net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  44
  45 /* Handle HCI Event packets */
  46
  47 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  48                                   u8 *new_status)
  49 {
  50         __u8 status = *((__u8 *) skb->data);
  51
  52         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  53
  54         /* It is possible that we receive Inquiry Complete event right
  55          * before we receive Inquiry Cancel Command Complete event, in
  56          * which case the latter event should have status of Command
  57          * Disallowed (0x0c). This should not be treated as error, since
  58          * we actually achieve what Inquiry Cancel wants to achieve,
  59          * which is to end the last Inquiry session.
  60          */
  61         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  62                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  63                 status = 0x00;
  64         }
  65
  66         *new_status = status;
  67
  68         if (status)
  69                 return;
  70
  71         clear_bit(HCI_INQUIRY, &hdev->flags);
  72         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  73         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  74
  75         hci_dev_lock(hdev);
  76         /* Set discovery state to stopped if we're not doing LE active
  77          * scanning.
  78          */
  79         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  80             hdev->le_scan_type != LE_SCAN_ACTIVE)
  81                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  82         hci_dev_unlock(hdev);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         __u8 status = *((__u8 *) skb->data);
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  92
  93         if (status)
  94                 return;
  95
  96         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  97 }
  98
  99 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 100 {
 101         __u8 status = *((__u8 *) skb->data);
 102
 103         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 104
 105         if (status)
 106                 return;
 107
 108         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 109
 110         hci_conn_check_pending(hdev);
 111 }
 112
 113 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 114                                           struct sk_buff *skb)
 115 {
 116         BT_DBG("%s", hdev->name);
 117 }
 118
 119 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 120 {
 121         struct hci_rp_role_discovery *rp = (void *) skb->data;
 122         struct hci_conn *conn;
 123
 124         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 125
 126         if (rp->status)
 127                 return;
 128
 129         hci_dev_lock(hdev);
 130
 131         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 132         if (conn)
 133                 conn->role = rp->role;
 134
 135         hci_dev_unlock(hdev);
 136 }
 137
 138 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 139 {
 140         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 141         struct hci_conn *conn;
 142
 143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 144
 145         if (rp->status)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = __le16_to_cpu(rp->policy);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 160         struct hci_conn *conn;
 161         void *sent;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 169         if (!sent)
 170                 return;
 171
 172         hci_dev_lock(hdev);
 173
 174         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 175         if (conn)
 176                 conn->link_policy = get_unaligned_le16(sent + 2);
 177
 178         hci_dev_unlock(hdev);
 179 }
 180
 181 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 182                                         struct sk_buff *skb)
 183 {
 184         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 185
 186         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 187
 188         if (rp->status)
 189                 return;
 190
 191         hdev->link_policy = __le16_to_cpu(rp->policy);
 192 }
 193
 194 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 195                                          struct sk_buff *skb)
 196 {
 197         __u8 status = *((__u8 *) skb->data);
 198         void *sent;
 199
 200         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 201
 202         if (status)
 203                 return;
 204
 205         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 206         if (!sent)
 207                 return;
 208
 209         hdev->link_policy = get_unaligned_le16(sent);
 210 }
 211
 212 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 213 {
 214         __u8 status = *((__u8 *) skb->data);
 215
 216         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 217
 218         clear_bit(HCI_RESET, &hdev->flags);
 219
 220         if (status)
 221                 return;
 222
 223         /* Reset all non-persistent flags */
 224         hci_dev_clear_volatile_flags(hdev);
 225
 226         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 227
 228         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 229         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 230
 231         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 232         hdev->adv_data_len = 0;
 233
 234         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 235         hdev->scan_rsp_data_len = 0;
 236
 237         hdev->le_scan_type = LE_SCAN_PASSIVE;
 238
 239         hdev->ssp_debug_mode = 0;
 240
 241         hci_bdaddr_list_clear(&hdev->le_accept_list);
 242         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 243 }
 244
 245 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 246                                         struct sk_buff *skb)
 247 {
 248         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 249         struct hci_cp_read_stored_link_key *sent;
 250
 251         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 254         if (!sent)
 255                 return;
 256
 257         if (!rp->status && sent->read_all == 0x01) {
 258                 hdev->stored_max_keys = rp->max_keys;
 259                 hdev->stored_num_keys = rp->num_keys;
 260         }
 261 }
 262
 263 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 264                                           struct sk_buff *skb)
 265 {
 266         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 267
 268         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 269
 270         if (rp->status)
 271                 return;
 272
 273         if (rp->num_keys <= hdev->stored_num_keys)
 274                 hdev->stored_num_keys -= rp->num_keys;
 275         else
 276                 hdev->stored_num_keys = 0;
 277 }
 278
 279 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 280 {
 281         __u8 status = *((__u8 *) skb->data);
 282         void *sent;
 283
 284         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 285
 286         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 287         if (!sent)
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         if (hci_dev_test_flag(hdev, HCI_MGMT))
 293                 mgmt_set_local_name_complete(hdev, sent, status);
 294         else if (!status)
 295                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 296
 297         hci_dev_unlock(hdev);
 298 }
 299
 300 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_local_name *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 310             hci_dev_test_flag(hdev, HCI_CONFIG))
 311                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 312 }
 313
 314 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 315 {
 316         __u8 status = *((__u8 *) skb->data);
 317         void *sent;
 318
 319         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 320
 321         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 322         if (!sent)
 323                 return;
 324
 325         hci_dev_lock(hdev);
 326
 327         if (!status) {
 328                 __u8 param = *((__u8 *) sent);
 329
 330                 if (param == AUTH_ENABLED)
 331                         set_bit(HCI_AUTH, &hdev->flags);
 332                 else
 333                         clear_bit(HCI_AUTH, &hdev->flags);
 334         }
 335
 336         if (hci_dev_test_flag(hdev, HCI_MGMT))
 337                 mgmt_auth_enable_complete(hdev, status);
 338
 339         hci_dev_unlock(hdev);
 340 }
 341
 342 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 343 {
 344         __u8 status = *((__u8 *) skb->data);
 345         __u8 param;
 346         void *sent;
 347
 348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 349
 350         if (status)
 351                 return;
 352
 353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 354         if (!sent)
 355                 return;
 356
 357         param = *((__u8 *) sent);
 358
 359         if (param)
 360                 set_bit(HCI_ENCRYPT, &hdev->flags);
 361         else
 362                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 363 }
 364
 365 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 366 {
 367         __u8 status = *((__u8 *) skb->data);
 368         __u8 param;
 369         void *sent;
 370
 371         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 372
 373         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 374         if (!sent)
 375                 return;
 376
 377         param = *((__u8 *) sent);
 378
 379         hci_dev_lock(hdev);
 380
 381         if (status) {
 382                 hdev->discov_timeout = 0;
 383                 goto done;
 384         }
 385
 386         if (param & SCAN_INQUIRY)
 387                 set_bit(HCI_ISCAN, &hdev->flags);
 388         else
 389                 clear_bit(HCI_ISCAN, &hdev->flags);
 390
 391         if (param & SCAN_PAGE)
 392                 set_bit(HCI_PSCAN, &hdev->flags);
 393         else
 394                 clear_bit(HCI_PSCAN, &hdev->flags);
 395
 396 done:
 397         hci_dev_unlock(hdev);
 398 }
 399
 400 static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *)skb->data);
 403         struct hci_cp_set_event_filter *cp;
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 412         if (!sent)
 413                 return;
 414
 415         cp = (struct hci_cp_set_event_filter *)sent;
 416
 417         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 418                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 419         else
 420                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 421 }
 422
 423 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 426
 427         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 428
 429         if (rp->status)
 430                 return;
 431
 432         memcpy(hdev->dev_class, rp->dev_class, 3);
 433
 434         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 435                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 436 }
 437
 438 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 446         if (!sent)
 447                 return;
 448
 449         hci_dev_lock(hdev);
 450
 451         if (status == 0)
 452                 memcpy(hdev->dev_class, sent, 3);
 453
 454         if (hci_dev_test_flag(hdev, HCI_MGMT))
 455                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 456
 457         hci_dev_unlock(hdev);
 458 }
 459
 460 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 461 {
 462         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 463         __u16 setting;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 466
 467         if (rp->status)
 468                 return;
 469
 470         setting = __le16_to_cpu(rp->voice_setting);
 471
 472         if (hdev->voice_setting == setting)
 473                 return;
 474
 475         hdev->voice_setting = setting;
 476
 477         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 478
 479         if (hdev->notify)
 480                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 481 }
 482
 483 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 484                                        struct sk_buff *skb)
 485 {
 486         __u8 status = *((__u8 *) skb->data);
 487         __u16 setting;
 488         void *sent;
 489
 490         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 491
 492         if (status)
 493                 return;
 494
 495         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 496         if (!sent)
 497                 return;
 498
 499         setting = get_unaligned_le16(sent);
 500
 501         if (hdev->voice_setting == setting)
 502                 return;
 503
 504         hdev->voice_setting = setting;
 505
 506         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 507
 508         if (hdev->notify)
 509                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 510 }
 511
 512 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 513                                           struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 518
 519         if (rp->status)
 520                 return;
 521
 522         hdev->num_iac = rp->num_iac;
 523
 524         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 525 }
 526
 527 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 528 {
 529         __u8 status = *((__u8 *) skb->data);
 530         struct hci_cp_write_ssp_mode *sent;
 531
 532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 533
 534         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 535         if (!sent)
 536                 return;
 537
 538         hci_dev_lock(hdev);
 539
 540         if (!status) {
 541                 if (sent->mode)
 542                         hdev->features[1][0] |= LMP_HOST_SSP;
 543                 else
 544                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 545         }
 546
 547         if (hci_dev_test_flag(hdev, HCI_MGMT))
 548                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 549         else if (!status) {
 550                 if (sent->mode)
 551                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 552                 else
 553                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 554         }
 555
 556         hci_dev_unlock(hdev);
 557 }
 558
 559 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 560 {
 561         u8 status = *((u8 *) skb->data);
 562         struct hci_cp_write_sc_support *sent;
 563
 564         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 565
 566         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 567         if (!sent)
 568                 return;
 569
 570         hci_dev_lock(hdev);
 571
 572         if (!status) {
 573                 if (sent->support)
 574                         hdev->features[1][0] |= LMP_HOST_SC;
 575                 else
 576                         hdev->features[1][0] &= ~LMP_HOST_SC;
 577         }
 578
 579         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 580                 if (sent->support)
 581                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 582                 else
 583                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 584         }
 585
 586         hci_dev_unlock(hdev);
 587 }
 588
 589 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 590 {
 591         struct hci_rp_read_local_version *rp = (void *) skb->data;
 592
 593         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 594
 595         if (rp->status)
 596                 return;
 597
 598         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 599             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 600                 hdev->hci_ver = rp->hci_ver;
 601                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 602                 hdev->lmp_ver = rp->lmp_ver;
 603                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 604                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 605         }
 606 }
 607
 608 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 609                                        struct sk_buff *skb)
 610 {
 611         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 612
 613         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 614
 615         if (rp->status)
 616                 return;
 617
 618         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 619             hci_dev_test_flag(hdev, HCI_CONFIG))
 620                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 621 }
 622
 623 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 624                                              struct sk_buff *skb)
 625 {
 626         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 627         struct hci_conn *conn;
 628
 629         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 630
 631         if (rp->status)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 644                                               struct sk_buff *skb)
 645 {
 646         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 647         struct hci_conn *conn;
 648         void *sent;
 649
 650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 656         if (!sent)
 657                 return;
 658
 659         hci_dev_lock(hdev);
 660
 661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 662         if (conn)
 663                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 664
 665         hci_dev_unlock(hdev);
 666 }
 667
 668 static void hci_cc_read_local_features(struct hci_dev *hdev,
 669                                        struct sk_buff *skb)
 670 {
 671         struct hci_rp_read_local_features *rp = (void *) skb->data;
 672
 673         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 674
 675         if (rp->status)
 676                 return;
 677
 678         memcpy(hdev->features, rp->features, 8);
 679
 680         /* Adjust default settings according to features
 681          * supported by device. */
 682
 683         if (hdev->features[0][0] & LMP_3SLOT)
 684                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 685
 686         if (hdev->features[0][0] & LMP_5SLOT)
 687                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 688
 689         if (hdev->features[0][1] & LMP_HV2) {
 690                 hdev->pkt_type  |= (HCI_HV2);
 691                 hdev->esco_type |= (ESCO_HV2);
 692         }
 693
 694         if (hdev->features[0][1] & LMP_HV3) {
 695                 hdev->pkt_type  |= (HCI_HV3);
 696                 hdev->esco_type |= (ESCO_HV3);
 697         }
 698
 699         if (lmp_esco_capable(hdev))
 700                 hdev->esco_type |= (ESCO_EV3);
 701
 702         if (hdev->features[0][4] & LMP_EV4)
 703                 hdev->esco_type |= (ESCO_EV4);
 704
 705         if (hdev->features[0][4] & LMP_EV5)
 706                 hdev->esco_type |= (ESCO_EV5);
 707
 708         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 709                 hdev->esco_type |= (ESCO_2EV3);
 710
 711         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 712                 hdev->esco_type |= (ESCO_3EV3);
 713
 714         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 715                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 716 }
 717
 718 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 719                                            struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 return;
 727
 728         if (hdev->max_page < rp->max_page)
 729                 hdev->max_page = rp->max_page;
 730
 731         if (rp->page < HCI_MAX_PAGES)
 732                 memcpy(hdev->features[rp->page], rp->features, 8);
 733 }
 734
 735 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 736                                           struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 741
 742         if (rp->status)
 743                 return;
 744
 745         hdev->flow_ctl_mode = rp->mode;
 746 }
 747
 748 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 751
 752         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 753
 754         if (rp->status)
 755                 return;
 756
 757         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 758         hdev->sco_mtu  = rp->sco_mtu;
 759         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 760         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 761
 762         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 763                 hdev->sco_mtu  = 64;
 764                 hdev->sco_pkts = 8;
 765         }
 766
 767         hdev->acl_cnt = hdev->acl_pkts;
 768         hdev->sco_cnt = hdev->sco_pkts;
 769
 770         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 771                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 772 }
 773
 774 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         if (test_bit(HCI_INIT, &hdev->flags))
 784                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 785
 786         if (hci_dev_test_flag(hdev, HCI_SETUP))
 787                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 788 }
 789
 790 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 791                                            struct sk_buff *skb)
 792 {
 793         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 794
 795         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 796
 797         if (rp->status)
 798                 return;
 799
 800         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 801             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 802                 hdev->pairing_opts = rp->pairing_opts;
 803                 hdev->max_enc_key_size = rp->max_key_size;
 804         }
 805 }
 806
 807 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 808                                            struct sk_buff *skb)
 809 {
 810         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 811
 812         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 813
 814         if (rp->status)
 815                 return;
 816
 817         if (test_bit(HCI_INIT, &hdev->flags)) {
 818                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 819                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 820         }
 821 }
 822
 823 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 824                                             struct sk_buff *skb)
 825 {
 826         u8 status = *((u8 *) skb->data);
 827         struct hci_cp_write_page_scan_activity *sent;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 830
 831         if (status)
 832                 return;
 833
 834         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 835         if (!sent)
 836                 return;
 837
 838         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 839         hdev->page_scan_window = __le16_to_cpu(sent->window);
 840 }
 841
 842 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 843                                            struct sk_buff *skb)
 844 {
 845         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 846
 847         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 848
 849         if (rp->status)
 850                 return;
 851
 852         if (test_bit(HCI_INIT, &hdev->flags))
 853                 hdev->page_scan_type = rp->type;
 854 }
 855
 856 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 857                                         struct sk_buff *skb)
 858 {
 859         u8 status = *((u8 *) skb->data);
 860         u8 *type;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 863
 864         if (status)
 865                 return;
 866
 867         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 868         if (type)
 869                 hdev->page_scan_type = *type;
 870 }
 871
 872 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 873                                         struct sk_buff *skb)
 874 {
 875         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         if (rp->status)
 880                 return;
 881
 882         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 883         hdev->block_len = __le16_to_cpu(rp->block_len);
 884         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 885
 886         hdev->block_cnt = hdev->num_blocks;
 887
 888         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 889                hdev->block_cnt, hdev->block_len);
 890 }
 891
 892 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_read_clock *rp = (void *) skb->data;
 895         struct hci_cp_read_clock *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s", hdev->name);
 899
 900         if (skb->len < sizeof(*rp))
 901                 return;
 902
 903         if (rp->status)
 904                 return;
 905
 906         hci_dev_lock(hdev);
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 909         if (!cp)
 910                 goto unlock;
 911
 912         if (cp->which == 0x00) {
 913                 hdev->clock = le32_to_cpu(rp->clock);
 914                 goto unlock;
 915         }
 916
 917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 918         if (conn) {
 919                 conn->clock = le32_to_cpu(rp->clock);
 920                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 921         }
 922
 923 unlock:
 924         hci_dev_unlock(hdev);
 925 }
 926
 927 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 928                                        struct sk_buff *skb)
 929 {
 930         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 931
 932         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 933
 934         if (rp->status)
 935                 return;
 936
 937         hdev->amp_status = rp->amp_status;
 938         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 939         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 940         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 941         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 942         hdev->amp_type = rp->amp_type;
 943         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 944         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 945         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 946         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 947 }
 948
 949 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 950                                          struct sk_buff *skb)
 951 {
 952         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 953
 954         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 955
 956         if (rp->status)
 957                 return;
 958
 959         hdev->inq_tx_power = rp->tx_power;
 960 }
 961
 962 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 963                                                struct sk_buff *skb)
 964 {
 965         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 966
 967         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 968
 969         if (rp->status)
 970                 return;
 971
 972         hdev->err_data_reporting = rp->err_data_reporting;
 973 }
 974
 975 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 976                                                 struct sk_buff *skb)
 977 {
 978         __u8 status = *((__u8 *)skb->data);
 979         struct hci_cp_write_def_err_data_reporting *cp;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 982
 983         if (status)
 984                 return;
 985
 986         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 987         if (!cp)
 988                 return;
 989
 990         hdev->err_data_reporting = cp->err_data_reporting;
 991 }
 992
 993 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 994 {
 995         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 996         struct hci_cp_pin_code_reply *cp;
 997         struct hci_conn *conn;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (hci_dev_test_flag(hdev, HCI_MGMT))
1004                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1005
1006         if (rp->status)
1007                 goto unlock;
1008
1009         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1010         if (!cp)
1011                 goto unlock;
1012
1013         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1014         if (conn)
1015                 conn->pin_length = cp->pin_len;
1016
1017 unlock:
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1026
1027         hci_dev_lock(hdev);
1028
1029         if (hci_dev_test_flag(hdev, HCI_MGMT))
1030                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1031                                                  rp->status);
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1037                                        struct sk_buff *skb)
1038 {
1039         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1040
1041         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1042
1043         if (rp->status)
1044                 return;
1045
1046         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1047         hdev->le_pkts = rp->le_max_pkt;
1048
1049         hdev->le_cnt = hdev->le_pkts;
1050
1051         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1052 }
1053
1054 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1055                                           struct sk_buff *skb)
1056 {
1057         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         if (rp->status)
1062                 return;
1063
1064         memcpy(hdev->le_features, rp->features, 8);
1065 }
1066
1067 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1068                                         struct sk_buff *skb)
1069 {
1070         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1073
1074         if (rp->status)
1075                 return;
1076
1077         hdev->adv_tx_power = rp->tx_power;
1078 }
1079
1080 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1081 {
1082         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1083
1084         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1085
1086         hci_dev_lock(hdev);
1087
1088         if (hci_dev_test_flag(hdev, HCI_MGMT))
1089                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1090                                                  rp->status);
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1096                                           struct sk_buff *skb)
1097 {
1098         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1101
1102         hci_dev_lock(hdev);
1103
1104         if (hci_dev_test_flag(hdev, HCI_MGMT))
1105                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1106                                                      ACL_LINK, 0, rp->status);
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (hci_dev_test_flag(hdev, HCI_MGMT))
1120                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1121                                                  0, rp->status);
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1127                                           struct sk_buff *skb)
1128 {
1129         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1132
1133         hci_dev_lock(hdev);
1134
1135         if (hci_dev_test_flag(hdev, HCI_MGMT))
1136                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1137                                                      ACL_LINK, 0, rp->status);
1138
1139         hci_dev_unlock(hdev);
1140 }
1141
1142 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1143                                        struct sk_buff *skb)
1144 {
1145         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1146
1147         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1148 }
1149
1150 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1151                                            struct sk_buff *skb)
1152 {
1153         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1154
1155         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1156 }
1157
1158 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1159 {
1160         __u8 status = *((__u8 *) skb->data);
1161         bdaddr_t *sent;
1162
1163         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1164
1165         if (status)
1166                 return;
1167
1168         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1169         if (!sent)
1170                 return;
1171
1172         hci_dev_lock(hdev);
1173
1174         bacpy(&hdev->random_addr, sent);
1175
1176         if (!bacmp(&hdev->rpa, sent)) {
1177                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1178                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1179                                    secs_to_jiffies(hdev->rpa_timeout));
1180         }
1181
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1186 {
1187         __u8 status = *((__u8 *) skb->data);
1188         struct hci_cp_le_set_default_phy *cp;
1189
1190         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1191
1192         if (status)
1193                 return;
1194
1195         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1196         if (!cp)
1197                 return;
1198
1199         hci_dev_lock(hdev);
1200
1201         hdev->le_tx_def_phys = cp->tx_phys;
1202         hdev->le_rx_def_phys = cp->rx_phys;
1203
1204         hci_dev_unlock(hdev);
1205 }
1206
1207 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1208                                               struct sk_buff *skb)
1209 {
1210         __u8 status = *((__u8 *) skb->data);
1211         struct hci_cp_le_set_adv_set_rand_addr *cp;
1212         struct adv_info *adv;
1213
1214         if (status)
1215                 return;
1216
1217         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1218         /* Update only in case the adv instance since handle 0x00 shall be using
1219          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1220          * non-extended adverting.
