net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         /* Set discovery state to stopped if we're not doing LE active
  59          * scanning.
  60          */
  61         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  62             hdev->le_scan_type != LE_SCAN_ACTIVE)
  63                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  64         hci_dev_unlock(hdev);
  65
  66         hci_conn_check_pending(hdev);
  67 }
  68
  69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  70 {
  71         __u8 status = *((__u8 *) skb->data);
  72
  73         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  74
  75         if (status)
  76                 return;
  77
  78         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  79 }
  80
  81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  82 {
  83         __u8 status = *((__u8 *) skb->data);
  84
  85         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  86
  87         if (status)
  88                 return;
  89
  90         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  91
  92         hci_conn_check_pending(hdev);
  93 }
  94
  95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  96                                           struct sk_buff *skb)
  97 {
  98         BT_DBG("%s", hdev->name);
  99 }
 100
 101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 102 {
 103         struct hci_rp_role_discovery *rp = (void *) skb->data;
 104         struct hci_conn *conn;
 105
 106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 107
 108         if (rp->status)
 109                 return;
 110
 111         hci_dev_lock(hdev);
 112
 113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 114         if (conn)
 115                 conn->role = rp->role;
 116
 117         hci_dev_unlock(hdev);
 118 }
 119
 120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 121 {
 122         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 123         struct hci_conn *conn;
 124
 125         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 126
 127         if (rp->status)
 128                 return;
 129
 130         hci_dev_lock(hdev);
 131
 132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 133         if (conn)
 134                 conn->link_policy = __le16_to_cpu(rp->policy);
 135
 136         hci_dev_unlock(hdev);
 137 }
 138
 139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 140 {
 141         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 142         struct hci_conn *conn;
 143         void *sent;
 144 #ifdef TIZEN_BT
 145         struct hci_cp_write_link_policy cp;
 146         struct hci_conn *sco_conn;
 147 #endif
 148
 149         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 150
 151         if (rp->status)
 152                 return;
 153
 154         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 155         if (!sent)
 156                 return;
 157
 158         hci_dev_lock(hdev);
 159
 160         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 161         if (conn)
 162                 conn->link_policy = get_unaligned_le16(sent + 2);
 163
 164 #ifdef TIZEN_BT
 165         sco_conn = hci_conn_hash_lookup_sco(hdev);
 166         if (sco_conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 167             conn->link_policy & HCI_LP_SNIFF) {
 168                 BT_ERR("SNIFF is not allowed during sco connection");
 169                 cp.handle = __cpu_to_le16(conn->handle);
 170                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 171                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 172         }
 173 #endif
 174
 175         hci_dev_unlock(hdev);
 176 }
 177
 178 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 179                                         struct sk_buff *skb)
 180 {
 181         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 182
 183         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 184
 185         if (rp->status)
 186                 return;
 187
 188         hdev->link_policy = __le16_to_cpu(rp->policy);
 189 }
 190
 191 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 192                                          struct sk_buff *skb)
 193 {
 194         __u8 status = *((__u8 *) skb->data);
 195         void *sent;
 196
 197         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 198
 199         if (status)
 200                 return;
 201
 202         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 203         if (!sent)
 204                 return;
 205
 206         hdev->link_policy = get_unaligned_le16(sent);
 207 }
 208
 209 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 210 {
 211         __u8 status = *((__u8 *) skb->data);
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         clear_bit(HCI_RESET, &hdev->flags);
 216
 217         if (status)
 218                 return;
 219
 220         /* Reset all non-persistent flags */
 221         hci_dev_clear_volatile_flags(hdev);
 222
 223         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 224
 225         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 226         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 227
 228         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 229         hdev->adv_data_len = 0;
 230
 231         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 232         hdev->scan_rsp_data_len = 0;
 233
 234         hdev->le_scan_type = LE_SCAN_PASSIVE;
 235
 236         hdev->ssp_debug_mode = 0;
 237
 238         hci_bdaddr_list_clear(&hdev->le_white_list);
 239         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (hci_dev_test_flag(hdev, HCI_MGMT))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 307             hci_dev_test_flag(hdev, HCI_CONFIG))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (hci_dev_test_flag(hdev, HCI_MGMT))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (hci_dev_test_flag(hdev, HCI_MGMT))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (hci_dev_test_flag(hdev, HCI_MGMT))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 526                 else
 527                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 554                 if (sent->support)
 555                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 556                 else
 557                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 573             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 593             hci_dev_test_flag(hdev, HCI_CONFIG))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (hci_dev_test_flag(hdev, HCI_SETUP))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 return;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859 }
 860
 861 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 862                                          struct sk_buff *skb)
 863 {
 864         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 865
 866         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 867
 868         if (rp->status)
 869                 return;
 870
 871         hdev->inq_tx_power = rp->tx_power;
 872 }
 873
 874 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 877         struct hci_cp_pin_code_reply *cp;
 878         struct hci_conn *conn;
