reply(hdev, skb);
3327                 break;
3328
3329         case HCI_OP_LE_SET_RANDOM_ADDR:
3330                 hci_cc_le_set_random_addr(hdev, skb);
3331                 break;
3332
3333         case HCI_OP_LE_SET_ADV_ENABLE:
3334                 hci_cc_le_set_adv_enable(hdev, skb);
3335                 break;
3336
3337         case HCI_OP_LE_SET_SCAN_PARAM:
3338                 hci_cc_le_set_scan_param(hdev, skb);
3339                 break;
3340
3341         case HCI_OP_LE_SET_SCAN_ENABLE:
3342                 hci_cc_le_set_scan_enable(hdev, skb);
3343                 break;
3344
3345         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3346                 hci_cc_le_read_white_list_size(hdev, skb);
3347                 break;
3348
3349         case HCI_OP_LE_CLEAR_WHITE_LIST:
3350                 hci_cc_le_clear_white_list(hdev, skb);
3351                 break;
3352
3353         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3354                 hci_cc_le_add_to_white_list(hdev, skb);
3355                 break;
3356
3357         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3358                 hci_cc_le_del_from_white_list(hdev, skb);
3359                 break;
3360
3361         case HCI_OP_LE_READ_SUPPORTED_STATES:
3362                 hci_cc_le_read_supported_states(hdev, skb);
3363                 break;
3364
3365         case HCI_OP_LE_READ_DEF_DATA_LEN:
3366                 hci_cc_le_read_def_data_len(hdev, skb);
3367                 break;
3368
3369         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3370                 hci_cc_le_write_def_data_len(hdev, skb);
3371                 break;
3372
3373         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3374                 hci_cc_le_clear_resolv_list(hdev, skb);
3375                 break;
3376
3377         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3378                 hci_cc_le_read_resolv_list_size(hdev, skb);
3379                 break;
3380
3381         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3382                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3383                 break;
3384
3385         case HCI_OP_LE_READ_MAX_DATA_LEN:
3386                 hci_cc_le_read_max_data_len(hdev, skb);
3387                 break;
3388
3389         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3390                 hci_cc_write_le_host_supported(hdev, skb);
3391                 break;
3392
3393         case HCI_OP_LE_SET_ADV_PARAM:
3394                 hci_cc_set_adv_param(hdev, skb);
3395                 break;
3396
3397         case HCI_OP_READ_RSSI:
3398                 hci_cc_read_rssi(hdev, skb);
3399                 break;
3400
3401         case HCI_OP_READ_TX_POWER:
3402                 hci_cc_read_tx_power(hdev, skb);
3403                 break;
3404
3405         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3406                 hci_cc_write_ssp_debug_mode(hdev, skb);
3407                 break;
3408
3409         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3410                 hci_cc_le_set_ext_scan_param(hdev, skb);
3411                 break;
3412
3413         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3414                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3415                 break;
3416
3417         case HCI_OP_LE_SET_DEFAULT_PHY:
3418                 hci_cc_le_set_default_phy(hdev, skb);
3419                 break;
3420
3421         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3422                 hci_cc_le_read_num_adv_sets(hdev, skb);
3423                 break;
3424
3425         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3426                 hci_cc_set_ext_adv_param(hdev, skb);
3427                 break;
3428
3429         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3430                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3431                 break;
3432
3433         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3434                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3435                 break;
3436 #ifdef TIZEN_BT
3437         case HCI_OP_ENABLE_RSSI:
3438                 hci_cc_enable_rssi(hdev, skb);
3439                 break;
3440
3441         case HCI_OP_GET_RAW_RSSI:
3442                 hci_cc_get_raw_rssi(hdev, skb);
3443                 break;
3444 #endif
3445         default:
3446                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3447                 break;
3448         }
3449
3450         if (*opcode != HCI_OP_NOP)
3451                 cancel_delayed_work(&hdev->cmd_timer);
3452
3453         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3454                 atomic_set(&hdev->cmd_cnt, 1);
3455
3456         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3457                              req_complete_skb);
3458
3459         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3460                 bt_dev_err(hdev,
3461                            "unexpected event for opcode 0x%4.4x", *opcode);
3462                 return;
3463         }
3464
3465         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3466                 queue_work(hdev->workqueue, &hdev->cmd_work);
3467 }
3468
3469 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3470                                u16 *opcode, u8 *status,
3471                                hci_req_complete_t *req_complete,
3472                                hci_req_complete_skb_t *req_complete_skb)
3473 {
3474         struct hci_ev_cmd_status *ev = (void *) skb->data;
3475
3476         skb_pull(skb, sizeof(*ev));
3477
3478         *opcode = __le16_to_cpu(ev->opcode);
3479         *status = ev->status;
3480
3481         switch (*opcode) {
3482         case HCI_OP_INQUIRY:
3483                 hci_cs_inquiry(hdev, ev->status);
3484                 break;
3485
3486         case HCI_OP_CREATE_CONN:
3487                 hci_cs_create_conn(hdev, ev->status);
3488                 break;
3489
3490         case HCI_OP_DISCONNECT:
3491                 hci_cs_disconnect(hdev, ev->status);
3492                 break;
3493
3494         case HCI_OP_ADD_SCO:
3495                 hci_cs_add_sco(hdev, ev->status);
3496                 break;
3497
3498         case HCI_OP_AUTH_REQUESTED:
3499                 hci_cs_auth_requested(hdev, ev->status);
3500                 break;
3501
3502         case HCI_OP_SET_CONN_ENCRYPT:
3503                 hci_cs_set_conn_encrypt(hdev, ev->status);
3504                 break;
3505
3506         case HCI_OP_REMOTE_NAME_REQ:
3507                 hci_cs_remote_name_req(hdev, ev->status);
3508                 break;
3509
3510         case HCI_OP_READ_REMOTE_FEATURES:
3511                 hci_cs_read_remote_features(hdev, ev->status);
3512                 break;
3513
3514         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3515                 hci_cs_read_remote_ext_features(hdev, ev->status);
3516                 break;
3517
3518         case HCI_OP_SETUP_SYNC_CONN:
3519                 hci_cs_setup_sync_conn(hdev, ev->status);
3520                 break;
3521
3522         case HCI_OP_SNIFF_MODE:
3523                 hci_cs_sniff_mode(hdev, ev->status);
3524                 break;
3525
3526         case HCI_OP_EXIT_SNIFF_MODE:
3527                 hci_cs_exit_sniff_mode(hdev, ev->status);
3528                 break;
3529
3530         case HCI_OP_SWITCH_ROLE:
3531                 hci_cs_switch_role(hdev, ev->status);
3532                 break;
3533
3534         case HCI_OP_LE_CREATE_CONN:
3535                 hci_cs_le_create_conn(hdev, ev->status);
3536                 break;
3537
3538         case HCI_OP_LE_READ_REMOTE_FEATURES:
3539                 hci_cs_le_read_remote_features(hdev, ev->status);
3540                 break;
3541
3542         case HCI_OP_LE_START_ENC:
3543                 hci_cs_le_start_enc(hdev, ev->status);
3544                 break;
3545
3546         case HCI_OP_LE_EXT_CREATE_CONN:
3547                 hci_cs_le_ext_create_conn(hdev, ev->status);
3548                 break;
3549
3550         default:
3551                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3552                 break;
3553         }
3554
3555         if (*opcode != HCI_OP_NOP)
3556                 cancel_delayed_work(&hdev->cmd_timer);
3557
3558         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3559                 atomic_set(&hdev->cmd_cnt, 1);
3560
3561         /* Indicate request completion if the command failed. Also, if
3562          * we're not waiting for a special event and we get a success
3563          * command status we should try to flag the request as completed
3564          * (since for this kind of commands there will not be a command
3565          * complete event).
