net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  44
  45 /* Handle HCI Event packets */
  46
  47 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  48                                   u8 *new_status)
  49 {
  50         __u8 status = *((__u8 *) skb->data);
  51
  52         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  53
  54         /* It is possible that we receive Inquiry Complete event right
  55          * before we receive Inquiry Cancel Command Complete event, in
  56          * which case the latter event should have status of Command
  57          * Disallowed (0x0c). This should not be treated as error, since
  58          * we actually achieve what Inquiry Cancel wants to achieve,
  59          * which is to end the last Inquiry session.
  60          */
  61         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  62                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  63                 status = 0x00;
  64         }
  65
  66         *new_status = status;
  67
  68         if (status)
  69                 return;
  70
  71         clear_bit(HCI_INQUIRY, &hdev->flags);
  72         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  73         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  74
  75         hci_dev_lock(hdev);
  76         /* Set discovery state to stopped if we're not doing LE active
  77          * scanning.
  78          */
  79         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  80             hdev->le_scan_type != LE_SCAN_ACTIVE)
  81                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  82         hci_dev_unlock(hdev);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         __u8 status = *((__u8 *) skb->data);
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  92
  93         if (status)
  94                 return;
  95
  96         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  97 }
  98
  99 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 100 {
 101         __u8 status = *((__u8 *) skb->data);
 102
 103         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 104
 105         if (status)
 106                 return;
 107
 108         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 109
 110         hci_conn_check_pending(hdev);
 111 }
 112
 113 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 114                                           struct sk_buff *skb)
 115 {
 116         BT_DBG("%s", hdev->name);
 117 }
 118
 119 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 120 {
 121         struct hci_rp_role_discovery *rp = (void *) skb->data;
 122         struct hci_conn *conn;
 123
 124         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 125
 126         if (rp->status)
 127                 return;
 128
 129         hci_dev_lock(hdev);
 130
 131         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 132         if (conn)
 133                 conn->role = rp->role;
 134
 135         hci_dev_unlock(hdev);
 136 }
 137
 138 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 139 {
 140         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 141         struct hci_conn *conn;
 142
 143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 144
 145         if (rp->status)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = __le16_to_cpu(rp->policy);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 160         struct hci_conn *conn;
 161         void *sent;
 162 #ifdef TIZEN_BT
 163         struct hci_cp_write_link_policy cp;
 164         struct hci_conn *sco_conn;
 165 #endif
 166
 167         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 168
 169         if (rp->status)
 170                 return;
 171
 172         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 173         if (!sent)
 174                 return;
 175
 176         hci_dev_lock(hdev);
 177
 178         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 179         if (conn)
 180                 conn->link_policy = get_unaligned_le16(sent + 2);
 181
 182 #ifdef TIZEN_BT
 183         sco_conn = hci_conn_hash_lookup_sco(hdev);
 184         if (sco_conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 185             conn->link_policy & HCI_LP_SNIFF) {
 186                 BT_ERR("SNIFF is not allowed during sco connection");
 187                 cp.handle = __cpu_to_le16(conn->handle);
 188                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 189                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 190         }
 191 #endif
 192
 193         hci_dev_unlock(hdev);
 194 }
 195
 196 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 197                                         struct sk_buff *skb)
 198 {
 199         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 200
 201         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 202
 203         if (rp->status)
 204                 return;
 205
 206         hdev->link_policy = __le16_to_cpu(rp->policy);
 207 }
 208
 209 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 210                                          struct sk_buff *skb)
 211 {
 212         __u8 status = *((__u8 *) skb->data);
 213         void *sent;
 214
 215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 216
 217         if (status)
 218                 return;
 219
 220         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 221         if (!sent)
 222                 return;
 223
 224         hdev->link_policy = get_unaligned_le16(sent);
 225 }
 226
 227 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 228 {
 229         __u8 status = *((__u8 *) skb->data);
 230
 231         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 232
 233         clear_bit(HCI_RESET, &hdev->flags);
 234
 235         if (status)
 236                 return;
 237
 238         /* Reset all non-persistent flags */
 239         hci_dev_clear_volatile_flags(hdev);
 240
 241         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 242
 243         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 244         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 245
 246         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 247         hdev->adv_data_len = 0;
 248
 249         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 250         hdev->scan_rsp_data_len = 0;
 251
 252         hdev->le_scan_type = LE_SCAN_PASSIVE;
 253
 254         hdev->ssp_debug_mode = 0;
 255
 256         hci_bdaddr_list_clear(&hdev->le_accept_list);
 257         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 258 }
 259
 260 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 261                                         struct sk_buff *skb)
 262 {
 263         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 264         struct hci_cp_read_stored_link_key *sent;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 269         if (!sent)
 270                 return;
 271
 272         if (!rp->status && sent->read_all == 0x01) {
 273                 hdev->stored_max_keys = rp->max_keys;
 274                 hdev->stored_num_keys = rp->num_keys;
 275         }
 276 }
 277
 278 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 279                                           struct sk_buff *skb)
 280 {
 281         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 282
 283         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 284
 285         if (rp->status)
 286                 return;
 287
 288         if (rp->num_keys <= hdev->stored_num_keys)
 289                 hdev->stored_num_keys -= rp->num_keys;
 290         else
 291                 hdev->stored_num_keys = 0;
 292 }
 293
 294 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 295 {
 296         __u8 status = *((__u8 *) skb->data);
 297         void *sent;
 298
 299         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 300
 301         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 302         if (!sent)
 303                 return;
 304
 305         hci_dev_lock(hdev);
 306
 307         if (hci_dev_test_flag(hdev, HCI_MGMT))
 308                 mgmt_set_local_name_complete(hdev, sent, status);
 309         else if (!status)
 310                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 311
 312         hci_dev_unlock(hdev);
 313 }
 314
 315 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 316 {
 317         struct hci_rp_read_local_name *rp = (void *) skb->data;
 318
 319         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 320
 321         if (rp->status)
 322                 return;
 323
 324         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 325             hci_dev_test_flag(hdev, HCI_CONFIG))
 326                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 327 }
 328
 329 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 330 {
 331         __u8 status = *((__u8 *) skb->data);
 332         void *sent;
 333
 334         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 335
 336         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 337         if (!sent)
 338                 return;
 339
 340         hci_dev_lock(hdev);
 341
 342         if (!status) {
 343                 __u8 param = *((__u8 *) sent);
 344
 345                 if (param == AUTH_ENABLED)
 346                         set_bit(HCI_AUTH, &hdev->flags);
 347                 else
 348                         clear_bit(HCI_AUTH, &hdev->flags);
 349         }
 350
 351         if (hci_dev_test_flag(hdev, HCI_MGMT))
 352                 mgmt_auth_enable_complete(hdev, status);
 353
 354         hci_dev_unlock(hdev);
 355 }
 356
 357 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 358 {
 359         __u8 status = *((__u8 *) skb->data);
 360         __u8 param;
 361         void *sent;
 362
 363         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 364
 365         if (status)
 366                 return;
 367
 368         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 369         if (!sent)
 370                 return;
 371
 372         param = *((__u8 *) sent);
 373
 374         if (param)
 375                 set_bit(HCI_ENCRYPT, &hdev->flags);
 376         else
 377                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 378 }
 379
 380 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 381 {
 382         __u8 status = *((__u8 *) skb->data);
 383         __u8 param;
 384         void *sent;
 385
 386         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 387
 388         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 389         if (!sent)
 390                 return;
 391
 392         param = *((__u8 *) sent);
 393
 394         hci_dev_lock(hdev);
 395
 396         if (status) {
 397                 hdev->discov_timeout = 0;
 398                 goto done;
 399         }
 400
 401         if (param & SCAN_INQUIRY)
 402                 set_bit(HCI_ISCAN, &hdev->flags);
 403         else
 404                 clear_bit(HCI_ISCAN, &hdev->flags);
 405
 406         if (param & SCAN_PAGE)
 407                 set_bit(HCI_PSCAN, &hdev->flags);
 408         else
 409                 clear_bit(HCI_PSCAN, &hdev->flags);
 410
 411 done:
 412         hci_dev_unlock(hdev);
 413 }
 414
 415 static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 416 {
 417         __u8 status = *((__u8 *)skb->data);
 418         struct hci_cp_set_event_filter *cp;
 419         void *sent;
 420
 421         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 422
 423         if (status)
 424                 return;
 425
 426         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 427         if (!sent)
 428                 return;
 429
 430         cp = (struct hci_cp_set_event_filter *)sent;
 431
 432         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 433                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 434         else
 435                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 436 }
 437
 438 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 441
 442         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 443
 444         if (rp->status)
 445                 return;
 446
 447         memcpy(hdev->dev_class, rp->dev_class, 3);
 448
 449         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 450                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 451 }
 452
 453 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 454 {
 455         __u8 status = *((__u8 *) skb->data);
 456         void *sent;
 457
 458         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 459
 460         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 461         if (!sent)
 462                 return;
 463
 464         hci_dev_lock(hdev);
 465
 466         if (status == 0)
 467                 memcpy(hdev->dev_class, sent, 3);
 468
 469         if (hci_dev_test_flag(hdev, HCI_MGMT))
 470                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 471
 472         hci_dev_unlock(hdev);
 473 }
 474
 475 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 476 {
 477         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 478         __u16 setting;
 479
 480         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 481
 482         if (rp->status)
 483                 return;
 484
 485         setting = __le16_to_cpu(rp->voice_setting);
 486
 487         if (hdev->voice_setting == setting)
 488                 return;
 489
 490         hdev->voice_setting = setting;
 491
 492         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 493
 494         if (hdev->notify)
 495                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 496 }
 497
 498 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 499                                        struct sk_buff *skb)
 500 {
 501         __u8 status = *((__u8 *) skb->data);
 502         __u16 setting;
 503         void *sent;
 504
 505         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 506
 507         if (status)
 508                 return;
 509
 510         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 511         if (!sent)
 512                 return;
 513
 514         setting = get_unaligned_le16(sent);
 515
 516         if (hdev->voice_setting == setting)
 517                 return;
 518
 519         hdev->voice_setting = setting;
 520
 521         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 522
 523         if (hdev->notify)
 524                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 525 }
 526
 527 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 528                                           struct sk_buff *skb)
 529 {
 530         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 531
 532         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 533
 534         if (rp->status)
 535                 return;
 536
 537         hdev->num_iac = rp->num_iac;
 538
 539         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 540 }
 541
 542 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 543 {
 544         __u8 status = *((__u8 *) skb->data);
 545         struct hci_cp_write_ssp_mode *sent;
 546
 547         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 548
 549         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 550         if (!sent)
 551                 return;
 552
 553         hci_dev_lock(hdev);
 554
 555         if (!status) {
 556                 if (sent->mode)
 557                         hdev->features[1][0] |= LMP_HOST_SSP;
 558                 else
 559                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 560         }
 561
 562         if (hci_dev_test_flag(hdev, HCI_MGMT))
 563                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 564         else if (!status) {
 565                 if (sent->mode)
 566                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 567                 else
 568                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 569         }
 570
 571         hci_dev_unlock(hdev);
 572 }
 573
 574 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 575 {
 576         u8 status = *((u8 *) skb->data);
 577         struct hci_cp_write_sc_support *sent;
 578
 579         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 580
 581         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 582         if (!sent)
 583                 return;
 584
 585         hci_dev_lock(hdev);
 586
 587         if (!status) {
 588                 if (sent->support)
 589                         hdev->features[1][0] |= LMP_HOST_SC;
 590                 else
 591                         hdev->features[1][0] &= ~LMP_HOST_SC;
 592         }
 593
 594         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 595                 if (sent->support)
 596                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 597                 else
 598                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 599         }
 600
 601         hci_dev_unlock(hdev);
 602 }
 603
 604 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 605 {
 606         struct hci_rp_read_local_version *rp = (void *) skb->data;
 607
 608         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 609
 610         if (rp->status)
 611                 return;
 612
 613         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 614             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 615                 hdev->hci_ver = rp->hci_ver;
 616                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 617                 hdev->lmp_ver = rp->lmp_ver;
 618                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 619                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 620         }
 621 }
 622
 623 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 624                                        struct sk_buff *skb)
 625 {
 626         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 627
 628         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 629
 630         if (rp->status)
 631                 return;
 632
 633         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 634             hci_dev_test_flag(hdev, HCI_CONFIG))
 635                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 636 }
 637
 638 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 639                                              struct sk_buff *skb)
 640 {
 641         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 642         struct hci_conn *conn;
 643
 644         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 645
 646         if (rp->status)
 647                 return;
 648
 649         hci_dev_lock(hdev);
 650
 651         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 652         if (conn)
 653                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 654
 655         hci_dev_unlock(hdev);
 656 }
 657
 658 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 659                                               struct sk_buff *skb)
 660 {
 661         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 662         struct hci_conn *conn;
 663         void *sent;
 664
 665         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 666
 667         if (rp->status)
 668                 return;
 669
 670         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 671         if (!sent)
 672                 return;
 673
 674         hci_dev_lock(hdev);
 675
 676         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 677         if (conn)
 678                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 679
 680         hci_dev_unlock(hdev);
 681 }
 682
 683 static void hci_cc_read_local_features(struct hci_dev *hdev,
 684                                        struct sk_buff *skb)
 685 {
 686         struct hci_rp_read_local_features *rp = (void *) skb->data;
 687
 688         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 689
 690         if (rp->status)
 691                 return;
 692
 693         memcpy(hdev->features, rp->features, 8);
 694
 695         /* Adjust default settings according to features
 696          * supported by device. */
 697
 698         if (hdev->features[0][0] & LMP_3SLOT)
 699                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 700
 701         if (hdev->features[0][0] & LMP_5SLOT)
 702                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 703
 704         if (hdev->features[0][1] & LMP_HV2) {
 705                 hdev->pkt_type  |= (HCI_HV2);
 706                 hdev->esco_type |= (ESCO_HV2);
 707         }
 708
 709         if (hdev->features[0][1] & LMP_HV3) {
 710                 hdev->pkt_type  |= (HCI_HV3);
 711                 hdev->esco_type |= (ESCO_HV3);
 712         }
 713
 714         if (lmp_esco_capable(hdev))
 715                 hdev->esco_type |= (ESCO_EV3);
 716
 717         if (hdev->features[0][4] & LMP_EV4)
 718                 hdev->esco_type |= (ESCO_EV4);
 719
 720         if (hdev->features[0][4] & LMP_EV5)
 721                 hdev->esco_type |= (ESCO_EV5);
 722
 723         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 724                 hdev->esco_type |= (ESCO_2EV3);
 725
 726         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 727                 hdev->esco_type |= (ESCO_3EV3);
 728
 729         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 730                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 731 }
 732
 733 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 734                                            struct sk_buff *skb)
 735 {
 736         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 737
 738         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 739
 740         if (rp->status)
 741                 return;
 742
 743         if (hdev->max_page < rp->max_page)
 744                 hdev->max_page = rp->max_page;
 745
 746         if (rp->page < HCI_MAX_PAGES)
 747                 memcpy(hdev->features[rp->page], rp->features, 8);
 748 }
 749
 750 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 751                                           struct sk_buff *skb)
 752 {
 753         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 754
 755         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 756
 757         if (rp->status)
 758                 return;
 759
 760         hdev->flow_ctl_mode = rp->mode;
 761 }
 762
 763 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 764 {
 765         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 766
 767         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 768
 769         if (rp->status)
 770                 return;
 771
 772         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 773         hdev->sco_mtu  = rp->sco_mtu;
 774         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 775         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 776
 777         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 778                 hdev->sco_mtu  = 64;
 779                 hdev->sco_pkts = 8;
 780         }
 781
 782         hdev->acl_cnt = hdev->acl_pkts;
 783         hdev->sco_cnt = hdev->sco_pkts;
 784
 785         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 786                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 787 }
 788
 789 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 790 {
 791         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 792
 793         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 794
 795         if (rp->status)
 796                 return;
 797
 798         if (test_bit(HCI_INIT, &hdev->flags))
 799                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 800
 801         if (hci_dev_test_flag(hdev, HCI_SETUP))
 802                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 803 }
 804
 805 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 806                                            struct sk_buff *skb)
 807 {
 808         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 809
 810         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 811
 812         if (rp->status)
 813                 return;
 814
 815         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 816             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 817                 hdev->pairing_opts = rp->pairing_opts;
 818                 hdev->max_enc_key_size = rp->max_key_size;
 819         }
 820 }
 821
 822 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 823                                            struct sk_buff *skb)
 824 {
 825         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 826
 827         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 828
 829         if (rp->status)
 830                 return;
 831
 832         if (test_bit(HCI_INIT, &hdev->flags)) {
 833                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 834                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 835         }
 836 }
 837
 838 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 839                                             struct sk_buff *skb)
 840 {
 841         u8 status = *((u8 *) skb->data);
 842         struct hci_cp_write_page_scan_activity *sent;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 845
 846         if (status)
 847                 return;
 848
 849         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 850         if (!sent)
 851                 return;
 852
 853         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 854         hdev->page_scan_window = __le16_to_cpu(sent->window);
 855 }
 856
 857 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 858                                            struct sk_buff *skb)
 859 {
 860         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 863
 864         if (rp->status)
 865                 return;
 866
 867         if (test_bit(HCI_INIT, &hdev->flags))
 868                 hdev->page_scan_type = rp->type;
 869 }
 870
 871 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 872                                         struct sk_buff *skb)
 873 {
 874         u8 status = *((u8 *) skb->data);
 875         u8 *type;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 878
 879         if (status)
 880                 return;
 881
 882         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 883         if (type)
 884                 hdev->page_scan_type = *type;
 885 }
 886
 887 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 888                                         struct sk_buff *skb)
 889 {
 890         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 891
 892         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 893
 894         if (rp->status)
 895                 return;
 896
 897         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 898         hdev->block_len = __le16_to_cpu(rp->block_len);
 899         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 900
 901         hdev->block_cnt = hdev->num_blocks;
 902
 903         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 904                hdev->block_cnt, hdev->block_len);
 905 }
 906
 907 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 908 {
 909         struct hci_rp_read_clock *rp = (void *) skb->data;
 910         struct hci_cp_read_clock *cp;
 911         struct hci_conn *conn;
 912
 913         BT_DBG("%s", hdev->name);
 914
 915         if (skb->len < sizeof(*rp))
 916                 return;
 917
 918         if (rp->status)
 919                 return;
 920
 921         hci_dev_lock(hdev);
 922
 923         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 924         if (!cp)
 925                 goto unlock;
 926
 927         if (cp->which == 0x00) {
 928                 hdev->clock = le32_to_cpu(rp->clock);
 929                 goto unlock;
 930         }
 931
 932         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 933         if (conn) {
 934                 conn->clock = le32_to_cpu(rp->clock);
 935                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 936         }
 937
 938 unlock:
 939         hci_dev_unlock(hdev);
 940 }
 941
 942 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 943                                        struct sk_buff *skb)
 944 {
 945         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 946
 947         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 948
 949         if (rp->status)
 950                 return;
 951
 952         hdev->amp_status = rp->amp_status;
 953         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 954         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 955         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 956         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 957         hdev->amp_type = rp->amp_type;
 958         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 959         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 960         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 961         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 962 }
 963
 964 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 965                                          struct sk_buff *skb)
 966 {
 967         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 968
 969         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 970
 971         if (rp->status)
 972                 return;
 973
 974         hdev->inq_tx_power = rp->tx_power;
 975 }
 976
 977 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 978                                                struct sk_buff *skb)
 979 {
 980         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 981
 982         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 983
 984         if (rp->status)
 985                 return;
 986
 987         hdev->err_data_reporting = rp->err_data_reporting;
 988 }
 989
 990 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 991                                                 struct sk_buff *skb)
 992 {
 993         __u8 status = *((__u8 *)skb->data);
 994         struct hci_cp_write_def_err_data_reporting *cp;
 995
 996         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 997
 998         if (status)
 999                 return;
1000
1001         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1002         if (!cp)
1003                 return;
1004
1005         hdev->err_data_reporting = cp->err_data_reporting;
1006 }
1007
1008 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
1009 {
1010         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
1011         struct hci_cp_pin_code_reply *cp;
1012         struct hci_conn *conn;
1013
1014         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1015
1016         hci_dev_lock(hdev);
1017
1018         if (hci_dev_test_flag(hdev, HCI_MGMT))
1019                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1020
1021         if (rp->status)
1022                 goto unlock;
1023
1024         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1025         if (!cp)
1026                 goto unlock;
1027
1028         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1029         if (conn)
1030                 conn->pin_length = cp->pin_len;
1031
1032 unlock:
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1037 {
1038         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1039
1040         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1041
1042         hci_dev_lock(hdev);
1043
1044         if (hci_dev_test_flag(hdev, HCI_MGMT))
1045                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1046                                                  rp->status);
1047
1048         hci_dev_unlock(hdev);
1049 }
1050
1051 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1052                                        struct sk_buff *skb)
1053 {
1054         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1055
1056         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1057
1058         if (rp->status)
1059                 return;
1060
1061         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1062         hdev->le_pkts = rp->le_max_pkt;
1063
1064         hdev->le_cnt = hdev->le_pkts;
1065
1066         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1067 }
1068
1069 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1070                                           struct sk_buff *skb)
1071 {
1072         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1073
1074         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1075
1076         if (rp->status)
1077                 return;
1078
1079         memcpy(hdev->le_features, rp->features, 8);
1080 }
1081
1082 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1083                                         struct sk_buff *skb)
1084 {
1085         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1086
1087         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1088
1089         if (rp->status)
1090                 return;
1091
1092         hdev->adv_tx_power = rp->tx_power;
1093 }
1094
1095 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1096 {
1097         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1098
1099         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1100
1101         hci_dev_lock(hdev);
1102
1103         if (hci_dev_test_flag(hdev, HCI_MGMT))
1104                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1105                                                  rp->status);
1106
1107         hci_dev_unlock(hdev);
1108 }
1109
1110 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1111                                           struct sk_buff *skb)
1112 {
1113         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (hci_dev_test_flag(hdev, HCI_MGMT))
1120                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1121                                                      ACL_LINK, 0, rp->status);
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1127 {
1128         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1129
1130         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1131
1132         hci_dev_lock(hdev);
1133
1134         if (hci_dev_test_flag(hdev, HCI_MGMT))
1135                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1136                                                  0, rp->status);
1137
1138         hci_dev_unlock(hdev);
1139 }
1140
1141 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1142                                           struct sk_buff *skb)
1143 {
1144         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1145
1146         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1147
1148         hci_dev_lock(hdev);
1149
1150         if (hci_dev_test_flag(hdev, HCI_MGMT))
1151                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1152                                                      ACL_LINK, 0, rp->status);
1153
1154         hci_dev_unlock(hdev);
1155 }
1156
1157 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1158                                        struct sk_buff *skb)
1159 {
1160         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1161
1162         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1163 }
1164
1165 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1166                                            struct sk_buff *skb)
1167 {
1168         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1169
1170         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1171 }
1172
1173 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1174 {
1175         __u8 status = *((__u8 *) skb->data);
1176         bdaddr_t *sent;
1177
1178         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1179
1180         if (status)
1181                 return;
1182
1183         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1184         if (!sent)
1185                 return;
1186
1187         hci_dev_lock(hdev);
1188
1189         bacpy(&hdev->random_addr, sent);
1190
1191         if (!bacmp(&hdev->rpa, sent)) {
1192                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1193                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1194                                    secs_to_jiffies(hdev->rpa_timeout));
1195         }
1196
1197         hci_dev_unlock(hdev);
1198 }
1199
1200 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1201 {
1202         __u8 status = *((__u8 *) skb->data);
1203         struct hci_cp_le_set_default_phy *cp;
1204
1205         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1206
1207         if (status)
1208                 return;
1209
1210         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1211         if (!cp)
1212                 return;
1213
1214         hci_dev_lock(hdev);
1215
1216         hdev->le_tx_def_phys = cp->tx_phys;
1217         hdev->le_rx_def_phys = cp->rx_phys;
1218
1219         hci_dev_unlock(hdev);
1220 }
1221
1222 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1223                                               struct sk_buff *skb)
1224 {
1225         __u8 status = *((__u8 *) skb->data);
1226         struct hci_cp_le_set_adv_set_rand_addr *cp;
1227         struct adv_info *adv;
1228
1229         if (status)
1230                 return;
1231
1232         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1233         /* Update only in case the adv instance since handle 0x00 shall be using
1234          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1235          * non-extended adverting.