 879
 880         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 881
 882         hci_dev_lock(hdev);
 883
 884         if (hci_dev_test_flag(hdev, HCI_MGMT))
 885                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 886
 887         if (rp->status)
 888                 goto unlock;
 889
 890         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 891         if (!cp)
 892                 goto unlock;
 893
 894         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 895         if (conn)
 896                 conn->pin_length = cp->pin_len;
 897
 898 unlock:
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 903 {
 904         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         hci_dev_lock(hdev);
 909
 910         if (hci_dev_test_flag(hdev, HCI_MGMT))
 911                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 912                                                  rp->status);
 913
 914         hci_dev_unlock(hdev);
 915 }
 916
 917 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 918                                        struct sk_buff *skb)
 919 {
 920         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 921
 922         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 923
 924         if (rp->status)
 925                 return;
 926
 927         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 928         hdev->le_pkts = rp->le_max_pkt;
 929
 930         hdev->le_cnt = hdev->le_pkts;
 931
 932         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 933 }
 934
 935 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 936                                           struct sk_buff *skb)
 937 {
 938         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 941
 942         if (rp->status)
 943                 return;
 944
 945         memcpy(hdev->le_features, rp->features, 8);
 946 }
 947
 948 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 949                                         struct sk_buff *skb)
 950 {
 951         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 952
 953         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 954
 955         if (rp->status)
 956                 return;
 957
 958         hdev->adv_tx_power = rp->tx_power;
 959 }
 960
 961 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 962 {
 963         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 964
 965         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 966
 967         hci_dev_lock(hdev);
 968
 969         if (hci_dev_test_flag(hdev, HCI_MGMT))
 970                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 971                                                  rp->status);
 972
 973         hci_dev_unlock(hdev);
 974 }
 975
 976 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 977                                           struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (hci_dev_test_flag(hdev, HCI_MGMT))
 986                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 987                                                      ACL_LINK, 0, rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 993 {
 994         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 995
 996         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 997
 998         hci_dev_lock(hdev);
 999
1000         if (hci_dev_test_flag(hdev, HCI_MGMT))
1001                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1002                                                  0, rp->status);
1003
1004         hci_dev_unlock(hdev);
1005 }
1006
1007 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1008                                           struct sk_buff *skb)
1009 {
1010         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1011
1012         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1013
1014         hci_dev_lock(hdev);
1015
1016         if (hci_dev_test_flag(hdev, HCI_MGMT))
1017                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1018                                                      ACL_LINK, 0, rp->status);
1019
1020         hci_dev_unlock(hdev);
1021 }
1022
1023 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1024                                        struct sk_buff *skb)
1025 {
1026         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1027
1028         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1029 }
1030
1031 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1032                                            struct sk_buff *skb)
1033 {
1034         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037 }
1038
1039 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1040 {
1041         __u8 status = *((__u8 *) skb->data);
1042         bdaddr_t *sent;
1043
1044         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1045
1046         if (status)
1047                 return;
1048
1049         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1050         if (!sent)
1051                 return;
1052
1053         hci_dev_lock(hdev);
1054
1055         bacpy(&hdev->random_addr, sent);
1056
1057         hci_dev_unlock(hdev);
1058 }
1059
1060 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1061 {
1062         __u8 status = *((__u8 *) skb->data);
1063         struct hci_cp_le_set_default_phy *cp;
1064
1065         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1066
1067         if (status)
1068                 return;
1069
1070         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1071         if (!cp)
1072                 return;
1073
1074         hci_dev_lock(hdev);
1075
1076         hdev->le_tx_def_phys = cp->tx_phys;
1077         hdev->le_rx_def_phys = cp->rx_phys;
1078
1079         hci_dev_unlock(hdev);
1080 }
1081
1082 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1083                                               struct sk_buff *skb)
1084 {
1085         __u8 status = *((__u8 *) skb->data);
1086         struct hci_cp_le_set_adv_set_rand_addr *cp;
1087         struct adv_info *adv_instance;
1088
1089         if (status)
1090                 return;
1091
1092         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1093         if (!cp)
1094                 return;
1095
1096         hci_dev_lock(hdev);
1097
1098         if (!hdev->cur_adv_instance) {
1099                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1100                 bacpy(&hdev->random_addr, &cp->bdaddr);
1101         } else {
1102                 adv_instance = hci_find_adv_instance(hdev,
1103                                                      hdev->cur_adv_instance);
1104                 if (adv_instance)
1105                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1106         }
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         __u8 *sent, status = *((__u8 *) skb->data);
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1116
1117         if (status)
1118                 return;
1119
1120         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1121         if (!sent)
1122                 return;
1123
1124         hci_dev_lock(hdev);
1125
1126         /* If we're doing connection initiation as peripheral. Set a
1127          * timeout in case something goes wrong.