3566          */
3567         if (ev->status ||
3568             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3569                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3570                                      req_complete_skb);
3571
3572         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3573                 bt_dev_err(hdev,
3574                            "unexpected event for opcode 0x%4.4x", *opcode);
3575                 return;
3576         }
3577
3578         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3579                 queue_work(hdev->workqueue, &hdev->cmd_work);
3580 }
3581
3582 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3583 {
3584         struct hci_ev_hardware_error *ev = (void *) skb->data;
3585
3586 #ifdef TIZEN_BT
3587         hci_dev_lock(hdev);
3588         mgmt_hardware_error(hdev, ev->code);
3589         hci_dev_unlock(hdev);
3590 #endif
3591         hdev->hw_error_code = ev->code;
3592
3593         queue_work(hdev->req_workqueue, &hdev->error_reset);
3594 }
3595
3596 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3597 {
3598         struct hci_ev_role_change *ev = (void *) skb->data;
3599         struct hci_conn *conn;
3600
3601         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3602
3603         hci_dev_lock(hdev);
3604
3605         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3606         if (conn) {
3607                 if (!ev->status)
3608                         conn->role = ev->role;
3609
3610                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3611
3612                 hci_role_switch_cfm(conn, ev->status, ev->role);
3613         }
3614
3615         hci_dev_unlock(hdev);
3616 }
3617
3618 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3619 {
3620         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3621         int i;
3622
3623         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3624                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3625                 return;
3626         }
3627
3628         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3629             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3630                 BT_DBG("%s bad parameters", hdev->name);
3631                 return;
3632         }
3633
3634         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3635
3636         for (i = 0; i < ev->num_hndl; i++) {
3637                 struct hci_comp_pkts_info *info = &ev->handles[i];
3638                 struct hci_conn *conn;
3639                 __u16  handle, count;
3640
3641                 handle = __le16_to_cpu(info->handle);
3642                 count  = __le16_to_cpu(info->count);
3643
3644                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3645                 if (!conn)
3646                         continue;
3647
3648                 conn->sent -= count;
3649
3650                 switch (conn->type) {
3651                 case ACL_LINK:
3652                         hdev->acl_cnt += count;
3653                         if (hdev->acl_cnt > hdev->acl_pkts)
3654                                 hdev->acl_cnt = hdev->acl_pkts;
3655                         break;
3656
3657                 case LE_LINK:
3658                         if (hdev->le_pkts) {
3659                                 hdev->le_cnt += count;
3660                                 if (hdev->le_cnt > hdev->le_pkts)
3661                                         hdev->le_cnt = hdev->le_pkts;
3662                         } else {
3663                                 hdev->acl_cnt += count;
3664                                 if (hdev->acl_cnt > hdev->acl_pkts)
3665                                         hdev->acl_cnt = hdev->acl_pkts;
3666                         }
3667                         break;
3668
3669                 case SCO_LINK:
3670                         hdev->sco_cnt += count;
3671                         if (hdev->sco_cnt > hdev->sco_pkts)
3672                                 hdev->sco_cnt = hdev->sco_pkts;
3673                         break;
3674
3675                 default:
3676                         bt_dev_err(hdev, "unknown type %d conn %p",
3677                                    conn->type, conn);
3678                         break;
3679                 }
3680         }
3681
3682         queue_work(hdev->workqueue, &hdev->tx_work);
3683 }
3684
3685 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3686                                                  __u16 handle)
3687 {
3688         struct hci_chan *chan;
3689
3690         switch (hdev->dev_type) {
3691         case HCI_PRIMARY:
3692                 return hci_conn_hash_lookup_handle(hdev, handle);
3693         case HCI_AMP:
3694                 chan = hci_chan_lookup_handle(hdev, handle);
3695                 if (chan)
3696                         return chan->conn;
3697                 break;
3698         default:
3699                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3700                 break;
3701         }
3702
3703         return NULL;
3704 }
3705
3706 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3707 {
3708         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3709         int i;
3710
3711         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3712                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3713                 return;
3714         }
3715
3716         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3717             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3718                 BT_DBG("%s bad parameters", hdev->name);
3719                 return;
3720         }
3721
3722         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3723                ev->num_hndl);
3724
3725         for (i = 0; i < ev->num_hndl; i++) {
3726                 struct hci_comp_blocks_info *info = &ev->handles[i];
3727                 struct hci_conn *conn = NULL;
3728                 __u16  handle, block_count;
3729
3730                 handle = __le16_to_cpu(info->handle);
3731                 block_count = __le16_to_cpu(info->blocks);
3732
3733                 conn = __hci_conn_lookup_handle(hdev, handle);
3734                 if (!conn)
3735                         continue;
3736
3737                 conn->sent -= block_count;
3738
3739                 switch (conn->type) {
3740                 case ACL_LINK:
3741                 case AMP_LINK:
3742                         hdev->block_cnt += block_count;
3743                         if (hdev->block_cnt > hdev->num_blocks)
3744                                 hdev->block_cnt = hdev->num_blocks;
3745                         break;
3746
3747                 default:
3748                         bt_dev_err(hdev, "unknown type %d conn %p",
3749                                    conn->type, conn);
3750                         break;
3751                 }
3752         }
3753
3754         queue_work(hdev->workqueue, &hdev->tx_work);
3755 }
3756
3757 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3758 {
3759         struct hci_ev_mode_change *ev = (void *) skb->data;
3760         struct hci_conn *conn;
3761
3762         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3763
3764         hci_dev_lock(hdev);
3765
3766         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3767         if (conn) {
3768                 conn->mode = ev->mode;
3769
3770                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3771                                         &conn->flags)) {
3772                         if (conn->mode == HCI_CM_ACTIVE)
3773                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3774                         else
3775                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3776                 }
3777
3778                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3779                         hci_sco_setup(conn, ev->status);
3780         }
3781
3782         hci_dev_unlock(hdev);
3783 }
3784
3785 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3786 {
3787         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3788         struct hci_conn *conn;
3789
3790         BT_DBG("%s", hdev->name);
3791
3792         hci_dev_lock(hdev);
3793
3794         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3795         if (!conn)
3796                 goto unlock;
3797
3798         if (conn->state == BT_CONNECTED) {
3799                 hci_conn_hold(conn);
3800                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3801                 hci_conn_drop(conn);
3802         }
3803
3804         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3805             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3806                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3807                              sizeof(ev->bdaddr), &ev->bdaddr);
3808         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3809                 u8 secure;
3810
3811                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3812                         secure = 1;
3813                 else
3814                         secure = 0;
3815
3816                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3817         }
3818
3819 unlock:
3820         hci_dev_unlock(hdev);
3821 }
3822
3823 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3824 {
3825         if (key_type == HCI_LK_CHANGED_COMBINATION)
3826                 return;
3827
3828         conn->pin_length = pin_len;
3829         conn->key_type = key_type;
3830
3831         switch (key_type) {
3832         case HCI_LK_LOCAL_UNIT:
3833         case HCI_LK_REMOTE_UNIT:
3834         case HCI_LK_DEBUG_COMBINATION:
3835                 return;
3836         case HCI_LK_COMBINATION:
3837                 if (pin_len == 16)
3838                         conn->pending_sec_level = BT_SECURITY_HIGH;
3839                 else
3840                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3841                 break;
3842         case HCI_LK_UNAUTH_COMBINATION_P192:
3843         case HCI_LK_UNAUTH_COMBINATION_P256:
3844                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3845                 break;
3846         case HCI_LK_AUTH_COMBINATION_P192:
3847                 conn->pending_sec_level = BT_SECURITY_HIGH;
3848                 break;
3849         case HCI_LK_AUTH_COMBINATION_P256:
3850                 conn->pending_sec_level = BT_SECURITY_FIPS;
3851                 break;
3852         }
3853 }
3854
3855 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3856 {
3857         struct hci_ev_link_key_req *ev = (void *) skb->data;
3858         struct hci_cp_link_key_reply cp;
3859         struct hci_conn *conn;
3860         struct link_key *key;
3861
3862         BT_DBG("%s", hdev->name);
3863
3864         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3865                 return;
3866
3867         hci_dev_lock(hdev);
3868
3869         key = hci_find_link_key(hdev, &ev->bdaddr);
3870         if (!key) {
3871                 BT_DBG("%s link key not found for %pMR", hdev->name,
3872                        &ev->bdaddr);
3873                 goto not_found;
3874         }
3875
3876         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3877                &ev->bdaddr);
3878
3879         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3880         if (conn) {
3881                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3882
3883                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3884                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3885                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3886                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3887                         goto not_found;
3888                 }
3889
3890                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3891                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3892                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3893                         BT_DBG("%s ignoring key unauthenticated for high security",
3894                                hdev->name);
3895                         goto not_found;
3896                 }
3897
3898                 conn_set_key(conn, key->type, key->pin_len);
3899         }
3900
3901         bacpy(&cp.bdaddr, &ev->bdaddr);
3902         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3903
3904         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3905
3906         hci_dev_unlock(hdev);
3907
3908         return;
3909
3910 not_found:
3911         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3912         hci_dev_unlock(hdev);
3913 }
3914
3915 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3916 {
3917         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3918         struct hci_conn *conn;
3919         struct link_key *key;
3920         bool persistent;
3921         u8 pin_len = 0;
3922
3923         BT_DBG("%s", hdev->name);
3924
3925         hci_dev_lock(hdev);
3926
3927         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3928         if (!conn)
3929                 goto unlock;
3930
3931         hci_conn_hold(conn);
3932         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3933         hci_conn_drop(conn);
3934
3935         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3936         conn_set_key(conn, ev->key_type, conn->pin_length);
3937
3938         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3939                 goto unlock;
3940
3941         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3942                                 ev->key_type, pin_len, &persistent);
3943         if (!key)
3944                 goto unlock;
3945
3946         /* Update connection information since adding the key will have
3947          * fixed up the type in the case of changed combination keys.
3948          */
3949         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3950                 conn_set_key(conn, key->type, key->pin_len);
3951
3952         mgmt_new_link_key(hdev, key, persistent);
3953
3954         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3955          * is set. If it's not set simply remove the key from the kernel
3956          * list (we've still notified user space about it but with
3957          * store_hint being 0).