1221          */
1222         if (!cp || !cp->handle)
1223                 return;
1224
1225         hci_dev_lock(hdev);
1226
1227         adv = hci_find_adv_instance(hdev, cp->handle);
1228         if (adv) {
1229                 bacpy(&adv->random_addr, &cp->bdaddr);
1230                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1231                         adv->rpa_expired = false;
1232                         queue_delayed_work(hdev->workqueue,
1233                                            &adv->rpa_expired_cb,
1234                                            secs_to_jiffies(hdev->rpa_timeout));
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1242                                           struct sk_buff *skb)
1243 {
1244         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1245
1246         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1247
1248         if (rp->status)
1249                 return;
1250
1251         hdev->min_le_tx_power = rp->min_le_tx_power;
1252         hdev->max_le_tx_power = rp->max_le_tx_power;
1253 }
1254
1255 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1256 {
1257         __u8 *sent, status = *((__u8 *) skb->data);
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1260
1261         if (status)
1262                 return;
1263
1264         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1265         if (!sent)
1266                 return;
1267
1268         hci_dev_lock(hdev);
1269
1270         /* If we're doing connection initiation as peripheral. Set a
1271          * timeout in case something goes wrong.
1272          */
1273         if (*sent) {
1274                 struct hci_conn *conn;
1275
1276                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1277
1278                 conn = hci_lookup_le_connect(hdev);
1279                 if (conn)
1280                         queue_delayed_work(hdev->workqueue,
1281                                            &conn->le_conn_timeout,
1282                                            conn->conn_timeout);
1283         } else {
1284                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1285         }
1286
1287         hci_dev_unlock(hdev);
1288 }
1289
1290 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1291                                          struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_set_ext_adv_enable *cp;
1294         struct hci_cp_ext_adv_set *set;
1295         __u8 status = *((__u8 *) skb->data);
1296         struct adv_info *adv = NULL, *n;
1297
1298         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1299
1300         if (status)
1301                 return;
1302
1303         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1304         if (!cp)
1305                 return;
1306
1307         set = (void *)cp->data;
1308
1309         hci_dev_lock(hdev);
1310
1311         if (cp->num_of_sets)
1312                 adv = hci_find_adv_instance(hdev, set->handle);
1313
1314         if (cp->enable) {
1315                 struct hci_conn *conn;
1316
1317                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1318
1319                 if (adv)
1320                         adv->enabled = true;
1321
1322                 conn = hci_lookup_le_connect(hdev);
1323                 if (conn)
1324                         queue_delayed_work(hdev->workqueue,
1325                                            &conn->le_conn_timeout,
1326                                            conn->conn_timeout);
1327         } else {
1328                 if (cp->num_of_sets) {
1329                         if (adv)
1330                                 adv->enabled = false;
1331
1332                         /* If just one instance was disabled check if there are
1333                          * any other instance enabled before clearing HCI_LE_ADV
1334                          */
1335                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1336                                                  list) {
1337                                 if (adv->enabled)
1338                                         goto unlock;
1339                         }
1340                 } else {
1341                         /* All instances shall be considered disabled */
1342                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1343                                                  list)
1344                                 adv->enabled = false;
1345                 }
1346
1347                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1348         }
1349
1350 unlock:
1351         hci_dev_unlock(hdev);
1352 }
1353
1354 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1355 {
1356         struct hci_cp_le_set_scan_param *cp;
1357         __u8 status = *((__u8 *) skb->data);
1358
1359         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1360
1361         if (status)
1362                 return;
1363
1364         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1365         if (!cp)
1366                 return;
1367
1368         hci_dev_lock(hdev);
1369
1370         hdev->le_scan_type = cp->type;
1371
1372         hci_dev_unlock(hdev);
1373 }
1374
1375 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1376                                          struct sk_buff *skb)
1377 {
1378         struct hci_cp_le_set_ext_scan_params *cp;
1379         __u8 status = *((__u8 *) skb->data);
1380         struct hci_cp_le_scan_phy_params *phy_param;
1381
1382         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1383
1384         if (status)
1385                 return;
1386
1387         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1388         if (!cp)
1389                 return;
1390
1391         phy_param = (void *)cp->data;
1392
1393         hci_dev_lock(hdev);
1394
1395         hdev->le_scan_type = phy_param->type;
1396
1397         hci_dev_unlock(hdev);
1398 }
1399
1400 static bool has_pending_adv_report(struct hci_dev *hdev)
1401 {
1402         struct discovery_state *d = &hdev->discovery;
1403
1404         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1405 }
1406
1407 static void clear_pending_adv_report(struct hci_dev *hdev)
1408 {
1409         struct discovery_state *d = &hdev->discovery;
1410
1411         bacpy(&d->last_adv_addr, BDADDR_ANY);
1412         d->last_adv_data_len = 0;
1413 }
1414
1415 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1416                                      u8 bdaddr_type, s8 rssi, u32 flags,
1417                                      u8 *data, u8 len)
1418 {
1419         struct discovery_state *d = &hdev->discovery;
1420
1421         if (len > HCI_MAX_AD_LENGTH)
1422                 return;
1423
1424         bacpy(&d->last_adv_addr, bdaddr);
1425         d->last_adv_addr_type = bdaddr_type;
1426         d->last_adv_rssi = rssi;
1427         d->last_adv_flags = flags;
1428         memcpy(d->last_adv_data, data, len);
1429         d->last_adv_data_len = len;
1430 }
1431
1432 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1433 {
1434         hci_dev_lock(hdev);
1435
1436         switch (enable) {
1437         case LE_SCAN_ENABLE:
1438                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1439                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1440                         clear_pending_adv_report(hdev);
1441                 break;
1442
1443         case LE_SCAN_DISABLE:
1444                 /* We do this here instead of when setting DISCOVERY_STOPPED
1445                  * since the latter would potentially require waiting for
1446                  * inquiry to stop too.
1447                  */
1448                 if (has_pending_adv_report(hdev)) {
1449                         struct discovery_state *d = &hdev->discovery;
1450
1451                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1452                                           d->last_adv_addr_type, NULL,
1453                                           d->last_adv_rssi, d->last_adv_flags,
1454                                           d->last_adv_data,
1455                                           d->last_adv_data_len, NULL, 0);
1456                 }
1457
1458                 /* Cancel this timer so that we don't try to disable scanning
1459                  * when it's already disabled.
1460                  */
1461                 cancel_delayed_work(&hdev->le_scan_disable);
1462
1463                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1464
1465                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1466                  * interrupted scanning due to a connect request. Mark
1467                  * therefore discovery as stopped. If this was not
1468                  * because of a connect request advertising might have
1469                  * been disabled because of active scanning, so
1470                  * re-enable it again if necessary.
1471                  */
1472                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1473 #ifndef TIZEN_BT /* The below line is kernel bug. */
1474                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1475 #else
1476                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1477 #endif
1478                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1479                          hdev->discovery.state == DISCOVERY_FINDING)
1480                         hci_req_reenable_advertising(hdev);
1481
1482                 break;
1483
1484         default:
1485                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1486                            enable);
1487                 break;
1488         }
1489
1490         hci_dev_unlock(hdev);
1491 }
1492
1493 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1494                                       struct sk_buff *skb)
1495 {
1496         struct hci_cp_le_set_scan_enable *cp;
1497         __u8 status = *((__u8 *) skb->data);
1498
1499         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1500
1501         if (status)
1502                 return;
1503
1504         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1505         if (!cp)
1506                 return;
1507
1508         le_set_scan_enable_complete(hdev, cp->enable);
1509 }
1510
1511 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1512                                       struct sk_buff *skb)
1513 {
1514         struct hci_cp_le_set_ext_scan_enable *cp;
1515         __u8 status = *((__u8 *) skb->data);
1516
1517         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1518
1519         if (status)
1520                 return;
1521
1522         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1523         if (!cp)
1524                 return;
1525
1526         le_set_scan_enable_complete(hdev, cp->enable);
1527 }
1528
1529 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1530                                       struct sk_buff *skb)
1531 {
1532         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1533
1534         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1535                rp->num_of_sets);
1536
1537         if (rp->status)
1538                 return;
1539
1540         hdev->le_num_of_adv_sets = rp->num_of_sets;
1541 }
1542
1543 static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1544                                             struct sk_buff *skb)
1545 {
1546         struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1547
1548         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1549
1550         if (rp->status)
1551                 return;
1552
1553         hdev->le_accept_list_size = rp->size;
1554 }
1555
1556 static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1557                                         struct sk_buff *skb)
1558 {
1559         __u8 status = *((__u8 *) skb->data);
1560
1561         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1562
1563         if (status)
1564                 return;
1565
1566         hci_dev_lock(hdev);
1567         hci_bdaddr_list_clear(&hdev->le_accept_list);
1568         hci_dev_unlock(hdev);
1569 }
1570
1571 static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1572                                          struct sk_buff *skb)
1573 {
1574         struct hci_cp_le_add_to_accept_list *sent;
1575         __u8 status = *((__u8 *) skb->data);
1576
1577         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1578
1579         if (status)
1580                 return;
1581
1582         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1583         if (!sent)
1584                 return;
1585
1586         hci_dev_lock(hdev);
1587         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1588                             sent->bdaddr_type);
1589         hci_dev_unlock(hdev);
1590 }
1591
1592 static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1593                                            struct sk_buff *skb)
1594 {
1595         struct hci_cp_le_del_from_accept_list *sent;
1596         __u8 status = *((__u8 *) skb->data);
1597
1598         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1599
1600         if (status)
1601                 return;
1602
1603         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1604         if (!sent)
1605                 return;
1606
1607         hci_dev_lock(hdev);
1608         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1609                             sent->bdaddr_type);
1610         hci_dev_unlock(hdev);
1611 }
1612
1613 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1614                                             struct sk_buff *skb)
1615 {
1616         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1617
1618         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1619
1620         if (rp->status)
1621                 return;
1622
1623         memcpy(hdev->le_states, rp->le_states, 8);
1624 }
1625
1626 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1627                                         struct sk_buff *skb)
1628 {
1629         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1630
1631         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1632
1633         if (rp->status)
1634                 return;
1635
1636         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1637         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1638 }
1639
1640 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1641                                          struct sk_buff *skb)
1642 {
1643         struct hci_cp_le_write_def_data_len *sent;
1644         __u8 status = *((__u8 *) skb->data);
1645
1646         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1647
1648         if (status)
1649                 return;
1650
1651         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1652         if (!sent)
1653                 return;
1654
1655         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1656         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1657 }
1658
1659 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1660                                          struct sk_buff *skb)
1661 {
1662         struct hci_cp_le_add_to_resolv_list *sent;
1663         __u8 status = *((__u8 *) skb->data);
1664
1665         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1666
1667         if (status)
1668                 return;
1669
1670         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1671         if (!sent)
1672                 return;
1673
1674         hci_dev_lock(hdev);
1675         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1676                                 sent->bdaddr_type, sent->peer_irk,
1677                                 sent->local_irk);
1678         hci_dev_unlock(hdev);
1679 }
1680
1681 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1682                                           struct sk_buff *skb)
1683 {
1684         struct hci_cp_le_del_from_resolv_list *sent;
1685         __u8 status = *((__u8 *) skb->data);
1686
1687         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1688
1689         if (status)
1690                 return;
1691
1692         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1693         if (!sent)
1694                 return;
1695
1696         hci_dev_lock(hdev);
1697         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1698                             sent->bdaddr_type);
1699         hci_dev_unlock(hdev);
1700 }
1701
1702 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1703                                        struct sk_buff *skb)
1704 {
1705         __u8 status = *((__u8 *) skb->data);
1706
1707         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1708
1709         if (status)
1710                 return;
1711
1712         hci_dev_lock(hdev);
1713         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1714         hci_dev_unlock(hdev);
1715 }
1716
1717 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1718                                            struct sk_buff *skb)
1719 {
1720         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1721
1722         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1723
1724         if (rp->status)
1725                 return;
1726
1727         hdev->le_resolv_list_size = rp->size;
1728 }
1729
1730 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1731                                                 struct sk_buff *skb)
1732 {
1733         __u8 *sent, status = *((__u8 *) skb->data);
1734
1735         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1736
1737         if (status)
1738                 return;
1739
1740         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1741         if (!sent)
1742                 return;
1743
1744         hci_dev_lock(hdev);
1745
1746         if (*sent)
1747                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1748         else
1749                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1750
1751         hci_dev_unlock(hdev);
1752 }
1753
1754 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1755                                         struct sk_buff *skb)
1756 {
1757         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1758
1759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1760
1761         if (rp->status)
1762                 return;
1763
1764         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1765         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1766         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1767         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1768 }
1769
1770 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1771                                            struct sk_buff *skb)
1772 {
1773         struct hci_cp_write_le_host_supported *sent;
1774         __u8 status = *((__u8 *) skb->data);
1775
1776         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1777
1778         if (status)
1779                 return;
1780
1781         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1782         if (!sent)
1783                 return;
1784
1785         hci_dev_lock(hdev);
1786
1787         if (sent->le) {
1788                 hdev->features[1][0] |= LMP_HOST_LE;
1789                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1790         } else {
1791                 hdev->features[1][0] &= ~LMP_HOST_LE;
1792                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1793                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1794         }
1795
1796         if (sent->simul)
1797                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1798         else
1799                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1800
1801         hci_dev_unlock(hdev);
1802 }
1803
1804 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1805 {
1806         struct hci_cp_le_set_adv_param *cp;
1807         u8 status = *((u8 *) skb->data);
1808
1809         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1810
1811         if (status)
1812                 return;
1813
1814         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1815         if (!cp)
1816                 return;
1817
1818         hci_dev_lock(hdev);
1819         hdev->adv_addr_type = cp->own_address_type;
1820         hci_dev_unlock(hdev);
1821 }
1822
1823 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1824 {
1825         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1826         struct hci_cp_le_set_ext_adv_params *cp;
1827         struct adv_info *adv_instance;
1828
1829         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1830
1831         if (rp->status)
1832                 return;
1833
1834         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1835         if (!cp)
1836                 return;
1837
1838         hci_dev_lock(hdev);
1839         hdev->adv_addr_type = cp->own_addr_type;
1840         if (!cp->handle) {
1841                 /* Store in hdev for instance 0 */
1842                 hdev->adv_tx_power = rp->tx_power;
1843         } else {
1844                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
1845                 if (adv_instance)
1846                         adv_instance->tx_power = rp->tx_power;
1847         }
1848         /* Update adv data as tx power is known now */
1849         hci_req_update_adv_data(hdev, cp->handle);
1850
1851         hci_dev_unlock(hdev);
1852 }
1853
1854 #ifdef TIZEN_BT
1855 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1856                                           struct sk_buff *skb)
1857 {
1858         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1859
1860         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1861                hdev->name, rp->status, rp->le_ext_opcode);
1862
1863         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1864 }
1865
1866 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1867                                           struct sk_buff *skb)
1868 {
1869         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1870
1871         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1872                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1873
1874         mgmt_raw_rssi_response(hdev, rp, rp->status);
1875 }
1876 #endif
1877
1878 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1879 {
1880         struct hci_rp_read_rssi *rp = (void *) skb->data;
1881         struct hci_conn *conn;
1882
1883         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1884
1885         if (rp->status)
1886                 return;
1887
1888         hci_dev_lock(hdev);
1889
1890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1891         if (conn)
1892                 conn->rssi = rp->rssi;
1893
1894         hci_dev_unlock(hdev);
1895 }
1896
1897 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1898 {
1899         struct hci_cp_read_tx_power *sent;
1900         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1901         struct hci_conn *conn;
1902
1903         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1904
1905         if (rp->status)
1906                 return;
1907
1908         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1909         if (!sent)
1910                 return;
1911
1912         hci_dev_lock(hdev);
1913
1914         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1915         if (!conn)
1916                 goto unlock;
1917
1918         switch (sent->type) {
1919         case 0x00:
1920                 conn->tx_power = rp->tx_power;
1921                 break;
1922         case 0x01:
1923                 conn->max_tx_power = rp->tx_power;
1924                 break;
1925         }
1926
1927 unlock:
1928         hci_dev_unlock(hdev);
1929 }
1930
1931 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1932 {
1933         u8 status = *((u8 *) skb->data);
1934         u8 *mode;
1935
1936         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1937
1938         if (status)
1939                 return;
1940
1941         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1942         if (mode)
1943                 hdev->ssp_debug_mode = *mode;
1944 }
1945
1946 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1947 {
1948         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1949
1950         if (status) {
1951                 hci_conn_check_pending(hdev);
1952                 return;
1953         }
1954
1955         set_bit(HCI_INQUIRY, &hdev->flags);
1956 }
1957
1958 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1959 {
1960         struct hci_cp_create_conn *cp;
1961         struct hci_conn *conn;
1962
1963         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1964
1965         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1966         if (!cp)
1967                 return;
1968
1969         hci_dev_lock(hdev);
1970
1971         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1972
1973         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1974
1975         if (status) {
1976                 if (conn && conn->state == BT_CONNECT) {
1977                         if (status != 0x0c || conn->attempt > 2) {
1978                                 conn->state = BT_CLOSED;
1979                                 hci_connect_cfm(conn, status);
1980                                 hci_conn_del(conn);
1981                         } else
1982                                 conn->state = BT_CONNECT2;
1983                 }
1984         } else {
1985                 if (!conn) {
1986                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1987                                             HCI_ROLE_MASTER);
1988                         if (!conn)
1989                                 bt_dev_err(hdev, "no memory for new connection");
1990                 }
1991         }
1992
1993         hci_dev_unlock(hdev);
1994 }
1995
1996 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1997 {
1998         struct hci_cp_add_sco *cp;
1999         struct hci_conn *acl, *sco;
2000         __u16 handle;
2001
2002         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2003
2004         if (!status)
2005                 return;
2006
2007         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2008         if (!cp)
2009                 return;
2010
2011         handle = __le16_to_cpu(cp->handle);
2012
2013         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2014
2015         hci_dev_lock(hdev);
2016
2017         acl = hci_conn_hash_lookup_handle(hdev, handle);
2018         if (acl) {
2019                 sco = acl->link;
2020                 if (sco) {
2021                         sco->state = BT_CLOSED;
2022
2023                         hci_connect_cfm(sco, status);
2024                         hci_conn_del(sco);
2025                 }
2026         }
2027
2028         hci_dev_unlock(hdev);
2029 }
2030
2031 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2032 {
2033         struct hci_cp_auth_requested *cp;
2034         struct hci_conn *conn;
2035
2036         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2037
2038         if (!status)
2039                 return;
2040
2041         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2042         if (!cp)
2043                 return;
2044
2045         hci_dev_lock(hdev);
2046
2047         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2048         if (conn) {
2049                 if (conn->state == BT_CONFIG) {
2050                         hci_connect_cfm(conn, status);
2051                         hci_conn_drop(conn);
2052                 }
2053         }
2054
2055         hci_dev_unlock(hdev);
2056 }
2057
2058 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2059 {
2060         struct hci_cp_set_conn_encrypt *cp;
2061         struct hci_conn *conn;
2062
2063         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2064
2065         if (!status)
2066                 return;
2067
2068         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2069         if (!cp)
2070                 return;
2071
2072         hci_dev_lock(hdev);
2073
2074         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2075         if (conn) {
2076                 if (conn->state == BT_CONFIG) {
2077                         hci_connect_cfm(conn, status);
2078                         hci_conn_drop(conn);
2079                 }
2080         }
2081
2082         hci_dev_unlock(hdev);
2083 }
2084
2085 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2086                                     struct hci_conn *conn)
2087 {
2088         if (conn->state != BT_CONFIG || !conn->out)
2089                 return 0;
2090
2091         if (conn->pending_sec_level == BT_SECURITY_SDP)
2092                 return 0;
2093
2094         /* Only request authentication for SSP connections or non-SSP
2095          * devices with sec_level MEDIUM or HIGH or if MITM protection
2096          * is requested.