1236          */
1237         if (!cp || !cp->handle)
1238                 return;
1239
1240         hci_dev_lock(hdev);
1241
1242         adv = hci_find_adv_instance(hdev, cp->handle);
1243         if (adv) {
1244                 bacpy(&adv->random_addr, &cp->bdaddr);
1245                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1246                         adv->rpa_expired = false;
1247                         queue_delayed_work(hdev->workqueue,
1248                                            &adv->rpa_expired_cb,
1249                                            secs_to_jiffies(hdev->rpa_timeout));
1250                 }
1251         }
1252
1253         hci_dev_unlock(hdev);
1254 }
1255
1256 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1257                                           struct sk_buff *skb)
1258 {
1259         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1260
1261         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1262
1263         if (rp->status)
1264                 return;
1265
1266         hdev->min_le_tx_power = rp->min_le_tx_power;
1267         hdev->max_le_tx_power = rp->max_le_tx_power;
1268 }
1269
1270 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1271 {
1272         __u8 *sent, status = *((__u8 *) skb->data);
1273
1274         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1275
1276         if (status)
1277                 return;
1278
1279         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1280         if (!sent)
1281                 return;
1282
1283         hci_dev_lock(hdev);
1284
1285         /* If we're doing connection initiation as peripheral. Set a
1286          * timeout in case something goes wrong.
1287          */
1288         if (*sent) {
1289                 struct hci_conn *conn;
1290
1291                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1292
1293                 conn = hci_lookup_le_connect(hdev);
1294                 if (conn)
1295                         queue_delayed_work(hdev->workqueue,
1296                                            &conn->le_conn_timeout,
1297                                            conn->conn_timeout);
1298         } else {
1299                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1300         }
1301
1302         hci_dev_unlock(hdev);
1303 }
1304
1305 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1306                                          struct sk_buff *skb)
1307 {
1308         struct hci_cp_le_set_ext_adv_enable *cp;
1309         struct hci_cp_ext_adv_set *set;
1310         __u8 status = *((__u8 *) skb->data);
1311         struct adv_info *adv = NULL, *n;
1312
1313         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1314
1315         if (status)
1316                 return;
1317
1318         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1319         if (!cp)
1320                 return;
1321
1322         set = (void *)cp->data;
1323
1324         hci_dev_lock(hdev);
1325
1326         if (cp->num_of_sets)
1327                 adv = hci_find_adv_instance(hdev, set->handle);
1328
1329         if (cp->enable) {
1330                 struct hci_conn *conn;
1331
1332                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1333
1334                 if (adv)
1335                         adv->enabled = true;
1336
1337                 conn = hci_lookup_le_connect(hdev);
1338                 if (conn)
1339                         queue_delayed_work(hdev->workqueue,
1340                                            &conn->le_conn_timeout,
1341                                            conn->conn_timeout);
1342         } else {
1343                 if (cp->num_of_sets) {
1344                         if (adv)
1345                                 adv->enabled = false;
1346
1347                         /* If just one instance was disabled check if there are
1348                          * any other instance enabled before clearing HCI_LE_ADV
1349                          */
1350                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1351                                                  list) {
1352                                 if (adv->enabled)
1353                                         goto unlock;
1354                         }
1355                 } else {
1356                         /* All instances shall be considered disabled */
1357                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1358                                                  list)
1359                                 adv->enabled = false;
1360                 }
1361
1362                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1363         }
1364
1365 unlock:
1366         hci_dev_unlock(hdev);
1367 }
1368
1369 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1370 {
1371         struct hci_cp_le_set_scan_param *cp;
1372         __u8 status = *((__u8 *) skb->data);
1373
1374         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1375
1376         if (status)
1377                 return;
1378
1379         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1380         if (!cp)
1381                 return;
1382
1383         hci_dev_lock(hdev);
1384
1385         hdev->le_scan_type = cp->type;
1386
1387         hci_dev_unlock(hdev);
1388 }
1389
1390 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1391                                          struct sk_buff *skb)
1392 {
1393         struct hci_cp_le_set_ext_scan_params *cp;
1394         __u8 status = *((__u8 *) skb->data);
1395         struct hci_cp_le_scan_phy_params *phy_param;
1396
1397         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1398
1399         if (status)
1400                 return;
1401
1402         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1403         if (!cp)
1404                 return;
1405
1406         phy_param = (void *)cp->data;
1407
1408         hci_dev_lock(hdev);
1409
1410         hdev->le_scan_type = phy_param->type;
1411
1412         hci_dev_unlock(hdev);
1413 }
1414
1415 static bool has_pending_adv_report(struct hci_dev *hdev)
1416 {
1417         struct discovery_state *d = &hdev->discovery;
1418
1419         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1420 }
1421
1422 static void clear_pending_adv_report(struct hci_dev *hdev)
1423 {
1424         struct discovery_state *d = &hdev->discovery;
1425
1426         bacpy(&d->last_adv_addr, BDADDR_ANY);
1427         d->last_adv_data_len = 0;
1428 }
1429
1430 #ifndef TIZEN_BT
1431 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1432                                      u8 bdaddr_type, s8 rssi, u32 flags,
1433                                      u8 *data, u8 len)
1434 {
1435         struct discovery_state *d = &hdev->discovery;
1436
1437         if (len > HCI_MAX_AD_LENGTH)
1438                 return;
1439
1440         bacpy(&d->last_adv_addr, bdaddr);
1441         d->last_adv_addr_type = bdaddr_type;
1442         d->last_adv_rssi = rssi;
1443         d->last_adv_flags = flags;
1444         memcpy(d->last_adv_data, data, len);
1445         d->last_adv_data_len = len;
1446 }
1447 #endif
1448
1449 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1450 {
1451         hci_dev_lock(hdev);
1452
1453         switch (enable) {
1454         case LE_SCAN_ENABLE:
1455                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1456                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1457                         clear_pending_adv_report(hdev);
1458                 break;
1459
1460         case LE_SCAN_DISABLE:
1461                 /* We do this here instead of when setting DISCOVERY_STOPPED
1462                  * since the latter would potentially require waiting for
1463                  * inquiry to stop too.
1464                  */
1465                 if (has_pending_adv_report(hdev)) {
1466                         struct discovery_state *d = &hdev->discovery;
1467
1468                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1469                                           d->last_adv_addr_type, NULL,
1470                                           d->last_adv_rssi, d->last_adv_flags,
1471                                           d->last_adv_data,
1472                                           d->last_adv_data_len, NULL, 0);
1473                 }
1474
1475                 /* Cancel this timer so that we don't try to disable scanning
1476                  * when it's already disabled.
1477                  */
1478                 cancel_delayed_work(&hdev->le_scan_disable);
1479
1480                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1481
1482                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1483                  * interrupted scanning due to a connect request. Mark
1484                  * therefore discovery as stopped. If this was not
1485                  * because of a connect request advertising might have
1486                  * been disabled because of active scanning, so
1487                  * re-enable it again if necessary.
1488                  */
1489                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1490 #ifndef TIZEN_BT /* The below line is kernel bug. */
1491                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1492 #else
1493                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1494 #endif
1495                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1496                          hdev->discovery.state == DISCOVERY_FINDING)
1497                         hci_req_reenable_advertising(hdev);
1498
1499                 break;
1500
1501         default:
1502                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1503                            enable);
1504                 break;
1505         }
1506
1507         hci_dev_unlock(hdev);
1508 }
1509
1510 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1511                                       struct sk_buff *skb)
1512 {
1513         struct hci_cp_le_set_scan_enable *cp;
1514         __u8 status = *((__u8 *) skb->data);
1515
1516         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1517
1518         if (status)
1519                 return;
1520
1521         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1522         if (!cp)
1523                 return;
1524
1525         le_set_scan_enable_complete(hdev, cp->enable);
1526 }
1527
1528 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1529                                       struct sk_buff *skb)
1530 {
1531         struct hci_cp_le_set_ext_scan_enable *cp;
1532         __u8 status = *((__u8 *) skb->data);
1533
1534         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1535
1536         if (status)
1537                 return;
1538
1539         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1540         if (!cp)
1541                 return;
1542
1543         le_set_scan_enable_complete(hdev, cp->enable);
1544 }
1545
1546 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1547                                       struct sk_buff *skb)
1548 {
1549         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1550
1551         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1552                rp->num_of_sets);
1553
1554         if (rp->status)
1555                 return;
1556
1557         hdev->le_num_of_adv_sets = rp->num_of_sets;
1558 }
1559
1560 static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1561                                             struct sk_buff *skb)
1562 {
1563         struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1564
1565         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1566
1567         if (rp->status)
1568                 return;
1569
1570         hdev->le_accept_list_size = rp->size;
1571 }
1572
1573 static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1574                                         struct sk_buff *skb)
1575 {
1576         __u8 status = *((__u8 *) skb->data);
1577
1578         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1579
1580         if (status)
1581                 return;
1582
1583         hci_dev_lock(hdev);
1584         hci_bdaddr_list_clear(&hdev->le_accept_list);
1585         hci_dev_unlock(hdev);
1586 }
1587
1588 static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1589                                          struct sk_buff *skb)
1590 {
1591         struct hci_cp_le_add_to_accept_list *sent;
1592         __u8 status = *((__u8 *) skb->data);
1593
1594         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1595
1596         if (status)
1597                 return;
1598
1599         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1600         if (!sent)
1601                 return;
1602
1603         hci_dev_lock(hdev);
1604         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1605                             sent->bdaddr_type);
1606         hci_dev_unlock(hdev);
1607 }
1608
1609 static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1610                                            struct sk_buff *skb)
1611 {
1612         struct hci_cp_le_del_from_accept_list *sent;
1613         __u8 status = *((__u8 *) skb->data);
1614
1615         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1616
1617         if (status)
1618                 return;
1619
1620         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1621         if (!sent)
1622                 return;
1623
1624         hci_dev_lock(hdev);
1625         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1626                             sent->bdaddr_type);
1627         hci_dev_unlock(hdev);
1628 }
1629
1630 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1631                                             struct sk_buff *skb)
1632 {
1633         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1634
1635         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1636
1637         if (rp->status)
1638                 return;
1639
1640         memcpy(hdev->le_states, rp->le_states, 8);
1641 }
1642
1643 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1644                                         struct sk_buff *skb)
1645 {
1646         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1647
1648         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1649
1650         if (rp->status)
1651                 return;
1652
1653         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1654         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1655 }
1656
1657 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1658                                          struct sk_buff *skb)
1659 {
1660         struct hci_cp_le_write_def_data_len *sent;
1661         __u8 status = *((__u8 *) skb->data);
1662
1663         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1664
1665         if (status)
1666                 return;
1667
1668         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1669         if (!sent)
1670                 return;
1671
1672         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1673         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1674 }
1675
1676 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1677                                          struct sk_buff *skb)
1678 {
1679         struct hci_cp_le_add_to_resolv_list *sent;
1680         __u8 status = *((__u8 *) skb->data);
1681
1682         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1683
1684         if (status)
1685                 return;
1686
1687         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1688         if (!sent)
1689                 return;
1690
1691         hci_dev_lock(hdev);
1692         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1693                                 sent->bdaddr_type, sent->peer_irk,
1694                                 sent->local_irk);
1695         hci_dev_unlock(hdev);
1696 }
1697
1698 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1699                                           struct sk_buff *skb)
1700 {
1701         struct hci_cp_le_del_from_resolv_list *sent;
1702         __u8 status = *((__u8 *) skb->data);
1703
1704         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1705
1706         if (status)
1707                 return;
1708
1709         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1710         if (!sent)
1711                 return;
1712
1713         hci_dev_lock(hdev);
1714         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1715                             sent->bdaddr_type);
1716         hci_dev_unlock(hdev);
1717 }
1718
1719 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1720                                        struct sk_buff *skb)
1721 {
1722         __u8 status = *((__u8 *) skb->data);
1723
1724         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1725
1726         if (status)
1727                 return;
1728
1729         hci_dev_lock(hdev);
1730         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1731         hci_dev_unlock(hdev);
1732 }
1733
1734 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1735                                            struct sk_buff *skb)
1736 {
1737         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1738
1739         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1740
1741         if (rp->status)
1742                 return;
1743
1744         hdev->le_resolv_list_size = rp->size;
1745 }
1746
1747 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1748                                                 struct sk_buff *skb)
1749 {
1750         __u8 *sent, status = *((__u8 *) skb->data);
1751
1752         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1753
1754         if (status)
1755                 return;
1756
1757         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1758         if (!sent)
1759                 return;
1760
1761         hci_dev_lock(hdev);
1762
1763         if (*sent)
1764                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1765         else
1766                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1767
1768         hci_dev_unlock(hdev);
1769 }
1770
1771 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1772                                         struct sk_buff *skb)
1773 {
1774         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1775
1776         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1777
1778         if (rp->status)
1779                 return;
1780
1781         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1782         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1783         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1784         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1785 }
1786
1787 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1788                                            struct sk_buff *skb)
1789 {
1790         struct hci_cp_write_le_host_supported *sent;
1791         __u8 status = *((__u8 *) skb->data);
1792
1793         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1794
1795         if (status)
1796                 return;
1797
1798         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1799         if (!sent)
1800                 return;
1801
1802         hci_dev_lock(hdev);
1803
1804         if (sent->le) {
1805                 hdev->features[1][0] |= LMP_HOST_LE;
1806                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1807         } else {
1808                 hdev->features[1][0] &= ~LMP_HOST_LE;
1809                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1810                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1811         }
1812
1813         if (sent->simul)
1814                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1815         else
1816                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1817
1818         hci_dev_unlock(hdev);
1819 }
1820
1821 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1822 {
1823         struct hci_cp_le_set_adv_param *cp;
1824         u8 status = *((u8 *) skb->data);
1825
1826         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1827
1828         if (status)
1829                 return;
1830
1831         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1832         if (!cp)
1833                 return;
1834
1835         hci_dev_lock(hdev);
1836         hdev->adv_addr_type = cp->own_address_type;
1837         hci_dev_unlock(hdev);
1838 }
1839
1840 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1841 {
1842         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1843         struct hci_cp_le_set_ext_adv_params *cp;
1844         struct adv_info *adv_instance;
1845
1846         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1847
1848         if (rp->status)
1849                 return;
1850
1851         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1852         if (!cp)
1853                 return;
1854
1855         hci_dev_lock(hdev);
1856         hdev->adv_addr_type = cp->own_addr_type;
1857         if (!cp->handle) {
1858                 /* Store in hdev for instance 0 */
1859                 hdev->adv_tx_power = rp->tx_power;
1860         } else {
1861                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
1862                 if (adv_instance)
1863                         adv_instance->tx_power = rp->tx_power;
1864         }
1865         /* Update adv data as tx power is known now */
1866         hci_req_update_adv_data(hdev, cp->handle);
1867
1868         hci_dev_unlock(hdev);
1869 }
1870
1871 #ifdef TIZEN_BT
1872 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1873                                           struct sk_buff *skb)
1874 {
1875         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1876
1877         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1878                hdev->name, rp->status, rp->le_ext_opcode);
1879
1880         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1881 }
1882
1883 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1884                                           struct sk_buff *skb)
1885 {
1886         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1887
1888         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1889                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1890
1891         mgmt_raw_rssi_response(hdev, rp, rp->status);
1892 }
1893
1894 static void hci_vendor_ext_rssi_link_alert_evt(struct hci_dev *hdev,
1895                                                struct sk_buff *skb)
1896 {
1897         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
1898
1899         BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X", LE_RSSI_LINK_ALERT);
1900
1901         mgmt_rssi_alert_evt(hdev, ev->conn_handle, ev->alert_type,
1902                             ev->rssi_dbm);
1903 }
1904
1905 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1906                                               struct sk_buff *skb)
1907 {
1908         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1909         __u8 event_le_ext_sub_code;
1910
1911         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1912                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1913
1914         skb_pull(skb, sizeof(*ev));
1915         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1916
1917         switch (event_le_ext_sub_code) {
1918         case LE_RSSI_LINK_ALERT:
1919                 hci_vendor_ext_rssi_link_alert_evt(hdev, skb);
1920                 break;
1921
1922         default:
1923                 break;
1924         }
1925 }
1926
1927 static void hci_vendor_multi_adv_state_change_evt(struct hci_dev *hdev,
1928                                                   struct sk_buff *skb)
1929 {
1930         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *)skb->data;
1931
1932         BT_DBG("LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT");
1933
1934         mgmt_multi_adv_state_change_evt(hdev, ev->adv_instance,
1935                                         ev->state_change_reason,
1936                                         ev->connection_handle);
1937 }
1938
1939 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1940 {
1941         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1942         __u8 event_sub_code;
1943
1944         BT_DBG("hci_vendor_specific_evt");
1945
1946         skb_pull(skb, sizeof(*ev));
1947         event_sub_code = ev->event_sub_code;
1948
1949         switch (event_sub_code) {
1950         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1951                 hci_vendor_specific_group_ext_evt(hdev, skb);
1952                 break;
1953
1954         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
1955                 hci_vendor_multi_adv_state_change_evt(hdev, skb);
1956                 break;
1957
1958         default:
1959                 break;
1960         }
1961 }
1962 #endif
1963
1964 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1965 {
1966         struct hci_rp_read_rssi *rp = (void *) skb->data;
1967         struct hci_conn *conn;
1968
1969         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1970
1971         if (rp->status)
1972                 return;
1973
1974         hci_dev_lock(hdev);
1975
1976         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1977         if (conn)
1978                 conn->rssi = rp->rssi;
1979
1980         hci_dev_unlock(hdev);
1981 }
1982
1983 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1984 {
1985         struct hci_cp_read_tx_power *sent;
1986         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1987         struct hci_conn *conn;
1988
1989         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1990
1991         if (rp->status)
1992                 return;
1993
1994         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1995         if (!sent)
1996                 return;
1997
1998         hci_dev_lock(hdev);
1999
2000         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2001         if (!conn)
2002                 goto unlock;
2003
2004         switch (sent->type) {
2005         case 0x00:
2006                 conn->tx_power = rp->tx_power;
2007                 break;
2008         case 0x01:
2009                 conn->max_tx_power = rp->tx_power;
2010                 break;
2011         }
2012
2013 unlock:
2014         hci_dev_unlock(hdev);
2015 }
2016
2017 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
2018 {
2019         u8 status = *((u8 *) skb->data);
2020         u8 *mode;
2021
2022         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2023
2024         if (status)
2025                 return;
2026
2027         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2028         if (mode)
2029                 hdev->ssp_debug_mode = *mode;
2030 }
2031
2032 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2033 {
2034         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2035
2036         if (status) {
2037                 hci_conn_check_pending(hdev);
2038                 return;
2039         }
2040
2041         set_bit(HCI_INQUIRY, &hdev->flags);
2042 }
2043
2044 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2045 {
2046         struct hci_cp_create_conn *cp;
2047         struct hci_conn *conn;
2048
2049         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2050
2051         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2052         if (!cp)
2053                 return;
2054
2055         hci_dev_lock(hdev);
2056
2057         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2058
2059         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
2060
2061         if (status) {
2062                 if (conn && conn->state == BT_CONNECT) {
2063                         if (status != 0x0c || conn->attempt > 2) {
2064                                 conn->state = BT_CLOSED;
2065                                 hci_connect_cfm(conn, status);
2066                                 hci_conn_del(conn);
2067                         } else
2068                                 conn->state = BT_CONNECT2;
2069                 }
2070         } else {
2071                 if (!conn) {
2072                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2073                                             HCI_ROLE_MASTER);
2074                         if (!conn)
2075                                 bt_dev_err(hdev, "no memory for new connection");
2076                 }
2077         }
2078
2079         hci_dev_unlock(hdev);
2080 }
2081
2082 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2083 {
2084         struct hci_cp_add_sco *cp;
2085         struct hci_conn *acl, *sco;
2086         __u16 handle;
2087
2088         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2089
2090         if (!status)
2091                 return;
2092
2093         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2094         if (!cp)
2095                 return;
2096
2097         handle = __le16_to_cpu(cp->handle);
2098
2099         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2100
2101         hci_dev_lock(hdev);
2102
2103         acl = hci_conn_hash_lookup_handle(hdev, handle);
2104         if (acl) {
2105                 sco = acl->link;
2106                 if (sco) {
2107                         sco->state = BT_CLOSED;
2108
2109                         hci_connect_cfm(sco, status);
2110                         hci_conn_del(sco);
2111                 }
2112         }
2113
2114         hci_dev_unlock(hdev);
2115 }
2116
2117 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2118 {
2119         struct hci_cp_auth_requested *cp;
2120         struct hci_conn *conn;
2121
2122         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2123
2124         if (!status)
2125                 return;
2126
2127         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2128         if (!cp)
2129                 return;
2130
2131         hci_dev_lock(hdev);
2132
2133         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2134         if (conn) {
2135                 if (conn->state == BT_CONFIG) {
2136                         hci_connect_cfm(conn, status);
2137                         hci_conn_drop(conn);
2138                 }
2139         }
2140
2141         hci_dev_unlock(hdev);
2142 }
2143
2144 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2145 {
2146         struct hci_cp_set_conn_encrypt *cp;
2147         struct hci_conn *conn;
2148
2149         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2150
2151         if (!status)
2152                 return;
2153
2154         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2155         if (!cp)
2156                 return;
2157
2158         hci_dev_lock(hdev);
2159
2160         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2161         if (conn) {
2162                 if (conn->state == BT_CONFIG) {
2163                         hci_connect_cfm(conn, status);
2164                         hci_conn_drop(conn);
2165                 }
2166         }
2167
2168         hci_dev_unlock(hdev);
2169 }
2170
2171 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2172                                     struct hci_conn *conn)
2173 {
2174         if (conn->state != BT_CONFIG || !conn->out)
2175                 return 0;
2176
2177         if (conn->pending_sec_level == BT_SECURITY_SDP)
2178                 return 0;
2179
2180         /* Only request authentication for SSP connections or non-SSP
2181          * devices with sec_level MEDIUM or HIGH or if MITM protection
2182          * is requested.