3958          */
3959         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3960             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
3961                 list_del_rcu(&key->list);
3962                 kfree_rcu(key, rcu);
3963                 goto unlock;
3964         }
3965
3966         if (persistent)
3967                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3968         else
3969                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3970
3971 unlock:
3972         hci_dev_unlock(hdev);
3973 }
3974
3975 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3976 {
3977         struct hci_ev_clock_offset *ev = (void *) skb->data;
3978         struct hci_conn *conn;
3979
3980         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3981
3982         hci_dev_lock(hdev);
3983
3984         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3985         if (conn && !ev->status) {
3986                 struct inquiry_entry *ie;
3987
3988                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3989                 if (ie) {
3990                         ie->data.clock_offset = ev->clock_offset;
3991                         ie->timestamp = jiffies;
3992                 }
3993         }
3994
3995         hci_dev_unlock(hdev);
3996 }
3997
3998 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3999 {
4000         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4001         struct hci_conn *conn;
4002
4003         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4004
4005         hci_dev_lock(hdev);
4006
4007         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4008         if (conn && !ev->status)
4009                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4010
4011         hci_dev_unlock(hdev);
4012 }
4013
4014 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4015 {
4016         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4017         struct inquiry_entry *ie;
4018
4019         BT_DBG("%s", hdev->name);
4020
4021         hci_dev_lock(hdev);
4022
4023         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4024         if (ie) {
4025                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4026                 ie->timestamp = jiffies;
4027         }
4028
4029         hci_dev_unlock(hdev);
4030 }
4031
4032 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4033                                              struct sk_buff *skb)
4034 {
4035         struct inquiry_data data;
4036         int num_rsp = *((__u8 *) skb->data);
4037
4038         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4039
4040         if (!num_rsp)
4041                 return;
4042
4043         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4044                 return;
4045
4046         hci_dev_lock(hdev);
4047
4048         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4049                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4050                 info = (void *) (skb->data + 1);
4051
4052                 for (; num_rsp; num_rsp--, info++) {
4053                         u32 flags;
4054
4055                         bacpy(&data.bdaddr, &info->bdaddr);
4056                         data.pscan_rep_mode     = info->pscan_rep_mode;
4057                         data.pscan_period_mode  = info->pscan_period_mode;
4058                         data.pscan_mode         = info->pscan_mode;
4059                         memcpy(data.dev_class, info->dev_class, 3);
4060                         data.clock_offset       = info->clock_offset;
4061                         data.rssi               = info->rssi;
4062                         data.ssp_mode           = 0x00;
4063
4064                         flags = hci_inquiry_cache_update(hdev, &data, false);
4065
4066                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4067                                           info->dev_class, info->rssi,
4068                                           flags, NULL, 0, NULL, 0);
4069                 }
4070         } else {
4071                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4072
4073                 for (; num_rsp; num_rsp--, info++) {
4074                         u32 flags;
4075
4076                         bacpy(&data.bdaddr, &info->bdaddr);
4077                         data.pscan_rep_mode     = info->pscan_rep_mode;
4078                         data.pscan_period_mode  = info->pscan_period_mode;
4079                         data.pscan_mode         = 0x00;
4080                         memcpy(data.dev_class, info->dev_class, 3);
4081                         data.clock_offset       = info->clock_offset;
4082                         data.rssi               = info->rssi;
4083                         data.ssp_mode           = 0x00;
4084
4085                         flags = hci_inquiry_cache_update(hdev, &data, false);
4086
4087                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4088                                           info->dev_class, info->rssi,
4089                                           flags, NULL, 0, NULL, 0);
4090                 }
4091         }
4092
4093         hci_dev_unlock(hdev);
4094 }
4095
4096 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4097                                         struct sk_buff *skb)
4098 {
4099         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4100         struct hci_conn *conn;
4101
4102         BT_DBG("%s", hdev->name);
4103
4104         hci_dev_lock(hdev);
4105
4106         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4107         if (!conn)
4108                 goto unlock;
4109
4110         if (ev->page < HCI_MAX_PAGES)
4111                 memcpy(conn->features[ev->page], ev->features, 8);
4112
4113         if (!ev->status && ev->page == 0x01) {
4114                 struct inquiry_entry *ie;
4115
4116                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4117                 if (ie)
4118                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4119
4120                 if (ev->features[0] & LMP_HOST_SSP) {
4121                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4122                 } else {
4123                         /* It is mandatory by the Bluetooth specification that
4124                          * Extended Inquiry Results are only used when Secure
4125                          * Simple Pairing is enabled, but some devices violate
4126                          * this.
4127                          *
4128                          * To make these devices work, the internal SSP
4129                          * enabled flag needs to be cleared if the remote host
4130                          * features do not indicate SSP support */
4131                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4132                 }
4133
4134                 if (ev->features[0] & LMP_HOST_SC)
4135                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4136         }
4137
4138         if (conn->state != BT_CONFIG)
4139                 goto unlock;
4140
4141         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4142                 struct hci_cp_remote_name_req cp;
4143                 memset(&cp, 0, sizeof(cp));
4144                 bacpy(&cp.bdaddr, &conn->dst);
4145                 cp.pscan_rep_mode = 0x02;
4146                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4147         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4148                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4149
4150         if (!hci_outgoing_auth_needed(hdev, conn)) {
4151                 conn->state = BT_CONNECTED;
4152                 hci_connect_cfm(conn, ev->status);
4153                 hci_conn_drop(conn);
4154         }
4155
4156 unlock:
4157         hci_dev_unlock(hdev);
4158 }
4159
4160 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4161                                        struct sk_buff *skb)
4162 {
4163         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4164         struct hci_conn *conn;
4165
4166         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4167
4168         hci_dev_lock(hdev);
4169
4170         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4171         if (!conn) {
4172                 if (ev->link_type == ESCO_LINK)
4173                         goto unlock;
4174
4175                 /* When the link type in the event indicates SCO connection
4176                  * and lookup of the connection object fails, then check
4177                  * if an eSCO connection object exists.
4178                  *
4179                  * The core limits the synchronous connections to either
4180                  * SCO or eSCO. The eSCO connection is preferred and tried
4181                  * to be setup first and until successfully established,
4182                  * the link type will be hinted as eSCO.
4183                  */
4184                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4185                 if (!conn)
4186                         goto unlock;
4187         }
4188
4189         switch (ev->status) {
4190         case 0x00:
4191                 conn->handle = __le16_to_cpu(ev->handle);
4192                 conn->state  = BT_CONNECTED;
4193                 conn->type   = ev->link_type;
4194
4195                 hci_debugfs_create_conn(conn);
4196                 hci_conn_add_sysfs(conn);
4197                 break;
4198
4199         case 0x10:      /* Connection Accept Timeout */
4200         case 0x0d:      /* Connection Rejected due to Limited Resources */
4201         case 0x11:      /* Unsupported Feature or Parameter Value */
4202         case 0x1c:      /* SCO interval rejected */
4203         case 0x1a:      /* Unsupported Remote Feature */
4204         case 0x1f:      /* Unspecified error */
4205         case 0x20:      /* Unsupported LMP Parameter value */
4206                 if (conn->out) {
4207                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4208                                         (hdev->esco_type & EDR_ESCO_MASK);
4209                         if (hci_setup_sync(conn, conn->link->handle))
4210                                 goto unlock;
4211                 }
4212                 /* fall through */
4213
4214         default:
4215                 conn->state = BT_CLOSED;
4216                 break;
4217         }
4218
4219         hci_connect_cfm(conn, ev->status);
4220         if (ev->status)
4221                 hci_conn_del(conn);
4222
4223 unlock:
4224         hci_dev_unlock(hdev);
4225 }
4226
4227 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4228 {
4229         size_t parsed = 0;
4230
4231         while (parsed < eir_len) {
4232                 u8 field_len = eir[0];
4233
4234                 if (field_len == 0)
4235                         return parsed;
4236
4237                 parsed += field_len + 1;
4238                 eir += field_len + 1;
4239         }
4240
4241         return eir_len;
4242 }
4243
4244 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4245                                             struct sk_buff *skb)
4246 {
4247         struct inquiry_data data;
4248         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4249         int num_rsp = *((__u8 *) skb->data);
4250         size_t eir_len;
4251
4252         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4253
4254         if (!num_rsp)
4255                 return;
4256
4257         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4258                 return;
4259
4260         hci_dev_lock(hdev);
4261
4262         for (; num_rsp; num_rsp--, info++) {
4263                 u32 flags;
4264                 bool name_known;
4265
4266                 bacpy(&data.bdaddr, &info->bdaddr);
4267                 data.pscan_rep_mode     = info->pscan_rep_mode;
4268                 data.pscan_period_mode  = info->pscan_period_mode;
4269                 data.pscan_mode         = 0x00;
4270                 memcpy(data.dev_class, info->dev_class, 3);
4271                 data.clock_offset       = info->clock_offset;
4272                 data.rssi               = info->rssi;
4273                 data.ssp_mode           = 0x01;
4274
4275                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4276                         name_known = eir_get_data(info->data,
4277                                                   sizeof(info->data),
4278                                                   EIR_NAME_COMPLETE, NULL);
4279                 else
4280                         name_known = true;
4281
4282                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4283
4284                 eir_len = eir_get_length(info->data, sizeof(info->data));
4285
4286                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4287                                   info->dev_class, info->rssi,
4288                                   flags, info->data, eir_len, NULL, 0);
4289         }
4290
4291         hci_dev_unlock(hdev);
4292 }
4293
4294 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4295                                          struct sk_buff *skb)
4296 {
4297         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4298         struct hci_conn *conn;
4299
4300         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4301                __le16_to_cpu(ev->handle));
4302
4303         hci_dev_lock(hdev);
4304
4305         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4306         if (!conn)
4307                 goto unlock;
4308
4309         /* For BR/EDR the necessary steps are taken through the
4310          * auth_complete event.
4311          */
4312         if (conn->type != LE_LINK)
4313                 goto unlock;
4314
4315         if (!ev->status)
4316                 conn->sec_level = conn->pending_sec_level;
4317
4318         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4319
4320         if (ev->status && conn->state == BT_CONNECTED) {
4321                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4322                 hci_conn_drop(conn);
4323                 goto unlock;
4324         }
4325
4326         if (conn->state == BT_CONFIG) {
4327                 if (!ev->status)
4328                         conn->state = BT_CONNECTED;
4329
4330                 hci_connect_cfm(conn, ev->status);
4331                 hci_conn_drop(conn);
4332         } else {
4333                 hci_auth_cfm(conn, ev->status);
4334
4335                 hci_conn_hold(conn);
4336                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4337                 hci_conn_drop(conn);
4338         }
4339
4340 unlock:
4341         hci_dev_unlock(hdev);
4342 }
4343
4344 static u8 hci_get_auth_req(struct hci_conn *conn)
4345 {
4346         /* If remote requests no-bonding follow that lead */
4347         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4348             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4349                 return conn->remote_auth | (conn->auth_type & 0x01);
4350
4351         /* If both remote and local have enough IO capabilities, require
4352          * MITM protection
4353          */
4354         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4355             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4356                 return conn->remote_auth | 0x01;
4357
4358         /* No MITM protection possible so ignore remote requirement */
4359         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4360 }
4361
4362 static u8 bredr_oob_data_present(struct hci_conn *conn)
4363 {
4364         struct hci_dev *hdev = conn->hdev;
4365         struct oob_data *data;
4366
4367         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4368         if (!data)
4369                 return 0x00;
4370
4371         if (bredr_sc_enabled(hdev)) {
4372                 /* When Secure Connections is enabled, then just
4373                  * return the present value stored with the OOB
4374                  * data. The stored value contains the right present
4375                  * information. However it can only be trusted when
4376                  * not in Secure Connection Only mode.