2097          */
2098         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2099             conn->pending_sec_level != BT_SECURITY_FIPS &&
2100             conn->pending_sec_level != BT_SECURITY_HIGH &&
2101             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2102                 return 0;
2103
2104         return 1;
2105 }
2106
2107 static int hci_resolve_name(struct hci_dev *hdev,
2108                                    struct inquiry_entry *e)
2109 {
2110         struct hci_cp_remote_name_req cp;
2111
2112         memset(&cp, 0, sizeof(cp));
2113
2114         bacpy(&cp.bdaddr, &e->data.bdaddr);
2115         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2116         cp.pscan_mode = e->data.pscan_mode;
2117         cp.clock_offset = e->data.clock_offset;
2118
2119         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2120 }
2121
2122 static bool hci_resolve_next_name(struct hci_dev *hdev)
2123 {
2124         struct discovery_state *discov = &hdev->discovery;
2125         struct inquiry_entry *e;
2126
2127         if (list_empty(&discov->resolve))
2128                 return false;
2129
2130         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2131         if (!e)
2132                 return false;
2133
2134         if (hci_resolve_name(hdev, e) == 0) {
2135                 e->name_state = NAME_PENDING;
2136                 return true;
2137         }
2138
2139         return false;
2140 }
2141
2142 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2143                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2144 {
2145         struct discovery_state *discov = &hdev->discovery;
2146         struct inquiry_entry *e;
2147
2148 #ifdef TIZEN_BT
2149         /* Update the mgmt connected state if necessary. Be careful with
2150          * conn objects that exist but are not (yet) connected however.
2151          * Only those in BT_CONFIG or BT_CONNECTED states can be
2152          * considered connected.
2153          */
2154         if (conn &&
2155             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2156                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2157                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2158                 else
2159                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2160         }
2161 #else
2162         if (conn &&
2163             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2164             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2165                 mgmt_device_connected(hdev, conn, name, name_len);
2166 #endif
2167
2168         if (discov->state == DISCOVERY_STOPPED)
2169                 return;
2170
2171         if (discov->state == DISCOVERY_STOPPING)
2172                 goto discov_complete;
2173
2174         if (discov->state != DISCOVERY_RESOLVING)
2175                 return;
2176
2177         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2178         /* If the device was not found in a list of found devices names of which
2179          * are pending. there is no need to continue resolving a next name as it
2180          * will be done upon receiving another Remote Name Request Complete
2181          * Event */
2182         if (!e)
2183                 return;
2184
2185         list_del(&e->list);
2186         if (name) {
2187                 e->name_state = NAME_KNOWN;
2188                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2189                                  e->data.rssi, name, name_len);
2190         } else {
2191                 e->name_state = NAME_NOT_KNOWN;
2192         }
2193
2194         if (hci_resolve_next_name(hdev))
2195                 return;
2196
2197 discov_complete:
2198         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2199 }
2200
2201 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2202 {
2203         struct hci_cp_remote_name_req *cp;
2204         struct hci_conn *conn;
2205
2206         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2207
2208         /* If successful wait for the name req complete event before
2209          * checking for the need to do authentication */
2210         if (!status)
2211                 return;
2212
2213         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2214         if (!cp)
2215                 return;
2216
2217         hci_dev_lock(hdev);
2218
2219         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2220
2221         if (hci_dev_test_flag(hdev, HCI_MGMT))
2222                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2223
2224         if (!conn)
2225                 goto unlock;
2226
2227         if (!hci_outgoing_auth_needed(hdev, conn))
2228                 goto unlock;
2229
2230         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2231                 struct hci_cp_auth_requested auth_cp;
2232
2233                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2234
2235                 auth_cp.handle = __cpu_to_le16(conn->handle);
2236                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2237                              sizeof(auth_cp), &auth_cp);
2238         }
2239
2240 unlock:
2241         hci_dev_unlock(hdev);
2242 }
2243
2244 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2245 {
2246         struct hci_cp_read_remote_features *cp;
2247         struct hci_conn *conn;
2248
2249         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2250
2251         if (!status)
2252                 return;
2253
2254         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2255         if (!cp)
2256                 return;
2257
2258         hci_dev_lock(hdev);
2259
2260         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2261         if (conn) {
2262                 if (conn->state == BT_CONFIG) {
2263                         hci_connect_cfm(conn, status);
2264                         hci_conn_drop(conn);
2265                 }
2266         }
2267
2268         hci_dev_unlock(hdev);
2269 }
2270
2271 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2272 {
2273         struct hci_cp_read_remote_ext_features *cp;
2274         struct hci_conn *conn;
2275
2276         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2277
2278         if (!status)
2279                 return;
2280
2281         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2282         if (!cp)
2283                 return;
2284
2285         hci_dev_lock(hdev);
2286
2287         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2288         if (conn) {
2289                 if (conn->state == BT_CONFIG) {
2290                         hci_connect_cfm(conn, status);
2291                         hci_conn_drop(conn);
2292                 }
2293         }
2294
2295         hci_dev_unlock(hdev);
2296 }
2297
2298 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2299 {
2300         struct hci_cp_setup_sync_conn *cp;
2301         struct hci_conn *acl, *sco;
2302         __u16 handle;
2303
2304         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2305
2306         if (!status)
2307                 return;
2308
2309         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2310         if (!cp)
2311                 return;
2312
2313         handle = __le16_to_cpu(cp->handle);
2314
2315         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2316
2317         hci_dev_lock(hdev);
2318
2319         acl = hci_conn_hash_lookup_handle(hdev, handle);
2320         if (acl) {
2321                 sco = acl->link;
2322                 if (sco) {
2323                         sco->state = BT_CLOSED;
2324
2325                         hci_connect_cfm(sco, status);
2326                         hci_conn_del(sco);
2327                 }
2328         }
2329
2330         hci_dev_unlock(hdev);
2331 }
2332
2333 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2334 {
2335         struct hci_cp_sniff_mode *cp;
2336         struct hci_conn *conn;
2337
2338         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2339
2340         if (!status)
2341                 return;
2342
2343         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2344         if (!cp)
2345                 return;
2346
2347         hci_dev_lock(hdev);
2348
2349         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2350         if (conn) {
2351                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2352
2353                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2354                         hci_sco_setup(conn, status);
2355         }
2356
2357         hci_dev_unlock(hdev);
2358 }
2359
2360 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2361 {
2362         struct hci_cp_exit_sniff_mode *cp;
2363         struct hci_conn *conn;
2364
2365         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2366
2367         if (!status)
2368                 return;
2369
2370         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2371         if (!cp)
2372                 return;
2373
2374         hci_dev_lock(hdev);
2375
2376         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2377         if (conn) {
2378                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2379
2380                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2381                         hci_sco_setup(conn, status);
2382         }
2383
2384         hci_dev_unlock(hdev);
2385 }
2386
2387 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2388 {
2389         struct hci_cp_disconnect *cp;
2390         struct hci_conn *conn;
2391
2392         if (!status)
2393                 return;
2394
2395         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2396         if (!cp)
2397                 return;
2398
2399         hci_dev_lock(hdev);
2400
2401         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2402         if (conn) {
2403                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2404                                        conn->dst_type, status);
2405
2406                 if (conn->type == LE_LINK) {
2407                         hdev->cur_adv_instance = conn->adv_instance;
2408                         hci_req_reenable_advertising(hdev);
2409                 }
2410
2411                 /* If the disconnection failed for any reason, the upper layer
2412                  * does not retry to disconnect in current implementation.
2413                  * Hence, we need to do some basic cleanup here and re-enable
2414                  * advertising if necessary.
2415                  */
2416                 hci_conn_del(conn);
2417         }
2418
2419         hci_dev_unlock(hdev);
2420 }
2421
2422 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2423                               u8 peer_addr_type, u8 own_address_type,
2424                               u8 filter_policy)
2425 {
2426         struct hci_conn *conn;
2427
2428         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2429                                        peer_addr_type);
2430         if (!conn)
2431                 return;
2432
2433         /* When using controller based address resolution, then the new
2434          * address types 0x02 and 0x03 are used. These types need to be
2435          * converted back into either public address or random address type
2436          */
2437         if (use_ll_privacy(hdev) &&
2438             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2439                 switch (own_address_type) {
2440                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2441                         own_address_type = ADDR_LE_DEV_PUBLIC;
2442                         break;
2443                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2444                         own_address_type = ADDR_LE_DEV_RANDOM;
2445                         break;
2446                 }
2447         }
2448
2449         /* Store the initiator and responder address information which
2450          * is needed for SMP. These values will not change during the
2451          * lifetime of the connection.
2452          */
2453         conn->init_addr_type = own_address_type;
2454         if (own_address_type == ADDR_LE_DEV_RANDOM)
2455                 bacpy(&conn->init_addr, &hdev->random_addr);
2456         else
2457                 bacpy(&conn->init_addr, &hdev->bdaddr);
2458
2459         conn->resp_addr_type = peer_addr_type;
2460         bacpy(&conn->resp_addr, peer_addr);
2461
2462         /* We don't want the connection attempt to stick around
2463          * indefinitely since LE doesn't have a page timeout concept
2464          * like BR/EDR. Set a timer for any connection that doesn't use
2465          * the accept list for connecting.
2466          */
2467         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2468                 queue_delayed_work(conn->hdev->workqueue,
2469                                    &conn->le_conn_timeout,
2470                                    conn->conn_timeout);
2471 }
2472
2473 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2474 {
2475         struct hci_cp_le_create_conn *cp;
2476
2477         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2478
2479         /* All connection failure handling is taken care of by the
2480          * hci_le_conn_failed function which is triggered by the HCI
2481          * request completion callbacks used for connecting.
2482          */
2483         if (status)
2484                 return;
2485
2486         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2487         if (!cp)
2488                 return;
2489
2490         hci_dev_lock(hdev);
2491
2492         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2493                           cp->own_address_type, cp->filter_policy);
2494
2495         hci_dev_unlock(hdev);
2496 }
2497
2498 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2499 {
2500         struct hci_cp_le_ext_create_conn *cp;
2501
2502         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2503
2504         /* All connection failure handling is taken care of by the
2505          * hci_le_conn_failed function which is triggered by the HCI
2506          * request completion callbacks used for connecting.
2507          */
2508         if (status)
2509                 return;
2510
2511         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2512         if (!cp)
2513                 return;
2514
2515         hci_dev_lock(hdev);
2516
2517         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2518                           cp->own_addr_type, cp->filter_policy);
2519
2520         hci_dev_unlock(hdev);
2521 }
2522
2523 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2524 {
2525         struct hci_cp_le_read_remote_features *cp;
2526         struct hci_conn *conn;
2527
2528         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2529
2530         if (!status)
2531                 return;
2532
2533         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2534         if (!cp)
2535                 return;
2536
2537         hci_dev_lock(hdev);
2538
2539         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2540         if (conn) {
2541                 if (conn->state == BT_CONFIG) {
2542                         hci_connect_cfm(conn, status);
2543                         hci_conn_drop(conn);
2544                 }
2545         }
2546
2547         hci_dev_unlock(hdev);
2548 }
2549
2550 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2551 {
2552         struct hci_cp_le_start_enc *cp;
2553         struct hci_conn *conn;
2554
2555         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2556
2557         if (!status)
2558                 return;
2559
2560         hci_dev_lock(hdev);
2561
2562         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2563         if (!cp)
2564                 goto unlock;
2565
2566         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2567         if (!conn)
2568                 goto unlock;
2569
2570         if (conn->state != BT_CONNECTED)
2571                 goto unlock;
2572
2573         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2574         hci_conn_drop(conn);
2575
2576 unlock:
2577         hci_dev_unlock(hdev);
2578 }
2579
2580 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2581 {
2582         struct hci_cp_switch_role *cp;
2583         struct hci_conn *conn;
2584
2585         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2586
2587         if (!status)
2588                 return;
2589
2590         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2591         if (!cp)
2592                 return;
2593
2594         hci_dev_lock(hdev);
2595
2596         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2597         if (conn)
2598                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2599
2600         hci_dev_unlock(hdev);
2601 }
2602
2603 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2604 {
2605         __u8 status = *((__u8 *) skb->data);
2606         struct discovery_state *discov = &hdev->discovery;
2607         struct inquiry_entry *e;
2608
2609         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2610
2611         hci_conn_check_pending(hdev);
2612
2613         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2614                 return;
2615
2616         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2617         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2618
2619         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2620                 return;
2621
2622         hci_dev_lock(hdev);
2623
2624         if (discov->state != DISCOVERY_FINDING)
2625                 goto unlock;
2626
2627         if (list_empty(&discov->resolve)) {
2628                 /* When BR/EDR inquiry is active and no LE scanning is in
2629                  * progress, then change discovery state to indicate completion.
2630                  *
2631                  * When running LE scanning and BR/EDR inquiry simultaneously
2632                  * and the LE scan already finished, then change the discovery
2633                  * state to indicate completion.
2634                  */
2635                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2636                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2637                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2638                 goto unlock;
2639         }
2640
2641         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2642         if (e && hci_resolve_name(hdev, e) == 0) {
2643                 e->name_state = NAME_PENDING;
2644                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2645         } else {
2646                 /* When BR/EDR inquiry is active and no LE scanning is in
2647                  * progress, then change discovery state to indicate completion.
2648                  *
2649                  * When running LE scanning and BR/EDR inquiry simultaneously
2650                  * and the LE scan already finished, then change the discovery
2651                  * state to indicate completion.
2652                  */
2653                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2654                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2655                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2656         }
2657
2658 unlock:
2659         hci_dev_unlock(hdev);
2660 }
2661
2662 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2663 {
2664         struct inquiry_data data;
2665         struct inquiry_info *info = (void *) (skb->data + 1);
2666         int num_rsp = *((__u8 *) skb->data);
2667
2668         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2669
2670         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2671                 return;
2672
2673         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2674                 return;
2675
2676         hci_dev_lock(hdev);
2677
2678         for (; num_rsp; num_rsp--, info++) {
2679                 u32 flags;
2680
2681                 bacpy(&data.bdaddr, &info->bdaddr);
2682                 data.pscan_rep_mode     = info->pscan_rep_mode;
2683                 data.pscan_period_mode  = info->pscan_period_mode;
2684                 data.pscan_mode         = info->pscan_mode;
2685                 memcpy(data.dev_class, info->dev_class, 3);
2686                 data.clock_offset       = info->clock_offset;
2687                 data.rssi               = HCI_RSSI_INVALID;
2688                 data.ssp_mode           = 0x00;
2689
2690                 flags = hci_inquiry_cache_update(hdev, &data, false);
2691
2692                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2693                                   info->dev_class, HCI_RSSI_INVALID,
2694                                   flags, NULL, 0, NULL, 0);
2695         }
2696
2697         hci_dev_unlock(hdev);
2698 }
2699
2700 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2701 {
2702         struct hci_ev_conn_complete *ev = (void *) skb->data;
2703         struct hci_conn *conn;
2704
2705         BT_DBG("%s", hdev->name);
2706
2707         hci_dev_lock(hdev);
2708
2709         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2710         if (!conn) {
2711                 /* Connection may not exist if auto-connected. Check the bredr
2712                  * allowlist to see if this device is allowed to auto connect.
2713                  * If link is an ACL type, create a connection class
2714                  * automatically.
2715                  *
2716                  * Auto-connect will only occur if the event filter is
2717                  * programmed with a given address. Right now, event filter is
2718                  * only used during suspend.
2719                  */
2720                 if (ev->link_type == ACL_LINK &&
2721                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2722                                                       &ev->bdaddr,
2723                                                       BDADDR_BREDR)) {
2724                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2725                                             HCI_ROLE_SLAVE);
2726                         if (!conn) {
2727                                 bt_dev_err(hdev, "no memory for new conn");
2728                                 goto unlock;
2729                         }
2730                 } else {
2731                         if (ev->link_type != SCO_LINK)
2732                                 goto unlock;
2733
2734                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2735                                                        &ev->bdaddr);
2736                         if (!conn)
2737                                 goto unlock;
2738
2739                         conn->type = SCO_LINK;
2740                 }
2741         }
2742
2743         if (!ev->status) {
2744                 conn->handle = __le16_to_cpu(ev->handle);
2745
2746                 if (conn->type == ACL_LINK) {
2747                         conn->state = BT_CONFIG;
2748                         hci_conn_hold(conn);
2749
2750                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2751                             !hci_find_link_key(hdev, &ev->bdaddr))
2752                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2753                         else
2754                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2755                 } else
2756                         conn->state = BT_CONNECTED;
2757
2758                 hci_debugfs_create_conn(conn);
2759                 hci_conn_add_sysfs(conn);
2760
2761                 if (test_bit(HCI_AUTH, &hdev->flags))
2762                         set_bit(HCI_CONN_AUTH, &conn->flags);
2763
2764                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2765                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2766
2767                 /* Get remote features */
2768                 if (conn->type == ACL_LINK) {
2769                         struct hci_cp_read_remote_features cp;
2770                         cp.handle = ev->handle;
2771                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2772                                      sizeof(cp), &cp);
2773
2774                         hci_req_update_scan(hdev);
2775                 }
2776
2777                 /* Set packet type for incoming connection */
2778                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2779                         struct hci_cp_change_conn_ptype cp;
2780                         cp.handle = ev->handle;
2781                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2782                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2783                                      &cp);
2784                 }
2785         } else {
2786                 conn->state = BT_CLOSED;
2787                 if (conn->type == ACL_LINK)
2788                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2789                                             conn->dst_type, ev->status);
2790         }
2791
2792         if (conn->type == ACL_LINK)
2793                 hci_sco_setup(conn, ev->status);
2794
2795         if (ev->status) {
2796                 hci_connect_cfm(conn, ev->status);
2797                 hci_conn_del(conn);
2798         } else if (ev->link_type == SCO_LINK) {
2799                 switch (conn->setting & SCO_AIRMODE_MASK) {
2800                 case SCO_AIRMODE_CVSD:
2801                         if (hdev->notify)
2802                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2803                         break;
2804                 }
2805
2806                 hci_connect_cfm(conn, ev->status);
2807         }
2808
2809 unlock:
2810         hci_dev_unlock(hdev);
2811
2812         hci_conn_check_pending(hdev);
2813 }
2814
2815 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2816 {
2817         struct hci_cp_reject_conn_req cp;
2818
2819         bacpy(&cp.bdaddr, bdaddr);
2820         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2821         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2822 }
2823
2824 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2825 {
2826         struct hci_ev_conn_request *ev = (void *) skb->data;
2827         int mask = hdev->link_mode;
2828         struct inquiry_entry *ie;
2829         struct hci_conn *conn;
2830         __u8 flags = 0;
2831
2832         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2833                ev->link_type);
2834
2835         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2836                                       &flags);
2837
2838         if (!(mask & HCI_LM_ACCEPT)) {
2839                 hci_reject_conn(hdev, &ev->bdaddr);
2840                 return;
2841         }
2842
2843         hci_dev_lock(hdev);
2844
2845         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2846                                    BDADDR_BREDR)) {
2847                 hci_reject_conn(hdev, &ev->bdaddr);
2848                 goto unlock;
2849         }
2850
2851         /* Require HCI_CONNECTABLE or an accept list entry to accept the
2852          * connection. These features are only touched through mgmt so
2853          * only do the checks if HCI_MGMT is set.