2183          */
2184         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2185             conn->pending_sec_level != BT_SECURITY_FIPS &&
2186             conn->pending_sec_level != BT_SECURITY_HIGH &&
2187             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2188                 return 0;
2189
2190         return 1;
2191 }
2192
2193 static int hci_resolve_name(struct hci_dev *hdev,
2194                                    struct inquiry_entry *e)
2195 {
2196         struct hci_cp_remote_name_req cp;
2197
2198         memset(&cp, 0, sizeof(cp));
2199
2200         bacpy(&cp.bdaddr, &e->data.bdaddr);
2201         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2202         cp.pscan_mode = e->data.pscan_mode;
2203         cp.clock_offset = e->data.clock_offset;
2204
2205         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2206 }
2207
2208 static bool hci_resolve_next_name(struct hci_dev *hdev)
2209 {
2210         struct discovery_state *discov = &hdev->discovery;
2211         struct inquiry_entry *e;
2212
2213         if (list_empty(&discov->resolve))
2214                 return false;
2215
2216         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2217         if (!e)
2218                 return false;
2219
2220         if (hci_resolve_name(hdev, e) == 0) {
2221                 e->name_state = NAME_PENDING;
2222                 return true;
2223         }
2224
2225         return false;
2226 }
2227
2228 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2229                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2230 {
2231         struct discovery_state *discov = &hdev->discovery;
2232         struct inquiry_entry *e;
2233
2234 #ifdef TIZEN_BT
2235         /* Update the mgmt connected state if necessary. Be careful with
2236          * conn objects that exist but are not (yet) connected however.
2237          * Only those in BT_CONFIG or BT_CONNECTED states can be
2238          * considered connected.
2239          */
2240         if (conn &&
2241             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2242                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2243                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2244                 else
2245                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2246         }
2247 #else
2248         if (conn &&
2249             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2250             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2251                 mgmt_device_connected(hdev, conn, name, name_len);
2252 #endif
2253
2254         if (discov->state == DISCOVERY_STOPPED)
2255                 return;
2256
2257         if (discov->state == DISCOVERY_STOPPING)
2258                 goto discov_complete;
2259
2260         if (discov->state != DISCOVERY_RESOLVING)
2261                 return;
2262
2263         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2264         /* If the device was not found in a list of found devices names of which
2265          * are pending. there is no need to continue resolving a next name as it
2266          * will be done upon receiving another Remote Name Request Complete
2267          * Event */
2268         if (!e)
2269                 return;
2270
2271         list_del(&e->list);
2272         if (name) {
2273                 e->name_state = NAME_KNOWN;
2274                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2275                                  e->data.rssi, name, name_len);
2276         } else {
2277                 e->name_state = NAME_NOT_KNOWN;
2278         }
2279
2280         if (hci_resolve_next_name(hdev))
2281                 return;
2282
2283 discov_complete:
2284         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2285 }
2286
2287 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2288 {
2289         struct hci_cp_remote_name_req *cp;
2290         struct hci_conn *conn;
2291
2292         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2293
2294         /* If successful wait for the name req complete event before
2295          * checking for the need to do authentication */
2296         if (!status)
2297                 return;
2298
2299         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2300         if (!cp)
2301                 return;
2302
2303         hci_dev_lock(hdev);
2304
2305         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2306
2307         if (hci_dev_test_flag(hdev, HCI_MGMT))
2308                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2309
2310         if (!conn)
2311                 goto unlock;
2312
2313         if (!hci_outgoing_auth_needed(hdev, conn))
2314                 goto unlock;
2315
2316         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2317                 struct hci_cp_auth_requested auth_cp;
2318
2319                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2320
2321                 auth_cp.handle = __cpu_to_le16(conn->handle);
2322                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2323                              sizeof(auth_cp), &auth_cp);
2324         }
2325
2326 unlock:
2327         hci_dev_unlock(hdev);
2328 }
2329
2330 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2331 {
2332         struct hci_cp_read_remote_features *cp;
2333         struct hci_conn *conn;
2334
2335         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2336
2337         if (!status)
2338                 return;
2339
2340         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2341         if (!cp)
2342                 return;
2343
2344         hci_dev_lock(hdev);
2345
2346         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2347         if (conn) {
2348                 if (conn->state == BT_CONFIG) {
2349                         hci_connect_cfm(conn, status);
2350                         hci_conn_drop(conn);
2351                 }
2352         }
2353
2354         hci_dev_unlock(hdev);
2355 }
2356
2357 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2358 {
2359         struct hci_cp_read_remote_ext_features *cp;
2360         struct hci_conn *conn;
2361
2362         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2363
2364         if (!status)
2365                 return;
2366
2367         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2368         if (!cp)
2369                 return;
2370
2371         hci_dev_lock(hdev);
2372
2373         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2374         if (conn) {
2375                 if (conn->state == BT_CONFIG) {
2376                         hci_connect_cfm(conn, status);
2377                         hci_conn_drop(conn);
2378                 }
2379         }
2380
2381         hci_dev_unlock(hdev);
2382 }
2383
2384 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2385 {
2386         struct hci_cp_setup_sync_conn *cp;
2387         struct hci_conn *acl, *sco;
2388         __u16 handle;
2389
2390         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2391
2392         if (!status)
2393                 return;
2394
2395         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2396         if (!cp)
2397                 return;
2398
2399         handle = __le16_to_cpu(cp->handle);
2400
2401         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2402
2403         hci_dev_lock(hdev);
2404
2405         acl = hci_conn_hash_lookup_handle(hdev, handle);
2406         if (acl) {
2407                 sco = acl->link;
2408                 if (sco) {
2409                         sco->state = BT_CLOSED;
2410
2411                         hci_connect_cfm(sco, status);
2412                         hci_conn_del(sco);
2413                 }
2414         }
2415
2416         hci_dev_unlock(hdev);
2417 }
2418
2419 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2420 {
2421         struct hci_cp_sniff_mode *cp;
2422         struct hci_conn *conn;
2423
2424         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2425
2426         if (!status)
2427                 return;
2428
2429         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2430         if (!cp)
2431                 return;
2432
2433         hci_dev_lock(hdev);
2434
2435         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2436         if (conn) {
2437                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2438
2439                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2440                         hci_sco_setup(conn, status);
2441         }
2442
2443         hci_dev_unlock(hdev);
2444 }
2445
2446 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2447 {
2448         struct hci_cp_exit_sniff_mode *cp;
2449         struct hci_conn *conn;
2450
2451         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2452
2453         if (!status)
2454                 return;
2455
2456         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2457         if (!cp)
2458                 return;
2459
2460         hci_dev_lock(hdev);
2461
2462         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2463         if (conn) {
2464                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2465
2466                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2467                         hci_sco_setup(conn, status);
2468         }
2469
2470         hci_dev_unlock(hdev);
2471 }
2472
2473 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2474 {
2475         struct hci_cp_disconnect *cp;
2476         struct hci_conn *conn;
2477
2478         if (!status)
2479                 return;
2480
2481         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2482         if (!cp)
2483                 return;
2484
2485         hci_dev_lock(hdev);
2486
2487         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2488         if (conn) {
2489                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2490                                        conn->dst_type, status);
2491
2492                 if (conn->type == LE_LINK) {
2493                         hdev->cur_adv_instance = conn->adv_instance;
2494                         hci_req_reenable_advertising(hdev);
2495                 }
2496
2497                 /* If the disconnection failed for any reason, the upper layer
2498                  * does not retry to disconnect in current implementation.
2499                  * Hence, we need to do some basic cleanup here and re-enable
2500                  * advertising if necessary.
2501                  */
2502                 hci_conn_del(conn);
2503         }
2504
2505         hci_dev_unlock(hdev);
2506 }
2507
2508 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2509                               u8 peer_addr_type, u8 own_address_type,
2510                               u8 filter_policy)
2511 {
2512         struct hci_conn *conn;
2513
2514         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2515                                        peer_addr_type);
2516         if (!conn)
2517                 return;
2518
2519         /* When using controller based address resolution, then the new
2520          * address types 0x02 and 0x03 are used. These types need to be
2521          * converted back into either public address or random address type
2522          */
2523         if (use_ll_privacy(hdev) &&
2524             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2525                 switch (own_address_type) {
2526                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2527                         own_address_type = ADDR_LE_DEV_PUBLIC;
2528                         break;
2529                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2530                         own_address_type = ADDR_LE_DEV_RANDOM;
2531                         break;
2532                 }
2533         }
2534
2535         /* Store the initiator and responder address information which
2536          * is needed for SMP. These values will not change during the
2537          * lifetime of the connection.
2538          */
2539         conn->init_addr_type = own_address_type;
2540         if (own_address_type == ADDR_LE_DEV_RANDOM)
2541                 bacpy(&conn->init_addr, &hdev->random_addr);
2542         else
2543                 bacpy(&conn->init_addr, &hdev->bdaddr);
2544
2545         conn->resp_addr_type = peer_addr_type;
2546         bacpy(&conn->resp_addr, peer_addr);
2547
2548         /* We don't want the connection attempt to stick around
2549          * indefinitely since LE doesn't have a page timeout concept
2550          * like BR/EDR. Set a timer for any connection that doesn't use
2551          * the accept list for connecting.
2552          */
2553         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2554                 queue_delayed_work(conn->hdev->workqueue,
2555                                    &conn->le_conn_timeout,
2556                                    conn->conn_timeout);
2557 }
2558
2559 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2560 {
2561         struct hci_cp_le_create_conn *cp;
2562
2563         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2564
2565         /* All connection failure handling is taken care of by the
2566          * hci_le_conn_failed function which is triggered by the HCI
2567          * request completion callbacks used for connecting.
2568          */
2569         if (status)
2570                 return;
2571
2572         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2573         if (!cp)
2574                 return;
2575
2576         hci_dev_lock(hdev);
2577
2578         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2579                           cp->own_address_type, cp->filter_policy);
2580
2581         hci_dev_unlock(hdev);
2582 }
2583
2584 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2585 {
2586         struct hci_cp_le_ext_create_conn *cp;
2587
2588         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2589
2590         /* All connection failure handling is taken care of by the
2591          * hci_le_conn_failed function which is triggered by the HCI
2592          * request completion callbacks used for connecting.
2593          */
2594         if (status)
2595                 return;
2596
2597         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2598         if (!cp)
2599                 return;
2600
2601         hci_dev_lock(hdev);
2602
2603         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2604                           cp->own_addr_type, cp->filter_policy);
2605
2606         hci_dev_unlock(hdev);
2607 }
2608
2609 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2610 {
2611         struct hci_cp_le_read_remote_features *cp;
2612         struct hci_conn *conn;
2613
2614         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2615
2616         if (!status)
2617                 return;
2618
2619         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2620         if (!cp)
2621                 return;
2622
2623         hci_dev_lock(hdev);
2624
2625         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2626         if (conn) {
2627                 if (conn->state == BT_CONFIG) {
2628                         hci_connect_cfm(conn, status);
2629                         hci_conn_drop(conn);
2630                 }
2631         }
2632
2633         hci_dev_unlock(hdev);
2634 }
2635
2636 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2637 {
2638         struct hci_cp_le_start_enc *cp;
2639         struct hci_conn *conn;
2640
2641         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2642
2643         if (!status)
2644                 return;
2645
2646         hci_dev_lock(hdev);
2647
2648         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2649         if (!cp)
2650                 goto unlock;
2651
2652         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2653         if (!conn)
2654                 goto unlock;
2655
2656         if (conn->state != BT_CONNECTED)
2657                 goto unlock;
2658
2659         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2660         hci_conn_drop(conn);
2661
2662 unlock:
2663         hci_dev_unlock(hdev);
2664 }
2665
2666 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2667 {
2668         struct hci_cp_switch_role *cp;
2669         struct hci_conn *conn;
2670
2671         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2672
2673         if (!status)
2674                 return;
2675
2676         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2677         if (!cp)
2678                 return;
2679
2680         hci_dev_lock(hdev);
2681
2682         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2683         if (conn)
2684                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2685
2686         hci_dev_unlock(hdev);
2687 }
2688
2689 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2690 {
2691         __u8 status = *((__u8 *) skb->data);
2692         struct discovery_state *discov = &hdev->discovery;
2693         struct inquiry_entry *e;
2694
2695         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2696
2697         hci_conn_check_pending(hdev);
2698
2699         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2700                 return;
2701
2702         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2703         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2704
2705         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2706                 return;
2707
2708         hci_dev_lock(hdev);
2709
2710         if (discov->state != DISCOVERY_FINDING)
2711                 goto unlock;
2712
2713         if (list_empty(&discov->resolve)) {
2714                 /* When BR/EDR inquiry is active and no LE scanning is in
2715                  * progress, then change discovery state to indicate completion.
2716                  *
2717                  * When running LE scanning and BR/EDR inquiry simultaneously
2718                  * and the LE scan already finished, then change the discovery
2719                  * state to indicate completion.
2720                  */
2721                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2722                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2723                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2724                 goto unlock;
2725         }
2726
2727         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2728         if (e && hci_resolve_name(hdev, e) == 0) {
2729                 e->name_state = NAME_PENDING;
2730                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2731         } else {
2732                 /* When BR/EDR inquiry is active and no LE scanning is in
2733                  * progress, then change discovery state to indicate completion.
2734                  *
2735                  * When running LE scanning and BR/EDR inquiry simultaneously
2736                  * and the LE scan already finished, then change the discovery
2737                  * state to indicate completion.
2738                  */
2739                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2740                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2741                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2742         }
2743
2744 unlock:
2745         hci_dev_unlock(hdev);
2746 }
2747
2748 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2749 {
2750         struct inquiry_data data;
2751         struct inquiry_info *info = (void *) (skb->data + 1);
2752         int num_rsp = *((__u8 *) skb->data);
2753
2754         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2755
2756         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2757                 return;
2758
2759         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2760                 return;
2761
2762         hci_dev_lock(hdev);
2763
2764         for (; num_rsp; num_rsp--, info++) {
2765                 u32 flags;
2766
2767                 bacpy(&data.bdaddr, &info->bdaddr);
2768                 data.pscan_rep_mode     = info->pscan_rep_mode;
2769                 data.pscan_period_mode  = info->pscan_period_mode;
2770                 data.pscan_mode         = info->pscan_mode;
2771                 memcpy(data.dev_class, info->dev_class, 3);
2772                 data.clock_offset       = info->clock_offset;
2773                 data.rssi               = HCI_RSSI_INVALID;
2774                 data.ssp_mode           = 0x00;
2775
2776                 flags = hci_inquiry_cache_update(hdev, &data, false);
2777
2778                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2779                                   info->dev_class, HCI_RSSI_INVALID,
2780                                   flags, NULL, 0, NULL, 0);
2781         }
2782
2783         hci_dev_unlock(hdev);
2784 }
2785
2786 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2787 {
2788         struct hci_ev_conn_complete *ev = (void *) skb->data;
2789         struct hci_conn *conn;
2790
2791         BT_DBG("%s", hdev->name);
2792
2793         hci_dev_lock(hdev);
2794
2795         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2796         if (!conn) {
2797                 /* Connection may not exist if auto-connected. Check the bredr
2798                  * allowlist to see if this device is allowed to auto connect.
2799                  * If link is an ACL type, create a connection class
2800                  * automatically.
2801                  *
2802                  * Auto-connect will only occur if the event filter is
2803                  * programmed with a given address. Right now, event filter is
2804                  * only used during suspend.
2805                  */
2806                 if (ev->link_type == ACL_LINK &&
2807                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2808                                                       &ev->bdaddr,
2809                                                       BDADDR_BREDR)) {
2810                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2811                                             HCI_ROLE_SLAVE);
2812                         if (!conn) {
2813                                 bt_dev_err(hdev, "no memory for new conn");
2814                                 goto unlock;
2815                         }
2816                 } else {
2817                         if (ev->link_type != SCO_LINK)
2818                                 goto unlock;
2819
2820                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2821                                                        &ev->bdaddr);
2822                         if (!conn)
2823                                 goto unlock;
2824
2825                         conn->type = SCO_LINK;
2826                 }
2827         }
2828
2829         if (!ev->status) {
2830                 conn->handle = __le16_to_cpu(ev->handle);
2831
2832                 if (conn->type == ACL_LINK) {
2833                         conn->state = BT_CONFIG;
2834                         hci_conn_hold(conn);
2835
2836                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2837                             !hci_find_link_key(hdev, &ev->bdaddr))
2838                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2839                         else
2840                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2841                 } else
2842                         conn->state = BT_CONNECTED;
2843
2844                 hci_debugfs_create_conn(conn);
2845                 hci_conn_add_sysfs(conn);
2846
2847                 if (test_bit(HCI_AUTH, &hdev->flags))
2848                         set_bit(HCI_CONN_AUTH, &conn->flags);
2849
2850                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2851                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2852
2853                 /* Get remote features */
2854                 if (conn->type == ACL_LINK) {
2855                         struct hci_cp_read_remote_features cp;
2856                         cp.handle = ev->handle;
2857                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2858                                      sizeof(cp), &cp);
2859
2860                         hci_req_update_scan(hdev);
2861                 }
2862
2863                 /* Set packet type for incoming connection */
2864                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2865                         struct hci_cp_change_conn_ptype cp;
2866                         cp.handle = ev->handle;
2867                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2868                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2869                                      &cp);
2870                 }
2871 #ifdef TIZEN_BT
2872                 if (get_link_mode(conn) & HCI_LM_MASTER)
2873                         hci_conn_change_supervision_timeout(conn,
2874                                         LINK_SUPERVISION_TIMEOUT);
2875 #endif
2876         } else {
2877                 conn->state = BT_CLOSED;
2878                 if (conn->type == ACL_LINK)
2879                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2880                                             conn->dst_type, ev->status);
2881         }
2882
2883         if (conn->type == ACL_LINK)
2884                 hci_sco_setup(conn, ev->status);
2885
2886         if (ev->status) {
2887                 hci_connect_cfm(conn, ev->status);
2888                 hci_conn_del(conn);
2889         } else if (ev->link_type == SCO_LINK) {
2890                 switch (conn->setting & SCO_AIRMODE_MASK) {
2891                 case SCO_AIRMODE_CVSD:
2892                         if (hdev->notify)
2893                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2894                         break;
2895                 }
2896
2897                 hci_connect_cfm(conn, ev->status);
2898         }
2899
2900 unlock:
2901         hci_dev_unlock(hdev);
2902
2903         hci_conn_check_pending(hdev);
2904 }
2905
2906 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2907 {
2908         struct hci_cp_reject_conn_req cp;
2909
2910         bacpy(&cp.bdaddr, bdaddr);
2911         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2912         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2913 }
2914
2915 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2916 {
2917         struct hci_ev_conn_request *ev = (void *) skb->data;
2918         int mask = hdev->link_mode;
2919         struct inquiry_entry *ie;
2920         struct hci_conn *conn;
2921         __u8 flags = 0;
2922
2923         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2924                ev->link_type);
2925
2926         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2927                                       &flags);
2928
2929         if (!(mask & HCI_LM_ACCEPT)) {
2930                 hci_reject_conn(hdev, &ev->bdaddr);
2931                 return;
2932         }
2933
2934         hci_dev_lock(hdev);
2935
2936         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2937                                    BDADDR_BREDR)) {
2938                 hci_reject_conn(hdev, &ev->bdaddr);
2939                 goto unlock;
2940         }
2941
2942         /* Require HCI_CONNECTABLE or an accept list entry to accept the
2943          * connection. These features are only touched through mgmt so
2944          * only do the checks if HCI_MGMT is set.