4377                  */
4378                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4379                         return data->present;
4380
4381                 /* When Secure Connections Only mode is enabled, then
4382                  * the P-256 values are required. If they are not
4383                  * available, then do not declare that OOB data is
4384                  * present.
4385                  */
4386                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4387                     !memcmp(data->hash256, ZERO_KEY, 16))
4388                         return 0x00;
4389
4390                 return 0x02;
4391         }
4392
4393         /* When Secure Connections is not enabled or actually
4394          * not supported by the hardware, then check that if
4395          * P-192 data values are present.
4396          */
4397         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4398             !memcmp(data->hash192, ZERO_KEY, 16))
4399                 return 0x00;
4400
4401         return 0x01;
4402 }
4403
4404 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4405 {
4406         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4407         struct hci_conn *conn;
4408
4409         BT_DBG("%s", hdev->name);
4410
4411         hci_dev_lock(hdev);
4412
4413         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4414         if (!conn)
4415                 goto unlock;
4416
4417         hci_conn_hold(conn);
4418
4419         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4420                 goto unlock;
4421
4422         /* Allow pairing if we're pairable, the initiators of the
4423          * pairing or if the remote is not requesting bonding.
4424          */
4425         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4426             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4427             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4428                 struct hci_cp_io_capability_reply cp;
4429
4430                 bacpy(&cp.bdaddr, &ev->bdaddr);
4431                 /* Change the IO capability from KeyboardDisplay
4432                  * to DisplayYesNo as it is not supported by BT spec. */
4433                 cp.capability = (conn->io_capability == 0x04) ?
4434                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4435
4436                 /* If we are initiators, there is no remote information yet */
4437                 if (conn->remote_auth == 0xff) {
4438                         /* Request MITM protection if our IO caps allow it
4439                          * except for the no-bonding case.
4440                          */
4441                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4442                             conn->auth_type != HCI_AT_NO_BONDING)
4443                                 conn->auth_type |= 0x01;
4444                 } else {
4445                         conn->auth_type = hci_get_auth_req(conn);
4446                 }
4447
4448                 /* If we're not bondable, force one of the non-bondable
4449                  * authentication requirement values.
4450                  */
4451                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4452                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4453
4454                 cp.authentication = conn->auth_type;
4455                 cp.oob_data = bredr_oob_data_present(conn);
4456
4457                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4458                              sizeof(cp), &cp);
4459         } else {
4460                 struct hci_cp_io_capability_neg_reply cp;
4461
4462                 bacpy(&cp.bdaddr, &ev->bdaddr);
4463                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4464
4465                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4466                              sizeof(cp), &cp);
4467         }
4468
4469 unlock:
4470         hci_dev_unlock(hdev);
4471 }
4472
4473 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4474 {
4475         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4476         struct hci_conn *conn;
4477
4478         BT_DBG("%s", hdev->name);
4479
4480         hci_dev_lock(hdev);
4481
4482         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4483         if (!conn)
4484                 goto unlock;
4485
4486         conn->remote_cap = ev->capability;
4487         conn->remote_auth = ev->authentication;
4488
4489 unlock:
4490         hci_dev_unlock(hdev);
4491 }
4492
4493 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4494                                          struct sk_buff *skb)
4495 {
4496         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4497         int loc_mitm, rem_mitm, confirm_hint = 0;
4498         struct hci_conn *conn;
4499
4500         BT_DBG("%s", hdev->name);
4501
4502         hci_dev_lock(hdev);
4503
4504         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4505                 goto unlock;
4506
4507         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4508         if (!conn)
4509                 goto unlock;
4510
4511         loc_mitm = (conn->auth_type & 0x01);
4512         rem_mitm = (conn->remote_auth & 0x01);
4513
4514         /* If we require MITM but the remote device can't provide that
4515          * (it has NoInputNoOutput) then reject the confirmation
4516          * request. We check the security level here since it doesn't
4517          * necessarily match conn->auth_type.
4518          */
4519         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4520             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4521                 BT_DBG("Rejecting request: remote device can't provide MITM");
4522                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4523                              sizeof(ev->bdaddr), &ev->bdaddr);
4524                 goto unlock;
4525         }
4526
4527         /* If no side requires MITM protection; auto-accept */
4528         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4529             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4530
4531                 /* If we're not the initiators request authorization to
4532                  * proceed from user space (mgmt_user_confirm with
4533                  * confirm_hint set to 1). The exception is if neither
4534                  * side had MITM or if the local IO capability is
4535                  * NoInputNoOutput, in which case we do auto-accept
4536                  */
4537                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4538                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4539                     (loc_mitm || rem_mitm)) {
4540                         BT_DBG("Confirming auto-accept as acceptor");
4541                         confirm_hint = 1;
4542                         goto confirm;
4543                 }
4544
4545                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4546                        hdev->auto_accept_delay);
4547
4548                 if (hdev->auto_accept_delay > 0) {
4549                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4550                         queue_delayed_work(conn->hdev->workqueue,
4551                                            &conn->auto_accept_work, delay);
4552                         goto unlock;
4553                 }
4554
4555                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4556                              sizeof(ev->bdaddr), &ev->bdaddr);
4557                 goto unlock;
4558         }
4559
4560 confirm:
4561         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4562                                   le32_to_cpu(ev->passkey), confirm_hint);
4563
4564 unlock:
4565         hci_dev_unlock(hdev);
4566 }
4567
4568 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4569                                          struct sk_buff *skb)
4570 {
4571         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4572
4573         BT_DBG("%s", hdev->name);
4574
4575         if (hci_dev_test_flag(hdev, HCI_MGMT))
4576                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4577 }
4578
4579 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4580                                         struct sk_buff *skb)
4581 {
4582         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4583         struct hci_conn *conn;
4584
4585         BT_DBG("%s", hdev->name);
4586
4587         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4588         if (!conn)
4589                 return;
4590
4591         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4592         conn->passkey_entered = 0;
4593
4594         if (hci_dev_test_flag(hdev, HCI_MGMT))
4595                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4596                                          conn->dst_type, conn->passkey_notify,
4597                                          conn->passkey_entered);
4598 }
4599
4600 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4601 {
4602         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4603         struct hci_conn *conn;
4604
4605         BT_DBG("%s", hdev->name);
4606
4607         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4608         if (!conn)
4609                 return;
4610
4611         switch (ev->type) {
4612         case HCI_KEYPRESS_STARTED:
4613                 conn->passkey_entered = 0;
4614                 return;
4615
4616         case HCI_KEYPRESS_ENTERED:
4617                 conn->passkey_entered++;
4618                 break;
4619
4620         case HCI_KEYPRESS_ERASED:
4621                 conn->passkey_entered--;
4622                 break;
4623
4624         case HCI_KEYPRESS_CLEARED:
4625                 conn->passkey_entered = 0;
4626                 break;
4627
4628         case HCI_KEYPRESS_COMPLETED:
4629                 return;
4630         }
4631
4632         if (hci_dev_test_flag(hdev, HCI_MGMT))
4633                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4634                                          conn->dst_type, conn->passkey_notify,
4635                                          conn->passkey_entered);
4636 }
4637
4638 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4639                                          struct sk_buff *skb)
4640 {
4641         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4642         struct hci_conn *conn;
4643
4644         BT_DBG("%s", hdev->name);
4645
4646         hci_dev_lock(hdev);
4647
4648         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4649         if (!conn)
4650                 goto unlock;
4651
4652         /* Reset the authentication requirement to unknown */
4653         conn->remote_auth = 0xff;
4654
4655         /* To avoid duplicate auth_failed events to user space we check
4656          * the HCI_CONN_AUTH_PEND flag which will be set if we
4657          * initiated the authentication. A traditional auth_complete
4658          * event gets always produced as initiator and is also mapped to
4659          * the mgmt_auth_failed event */
4660         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4661                 mgmt_auth_failed(conn, ev->status);
4662
4663         hci_conn_drop(conn);
4664
4665 unlock:
4666         hci_dev_unlock(hdev);
4667 }
4668
4669 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4670                                          struct sk_buff *skb)
4671 {
4672         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4673         struct inquiry_entry *ie;
4674         struct hci_conn *conn;
4675
4676         BT_DBG("%s", hdev->name);
4677
4678         hci_dev_lock(hdev);
4679
4680         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4681         if (conn)
4682                 memcpy(conn->features[1], ev->features, 8);
4683
4684         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4685         if (ie)
4686                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4687
4688         hci_dev_unlock(hdev);
4689 }
4690
4691 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4692                                             struct sk_buff *skb)
4693 {
4694         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4695         struct oob_data *data;
4696
4697         BT_DBG("%s", hdev->name);