2854          */
2855         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2856             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2857             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2858                                                BDADDR_BREDR)) {
2859                 hci_reject_conn(hdev, &ev->bdaddr);
2860                 goto unlock;
2861         }
2862
2863         /* Connection accepted */
2864
2865         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2866         if (ie)
2867                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2868
2869         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2870                         &ev->bdaddr);
2871         if (!conn) {
2872                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2873                                     HCI_ROLE_SLAVE);
2874                 if (!conn) {
2875                         bt_dev_err(hdev, "no memory for new connection");
2876                         goto unlock;
2877                 }
2878         }
2879
2880         memcpy(conn->dev_class, ev->dev_class, 3);
2881
2882         hci_dev_unlock(hdev);
2883
2884         if (ev->link_type == ACL_LINK ||
2885             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2886                 struct hci_cp_accept_conn_req cp;
2887                 conn->state = BT_CONNECT;
2888
2889                 bacpy(&cp.bdaddr, &ev->bdaddr);
2890
2891                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2892                         cp.role = 0x00; /* Become central */
2893                 else
2894                         cp.role = 0x01; /* Remain peripheral */
2895
2896                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2897         } else if (!(flags & HCI_PROTO_DEFER)) {
2898                 struct hci_cp_accept_sync_conn_req cp;
2899                 conn->state = BT_CONNECT;
2900
2901                 bacpy(&cp.bdaddr, &ev->bdaddr);
2902                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2903
2904                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2905                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2906                 cp.max_latency    = cpu_to_le16(0xffff);
2907                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2908                 cp.retrans_effort = 0xff;
2909
2910                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2911                              &cp);
2912         } else {
2913                 conn->state = BT_CONNECT2;
2914                 hci_connect_cfm(conn, 0);
2915         }
2916
2917         return;
2918 unlock:
2919         hci_dev_unlock(hdev);
2920 }
2921
2922 static u8 hci_to_mgmt_reason(u8 err)
2923 {
2924         switch (err) {
2925         case HCI_ERROR_CONNECTION_TIMEOUT:
2926                 return MGMT_DEV_DISCONN_TIMEOUT;
2927         case HCI_ERROR_REMOTE_USER_TERM:
2928         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2929         case HCI_ERROR_REMOTE_POWER_OFF:
2930                 return MGMT_DEV_DISCONN_REMOTE;
2931         case HCI_ERROR_LOCAL_HOST_TERM:
2932                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2933         default:
2934                 return MGMT_DEV_DISCONN_UNKNOWN;
2935         }
2936 }
2937
2938 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2939 {
2940         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2941         u8 reason;
2942         struct hci_conn_params *params;
2943         struct hci_conn *conn;
2944         bool mgmt_connected;
2945
2946         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2947
2948         hci_dev_lock(hdev);
2949
2950         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2951         if (!conn)
2952                 goto unlock;
2953
2954         if (ev->status) {
2955                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2956                                        conn->dst_type, ev->status);
2957                 goto unlock;
2958         }
2959
2960         conn->state = BT_CLOSED;
2961
2962         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2963
2964         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2965                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2966         else
2967                 reason = hci_to_mgmt_reason(ev->reason);
2968
2969         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2970                                 reason, mgmt_connected);
2971
2972         if (conn->type == ACL_LINK) {
2973                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2974                         hci_remove_link_key(hdev, &conn->dst);
2975
2976                 hci_req_update_scan(hdev);
2977         }
2978
2979         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2980         if (params) {
2981                 switch (params->auto_connect) {
2982                 case HCI_AUTO_CONN_LINK_LOSS:
2983                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2984                                 break;
2985                         fallthrough;
2986
2987                 case HCI_AUTO_CONN_DIRECT:
2988                 case HCI_AUTO_CONN_ALWAYS:
2989                         list_del_init(&params->action);
2990                         list_add(&params->action, &hdev->pend_le_conns);
2991                         hci_update_background_scan(hdev);
2992                         break;
2993
2994                 default:
2995                         break;
2996                 }
2997         }
2998
2999         hci_disconn_cfm(conn, ev->reason);
3000
3001         /* The suspend notifier is waiting for all devices to disconnect so
3002          * clear the bit from pending tasks and inform the wait queue.
3003          */
3004         if (list_empty(&hdev->conn_hash.list) &&
3005             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
3006                 wake_up(&hdev->suspend_wait_q);
3007         }
3008
3009         /* Re-enable advertising if necessary, since it might
3010          * have been disabled by the connection. From the
3011          * HCI_LE_Set_Advertise_Enable command description in
3012          * the core specification (v4.0):
3013          * "The Controller shall continue advertising until the Host
3014          * issues an LE_Set_Advertise_Enable command with
3015          * Advertising_Enable set to 0x00 (Advertising is disabled)
3016          * or until a connection is created or until the Advertising
3017          * is timed out due to Directed Advertising."
3018          */
3019         if (conn->type == LE_LINK) {
3020                 hdev->cur_adv_instance = conn->adv_instance;
3021                 hci_req_reenable_advertising(hdev);
3022         }
3023
3024         hci_conn_del(conn);
3025
3026 unlock:
3027         hci_dev_unlock(hdev);
3028 }
3029
3030 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3031 {
3032         struct hci_ev_auth_complete *ev = (void *) skb->data;
3033         struct hci_conn *conn;
3034
3035         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3036
3037         hci_dev_lock(hdev);
3038
3039         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3040         if (!conn)
3041                 goto unlock;
3042
3043         if (!ev->status) {
3044                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3045
3046                 if (!hci_conn_ssp_enabled(conn) &&
3047                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3048                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3049                 } else {
3050                         set_bit(HCI_CONN_AUTH, &conn->flags);
3051                         conn->sec_level = conn->pending_sec_level;
3052                 }
3053         } else {
3054                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3055                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3056
3057                 mgmt_auth_failed(conn, ev->status);
3058         }
3059
3060         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3061         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3062
3063         if (conn->state == BT_CONFIG) {
3064                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3065                         struct hci_cp_set_conn_encrypt cp;
3066                         cp.handle  = ev->handle;
3067                         cp.encrypt = 0x01;
3068                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3069                                      &cp);
3070                 } else {
3071                         conn->state = BT_CONNECTED;
3072                         hci_connect_cfm(conn, ev->status);
3073                         hci_conn_drop(conn);
3074                 }
3075         } else {
3076                 hci_auth_cfm(conn, ev->status);
3077
3078                 hci_conn_hold(conn);
3079                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3080                 hci_conn_drop(conn);
3081         }
3082
3083         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3084                 if (!ev->status) {
3085                         struct hci_cp_set_conn_encrypt cp;
3086                         cp.handle  = ev->handle;
3087                         cp.encrypt = 0x01;
3088                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3089                                      &cp);
3090                 } else {
3091                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3092                         hci_encrypt_cfm(conn, ev->status);
3093                 }
3094         }
3095
3096 unlock:
3097         hci_dev_unlock(hdev);
3098 }
3099
3100 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3101 {
3102         struct hci_ev_remote_name *ev = (void *) skb->data;
3103         struct hci_conn *conn;
3104
3105         BT_DBG("%s", hdev->name);
3106
3107         hci_conn_check_pending(hdev);
3108
3109         hci_dev_lock(hdev);
3110
3111         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3112
3113         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3114                 goto check_auth;
3115
3116         if (ev->status == 0)
3117                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3118                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3119         else
3120                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3121
3122 check_auth:
3123         if (!conn)
3124                 goto unlock;
3125
3126         if (!hci_outgoing_auth_needed(hdev, conn))
3127                 goto unlock;
3128
3129         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3130                 struct hci_cp_auth_requested cp;
3131
3132                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3133
3134                 cp.handle = __cpu_to_le16(conn->handle);
3135                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3136         }
3137
3138 unlock:
3139         hci_dev_unlock(hdev);
3140 }
3141
3142 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3143                                        u16 opcode, struct sk_buff *skb)
3144 {
3145         const struct hci_rp_read_enc_key_size *rp;
3146         struct hci_conn *conn;
3147         u16 handle;
3148
3149         BT_DBG("%s status 0x%02x", hdev->name, status);
3150
3151         if (!skb || skb->len < sizeof(*rp)) {
3152                 bt_dev_err(hdev, "invalid read key size response");
3153                 return;
3154         }
3155
3156         rp = (void *)skb->data;
3157         handle = le16_to_cpu(rp->handle);
3158
3159         hci_dev_lock(hdev);
3160
3161         conn = hci_conn_hash_lookup_handle(hdev, handle);
3162         if (!conn)
3163                 goto unlock;
3164
3165         /* While unexpected, the read_enc_key_size command may fail. The most
3166          * secure approach is to then assume the key size is 0 to force a
3167          * disconnection.
3168          */
3169         if (rp->status) {
3170                 bt_dev_err(hdev, "failed to read key size for handle %u",
3171                            handle);
3172                 conn->enc_key_size = 0;
3173         } else {
3174                 conn->enc_key_size = rp->key_size;
3175         }
3176
3177         hci_encrypt_cfm(conn, 0);
3178
3179 unlock:
3180         hci_dev_unlock(hdev);
3181 }
3182
3183 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3184 {
3185         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3186         struct hci_conn *conn;
3187
3188         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3189
3190         hci_dev_lock(hdev);
3191
3192         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3193         if (!conn)
3194                 goto unlock;
3195
3196         if (!ev->status) {
3197                 if (ev->encrypt) {
3198                         /* Encryption implies authentication */
3199                         set_bit(HCI_CONN_AUTH, &conn->flags);
3200                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3201                         conn->sec_level = conn->pending_sec_level;
3202
3203                         /* P-256 authentication key implies FIPS */
3204                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3205                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3206
3207                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3208                             conn->type == LE_LINK)
3209                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3210                 } else {
3211                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3212                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3213                 }
3214         }
3215
3216         /* We should disregard the current RPA and generate a new one
3217          * whenever the encryption procedure fails.
3218          */
3219         if (ev->status && conn->type == LE_LINK) {
3220                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3221                 hci_adv_instances_set_rpa_expired(hdev, true);
3222         }
3223
3224         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3225
3226         /* Check link security requirements are met */
3227         if (!hci_conn_check_link_mode(conn))
3228                 ev->status = HCI_ERROR_AUTH_FAILURE;
3229
3230         if (ev->status && conn->state == BT_CONNECTED) {
3231                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3232                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3233
3234                 /* Notify upper layers so they can cleanup before
3235                  * disconnecting.
3236                  */
3237                 hci_encrypt_cfm(conn, ev->status);
3238                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3239                 hci_conn_drop(conn);
3240                 goto unlock;
3241         }
3242
3243         /* Try reading the encryption key size for encrypted ACL links */
3244         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3245                 struct hci_cp_read_enc_key_size cp;
3246                 struct hci_request req;
3247
3248                 /* Only send HCI_Read_Encryption_Key_Size if the
3249                  * controller really supports it. If it doesn't, assume
3250                  * the default size (16).
3251                  */
3252                 if (!(hdev->commands[20] & 0x10)) {
3253                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3254                         goto notify;
3255                 }
3256
3257                 hci_req_init(&req, hdev);
3258
3259                 cp.handle = cpu_to_le16(conn->handle);
3260                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3261
3262                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3263                         bt_dev_err(hdev, "sending read key size failed");
3264                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3265                         goto notify;
3266                 }
3267
3268                 goto unlock;
3269         }
3270
3271         /* Set the default Authenticated Payload Timeout after
3272          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3273          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3274          * sent when the link is active and Encryption is enabled, the conn
3275          * type can be either LE or ACL and controller must support LMP Ping.
3276          * Ensure for AES-CCM encryption as well.
3277          */
3278         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3279             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3280             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3281              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3282                 struct hci_cp_write_auth_payload_to cp;
3283
3284                 cp.handle = cpu_to_le16(conn->handle);
3285                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3286                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3287                              sizeof(cp), &cp);
3288         }
3289
3290 notify:
3291         hci_encrypt_cfm(conn, ev->status);
3292
3293 unlock:
3294         hci_dev_unlock(hdev);
3295 }
3296
3297 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3298                                              struct sk_buff *skb)
3299 {
3300         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3301         struct hci_conn *conn;
3302
3303         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3304
3305         hci_dev_lock(hdev);
3306
3307         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3308         if (conn) {
3309                 if (!ev->status)
3310                         set_bit(HCI_CONN_SECURE, &conn->flags);
3311
3312                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3313
3314                 hci_key_change_cfm(conn, ev->status);
3315         }
3316
3317         hci_dev_unlock(hdev);
3318 }
3319
3320 static void hci_remote_features_evt(struct hci_dev *hdev,
3321                                     struct sk_buff *skb)
3322 {
3323         struct hci_ev_remote_features *ev = (void *) skb->data;
3324         struct hci_conn *conn;
3325
3326         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3327
3328         hci_dev_lock(hdev);
3329
3330         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3331         if (!conn)
3332                 goto unlock;
3333
3334         if (!ev->status)
3335                 memcpy(conn->features[0], ev->features, 8);
3336
3337         if (conn->state != BT_CONFIG)
3338                 goto unlock;
3339
3340         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3341             lmp_ext_feat_capable(conn)) {
3342                 struct hci_cp_read_remote_ext_features cp;
3343                 cp.handle = ev->handle;
3344                 cp.page = 0x01;
3345                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3346                              sizeof(cp), &cp);
3347                 goto unlock;
3348         }
3349
3350         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3351                 struct hci_cp_remote_name_req cp;
3352                 memset(&cp, 0, sizeof(cp));
3353                 bacpy(&cp.bdaddr, &conn->dst);
3354                 cp.pscan_rep_mode = 0x02;
3355                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3356         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3357                 mgmt_device_connected(hdev, conn, NULL, 0);
3358
3359         if (!hci_outgoing_auth_needed(hdev, conn)) {
3360                 conn->state = BT_CONNECTED;
3361                 hci_connect_cfm(conn, ev->status);
3362                 hci_conn_drop(conn);
3363         }
3364
3365 unlock:
3366         hci_dev_unlock(hdev);
3367 }
3368
3369 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3370 {
3371         cancel_delayed_work(&hdev->cmd_timer);
3372
3373         if (!test_bit(HCI_RESET, &hdev->flags)) {
3374                 if (ncmd) {
3375                         cancel_delayed_work(&hdev->ncmd_timer);
3376                         atomic_set(&hdev->cmd_cnt, 1);
3377                 } else {
3378                         schedule_delayed_work(&hdev->ncmd_timer,
3379                                               HCI_NCMD_TIMEOUT);
3380                 }
3381         }
3382 }
3383
3384 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3385                                  u16 *opcode, u8 *status,
3386                                  hci_req_complete_t *req_complete,
3387                                  hci_req_complete_skb_t *req_complete_skb)
3388 {
3389         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3390
3391         *opcode = __le16_to_cpu(ev->opcode);
3392         *status = skb->data[sizeof(*ev)];
3393
3394         skb_pull(skb, sizeof(*ev));
3395
3396         switch (*opcode) {
3397         case HCI_OP_INQUIRY_CANCEL:
3398                 hci_cc_inquiry_cancel(hdev, skb, status);
3399                 break;
3400
3401         case HCI_OP_PERIODIC_INQ:
3402                 hci_cc_periodic_inq(hdev, skb);
3403                 break;
3404
3405         case HCI_OP_EXIT_PERIODIC_INQ:
3406                 hci_cc_exit_periodic_inq(hdev, skb);
3407                 break;
3408
3409         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3410                 hci_cc_remote_name_req_cancel(hdev, skb);
3411                 break;
3412
3413         case HCI_OP_ROLE_DISCOVERY:
3414                 hci_cc_role_discovery(hdev, skb);
3415                 break;
3416
3417         case HCI_OP_READ_LINK_POLICY:
3418                 hci_cc_read_link_policy(hdev, skb);
3419                 break;
3420
3421         case HCI_OP_WRITE_LINK_POLICY:
3422                 hci_cc_write_link_policy(hdev, skb);
3423                 break;
3424
3425         case HCI_OP_READ_DEF_LINK_POLICY:
3426                 hci_cc_read_def_link_policy(hdev, skb);
3427                 break;
3428
3429         case HCI_OP_WRITE_DEF_LINK_POLICY:
3430                 hci_cc_write_def_link_policy(hdev, skb);
3431                 break;
3432
3433         case HCI_OP_RESET:
3434                 hci_cc_reset(hdev, skb);
3435                 break;
3436
3437         case HCI_OP_READ_STORED_LINK_KEY:
3438                 hci_cc_read_stored_link_key(hdev, skb);
3439                 break;
3440
3441         case HCI_OP_DELETE_STORED_LINK_KEY:
3442                 hci_cc_delete_stored_link_key(hdev, skb);
3443                 break;
3444
3445         case HCI_OP_WRITE_LOCAL_NAME:
3446                 hci_cc_write_local_name(hdev, skb);
3447                 break;
3448
3449         case HCI_OP_READ_LOCAL_NAME:
3450                 hci_cc_read_local_name(hdev, skb);
3451                 break;
3452
3453         case HCI_OP_WRITE_AUTH_ENABLE:
3454                 hci_cc_write_auth_enable(hdev, skb);
3455                 break;
3456
3457         case HCI_OP_WRITE_ENCRYPT_MODE:
3458                 hci_cc_write_encrypt_mode(hdev, skb);
3459                 break;
3460
3461         case HCI_OP_WRITE_SCAN_ENABLE:
3462                 hci_cc_write_scan_enable(hdev, skb);
3463                 break;
3464
3465         case HCI_OP_SET_EVENT_FLT:
3466                 hci_cc_set_event_filter(hdev, skb);
3467                 break;
3468
3469         case HCI_OP_READ_CLASS_OF_DEV:
3470                 hci_cc_read_class_of_dev(hdev, skb);
3471                 break;
3472
3473         case HCI_OP_WRITE_CLASS_OF_DEV:
3474                 hci_cc_write_class_of_dev(hdev, skb);
3475                 break;
3476
3477         case HCI_OP_READ_VOICE_SETTING:
3478                 hci_cc_read_voice_setting(hdev, skb);
3479                 break;
3480
3481         case HCI_OP_WRITE_VOICE_SETTING:
3482                 hci_cc_write_voice_setting(hdev, skb);
3483                 break;
3484
3485         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3486                 hci_cc_read_num_supported_iac(hdev, skb);
3487                 break;
3488
3489         case HCI_OP_WRITE_SSP_MODE:
3490                 hci_cc_write_ssp_mode(hdev, skb);
3491                 break;
3492
3493         case HCI_OP_WRITE_SC_SUPPORT:
3494                 hci_cc_write_sc_support(hdev, skb);
3495                 break;
3496
3497         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3498                 hci_cc_read_auth_payload_timeout(hdev, skb);
3499                 break;
3500
3501         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3502                 hci_cc_write_auth_payload_timeout(hdev, skb);
3503                 break;
3504
3505         case HCI_OP_READ_LOCAL_VERSION:
3506                 hci_cc_read_local_version(hdev, skb);
3507                 break;
3508
3509         case HCI_OP_READ_LOCAL_COMMANDS:
3510                 hci_cc_read_local_commands(hdev, skb);
3511                 break;
3512
3513         case HCI_OP_READ_LOCAL_FEATURES:
3514                 hci_cc_read_local_features(hdev, skb);
3515                 break;
3516
3517         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3518                 hci_cc_read_local_ext_features(hdev, skb);
3519                 break;
3520
3521         case HCI_OP_READ_BUFFER_SIZE:
3522                 hci_cc_read_buffer_size(hdev, skb);
3523                 break;
3524
3525         case HCI_OP_READ_BD_ADDR:
3526                 hci_cc_read_bd_addr(hdev, skb);
3527                 break;
3528
3529         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3530                 hci_cc_read_local_pairing_opts(hdev, skb);
3531                 break;
3532
3533         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3534                 hci_cc_read_page_scan_activity(hdev, skb);
3535                 break;
3536
3537         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3538                 hci_cc_write_page_scan_activity(hdev, skb);
3539                 break;
3540
3541         case HCI_OP_READ_PAGE_SCAN_TYPE:
3542                 hci_cc_read_page_scan_type(hdev, skb);
3543                 break;
3544
3545         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3546                 hci_cc_write_page_scan_type(hdev, skb);
3547                 break;
3548
3549         case HCI_OP_READ_DATA_BLOCK_SIZE:
3550                 hci_cc_read_data_block_size(hdev, skb);
3551                 break;
3552
3553         case HCI_OP_READ_FLOW_CONTROL_MODE:
3554                 hci_cc_read_flow_control_mode(hdev, skb);
3555                 break;
3556
3557         case HCI_OP_READ_LOCAL_AMP_INFO:
3558                 hci_cc_read_local_amp_info(hdev, skb);
3559                 break;
3560
3561         case HCI_OP_READ_CLOCK:
3562                 hci_cc_read_clock(hdev, skb);
3563                 break;
3564
3565         case HCI_OP_READ_INQ_RSP_TX_POWER:
3566                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3567                 break;
3568
3569         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3570                 hci_cc_read_def_err_data_reporting(hdev, skb);
3571                 break;
3572
3573         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3574                 hci_cc_write_def_err_data_reporting(hdev, skb);
3575                 break;
3576
3577         case HCI_OP_PIN_CODE_REPLY:
3578                 hci_cc_pin_code_reply(hdev, skb);
3579                 break;
3580
3581         case HCI_OP_PIN_CODE_NEG_REPLY:
3582                 hci_cc_pin_code_neg_reply(hdev, skb);
3583                 break;
3584
3585         case HCI_OP_READ_LOCAL_OOB_DATA:
3586                 hci_cc_read_local_oob_data(hdev, skb);
3587                 break;
3588
3589         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3590                 hci_cc_read_local_oob_ext_data(hdev, skb);
3591                 break;
3592
3593         case HCI_OP_LE_READ_BUFFER_SIZE:
3594                 hci_cc_le_read_buffer_size(hdev, skb);
3595                 break;
3596
3597         case HCI_OP_LE_READ_LOCAL_FEATURES:
3598                 hci_cc_le_read_local_features(hdev, skb);
3599                 break;
3600
3601         case HCI_OP_LE_READ_ADV_TX_POWER:
3602                 hci_cc_le_read_adv_tx_power(hdev, skb);
3603                 break;
3604
3605         case HCI_OP_USER_CONFIRM_REPLY:
3606                 hci_cc_user_confirm_reply(hdev, skb);
3607                 break;
3608
3609         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3610                 hci_cc_user_confirm_neg_reply(hdev, skb);
3611                 break;
3612
3613         case HCI_OP_USER_PASSKEY_REPLY:
3614                 hci_cc_user_passkey_reply(hdev, skb);
3615                 break;
3616
3617         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3618                 hci_cc_user_passkey_neg_reply(hdev, skb);
3619                 break;
3620
3621         case HCI_OP_LE_SET_RANDOM_ADDR:
3622                 hci_cc_le_set_random_addr(hdev, skb);
3623                 break;
3624
3625         case HCI_OP_LE_SET_ADV_ENABLE:
3626                 hci_cc_le_set_adv_enable(hdev, skb);
3627                 break;
3628
3629         case HCI_OP_LE_SET_SCAN_PARAM:
3630                 hci_cc_le_set_scan_param(hdev, skb);
3631                 break;
3632
3633         case HCI_OP_LE_SET_SCAN_ENABLE:
3634                 hci_cc_le_set_scan_enable(hdev, skb);
3635                 break;
3636
3637         case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3638                 hci_cc_le_read_accept_list_size(hdev, skb);
3639                 break;
3640
3641         case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3642                 hci_cc_le_clear_accept_list(hdev, skb);
3643                 break;
3644
3645         case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3646                 hci_cc_le_add_to_accept_list(hdev, skb);
3647                 break;
3648
3649         case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3650                 hci_cc_le_del_from_accept_list(hdev, skb);
3651                 break;
3652
3653         case HCI_OP_LE_READ_SUPPORTED_STATES:
3654                 hci_cc_le_read_supported_states(hdev, skb);
3655                 break;
3656
3657         case HCI_OP_LE_READ_DEF_DATA_LEN:
3658                 hci_cc_le_read_def_data_len(hdev, skb);
3659                 break;
3660
3661         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3662                 hci_cc_le_write_def_data_len(hdev, skb);
3663                 break;
3664
3665         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3666                 hci_cc_le_add_to_resolv_list(hdev, skb);
3667                 break;
3668
3669         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3670                 hci_cc_le_del_from_resolv_list(hdev, skb);
3671                 break;
3672
3673         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3674                 hci_cc_le_clear_resolv_list(hdev, skb);
3675                 break;
3676
3677         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3678                 hci_cc_le_read_resolv_list_size(hdev, skb);
3679                 break;
3680
3681         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3682                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3683                 break;
3684
3685         case HCI_OP_LE_READ_MAX_DATA_LEN:
3686                 hci_cc_le_read_max_data_len(hdev, skb);
3687                 break;
3688
3689         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3690                 hci_cc_write_le_host_supported(hdev, skb);
3691                 break;
3692
3693         case HCI_OP_LE_SET_ADV_PARAM:
3694                 hci_cc_set_adv_param(hdev, skb);
3695                 break;
3696
3697         case HCI_OP_READ_RSSI:
3698                 hci_cc_read_rssi(hdev, skb);
3699                 break;
3700
3701         case HCI_OP_READ_TX_POWER:
3702                 hci_cc_read_tx_power(hdev, skb);
3703                 break;
3704
3705         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3706                 hci_cc_write_ssp_debug_mode(hdev, skb);
3707                 break;
3708
3709         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3710                 hci_cc_le_set_ext_scan_param(hdev, skb);
3711                 break;
3712
3713         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3714                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3715                 break;
3716
3717         case HCI_OP_LE_SET_DEFAULT_PHY:
3718                 hci_cc_le_set_default_phy(hdev, skb);
3719                 break;
3720
3721         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3722                 hci_cc_le_read_num_adv_sets(hdev, skb);
3723                 break;
3724
3725         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3726                 hci_cc_set_ext_adv_param(hdev, skb);
3727                 break;
3728
3729         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3730                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3731                 break;
3732
3733         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3734                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3735                 break;
3736
3737         case HCI_OP_LE_READ_TRANSMIT_POWER:
3738                 hci_cc_le_read_transmit_power(hdev, skb);
3739                 break;
3740 #ifdef TIZEN_BT
3741         case HCI_OP_ENABLE_RSSI:
3742                 hci_cc_enable_rssi(hdev, skb);
3743                 break;
3744
3745         case HCI_OP_GET_RAW_RSSI:
3746                 hci_cc_get_raw_rssi(hdev, skb);
3747                 break;
3748 #endif
3749         default:
3750                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3751                 break;
3752         }
3753
3754         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3755
3756         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3757                              req_complete_skb);
3758
3759         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3760                 bt_dev_err(hdev,
3761                            "unexpected event for opcode 0x%4.4x", *opcode);
3762                 return;
3763         }
3764
3765         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3766                 queue_work(hdev->workqueue, &hdev->cmd_work);
3767 }
3768
3769 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3770                                u16 *opcode, u8 *status,
3771                                hci_req_complete_t *req_complete,
3772                                hci_req_complete_skb_t *req_complete_skb)
3773 {
3774         struct hci_ev_cmd_status *ev = (void *) skb->data;
3775
3776         skb_pull(skb, sizeof(*ev));
3777
3778         *opcode = __le16_to_cpu(ev->opcode);
3779         *status = ev->status;
3780
3781         switch (*opcode) {
3782         case HCI_OP_INQUIRY:
3783                 hci_cs_inquiry(hdev, ev->status);
3784                 break;
3785
3786         case HCI_OP_CREATE_CONN:
3787                 hci_cs_create_conn(hdev, ev->status);
3788                 break;
3789
3790         case HCI_OP_DISCONNECT:
3791                 hci_cs_disconnect(hdev, ev->status);
3792                 break;
3793
3794         case HCI_OP_ADD_SCO:
3795                 hci_cs_add_sco(hdev, ev->status);
3796                 break;
3797
3798         case HCI_OP_AUTH_REQUESTED:
3799                 hci_cs_auth_requested(hdev, ev->status);
3800                 break;
3801
3802         case HCI_OP_SET_CONN_ENCRYPT:
3803                 hci_cs_set_conn_encrypt(hdev, ev->status);
3804                 break;
3805
3806         case HCI_OP_REMOTE_NAME_REQ:
3807                 hci_cs_remote_name_req(hdev, ev->status);
3808                 break;
3809
3810         case HCI_OP_READ_REMOTE_FEATURES:
3811                 hci_cs_read_remote_features(hdev, ev->status);
3812                 break;
3813
3814         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3815                 hci_cs_read_remote_ext_features(hdev, ev->status);
3816                 break;
3817
3818         case HCI_OP_SETUP_SYNC_CONN:
3819                 hci_cs_setup_sync_conn(hdev, ev->status);
3820                 break;
3821
3822         case HCI_OP_SNIFF_MODE:
3823                 hci_cs_sniff_mode(hdev, ev->status);
3824                 break;
3825
3826         case HCI_OP_EXIT_SNIFF_MODE:
3827                 hci_cs_exit_sniff_mode(hdev, ev->status);
3828                 break;
3829
3830         case HCI_OP_SWITCH_ROLE:
3831                 hci_cs_switch_role(hdev, ev->status);
3832                 break;
3833
3834         case HCI_OP_LE_CREATE_CONN:
3835                 hci_cs_le_create_conn(hdev, ev->status);
3836                 break;
3837
3838         case HCI_OP_LE_READ_REMOTE_FEATURES:
3839                 hci_cs_le_read_remote_features(hdev, ev->status);
3840                 break;
3841
3842         case HCI_OP_LE_START_ENC:
3843                 hci_cs_le_start_enc(hdev, ev->status);
3844                 break;
3845
3846         case HCI_OP_LE_EXT_CREATE_CONN:
3847                 hci_cs_le_ext_create_conn(hdev, ev->status);
3848                 break;
3849
3850         default:
3851                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3852                 break;
3853         }
3854
3855         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3856
3857         /* Indicate request completion if the command failed. Also, if
3858          * we're not waiting for a special event and we get a success
3859          * command status we should try to flag the request as completed
3860          * (since for this kind of commands there will not be a command
3861          * complete event).
3862          */
3863         if (ev->status ||
3864             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3865                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3866                                      req_complete_skb);
3867
3868         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3869                 bt_dev_err(hdev,
3870                            "unexpected event for opcode 0x%4.4x", *opcode);
3871                 return;
3872         }
3873
3874         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3875                 queue_work(hdev->workqueue, &hdev->cmd_work);
3876 }
3877
3878 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3879 {
3880         struct hci_ev_hardware_error *ev = (void *) skb->data;
3881
3882         hdev->hw_error_code = ev->code;
3883
3884         queue_work(hdev->req_workqueue, &hdev->error_reset);
3885 }
3886
3887 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3888 {
3889         struct hci_ev_role_change *ev = (void *) skb->data;
3890         struct hci_conn *conn;
3891
3892         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3893
3894         hci_dev_lock(hdev);
3895
3896         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3897         if (conn) {
3898                 if (!ev->status)
3899                         conn->role = ev->role;
3900
3901                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3902
3903                 hci_role_switch_cfm(conn, ev->status, ev->role);
3904         }
3905
3906         hci_dev_unlock(hdev);
3907 }
3908
3909 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3910 {
3911         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3912         int i;
3913
3914         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3915                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3916                 return;
3917         }
3918
3919         if (skb->len < sizeof(*ev) ||
3920             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3921                 BT_DBG("%s bad parameters", hdev->name);
3922                 return;
3923         }
3924
3925         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3926
3927         for (i = 0; i < ev->num_hndl; i++) {
3928                 struct hci_comp_pkts_info *info = &ev->handles[i];
3929                 struct hci_conn *conn;
3930                 __u16  handle, count;
3931
3932                 handle = __le16_to_cpu(info->handle);
3933                 count  = __le16_to_cpu(info->count);
3934
3935                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3936                 if (!conn)
3937                         continue;
3938
3939                 conn->sent -= count;
3940
3941                 switch (conn->type) {
3942                 case ACL_LINK:
3943                         hdev->acl_cnt += count;
3944                         if (hdev->acl_cnt > hdev->acl_pkts)
3945                                 hdev->acl_cnt = hdev->acl_pkts;
3946                         break;
3947
3948                 case LE_LINK:
3949                         if (hdev->le_pkts) {
3950                                 hdev->le_cnt += count;
3951                                 if (hdev->le_cnt > hdev->le_pkts)
3952                                         hdev->le_cnt = hdev->le_pkts;
3953                         } else {
3954                                 hdev->acl_cnt += count;
3955                                 if (hdev->acl_cnt > hdev->acl_pkts)
3956                                         hdev->acl_cnt = hdev->acl_pkts;
3957                         }
3958                         break;
3959
3960                 case SCO_LINK:
3961                         hdev->sco_cnt += count;
3962                         if (hdev->sco_cnt > hdev->sco_pkts)
3963                                 hdev->sco_cnt = hdev->sco_pkts;
3964                         break;
3965
3966                 default:
3967                         bt_dev_err(hdev, "unknown type %d conn %p",
3968                                    conn->type, conn);
3969                         break;
3970                 }
3971         }
3972
3973         queue_work(hdev->workqueue, &hdev->tx_work);
3974 }
3975
3976 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3977                                                  __u16 handle)
3978 {
3979         struct hci_chan *chan;
3980
3981         switch (hdev->dev_type) {
3982         case HCI_PRIMARY:
3983                 return hci_conn_hash_lookup_handle(hdev, handle);
3984         case HCI_AMP:
3985                 chan = hci_chan_lookup_handle(hdev, handle);
3986                 if (chan)
3987                         return chan->conn;
3988                 break;
3989         default:
3990                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3991                 break;
3992         }
3993
3994         return NULL;
3995 }
3996
3997 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3998 {
3999         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
4000         int i;
4001
4002         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4003                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4004                 return;
4005         }
4006
4007         if (skb->len < sizeof(*ev) ||
4008             skb->len < struct_size(ev, handles, ev->num_hndl)) {
4009                 BT_DBG("%s bad parameters", hdev->name);
4010                 return;
4011         }
4012
4013         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
4014                ev->num_hndl);
4015
4016         for (i = 0; i < ev->num_hndl; i++) {
4017                 struct hci_comp_blocks_info *info = &ev->handles[i];
4018                 struct hci_conn *conn = NULL;
4019                 __u16  handle, block_count;
4020
4021                 handle = __le16_to_cpu(info->handle);
4022                 block_count = __le16_to_cpu(info->blocks);
4023
4024                 conn = __hci_conn_lookup_handle(hdev, handle);
4025                 if (!conn)
4026                         continue;
4027
4028                 conn->sent -= block_count;
4029
4030                 switch (conn->type) {
4031                 case ACL_LINK:
4032                 case AMP_LINK:
4033                         hdev->block_cnt += block_count;
4034                         if (hdev->block_cnt > hdev->num_blocks)
4035                                 hdev->block_cnt = hdev->num_blocks;
4036                         break;
4037
4038                 default:
4039                         bt_dev_err(hdev, "unknown type %d conn %p",
4040                                    conn->type, conn);
4041                         break;
4042                 }
4043         }
4044
4045         queue_work(hdev->workqueue, &hdev->tx_work);
4046 }
4047
4048 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4049 {
4050         struct hci_ev_mode_change *ev = (void *) skb->data;
4051         struct hci_conn *conn;
4052
4053         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4054
4055         hci_dev_lock(hdev);
4056
4057         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4058         if (conn) {
4059                 conn->mode = ev->mode;
4060
4061                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4062                                         &conn->flags)) {
4063                         if (conn->mode == HCI_CM_ACTIVE)
4064                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4065                         else
4066                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4067                 }
4068
4069                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4070                         hci_sco_setup(conn, ev->status);
4071         }
4072
4073         hci_dev_unlock(hdev);
4074 }
4075
4076 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4077 {
4078         struct hci_ev_pin_code_req *ev = (void *) skb->data;
4079         struct hci_conn *conn;
4080
4081         BT_DBG("%s", hdev->name);
4082
4083         hci_dev_lock(hdev);
4084
4085         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4086         if (!conn)
4087                 goto unlock;
4088
4089         if (conn->state == BT_CONNECTED) {
4090                 hci_conn_hold(conn);
4091                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4092                 hci_conn_drop(conn);
4093         }
4094
4095         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4096             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4097                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4098                              sizeof(ev->bdaddr), &ev->bdaddr);
4099         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4100                 u8 secure;
4101
4102                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4103                         secure = 1;
4104                 else
4105                         secure = 0;
4106
4107                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4108         }
4109
4110 unlock:
4111         hci_dev_unlock(hdev);
4112 }
4113
4114 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4115 {
4116         if (key_type == HCI_LK_CHANGED_COMBINATION)
4117                 return;
4118
4119         conn->pin_length = pin_len;
4120         conn->key_type = key_type;
4121
4122         switch (key_type) {
4123         case HCI_LK_LOCAL_UNIT:
4124         case HCI_LK_REMOTE_UNIT:
4125         case HCI_LK_DEBUG_COMBINATION:
4126                 return;
4127         case HCI_LK_COMBINATION:
4128                 if (pin_len == 16)
4129                         conn->pending_sec_level = BT_SECURITY_HIGH;
4130                 else
4131                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4132                 break;
4133         case HCI_LK_UNAUTH_COMBINATION_P192:
4134         case HCI_LK_UNAUTH_COMBINATION_P256:
4135                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4136                 break;
4137         case HCI_LK_AUTH_COMBINATION_P192:
4138                 conn->pending_sec_level = BT_SECURITY_HIGH;
4139                 break;
4140         case HCI_LK_AUTH_COMBINATION_P256:
4141                 conn->pending_sec_level = BT_SECURITY_FIPS;
4142                 break;
4143         }
4144 }
4145
4146 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4147 {
4148         struct hci_ev_link_key_req *ev = (void *) skb->data;
4149         struct hci_cp_link_key_reply cp;
4150         struct hci_conn *conn;
4151         struct link_key *key;
4152
4153         BT_DBG("%s", hdev->name);
4154
4155         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4156                 return;
4157
4158         hci_dev_lock(hdev);
4159
4160         key = hci_find_link_key(hdev, &ev->bdaddr);
4161         if (!key) {
4162                 BT_DBG("%s link key not found for %pMR", hdev->name,
4163                        &ev->bdaddr);
4164                 goto not_found;
4165         }
4166
4167         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4168                &ev->bdaddr);
4169
4170         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4171         if (conn) {
4172                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4173
4174                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4175                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4176                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4177                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4178                         goto not_found;
4179                 }
4180
4181                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4182                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4183                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4184                         BT_DBG("%s ignoring key unauthenticated for high security",
4185                                hdev->name);
4186                         goto not_found;
4187                 }
4188
4189                 conn_set_key(conn, key->type, key->pin_len);
4190         }
4191
4192         bacpy(&cp.bdaddr, &ev->bdaddr);
4193         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4194
4195         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4196
4197         hci_dev_unlock(hdev);
4198
4199         return;
4200
4201 not_found:
4202         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4203         hci_dev_unlock(hdev);
4204 }
4205
4206 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4207 {
4208         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4209         struct hci_conn *conn;
4210         struct link_key *key;
4211         bool persistent;
4212         u8 pin_len = 0;
4213
4214         BT_DBG("%s", hdev->name);
4215
4216         hci_dev_lock(hdev);
4217
4218         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4219         if (!conn)
4220                 goto unlock;
4221
4222         hci_conn_hold(conn);
4223         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4224         hci_conn_drop(conn);
4225
4226         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4227         conn_set_key(conn, ev->key_type, conn->pin_length);
4228
4229         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4230                 goto unlock;
4231
4232         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4233                                 ev->key_type, pin_len, &persistent);
4234         if (!key)
4235                 goto unlock;
4236
4237         /* Update connection information since adding the key will have
4238          * fixed up the type in the case of changed combination keys.
4239          */
4240         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4241                 conn_set_key(conn, key->type, key->pin_len);
4242
4243         mgmt_new_link_key(hdev, key, persistent);
4244
4245         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4246          * is set. If it's not set simply remove the key from the kernel
4247          * list (we've still notified user space about it but with
4248          * store_hint being 0).
4249          */
4250         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4251             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4252                 list_del_rcu(&key->list);
4253                 kfree_rcu(key, rcu);
4254                 goto unlock;
4255         }
4256
4257         if (persistent)
4258                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4259         else
4260                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4261
4262 unlock:
4263         hci_dev_unlock(hdev);
4264 }
4265
4266 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4267 {
4268         struct hci_ev_clock_offset *ev = (void *) skb->data;
4269         struct hci_conn *conn;
4270
4271         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4272
4273         hci_dev_lock(hdev);
4274
4275         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4276         if (conn && !ev->status) {
4277                 struct inquiry_entry *ie;
4278
4279                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4280                 if (ie) {
4281                         ie->data.clock_offset = ev->clock_offset;
4282                         ie->timestamp = jiffies;
4283                 }
4284         }
4285
4286         hci_dev_unlock(hdev);
4287 }
4288
4289 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4290 {
4291         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4292         struct hci_conn *conn;
4293
4294         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4295
4296         hci_dev_lock(hdev);
4297
4298         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4299         if (conn && !ev->status)
4300                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4301
4302         hci_dev_unlock(hdev);
4303 }
4304
4305 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4306 {
4307         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4308         struct inquiry_entry *ie;
4309
4310         BT_DBG("%s", hdev->name);
4311
4312         hci_dev_lock(hdev);
4313
4314         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4315         if (ie) {
4316                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4317                 ie->timestamp = jiffies;
4318         }
4319
4320         hci_dev_unlock(hdev);
4321 }
4322
4323 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4324                                              struct sk_buff *skb)
4325 {
4326         struct inquiry_data data;
4327         int num_rsp = *((__u8 *) skb->data);
4328
4329         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4330
4331         if (!num_rsp)
4332                 return;
4333
4334         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4335                 return;
4336
4337         hci_dev_lock(hdev);
4338
4339         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4340                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4341                 info = (void *) (skb->data + 1);
4342
4343                 if (skb->len < num_rsp * sizeof(*info) + 1)
4344                         goto unlock;
4345
4346                 for (; num_rsp; num_rsp--, info++) {
4347                         u32 flags;
4348
4349                         bacpy(&data.bdaddr, &info->bdaddr);
4350                         data.pscan_rep_mode     = info->pscan_rep_mode;
4351                         data.pscan_period_mode  = info->pscan_period_mode;
4352                         data.pscan_mode         = info->pscan_mode;
4353                         memcpy(data.dev_class, info->dev_class, 3);
4354                         data.clock_offset       = info->clock_offset;
4355                         data.rssi               = info->rssi;
4356                         data.ssp_mode           = 0x00;
4357
4358                         flags = hci_inquiry_cache_update(hdev, &data, false);
4359
4360                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4361                                           info->dev_class, info->rssi,
4362                                           flags, NULL, 0, NULL, 0);
4363                 }
4364         } else {
4365                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4366
4367                 if (skb->len < num_rsp * sizeof(*info) + 1)
4368                         goto unlock;
4369
4370                 for (; num_rsp; num_rsp--, info++) {
4371                         u32 flags;
4372
4373                         bacpy(&data.bdaddr, &info->bdaddr);
4374                         data.pscan_rep_mode     = info->pscan_rep_mode;
4375                         data.pscan_period_mode  = info->pscan_period_mode;
4376                         data.pscan_mode         = 0x00;
4377                         memcpy(data.dev_class, info->dev_class, 3);
4378                         data.clock_offset       = info->clock_offset;
4379                         data.rssi               = info->rssi;
4380                         data.ssp_mode           = 0x00;
4381
4382                         flags = hci_inquiry_cache_update(hdev, &data, false);
4383
4384                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4385                                           info->dev_class, info->rssi,
4386                                           flags, NULL, 0, NULL, 0);
4387                 }
4388         }
4389
4390 unlock:
4391         hci_dev_unlock(hdev);
4392 }
4393
4394 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4395                                         struct sk_buff *skb)
4396 {
4397         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4398         struct hci_conn *conn;
4399
4400         BT_DBG("%s", hdev->name);
4401
4402         hci_dev_lock(hdev);
4403
4404         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4405         if (!conn)
4406                 goto unlock;
4407
4408         if (ev->page < HCI_MAX_PAGES)
4409                 memcpy(conn->features[ev->page], ev->features, 8);
4410
4411         if (!ev->status && ev->page == 0x01) {
4412                 struct inquiry_entry *ie;
4413
4414                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4415                 if (ie)
4416                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4417
4418                 if (ev->features[0] & LMP_HOST_SSP) {
4419                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4420                 } else {
4421                         /* It is mandatory by the Bluetooth specification that
4422                          * Extended Inquiry Results are only used when Secure
4423                          * Simple Pairing is enabled, but some devices violate
4424                          * this.