2945          */
2946         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2947             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2948             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2949                                                BDADDR_BREDR)) {
2950                 hci_reject_conn(hdev, &ev->bdaddr);
2951                 goto unlock;
2952         }
2953
2954         /* Connection accepted */
2955
2956         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2957         if (ie)
2958                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2959
2960 #ifdef TIZEN_BT
2961                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2962                     hci_conn_hash_lookup_sco(hdev)) {
2963                         struct hci_cp_reject_conn_req cp;
2964
2965                         bacpy(&cp.bdaddr, &ev->bdaddr);
2966                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2967                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2968                                      sizeof(cp), &cp);
2969                         hci_dev_unlock(hdev);
2970                         return;
2971                 }
2972 #endif
2973
2974         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2975                         &ev->bdaddr);
2976         if (!conn) {
2977                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2978                                     HCI_ROLE_SLAVE);
2979                 if (!conn) {
2980                         bt_dev_err(hdev, "no memory for new connection");
2981                         goto unlock;
2982                 }
2983         }
2984
2985         memcpy(conn->dev_class, ev->dev_class, 3);
2986
2987         hci_dev_unlock(hdev);
2988
2989         if (ev->link_type == ACL_LINK ||
2990             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2991                 struct hci_cp_accept_conn_req cp;
2992                 conn->state = BT_CONNECT;
2993
2994                 bacpy(&cp.bdaddr, &ev->bdaddr);
2995
2996                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2997                         cp.role = 0x00; /* Become central */
2998                 else
2999                         cp.role = 0x01; /* Remain peripheral */
3000
3001                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3002         } else if (!(flags & HCI_PROTO_DEFER)) {
3003                 struct hci_cp_accept_sync_conn_req cp;
3004                 conn->state = BT_CONNECT;
3005
3006                 bacpy(&cp.bdaddr, &ev->bdaddr);
3007                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
3008
3009                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3010                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3011                 cp.max_latency    = cpu_to_le16(0xffff);
3012                 cp.content_format = cpu_to_le16(hdev->voice_setting);
3013                 cp.retrans_effort = 0xff;
3014
3015                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3016                              &cp);
3017         } else {
3018                 conn->state = BT_CONNECT2;
3019                 hci_connect_cfm(conn, 0);
3020         }
3021
3022         return;
3023 unlock:
3024         hci_dev_unlock(hdev);
3025 }
3026
3027 static u8 hci_to_mgmt_reason(u8 err)
3028 {
3029         switch (err) {
3030         case HCI_ERROR_CONNECTION_TIMEOUT:
3031                 return MGMT_DEV_DISCONN_TIMEOUT;
3032         case HCI_ERROR_REMOTE_USER_TERM:
3033         case HCI_ERROR_REMOTE_LOW_RESOURCES:
3034         case HCI_ERROR_REMOTE_POWER_OFF:
3035                 return MGMT_DEV_DISCONN_REMOTE;
3036         case HCI_ERROR_LOCAL_HOST_TERM:
3037                 return MGMT_DEV_DISCONN_LOCAL_HOST;
3038         default:
3039                 return MGMT_DEV_DISCONN_UNKNOWN;
3040         }
3041 }
3042
3043 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3044 {
3045         struct hci_ev_disconn_complete *ev = (void *) skb->data;
3046         u8 reason;
3047         struct hci_conn_params *params;
3048         struct hci_conn *conn;
3049         bool mgmt_connected;
3050
3051         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3052
3053         hci_dev_lock(hdev);
3054
3055         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3056         if (!conn)
3057                 goto unlock;
3058
3059         if (ev->status) {
3060                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3061                                        conn->dst_type, ev->status);
3062                 goto unlock;
3063         }
3064
3065         conn->state = BT_CLOSED;
3066
3067         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3068
3069         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3070                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3071         else
3072                 reason = hci_to_mgmt_reason(ev->reason);
3073
3074         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3075                                 reason, mgmt_connected);
3076
3077         if (conn->type == ACL_LINK) {
3078                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3079                         hci_remove_link_key(hdev, &conn->dst);
3080
3081                 hci_req_update_scan(hdev);
3082         }
3083
3084         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3085         if (params) {
3086                 switch (params->auto_connect) {
3087                 case HCI_AUTO_CONN_LINK_LOSS:
3088                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3089                                 break;
3090                         fallthrough;
3091
3092                 case HCI_AUTO_CONN_DIRECT:
3093                 case HCI_AUTO_CONN_ALWAYS:
3094                         list_del_init(&params->action);
3095                         list_add(&params->action, &hdev->pend_le_conns);
3096                         hci_update_background_scan(hdev);
3097                         break;
3098
3099                 default:
3100                         break;
3101                 }
3102         }
3103
3104         hci_disconn_cfm(conn, ev->reason);
3105
3106         /* The suspend notifier is waiting for all devices to disconnect so
3107          * clear the bit from pending tasks and inform the wait queue.
3108          */
3109         if (list_empty(&hdev->conn_hash.list) &&
3110             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
3111                 wake_up(&hdev->suspend_wait_q);
3112         }
3113
3114         /* Re-enable advertising if necessary, since it might
3115          * have been disabled by the connection. From the
3116          * HCI_LE_Set_Advertise_Enable command description in
3117          * the core specification (v4.0):
3118          * "The Controller shall continue advertising until the Host
3119          * issues an LE_Set_Advertise_Enable command with
3120          * Advertising_Enable set to 0x00 (Advertising is disabled)
3121          * or until a connection is created or until the Advertising
3122          * is timed out due to Directed Advertising."
3123          */
3124         if (conn->type == LE_LINK) {
3125                 hdev->cur_adv_instance = conn->adv_instance;
3126                 hci_req_reenable_advertising(hdev);
3127         }
3128
3129         hci_conn_del(conn);
3130
3131 unlock:
3132         hci_dev_unlock(hdev);
3133 }
3134
3135 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3136 {
3137         struct hci_ev_auth_complete *ev = (void *) skb->data;
3138         struct hci_conn *conn;
3139
3140         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3141
3142         hci_dev_lock(hdev);
3143
3144         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3145         if (!conn)
3146                 goto unlock;
3147
3148         if (!ev->status) {
3149                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3150
3151                 if (!hci_conn_ssp_enabled(conn) &&
3152                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3153                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3154                 } else {
3155                         set_bit(HCI_CONN_AUTH, &conn->flags);
3156                         conn->sec_level = conn->pending_sec_level;
3157                 }
3158         } else {
3159                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3160                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3161
3162                 mgmt_auth_failed(conn, ev->status);
3163         }
3164
3165         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3166         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3167
3168         if (conn->state == BT_CONFIG) {
3169                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3170                         struct hci_cp_set_conn_encrypt cp;
3171                         cp.handle  = ev->handle;
3172                         cp.encrypt = 0x01;
3173                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3174                                      &cp);
3175                 } else {
3176                         conn->state = BT_CONNECTED;
3177                         hci_connect_cfm(conn, ev->status);
3178                         hci_conn_drop(conn);
3179                 }
3180         } else {
3181                 hci_auth_cfm(conn, ev->status);
3182
3183                 hci_conn_hold(conn);
3184                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3185                 hci_conn_drop(conn);
3186         }
3187
3188         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3189                 if (!ev->status) {
3190                         struct hci_cp_set_conn_encrypt cp;
3191                         cp.handle  = ev->handle;
3192                         cp.encrypt = 0x01;
3193                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3194                                      &cp);
3195                 } else {
3196                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3197                         hci_encrypt_cfm(conn, ev->status);
3198                 }
3199         }
3200
3201 unlock:
3202         hci_dev_unlock(hdev);
3203 }
3204
3205 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3206 {
3207         struct hci_ev_remote_name *ev = (void *) skb->data;
3208         struct hci_conn *conn;
3209
3210         BT_DBG("%s", hdev->name);
3211
3212         hci_conn_check_pending(hdev);
3213
3214         hci_dev_lock(hdev);
3215
3216         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3217
3218         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3219                 goto check_auth;
3220
3221         if (ev->status == 0)
3222                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3223                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3224         else
3225                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3226
3227 check_auth:
3228         if (!conn)
3229                 goto unlock;
3230
3231         if (!hci_outgoing_auth_needed(hdev, conn))
3232                 goto unlock;
3233
3234         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3235                 struct hci_cp_auth_requested cp;
3236
3237                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3238
3239                 cp.handle = __cpu_to_le16(conn->handle);
3240                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3241         }
3242
3243 unlock:
3244         hci_dev_unlock(hdev);
3245 }
3246
3247 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3248                                        u16 opcode, struct sk_buff *skb)
3249 {
3250         const struct hci_rp_read_enc_key_size *rp;
3251         struct hci_conn *conn;
3252         u16 handle;
3253
3254         BT_DBG("%s status 0x%02x", hdev->name, status);
3255
3256         if (!skb || skb->len < sizeof(*rp)) {
3257                 bt_dev_err(hdev, "invalid read key size response");
3258                 return;
3259         }
3260
3261         rp = (void *)skb->data;
3262         handle = le16_to_cpu(rp->handle);
3263
3264         hci_dev_lock(hdev);
3265
3266         conn = hci_conn_hash_lookup_handle(hdev, handle);
3267         if (!conn)
3268                 goto unlock;
3269
3270         /* While unexpected, the read_enc_key_size command may fail. The most
3271          * secure approach is to then assume the key size is 0 to force a
3272          * disconnection.
3273          */
3274         if (rp->status) {
3275                 bt_dev_err(hdev, "failed to read key size for handle %u",
3276                            handle);
3277                 conn->enc_key_size = 0;
3278         } else {
3279                 conn->enc_key_size = rp->key_size;
3280         }
3281
3282         hci_encrypt_cfm(conn, 0);
3283
3284 unlock:
3285         hci_dev_unlock(hdev);
3286 }
3287
3288 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3289 {
3290         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3291         struct hci_conn *conn;
3292
3293         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3294
3295         hci_dev_lock(hdev);
3296
3297         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3298         if (!conn)
3299                 goto unlock;
3300
3301         if (!ev->status) {
3302                 if (ev->encrypt) {
3303                         /* Encryption implies authentication */
3304                         set_bit(HCI_CONN_AUTH, &conn->flags);
3305                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3306                         conn->sec_level = conn->pending_sec_level;
3307
3308                         /* P-256 authentication key implies FIPS */
3309                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3310                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3311
3312                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3313                             conn->type == LE_LINK)
3314                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3315                 } else {
3316                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3317                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3318                 }
3319         }
3320
3321         /* We should disregard the current RPA and generate a new one
3322          * whenever the encryption procedure fails.
3323          */
3324         if (ev->status && conn->type == LE_LINK) {
3325                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3326                 hci_adv_instances_set_rpa_expired(hdev, true);
3327         }
3328
3329         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3330
3331         /* Check link security requirements are met */
3332         if (!hci_conn_check_link_mode(conn))
3333                 ev->status = HCI_ERROR_AUTH_FAILURE;
3334
3335         if (ev->status && conn->state == BT_CONNECTED) {
3336                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3337                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3338
3339                 /* Notify upper layers so they can cleanup before
3340                  * disconnecting.
3341                  */
3342                 hci_encrypt_cfm(conn, ev->status);
3343                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3344                 hci_conn_drop(conn);
3345                 goto unlock;
3346         }
3347
3348         /* Try reading the encryption key size for encrypted ACL links */
3349         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3350                 struct hci_cp_read_enc_key_size cp;
3351                 struct hci_request req;
3352
3353                 /* Only send HCI_Read_Encryption_Key_Size if the
3354                  * controller really supports it. If it doesn't, assume
3355                  * the default size (16).
3356                  */
3357                 if (!(hdev->commands[20] & 0x10)) {
3358                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3359                         goto notify;
3360                 }
3361
3362                 hci_req_init(&req, hdev);
3363
3364                 cp.handle = cpu_to_le16(conn->handle);
3365                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3366
3367                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3368                         bt_dev_err(hdev, "sending read key size failed");
3369                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3370                         goto notify;
3371                 }
3372
3373                 goto unlock;
3374         }
3375
3376         /* Set the default Authenticated Payload Timeout after
3377          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3378          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3379          * sent when the link is active and Encryption is enabled, the conn
3380          * type can be either LE or ACL and controller must support LMP Ping.
3381          * Ensure for AES-CCM encryption as well.
3382          */
3383         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3384             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3385             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3386              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3387                 struct hci_cp_write_auth_payload_to cp;
3388
3389                 cp.handle = cpu_to_le16(conn->handle);
3390                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3391                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3392                              sizeof(cp), &cp);
3393         }
3394
3395 notify:
3396         hci_encrypt_cfm(conn, ev->status);
3397
3398 unlock:
3399         hci_dev_unlock(hdev);
3400 }
3401
3402 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3403                                              struct sk_buff *skb)
3404 {
3405         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3406         struct hci_conn *conn;
3407
3408         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3409
3410         hci_dev_lock(hdev);
3411
3412         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3413         if (conn) {
3414                 if (!ev->status)
3415                         set_bit(HCI_CONN_SECURE, &conn->flags);
3416
3417                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3418
3419                 hci_key_change_cfm(conn, ev->status);
3420         }
3421
3422         hci_dev_unlock(hdev);
3423 }
3424
3425 static void hci_remote_features_evt(struct hci_dev *hdev,
3426                                     struct sk_buff *skb)
3427 {
3428         struct hci_ev_remote_features *ev = (void *) skb->data;
3429         struct hci_conn *conn;
3430
3431         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3432
3433         hci_dev_lock(hdev);
3434
3435         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3436         if (!conn)
3437                 goto unlock;
3438
3439         if (!ev->status)
3440                 memcpy(conn->features[0], ev->features, 8);
3441
3442         if (conn->state != BT_CONFIG)
3443                 goto unlock;
3444
3445         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3446             lmp_ext_feat_capable(conn)) {
3447                 struct hci_cp_read_remote_ext_features cp;
3448                 cp.handle = ev->handle;
3449                 cp.page = 0x01;
3450                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3451                              sizeof(cp), &cp);
3452                 goto unlock;
3453         }
3454
3455         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3456                 struct hci_cp_remote_name_req cp;
3457                 memset(&cp, 0, sizeof(cp));
3458                 bacpy(&cp.bdaddr, &conn->dst);
3459                 cp.pscan_rep_mode = 0x02;
3460                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3461         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3462                 mgmt_device_connected(hdev, conn, NULL, 0);
3463
3464         if (!hci_outgoing_auth_needed(hdev, conn)) {
3465                 conn->state = BT_CONNECTED;
3466                 hci_connect_cfm(conn, ev->status);
3467                 hci_conn_drop(conn);
3468         }
3469
3470 unlock:
3471         hci_dev_unlock(hdev);
3472 }
3473
3474 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3475 {
3476         cancel_delayed_work(&hdev->cmd_timer);
3477
3478         if (!test_bit(HCI_RESET, &hdev->flags)) {
3479                 if (ncmd) {
3480                         cancel_delayed_work(&hdev->ncmd_timer);
3481                         atomic_set(&hdev->cmd_cnt, 1);
3482                 } else {
3483                         schedule_delayed_work(&hdev->ncmd_timer,
3484                                               HCI_NCMD_TIMEOUT);
3485                 }
3486         }
3487 }
3488
3489 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3490                                  u16 *opcode, u8 *status,
3491                                  hci_req_complete_t *req_complete,
3492                                  hci_req_complete_skb_t *req_complete_skb)
3493 {
3494         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3495
3496         *opcode = __le16_to_cpu(ev->opcode);
3497         *status = skb->data[sizeof(*ev)];
3498
3499         skb_pull(skb, sizeof(*ev));
3500
3501         switch (*opcode) {
3502         case HCI_OP_INQUIRY_CANCEL:
3503                 hci_cc_inquiry_cancel(hdev, skb, status);
3504                 break;
3505
3506         case HCI_OP_PERIODIC_INQ:
3507                 hci_cc_periodic_inq(hdev, skb);
3508                 break;
3509
3510         case HCI_OP_EXIT_PERIODIC_INQ:
3511                 hci_cc_exit_periodic_inq(hdev, skb);
3512                 break;
3513
3514         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3515                 hci_cc_remote_name_req_cancel(hdev, skb);
3516                 break;
3517
3518         case HCI_OP_ROLE_DISCOVERY:
3519                 hci_cc_role_discovery(hdev, skb);
3520                 break;
3521
3522         case HCI_OP_READ_LINK_POLICY:
3523                 hci_cc_read_link_policy(hdev, skb);
3524                 break;
3525
3526         case HCI_OP_WRITE_LINK_POLICY:
3527                 hci_cc_write_link_policy(hdev, skb);
3528                 break;
3529
3530         case HCI_OP_READ_DEF_LINK_POLICY:
3531                 hci_cc_read_def_link_policy(hdev, skb);
3532                 break;
3533
3534         case HCI_OP_WRITE_DEF_LINK_POLICY:
3535                 hci_cc_write_def_link_policy(hdev, skb);
3536                 break;
3537
3538         case HCI_OP_RESET:
3539                 hci_cc_reset(hdev, skb);
3540                 break;
3541
3542         case HCI_OP_READ_STORED_LINK_KEY:
3543                 hci_cc_read_stored_link_key(hdev, skb);
3544                 break;
3545
3546         case HCI_OP_DELETE_STORED_LINK_KEY:
3547                 hci_cc_delete_stored_link_key(hdev, skb);
3548                 break;
3549
3550         case HCI_OP_WRITE_LOCAL_NAME:
3551                 hci_cc_write_local_name(hdev, skb);
3552                 break;
3553
3554         case HCI_OP_READ_LOCAL_NAME:
3555                 hci_cc_read_local_name(hdev, skb);
3556                 break;
3557
3558         case HCI_OP_WRITE_AUTH_ENABLE:
3559                 hci_cc_write_auth_enable(hdev, skb);
3560                 break;
3561
3562         case HCI_OP_WRITE_ENCRYPT_MODE:
3563                 hci_cc_write_encrypt_mode(hdev, skb);
3564                 break;
3565
3566         case HCI_OP_WRITE_SCAN_ENABLE:
3567                 hci_cc_write_scan_enable(hdev, skb);
3568                 break;
3569
3570         case HCI_OP_SET_EVENT_FLT:
3571                 hci_cc_set_event_filter(hdev, skb);
3572                 break;
3573
3574         case HCI_OP_READ_CLASS_OF_DEV:
3575                 hci_cc_read_class_of_dev(hdev, skb);
3576                 break;
3577
3578         case HCI_OP_WRITE_CLASS_OF_DEV:
3579                 hci_cc_write_class_of_dev(hdev, skb);
3580                 break;
3581
3582         case HCI_OP_READ_VOICE_SETTING:
3583                 hci_cc_read_voice_setting(hdev, skb);
3584                 break;
3585
3586         case HCI_OP_WRITE_VOICE_SETTING:
3587                 hci_cc_write_voice_setting(hdev, skb);
3588                 break;
3589
3590         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3591                 hci_cc_read_num_supported_iac(hdev, skb);
3592                 break;
3593
3594         case HCI_OP_WRITE_SSP_MODE:
3595                 hci_cc_write_ssp_mode(hdev, skb);
3596                 break;
3597
3598         case HCI_OP_WRITE_SC_SUPPORT:
3599                 hci_cc_write_sc_support(hdev, skb);
3600                 break;
3601
3602         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3603                 hci_cc_read_auth_payload_timeout(hdev, skb);
3604                 break;
3605
3606         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3607                 hci_cc_write_auth_payload_timeout(hdev, skb);
3608                 break;
3609
3610         case HCI_OP_READ_LOCAL_VERSION:
3611                 hci_cc_read_local_version(hdev, skb);
3612                 break;
3613
3614         case HCI_OP_READ_LOCAL_COMMANDS:
3615                 hci_cc_read_local_commands(hdev, skb);
3616                 break;
3617
3618         case HCI_OP_READ_LOCAL_FEATURES:
3619                 hci_cc_read_local_features(hdev, skb);
3620                 break;
3621
3622         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3623                 hci_cc_read_local_ext_features(hdev, skb);
3624                 break;
3625
3626         case HCI_OP_READ_BUFFER_SIZE:
3627                 hci_cc_read_buffer_size(hdev, skb);
3628                 break;
3629
3630         case HCI_OP_READ_BD_ADDR:
3631                 hci_cc_read_bd_addr(hdev, skb);
3632                 break;
3633
3634         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3635                 hci_cc_read_local_pairing_opts(hdev, skb);
3636                 break;
3637
3638         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3639                 hci_cc_read_page_scan_activity(hdev, skb);
3640                 break;
3641