4698
4699         hci_dev_lock(hdev);
4700
4701         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4702                 goto unlock;
4703
4704         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4705         if (!data) {
4706                 struct hci_cp_remote_oob_data_neg_reply cp;
4707
4708                 bacpy(&cp.bdaddr, &ev->bdaddr);
4709                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4710                              sizeof(cp), &cp);
4711                 goto unlock;
4712         }
4713
4714         if (bredr_sc_enabled(hdev)) {
4715                 struct hci_cp_remote_oob_ext_data_reply cp;
4716
4717                 bacpy(&cp.bdaddr, &ev->bdaddr);
4718                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4719                         memset(cp.hash192, 0, sizeof(cp.hash192));
4720                         memset(cp.rand192, 0, sizeof(cp.rand192));
4721                 } else {
4722                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4723                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4724                 }
4725                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4726                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4727
4728                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4729                              sizeof(cp), &cp);
4730         } else {
4731                 struct hci_cp_remote_oob_data_reply cp;
4732
4733                 bacpy(&cp.bdaddr, &ev->bdaddr);
4734                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4735                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4736
4737                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4738                              sizeof(cp), &cp);
4739         }
4740
4741 unlock:
4742         hci_dev_unlock(hdev);
4743 }
4744
4745 #if IS_ENABLED(CONFIG_BT_HS)
4746 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4747 {
4748         struct hci_ev_channel_selected *ev = (void *)skb->data;
4749         struct hci_conn *hcon;
4750
4751         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4752
4753         skb_pull(skb, sizeof(*ev));
4754
4755         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4756         if (!hcon)
4757                 return;
4758
4759         amp_read_loc_assoc_final_data(hdev, hcon);
4760 }
4761
4762 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4763                                       struct sk_buff *skb)
4764 {
4765         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4766         struct hci_conn *hcon, *bredr_hcon;
4767
4768         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4769                ev->status);
4770
4771         hci_dev_lock(hdev);
4772
4773         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4774         if (!hcon) {
4775                 hci_dev_unlock(hdev);
4776                 return;
4777         }
4778
4779         if (ev->status) {
4780                 hci_conn_del(hcon);
4781                 hci_dev_unlock(hdev);
4782                 return;
4783         }
4784
4785         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4786
4787         hcon->state = BT_CONNECTED;
4788         bacpy(&hcon->dst, &bredr_hcon->dst);
4789
4790         hci_conn_hold(hcon);
4791         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4792         hci_conn_drop(hcon);
4793
4794         hci_debugfs_create_conn(hcon);
4795         hci_conn_add_sysfs(hcon);
4796
4797         amp_physical_cfm(bredr_hcon, hcon);
4798
4799         hci_dev_unlock(hdev);
4800 }
4801
4802 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4803 {
4804         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4805         struct hci_conn *hcon;
4806         struct hci_chan *hchan;
4807         struct amp_mgr *mgr;
4808
4809         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4810                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4811                ev->status);
4812
4813         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4814         if (!hcon)
4815                 return;
4816
4817         /* Create AMP hchan */
4818         hchan = hci_chan_create(hcon);
4819         if (!hchan)
4820                 return;
4821
4822         hchan->handle = le16_to_cpu(ev->handle);
4823
4824         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4825
4826         mgr = hcon->amp_mgr;
4827         if (mgr && mgr->bredr_chan) {
4828                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4829
4830                 l2cap_chan_lock(bredr_chan);
4831
4832                 bredr_chan->conn->mtu = hdev->block_mtu;
4833                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4834                 hci_conn_hold(hcon);
4835
4836                 l2cap_chan_unlock(bredr_chan);
4837         }
4838 }
4839
4840 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4841                                              struct sk_buff *skb)
4842 {
4843         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4844         struct hci_chan *hchan;
4845
4846         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4847                le16_to_cpu(ev->handle), ev->status);
4848
4849         if (ev->status)
4850                 return;
4851
4852         hci_dev_lock(hdev);
4853
4854         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4855         if (!hchan)
4856                 goto unlock;
4857
4858         amp_destroy_logical_link(hchan, ev->reason);
4859
4860 unlock:
4861         hci_dev_unlock(hdev);
4862 }
4863
4864 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4865                                              struct sk_buff *skb)
4866 {
4867         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4868         struct hci_conn *hcon;
4869
4870         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4871
4872         if (ev->status)
4873                 return;
4874
4875         hci_dev_lock(hdev);
4876
4877         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4878         if (hcon) {
4879                 hcon->state = BT_CLOSED;
4880                 hci_conn_del(hcon);
4881         }
4882
4883         hci_dev_unlock(hdev);
4884 }
4885 #endif
4886
4887 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4888                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4889                         u16 interval, u16 latency, u16 supervision_timeout)
4890 {
4891         struct hci_conn_params *params;
4892         struct hci_conn *conn;
4893         struct smp_irk *irk;
4894         u8 addr_type;
4895
4896         hci_dev_lock(hdev);
4897
4898         /* All controllers implicitly stop advertising in the event of a
4899          * connection, so ensure that the state bit is cleared.
4900          */
4901         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4902
4903         conn = hci_lookup_le_connect(hdev);
4904         if (!conn) {
4905                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4906                 if (!conn) {
4907                         bt_dev_err(hdev, "no memory for new connection");
4908                         goto unlock;
4909                 }
4910
4911                 conn->dst_type = bdaddr_type;
4912
4913                 /* If we didn't have a hci_conn object previously
4914                  * but we're in master role this must be something
4915                  * initiated using a white list. Since white list based
4916                  * connections are not "first class citizens" we don't
4917                  * have full tracking of them. Therefore, we go ahead
4918                  * with a "best effort" approach of determining the
4919                  * initiator address based on the HCI_PRIVACY flag.
4920                  */
4921                 if (conn->out) {
4922                         conn->resp_addr_type = bdaddr_type;
4923                         bacpy(&conn->resp_addr, bdaddr);
4924                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4925                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4926                                 bacpy(&conn->init_addr, &hdev->rpa);
4927                         } else {
4928                                 hci_copy_identity_address(hdev,
4929                                                           &conn->init_addr,
4930                                                           &conn->init_addr_type);
4931                         }
4932                 }
4933         } else {
4934                 cancel_delayed_work(&conn->le_conn_timeout);
4935         }
4936
4937         if (!conn->out) {
4938                 /* Set the responder (our side) address type based on
4939                  * the advertising address type.
4940                  */
4941                 conn->resp_addr_type = hdev->adv_addr_type;
4942                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
4943                         /* In case of ext adv, resp_addr will be updated in
4944                          * Adv Terminated event.
4945                          */
4946                         if (!ext_adv_capable(hdev))
4947                                 bacpy(&conn->resp_addr, &hdev->random_addr);
4948                 } else {
4949                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4950                 }
4951
4952                 conn->init_addr_type = bdaddr_type;
4953                 bacpy(&conn->init_addr, bdaddr);
4954
4955                 /* For incoming connections, set the default minimum
4956                  * and maximum connection interval. They will be used
4957                  * to check if the parameters are in range and if not
4958                  * trigger the connection update procedure.
4959                  */
4960                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4961                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4962         }
4963
4964         /* Lookup the identity address from the stored connection
4965          * address and address type.
4966          *
4967          * When establishing connections to an identity address, the
4968          * connection procedure will store the resolvable random
4969          * address first. Now if it can be converted back into the
4970          * identity address, start using the identity address from
4971          * now on.
4972          */
4973         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4974         if (irk) {
4975                 bacpy(&conn->dst, &irk->bdaddr);
4976                 conn->dst_type = irk->addr_type;
4977         }
4978
4979         if (status) {
4980                 hci_le_conn_failed(conn, status);
4981                 goto unlock;
4982         }
4983
4984         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4985                 addr_type = BDADDR_LE_PUBLIC;
4986         else
4987                 addr_type = BDADDR_LE_RANDOM;
4988
4989         /* Drop the connection if the device is blocked */
4990         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4991                 hci_conn_drop(conn);
4992                 goto unlock;
4993         }
4994
4995         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4996                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4997
4998         conn->sec_level = BT_SECURITY_LOW;
4999         conn->handle = handle;
5000         conn->state = BT_CONFIG;
5001
5002         conn->le_conn_interval = interval;
5003         conn->le_conn_latency = latency;
5004         conn->le_supv_timeout = supervision_timeout;
5005
5006         hci_debugfs_create_conn(conn);
5007         hci_conn_add_sysfs(conn);
5008
5009         if (!status) {
5010                 /* The remote features procedure is defined for master
5011                  * role only. So only in case of an initiated connection
5012                  * request the remote features.
5013                  *
5014                  * If the local controller supports slave-initiated features
5015                  * exchange, then requesting the remote features in slave
5016                  * role is possible. Otherwise just transition into the
5017                  * connected state without requesting the remote features.