1128          */
1129         if (*sent) {
1130                 struct hci_conn *conn;
1131
1132                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1133
1134                 conn = hci_lookup_le_connect(hdev);
1135                 if (conn)
1136                         queue_delayed_work(hdev->workqueue,
1137                                            &conn->le_conn_timeout,
1138                                            conn->conn_timeout);
1139         } else {
1140                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1141         }
1142
1143         hci_dev_unlock(hdev);
1144 }
1145
1146 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1147                                          struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_ext_adv_enable *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         if (cp->enable) {
1164                 struct hci_conn *conn;
1165
1166                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1167
1168                 conn = hci_lookup_le_connect(hdev);
1169                 if (conn)
1170                         queue_delayed_work(hdev->workqueue,
1171                                            &conn->le_conn_timeout,
1172                                            conn->conn_timeout);
1173         } else {
1174                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1175         }
1176
1177         hci_dev_unlock(hdev);
1178 }
1179
1180 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1181 {
1182         struct hci_cp_le_set_scan_param *cp;
1183         __u8 status = *((__u8 *) skb->data);
1184
1185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1186
1187         if (status)
1188                 return;
1189
1190         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1191         if (!cp)
1192                 return;
1193
1194         hci_dev_lock(hdev);
1195
1196         hdev->le_scan_type = cp->type;
1197
1198         hci_dev_unlock(hdev);
1199 }
1200
1201 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1202                                          struct sk_buff *skb)
1203 {
1204         struct hci_cp_le_set_ext_scan_params *cp;
1205         __u8 status = *((__u8 *) skb->data);
1206         struct hci_cp_le_scan_phy_params *phy_param;
1207
1208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1209
1210         if (status)
1211                 return;
1212
1213         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1214         if (!cp)
1215                 return;
1216
1217         phy_param = (void *)cp->data;
1218
1219         hci_dev_lock(hdev);
1220
1221         hdev->le_scan_type = phy_param->type;
1222
1223         hci_dev_unlock(hdev);
1224 }
1225
1226 static bool has_pending_adv_report(struct hci_dev *hdev)
1227 {
1228         struct discovery_state *d = &hdev->discovery;
1229
1230         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1231 }
1232
1233 static void clear_pending_adv_report(struct hci_dev *hdev)
1234 {
1235         struct discovery_state *d = &hdev->discovery;
1236
1237         bacpy(&d->last_adv_addr, BDADDR_ANY);
1238         d->last_adv_data_len = 0;
1239 }
1240
1241 #ifndef TIZEN_BT
1242 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1243                                      u8 bdaddr_type, s8 rssi, u32 flags,
1244                                      u8 *data, u8 len)
1245 {
1246         struct discovery_state *d = &hdev->discovery;
1247
1248         bacpy(&d->last_adv_addr, bdaddr);
1249         d->last_adv_addr_type = bdaddr_type;
1250         d->last_adv_rssi = rssi;
1251         d->last_adv_flags = flags;
1252         memcpy(d->last_adv_data, data, len);
1253         d->last_adv_data_len = len;
1254 }
1255 #endif
1256
1257 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1258 {
1259         hci_dev_lock(hdev);
1260
1261         switch (enable) {
1262         case LE_SCAN_ENABLE:
1263                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1264                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1265                         clear_pending_adv_report(hdev);
1266                 break;
1267
1268         case LE_SCAN_DISABLE:
1269                 /* We do this here instead of when setting DISCOVERY_STOPPED
1270                  * since the latter would potentially require waiting for
1271                  * inquiry to stop too.