3642         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3643                 hci_cc_write_page_scan_activity(hdev, skb);
3644                 break;
3645
3646         case HCI_OP_READ_PAGE_SCAN_TYPE:
3647                 hci_cc_read_page_scan_type(hdev, skb);
3648                 break;
3649
3650         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3651                 hci_cc_write_page_scan_type(hdev, skb);
3652                 break;
3653
3654         case HCI_OP_READ_DATA_BLOCK_SIZE:
3655                 hci_cc_read_data_block_size(hdev, skb);
3656                 break;
3657
3658         case HCI_OP_READ_FLOW_CONTROL_MODE:
3659                 hci_cc_read_flow_control_mode(hdev, skb);
3660                 break;
3661
3662         case HCI_OP_READ_LOCAL_AMP_INFO:
3663                 hci_cc_read_local_amp_info(hdev, skb);
3664                 break;
3665
3666         case HCI_OP_READ_CLOCK:
3667                 hci_cc_read_clock(hdev, skb);
3668                 break;
3669
3670         case HCI_OP_READ_INQ_RSP_TX_POWER:
3671                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3672                 break;
3673
3674         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3675                 hci_cc_read_def_err_data_reporting(hdev, skb);
3676                 break;
3677
3678         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3679                 hci_cc_write_def_err_data_reporting(hdev, skb);
3680                 break;
3681
3682         case HCI_OP_PIN_CODE_REPLY:
3683                 hci_cc_pin_code_reply(hdev, skb);
3684                 break;
3685
3686         case HCI_OP_PIN_CODE_NEG_REPLY:
3687                 hci_cc_pin_code_neg_reply(hdev, skb);
3688                 break;
3689
3690         case HCI_OP_READ_LOCAL_OOB_DATA:
3691                 hci_cc_read_local_oob_data(hdev, skb);
3692                 break;
3693
3694         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3695                 hci_cc_read_local_oob_ext_data(hdev, skb);
3696                 break;
3697
3698         case HCI_OP_LE_READ_BUFFER_SIZE:
3699                 hci_cc_le_read_buffer_size(hdev, skb);
3700                 break;
3701
3702         case HCI_OP_LE_READ_LOCAL_FEATURES:
3703                 hci_cc_le_read_local_features(hdev, skb);
3704                 break;
3705
3706         case HCI_OP_LE_READ_ADV_TX_POWER:
3707                 hci_cc_le_read_adv_tx_power(hdev, skb);
3708                 break;
3709
3710         case HCI_OP_USER_CONFIRM_REPLY:
3711                 hci_cc_user_confirm_reply(hdev, skb);
3712                 break;
3713
3714         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3715                 hci_cc_user_confirm_neg_reply(hdev, skb);
3716                 break;
3717
3718         case HCI_OP_USER_PASSKEY_REPLY:
3719                 hci_cc_user_passkey_reply(hdev, skb);
3720                 break;
3721
3722         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3723                 hci_cc_user_passkey_neg_reply(hdev, skb);
3724                 break;
3725
3726         case HCI_OP_LE_SET_RANDOM_ADDR:
3727                 hci_cc_le_set_random_addr(hdev, skb);
3728                 break;
3729
3730         case HCI_OP_LE_SET_ADV_ENABLE:
3731                 hci_cc_le_set_adv_enable(hdev, skb);
3732                 break;
3733
3734         case HCI_OP_LE_SET_SCAN_PARAM:
3735                 hci_cc_le_set_scan_param(hdev, skb);
3736                 break;
3737
3738         case HCI_OP_LE_SET_SCAN_ENABLE:
3739                 hci_cc_le_set_scan_enable(hdev, skb);
3740                 break;
3741
3742         case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3743                 hci_cc_le_read_accept_list_size(hdev, skb);
3744                 break;
3745
3746         case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3747                 hci_cc_le_clear_accept_list(hdev, skb);
3748                 break;
3749
3750         case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3751                 hci_cc_le_add_to_accept_list(hdev, skb);
3752                 break;
3753
3754         case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3755                 hci_cc_le_del_from_accept_list(hdev, skb);
3756                 break;
3757
3758         case HCI_OP_LE_READ_SUPPORTED_STATES:
3759                 hci_cc_le_read_supported_states(hdev, skb);
3760                 break;
3761
3762         case HCI_OP_LE_READ_DEF_DATA_LEN:
3763                 hci_cc_le_read_def_data_len(hdev, skb);
3764                 break;
3765
3766         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3767                 hci_cc_le_write_def_data_len(hdev, skb);
3768                 break;
3769
3770         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3771                 hci_cc_le_add_to_resolv_list(hdev, skb);
3772                 break;
3773
3774         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3775                 hci_cc_le_del_from_resolv_list(hdev, skb);
3776                 break;
3777
3778         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3779                 hci_cc_le_clear_resolv_list(hdev, skb);
3780                 break;
3781
3782         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3783                 hci_cc_le_read_resolv_list_size(hdev, skb);
3784                 break;
3785
3786         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3787                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3788                 break;
3789
3790         case HCI_OP_LE_READ_MAX_DATA_LEN:
3791                 hci_cc_le_read_max_data_len(hdev, skb);
3792                 break;
3793
3794         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3795                 hci_cc_write_le_host_supported(hdev, skb);
3796                 break;
3797
3798         case HCI_OP_LE_SET_ADV_PARAM:
3799                 hci_cc_set_adv_param(hdev, skb);
3800                 break;
3801
3802         case HCI_OP_READ_RSSI:
3803                 hci_cc_read_rssi(hdev, skb);
3804                 break;
3805
3806         case HCI_OP_READ_TX_POWER:
3807                 hci_cc_read_tx_power(hdev, skb);
3808                 break;
3809
3810         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3811                 hci_cc_write_ssp_debug_mode(hdev, skb);
3812                 break;
3813
3814         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3815                 hci_cc_le_set_ext_scan_param(hdev, skb);
3816                 break;
3817
3818         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3819                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3820                 break;
3821
3822         case HCI_OP_LE_SET_DEFAULT_PHY:
3823                 hci_cc_le_set_default_phy(hdev, skb);
3824                 break;
3825
3826         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3827                 hci_cc_le_read_num_adv_sets(hdev, skb);
3828                 break;
3829
3830         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3831                 hci_cc_set_ext_adv_param(hdev, skb);
3832                 break;
3833
3834         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3835                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3836                 break;
3837
3838         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3839                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3840                 break;
3841
3842         case HCI_OP_LE_READ_TRANSMIT_POWER:
3843                 hci_cc_le_read_transmit_power(hdev, skb);
3844                 break;
3845 #ifdef TIZEN_BT
3846         case HCI_OP_ENABLE_RSSI:
3847                 hci_cc_enable_rssi(hdev, skb);
3848                 break;
3849
3850         case HCI_OP_GET_RAW_RSSI:
3851                 hci_cc_get_raw_rssi(hdev, skb);
3852                 break;
3853 #endif
3854         default:
3855                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3856                 break;
3857         }
3858
3859         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3860
3861         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3862                              req_complete_skb);
3863
3864         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3865                 bt_dev_err(hdev,
3866                            "unexpected event for opcode 0x%4.4x", *opcode);
3867                 return;
3868         }
3869
3870         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3871                 queue_work(hdev->workqueue, &hdev->cmd_work);
3872 }
3873
3874 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3875                                u16 *opcode, u8 *status,
3876                                hci_req_complete_t *req_complete,
3877                                hci_req_complete_skb_t *req_complete_skb)
3878 {
3879         struct hci_ev_cmd_status *ev = (void *) skb->data;
3880
3881         skb_pull(skb, sizeof(*ev));
3882
3883         *opcode = __le16_to_cpu(ev->opcode);
3884         *status = ev->status;
3885
3886         switch (*opcode) {
3887         case HCI_OP_INQUIRY:
3888                 hci_cs_inquiry(hdev, ev->status);
3889                 break;
3890
3891         case HCI_OP_CREATE_CONN:
3892                 hci_cs_create_conn(hdev, ev->status);
3893                 break;
3894
3895         case HCI_OP_DISCONNECT:
3896                 hci_cs_disconnect(hdev, ev->status);
3897                 break;
3898
3899         case HCI_OP_ADD_SCO:
3900                 hci_cs_add_sco(hdev, ev->status);
3901                 break;
3902
3903         case HCI_OP_AUTH_REQUESTED:
3904                 hci_cs_auth_requested(hdev, ev->status);
3905                 break;
3906
3907         case HCI_OP_SET_CONN_ENCRYPT:
3908                 hci_cs_set_conn_encrypt(hdev, ev->status);
3909                 break;
3910
3911         case HCI_OP_REMOTE_NAME_REQ:
3912                 hci_cs_remote_name_req(hdev, ev->status);
3913                 break;
3914
3915         case HCI_OP_READ_REMOTE_FEATURES:
3916                 hci_cs_read_remote_features(hdev, ev->status);
3917                 break;
3918
3919         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3920                 hci_cs_read_remote_ext_features(hdev, ev->status);
3921                 break;
3922
3923         case HCI_OP_SETUP_SYNC_CONN:
3924                 hci_cs_setup_sync_conn(hdev, ev->status);
3925                 break;
3926
3927         case HCI_OP_SNIFF_MODE:
3928                 hci_cs_sniff_mode(hdev, ev->status);
3929                 break;
3930
3931         case HCI_OP_EXIT_SNIFF_MODE:
3932                 hci_cs_exit_sniff_mode(hdev, ev->status);
3933                 break;
3934
3935         case HCI_OP_SWITCH_ROLE:
3936                 hci_cs_switch_role(hdev, ev->status);
3937                 break;
3938
3939         case HCI_OP_LE_CREATE_CONN:
3940                 hci_cs_le_create_conn(hdev, ev->status);
3941                 break;
3942
3943         case HCI_OP_LE_READ_REMOTE_FEATURES:
3944                 hci_cs_le_read_remote_features(hdev, ev->status);
3945                 break;
3946
3947         case HCI_OP_LE_START_ENC:
3948                 hci_cs_le_start_enc(hdev, ev->status);
3949                 break;
3950
3951         case HCI_OP_LE_EXT_CREATE_CONN:
3952                 hci_cs_le_ext_create_conn(hdev, ev->status);
3953                 break;
3954
3955         default:
3956                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3957                 break;
3958         }
3959
3960         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3961
3962         /* Indicate request completion if the command failed. Also, if
3963          * we're not waiting for a special event and we get a success
3964          * command status we should try to flag the request as completed
3965          * (since for this kind of commands there will not be a command
3966          * complete event).
3967          */
3968         if (ev->status ||
3969             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3970                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3971                                      req_complete_skb);
3972
3973         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3974                 bt_dev_err(hdev,
3975                            "unexpected event for opcode 0x%4.4x", *opcode);
3976                 return;
3977         }
3978
3979         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3980                 queue_work(hdev->workqueue, &hdev->cmd_work);
3981 }
3982
3983 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3984 {
3985         struct hci_ev_hardware_error *ev = (void *) skb->data;
3986
3987 #ifdef TIZEN_BT
3988         hci_dev_lock(hdev);
3989         mgmt_hardware_error(hdev, ev->code);
3990         hci_dev_unlock(hdev);
3991 #endif
3992         hdev->hw_error_code = ev->code;
3993
3994         queue_work(hdev->req_workqueue, &hdev->error_reset);
3995 }
3996
3997 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3998 {
3999         struct hci_ev_role_change *ev = (void *) skb->data;
4000         struct hci_conn *conn;
4001
4002         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4003
4004         hci_dev_lock(hdev);
4005
4006         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4007         if (conn) {
4008                 if (!ev->status)
4009                         conn->role = ev->role;
4010
4011                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4012
4013                 hci_role_switch_cfm(conn, ev->status, ev->role);
4014 #ifdef TIZEN_BT
4015                 if (!ev->status && (get_link_mode(conn) & HCI_LM_MASTER))
4016                         hci_conn_change_supervision_timeout(conn,
4017                                         LINK_SUPERVISION_TIMEOUT);
4018 #endif
4019         }
4020
4021         hci_dev_unlock(hdev);
4022 }
4023
4024 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
4025 {
4026         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
4027         int i;
4028
4029         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4030                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4031                 return;
4032         }
4033
4034         if (skb->len < sizeof(*ev) ||
4035             skb->len < struct_size(ev, handles, ev->num_hndl)) {
4036                 BT_DBG("%s bad parameters", hdev->name);
4037                 return;
4038         }
4039
4040         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
4041
4042         for (i = 0; i < ev->num_hndl; i++) {
4043                 struct hci_comp_pkts_info *info = &ev->handles[i];
4044                 struct hci_conn *conn;
4045                 __u16  handle, count;
4046
4047                 handle = __le16_to_cpu(info->handle);
4048                 count  = __le16_to_cpu(info->count);
4049
4050                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4051                 if (!conn)
4052                         continue;
4053
4054                 conn->sent -= count;
4055
4056                 switch (conn->type) {
4057                 case ACL_LINK:
4058                         hdev->acl_cnt += count;
4059                         if (hdev->acl_cnt > hdev->acl_pkts)
4060                                 hdev->acl_cnt = hdev->acl_pkts;
4061                         break;
4062
4063                 case LE_LINK:
4064                         if (hdev->le_pkts) {
4065                                 hdev->le_cnt += count;
4066                                 if (hdev->le_cnt > hdev->le_pkts)
4067                                         hdev->le_cnt = hdev->le_pkts;
4068                         } else {
4069                                 hdev->acl_cnt += count;
4070                                 if (hdev->acl_cnt > hdev->acl_pkts)
4071                                         hdev->acl_cnt = hdev->acl_pkts;
4072                         }
4073                         break;
4074
4075                 case SCO_LINK:
4076                         hdev->sco_cnt += count;
4077                         if (hdev->sco_cnt > hdev->sco_pkts)
4078                                 hdev->sco_cnt = hdev->sco_pkts;
4079                         break;
4080
4081                 default:
4082                         bt_dev_err(hdev, "unknown type %d conn %p",
4083                                    conn->type, conn);
4084                         break;
4085                 }
4086         }
4087
4088         queue_work(hdev->workqueue, &hdev->tx_work);
4089 }
4090
4091 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4092                                                  __u16 handle)
4093 {
4094         struct hci_chan *chan;
4095
4096         switch (hdev->dev_type) {
4097         case HCI_PRIMARY:
4098                 return hci_conn_hash_lookup_handle(hdev, handle);
4099         case HCI_AMP:
4100                 chan = hci_chan_lookup_handle(hdev, handle);
4101                 if (chan)
4102                         return chan->conn;
4103                 break;
4104         default:
4105                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4106                 break;
4107         }
4108
4109         return NULL;
4110 }
4111
4112 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
4113 {
4114         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
4115         int i;
4116
4117         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4118                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4119                 return;
4120         }
4121
4122         if (skb->len < sizeof(*ev) ||
4123             skb->len < struct_size(ev, handles, ev->num_hndl)) {
4124                 BT_DBG("%s bad parameters", hdev->name);
4125                 return;
4126         }
4127
4128         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
4129                ev->num_hndl);
4130
4131         for (i = 0; i < ev->num_hndl; i++) {
4132                 struct hci_comp_blocks_info *info = &ev->handles[i];
4133                 struct hci_conn *conn = NULL;
4134                 __u16  handle, block_count;
4135
4136                 handle = __le16_to_cpu(info->handle);
4137                 block_count = __le16_to_cpu(info->blocks);
4138
4139                 conn = __hci_conn_lookup_handle(hdev, handle);
4140                 if (!conn)
4141                         continue;
4142
4143                 conn->sent -= block_count;
4144
4145                 switch (conn->type) {
4146                 case ACL_LINK:
4147                 case AMP_LINK:
4148                         hdev->block_cnt += block_count;
4149                         if (hdev->block_cnt > hdev->num_blocks)
4150                                 hdev->block_cnt = hdev->num_blocks;
4151                         break;
4152
4153                 default:
4154                         bt_dev_err(hdev, "unknown type %d conn %p",
4155                                    conn->type, conn);
4156                         break;
4157                 }
4158         }
4159
4160         queue_work(hdev->workqueue, &hdev->tx_work);
4161 }
4162
4163 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4164 {
4165         struct hci_ev_mode_change *ev = (void *) skb->data;
4166         struct hci_conn *conn;
4167
4168         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4169
4170         hci_dev_lock(hdev);
4171
4172         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4173         if (conn) {
4174                 conn->mode = ev->mode;
4175
4176                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4177                                         &conn->flags)) {
4178                         if (conn->mode == HCI_CM_ACTIVE)
4179                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4180                         else
4181                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4182                 }
4183
4184                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4185                         hci_sco_setup(conn, ev->status);
4186         }
4187
4188         hci_dev_unlock(hdev);
4189 }
4190
4191 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4192 {
4193         struct hci_ev_pin_code_req *ev = (void *) skb->data;
4194         struct hci_conn *conn;
4195
4196         BT_DBG("%s", hdev->name);
4197
4198         hci_dev_lock(hdev);
4199
4200         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4201         if (!conn)
4202                 goto unlock;
4203
4204         if (conn->state == BT_CONNECTED) {
4205                 hci_conn_hold(conn);
4206                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4207                 hci_conn_drop(conn);
4208         }
4209
4210         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4211             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4212                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4213                              sizeof(ev->bdaddr), &ev->bdaddr);
4214         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4215                 u8 secure;
4216
4217                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4218                         secure = 1;
4219                 else
4220                         secure = 0;
4221
4222                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4223         }
4224
4225 unlock:
4226         hci_dev_unlock(hdev);
4227 }
4228
4229 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4230 {
4231         if (key_type == HCI_LK_CHANGED_COMBINATION)
4232                 return;
4233
4234         conn->pin_length = pin_len;
4235         conn->key_type = key_type;
4236
4237         switch (key_type) {
4238         case HCI_LK_LOCAL_UNIT:
4239         case HCI_LK_REMOTE_UNIT:
4240         case HCI_LK_DEBUG_COMBINATION:
4241                 return;
4242         case HCI_LK_COMBINATION:
4243                 if (pin_len == 16)
4244                         conn->pending_sec_level = BT_SECURITY_HIGH;
4245                 else
4246                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4247                 break;
4248         case HCI_LK_UNAUTH_COMBINATION_P192:
4249         case HCI_LK_UNAUTH_COMBINATION_P256:
4250                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4251                 break;
4252         case HCI_LK_AUTH_COMBINATION_P192:
4253                 conn->pending_sec_level = BT_SECURITY_HIGH;
4254                 break;
4255         case HCI_LK_AUTH_COMBINATION_P256:
4256                 conn->pending_sec_level = BT_SECURITY_FIPS;
4257                 break;
4258         }
4259 }
4260
4261 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4262 {
4263         struct hci_ev_link_key_req *ev = (void *) skb->data;
4264         struct hci_cp_link_key_reply cp;
4265         struct hci_conn *conn;
4266         struct link_key *key;
4267
4268         BT_DBG("%s", hdev->name);
4269
4270         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4271                 return;
4272
4273         hci_dev_lock(hdev);
4274
4275         key = hci_find_link_key(hdev, &ev->bdaddr);
4276         if (!key) {
4277                 BT_DBG("%s link key not found for %pMR", hdev->name,
4278                        &ev->bdaddr);
4279                 goto not_found;
4280         }
4281
4282         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4283                &ev->bdaddr);
4284
4285         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4286         if (conn) {
4287                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4288
4289                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4290                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4291                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4292                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4293                         goto not_found;
4294                 }
4295
4296                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4297                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4298                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4299                         BT_DBG("%s ignoring key unauthenticated for high security",
4300                                hdev->name);
4301                         goto not_found;
4302                 }
4303
4304                 conn_set_key(conn, key->type, key->pin_len);
4305         }
4306
4307         bacpy(&cp.bdaddr, &ev->bdaddr);
4308         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4309
4310         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4311
4312         hci_dev_unlock(hdev);
4313
4314         return;
4315
4316 not_found:
4317         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4318         hci_dev_unlock(hdev);
4319 }
4320
4321 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4322 {
4323         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4324         struct hci_conn *conn;
4325         struct link_key *key;
4326         bool persistent;
4327         u8 pin_len = 0;
4328
4329         BT_DBG("%s", hdev->name);
4330
4331         hci_dev_lock(hdev);
4332
4333         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4334         if (!conn)
4335                 goto unlock;
4336
4337         hci_conn_hold(conn);
4338         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4339         hci_conn_drop(conn);
4340
4341         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4342         conn_set_key(conn, ev->key_type, conn->pin_length);
4343
4344         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4345                 goto unlock;
4346
4347         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4348                                 ev->key_type, pin_len, &persistent);
4349         if (!key)
4350                 goto unlock;
4351
4352         /* Update connection information since adding the key will have
4353          * fixed up the type in the case of changed combination keys.
4354          */
4355         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4356                 conn_set_key(conn, key->type, key->pin_len);
4357
4358         mgmt_new_link_key(hdev, key, persistent);
4359
4360         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4361          * is set. If it's not set simply remove the key from the kernel
4362          * list (we've still notified user space about it but with
4363          * store_hint being 0).