5018                  */
5019                 if (conn->out ||
5020                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5021                         struct hci_cp_le_read_remote_features cp;
5022
5023                         cp.handle = __cpu_to_le16(conn->handle);
5024
5025                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5026                                      sizeof(cp), &cp);
5027
5028                         hci_conn_hold(conn);
5029                 } else {
5030                         conn->state = BT_CONNECTED;
5031                         hci_connect_cfm(conn, status);
5032                 }
5033         } else {
5034                 hci_connect_cfm(conn, status);
5035         }
5036
5037         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5038                                            conn->dst_type);
5039         if (params) {
5040                 list_del_init(&params->action);
5041                 if (params->conn) {
5042                         hci_conn_drop(params->conn);
5043                         hci_conn_put(params->conn);
5044                         params->conn = NULL;
5045                 }
5046         }
5047
5048 unlock:
5049         hci_update_background_scan(hdev);
5050         hci_dev_unlock(hdev);
5051 }
5052
5053 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5054 {
5055         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5056
5057         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5058
5059         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5060                              ev->role, le16_to_cpu(ev->handle),
5061                              le16_to_cpu(ev->interval),
5062                              le16_to_cpu(ev->latency),
5063                              le16_to_cpu(ev->supervision_timeout));
5064 }
5065
5066 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5067                                          struct sk_buff *skb)
5068 {
5069         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5070
5071         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5072
5073         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5074                              ev->role, le16_to_cpu(ev->handle),
5075                              le16_to_cpu(ev->interval),
5076                              le16_to_cpu(ev->latency),
5077                              le16_to_cpu(ev->supervision_timeout));
5078 }
5079
5080 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5081 {
5082         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5083         struct hci_conn *conn;
5084
5085         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5086
5087         if (ev->status)
5088                 return;
5089
5090         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5091         if (conn) {
5092                 struct adv_info *adv_instance;
5093
5094                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5095                         return;
5096
5097                 if (!hdev->cur_adv_instance) {
5098                         bacpy(&conn->resp_addr, &hdev->random_addr);
5099                         return;
5100                 }
5101
5102                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5103                 if (adv_instance)
5104                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5105         }
5106 }
5107
5108 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5109                                             struct sk_buff *skb)
5110 {
5111         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5112         struct hci_conn *conn;
5113
5114         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5115
5116         if (ev->status)
5117                 return;
5118
5119         hci_dev_lock(hdev);
5120
5121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5122         if (conn) {
5123 #ifdef TIZEN_BT
5124                 if (ev->status) {
5125                         hci_dev_unlock(hdev);
5126                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5127                                 conn->type, conn->dst_type, ev->status);
5128                         return;
5129                 }
5130 #endif
5131                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5132                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5133                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5134         }
5135
5136         hci_dev_unlock(hdev);
5137
5138 #ifdef TIZEN_BT
5139         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5140                                 conn->dst_type, conn->le_conn_interval,
5141                                 conn->le_conn_latency, conn->le_supv_timeout);
5142 #endif
5143 }
5144
5145 /* This function requires the caller holds hdev->lock */
5146 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5147                                               bdaddr_t *addr,
5148                                               u8 addr_type, u8 adv_type,
5149                                               bdaddr_t *direct_rpa)
5150 {
5151         struct hci_conn *conn;
5152         struct hci_conn_params *params;
5153
5154         /* If the event is not connectable don't proceed further */
5155         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5156                 return NULL;
5157
5158         /* Ignore if the device is blocked */
5159         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5160                 return NULL;
5161
5162         /* Most controller will fail if we try to create new connections
5163          * while we have an existing one in slave role.
5164          */
5165         if (hdev->conn_hash.le_num_slave > 0)
5166                 return NULL;
5167
5168         /* If we're not connectable only connect devices that we have in
5169          * our pend_le_conns list.
5170          */
5171         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5172                                            addr_type);
5173         if (!params)
5174                 return NULL;
5175
5176         if (!params->explicit_connect) {
5177                 switch (params->auto_connect) {
5178                 case HCI_AUTO_CONN_DIRECT:
5179                         /* Only devices advertising with ADV_DIRECT_IND are
5180                          * triggering a connection attempt. This is allowing
5181                          * incoming connections from slave devices.
5182                          */
5183                         if (adv_type != LE_ADV_DIRECT_IND)
5184                                 return NULL;
5185                         break;
5186                 case HCI_AUTO_CONN_ALWAYS:
5187                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5188                          * are triggering a connection attempt. This means
5189                          * that incoming connectioms from slave device are
5190                          * accepted and also outgoing connections to slave
5191                          * devices are established when found.
5192                          */
5193                         break;
5194                 default:
5195                         return NULL;
5196                 }
5197         }
5198
5199         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5200                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5201                               direct_rpa);
5202         if (!IS_ERR(conn)) {
5203                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5204                  * by higher layer that tried to connect, if no then
5205                  * store the pointer since we don't really have any
5206                  * other owner of the object besides the params that
5207                  * triggered it. This way we can abort the connection if
5208                  * the parameters get removed and keep the reference
5209                  * count consistent once the connection is established.
5210                  */
5211
5212                 if (!params->explicit_connect)
5213                         params->conn = hci_conn_get(conn);
5214
5215                 return conn;
5216         }
5217
5218         switch (PTR_ERR(conn)) {
5219         case -EBUSY:
5220                 /* If hci_connect() returns -EBUSY it means there is already
5221                  * an LE connection attempt going on. Since controllers don't
5222                  * support more than one connection attempt at the time, we
5223                  * don't consider this an error case.
5224                  */
5225                 break;
5226         default:
5227                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5228                 return NULL;
5229         }
5230
5231         return NULL;
5232 }
5233
5234 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5235                                u8 bdaddr_type, bdaddr_t *direct_addr,
5236                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5237 {
5238         struct discovery_state *d = &hdev->discovery;
5239         struct smp_irk *irk;
5240         struct hci_conn *conn;
5241         bool match;
5242         u32 flags;
5243         u8 *ptr, real_len;
5244
5245         switch (type) {
5246         case LE_ADV_IND:
5247         case LE_ADV_DIRECT_IND:
5248         case LE_ADV_SCAN_IND:
5249         case LE_ADV_NONCONN_IND:
5250         case LE_ADV_SCAN_RSP:
5251                 break;
5252         default:
5253                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5254                                        "type: 0x%02x", type);
5255                 return;
5256         }
5257
5258         /* Find the end of the data in case the report contains padded zero
5259          * bytes at the end causing an invalid length value.
5260          *
5261          * When data is NULL, len is 0 so there is no need for extra ptr
5262          * check as 'ptr < data + 0' is already false in such case.
5263          */
5264         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5265                 if (ptr + 1 + *ptr > data + len)
5266                         break;
5267         }
5268
5269         real_len = ptr - data;
5270
5271         /* Adjust for actual length */
5272         if (len != real_len) {
5273                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5274                 len = real_len;
5275         }
5276
5277         /* If the direct address is present, then this report is from
5278          * a LE Direct Advertising Report event. In that case it is
5279          * important to see if the address is matching the local
5280          * controller address.
5281          */
5282         if (direct_addr) {
5283                 /* Only resolvable random addresses are valid for these
5284                  * kind of reports and others can be ignored.
5285                  */
5286                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5287                         return;
5288
5289                 /* If the controller is not using resolvable random
5290                  * addresses, then this report can be ignored.
5291                  */
5292                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5293                         return;
5294
5295                 /* If the local IRK of the controller does not match
5296                  * with the resolvable random address provided, then
5297                  * this report can be ignored.
5298                  */
5299                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5300                         return;
5301         }
5302
5303         /* Check if we need to convert to identity address */
5304         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5305         if (irk) {
5306                 bdaddr = &irk->bdaddr;
5307                 bdaddr_type = irk->addr_type;
5308         }
5309
5310         /* Check if we have been requested to connect to this device.
5311          *
5312          * direct_addr is set only for directed advertising reports (it is NULL
5313          * for advertising reports) and is already verified to be RPA above.
5314          */
5315         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5316                                                                 direct_addr);
5317         if (conn && type == LE_ADV_IND) {
5318                 /* Store report for later inclusion by
5319                  * mgmt_device_connected
5320                  */
5321                 memcpy(conn->le_adv_data, data, len);
5322                 conn->le_adv_data_len = len;
5323         }
5324
5325         /* Passive scanning shouldn't trigger any device found events,
5326          * except for devices marked as CONN_REPORT for which we do send
5327          * device found events.
5328          */
5329         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5330                 if (type == LE_ADV_DIRECT_IND)
5331                         return;
5332
5333                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5334                                                bdaddr, bdaddr_type))
5335                         return;
5336
5337                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5338                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5339                 else
5340                         flags = 0;
5341                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5342                                   rssi, flags, data, len, NULL, 0);
5343                 return;
5344         }
5345
5346         /* When receiving non-connectable or scannable undirected
5347          * advertising reports, this means that the remote device is
5348          * not connectable and then clearly indicate this in the
5349          * device found event.
5350          *
5351          * When receiving a scan response, then there is no way to
5352          * know if the remote device is connectable or not. However
5353          * since scan responses are merged with a previously seen
5354          * advertising report, the flags field from that report
5355          * will be used.
5356          *
5357          * In the really unlikely case that a controller get confused
5358          * and just sends a scan response event, then it is marked as
5359          * not connectable as well.
5360          */
5361         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5362             type == LE_ADV_SCAN_RSP)
5363                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5364         else
5365                 flags = 0;
5366
5367         /* If there's nothing pending either store the data from this
5368          * event or send an immediate device found event if the data
5369          * should not be stored for later.
5370          */
5371         if (!has_pending_adv_report(hdev)) {
5372                 /* If the report will trigger a SCAN_REQ store it for
5373                  * later merging.
5374                  */
5375                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5376                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5377                                                  rssi, flags, data, len);
5378                         return;
5379                 }
5380
5381                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5382                                   rssi, flags, data, len, NULL, 0);
5383                 return;
5384         }
5385
5386         /* Check if the pending report is for the same device as the new one */
5387         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5388                  bdaddr_type == d->last_adv_addr_type);
5389
5390         /* If the pending data doesn't match this report or this isn't a
5391          * scan response (e.g. we got a duplicate ADV_IND) then force
5392          * sending of the pending data.
5393          */
5394         if (type != LE_ADV_SCAN_RSP || !match) {
5395                 /* Send out whatever is in the cache, but skip duplicates */
5396                 if (!match)
5397                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5398                                           d->last_adv_addr_type, NULL,
5399                                           d->last_adv_rssi, d->last_adv_flags,
5400                                           d->last_adv_data,
5401                                           d->last_adv_data_len, NULL, 0);
5402
5403                 /* If the new report will trigger a SCAN_REQ store it for
5404                  * later merging.
5405                  */
5406                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5407                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5408                                                  rssi, flags, data, len);
5409                         return;
5410                 }
5411
5412                 /* The advertising reports cannot be merged, so clear
5413                  * the pending report and send out a device found event.
5414                  */
5415                 clear_pending_adv_report(hdev);
5416                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5417                                   rssi, flags, data, len, NULL, 0);
5418                 return;
5419         }
5420
5421         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5422          * the new event is a SCAN_RSP. We can therefore proceed with
5423          * sending a merged device found event.