1272                  */
1273                 if (has_pending_adv_report(hdev)) {
1274                         struct discovery_state *d = &hdev->discovery;
1275
1276                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1277                                           d->last_adv_addr_type, NULL,
1278                                           d->last_adv_rssi, d->last_adv_flags,
1279                                           d->last_adv_data,
1280                                           d->last_adv_data_len, NULL, 0);
1281                 }
1282
1283                 /* Cancel this timer so that we don't try to disable scanning
1284                  * when it's already disabled.
1285                  */
1286                 cancel_delayed_work(&hdev->le_scan_disable);
1287
1288                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1289
1290                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1291                  * interrupted scanning due to a connect request. Mark
1292                  * therefore discovery as stopped. If this was not
1293                  * because of a connect request advertising might have
1294                  * been disabled because of active scanning, so
1295                  * re-enable it again if necessary.
1296                  */
1297                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1298 #ifndef TIZEN_BT /* The below line is kernel bug. */
1299                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1300 #else
1301                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1302 #endif
1303                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1304                          hdev->discovery.state == DISCOVERY_FINDING)
1305                         hci_req_reenable_advertising(hdev);
1306
1307                 break;
1308
1309         default:
1310                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1311                            enable);
1312                 break;
1313         }
1314
1315         hci_dev_unlock(hdev);
1316 }
1317
1318 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1319                                       struct sk_buff *skb)
1320 {
1321         struct hci_cp_le_set_scan_enable *cp;
1322         __u8 status = *((__u8 *) skb->data);
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (status)
1327                 return;
1328
1329         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1330         if (!cp)
1331                 return;
1332
1333         le_set_scan_enable_complete(hdev, cp->enable);
1334 }
1335
1336 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1337                                       struct sk_buff *skb)
1338 {
1339         struct hci_cp_le_set_ext_scan_enable *cp;
1340         __u8 status = *((__u8 *) skb->data);
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1343
1344         if (status)
1345                 return;
1346
1347         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1348         if (!cp)
1349                 return;
1350
1351         le_set_scan_enable_complete(hdev, cp->enable);
1352 }
1353
1354 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1355                                       struct sk_buff *skb)
1356 {
1357         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1358
1359         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1360                rp->num_of_sets);
1361
1362         if (rp->status)
1363                 return;
1364
1365         hdev->le_num_of_adv_sets = rp->num_of_sets;
1366 }
1367
1368 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1369                                            struct sk_buff *skb)
1370 {
1371         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1372
1373         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1374
1375         if (rp->status)
1376                 return;
1377
1378         hdev->le_white_list_size = rp->size;
1379 }
1380
1381 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1382                                        struct sk_buff *skb)
1383 {
1384         __u8 status = *((__u8 *) skb->data);
1385
1386         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1387
1388         if (status)
1389                 return;
1390
1391         hci_bdaddr_list_clear(&hdev->le_white_list);
1392 }
1393
1394 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1395                                         struct sk_buff *skb)
1396 {
1397         struct hci_cp_le_add_to_white_list *sent;
1398         __u8 status = *((__u8 *) skb->data);
1399
1400         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1401
1402         if (status)
1403                 return;
1404
1405         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1406         if (!sent)
1407                 return;
1408
1409         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1410                            sent->bdaddr_type);
1411 }
1412
1413 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1414                                           struct sk_buff *skb)
1415 {
1416         struct hci_cp_le_del_from_white_list *sent;
1417         __u8 status = *((__u8 *) skb->data);
1418
1419         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1420
1421         if (status)
1422                 return;
1423
1424         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1425         if (!sent)
1426                 return;
1427
1428         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1429                             sent->bdaddr_type);
1430 }
1431
1432 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1433                                             struct sk_buff *skb)
1434 {
1435         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1436
1437         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1438
1439         if (rp->status)
1440                 return;
1441
1442         memcpy(hdev->le_states, rp->le_states, 8);
1443 }
1444
1445 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1446                                         struct sk_buff *skb)