4364          */
4365         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4366             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4367                 list_del_rcu(&key->list);
4368                 kfree_rcu(key, rcu);
4369                 goto unlock;
4370         }
4371
4372         if (persistent)
4373                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4374         else
4375                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4376
4377 unlock:
4378         hci_dev_unlock(hdev);
4379 }
4380
4381 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4382 {
4383         struct hci_ev_clock_offset *ev = (void *) skb->data;
4384         struct hci_conn *conn;
4385
4386         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4387
4388         hci_dev_lock(hdev);
4389
4390         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4391         if (conn && !ev->status) {
4392                 struct inquiry_entry *ie;
4393
4394                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4395                 if (ie) {
4396                         ie->data.clock_offset = ev->clock_offset;
4397                         ie->timestamp = jiffies;
4398                 }
4399         }
4400
4401         hci_dev_unlock(hdev);
4402 }
4403
4404 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4405 {
4406         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4407         struct hci_conn *conn;
4408
4409         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4410
4411         hci_dev_lock(hdev);
4412
4413         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4414         if (conn && !ev->status)
4415                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4416
4417         hci_dev_unlock(hdev);
4418 }
4419
4420 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4421 {
4422         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4423         struct inquiry_entry *ie;
4424
4425         BT_DBG("%s", hdev->name);
4426
4427         hci_dev_lock(hdev);
4428
4429         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4430         if (ie) {
4431                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4432                 ie->timestamp = jiffies;
4433         }
4434
4435         hci_dev_unlock(hdev);
4436 }
4437
4438 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4439                                              struct sk_buff *skb)
4440 {
4441         struct inquiry_data data;
4442         int num_rsp = *((__u8 *) skb->data);
4443
4444         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4445
4446         if (!num_rsp)
4447                 return;
4448
4449         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4450                 return;
4451
4452         hci_dev_lock(hdev);
4453
4454         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4455                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4456                 info = (void *) (skb->data + 1);
4457
4458                 if (skb->len < num_rsp * sizeof(*info) + 1)
4459                         goto unlock;
4460
4461                 for (; num_rsp; num_rsp--, info++) {
4462                         u32 flags;
4463
4464                         bacpy(&data.bdaddr, &info->bdaddr);
4465                         data.pscan_rep_mode     = info->pscan_rep_mode;
4466                         data.pscan_period_mode  = info->pscan_period_mode;
4467                         data.pscan_mode         = info->pscan_mode;
4468                         memcpy(data.dev_class, info->dev_class, 3);
4469                         data.clock_offset       = info->clock_offset;
4470                         data.rssi               = info->rssi;
4471                         data.ssp_mode           = 0x00;
4472
4473                         flags = hci_inquiry_cache_update(hdev, &data, false);
4474
4475                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4476                                           info->dev_class, info->rssi,
4477                                           flags, NULL, 0, NULL, 0);
4478                 }
4479         } else {
4480                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4481
4482                 if (skb->len < num_rsp * sizeof(*info) + 1)
4483                         goto unlock;
4484
4485                 for (; num_rsp; num_rsp--, info++) {
4486                         u32 flags;
4487
4488                         bacpy(&data.bdaddr, &info->bdaddr);
4489                         data.pscan_rep_mode     = info->pscan_rep_mode;
4490                         data.pscan_period_mode  = info->pscan_period_mode;
4491                         data.pscan_mode         = 0x00;
4492                         memcpy(data.dev_class, info->dev_class, 3);
4493                         data.clock_offset       = info->clock_offset;
4494                         data.rssi               = info->rssi;
4495                         data.ssp_mode           = 0x00;
4496
4497                         flags = hci_inquiry_cache_update(hdev, &data, false);
4498
4499                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4500                                           info->dev_class, info->rssi,
4501                                           flags, NULL, 0, NULL, 0);
4502                 }
4503         }
4504
4505 unlock:
4506         hci_dev_unlock(hdev);
4507 }
4508
4509 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4510                                         struct sk_buff *skb)
4511 {
4512         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4513         struct hci_conn *conn;
4514
4515         BT_DBG("%s", hdev->name);
4516
4517         hci_dev_lock(hdev);
4518
4519         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4520         if (!conn)
4521                 goto unlock;
4522
4523         if (ev->page < HCI_MAX_PAGES)
4524                 memcpy(conn->features[ev->page], ev->features, 8);
4525
4526         if (!ev->status && ev->page == 0x01) {
4527                 struct inquiry_entry *ie;
4528
4529                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4530                 if (ie)
4531                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4532
4533                 if (ev->features[0] & LMP_HOST_SSP) {
4534                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4535                 } else {
4536                         /* It is mandatory by the Bluetooth specification that
4537                          * Extended Inquiry Results are only used when Secure
4538                          * Simple Pairing is enabled, but some devices violate
4539                          * this.
4540                          *
4541                          * To make these devices work, the internal SSP
4542                          * enabled flag needs to be cleared if the remote host
4543                          * features do not indicate SSP support */
4544                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4545                 }
4546
4547                 if (ev->features[0] & LMP_HOST_SC)
4548                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4549         }
4550
4551         if (conn->state != BT_CONFIG)
4552                 goto unlock;
4553
4554         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4555                 struct hci_cp_remote_name_req cp;
4556                 memset(&cp, 0, sizeof(cp));
4557                 bacpy(&cp.bdaddr, &conn->dst);
4558                 cp.pscan_rep_mode = 0x02;
4559                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4560         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4561                 mgmt_device_connected(hdev, conn, NULL, 0);
4562
4563         if (!hci_outgoing_auth_needed(hdev, conn)) {
4564                 conn->state = BT_CONNECTED;
4565                 hci_connect_cfm(conn, ev->status);
4566                 hci_conn_drop(conn);
4567         }
4568
4569 unlock:
4570         hci_dev_unlock(hdev);
4571 }
4572
4573 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4574                                        struct sk_buff *skb)
4575 {
4576         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4577         struct hci_conn *conn;
4578
4579         switch (ev->link_type) {
4580         case SCO_LINK:
4581         case ESCO_LINK:
4582                 break;
4583         default:
4584                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4585                  * for HCI_Synchronous_Connection_Complete is limited to
4586                  * either SCO or eSCO
4587                  */
4588                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4589                 return;
4590         }
4591
4592         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4593
4594         hci_dev_lock(hdev);
4595
4596         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4597         if (!conn) {
4598                 if (ev->link_type == ESCO_LINK)
4599                         goto unlock;
4600
4601                 /* When the link type in the event indicates SCO connection
4602                  * and lookup of the connection object fails, then check
4603                  * if an eSCO connection object exists.
4604                  *
4605                  * The core limits the synchronous connections to either
4606                  * SCO or eSCO. The eSCO connection is preferred and tried
4607                  * to be setup first and until successfully established,
4608                  * the link type will be hinted as eSCO.
4609                  */
4610                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4611                 if (!conn)
4612                         goto unlock;
4613         }
4614
4615         switch (ev->status) {
4616         case 0x00:
4617                 /* The synchronous connection complete event should only be
4618                  * sent once per new connection. Receiving a successful
4619                  * complete event when the connection status is already
4620                  * BT_CONNECTED means that the device is misbehaving and sent
4621                  * multiple complete event packets for the same new connection.
4622                  *
4623                  * Registering the device more than once can corrupt kernel
4624                  * memory, hence upon detecting this invalid event, we report
4625                  * an error and ignore the packet.
4626                  */
4627                 if (conn->state == BT_CONNECTED) {
4628                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4629                         goto unlock;
4630                 }
4631
4632                 conn->handle = __le16_to_cpu(ev->handle);
4633                 conn->state  = BT_CONNECTED;
4634                 conn->type   = ev->link_type;
4635
4636                 hci_debugfs_create_conn(conn);
4637                 hci_conn_add_sysfs(conn);
4638                 break;
4639
4640         case 0x10:      /* Connection Accept Timeout */
4641         case 0x0d:      /* Connection Rejected due to Limited Resources */
4642         case 0x11:      /* Unsupported Feature or Parameter Value */
4643         case 0x1c:      /* SCO interval rejected */
4644         case 0x1a:      /* Unsupported Remote Feature */
4645         case 0x1e:      /* Invalid LMP Parameters */
4646         case 0x1f:      /* Unspecified error */
4647         case 0x20:      /* Unsupported LMP Parameter value */
4648                 if (conn->out) {
4649                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4650                                         (hdev->esco_type & EDR_ESCO_MASK);
4651                         if (hci_setup_sync(conn, conn->link->handle))
4652                                 goto unlock;
4653                 }
4654                 fallthrough;
4655
4656         default:
4657                 conn->state = BT_CLOSED;
4658                 break;
4659         }
4660
4661         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4662
4663         switch (ev->air_mode) {
4664         case 0x02:
4665                 if (hdev->notify)
4666                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4667                 break;
4668         case 0x03:
4669                 if (hdev->notify)
4670                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4671                 break;
4672         }
4673
4674         hci_connect_cfm(conn, ev->status);
4675         if (ev->status)
4676                 hci_conn_del(conn);
4677
4678 unlock:
4679         hci_dev_unlock(hdev);
4680 }
4681
4682 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4683 {
4684         size_t parsed = 0;
4685
4686         while (parsed < eir_len) {
4687                 u8 field_len = eir[0];
4688
4689                 if (field_len == 0)
4690                         return parsed;
4691
4692                 parsed += field_len + 1;
4693                 eir += field_len + 1;
4694         }
4695
4696         return eir_len;
4697 }
4698
4699 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4700                                             struct sk_buff *skb)
4701 {
4702         struct inquiry_data data;
4703         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4704         int num_rsp = *((__u8 *) skb->data);
4705         size_t eir_len;
4706
4707         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4708
4709         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4710                 return;
4711
4712         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4713                 return;
4714
4715         hci_dev_lock(hdev);
4716
4717         for (; num_rsp; num_rsp--, info++) {
4718                 u32 flags;
4719                 bool name_known;
4720
4721                 bacpy(&data.bdaddr, &info->bdaddr);
4722                 data.pscan_rep_mode     = info->pscan_rep_mode;
4723                 data.pscan_period_mode  = info->pscan_period_mode;
4724                 data.pscan_mode         = 0x00;
4725                 memcpy(data.dev_class, info->dev_class, 3);
4726                 data.clock_offset       = info->clock_offset;
4727                 data.rssi               = info->rssi;
4728                 data.ssp_mode           = 0x01;
4729
4730                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4731                         name_known = eir_get_data(info->data,
4732                                                   sizeof(info->data),
4733                                                   EIR_NAME_COMPLETE, NULL);
4734                 else
4735                         name_known = true;
4736
4737                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4738
4739                 eir_len = eir_get_length(info->data, sizeof(info->data));
4740
4741                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4742                                   info->dev_class, info->rssi,
4743                                   flags, info->data, eir_len, NULL, 0);
4744         }
4745
4746         hci_dev_unlock(hdev);
4747 }
4748
4749 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4750                                          struct sk_buff *skb)
4751 {
4752         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4753         struct hci_conn *conn;
4754
4755         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4756                __le16_to_cpu(ev->handle));
4757
4758         hci_dev_lock(hdev);
4759
4760         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4761         if (!conn)
4762                 goto unlock;
4763
4764         /* For BR/EDR the necessary steps are taken through the
4765          * auth_complete event.
4766          */
4767         if (conn->type != LE_LINK)
4768                 goto unlock;
4769
4770         if (!ev->status)
4771                 conn->sec_level = conn->pending_sec_level;
4772
4773         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4774
4775         if (ev->status && conn->state == BT_CONNECTED) {
4776                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4777                 hci_conn_drop(conn);
4778                 goto unlock;
4779         }
4780
4781         if (conn->state == BT_CONFIG) {
4782                 if (!ev->status)
4783                         conn->state = BT_CONNECTED;
4784
4785                 hci_connect_cfm(conn, ev->status);
4786                 hci_conn_drop(conn);
4787         } else {
4788                 hci_auth_cfm(conn, ev->status);
4789
4790                 hci_conn_hold(conn);
4791                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4792                 hci_conn_drop(conn);
4793         }
4794
4795 unlock:
4796         hci_dev_unlock(hdev);
4797 }
4798
4799 static u8 hci_get_auth_req(struct hci_conn *conn)
4800 {
4801 #ifdef TIZEN_BT
4802         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4803                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4804                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4805                         return HCI_AT_GENERAL_BONDING_MITM;
4806         }
4807 #endif
4808
4809         /* If remote requests no-bonding follow that lead */
4810         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4811             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4812                 return conn->remote_auth | (conn->auth_type & 0x01);
4813
4814         /* If both remote and local have enough IO capabilities, require
4815          * MITM protection
4816          */
4817         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4818             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4819                 return conn->remote_auth | 0x01;
4820
4821         /* No MITM protection possible so ignore remote requirement */
4822         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4823 }
4824
4825 static u8 bredr_oob_data_present(struct hci_conn *conn)
4826 {
4827         struct hci_dev *hdev = conn->hdev;
4828         struct oob_data *data;
4829
4830         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4831         if (!data)
4832                 return 0x00;
4833
4834         if (bredr_sc_enabled(hdev)) {
4835                 /* When Secure Connections is enabled, then just
4836                  * return the present value stored with the OOB
4837                  * data. The stored value contains the right present
4838                  * information. However it can only be trusted when
4839                  * not in Secure Connection Only mode.
4840                  */
4841                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4842                         return data->present;
4843
4844                 /* When Secure Connections Only mode is enabled, then
4845                  * the P-256 values are required. If they are not
4846                  * available, then do not declare that OOB data is
4847                  * present.
4848                  */
4849                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4850                     !memcmp(data->hash256, ZERO_KEY, 16))
4851                         return 0x00;
4852
4853                 return 0x02;
4854         }
4855
4856         /* When Secure Connections is not enabled or actually
4857          * not supported by the hardware, then check that if
4858          * P-192 data values are present.
4859          */
4860         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4861             !memcmp(data->hash192, ZERO_KEY, 16))
4862                 return 0x00;
4863
4864         return 0x01;
4865 }
4866
4867 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4868 {
4869         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4870         struct hci_conn *conn;
4871
4872         BT_DBG("%s", hdev->name);
4873
4874         hci_dev_lock(hdev);
4875
4876         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4877         if (!conn)
4878                 goto unlock;
4879
4880         hci_conn_hold(conn);
4881
4882         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4883                 goto unlock;
4884
4885         /* Allow pairing if we're pairable, the initiators of the
4886          * pairing or if the remote is not requesting bonding.
4887          */
4888         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4889             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4890             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4891                 struct hci_cp_io_capability_reply cp;
4892
4893                 bacpy(&cp.bdaddr, &ev->bdaddr);
4894                 /* Change the IO capability from KeyboardDisplay
4895                  * to DisplayYesNo as it is not supported by BT spec. */
4896                 cp.capability = (conn->io_capability == 0x04) ?
4897                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4898
4899                 /* If we are initiators, there is no remote information yet */
4900                 if (conn->remote_auth == 0xff) {
4901                         /* Request MITM protection if our IO caps allow it
4902                          * except for the no-bonding case.
4903                          */
4904                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4905                             conn->auth_type != HCI_AT_NO_BONDING)
4906                                 conn->auth_type |= 0x01;
4907                 } else {
4908                         conn->auth_type = hci_get_auth_req(conn);
4909                 }
4910
4911                 /* If we're not bondable, force one of the non-bondable
4912                  * authentication requirement values.
4913                  */
4914                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4915                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4916
4917                 cp.authentication = conn->auth_type;
4918                 cp.oob_data = bredr_oob_data_present(conn);
4919
4920                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4921                              sizeof(cp), &cp);
4922         } else {
4923                 struct hci_cp_io_capability_neg_reply cp;
4924
4925                 bacpy(&cp.bdaddr, &ev->bdaddr);
4926                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4927
4928                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4929                              sizeof(cp), &cp);
4930         }
4931
4932 unlock:
4933         hci_dev_unlock(hdev);
4934 }
4935
4936 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4937 {
4938         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4939         struct hci_conn *conn;
4940
4941         BT_DBG("%s", hdev->name);
4942
4943         hci_dev_lock(hdev);
4944
4945         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4946         if (!conn)
4947                 goto unlock;
4948
4949         conn->remote_cap = ev->capability;
4950         conn->remote_auth = ev->authentication;
4951
4952 unlock:
4953         hci_dev_unlock(hdev);
4954 }
4955
4956 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4957                                          struct sk_buff *skb)
4958 {
4959         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4960         int loc_mitm, rem_mitm, confirm_hint = 0;
4961         struct hci_conn *conn;
4962
4963         BT_DBG("%s", hdev->name);
4964
4965         hci_dev_lock(hdev);
4966
4967         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4968                 goto unlock;
4969
4970         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4971         if (!conn)
4972                 goto unlock;
4973
4974         loc_mitm = (conn->auth_type & 0x01);
4975         rem_mitm = (conn->remote_auth & 0x01);
4976
4977         /* If we require MITM but the remote device can't provide that
4978          * (it has NoInputNoOutput) then reject the confirmation
4979          * request. We check the security level here since it doesn't
4980          * necessarily match conn->auth_type.
4981          */
4982         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4983             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4984                 BT_DBG("Rejecting request: remote device can't provide MITM");
4985                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4986                              sizeof(ev->bdaddr), &ev->bdaddr);
4987                 goto unlock;
4988         }
4989
4990         /* If no side requires MITM protection; auto-accept */
4991         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4992             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4993
4994                 /* If we're not the initiators request authorization to
4995                  * proceed from user space (mgmt_user_confirm with
4996                  * confirm_hint set to 1). The exception is if neither
4997                  * side had MITM or if the local IO capability is
4998                  * NoInputNoOutput, in which case we do auto-accept
4999                  */
5000                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5001                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5002                     (loc_mitm || rem_mitm)) {
5003                         BT_DBG("Confirming auto-accept as acceptor");
5004                         confirm_hint = 1;
5005                         goto confirm;
5006                 }
5007
5008                 /* If there already exists link key in local host, leave the
5009                  * decision to user space since the remote device could be
5010                  * legitimate or malicious.
5011                  */
5012                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
5013                         bt_dev_dbg(hdev, "Local host already has link key");
5014                         confirm_hint = 1;
5015                         goto confirm;
5016                 }
5017
5018                 BT_DBG("Auto-accept of user confirmation with %ums delay",
5019                        hdev->auto_accept_delay);
5020
5021                 if (hdev->auto_accept_delay > 0) {
5022                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5023                         queue_delayed_work(conn->hdev->workqueue,
5024                                            &conn->auto_accept_work, delay);
5025                         goto unlock;
5026                 }
5027
5028                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5029                              sizeof(ev->bdaddr), &ev->bdaddr);
5030                 goto unlock;
5031         }
5032
5033 confirm:
5034         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5035                                   le32_to_cpu(ev->passkey), confirm_hint);
5036
5037 unlock:
5038         hci_dev_unlock(hdev);
5039 }
5040
5041 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
5042                                          struct sk_buff *skb)
5043 {
5044         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
5045
5046         BT_DBG("%s", hdev->name);
5047
5048         if (hci_dev_test_flag(hdev, HCI_MGMT))
5049                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5050 }
5051
5052 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
5053                                         struct sk_buff *skb)
5054 {
5055         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
5056         struct hci_conn *conn;
5057
5058         BT_DBG("%s", hdev->name);
5059
5060         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5061         if (!conn)
5062                 return;
5063
5064         conn->passkey_notify = __le32_to_cpu(ev->passkey);
5065         conn->passkey_entered = 0;
5066
5067         if (hci_dev_test_flag(hdev, HCI_MGMT))
5068                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5069                                          conn->dst_type, conn->passkey_notify,
5070                                          conn->passkey_entered);
5071 }
5072
5073 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
5074 {
5075         struct hci_ev_keypress_notify *ev = (void *) skb->data;
5076         struct hci_conn *conn;
5077
5078         BT_DBG("%s", hdev->name);
5079
5080         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5081         if (!conn)
5082                 return;
5083
5084         switch (ev->type) {
5085         case HCI_KEYPRESS_STARTED:
5086                 conn->passkey_entered = 0;
5087                 return;
5088
5089         case HCI_KEYPRESS_ENTERED:
5090                 conn->passkey_entered++;
5091                 break;
5092
5093         case HCI_KEYPRESS_ERASED:
5094                 conn->passkey_entered--;
5095                 break;
5096
5097         case HCI_KEYPRESS_CLEARED:
5098                 conn->passkey_entered = 0;
5099                 break;
5100
5101         case HCI_KEYPRESS_COMPLETED:
5102                 return;
5103         }
5104
5105         if (hci_dev_test_flag(hdev, HCI_MGMT))
5106                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5107                                          conn->dst_type, conn->passkey_notify,
5108                                          conn->passkey_entered);
5109 }
5110
5111 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
5112                                          struct sk_buff *skb)
5113 {
5114         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
5115         struct hci_conn *conn;
5116
5117         BT_DBG("%s", hdev->name);
5118
5119         hci_dev_lock(hdev);
5120
5121         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5122         if (!conn)
5123                 goto unlock;
5124
5125         /* Reset the authentication requirement to unknown */
5126         conn->remote_auth = 0xff;
5127
5128         /* To avoid duplicate auth_failed events to user space we check
5129          * the HCI_CONN_AUTH_PEND flag which will be set if we
5130          * initiated the authentication. A traditional auth_complete
5131          * event gets always produced as initiator and is also mapped to
5132          * the mgmt_auth_failed event */
5133         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5134                 mgmt_auth_failed(conn, ev->status);
5135
5136         hci_conn_drop(conn);
5137
5138 unlock:
5139         hci_dev_unlock(hdev);
5140 }
5141
5142 static void hci_remote_host_features_evt(struct hci_dev *hdev,
5143                                          struct sk_buff *skb)
5144 {
5145         struct hci_ev_remote_host_features *ev = (void *) skb->data;
5146         struct inquiry_entry *ie;
5147         struct hci_conn *conn;
5148
5149         BT_DBG("%s", hdev->name);
5150
5151         hci_dev_lock(hdev);
5152
5153         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5154         if (conn)
5155                 memcpy(conn->features[1], ev->features, 8);
5156
5157         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5158         if (ie)
5159                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5160
5161         hci_dev_unlock(hdev);
5162 }
5163
5164 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
5165                                             struct sk_buff *skb)
5166 {
5167         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
5168         struct oob_data *data;
5169
5170         BT_DBG("%s", hdev->name);
5171
5172         hci_dev_lock(hdev);
5173
5174         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5175                 goto unlock;
5176
5177         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5178         if (!data) {
5179                 struct hci_cp_remote_oob_data_neg_reply cp;
5180
5181                 bacpy(&cp.bdaddr, &ev->bdaddr);
5182                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5183                              sizeof(cp), &cp);
5184                 goto unlock;
5185         }
5186
5187         if (bredr_sc_enabled(hdev)) {
5188                 struct hci_cp_remote_oob_ext_data_reply cp;
5189
5190                 bacpy(&cp.bdaddr, &ev->bdaddr);
5191                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5192                         memset(cp.hash192, 0, sizeof(cp.hash192));
5193                         memset(cp.rand192, 0, sizeof(cp.rand192));
5194                 } else {
5195                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5196                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5197                 }
5198                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5199                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5200
5201                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5202                              sizeof(cp), &cp);
5203         } else {
5204                 struct hci_cp_remote_oob_data_reply cp;
5205
5206                 bacpy(&cp.bdaddr, &ev->bdaddr);
5207                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5208                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5209
5210                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5211                              sizeof(cp), &cp);
5212         }
5213
5214 unlock:
5215         hci_dev_unlock(hdev);
5216 }
5217
5218 #if IS_ENABLED(CONFIG_BT_HS)
5219 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5220 {
5221         struct hci_ev_channel_selected *ev = (void *)skb->data;
5222         struct hci_conn *hcon;
5223
5224         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5225
5226         skb_pull(skb, sizeof(*ev));
5227
5228         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5229         if (!hcon)
5230                 return;
5231
5232         amp_read_loc_assoc_final_data(hdev, hcon);
5233 }
5234
5235 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
5236                                       struct sk_buff *skb)
5237 {
5238         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
5239         struct hci_conn *hcon, *bredr_hcon;
5240
5241         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
5242                ev->status);
5243
5244         hci_dev_lock(hdev);
5245
5246         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5247         if (!hcon)
5248                 goto unlock;
5249
5250         if (!hcon->amp_mgr)
5251                 goto unlock;
5252
5253         if (ev->status) {
5254                 hci_conn_del(hcon);
5255                 goto unlock;
5256         }
5257
5258         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5259
5260         hcon->state = BT_CONNECTED;
5261         bacpy(&hcon->dst, &bredr_hcon->dst);
5262
5263         hci_conn_hold(hcon);
5264         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5265         hci_conn_drop(hcon);
5266
5267         hci_debugfs_create_conn(hcon);
5268         hci_conn_add_sysfs(hcon);
5269
5270         amp_physical_cfm(bredr_hcon, hcon);
5271
5272 unlock:
5273         hci_dev_unlock(hdev);
5274 }
5275
5276 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5277 {
5278         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
5279         struct hci_conn *hcon;
5280         struct hci_chan *hchan;
5281         struct amp_mgr *mgr;
5282
5283         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5284                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
5285                ev->status);
5286
5287         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5288         if (!hcon)
5289                 return;
5290
5291         /* Create AMP hchan */
5292         hchan = hci_chan_create(hcon);
5293         if (!hchan)
5294                 return;
5295
5296         hchan->handle = le16_to_cpu(ev->handle);
5297         hchan->amp = true;
5298
5299         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5300
5301         mgr = hcon->amp_mgr;
5302         if (mgr && mgr->bredr_chan) {
5303                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5304
5305                 l2cap_chan_lock(bredr_chan);
5306
5307                 bredr_chan->conn->mtu = hdev->block_mtu;
5308                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5309                 hci_conn_hold(hcon);
5310
5311                 l2cap_chan_unlock(bredr_chan);
5312         }
5313 }
5314
5315 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5316                                              struct sk_buff *skb)
5317 {
5318         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5319         struct hci_chan *hchan;
5320
5321         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5322                le16_to_cpu(ev->handle), ev->status);
5323
5324         if (ev->status)
5325                 return;
5326
5327         hci_dev_lock(hdev);
5328
5329         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5330         if (!hchan || !hchan->amp)
5331                 goto unlock;
5332
5333         amp_destroy_logical_link(hchan, ev->reason);
5334
5335 unlock:
5336         hci_dev_unlock(hdev);
5337 }
5338
5339 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5340                                              struct sk_buff *skb)
5341 {
5342         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5343         struct hci_conn *hcon;
5344
5345         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5346
5347         if (ev->status)
5348                 return;
5349
5350         hci_dev_lock(hdev);
5351
5352         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5353         if (hcon && hcon->type == AMP_LINK) {
5354                 hcon->state = BT_CLOSED;
5355                 hci_disconn_cfm(hcon, ev->reason);
5356                 hci_conn_del(hcon);
5357         }
5358
5359         hci_dev_unlock(hdev);
5360 }
5361 #endif
5362
5363 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5364                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5365 {
5366         if (conn->out) {
5367                 conn->dst_type = bdaddr_type;
5368                 conn->resp_addr_type = bdaddr_type;
5369                 bacpy(&conn->resp_addr, bdaddr);
5370
5371                 /* Check if the controller has set a Local RPA then it must be
5372                  * used instead or hdev->rpa.