4425                          *
4426                          * To make these devices work, the internal SSP
4427                          * enabled flag needs to be cleared if the remote host
4428                          * features do not indicate SSP support */
4429                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4430                 }
4431
4432                 if (ev->features[0] & LMP_HOST_SC)
4433                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4434         }
4435
4436         if (conn->state != BT_CONFIG)
4437                 goto unlock;
4438
4439         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4440                 struct hci_cp_remote_name_req cp;
4441                 memset(&cp, 0, sizeof(cp));
4442                 bacpy(&cp.bdaddr, &conn->dst);
4443                 cp.pscan_rep_mode = 0x02;
4444                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4445         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4446                 mgmt_device_connected(hdev, conn, NULL, 0);
4447
4448         if (!hci_outgoing_auth_needed(hdev, conn)) {
4449                 conn->state = BT_CONNECTED;
4450                 hci_connect_cfm(conn, ev->status);
4451                 hci_conn_drop(conn);
4452         }
4453
4454 unlock:
4455         hci_dev_unlock(hdev);
4456 }
4457
4458 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4459                                        struct sk_buff *skb)
4460 {
4461         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4462         struct hci_conn *conn;
4463
4464         switch (ev->link_type) {
4465         case SCO_LINK:
4466         case ESCO_LINK:
4467                 break;
4468         default:
4469                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4470                  * for HCI_Synchronous_Connection_Complete is limited to
4471                  * either SCO or eSCO
4472                  */
4473                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4474                 return;
4475         }
4476
4477         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4478
4479         hci_dev_lock(hdev);
4480
4481         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4482         if (!conn) {
4483                 if (ev->link_type == ESCO_LINK)
4484                         goto unlock;
4485
4486                 /* When the link type in the event indicates SCO connection
4487                  * and lookup of the connection object fails, then check
4488                  * if an eSCO connection object exists.
4489                  *
4490                  * The core limits the synchronous connections to either
4491                  * SCO or eSCO. The eSCO connection is preferred and tried
4492                  * to be setup first and until successfully established,
4493                  * the link type will be hinted as eSCO.
4494                  */
4495                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4496                 if (!conn)
4497                         goto unlock;
4498         }
4499
4500         switch (ev->status) {
4501         case 0x00:
4502                 /* The synchronous connection complete event should only be
4503                  * sent once per new connection. Receiving a successful
4504                  * complete event when the connection status is already
4505                  * BT_CONNECTED means that the device is misbehaving and sent
4506                  * multiple complete event packets for the same new connection.
4507                  *
4508                  * Registering the device more than once can corrupt kernel
4509                  * memory, hence upon detecting this invalid event, we report
4510                  * an error and ignore the packet.
4511                  */
4512                 if (conn->state == BT_CONNECTED) {
4513                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4514                         goto unlock;
4515                 }
4516
4517                 conn->handle = __le16_to_cpu(ev->handle);
4518                 conn->state  = BT_CONNECTED;
4519                 conn->type   = ev->link_type;
4520
4521                 hci_debugfs_create_conn(conn);
4522                 hci_conn_add_sysfs(conn);
4523                 break;
4524
4525         case 0x10:      /* Connection Accept Timeout */
4526         case 0x0d:      /* Connection Rejected due to Limited Resources */
4527         case 0x11:      /* Unsupported Feature or Parameter Value */
4528         case 0x1c:      /* SCO interval rejected */
4529         case 0x1a:      /* Unsupported Remote Feature */
4530         case 0x1e:      /* Invalid LMP Parameters */
4531         case 0x1f:      /* Unspecified error */
4532         case 0x20:      /* Unsupported LMP Parameter value */
4533                 if (conn->out) {
4534                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4535                                         (hdev->esco_type & EDR_ESCO_MASK);
4536                         if (hci_setup_sync(conn, conn->link->handle))
4537                                 goto unlock;
4538                 }
4539                 fallthrough;
4540
4541         default:
4542                 conn->state = BT_CLOSED;
4543                 break;
4544         }
4545
4546         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4547
4548         switch (ev->air_mode) {
4549         case 0x02:
4550                 if (hdev->notify)
4551                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4552                 break;
4553         case 0x03:
4554                 if (hdev->notify)
4555                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4556                 break;
4557         }
4558
4559         hci_connect_cfm(conn, ev->status);
4560         if (ev->status)
4561                 hci_conn_del(conn);
4562
4563 unlock:
4564         hci_dev_unlock(hdev);
4565 }
4566
4567 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4568 {
4569         size_t parsed = 0;
4570
4571         while (parsed < eir_len) {
4572                 u8 field_len = eir[0];
4573
4574                 if (field_len == 0)
4575                         return parsed;
4576
4577                 parsed += field_len + 1;
4578                 eir += field_len + 1;
4579         }
4580
4581         return eir_len;
4582 }
4583
4584 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4585                                             struct sk_buff *skb)
4586 {
4587         struct inquiry_data data;
4588         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4589         int num_rsp = *((__u8 *) skb->data);
4590         size_t eir_len;
4591
4592         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4593
4594         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4595                 return;
4596
4597         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4598                 return;
4599
4600         hci_dev_lock(hdev);
4601
4602         for (; num_rsp; num_rsp--, info++) {
4603                 u32 flags;
4604                 bool name_known;
4605
4606                 bacpy(&data.bdaddr, &info->bdaddr);
4607                 data.pscan_rep_mode     = info->pscan_rep_mode;
4608                 data.pscan_period_mode  = info->pscan_period_mode;
4609                 data.pscan_mode         = 0x00;
4610                 memcpy(data.dev_class, info->dev_class, 3);
4611                 data.clock_offset       = info->clock_offset;
4612                 data.rssi               = info->rssi;
4613                 data.ssp_mode           = 0x01;
4614
4615                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4616                         name_known = eir_get_data(info->data,
4617                                                   sizeof(info->data),
4618                                                   EIR_NAME_COMPLETE, NULL);
4619                 else
4620                         name_known = true;
4621
4622                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4623
4624                 eir_len = eir_get_length(info->data, sizeof(info->data));
4625
4626                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4627                                   info->dev_class, info->rssi,
4628                                   flags, info->data, eir_len, NULL, 0);
4629         }
4630
4631         hci_dev_unlock(hdev);
4632 }
4633
4634 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4635                                          struct sk_buff *skb)
4636 {
4637         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4638         struct hci_conn *conn;
4639
4640         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4641                __le16_to_cpu(ev->handle));
4642
4643         hci_dev_lock(hdev);
4644
4645         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4646         if (!conn)
4647                 goto unlock;
4648
4649         /* For BR/EDR the necessary steps are taken through the
4650          * auth_complete event.
4651          */
4652         if (conn->type != LE_LINK)
4653                 goto unlock;
4654
4655         if (!ev->status)
4656                 conn->sec_level = conn->pending_sec_level;
4657
4658         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4659
4660         if (ev->status && conn->state == BT_CONNECTED) {
4661                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4662                 hci_conn_drop(conn);
4663                 goto unlock;
4664         }
4665
4666         if (conn->state == BT_CONFIG) {
4667                 if (!ev->status)
4668                         conn->state = BT_CONNECTED;
4669
4670                 hci_connect_cfm(conn, ev->status);
4671                 hci_conn_drop(conn);
4672         } else {
4673                 hci_auth_cfm(conn, ev->status);
4674
4675                 hci_conn_hold(conn);
4676                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4677                 hci_conn_drop(conn);
4678         }
4679
4680 unlock:
4681         hci_dev_unlock(hdev);
4682 }
4683
4684 static u8 hci_get_auth_req(struct hci_conn *conn)
4685 {
4686         /* If remote requests no-bonding follow that lead */
4687         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4688             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4689                 return conn->remote_auth | (conn->auth_type & 0x01);
4690
4691         /* If both remote and local have enough IO capabilities, require
4692          * MITM protection
4693          */
4694         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4695             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4696                 return conn->remote_auth | 0x01;
4697
4698         /* No MITM protection possible so ignore remote requirement */
4699         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4700 }
4701
4702 static u8 bredr_oob_data_present(struct hci_conn *conn)
4703 {
4704         struct hci_dev *hdev = conn->hdev;
4705         struct oob_data *data;
4706
4707         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4708         if (!data)
4709                 return 0x00;
4710
4711         if (bredr_sc_enabled(hdev)) {
4712                 /* When Secure Connections is enabled, then just
4713                  * return the present value stored with the OOB
4714                  * data. The stored value contains the right present
4715                  * information. However it can only be trusted when
4716                  * not in Secure Connection Only mode.
4717                  */
4718                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4719                         return data->present;
4720
4721                 /* When Secure Connections Only mode is enabled, then
4722                  * the P-256 values are required. If they are not
4723                  * available, then do not declare that OOB data is
4724                  * present.
4725                  */
4726                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4727                     !memcmp(data->hash256, ZERO_KEY, 16))
4728                         return 0x00;
4729
4730                 return 0x02;
4731         }
4732
4733         /* When Secure Connections is not enabled or actually
4734          * not supported by the hardware, then check that if
4735          * P-192 data values are present.
4736          */
4737         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4738             !memcmp(data->hash192, ZERO_KEY, 16))
4739                 return 0x00;
4740
4741         return 0x01;
4742 }
4743
4744 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4745 {
4746         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4747         struct hci_conn *conn;
4748
4749         BT_DBG("%s", hdev->name);
4750
4751         hci_dev_lock(hdev);
4752
4753         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4754         if (!conn)
4755                 goto unlock;
4756
4757         hci_conn_hold(conn);
4758
4759         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4760                 goto unlock;
4761
4762         /* Allow pairing if we're pairable, the initiators of the
4763          * pairing or if the remote is not requesting bonding.
4764          */
4765         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4766             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4767             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4768                 struct hci_cp_io_capability_reply cp;
4769
4770                 bacpy(&cp.bdaddr, &ev->bdaddr);
4771                 /* Change the IO capability from KeyboardDisplay
4772                  * to DisplayYesNo as it is not supported by BT spec. */
4773                 cp.capability = (conn->io_capability == 0x04) ?
4774                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4775
4776                 /* If we are initiators, there is no remote information yet */
4777                 if (conn->remote_auth == 0xff) {
4778                         /* Request MITM protection if our IO caps allow it
4779                          * except for the no-bonding case.
4780                          */
4781                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4782                             conn->auth_type != HCI_AT_NO_BONDING)
4783                                 conn->auth_type |= 0x01;
4784                 } else {
4785                         conn->auth_type = hci_get_auth_req(conn);
4786                 }
4787
4788                 /* If we're not bondable, force one of the non-bondable
4789                  * authentication requirement values.
4790                  */
4791                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4792                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4793
4794                 cp.authentication = conn->auth_type;
4795                 cp.oob_data = bredr_oob_data_present(conn);
4796
4797                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4798                              sizeof(cp), &cp);
4799         } else {
4800                 struct hci_cp_io_capability_neg_reply cp;
4801
4802                 bacpy(&cp.bdaddr, &ev->bdaddr);
4803                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4804
4805                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4806                              sizeof(cp), &cp);
4807         }
4808
4809 unlock:
4810         hci_dev_unlock(hdev);
4811 }
4812
4813 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4814 {
4815         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4816         struct hci_conn *conn;
4817
4818         BT_DBG("%s", hdev->name);
4819
4820         hci_dev_lock(hdev);
4821
4822         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4823         if (!conn)
4824                 goto unlock;
4825
4826         conn->remote_cap = ev->capability;
4827         conn->remote_auth = ev->authentication;
4828
4829 unlock:
4830         hci_dev_unlock(hdev);
4831 }
4832
4833 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4834                                          struct sk_buff *skb)
4835 {
4836         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4837         int loc_mitm, rem_mitm, confirm_hint = 0;
4838         struct hci_conn *conn;
4839
4840         BT_DBG("%s", hdev->name);
4841
4842         hci_dev_lock(hdev);
4843
4844         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4845                 goto unlock;
4846
4847         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4848         if (!conn)
4849                 goto unlock;
4850
4851         loc_mitm = (conn->auth_type & 0x01);
4852         rem_mitm = (conn->remote_auth & 0x01);
4853
4854         /* If we require MITM but the remote device can't provide that
4855          * (it has NoInputNoOutput) then reject the confirmation
4856          * request. We check the security level here since it doesn't
4857          * necessarily match conn->auth_type.
4858          */
4859         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4860             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4861                 BT_DBG("Rejecting request: remote device can't provide MITM");
4862                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4863                              sizeof(ev->bdaddr), &ev->bdaddr);
4864                 goto unlock;
4865         }
4866
4867         /* If no side requires MITM protection; auto-accept */
4868         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4869             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4870
4871                 /* If we're not the initiators request authorization to
4872                  * proceed from user space (mgmt_user_confirm with
4873                  * confirm_hint set to 1). The exception is if neither
4874                  * side had MITM or if the local IO capability is
4875                  * NoInputNoOutput, in which case we do auto-accept
4876                  */
4877                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4878                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4879                     (loc_mitm || rem_mitm)) {
4880                         BT_DBG("Confirming auto-accept as acceptor");
4881                         confirm_hint = 1;
4882                         goto confirm;
4883                 }
4884
4885                 /* If there already exists link key in local host, leave the
4886                  * decision to user space since the remote device could be
4887                  * legitimate or malicious.
4888                  */
4889                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4890                         bt_dev_dbg(hdev, "Local host already has link key");
4891                         confirm_hint = 1;
4892                         goto confirm;
4893                 }
4894
4895                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4896                        hdev->auto_accept_delay);
4897
4898                 if (hdev->auto_accept_delay > 0) {
4899                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4900                         queue_delayed_work(conn->hdev->workqueue,
4901                                            &conn->auto_accept_work, delay);
4902                         goto unlock;
4903                 }
4904
4905                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4906                              sizeof(ev->bdaddr), &ev->bdaddr);
4907                 goto unlock;
4908         }
4909
4910 confirm:
4911         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4912                                   le32_to_cpu(ev->passkey), confirm_hint);
4913
4914 unlock:
4915         hci_dev_unlock(hdev);
4916 }
4917
4918 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4919                                          struct sk_buff *skb)
4920 {
4921         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4922
4923         BT_DBG("%s", hdev->name);
4924
4925         if (hci_dev_test_flag(hdev, HCI_MGMT))
4926                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4927 }
4928
4929 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4930                                         struct sk_buff *skb)
4931 {
4932         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4933         struct hci_conn *conn;
4934
4935         BT_DBG("%s", hdev->name);
4936
4937         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4938         if (!conn)
4939                 return;
4940
4941         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4942         conn->passkey_entered = 0;
4943
4944         if (hci_dev_test_flag(hdev, HCI_MGMT))
4945                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4946                                          conn->dst_type, conn->passkey_notify,
4947                                          conn->passkey_entered);
4948 }
4949
4950 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4951 {
4952         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4953         struct hci_conn *conn;
4954
4955         BT_DBG("%s", hdev->name);
4956
4957         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4958         if (!conn)
4959                 return;
4960
4961         switch (ev->type) {
4962         case HCI_KEYPRESS_STARTED:
4963                 conn->passkey_entered = 0;
4964                 return;
4965
4966         case HCI_KEYPRESS_ENTERED:
4967                 conn->passkey_entered++;
4968                 break;
4969
4970         case HCI_KEYPRESS_ERASED:
4971                 conn->passkey_entered--;
4972                 break;
4973
4974         case HCI_KEYPRESS_CLEARED:
4975                 conn->passkey_entered = 0;
4976                 break;
4977
4978         case HCI_KEYPRESS_COMPLETED:
4979                 return;
4980         }
4981
4982         if (hci_dev_test_flag(hdev, HCI_MGMT))
4983                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4984                                          conn->dst_type, conn->passkey_notify,
4985                                          conn->passkey_entered);
4986 }
4987
4988 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4989                                          struct sk_buff *skb)
4990 {
4991         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4992         struct hci_conn *conn;
4993
4994         BT_DBG("%s", hdev->name);
4995
4996         hci_dev_lock(hdev);
4997
4998         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4999         if (!conn)
5000                 goto unlock;
5001
5002         /* Reset the authentication requirement to unknown */
5003         conn->remote_auth = 0xff;
5004
5005         /* To avoid duplicate auth_failed events to user space we check
5006          * the HCI_CONN_AUTH_PEND flag which will be set if we
5007          * initiated the authentication. A traditional auth_complete
5008          * event gets always produced as initiator and is also mapped to
5009          * the mgmt_auth_failed event */
5010         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5011                 mgmt_auth_failed(conn, ev->status);
5012
5013         hci_conn_drop(conn);
5014
5015 unlock:
5016         hci_dev_unlock(hdev);
5017 }
5018
5019 static void hci_remote_host_features_evt(struct hci_dev *hdev,
5020                                          struct sk_buff *skb)
5021 {
5022         struct hci_ev_remote_host_features *ev = (void *) skb->data;
5023         struct inquiry_entry *ie;
5024         struct hci_conn *conn;
5025
5026         BT_DBG("%s", hdev->name);
5027
5028         hci_dev_lock(hdev);
5029
5030         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5031         if (conn)
5032                 memcpy(conn->features[1], ev->features, 8);
5033
5034         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5035         if (ie)
5036                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5037
5038         hci_dev_unlock(hdev);
5039 }
5040
5041 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
5042                                             struct sk_buff *skb)
5043 {
5044         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
5045         struct oob_data *data;
5046
5047         BT_DBG("%s", hdev->name);
5048
5049         hci_dev_lock(hdev);
5050
5051         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5052                 goto unlock;
5053
5054         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5055         if (!data) {
5056                 struct hci_cp_remote_oob_data_neg_reply cp;
5057
5058                 bacpy(&cp.bdaddr, &ev->bdaddr);
5059                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5060                              sizeof(cp), &cp);
5061                 goto unlock;
5062         }
5063
5064         if (bredr_sc_enabled(hdev)) {
5065                 struct hci_cp_remote_oob_ext_data_reply cp;
5066
5067                 bacpy(&cp.bdaddr, &ev->bdaddr);
5068                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5069                         memset(cp.hash192, 0, sizeof(cp.hash192));
5070                         memset(cp.rand192, 0, sizeof(cp.rand192));
5071                 } else {
5072                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5073                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5074                 }
5075                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5076                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5077
5078                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5079                              sizeof(cp), &cp);
5080         } else {
5081                 struct hci_cp_remote_oob_data_reply cp;
5082
5083                 bacpy(&cp.bdaddr, &ev->bdaddr);
5084                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5085                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5086
5087                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5088                              sizeof(cp), &cp);
5089         }
5090
5091 unlock:
5092         hci_dev_unlock(hdev);
5093 }
5094
5095 #if IS_ENABLED(CONFIG_BT_HS)
5096 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5097 {
5098         struct hci_ev_channel_selected *ev = (void *)skb->data;
5099         struct hci_conn *hcon;
5100
5101         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5102
5103         skb_pull(skb, sizeof(*ev));
5104
5105         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5106         if (!hcon)
5107                 return;
5108
5109         amp_read_loc_assoc_final_data(hdev, hcon);
5110 }
5111
5112 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
5113                                       struct sk_buff *skb)
5114 {
5115         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
5116         struct hci_conn *hcon, *bredr_hcon;
5117
5118         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
5119                ev->status);
5120
5121         hci_dev_lock(hdev);
5122
5123         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5124         if (!hcon)
5125                 goto unlock;
5126
5127         if (!hcon->amp_mgr)
5128                 goto unlock;
5129
5130         if (ev->status) {
5131                 hci_conn_del(hcon);
5132                 goto unlock;
5133         }
5134
5135         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5136
5137         hcon->state = BT_CONNECTED;
5138         bacpy(&hcon->dst, &bredr_hcon->dst);
5139
5140         hci_conn_hold(hcon);
5141         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5142         hci_conn_drop(hcon);
5143
5144         hci_debugfs_create_conn(hcon);
5145         hci_conn_add_sysfs(hcon);
5146
5147         amp_physical_cfm(bredr_hcon, hcon);
5148
5149 unlock:
5150         hci_dev_unlock(hdev);
5151 }
5152
5153 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5154 {
5155         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
5156         struct hci_conn *hcon;
5157         struct hci_chan *hchan;
5158         struct amp_mgr *mgr;
5159
5160         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5161                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
5162                ev->status);
5163
5164         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5165         if (!hcon)
5166                 return;
5167
5168         /* Create AMP hchan */
5169         hchan = hci_chan_create(hcon);
5170         if (!hchan)
5171                 return;
5172
5173         hchan->handle = le16_to_cpu(ev->handle);
5174         hchan->amp = true;
5175
5176         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5177
5178         mgr = hcon->amp_mgr;
5179         if (mgr && mgr->bredr_chan) {
5180                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5181
5182                 l2cap_chan_lock(bredr_chan);
5183
5184                 bredr_chan->conn->mtu = hdev->block_mtu;
5185                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5186                 hci_conn_hold(hcon);
5187
5188                 l2cap_chan_unlock(bredr_chan);
5189         }
5190 }
5191
5192 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5193                                              struct sk_buff *skb)
5194 {
5195         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5196         struct hci_chan *hchan;
5197
5198         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5199                le16_to_cpu(ev->handle), ev->status);
5200
5201         if (ev->status)
5202                 return;
5203
5204         hci_dev_lock(hdev);
5205
5206         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5207         if (!hchan || !hchan->amp)
5208                 goto unlock;
5209
5210         amp_destroy_logical_link(hchan, ev->reason);
5211
5212 unlock:
5213         hci_dev_unlock(hdev);
5214 }
5215
5216 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5217                                              struct sk_buff *skb)
5218 {
5219         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5220         struct hci_conn *hcon;
5221
5222         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5223
5224         if (ev->status)
5225                 return;
5226
5227         hci_dev_lock(hdev);
5228
5229         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5230         if (hcon && hcon->type == AMP_LINK) {
5231                 hcon->state = BT_CLOSED;
5232                 hci_disconn_cfm(hcon, ev->reason);
5233                 hci_conn_del(hcon);
5234         }
5235
5236         hci_dev_unlock(hdev);
5237 }
5238 #endif
5239
5240 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5241                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5242 {
5243         if (conn->out) {
5244                 conn->dst_type = bdaddr_type;
5245                 conn->resp_addr_type = bdaddr_type;
5246                 bacpy(&conn->resp_addr, bdaddr);
5247
5248                 /* Check if the controller has set a Local RPA then it must be
5249                  * used instead or hdev->rpa.