1447 {
1448         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1449
1450         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1451
1452         if (rp->status)
1453                 return;
1454
1455         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1456         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1457 }
1458
1459 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1460                                          struct sk_buff *skb)
1461 {
1462         struct hci_cp_le_write_def_data_len *sent;
1463         __u8 status = *((__u8 *) skb->data);
1464
1465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1466
1467         if (status)
1468                 return;
1469
1470         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1471         if (!sent)
1472                 return;
1473
1474         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1475         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1476 }
1477
1478 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1479                                        struct sk_buff *skb)
1480 {
1481         __u8 status = *((__u8 *) skb->data);
1482
1483         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1484
1485         if (status)
1486                 return;
1487
1488         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1489 }
1490
1491 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1492                                            struct sk_buff *skb)
1493 {
1494         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1495
1496         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1497
1498         if (rp->status)
1499                 return;
1500
1501         hdev->le_resolv_list_size = rp->size;
1502 }
1503
1504 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1505                                                 struct sk_buff *skb)
1506 {
1507         __u8 *sent, status = *((__u8 *) skb->data);
1508
1509         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1510
1511         if (status)
1512                 return;
1513
1514         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1515         if (!sent)
1516                 return;
1517
1518         hci_dev_lock(hdev);
1519
1520         if (*sent)
1521                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1522         else
1523                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1524
1525         hci_dev_unlock(hdev);
1526 }
1527
1528 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1529                                         struct sk_buff *skb)
1530 {
1531         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1532
1533         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1534
1535         if (rp->status)
1536                 return;
1537
1538         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1539         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1540         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1541         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1542 }
1543
1544 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1545                                            struct sk_buff *skb)
1546 {
1547         struct hci_cp_write_le_host_supported *sent;
1548         __u8 status = *((__u8 *) skb->data);
1549
1550         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1551
1552         if (status)
1553                 return;
1554
1555         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1556         if (!sent)
1557                 return;
1558
1559         hci_dev_lock(hdev);
1560
1561         if (sent->le) {
1562                 hdev->features[1][0] |= LMP_HOST_LE;
1563                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1564         } else {
1565                 hdev->features[1][0] &= ~LMP_HOST_LE;
1566                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1567                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1568         }
1569
1570         if (sent->simul)
1571                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1572         else
1573                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1574
1575         hci_dev_unlock(hdev);
1576 }
1577
1578 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1579 {
1580         struct hci_cp_le_set_adv_param *cp;
1581         u8 status = *((u8 *) skb->data);
1582
1583         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1584
1585         if (status)
1586                 return;
1587
1588         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1589         if (!cp)
1590                 return;
1591
1592         hci_dev_lock(hdev);
1593         hdev->adv_addr_type = cp->own_address_type;
1594         hci_dev_unlock(hdev);
1595 }
1596
1597 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1598 {
1599         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1600         struct hci_cp_le_set_ext_adv_params *cp;
1601         struct adv_info *adv_instance;
1602
1603         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1604
1605         if (rp->status)
1606                 return;
1607
1608         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1609         if (!cp)
1610                 return;
1611
1612         hci_dev_lock(hdev);
1613         hdev->adv_addr_type = cp->own_addr_type;
1614         if (!hdev->cur_adv_instance) {
1615                 /* Store in hdev for instance 0 */
1616                 hdev->adv_tx_power = rp->tx_power;
1617         } else {
1618                 adv_instance = hci_find_adv_instance(hdev,
1619                                                      hdev->cur_adv_instance);
1620                 if (adv_instance)
1621                         adv_instance->tx_power = rp->tx_power;
1622         }
1623         /* Update adv data as tx power is known now */
1624         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1625         hci_dev_unlock(hdev);
1626 }
1627
1628 #ifdef TIZEN_BT