5424          */
5425         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5426                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5427                           d->last_adv_data, d->last_adv_data_len, data, len);
5428         clear_pending_adv_report(hdev);
5429 }
5430
5431 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5432 {
5433         u8 num_reports = skb->data[0];
5434         void *ptr = &skb->data[1];
5435
5436         hci_dev_lock(hdev);
5437
5438         while (num_reports--) {
5439                 struct hci_ev_le_advertising_info *ev = ptr;
5440                 s8 rssi;
5441
5442                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5443                         rssi = ev->data[ev->length];
5444                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5445                                            ev->bdaddr_type, NULL, 0, rssi,
5446                                            ev->data, ev->length);
5447                 } else {
5448                         bt_dev_err(hdev, "Dropping invalid advertising data");
5449                 }
5450
5451                 ptr += sizeof(*ev) + ev->length + 1;
5452         }
5453
5454         hci_dev_unlock(hdev);
5455 }
5456
5457 static u8 ext_evt_type_to_legacy(u16 evt_type)
5458 {
5459         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5460                 switch (evt_type) {
5461                 case LE_LEGACY_ADV_IND:
5462                         return LE_ADV_IND;
5463                 case LE_LEGACY_ADV_DIRECT_IND:
5464                         return LE_ADV_DIRECT_IND;
5465                 case LE_LEGACY_ADV_SCAN_IND:
5466                         return LE_ADV_SCAN_IND;
5467                 case LE_LEGACY_NONCONN_IND:
5468                         return LE_ADV_NONCONN_IND;
5469                 case LE_LEGACY_SCAN_RSP_ADV:
5470                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5471                         return LE_ADV_SCAN_RSP;
5472                 }
5473
5474                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5475                                    evt_type);
5476
5477                 return LE_ADV_INVALID;
5478         }
5479
5480         if (evt_type & LE_EXT_ADV_CONN_IND) {
5481                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5482                         return LE_ADV_DIRECT_IND;
5483
5484                 return LE_ADV_IND;
5485         }
5486
5487         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5488                 return LE_ADV_SCAN_RSP;
5489
5490         if (evt_type & LE_EXT_ADV_SCAN_IND)
5491                 return LE_ADV_SCAN_IND;
5492
5493         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5494             evt_type & LE_EXT_ADV_DIRECT_IND)
5495                 return LE_ADV_NONCONN_IND;
5496
5497         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5498                                    evt_type);
5499
5500         return LE_ADV_INVALID;
5501 }
5502
5503 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5504 {
5505         u8 num_reports = skb->data[0];
5506         void *ptr = &skb->data[1];
5507
5508         hci_dev_lock(hdev);
5509
5510         while (num_reports--) {
5511                 struct hci_ev_le_ext_adv_report *ev = ptr;
5512                 u8 legacy_evt_type;
5513                 u16 evt_type;
5514
5515                 evt_type = __le16_to_cpu(ev->evt_type);
5516                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5517                 if (legacy_evt_type != LE_ADV_INVALID) {
5518                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5519                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5520                                            ev->data, ev->length);
5521                 }
5522
5523                 ptr += sizeof(*ev) + ev->length + 1;
5524         }
5525
5526         hci_dev_unlock(hdev);
5527 }
5528
5529 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5530                                             struct sk_buff *skb)
5531 {
5532         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5533         struct hci_conn *conn;
5534
5535         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5536
5537         hci_dev_lock(hdev);
5538
5539         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5540         if (conn) {
5541                 if (!ev->status)
5542                         memcpy(conn->features[0], ev->features, 8);
5543
5544                 if (conn->state == BT_CONFIG) {
5545                         __u8 status;
5546
5547                         /* If the local controller supports slave-initiated
5548                          * features exchange, but the remote controller does
5549                          * not, then it is possible that the error code 0x1a
5550                          * for unsupported remote feature gets returned.
5551                          *
5552                          * In this specific case, allow the connection to
5553                          * transition into connected state and mark it as
5554                          * successful.
5555                          */
5556                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5557                             !conn->out && ev->status == 0x1a)
5558                                 status = 0x00;
5559                         else
5560                                 status = ev->status;
5561
5562                         conn->state = BT_CONNECTED;
5563                         hci_connect_cfm(conn, status);
5564                         hci_conn_drop(conn);
5565                 }
5566         }
5567
5568         hci_dev_unlock(hdev);
5569 }
5570
5571 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5572 {
5573         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5574         struct hci_cp_le_ltk_reply cp;
5575         struct hci_cp_le_ltk_neg_reply neg;
5576         struct hci_conn *conn;
5577         struct smp_ltk *ltk;
5578
5579         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5580
5581         hci_dev_lock(hdev);
5582
5583         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5584         if (conn == NULL)
5585                 goto not_found;
5586
5587         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5588         if (!ltk)
5589                 goto not_found;
5590
5591         if (smp_ltk_is_sc(ltk)) {
5592                 /* With SC both EDiv and Rand are set to zero */
5593                 if (ev->ediv || ev->rand)
5594                         goto not_found;
5595         } else {
5596                 /* For non-SC keys check that EDiv and Rand match */
5597                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5598                         goto not_found;
5599         }
5600
5601         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5602         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5603         cp.handle = cpu_to_le16(conn->handle);
5604
5605         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5606
5607         conn->enc_key_size = ltk->enc_size;
5608
5609         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5610
5611         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5612          * temporary key used to encrypt a connection following
5613          * pairing. It is used during the Encrypted Session Setup to
5614          * distribute the keys. Later, security can be re-established
5615          * using a distributed LTK.
5616          */
5617         if (ltk->type == SMP_STK) {
5618                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5619                 list_del_rcu(&ltk->list);
5620                 kfree_rcu(ltk, rcu);
5621         } else {
5622                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5623         }
5624
5625         hci_dev_unlock(hdev);
5626
5627         return;
5628
5629 not_found:
5630         neg.handle = ev->handle;
5631         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5632         hci_dev_unlock(hdev);
5633 }
5634
5635 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5636                                       u8 reason)
5637 {
5638         struct hci_cp_le_conn_param_req_neg_reply cp;
5639
5640         cp.handle = cpu_to_le16(handle);
5641         cp.reason = reason;
5642
5643         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5644                      &cp);
5645 }
5646
5647 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5648                                              struct sk_buff *skb)
5649 {
5650         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5651         struct hci_cp_le_conn_param_req_reply cp;
5652         struct hci_conn *hcon;
5653         u16 handle, min, max, latency, timeout;
5654
5655         handle = le16_to_cpu(ev->handle);
5656         min = le16_to_cpu(ev->interval_min);
5657         max = le16_to_cpu(ev->interval_max);
5658         latency = le16_to_cpu(ev->latency);
5659         timeout = le16_to_cpu(ev->timeout);
5660
5661         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5662         if (!hcon || hcon->state != BT_CONNECTED)
5663                 return send_conn_param_neg_reply(hdev, handle,
5664                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5665
5666         if (hci_check_conn_params(min, max, latency, timeout))
5667                 return send_conn_param_neg_reply(hdev, handle,
5668                                                  HCI_ERROR_INVALID_LL_PARAMS);
5669
5670         if (hcon->role == HCI_ROLE_MASTER) {
5671                 struct hci_conn_params *params;
5672                 u8 store_hint;
5673
5674                 hci_dev_lock(hdev);
5675
5676                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5677                                                 hcon->dst_type);
5678                 if (params) {
5679                         params->conn_min_interval = min;
5680                         params->conn_max_interval = max;
5681                         params->conn_latency = latency;
5682                         params->supervision_timeout = timeout;
5683                         store_hint = 0x01;
5684                 } else{
5685                         store_hint = 0x00;
5686                 }
5687
5688                 hci_dev_unlock(hdev);
5689
5690                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5691                                     store_hint, min, max, latency, timeout);
5692         }
5693
5694         cp.handle = ev->handle;
5695         cp.interval_min = ev->interval_min;
5696         cp.interval_max = ev->interval_max;
5697         cp.latency = ev->latency;
5698         cp.timeout = ev->timeout;
5699         cp.min_ce_len = 0;
5700         cp.max_ce_len = 0;
5701
5702         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5703 }
5704
5705 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5706                                          struct sk_buff *skb)
5707 {
5708         u8 num_reports = skb->data[0];
5709         void *ptr = &skb->data[1];
5710
5711         hci_dev_lock(hdev);
5712
5713         while (num_reports--) {
5714                 struct hci_ev_le_direct_adv_info *ev = ptr;
5715
5716                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5717                                    ev->bdaddr_type, &ev->direct_addr,
5718                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5719
5720                 ptr += sizeof(*ev);
5721         }
5722
5723         hci_dev_unlock(hdev);
5724 }
5725
5726 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5727 {
5728         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5729
5730         skb_pull(skb, sizeof(*le_ev));
5731
5732         switch (le_ev->subevent) {
5733         case HCI_EV_LE_CONN_COMPLETE:
5734                 hci_le_conn_complete_evt(hdev, skb);
5735                 break;
5736
5737         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5738                 hci_le_conn_update_complete_evt(hdev, skb);
5739                 break;
5740
5741         case HCI_EV_LE_ADVERTISING_REPORT:
5742                 hci_le_adv_report_evt(hdev, skb);
5743                 break;
5744
5745         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5746                 hci_le_remote_feat_complete_evt(hdev, skb);
5747                 break;
5748
5749         case HCI_EV_LE_LTK_REQ:
5750                 hci_le_ltk_request_evt(hdev, skb);
5751                 break;
5752
5753         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5754                 hci_le_remote_conn_param_req_evt(hdev, skb);
5755                 break;
5756
5757         case HCI_EV_LE_DIRECT_ADV_REPORT:
5758                 hci_le_direct_adv_report_evt(hdev, skb);
5759                 break;
5760
5761         case HCI_EV_LE_EXT_ADV_REPORT:
5762                 hci_le_ext_adv_report_evt(hdev, skb);
5763                 break;
5764
5765         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5766                 hci_le_enh_conn_complete_evt(hdev, skb);
5767                 break;
5768
5769         case HCI_EV_LE_EXT_ADV_SET_TERM:
5770                 hci_le_ext_adv_term_evt(hdev, skb);
5771                 break;
5772
5773         default:
5774                 break;
5775         }
5776 }
5777
5778 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5779                                  u8 event, struct sk_buff *skb)
5780 {
5781         struct hci_ev_cmd_complete *ev;
5782         struct hci_event_hdr *hdr;
5783
5784         if (!skb)
5785                 return false;
5786
5787         if (skb->len < sizeof(*hdr)) {
5788                 bt_dev_err(hdev, "too short HCI event");
5789                 return false;
5790         }
5791
5792         hdr = (void *) skb->data;
5793         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5794
5795         if (event) {
5796                 if (hdr->evt != event)
5797                         return false;
5798                 return true;
5799         }
5800
5801         /* Check if request ended in Command Status - no way to retreive
5802          * any extra parameters in this case.