5250                  */
5251                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5252                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5253                         bacpy(&conn->init_addr, local_rpa);
5254                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5255                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5256                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5257                 } else {
5258                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5259                                                   &conn->init_addr_type);
5260                 }
5261         } else {
5262                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5263                 /* Check if the controller has set a Local RPA then it must be
5264                  * used instead or hdev->rpa.
5265                  */
5266                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5267                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5268                         bacpy(&conn->resp_addr, local_rpa);
5269                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5270                         /* In case of ext adv, resp_addr will be updated in
5271                          * Adv Terminated event.
5272                          */
5273                         if (!ext_adv_capable(conn->hdev))
5274                                 bacpy(&conn->resp_addr,
5275                                       &conn->hdev->random_addr);
5276                 } else {
5277                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5278                 }
5279
5280                 conn->init_addr_type = bdaddr_type;
5281                 bacpy(&conn->init_addr, bdaddr);
5282
5283                 /* For incoming connections, set the default minimum
5284                  * and maximum connection interval. They will be used
5285                  * to check if the parameters are in range and if not
5286                  * trigger the connection update procedure.
5287                  */
5288                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5289                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5290         }
5291 }
5292
5293 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5294                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5295                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5296                                  u16 interval, u16 latency,
5297                                  u16 supervision_timeout)
5298 {
5299         struct hci_conn_params *params;
5300         struct hci_conn *conn;
5301         struct smp_irk *irk;
5302         u8 addr_type;
5303
5304         hci_dev_lock(hdev);
5305
5306         /* All controllers implicitly stop advertising in the event of a
5307          * connection, so ensure that the state bit is cleared.
5308          */
5309         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5310
5311         conn = hci_lookup_le_connect(hdev);
5312         if (!conn) {
5313                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5314                 if (!conn) {
5315                         bt_dev_err(hdev, "no memory for new connection");
5316                         goto unlock;
5317                 }
5318
5319                 conn->dst_type = bdaddr_type;
5320
5321                 /* If we didn't have a hci_conn object previously
5322                  * but we're in central role this must be something
5323                  * initiated using an accept list. Since accept list based
5324                  * connections are not "first class citizens" we don't
5325                  * have full tracking of them. Therefore, we go ahead
5326                  * with a "best effort" approach of determining the
5327                  * initiator address based on the HCI_PRIVACY flag.
5328                  */
5329                 if (conn->out) {
5330                         conn->resp_addr_type = bdaddr_type;
5331                         bacpy(&conn->resp_addr, bdaddr);
5332                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5333                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5334                                 bacpy(&conn->init_addr, &hdev->rpa);
5335                         } else {
5336                                 hci_copy_identity_address(hdev,
5337                                                           &conn->init_addr,
5338                                                           &conn->init_addr_type);
5339                         }
5340                 }
5341         } else {
5342                 cancel_delayed_work(&conn->le_conn_timeout);
5343         }
5344
5345         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5346
5347         /* Lookup the identity address from the stored connection
5348          * address and address type.
5349          *
5350          * When establishing connections to an identity address, the
5351          * connection procedure will store the resolvable random
5352          * address first. Now if it can be converted back into the
5353          * identity address, start using the identity address from
5354          * now on.
5355          */
5356         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5357         if (irk) {
5358                 bacpy(&conn->dst, &irk->bdaddr);
5359                 conn->dst_type = irk->addr_type;
5360         }
5361
5362         /* When using controller based address resolution, then the new
5363          * address types 0x02 and 0x03 are used. These types need to be
5364          * converted back into either public address or random address type
5365          */
5366         if (use_ll_privacy(hdev) &&
5367             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5368             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
5369                 switch (conn->dst_type) {
5370                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
5371                         conn->dst_type = ADDR_LE_DEV_PUBLIC;
5372                         break;
5373                 case ADDR_LE_DEV_RANDOM_RESOLVED:
5374                         conn->dst_type = ADDR_LE_DEV_RANDOM;
5375                         break;
5376                 }
5377         }
5378
5379         if (status) {
5380                 hci_le_conn_failed(conn, status);
5381                 goto unlock;
5382         }
5383
5384         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5385                 addr_type = BDADDR_LE_PUBLIC;
5386         else
5387                 addr_type = BDADDR_LE_RANDOM;
5388
5389         /* Drop the connection if the device is blocked */
5390         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5391                 hci_conn_drop(conn);
5392                 goto unlock;
5393         }
5394
5395         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5396                 mgmt_device_connected(hdev, conn, NULL, 0);
5397
5398         conn->sec_level = BT_SECURITY_LOW;
5399         conn->handle = handle;
5400         conn->state = BT_CONFIG;
5401
5402         /* Store current advertising instance as connection advertising instance
5403          * when sotfware rotation is in use so it can be re-enabled when
5404          * disconnected.
5405          */
5406         if (!ext_adv_capable(hdev))
5407                 conn->adv_instance = hdev->cur_adv_instance;
5408
5409         conn->le_conn_interval = interval;
5410         conn->le_conn_latency = latency;
5411         conn->le_supv_timeout = supervision_timeout;
5412
5413         hci_debugfs_create_conn(conn);
5414         hci_conn_add_sysfs(conn);
5415
5416         /* The remote features procedure is defined for central
5417          * role only. So only in case of an initiated connection
5418          * request the remote features.
5419          *
5420          * If the local controller supports peripheral-initiated features
5421          * exchange, then requesting the remote features in peripheral
5422          * role is possible. Otherwise just transition into the
5423          * connected state without requesting the remote features.
5424          */
5425         if (conn->out ||
5426             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5427                 struct hci_cp_le_read_remote_features cp;
5428
5429                 cp.handle = __cpu_to_le16(conn->handle);
5430
5431                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5432                              sizeof(cp), &cp);
5433
5434                 hci_conn_hold(conn);
5435         } else {
5436                 conn->state = BT_CONNECTED;
5437                 hci_connect_cfm(conn, status);
5438         }
5439
5440         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5441                                            conn->dst_type);
5442         if (params) {
5443                 list_del_init(&params->action);
5444                 if (params->conn) {
5445                         hci_conn_drop(params->conn);
5446                         hci_conn_put(params->conn);
5447                         params->conn = NULL;
5448                 }
5449         }
5450
5451 unlock:
5452         hci_update_background_scan(hdev);
5453         hci_dev_unlock(hdev);
5454 }
5455
5456 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5457 {
5458         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5459
5460         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5461
5462         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5463                              NULL, ev->role, le16_to_cpu(ev->handle),
5464                              le16_to_cpu(ev->interval),
5465                              le16_to_cpu(ev->latency),
5466                              le16_to_cpu(ev->supervision_timeout));
5467 }
5468
5469 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5470                                          struct sk_buff *skb)
5471 {
5472         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5473
5474         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5475
5476         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5477                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5478                              le16_to_cpu(ev->interval),
5479                              le16_to_cpu(ev->latency),
5480                              le16_to_cpu(ev->supervision_timeout));
5481
5482         if (use_ll_privacy(hdev) &&
5483             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5484             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5485                 hci_req_disable_address_resolution(hdev);
5486 }
5487
5488 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5489 {
5490         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5491         struct hci_conn *conn;
5492         struct adv_info *adv;
5493
5494         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5495
5496         adv = hci_find_adv_instance(hdev, ev->handle);
5497
5498         if (ev->status) {
5499                 if (!adv)
5500                         return;
5501
5502                 /* Remove advertising as it has been terminated */
5503                 hci_remove_adv_instance(hdev, ev->handle);
5504                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5505
5506                 return;
5507         }
5508
5509         if (adv)
5510                 adv->enabled = false;
5511
5512         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5513         if (conn) {
5514                 /* Store handle in the connection so the correct advertising
5515                  * instance can be re-enabled when disconnected.
5516                  */
5517                 conn->adv_instance = ev->handle;
5518
5519                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5520                     bacmp(&conn->resp_addr, BDADDR_ANY))
5521                         return;
5522
5523                 if (!ev->handle) {
5524                         bacpy(&conn->resp_addr, &hdev->random_addr);
5525                         return;
5526                 }
5527
5528                 if (adv)
5529                         bacpy(&conn->resp_addr, &adv->random_addr);
5530         }
5531 }
5532
5533 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5534                                             struct sk_buff *skb)
5535 {
5536         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5537         struct hci_conn *conn;
5538
5539         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5540
5541         if (ev->status)
5542                 return;
5543
5544         hci_dev_lock(hdev);
5545
5546         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5547         if (conn) {
5548 #ifdef TIZEN_BT
5549                 if (ev->status) {
5550                         hci_dev_unlock(hdev);
5551                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5552                                 conn->type, conn->dst_type, ev->status);
5553                         return;
5554                 }
5555 #endif
5556                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5557                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5558                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5559         }
5560
5561         hci_dev_unlock(hdev);
5562
5563 #ifdef TIZEN_BT
5564         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5565                                 conn->dst_type, conn->le_conn_interval,
5566                                 conn->le_conn_latency, conn->le_supv_timeout);
5567 #endif
5568 }
5569
5570 /* This function requires the caller holds hdev->lock */
5571 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5572                                               bdaddr_t *addr,
5573                                               u8 addr_type, u8 adv_type,
5574                                               bdaddr_t *direct_rpa)
5575 {
5576         struct hci_conn *conn;
5577         struct hci_conn_params *params;
5578
5579         /* If the event is not connectable don't proceed further */
5580         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5581                 return NULL;
5582
5583         /* Ignore if the device is blocked */
5584         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type))
5585                 return NULL;
5586
5587         /* Most controller will fail if we try to create new connections
5588          * while we have an existing one in peripheral role.
5589          */
5590         if (hdev->conn_hash.le_num_peripheral > 0 &&
5591             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5592              !(hdev->le_states[3] & 0x10)))
5593                 return NULL;
5594
5595         /* If we're not connectable only connect devices that we have in
5596          * our pend_le_conns list.
5597          */
5598         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5599                                            addr_type);
5600         if (!params)
5601                 return NULL;
5602
5603         if (!params->explicit_connect) {
5604                 switch (params->auto_connect) {
5605                 case HCI_AUTO_CONN_DIRECT:
5606                         /* Only devices advertising with ADV_DIRECT_IND are
5607                          * triggering a connection attempt. This is allowing
5608                          * incoming connections from peripheral devices.
5609                          */
5610                         if (adv_type != LE_ADV_DIRECT_IND)
5611                                 return NULL;
5612                         break;
5613                 case HCI_AUTO_CONN_ALWAYS:
5614                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5615                          * are triggering a connection attempt. This means
5616                          * that incoming connections from peripheral device are
5617                          * accepted and also outgoing connections to peripheral
5618                          * devices are established when found.
5619                          */
5620                         break;
5621                 default:
5622                         return NULL;
5623                 }
5624         }
5625
5626         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5627                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5628                               direct_rpa);
5629         if (!IS_ERR(conn)) {
5630                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5631                  * by higher layer that tried to connect, if no then
5632                  * store the pointer since we don't really have any
5633                  * other owner of the object besides the params that
5634                  * triggered it. This way we can abort the connection if
5635                  * the parameters get removed and keep the reference
5636                  * count consistent once the connection is established.
5637                  */
5638
5639                 if (!params->explicit_connect)
5640                         params->conn = hci_conn_get(conn);
5641
5642                 return conn;
5643         }
5644
5645         switch (PTR_ERR(conn)) {
5646         case -EBUSY:
5647                 /* If hci_connect() returns -EBUSY it means there is already
5648                  * an LE connection attempt going on. Since controllers don't
5649                  * support more than one connection attempt at the time, we
5650                  * don't consider this an error case.
5651                  */
5652                 break;
5653         default:
5654                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5655                 return NULL;
5656         }
5657
5658         return NULL;
5659 }
5660
5661 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5662                                u8 bdaddr_type, bdaddr_t *direct_addr,
5663                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5664                                bool ext_adv)
5665 {
5666         struct discovery_state *d = &hdev->discovery;
5667         struct smp_irk *irk;
5668         struct hci_conn *conn;
5669         bool match;
5670         u32 flags;
5671         u8 *ptr;
5672
5673         switch (type) {
5674         case LE_ADV_IND:
5675         case LE_ADV_DIRECT_IND:
5676         case LE_ADV_SCAN_IND:
5677         case LE_ADV_NONCONN_IND:
5678         case LE_ADV_SCAN_RSP:
5679                 break;
5680         default:
5681                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5682                                        "type: 0x%02x", type);
5683                 return;
5684         }
5685
5686         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5687                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5688                 return;
5689         }
5690
5691         /* Find the end of the data in case the report contains padded zero
5692          * bytes at the end causing an invalid length value.
5693          *
5694          * When data is NULL, len is 0 so there is no need for extra ptr
5695          * check as 'ptr < data + 0' is already false in such case.
5696          */
5697         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5698                 if (ptr + 1 + *ptr > data + len)
5699                         break;
5700         }
5701
5702         /* Adjust for actual length. This handles the case when remote
5703          * device is advertising with incorrect data length.
5704          */
5705         len = ptr - data;
5706
5707         /* If the direct address is present, then this report is from
5708          * a LE Direct Advertising Report event. In that case it is
5709          * important to see if the address is matching the local
5710          * controller address.
5711          */
5712         if (direct_addr) {
5713                 /* Only resolvable random addresses are valid for these
5714                  * kind of reports and others can be ignored.
5715                  */
5716                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5717                         return;
5718
5719                 /* If the controller is not using resolvable random
5720                  * addresses, then this report can be ignored.
5721                  */
5722                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5723                         return;
5724
5725                 /* If the local IRK of the controller does not match
5726                  * with the resolvable random address provided, then
5727                  * this report can be ignored.
5728                  */
5729                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5730                         return;
5731         }
5732
5733         /* Check if we need to convert to identity address */
5734         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5735         if (irk) {
5736                 bdaddr = &irk->bdaddr;
5737                 bdaddr_type = irk->addr_type;
5738         }
5739
5740         /* Check if we have been requested to connect to this device.
5741          *
5742          * direct_addr is set only for directed advertising reports (it is NULL
5743          * for advertising reports) and is already verified to be RPA above.
5744          */
5745         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5746                                                                 direct_addr);
5747         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5748                 /* Store report for later inclusion by
5749                  * mgmt_device_connected
5750                  */
5751                 memcpy(conn->le_adv_data, data, len);
5752                 conn->le_adv_data_len = len;
5753         }
5754
5755         /* Passive scanning shouldn't trigger any device found events,
5756          * except for devices marked as CONN_REPORT for which we do send
5757          * device found events, or advertisement monitoring requested.
5758          */
5759         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5760                 if (type == LE_ADV_DIRECT_IND)
5761                         return;
5762
5763                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5764                                                bdaddr, bdaddr_type) &&
5765                     idr_is_empty(&hdev->adv_monitors_idr))
5766                         return;
5767
5768                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5769                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5770                 else
5771                         flags = 0;
5772                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5773                                   rssi, flags, data, len, NULL, 0);
5774                 return;
5775         }
5776
5777         /* When receiving non-connectable or scannable undirected
5778          * advertising reports, this means that the remote device is
5779          * not connectable and then clearly indicate this in the
5780          * device found event.
5781          *
5782          * When receiving a scan response, then there is no way to
5783          * know if the remote device is connectable or not. However
5784          * since scan responses are merged with a previously seen
5785          * advertising report, the flags field from that report
5786          * will be used.
5787          *
5788          * In the really unlikely case that a controller get confused
5789          * and just sends a scan response event, then it is marked as
5790          * not connectable as well.
5791          */
5792         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5793             type == LE_ADV_SCAN_RSP)
5794                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5795         else
5796                 flags = 0;
5797
5798         /* If there's nothing pending either store the data from this
5799          * event or send an immediate device found event if the data
5800          * should not be stored for later.
5801          */
5802         if (!ext_adv && !has_pending_adv_report(hdev)) {
5803                 /* If the report will trigger a SCAN_REQ store it for
5804                  * later merging.
5805                  */
5806                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5807                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5808                                                  rssi, flags, data, len);
5809                         return;
5810                 }
5811
5812                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5813                                   rssi, flags, data, len, NULL, 0);
5814                 return;
5815         }
5816
5817         /* Check if the pending report is for the same device as the new one */
5818         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5819                  bdaddr_type == d->last_adv_addr_type);
5820
5821         /* If the pending data doesn't match this report or this isn't a
5822          * scan response (e.g. we got a duplicate ADV_IND) then force
5823          * sending of the pending data.
5824          */
5825         if (type != LE_ADV_SCAN_RSP || !match) {
5826                 /* Send out whatever is in the cache, but skip duplicates */
5827                 if (!match)
5828                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5829                                           d->last_adv_addr_type, NULL,
5830                                           d->last_adv_rssi, d->last_adv_flags,
5831                                           d->last_adv_data,
5832                                           d->last_adv_data_len, NULL, 0);
5833
5834                 /* If the new report will trigger a SCAN_REQ store it for
5835                  * later merging.
5836                  */
5837                 if (!ext_adv && (type == LE_ADV_IND ||
5838                                  type == LE_ADV_SCAN_IND)) {
5839                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5840                                                  rssi, flags, data, len);
5841                         return;
5842                 }
5843
5844                 /* The advertising reports cannot be merged, so clear
5845                  * the pending report and send out a device found event.
5846                  */
5847                 clear_pending_adv_report(hdev);
5848                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5849                                   rssi, flags, data, len, NULL, 0);
5850                 return;
5851         }
5852
5853         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5854          * the new event is a SCAN_RSP. We can therefore proceed with
5855          * sending a merged device found event.