1629 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1630                                           struct sk_buff *skb)
1631 {
1632         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1633
1634         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1635                hdev->name, rp->status, rp->le_ext_opcode);
1636
1637         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1638 }
1639
1640 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1641                                           struct sk_buff *skb)
1642 {
1643         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1644
1645         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1646                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1647
1648         mgmt_raw_rssi_response(hdev, rp, rp->status);
1649 }
1650
1651 static void hci_vendor_ext_rssi_link_alert_evt(struct hci_dev *hdev,
1652                                                struct sk_buff *skb)
1653 {
1654         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
1655
1656         BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X", LE_RSSI_LINK_ALERT);
1657
1658         mgmt_rssi_alert_evt(hdev, ev->conn_handle, ev->alert_type,
1659                             ev->rssi_dbm);
1660 }
1661
1662 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1663                                               struct sk_buff *skb)
1664 {
1665         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1666         __u8 event_le_ext_sub_code;
1667
1668         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1669                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1670
1671         skb_pull(skb, sizeof(*ev));
1672         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1673
1674         switch (event_le_ext_sub_code) {
1675         case LE_RSSI_LINK_ALERT:
1676                 hci_vendor_ext_rssi_link_alert_evt(hdev, skb);
1677                 break;
1678
1679         default:
1680                 break;
1681         }
1682 }
1683
1684 static void hci_vendor_multi_adv_state_change_evt(struct hci_dev *hdev,
1685                                                   struct sk_buff *skb)
1686 {
1687         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *)skb->data;
1688
1689         BT_DBG("LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT");
1690
1691         mgmt_multi_adv_state_change_evt(hdev, ev->adv_instance,
1692                                         ev->state_change_reason,
1693                                         ev->connection_handle);
1694 }
1695
1696 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1697 {
1698         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1699         __u8 event_sub_code;
1700
1701         BT_DBG("hci_vendor_specific_evt");
1702
1703         skb_pull(skb, sizeof(*ev));
1704         event_sub_code = ev->event_sub_code;
1705
1706         switch (event_sub_code) {
1707         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1708                 hci_vendor_specific_group_ext_evt(hdev, skb);
1709                 break;
1710
1711         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
1712                 hci_vendor_multi_adv_state_change_evt(hdev, skb);
1713                 break;
1714
1715         default:
1716                 break;
1717         }
1718 }
1719 #endif
1720
1721 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1722 {
1723         struct hci_rp_read_rssi *rp = (void *) skb->data;
1724         struct hci_conn *conn;
1725
1726         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1727
1728         if (rp->status)
1729                 return;
1730
1731         hci_dev_lock(hdev);
1732
1733         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1734         if (conn)
1735                 conn->rssi = rp->rssi;
1736
1737         hci_dev_unlock(hdev);
1738 }
1739
1740 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1741 {
1742         struct hci_cp_read_tx_power *sent;
1743         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1744         struct hci_conn *conn;
1745
1746         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1747
1748         if (rp->status)
1749                 return;
1750
1751         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1752         if (!sent)
1753                 return;
1754
1755         hci_dev_lock(hdev);
1756
1757         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1758         if (!conn)
1759                 goto unlock;
1760
1761         switch (sent->type) {
1762         case 0x00:
1763                 conn->tx_power = rp->tx_power;
1764                 break;
1765         case 0x01:
1766                 conn->max_tx_power = rp->tx_power;
1767                 break;
1768         }
1769
1770 unlock:
1771         hci_dev_unlock(hdev);
1772 }
1773
1774 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1775 {
1776         u8 status = *((u8 *) skb->data);
1777         u8 *mode;
1778
1779         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1780
1781         if (status)
1782                 return;
1783
1784         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1785         if (mode)
1786                 hdev->ssp_debug_mode = *mode;
1787 }
1788
1789 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1790 {
1791         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1792
1793         if (status) {
1794                 hci_conn_check_pending(hdev);
1795                 return;
1796         }
1797
1798         set_bit(HCI_INQUIRY, &hdev->flags);
1799 }
1800
1801 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1802 {
1803         struct hci_cp_create_conn *cp;
1804         struct hci_conn *conn;
1805
1806         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1807
1808         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1809         if (!cp)
1810                 return;
1811
1812         hci_dev_lock(hdev);
1813
1814         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1815
1816         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1817