5373                  */
5374                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5375                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5376                         bacpy(&conn->init_addr, local_rpa);
5377                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5378                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5379                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5380                 } else {
5381                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5382                                                   &conn->init_addr_type);
5383                 }
5384         } else {
5385                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5386                 /* Check if the controller has set a Local RPA then it must be
5387                  * used instead or hdev->rpa.
5388                  */
5389                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5390                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5391                         bacpy(&conn->resp_addr, local_rpa);
5392                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5393                         /* In case of ext adv, resp_addr will be updated in
5394                          * Adv Terminated event.
5395                          */
5396                         if (!ext_adv_capable(conn->hdev))
5397                                 bacpy(&conn->resp_addr,
5398                                       &conn->hdev->random_addr);
5399                 } else {
5400                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5401                 }
5402
5403                 conn->init_addr_type = bdaddr_type;
5404                 bacpy(&conn->init_addr, bdaddr);
5405
5406                 /* For incoming connections, set the default minimum
5407                  * and maximum connection interval. They will be used
5408                  * to check if the parameters are in range and if not
5409                  * trigger the connection update procedure.
5410                  */
5411                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5412                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5413         }
5414 }
5415
5416 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5417                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5418                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5419                                  u16 interval, u16 latency,
5420                                  u16 supervision_timeout)
5421 {
5422         struct hci_conn_params *params;
5423         struct hci_conn *conn;
5424         struct smp_irk *irk;
5425         u8 addr_type;
5426
5427         hci_dev_lock(hdev);
5428
5429         /* All controllers implicitly stop advertising in the event of a
5430          * connection, so ensure that the state bit is cleared.
5431          */
5432         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5433
5434         conn = hci_lookup_le_connect(hdev);
5435         if (!conn) {
5436                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5437                 if (!conn) {
5438                         bt_dev_err(hdev, "no memory for new connection");
5439                         goto unlock;
5440                 }
5441
5442                 conn->dst_type = bdaddr_type;
5443
5444                 /* If we didn't have a hci_conn object previously
5445                  * but we're in central role this must be something
5446                  * initiated using an accept list. Since accept list based
5447                  * connections are not "first class citizens" we don't
5448                  * have full tracking of them. Therefore, we go ahead
5449                  * with a "best effort" approach of determining the
5450                  * initiator address based on the HCI_PRIVACY flag.
5451                  */
5452                 if (conn->out) {
5453                         conn->resp_addr_type = bdaddr_type;
5454                         bacpy(&conn->resp_addr, bdaddr);
5455                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5456                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5457                                 bacpy(&conn->init_addr, &hdev->rpa);
5458                         } else {
5459                                 hci_copy_identity_address(hdev,
5460                                                           &conn->init_addr,
5461                                                           &conn->init_addr_type);
5462                         }
5463                 }
5464         } else {
5465 #ifdef TIZEN_BT
5466                 /* LE auto connect */
5467                 bacpy(&conn->dst, bdaddr);
5468 #endif
5469                 cancel_delayed_work(&conn->le_conn_timeout);
5470         }
5471
5472         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5473
5474         /* Lookup the identity address from the stored connection
5475          * address and address type.
5476          *
5477          * When establishing connections to an identity address, the
5478          * connection procedure will store the resolvable random
5479          * address first. Now if it can be converted back into the
5480          * identity address, start using the identity address from
5481          * now on.
5482          */
5483         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5484         if (irk) {
5485                 bacpy(&conn->dst, &irk->bdaddr);
5486                 conn->dst_type = irk->addr_type;
5487         }
5488
5489         /* When using controller based address resolution, then the new
5490          * address types 0x02 and 0x03 are used. These types need to be
5491          * converted back into either public address or random address type
5492          */
5493         if (use_ll_privacy(hdev) &&
5494             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5495             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
5496                 switch (conn->dst_type) {
5497                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
5498                         conn->dst_type = ADDR_LE_DEV_PUBLIC;
5499                         break;
5500                 case ADDR_LE_DEV_RANDOM_RESOLVED:
5501                         conn->dst_type = ADDR_LE_DEV_RANDOM;
5502                         break;
5503                 }
5504         }
5505
5506         if (status) {
5507                 hci_le_conn_failed(conn, status);
5508                 goto unlock;
5509         }
5510
5511         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5512                 addr_type = BDADDR_LE_PUBLIC;
5513         else
5514                 addr_type = BDADDR_LE_RANDOM;
5515
5516         /* Drop the connection if the device is blocked */
5517         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5518                 hci_conn_drop(conn);
5519                 goto unlock;
5520         }
5521
5522         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5523                 mgmt_device_connected(hdev, conn, NULL, 0);
5524
5525         conn->sec_level = BT_SECURITY_LOW;
5526         conn->handle = handle;
5527         conn->state = BT_CONFIG;
5528
5529         /* Store current advertising instance as connection advertising instance
5530          * when sotfware rotation is in use so it can be re-enabled when
5531          * disconnected.
5532          */
5533         if (!ext_adv_capable(hdev))
5534                 conn->adv_instance = hdev->cur_adv_instance;
5535
5536         conn->le_conn_interval = interval;
5537         conn->le_conn_latency = latency;
5538         conn->le_supv_timeout = supervision_timeout;
5539
5540         hci_debugfs_create_conn(conn);
5541         hci_conn_add_sysfs(conn);
5542
5543         /* The remote features procedure is defined for central
5544          * role only. So only in case of an initiated connection
5545          * request the remote features.
5546          *
5547          * If the local controller supports peripheral-initiated features
5548          * exchange, then requesting the remote features in peripheral
5549          * role is possible. Otherwise just transition into the
5550          * connected state without requesting the remote features.
5551          */
5552         if (conn->out ||
5553             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5554                 struct hci_cp_le_read_remote_features cp;
5555
5556                 cp.handle = __cpu_to_le16(conn->handle);
5557
5558                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5559                              sizeof(cp), &cp);
5560
5561                 hci_conn_hold(conn);
5562         } else {
5563                 conn->state = BT_CONNECTED;
5564                 hci_connect_cfm(conn, status);
5565         }
5566
5567         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5568                                            conn->dst_type);
5569         if (params) {
5570                 list_del_init(&params->action);
5571                 if (params->conn) {
5572                         hci_conn_drop(params->conn);
5573                         hci_conn_put(params->conn);
5574                         params->conn = NULL;
5575                 }
5576         }
5577
5578 unlock:
5579         hci_update_background_scan(hdev);
5580         hci_dev_unlock(hdev);
5581 }
5582
5583 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5584 {
5585         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5586
5587         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5588
5589         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5590                              NULL, ev->role, le16_to_cpu(ev->handle),
5591                              le16_to_cpu(ev->interval),
5592                              le16_to_cpu(ev->latency),
5593                              le16_to_cpu(ev->supervision_timeout));
5594 }
5595
5596 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5597                                          struct sk_buff *skb)
5598 {
5599         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5600
5601         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5602
5603         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5604                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5605                              le16_to_cpu(ev->interval),
5606                              le16_to_cpu(ev->latency),
5607                              le16_to_cpu(ev->supervision_timeout));
5608
5609         if (use_ll_privacy(hdev) &&
5610             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5611             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5612                 hci_req_disable_address_resolution(hdev);
5613 }
5614
5615 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5616 {
5617         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5618         struct hci_conn *conn;
5619         struct adv_info *adv;
5620
5621         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5622
5623         adv = hci_find_adv_instance(hdev, ev->handle);
5624
5625         if (ev->status) {
5626                 if (!adv)
5627                         return;
5628
5629                 /* Remove advertising as it has been terminated */
5630                 hci_remove_adv_instance(hdev, ev->handle);
5631                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5632
5633                 return;
5634         }
5635
5636         if (adv)
5637                 adv->enabled = false;
5638
5639         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5640         if (conn) {
5641                 /* Store handle in the connection so the correct advertising
5642                  * instance can be re-enabled when disconnected.
5643                  */
5644                 conn->adv_instance = ev->handle;
5645
5646                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5647                     bacmp(&conn->resp_addr, BDADDR_ANY))
5648                         return;
5649
5650                 if (!ev->handle) {
5651                         bacpy(&conn->resp_addr, &hdev->random_addr);
5652                         return;
5653                 }
5654
5655                 if (adv)
5656                         bacpy(&conn->resp_addr, &adv->random_addr);
5657         }
5658 }
5659
5660 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5661                                             struct sk_buff *skb)
5662 {
5663         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5664         struct hci_conn *conn;
5665
5666         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5667
5668         if (ev->status)
5669                 return;
5670
5671         hci_dev_lock(hdev);
5672
5673         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5674         if (conn) {
5675 #ifdef TIZEN_BT
5676                 if (ev->status) {
5677                         hci_dev_unlock(hdev);
5678                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5679                                 conn->type, conn->dst_type, ev->status);
5680                         return;
5681                 }
5682 #endif
5683                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5684                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5685                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5686         }
5687
5688         hci_dev_unlock(hdev);
5689
5690 #ifdef TIZEN_BT
5691         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5692                                 conn->dst_type, conn->le_conn_interval,
5693                                 conn->le_conn_latency, conn->le_supv_timeout);
5694 #endif
5695 }
5696
5697 /* This function requires the caller holds hdev->lock */
5698 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5699                                               bdaddr_t *addr,
5700                                               u8 addr_type, u8 adv_type,
5701                                               bdaddr_t *direct_rpa)
5702 {
5703         struct hci_conn *conn;
5704         struct hci_conn_params *params;
5705
5706         /* If the event is not connectable don't proceed further */
5707         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5708                 return NULL;
5709
5710         /* Ignore if the device is blocked */
5711         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type))
5712                 return NULL;
5713
5714         /* Most controller will fail if we try to create new connections
5715          * while we have an existing one in peripheral role.
5716          */
5717         if (hdev->conn_hash.le_num_peripheral > 0 &&
5718             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5719              !(hdev->le_states[3] & 0x10)))
5720                 return NULL;
5721
5722         /* If we're not connectable only connect devices that we have in
5723          * our pend_le_conns list.
5724          */
5725         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5726                                            addr_type);
5727         if (!params)
5728                 return NULL;
5729
5730         if (!params->explicit_connect) {
5731                 switch (params->auto_connect) {
5732                 case HCI_AUTO_CONN_DIRECT:
5733                         /* Only devices advertising with ADV_DIRECT_IND are
5734                          * triggering a connection attempt. This is allowing
5735                          * incoming connections from peripheral devices.
5736                          */
5737                         if (adv_type != LE_ADV_DIRECT_IND)
5738                                 return NULL;
5739                         break;
5740                 case HCI_AUTO_CONN_ALWAYS:
5741                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5742                          * are triggering a connection attempt. This means
5743                          * that incoming connections from peripheral device are
5744                          * accepted and also outgoing connections to peripheral
5745                          * devices are established when found.
5746                          */
5747                         break;
5748                 default:
5749                         return NULL;
5750                 }
5751         }
5752
5753         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5754                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5755                               direct_rpa);
5756         if (!IS_ERR(conn)) {
5757                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5758                  * by higher layer that tried to connect, if no then
5759                  * store the pointer since we don't really have any
5760                  * other owner of the object besides the params that
5761                  * triggered it. This way we can abort the connection if
5762                  * the parameters get removed and keep the reference
5763                  * count consistent once the connection is established.
5764                  */
5765
5766                 if (!params->explicit_connect)
5767                         params->conn = hci_conn_get(conn);
5768
5769                 return conn;
5770         }
5771
5772         switch (PTR_ERR(conn)) {
5773         case -EBUSY:
5774                 /* If hci_connect() returns -EBUSY it means there is already
5775                  * an LE connection attempt going on. Since controllers don't
5776                  * support more than one connection attempt at the time, we
5777                  * don't consider this an error case.
5778                  */
5779                 break;
5780         default:
5781                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5782                 return NULL;
5783         }
5784
5785         return NULL;
5786 }
5787
5788 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5789                                u8 bdaddr_type, bdaddr_t *direct_addr,
5790                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5791                                bool ext_adv)
5792 {
5793 #ifndef TIZEN_BT
5794         struct discovery_state *d = &hdev->discovery;
5795 #endif
5796         struct smp_irk *irk;
5797         struct hci_conn *conn;
5798 #ifndef TIZEN_BT
5799         bool match;
5800 #endif
5801         u32 flags;
5802         u8 *ptr;
5803
5804         switch (type) {
5805         case LE_ADV_IND:
5806         case LE_ADV_DIRECT_IND:
5807         case LE_ADV_SCAN_IND:
5808         case LE_ADV_NONCONN_IND:
5809         case LE_ADV_SCAN_RSP:
5810                 break;
5811         default:
5812                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5813                                        "type: 0x%02x", type);
5814                 return;
5815         }
5816
5817         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5818                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5819                 return;
5820         }
5821
5822         /* Find the end of the data in case the report contains padded zero
5823          * bytes at the end causing an invalid length value.
5824          *
5825          * When data is NULL, len is 0 so there is no need for extra ptr
5826          * check as 'ptr < data + 0' is already false in such case.
5827          */
5828         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5829                 if (ptr + 1 + *ptr > data + len)
5830                         break;
5831         }
5832
5833         /* Adjust for actual length. This handles the case when remote
5834          * device is advertising with incorrect data length.
5835          */
5836         len = ptr - data;
5837
5838         /* If the direct address is present, then this report is from
5839          * a LE Direct Advertising Report event. In that case it is
5840          * important to see if the address is matching the local
5841          * controller address.
5842          */
5843         if (direct_addr) {
5844                 /* Only resolvable random addresses are valid for these
5845                  * kind of reports and others can be ignored.
5846                  */
5847                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5848                         return;
5849
5850                 /* If the controller is not using resolvable random
5851                  * addresses, then this report can be ignored.
5852                  */
5853                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5854                         return;
5855
5856                 /* If the local IRK of the controller does not match
5857                  * with the resolvable random address provided, then
5858                  * this report can be ignored.
5859                  */
5860                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5861                         return;
5862         }
5863
5864         /* Check if we need to convert to identity address */
5865         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5866         if (irk) {
5867                 bdaddr = &irk->bdaddr;
5868                 bdaddr_type = irk->addr_type;
5869         }
5870
5871         /* Check if we have been requested to connect to this device.
5872          *
5873          * direct_addr is set only for directed advertising reports (it is NULL
5874          * for advertising reports) and is already verified to be RPA above.
5875          */
5876         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5877                                                                 direct_addr);
5878         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5879                 /* Store report for later inclusion by
5880                  * mgmt_device_connected
5881                  */
5882                 memcpy(conn->le_adv_data, data, len);
5883                 conn->le_adv_data_len = len;
5884         }
5885
5886         /* Passive scanning shouldn't trigger any device found events,
5887          * except for devices marked as CONN_REPORT for which we do send
5888          * device found events, or advertisement monitoring requested.
5889          */
5890         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5891                 if (type == LE_ADV_DIRECT_IND)
5892                         return;
5893
5894 #ifndef TIZEN_BT
5895                 /* Handle all adv packet in platform */
5896                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5897                                                bdaddr, bdaddr_type) &&
5898                     idr_is_empty(&hdev->adv_monitors_idr))
5899                         return;
5900 #endif
5901
5902                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5903                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5904                 else
5905                         flags = 0;
5906 #ifdef TIZEN_BT
5907                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5908                                      rssi, flags, data, len, NULL, 0, type);
5909 #else
5910                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5911                                   rssi, flags, data, len, NULL, 0);
5912 #endif
5913                 return;
5914         }
5915
5916         /* When receiving non-connectable or scannable undirected
5917          * advertising reports, this means that the remote device is
5918          * not connectable and then clearly indicate this in the
5919          * device found event.
5920          *
5921          * When receiving a scan response, then there is no way to
5922          * know if the remote device is connectable or not. However
5923          * since scan responses are merged with a previously seen
5924          * advertising report, the flags field from that report
5925          * will be used.
5926          *
5927          * In the really unlikely case that a controller get confused
5928          * and just sends a scan response event, then it is marked as
5929          * not connectable as well.
5930          */
5931         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5932             type == LE_ADV_SCAN_RSP)
5933                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5934         else
5935                 flags = 0;
5936
5937 #ifdef TIZEN_BT
5938         /* Disable adv ind and scan rsp merging */
5939         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5940                              rssi, flags, data, len, NULL, 0, type);
5941 #else
5942         /* If there's nothing pending either store the data from this
5943          * event or send an immediate device found event if the data
5944          * should not be stored for later.
5945          */
5946         if (!ext_adv && !has_pending_adv_report(hdev)) {
5947                 /* If the report will trigger a SCAN_REQ store it for
5948                  * later merging.
5949                  */
5950                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5951                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5952                                                  rssi, flags, data, len);
5953                         return;
5954                 }
5955
5956                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5957                                   rssi, flags, data, len, NULL, 0);
5958                 return;
5959         }
5960
5961         /* Check if the pending report is for the same device as the new one */
5962         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5963                  bdaddr_type == d->last_adv_addr_type);
5964
5965         /* If the pending data doesn't match this report or this isn't a
5966          * scan response (e.g. we got a duplicate ADV_IND) then force
5967          * sending of the pending data.
5968          */
5969         if (type != LE_ADV_SCAN_RSP || !match) {
5970                 /* Send out whatever is in the cache, but skip duplicates */
5971                 if (!match)
5972                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5973                                           d->last_adv_addr_type, NULL,
5974                                           d->last_adv_rssi, d->last_adv_flags,
5975                                           d->last_adv_data,
5976                                           d->last_adv_data_len, NULL, 0);
5977
5978                 /* If the new report will trigger a SCAN_REQ store it for
5979                  * later merging.
5980                  */
5981                 if (!ext_adv && (type == LE_ADV_IND ||
5982                                  type == LE_ADV_SCAN_IND)) {
5983                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5984                                                  rssi, flags, data, len);
5985                         return;
5986                 }
5987
5988                 /* The advertising reports cannot be merged, so clear
5989                  * the pending report and send out a device found event.
5990                  */
5991                 clear_pending_adv_report(hdev);
5992                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5993                                   rssi, flags, data, len, NULL, 0);
5994                 return;
5995         }
5996
5997         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5998          * the new event is a SCAN_RSP. We can therefore proceed with
5999          * sending a merged device found event.