5803          */
5804         if (hdr->evt == HCI_EV_CMD_STATUS)
5805                 return false;
5806
5807         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5808                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5809                            hdr->evt);
5810                 return false;
5811         }
5812
5813         if (skb->len < sizeof(*ev)) {
5814                 bt_dev_err(hdev, "too short cmd_complete event");
5815                 return false;
5816         }
5817
5818         ev = (void *) skb->data;
5819         skb_pull(skb, sizeof(*ev));
5820
5821         if (opcode != __le16_to_cpu(ev->opcode)) {
5822                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5823                        __le16_to_cpu(ev->opcode));
5824                 return false;
5825         }
5826
5827         return true;
5828 }
5829
5830 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5831 {
5832         struct hci_event_hdr *hdr = (void *) skb->data;
5833         hci_req_complete_t req_complete = NULL;
5834         hci_req_complete_skb_t req_complete_skb = NULL;
5835         struct sk_buff *orig_skb = NULL;
5836         u8 status = 0, event = hdr->evt, req_evt = 0;
5837         u16 opcode = HCI_OP_NOP;
5838
5839         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5840                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5841                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5842                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5843                                      &req_complete_skb);
5844                 req_evt = event;
5845         }
5846
5847         /* If it looks like we might end up having to call
5848          * req_complete_skb, store a pristine copy of the skb since the
5849          * various handlers may modify the original one through
5850          * skb_pull() calls, etc.
5851          */
5852         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5853             event == HCI_EV_CMD_COMPLETE)
5854                 orig_skb = skb_clone(skb, GFP_KERNEL);
5855
5856         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5857
5858         switch (event) {
5859         case HCI_EV_INQUIRY_COMPLETE:
5860                 hci_inquiry_complete_evt(hdev, skb);
5861                 break;
5862
5863         case HCI_EV_INQUIRY_RESULT:
5864                 hci_inquiry_result_evt(hdev, skb);
5865                 break;
5866
5867         case HCI_EV_CONN_COMPLETE:
5868                 hci_conn_complete_evt(hdev, skb);
5869                 break;
5870
5871         case HCI_EV_CONN_REQUEST:
5872                 hci_conn_request_evt(hdev, skb);
5873                 break;
5874
5875         case HCI_EV_DISCONN_COMPLETE:
5876                 hci_disconn_complete_evt(hdev, skb);
5877                 break;
5878
5879         case HCI_EV_AUTH_COMPLETE:
5880                 hci_auth_complete_evt(hdev, skb);
5881                 break;
5882
5883         case HCI_EV_REMOTE_NAME:
5884                 hci_remote_name_evt(hdev, skb);
5885                 break;
5886
5887         case HCI_EV_ENCRYPT_CHANGE:
5888                 hci_encrypt_change_evt(hdev, skb);
5889                 break;
5890
5891         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5892                 hci_change_link_key_complete_evt(hdev, skb);
5893                 break;
5894
5895         case HCI_EV_REMOTE_FEATURES:
5896                 hci_remote_features_evt(hdev, skb);
5897                 break;
5898
5899         case HCI_EV_CMD_COMPLETE:
5900                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5901                                      &req_complete, &req_complete_skb);
5902                 break;
5903
5904         case HCI_EV_CMD_STATUS:
5905                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5906                                    &req_complete_skb);
5907                 break;
5908
5909         case HCI_EV_HARDWARE_ERROR:
5910                 hci_hardware_error_evt(hdev, skb);
5911                 break;
5912
5913         case HCI_EV_ROLE_CHANGE:
5914                 hci_role_change_evt(hdev, skb);
5915                 break;
5916
5917         case HCI_EV_NUM_COMP_PKTS:
5918                 hci_num_comp_pkts_evt(hdev, skb);
5919                 break;
5920
5921         case HCI_EV_MODE_CHANGE:
5922                 hci_mode_change_evt(hdev, skb);
5923                 break;
5924
5925         case HCI_EV_PIN_CODE_REQ:
5926                 hci_pin_code_request_evt(hdev, skb);
5927                 break;
5928
5929         case HCI_EV_LINK_KEY_REQ:
5930                 hci_link_key_request_evt(hdev, skb);
5931                 break;
5932
5933         case HCI_EV_LINK_KEY_NOTIFY:
5934                 hci_link_key_notify_evt(hdev, skb);
5935                 break;
5936
5937         case HCI_EV_CLOCK_OFFSET:
5938                 hci_clock_offset_evt(hdev, skb);
5939                 break;
5940
5941         case HCI_EV_PKT_TYPE_CHANGE:
5942                 hci_pkt_type_change_evt(hdev, skb);
5943                 break;
5944
5945         case HCI_EV_PSCAN_REP_MODE:
5946                 hci_pscan_rep_mode_evt(hdev, skb);
5947                 break;
5948
5949         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5950                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5951                 break;
5952
5953         case HCI_EV_REMOTE_EXT_FEATURES:
5954                 hci_remote_ext_features_evt(hdev, skb);
5955                 break;
5956
5957         case HCI_EV_SYNC_CONN_COMPLETE:
5958                 hci_sync_conn_complete_evt(hdev, skb);
5959                 break;
5960
5961         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5962                 hci_extended_inquiry_result_evt(hdev, skb);
5963                 break;
5964
5965         case HCI_EV_KEY_REFRESH_COMPLETE:
5966                 hci_key_refresh_complete_evt(hdev, skb);
5967                 break;
5968
5969         case HCI_EV_IO_CAPA_REQUEST:
5970                 hci_io_capa_request_evt(hdev, skb);
5971                 break;
5972
5973         case HCI_EV_IO_CAPA_REPLY:
5974                 hci_io_capa_reply_evt(hdev, skb);
5975                 break;
5976
5977         case HCI_EV_USER_CONFIRM_REQUEST:
5978                 hci_user_confirm_request_evt(hdev, skb);
5979                 break;
5980
5981         case HCI_EV_USER_PASSKEY_REQUEST:
5982                 hci_user_passkey_request_evt(hdev, skb);
5983                 break;
5984
5985         case HCI_EV_USER_PASSKEY_NOTIFY:
5986                 hci_user_passkey_notify_evt(hdev, skb);
5987                 break;
5988
5989         case HCI_EV_KEYPRESS_NOTIFY:
5990                 hci_keypress_notify_evt(hdev, skb);
5991                 break;
5992
5993         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5994                 hci_simple_pair_complete_evt(hdev, skb);
5995                 break;
5996
5997         case HCI_EV_REMOTE_HOST_FEATURES:
5998                 hci_remote_host_features_evt(hdev, skb);
5999                 break;
6000
6001         case HCI_EV_LE_META:
6002                 hci_le_meta_evt(hdev, skb);
6003                 break;
6004
6005         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6006                 hci_remote_oob_data_request_evt(hdev, skb);
6007                 break;
6008
6009 #if IS_ENABLED(CONFIG_BT_HS)
6010         case HCI_EV_CHANNEL_SELECTED:
6011                 hci_chan_selected_evt(hdev, skb);
6012                 break;
6013
6014         case HCI_EV_PHY_LINK_COMPLETE:
6015                 hci_phy_link_complete_evt(hdev, skb);
6016                 break;
6017
6018         case HCI_EV_LOGICAL_LINK_COMPLETE:
6019                 hci_loglink_complete_evt(hdev, skb);
6020                 break;
6021
6022         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6023                 hci_disconn_loglink_complete_evt(hdev, skb);
6024                 break;
6025
6026         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6027                 hci_disconn_phylink_complete_evt(hdev, skb);
6028                 break;
6029 #endif
6030
6031         case HCI_EV_NUM_COMP_BLOCKS:
6032                 hci_num_comp_blocks_evt(hdev, skb);
6033                 break;
6034
6035 #ifdef TIZEN_BT
6036         case HCI_EV_VENDOR_SPECIFIC:
6037                 hci_vendor_specific_evt(hdev, skb);
6038                 break;
6039 #endif
6040
6041         default:
6042                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6043                 break;
6044         }
6045
6046         if (req_complete) {
6047                 req_complete(hdev, status, opcode);
6048         } else if (req_complete_skb) {
6049                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6050                         kfree_skb(orig_skb);
6051                         orig_skb = NULL;
6052                 }
6053                 req_complete_skb(hdev, status, opcode, orig_skb);
6054         }
6055
6056         kfree_skb(orig_skb);
6057         kfree_skb(skb);
6058         hdev->stat.evt_rx++;
6059 }