5856          */
5857         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5858                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5859                           d->last_adv_data, d->last_adv_data_len, data, len);
5860         clear_pending_adv_report(hdev);
5861 }
5862
5863 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5864 {
5865         u8 num_reports = skb->data[0];
5866         void *ptr = &skb->data[1];
5867
5868         hci_dev_lock(hdev);
5869
5870         while (num_reports--) {
5871                 struct hci_ev_le_advertising_info *ev = ptr;
5872                 s8 rssi;
5873
5874                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
5875                         bt_dev_err(hdev, "Malicious advertising data.");
5876                         break;
5877                 }
5878
5879                 if (ev->length <= HCI_MAX_AD_LENGTH &&
5880                     ev->data + ev->length <= skb_tail_pointer(skb)) {
5881                         rssi = ev->data[ev->length];
5882                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5883                                            ev->bdaddr_type, NULL, 0, rssi,
5884                                            ev->data, ev->length, false);
5885                 } else {
5886                         bt_dev_err(hdev, "Dropping invalid advertising data");
5887                 }
5888
5889                 ptr += sizeof(*ev) + ev->length + 1;
5890         }
5891
5892         hci_dev_unlock(hdev);
5893 }
5894
5895 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5896 {
5897         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5898                 switch (evt_type) {
5899                 case LE_LEGACY_ADV_IND:
5900                         return LE_ADV_IND;
5901                 case LE_LEGACY_ADV_DIRECT_IND:
5902                         return LE_ADV_DIRECT_IND;
5903                 case LE_LEGACY_ADV_SCAN_IND:
5904                         return LE_ADV_SCAN_IND;
5905                 case LE_LEGACY_NONCONN_IND:
5906                         return LE_ADV_NONCONN_IND;
5907                 case LE_LEGACY_SCAN_RSP_ADV:
5908                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5909                         return LE_ADV_SCAN_RSP;
5910                 }
5911
5912                 goto invalid;
5913         }
5914
5915         if (evt_type & LE_EXT_ADV_CONN_IND) {
5916                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5917                         return LE_ADV_DIRECT_IND;
5918
5919                 return LE_ADV_IND;
5920         }
5921
5922         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5923                 return LE_ADV_SCAN_RSP;
5924
5925         if (evt_type & LE_EXT_ADV_SCAN_IND)
5926                 return LE_ADV_SCAN_IND;
5927
5928         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5929             evt_type & LE_EXT_ADV_DIRECT_IND)
5930                 return LE_ADV_NONCONN_IND;
5931
5932 invalid:
5933         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5934                                evt_type);
5935
5936         return LE_ADV_INVALID;
5937 }
5938
5939 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5940 {
5941         u8 num_reports = skb->data[0];
5942         void *ptr = &skb->data[1];
5943
5944         hci_dev_lock(hdev);
5945
5946         while (num_reports--) {
5947                 struct hci_ev_le_ext_adv_report *ev = ptr;
5948                 u8 legacy_evt_type;
5949                 u16 evt_type;
5950
5951                 evt_type = __le16_to_cpu(ev->evt_type);
5952                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5953                 if (legacy_evt_type != LE_ADV_INVALID) {
5954                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5955                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5956                                            ev->data, ev->length,
5957                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5958                 }
5959
5960                 ptr += sizeof(*ev) + ev->length;
5961         }
5962
5963         hci_dev_unlock(hdev);
5964 }
5965
5966 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5967                                             struct sk_buff *skb)
5968 {
5969         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5970         struct hci_conn *conn;
5971
5972         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5973
5974         hci_dev_lock(hdev);
5975
5976         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5977         if (conn) {
5978                 if (!ev->status)
5979                         memcpy(conn->features[0], ev->features, 8);
5980
5981                 if (conn->state == BT_CONFIG) {
5982                         __u8 status;
5983
5984                         /* If the local controller supports peripheral-initiated
5985                          * features exchange, but the remote controller does
5986                          * not, then it is possible that the error code 0x1a
5987                          * for unsupported remote feature gets returned.
5988                          *
5989                          * In this specific case, allow the connection to
5990                          * transition into connected state and mark it as
5991                          * successful.
5992                          */
5993                         if (!conn->out && ev->status == 0x1a &&
5994                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
5995                                 status = 0x00;
5996                         else
5997                                 status = ev->status;
5998
5999                         conn->state = BT_CONNECTED;
6000                         hci_connect_cfm(conn, status);
6001                         hci_conn_drop(conn);
6002                 }
6003         }
6004
6005         hci_dev_unlock(hdev);
6006 }
6007
6008 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
6009 {
6010         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
6011         struct hci_cp_le_ltk_reply cp;
6012         struct hci_cp_le_ltk_neg_reply neg;
6013         struct hci_conn *conn;
6014         struct smp_ltk *ltk;
6015
6016         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
6017
6018         hci_dev_lock(hdev);
6019
6020         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6021         if (conn == NULL)
6022                 goto not_found;
6023
6024         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6025         if (!ltk)
6026                 goto not_found;
6027
6028         if (smp_ltk_is_sc(ltk)) {
6029                 /* With SC both EDiv and Rand are set to zero */
6030                 if (ev->ediv || ev->rand)
6031                         goto not_found;
6032         } else {
6033                 /* For non-SC keys check that EDiv and Rand match */
6034                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6035                         goto not_found;
6036         }
6037
6038         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6039         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6040         cp.handle = cpu_to_le16(conn->handle);
6041
6042         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6043
6044         conn->enc_key_size = ltk->enc_size;
6045
6046         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6047
6048         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6049          * temporary key used to encrypt a connection following
6050          * pairing. It is used during the Encrypted Session Setup to
6051          * distribute the keys. Later, security can be re-established
6052          * using a distributed LTK.
6053          */
6054         if (ltk->type == SMP_STK) {
6055                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6056                 list_del_rcu(&ltk->list);
6057                 kfree_rcu(ltk, rcu);
6058         } else {
6059                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6060         }
6061
6062         hci_dev_unlock(hdev);
6063
6064         return;
6065
6066 not_found:
6067         neg.handle = ev->handle;
6068         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6069         hci_dev_unlock(hdev);
6070 }
6071
6072 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6073                                       u8 reason)
6074 {
6075         struct hci_cp_le_conn_param_req_neg_reply cp;
6076
6077         cp.handle = cpu_to_le16(handle);
6078         cp.reason = reason;
6079
6080         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6081                      &cp);
6082 }
6083
6084 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
6085                                              struct sk_buff *skb)
6086 {
6087         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
6088         struct hci_cp_le_conn_param_req_reply cp;
6089         struct hci_conn *hcon;
6090         u16 handle, min, max, latency, timeout;
6091
6092         handle = le16_to_cpu(ev->handle);
6093         min = le16_to_cpu(ev->interval_min);
6094         max = le16_to_cpu(ev->interval_max);
6095         latency = le16_to_cpu(ev->latency);
6096         timeout = le16_to_cpu(ev->timeout);
6097
6098         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6099         if (!hcon || hcon->state != BT_CONNECTED)
6100                 return send_conn_param_neg_reply(hdev, handle,
6101                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6102
6103         if (hci_check_conn_params(min, max, latency, timeout))
6104                 return send_conn_param_neg_reply(hdev, handle,
6105                                                  HCI_ERROR_INVALID_LL_PARAMS);
6106
6107         if (hcon->role == HCI_ROLE_MASTER) {
6108                 struct hci_conn_params *params;
6109                 u8 store_hint;
6110
6111                 hci_dev_lock(hdev);
6112
6113                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6114                                                 hcon->dst_type);
6115                 if (params) {
6116                         params->conn_min_interval = min;
6117                         params->conn_max_interval = max;
6118                         params->conn_latency = latency;
6119                         params->supervision_timeout = timeout;
6120                         store_hint = 0x01;
6121                 } else {
6122                         store_hint = 0x00;
6123                 }
6124
6125                 hci_dev_unlock(hdev);
6126
6127                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6128                                     store_hint, min, max, latency, timeout);
6129         }
6130
6131         cp.handle = ev->handle;
6132         cp.interval_min = ev->interval_min;
6133         cp.interval_max = ev->interval_max;
6134         cp.latency = ev->latency;
6135         cp.timeout = ev->timeout;
6136         cp.min_ce_len = 0;
6137         cp.max_ce_len = 0;
6138
6139         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6140 }
6141
6142 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
6143                                          struct sk_buff *skb)
6144 {
6145         u8 num_reports = skb->data[0];
6146         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6147
6148         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
6149                 return;
6150
6151         hci_dev_lock(hdev);
6152
6153         for (; num_reports; num_reports--, ev++)
6154                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6155                                    ev->bdaddr_type, &ev->direct_addr,
6156                                    ev->direct_addr_type, ev->rssi, NULL, 0,
6157                                    false);
6158
6159         hci_dev_unlock(hdev);
6160 }
6161
6162 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
6163 {
6164         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
6165         struct hci_conn *conn;
6166
6167         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6168
6169         if (ev->status)
6170                 return;
6171
6172         hci_dev_lock(hdev);
6173
6174         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6175         if (!conn)
6176                 goto unlock;
6177
6178         conn->le_tx_phy = ev->tx_phy;
6179         conn->le_rx_phy = ev->rx_phy;
6180
6181 unlock:
6182         hci_dev_unlock(hdev);
6183 }
6184
6185 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
6186 {
6187         struct hci_ev_le_meta *le_ev = (void *) skb->data;
6188
6189         skb_pull(skb, sizeof(*le_ev));
6190
6191         switch (le_ev->subevent) {
6192         case HCI_EV_LE_CONN_COMPLETE:
6193                 hci_le_conn_complete_evt(hdev, skb);
6194                 break;
6195
6196         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
6197                 hci_le_conn_update_complete_evt(hdev, skb);
6198                 break;
6199
6200         case HCI_EV_LE_ADVERTISING_REPORT:
6201                 hci_le_adv_report_evt(hdev, skb);
6202                 break;
6203
6204         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
6205                 hci_le_remote_feat_complete_evt(hdev, skb);
6206                 break;
6207
6208         case HCI_EV_LE_LTK_REQ:
6209                 hci_le_ltk_request_evt(hdev, skb);
6210                 break;
6211
6212         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
6213                 hci_le_remote_conn_param_req_evt(hdev, skb);
6214                 break;
6215
6216         case HCI_EV_LE_DIRECT_ADV_REPORT:
6217                 hci_le_direct_adv_report_evt(hdev, skb);
6218                 break;
6219
6220         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6221                 hci_le_phy_update_evt(hdev, skb);
6222                 break;
6223
6224         case HCI_EV_LE_EXT_ADV_REPORT:
6225                 hci_le_ext_adv_report_evt(hdev, skb);
6226                 break;
6227
6228         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
6229                 hci_le_enh_conn_complete_evt(hdev, skb);
6230                 break;
6231
6232         case HCI_EV_LE_EXT_ADV_SET_TERM:
6233                 hci_le_ext_adv_term_evt(hdev, skb);
6234                 break;
6235
6236         default:
6237                 break;
6238         }
6239 }
6240
6241 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6242                                  u8 event, struct sk_buff *skb)
6243 {
6244         struct hci_ev_cmd_complete *ev;
6245         struct hci_event_hdr *hdr;
6246
6247         if (!skb)
6248                 return false;
6249
6250         if (skb->len < sizeof(*hdr)) {
6251                 bt_dev_err(hdev, "too short HCI event");
6252                 return false;
6253         }
6254
6255         hdr = (void *) skb->data;
6256         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6257
6258         if (event) {
6259                 if (hdr->evt != event)
6260                         return false;
6261                 return true;
6262         }
6263
6264         /* Check if request ended in Command Status - no way to retrieve
6265          * any extra parameters in this case.
6266          */
6267         if (hdr->evt == HCI_EV_CMD_STATUS)
6268                 return false;
6269
6270         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6271                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6272                            hdr->evt);
6273                 return false;
6274         }
6275
6276         if (skb->len < sizeof(*ev)) {
6277                 bt_dev_err(hdev, "too short cmd_complete event");
6278                 return false;
6279         }
6280
6281         ev = (void *) skb->data;
6282         skb_pull(skb, sizeof(*ev));
6283
6284         if (opcode != __le16_to_cpu(ev->opcode)) {
6285                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6286                        __le16_to_cpu(ev->opcode));
6287                 return false;
6288         }
6289
6290         return true;
6291 }
6292
6293 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6294                                   struct sk_buff *skb)
6295 {
6296         struct hci_ev_le_advertising_info *adv;
6297         struct hci_ev_le_direct_adv_info *direct_adv;
6298         struct hci_ev_le_ext_adv_report *ext_adv;
6299         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6300         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6301
6302         hci_dev_lock(hdev);
6303
6304         /* If we are currently suspended and this is the first BT event seen,
6305          * save the wake reason associated with the event.
6306          */
6307         if (!hdev->suspended || hdev->wake_reason)
6308                 goto unlock;
6309
6310         /* Default to remote wake. Values for wake_reason are documented in the
6311          * Bluez mgmt api docs.
6312          */
6313         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6314
6315         /* Once configured for remote wakeup, we should only wake up for
6316          * reconnections. It's useful to see which device is waking us up so
6317          * keep track of the bdaddr of the connection event that woke us up.
6318          */
6319         if (event == HCI_EV_CONN_REQUEST) {
6320                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6321                 hdev->wake_addr_type = BDADDR_BREDR;
6322         } else if (event == HCI_EV_CONN_COMPLETE) {
6323                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6324                 hdev->wake_addr_type = BDADDR_BREDR;
6325         } else if (event == HCI_EV_LE_META) {
6326                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6327                 u8 subevent = le_ev->subevent;
6328                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6329                 u8 num_reports = *ptr;
6330
6331                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6332                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6333                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6334                     num_reports) {
6335                         adv = (void *)(ptr + 1);
6336                         direct_adv = (void *)(ptr + 1);
6337                         ext_adv = (void *)(ptr + 1);
6338
6339                         switch (subevent) {
6340                         case HCI_EV_LE_ADVERTISING_REPORT:
6341                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6342                                 hdev->wake_addr_type = adv->bdaddr_type;
6343                                 break;
6344                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6345                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6346                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6347                                 break;
6348                         case HCI_EV_LE_EXT_ADV_REPORT:
6349                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6350                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6351                                 break;
6352                         }
6353                 }
6354         } else {
6355                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6356         }
6357
6358 unlock:
6359         hci_dev_unlock(hdev);
6360 }
6361
6362 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6363 {
6364         struct hci_event_hdr *hdr = (void *) skb->data;
6365         hci_req_complete_t req_complete = NULL;
6366         hci_req_complete_skb_t req_complete_skb = NULL;
6367         struct sk_buff *orig_skb = NULL;
6368         u8 status = 0, event = hdr->evt, req_evt = 0;
6369         u16 opcode = HCI_OP_NOP;
6370
6371         if (!event) {
6372                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6373                 goto done;
6374         }
6375
6376         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6377                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6378                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6379                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6380                                      &req_complete_skb);
6381                 req_evt = event;
6382         }
6383
6384         /* If it looks like we might end up having to call
6385          * req_complete_skb, store a pristine copy of the skb since the
6386          * various handlers may modify the original one through
6387          * skb_pull() calls, etc.
6388          */
6389         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6390             event == HCI_EV_CMD_COMPLETE)
6391                 orig_skb = skb_clone(skb, GFP_KERNEL);
6392
6393         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6394
6395         /* Store wake reason if we're suspended */
6396         hci_store_wake_reason(hdev, event, skb);
6397
6398         switch (event) {
6399         case HCI_EV_INQUIRY_COMPLETE:
6400                 hci_inquiry_complete_evt(hdev, skb);
6401                 break;
6402
6403         case HCI_EV_INQUIRY_RESULT:
6404                 hci_inquiry_result_evt(hdev, skb);
6405                 break;
6406
6407         case HCI_EV_CONN_COMPLETE:
6408                 hci_conn_complete_evt(hdev, skb);
6409                 break;
6410
6411         case HCI_EV_CONN_REQUEST:
6412                 hci_conn_request_evt(hdev, skb);
6413                 break;
6414
6415         case HCI_EV_DISCONN_COMPLETE:
6416                 hci_disconn_complete_evt(hdev, skb);
6417                 break;
6418
6419         case HCI_EV_AUTH_COMPLETE:
6420                 hci_auth_complete_evt(hdev, skb);
6421                 break;
6422
6423         case HCI_EV_REMOTE_NAME:
6424                 hci_remote_name_evt(hdev, skb);
6425                 break;
6426
6427         case HCI_EV_ENCRYPT_CHANGE:
6428                 hci_encrypt_change_evt(hdev, skb);
6429                 break;
6430
6431         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6432                 hci_change_link_key_complete_evt(hdev, skb);
6433                 break;
6434
6435         case HCI_EV_REMOTE_FEATURES:
6436                 hci_remote_features_evt(hdev, skb);
6437                 break;
6438
6439         case HCI_EV_CMD_COMPLETE:
6440                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6441                                      &req_complete, &req_complete_skb);
6442                 break;
6443
6444         case HCI_EV_CMD_STATUS:
6445                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6446                                    &req_complete_skb);
6447                 break;
6448
6449         case HCI_EV_HARDWARE_ERROR:
6450                 hci_hardware_error_evt(hdev, skb);
6451                 break;
6452
6453         case HCI_EV_ROLE_CHANGE:
6454                 hci_role_change_evt(hdev, skb);
6455                 break;
6456
6457         case HCI_EV_NUM_COMP_PKTS:
6458                 hci_num_comp_pkts_evt(hdev, skb);
6459                 break;
6460
6461         case HCI_EV_MODE_CHANGE:
6462                 hci_mode_change_evt(hdev, skb);
6463                 break;
6464
6465         case HCI_EV_PIN_CODE_REQ:
6466                 hci_pin_code_request_evt(hdev, skb);
6467                 break;
6468
6469         case HCI_EV_LINK_KEY_REQ:
6470                 hci_link_key_request_evt(hdev, skb);
6471                 break;
6472
6473         case HCI_EV_LINK_KEY_NOTIFY:
6474                 hci_link_key_notify_evt(hdev, skb);
6475                 break;
6476
6477         case HCI_EV_CLOCK_OFFSET:
6478                 hci_clock_offset_evt(hdev, skb);
6479                 break;
6480
6481         case HCI_EV_PKT_TYPE_CHANGE:
6482                 hci_pkt_type_change_evt(hdev, skb);
6483                 break;
6484
6485         case HCI_EV_PSCAN_REP_MODE:
6486                 hci_pscan_rep_mode_evt(hdev, skb);
6487                 break;
6488
6489         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6490                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6491                 break;
6492
6493         case HCI_EV_REMOTE_EXT_FEATURES:
6494                 hci_remote_ext_features_evt(hdev, skb);
6495                 break;
6496
6497         case HCI_EV_SYNC_CONN_COMPLETE:
6498                 hci_sync_conn_complete_evt(hdev, skb);
6499                 break;
6500
6501         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6502                 hci_extended_inquiry_result_evt(hdev, skb);
6503                 break;
6504
6505         case HCI_EV_KEY_REFRESH_COMPLETE:
6506                 hci_key_refresh_complete_evt(hdev, skb);
6507                 break;
6508
6509         case HCI_EV_IO_CAPA_REQUEST:
6510                 hci_io_capa_request_evt(hdev, skb);
6511                 break;
6512
6513         case HCI_EV_IO_CAPA_REPLY:
6514                 hci_io_capa_reply_evt(hdev, skb);
6515                 break;
6516
6517         case HCI_EV_USER_CONFIRM_REQUEST:
6518                 hci_user_confirm_request_evt(hdev, skb);
6519                 break;
6520
6521         case HCI_EV_USER_PASSKEY_REQUEST:
6522                 hci_user_passkey_request_evt(hdev, skb);
6523                 break;
6524
6525         case HCI_EV_USER_PASSKEY_NOTIFY:
6526                 hci_user_passkey_notify_evt(hdev, skb);
6527                 break;
6528
6529         case HCI_EV_KEYPRESS_NOTIFY:
6530                 hci_keypress_notify_evt(hdev, skb);
6531                 break;
6532
6533         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6534                 hci_simple_pair_complete_evt(hdev, skb);
6535                 break;
6536
6537         case HCI_EV_REMOTE_HOST_FEATURES:
6538                 hci_remote_host_features_evt(hdev, skb);
6539                 break;
6540
6541         case HCI_EV_LE_META:
6542                 hci_le_meta_evt(hdev, skb);
6543                 break;
6544
6545         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6546                 hci_remote_oob_data_request_evt(hdev, skb);
6547                 break;
6548
6549 #if IS_ENABLED(CONFIG_BT_HS)
6550         case HCI_EV_CHANNEL_SELECTED:
6551                 hci_chan_selected_evt(hdev, skb);
6552                 break;
6553
6554         case HCI_EV_PHY_LINK_COMPLETE:
6555                 hci_phy_link_complete_evt(hdev, skb);
6556                 break;
6557
6558         case HCI_EV_LOGICAL_LINK_COMPLETE:
6559                 hci_loglink_complete_evt(hdev, skb);
6560                 break;
6561
6562         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6563                 hci_disconn_loglink_complete_evt(hdev, skb);
6564                 break;
6565
6566         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6567                 hci_disconn_phylink_complete_evt(hdev, skb);
6568                 break;
6569 #endif
6570
6571         case HCI_EV_NUM_COMP_BLOCKS:
6572                 hci_num_comp_blocks_evt(hdev, skb);
6573                 break;
6574
6575         case HCI_EV_VENDOR:
6576                 msft_vendor_evt(hdev, skb);
6577                 break;
6578
6579         default:
6580                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6581                 break;
6582         }
6583
6584         if (req_complete) {
6585                 req_complete(hdev, status, opcode);
6586         } else if (req_complete_skb) {
6587                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6588                         kfree_skb(orig_skb);
6589                         orig_skb = NULL;
6590                 }
6591                 req_complete_skb(hdev, status, opcode, orig_skb);
6592         }
6593
6594 done:
6595         kfree_skb(orig_skb);
6596         kfree_skb(skb);
6597         hdev->stat.evt_rx++;
6598 }