6000          */
6001         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6002                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6003                           d->last_adv_data, d->last_adv_data_len, data, len);
6004         clear_pending_adv_report(hdev);
6005 #endif
6006 }
6007
6008 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
6009 {
6010         u8 num_reports = skb->data[0];
6011         void *ptr = &skb->data[1];
6012
6013         hci_dev_lock(hdev);
6014
6015         while (num_reports--) {
6016                 struct hci_ev_le_advertising_info *ev = ptr;
6017                 s8 rssi;
6018
6019                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
6020                         bt_dev_err(hdev, "Malicious advertising data.");
6021                         break;
6022                 }
6023
6024                 if (ev->length <= HCI_MAX_AD_LENGTH &&
6025                     ev->data + ev->length <= skb_tail_pointer(skb)) {
6026                         rssi = ev->data[ev->length];
6027                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6028                                            ev->bdaddr_type, NULL, 0, rssi,
6029                                            ev->data, ev->length, false);
6030                 } else {
6031                         bt_dev_err(hdev, "Dropping invalid advertising data");
6032                 }
6033
6034                 ptr += sizeof(*ev) + ev->length + 1;
6035         }
6036
6037         hci_dev_unlock(hdev);
6038 }
6039
6040 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6041 {
6042         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6043                 switch (evt_type) {
6044                 case LE_LEGACY_ADV_IND:
6045                         return LE_ADV_IND;
6046                 case LE_LEGACY_ADV_DIRECT_IND:
6047                         return LE_ADV_DIRECT_IND;
6048                 case LE_LEGACY_ADV_SCAN_IND:
6049                         return LE_ADV_SCAN_IND;
6050                 case LE_LEGACY_NONCONN_IND:
6051                         return LE_ADV_NONCONN_IND;
6052                 case LE_LEGACY_SCAN_RSP_ADV:
6053                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6054                         return LE_ADV_SCAN_RSP;
6055                 }
6056
6057                 goto invalid;
6058         }
6059
6060         if (evt_type & LE_EXT_ADV_CONN_IND) {
6061                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
6062                         return LE_ADV_DIRECT_IND;
6063
6064                 return LE_ADV_IND;
6065         }
6066
6067         if (evt_type & LE_EXT_ADV_SCAN_RSP)
6068                 return LE_ADV_SCAN_RSP;
6069
6070         if (evt_type & LE_EXT_ADV_SCAN_IND)
6071                 return LE_ADV_SCAN_IND;
6072
6073         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6074             evt_type & LE_EXT_ADV_DIRECT_IND)
6075                 return LE_ADV_NONCONN_IND;
6076
6077 invalid:
6078         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6079                                evt_type);
6080
6081         return LE_ADV_INVALID;
6082 }
6083
6084 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
6085 {
6086         u8 num_reports = skb->data[0];
6087         void *ptr = &skb->data[1];
6088
6089         hci_dev_lock(hdev);
6090
6091         while (num_reports--) {
6092                 struct hci_ev_le_ext_adv_report *ev = ptr;
6093                 u8 legacy_evt_type;
6094                 u16 evt_type;
6095
6096                 evt_type = __le16_to_cpu(ev->evt_type);
6097                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6098                 if (legacy_evt_type != LE_ADV_INVALID) {
6099                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
6100                                            ev->bdaddr_type, NULL, 0, ev->rssi,
6101                                            ev->data, ev->length,
6102                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
6103                 }
6104
6105                 ptr += sizeof(*ev) + ev->length;
6106         }
6107
6108         hci_dev_unlock(hdev);
6109 }
6110
6111 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
6112                                             struct sk_buff *skb)
6113 {
6114         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
6115         struct hci_conn *conn;
6116
6117         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6118
6119         hci_dev_lock(hdev);
6120
6121         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6122         if (conn) {
6123                 if (!ev->status)
6124                         memcpy(conn->features[0], ev->features, 8);
6125
6126                 if (conn->state == BT_CONFIG) {
6127                         __u8 status;
6128
6129                         /* If the local controller supports peripheral-initiated
6130                          * features exchange, but the remote controller does
6131                          * not, then it is possible that the error code 0x1a
6132                          * for unsupported remote feature gets returned.
6133                          *
6134                          * In this specific case, allow the connection to
6135                          * transition into connected state and mark it as
6136                          * successful.
6137                          */
6138                         if (!conn->out && ev->status == 0x1a &&
6139                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6140                                 status = 0x00;
6141                         else
6142                                 status = ev->status;
6143
6144                         conn->state = BT_CONNECTED;
6145                         hci_connect_cfm(conn, status);
6146                         hci_conn_drop(conn);
6147                 }
6148         }
6149
6150         hci_dev_unlock(hdev);
6151 }
6152
6153 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
6154 {
6155         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
6156         struct hci_cp_le_ltk_reply cp;
6157         struct hci_cp_le_ltk_neg_reply neg;
6158         struct hci_conn *conn;
6159         struct smp_ltk *ltk;
6160
6161         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
6162
6163         hci_dev_lock(hdev);
6164
6165         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6166         if (conn == NULL)
6167                 goto not_found;
6168
6169         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6170         if (!ltk)
6171                 goto not_found;
6172
6173         if (smp_ltk_is_sc(ltk)) {
6174                 /* With SC both EDiv and Rand are set to zero */
6175                 if (ev->ediv || ev->rand)
6176                         goto not_found;
6177         } else {
6178                 /* For non-SC keys check that EDiv and Rand match */
6179                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6180                         goto not_found;
6181         }
6182
6183         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6184         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6185         cp.handle = cpu_to_le16(conn->handle);
6186
6187         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6188
6189         conn->enc_key_size = ltk->enc_size;
6190
6191         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6192
6193         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6194          * temporary key used to encrypt a connection following
6195          * pairing. It is used during the Encrypted Session Setup to
6196          * distribute the keys. Later, security can be re-established
6197          * using a distributed LTK.
6198          */
6199         if (ltk->type == SMP_STK) {
6200                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6201                 list_del_rcu(&ltk->list);
6202                 kfree_rcu(ltk, rcu);
6203         } else {
6204                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6205         }
6206
6207         hci_dev_unlock(hdev);
6208
6209         return;
6210
6211 not_found:
6212         neg.handle = ev->handle;
6213         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6214         hci_dev_unlock(hdev);
6215 }
6216
6217 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6218                                       u8 reason)
6219 {
6220         struct hci_cp_le_conn_param_req_neg_reply cp;
6221
6222         cp.handle = cpu_to_le16(handle);
6223         cp.reason = reason;
6224
6225         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6226                      &cp);
6227 }
6228
6229 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
6230                                              struct sk_buff *skb)
6231 {
6232         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
6233         struct hci_cp_le_conn_param_req_reply cp;
6234         struct hci_conn *hcon;
6235         u16 handle, min, max, latency, timeout;
6236
6237         handle = le16_to_cpu(ev->handle);
6238         min = le16_to_cpu(ev->interval_min);
6239         max = le16_to_cpu(ev->interval_max);
6240         latency = le16_to_cpu(ev->latency);
6241         timeout = le16_to_cpu(ev->timeout);
6242
6243         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6244         if (!hcon || hcon->state != BT_CONNECTED)
6245                 return send_conn_param_neg_reply(hdev, handle,
6246                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6247
6248         if (hci_check_conn_params(min, max, latency, timeout))
6249                 return send_conn_param_neg_reply(hdev, handle,
6250                                                  HCI_ERROR_INVALID_LL_PARAMS);
6251
6252         if (hcon->role == HCI_ROLE_MASTER) {
6253                 struct hci_conn_params *params;
6254                 u8 store_hint;
6255
6256                 hci_dev_lock(hdev);
6257
6258                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6259                                                 hcon->dst_type);
6260                 if (params) {
6261                         params->conn_min_interval = min;
6262                         params->conn_max_interval = max;
6263                         params->conn_latency = latency;
6264                         params->supervision_timeout = timeout;
6265                         store_hint = 0x01;
6266                 } else {
6267                         store_hint = 0x00;
6268                 }
6269
6270                 hci_dev_unlock(hdev);
6271
6272                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6273                                     store_hint, min, max, latency, timeout);
6274         }
6275
6276         cp.handle = ev->handle;
6277         cp.interval_min = ev->interval_min;
6278         cp.interval_max = ev->interval_max;
6279         cp.latency = ev->latency;
6280         cp.timeout = ev->timeout;
6281         cp.min_ce_len = 0;
6282         cp.max_ce_len = 0;
6283
6284         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6285 }
6286
6287 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
6288                                          struct sk_buff *skb)
6289 {
6290         u8 num_reports = skb->data[0];
6291         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6292
6293         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
6294                 return;
6295
6296         hci_dev_lock(hdev);
6297
6298         for (; num_reports; num_reports--, ev++)
6299                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6300                                    ev->bdaddr_type, &ev->direct_addr,
6301                                    ev->direct_addr_type, ev->rssi, NULL, 0,
6302                                    false);
6303
6304         hci_dev_unlock(hdev);
6305 }
6306
6307 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
6308 {
6309         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
6310         struct hci_conn *conn;
6311
6312         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6313
6314         if (ev->status)
6315                 return;
6316
6317         hci_dev_lock(hdev);
6318
6319         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6320         if (!conn)
6321                 goto unlock;
6322
6323         conn->le_tx_phy = ev->tx_phy;
6324         conn->le_rx_phy = ev->rx_phy;
6325
6326 unlock:
6327         hci_dev_unlock(hdev);
6328 }
6329
6330 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
6331 {
6332         struct hci_ev_le_meta *le_ev = (void *) skb->data;
6333
6334         skb_pull(skb, sizeof(*le_ev));
6335
6336         switch (le_ev->subevent) {
6337         case HCI_EV_LE_CONN_COMPLETE:
6338                 hci_le_conn_complete_evt(hdev, skb);
6339                 break;
6340
6341         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
6342                 hci_le_conn_update_complete_evt(hdev, skb);
6343                 break;
6344
6345         case HCI_EV_LE_ADVERTISING_REPORT:
6346                 hci_le_adv_report_evt(hdev, skb);
6347                 break;
6348
6349         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
6350                 hci_le_remote_feat_complete_evt(hdev, skb);
6351                 break;
6352
6353         case HCI_EV_LE_LTK_REQ:
6354                 hci_le_ltk_request_evt(hdev, skb);
6355                 break;
6356
6357         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
6358                 hci_le_remote_conn_param_req_evt(hdev, skb);
6359                 break;
6360
6361         case HCI_EV_LE_DIRECT_ADV_REPORT:
6362                 hci_le_direct_adv_report_evt(hdev, skb);
6363                 break;
6364
6365         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6366                 hci_le_phy_update_evt(hdev, skb);
6367                 break;
6368
6369         case HCI_EV_LE_EXT_ADV_REPORT:
6370                 hci_le_ext_adv_report_evt(hdev, skb);
6371                 break;
6372
6373         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
6374                 hci_le_enh_conn_complete_evt(hdev, skb);
6375                 break;
6376
6377         case HCI_EV_LE_EXT_ADV_SET_TERM:
6378                 hci_le_ext_adv_term_evt(hdev, skb);
6379                 break;
6380
6381         default:
6382                 break;
6383         }
6384 }
6385
6386 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6387                                  u8 event, struct sk_buff *skb)
6388 {
6389         struct hci_ev_cmd_complete *ev;
6390         struct hci_event_hdr *hdr;
6391
6392         if (!skb)
6393                 return false;
6394
6395         if (skb->len < sizeof(*hdr)) {
6396                 bt_dev_err(hdev, "too short HCI event");
6397                 return false;
6398         }
6399
6400         hdr = (void *) skb->data;
6401         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6402
6403         if (event) {
6404                 if (hdr->evt != event)
6405                         return false;
6406                 return true;
6407         }
6408
6409         /* Check if request ended in Command Status - no way to retrieve
6410          * any extra parameters in this case.
6411          */
6412         if (hdr->evt == HCI_EV_CMD_STATUS)
6413                 return false;
6414
6415         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6416                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6417                            hdr->evt);
6418                 return false;
6419         }
6420
6421         if (skb->len < sizeof(*ev)) {
6422                 bt_dev_err(hdev, "too short cmd_complete event");
6423                 return false;
6424         }
6425
6426         ev = (void *) skb->data;
6427         skb_pull(skb, sizeof(*ev));
6428
6429         if (opcode != __le16_to_cpu(ev->opcode)) {
6430                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6431                        __le16_to_cpu(ev->opcode));
6432                 return false;
6433         }
6434
6435         return true;
6436 }
6437
6438 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6439                                   struct sk_buff *skb)
6440 {
6441         struct hci_ev_le_advertising_info *adv;
6442         struct hci_ev_le_direct_adv_info *direct_adv;
6443         struct hci_ev_le_ext_adv_report *ext_adv;
6444         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6445         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6446
6447         hci_dev_lock(hdev);
6448
6449         /* If we are currently suspended and this is the first BT event seen,
6450          * save the wake reason associated with the event.
6451          */
6452         if (!hdev->suspended || hdev->wake_reason)
6453                 goto unlock;
6454
6455         /* Default to remote wake. Values for wake_reason are documented in the
6456          * Bluez mgmt api docs.
6457          */
6458         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6459
6460         /* Once configured for remote wakeup, we should only wake up for
6461          * reconnections. It's useful to see which device is waking us up so
6462          * keep track of the bdaddr of the connection event that woke us up.
6463          */
6464         if (event == HCI_EV_CONN_REQUEST) {
6465                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6466                 hdev->wake_addr_type = BDADDR_BREDR;
6467         } else if (event == HCI_EV_CONN_COMPLETE) {
6468                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6469                 hdev->wake_addr_type = BDADDR_BREDR;
6470         } else if (event == HCI_EV_LE_META) {
6471                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6472                 u8 subevent = le_ev->subevent;
6473                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6474                 u8 num_reports = *ptr;
6475
6476                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6477                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6478                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6479                     num_reports) {
6480                         adv = (void *)(ptr + 1);
6481                         direct_adv = (void *)(ptr + 1);
6482                         ext_adv = (void *)(ptr + 1);
6483
6484                         switch (subevent) {
6485                         case HCI_EV_LE_ADVERTISING_REPORT:
6486                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6487                                 hdev->wake_addr_type = adv->bdaddr_type;
6488                                 break;
6489                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6490                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6491                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6492                                 break;
6493                         case HCI_EV_LE_EXT_ADV_REPORT:
6494                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6495                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6496                                 break;
6497                         }
6498                 }
6499         } else {
6500                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6501         }
6502
6503 unlock:
6504         hci_dev_unlock(hdev);
6505 }
6506
6507 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6508 {
6509         struct hci_event_hdr *hdr = (void *) skb->data;
6510         hci_req_complete_t req_complete = NULL;
6511         hci_req_complete_skb_t req_complete_skb = NULL;
6512         struct sk_buff *orig_skb = NULL;
6513         u8 status = 0, event = hdr->evt, req_evt = 0;
6514         u16 opcode = HCI_OP_NOP;
6515
6516         if (!event) {
6517                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6518                 goto done;
6519         }
6520
6521         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6522                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6523                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6524                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6525                                      &req_complete_skb);
6526                 req_evt = event;
6527         }
6528
6529         /* If it looks like we might end up having to call
6530          * req_complete_skb, store a pristine copy of the skb since the
6531          * various handlers may modify the original one through
6532          * skb_pull() calls, etc.
6533          */
6534         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6535             event == HCI_EV_CMD_COMPLETE)
6536                 orig_skb = skb_clone(skb, GFP_KERNEL);
6537
6538         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6539
6540         /* Store wake reason if we're suspended */
6541         hci_store_wake_reason(hdev, event, skb);
6542
6543         switch (event) {
6544         case HCI_EV_INQUIRY_COMPLETE:
6545                 hci_inquiry_complete_evt(hdev, skb);
6546                 break;
6547
6548         case HCI_EV_INQUIRY_RESULT:
6549                 hci_inquiry_result_evt(hdev, skb);
6550                 break;
6551
6552         case HCI_EV_CONN_COMPLETE:
6553                 hci_conn_complete_evt(hdev, skb);
6554                 break;
6555
6556         case HCI_EV_CONN_REQUEST:
6557                 hci_conn_request_evt(hdev, skb);
6558                 break;
6559
6560         case HCI_EV_DISCONN_COMPLETE:
6561                 hci_disconn_complete_evt(hdev, skb);
6562                 break;
6563
6564         case HCI_EV_AUTH_COMPLETE:
6565                 hci_auth_complete_evt(hdev, skb);
6566                 break;
6567
6568         case HCI_EV_REMOTE_NAME:
6569                 hci_remote_name_evt(hdev, skb);
6570                 break;
6571
6572         case HCI_EV_ENCRYPT_CHANGE:
6573                 hci_encrypt_change_evt(hdev, skb);
6574                 break;
6575
6576         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6577                 hci_change_link_key_complete_evt(hdev, skb);
6578                 break;
6579
6580         case HCI_EV_REMOTE_FEATURES:
6581                 hci_remote_features_evt(hdev, skb);
6582                 break;
6583
6584         case HCI_EV_CMD_COMPLETE:
6585                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6586                                      &req_complete, &req_complete_skb);
6587                 break;
6588
6589         case HCI_EV_CMD_STATUS:
6590                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6591                                    &req_complete_skb);
6592                 break;
6593
6594         case HCI_EV_HARDWARE_ERROR:
6595                 hci_hardware_error_evt(hdev, skb);
6596                 break;
6597
6598         case HCI_EV_ROLE_CHANGE:
6599                 hci_role_change_evt(hdev, skb);
6600                 break;
6601
6602         case HCI_EV_NUM_COMP_PKTS:
6603                 hci_num_comp_pkts_evt(hdev, skb);
6604                 break;
6605
6606         case HCI_EV_MODE_CHANGE:
6607                 hci_mode_change_evt(hdev, skb);
6608                 break;
6609
6610         case HCI_EV_PIN_CODE_REQ:
6611                 hci_pin_code_request_evt(hdev, skb);
6612                 break;
6613
6614         case HCI_EV_LINK_KEY_REQ:
6615                 hci_link_key_request_evt(hdev, skb);
6616                 break;
6617
6618         case HCI_EV_LINK_KEY_NOTIFY:
6619                 hci_link_key_notify_evt(hdev, skb);
6620                 break;
6621
6622         case HCI_EV_CLOCK_OFFSET:
6623                 hci_clock_offset_evt(hdev, skb);
6624                 break;
6625
6626         case HCI_EV_PKT_TYPE_CHANGE:
6627                 hci_pkt_type_change_evt(hdev, skb);
6628                 break;
6629
6630         case HCI_EV_PSCAN_REP_MODE:
6631                 hci_pscan_rep_mode_evt(hdev, skb);
6632                 break;
6633
6634         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6635                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6636                 break;
6637
6638         case HCI_EV_REMOTE_EXT_FEATURES:
6639                 hci_remote_ext_features_evt(hdev, skb);
6640                 break;
6641
6642         case HCI_EV_SYNC_CONN_COMPLETE:
6643                 hci_sync_conn_complete_evt(hdev, skb);
6644                 break;
6645
6646         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6647                 hci_extended_inquiry_result_evt(hdev, skb);
6648                 break;
6649
6650         case HCI_EV_KEY_REFRESH_COMPLETE:
6651                 hci_key_refresh_complete_evt(hdev, skb);
6652                 break;
6653
6654         case HCI_EV_IO_CAPA_REQUEST:
6655                 hci_io_capa_request_evt(hdev, skb);
6656                 break;
6657
6658         case HCI_EV_IO_CAPA_REPLY:
6659                 hci_io_capa_reply_evt(hdev, skb);
6660                 break;
6661
6662         case HCI_EV_USER_CONFIRM_REQUEST:
6663                 hci_user_confirm_request_evt(hdev, skb);
6664                 break;
6665
6666         case HCI_EV_USER_PASSKEY_REQUEST:
6667                 hci_user_passkey_request_evt(hdev, skb);
6668                 break;
6669
6670         case HCI_EV_USER_PASSKEY_NOTIFY:
6671                 hci_user_passkey_notify_evt(hdev, skb);
6672                 break;
6673
6674         case HCI_EV_KEYPRESS_NOTIFY:
6675                 hci_keypress_notify_evt(hdev, skb);
6676                 break;
6677
6678         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6679                 hci_simple_pair_complete_evt(hdev, skb);
6680                 break;
6681
6682         case HCI_EV_REMOTE_HOST_FEATURES:
6683                 hci_remote_host_features_evt(hdev, skb);
6684                 break;
6685
6686         case HCI_EV_LE_META:
6687                 hci_le_meta_evt(hdev, skb);
6688                 break;
6689
6690         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6691                 hci_remote_oob_data_request_evt(hdev, skb);
6692                 break;
6693
6694 #if IS_ENABLED(CONFIG_BT_HS)
6695         case HCI_EV_CHANNEL_SELECTED:
6696                 hci_chan_selected_evt(hdev, skb);
6697                 break;
6698
6699         case HCI_EV_PHY_LINK_COMPLETE:
6700                 hci_phy_link_complete_evt(hdev, skb);
6701                 break;
6702
6703         case HCI_EV_LOGICAL_LINK_COMPLETE:
6704                 hci_loglink_complete_evt(hdev, skb);
6705                 break;
6706
6707         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6708                 hci_disconn_loglink_complete_evt(hdev, skb);
6709                 break;
6710
6711         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6712                 hci_disconn_phylink_complete_evt(hdev, skb);
6713                 break;
6714 #endif
6715
6716         case HCI_EV_NUM_COMP_BLOCKS:
6717                 hci_num_comp_blocks_evt(hdev, skb);
6718                 break;
6719
6720 #ifdef TIZEN_BT
6721         case HCI_EV_VENDOR_SPECIFIC:
6722                 hci_vendor_specific_evt(hdev, skb);
6723                 break;
6724 #else
6725         case HCI_EV_VENDOR:
6726                 msft_vendor_evt(hdev, skb);
6727                 break;
6728 #endif
6729
6730         default:
6731                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6732                 break;
6733         }
6734
6735         if (req_complete) {
6736                 req_complete(hdev, status, opcode);
6737         } else if (req_complete_skb) {
6738                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6739                         kfree_skb(orig_skb);
6740                         orig_skb = NULL;
6741                 }
6742                 req_complete_skb(hdev, status, opcode, orig_skb);
6743         }
6744
6745 done:
6746         kfree_skb(orig_skb);
6747         kfree_skb(skb);
6748         hdev->stat.evt_rx++;
6749 }