1818         if (status) {
1819                 if (conn && conn->state == BT_CONNECT) {
1820                         if (status != 0x0c || conn->attempt > 2) {
1821                                 conn->state = BT_CLOSED;
1822                                 hci_connect_cfm(conn, status);
1823                                 hci_conn_del(conn);
1824                         } else
1825                                 conn->state = BT_CONNECT2;
1826                 }
1827         } else {
1828                 if (!conn) {
1829                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1830                                             HCI_ROLE_MASTER);
1831                         if (!conn)
1832                                 bt_dev_err(hdev, "no memory for new connection");
1833                 }
1834         }
1835
1836         hci_dev_unlock(hdev);
1837 }
1838
1839 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1840 {
1841         struct hci_cp_add_sco *cp;
1842         struct hci_conn *acl, *sco;
1843         __u16 handle;
1844
1845         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1846
1847         if (!status)
1848                 return;
1849
1850         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1851         if (!cp)
1852                 return;
1853
1854         handle = __le16_to_cpu(cp->handle);
1855
1856         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1857
1858         hci_dev_lock(hdev);
1859
1860         acl = hci_conn_hash_lookup_handle(hdev, handle);
1861         if (acl) {
1862                 sco = acl->link;
1863                 if (sco) {
1864                         sco->state = BT_CLOSED;
1865
1866                         hci_connect_cfm(sco, status);
1867                         hci_conn_del(sco);
1868                 }
1869         }
1870
1871         hci_dev_unlock(hdev);
1872 }
1873
1874 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1875 {
1876         struct hci_cp_auth_requested *cp;
1877         struct hci_conn *conn;
1878
1879         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1880
1881         if (!status)
1882                 return;
1883
1884         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1885         if (!cp)
1886                 return;
1887
1888         hci_dev_lock(hdev);
1889
1890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1891         if (conn) {
1892                 if (conn->state == BT_CONFIG) {
1893                         hci_connect_cfm(conn, status);
1894                         hci_conn_drop(conn);
1895                 }
1896         }
1897
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1902 {
1903         struct hci_cp_set_conn_encrypt *cp;
1904         struct hci_conn *conn;
1905
1906         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1907
1908         if (!status)
1909                 return;
1910
1911         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1912         if (!cp)
1913                 return;
1914
1915         hci_dev_lock(hdev);
1916
1917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1918         if (conn) {
1919                 if (conn->state == BT_CONFIG) {
1920                         hci_connect_cfm(conn, status);
1921                         hci_conn_drop(conn);
1922                 }
1923         }
1924
1925         hci_dev_unlock(hdev);
1926 }
1927
1928 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1929                                     struct hci_conn *conn)
1930 {
1931         if (conn->state != BT_CONFIG || !conn->out)
1932                 return 0;
1933
1934         if (conn->pending_sec_level == BT_SECURITY_SDP)
1935                 return 0;
1936
1937         /* Only request authentication for SSP connections or non-SSP
1938          * devices with sec_level MEDIUM or HIGH or if MITM protection
1939          * is requested.
1940          */
1941         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1942             conn->pending_sec_level != BT_SECURITY_FIPS &&
1943             conn->pending_sec_level != BT_SECURITY_HIGH &&
1944             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1945                 return 0;
1946
1947         return 1;
1948 }
1949
1950 static int hci_resolve_name(struct hci_dev *hdev,
1951                                    struct inquiry_entry *e)
1952 {
1953         struct hci_cp_remote_name_req cp;
1954
1955         memset(&cp, 0, sizeof(cp));
1956
1957         bacpy(&cp.bdaddr, &e->data.bdaddr);
1958         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1959         cp.pscan_mode = e->data.pscan_mode;
1960         cp.clock_offset = e->data.clock_offset;
1961
1962         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1963 }
1964
1965 static bool hci_resolve_next_name(struct hci_dev *hdev)
1966 {
1967         struct discovery_state *discov = &hdev->discovery;
1968         struct inquiry_entry *e;
1969
1970         if (list_empty(&discov->resolve))
1971                 return false;
1972
1973         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1974         if (!e)
1975                 return false;
1976
1977         if (hci_resolve_name(hdev, e) == 0) {
1978                 e->name_state = NAME_PENDING;
1979                 return true;
1980         }
1981
1982         return false;
1983 }
1984
1985 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1986                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1987 {
1988         struct discovery_state *discov = &hdev->discovery;
1989         struct inquiry_entry *e;
1990
1991 #ifdef TIZEN_BT
1992         /* Update the mgmt connected state if necessary. Be careful with
1993          * conn objects that exist but are not (yet) connected however.
1994          * Only those in BT_CONFIG or BT_CONNECTED states can be
1995          * considered connected.
1996          */
1997         if (conn &&
1998             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1999                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2000                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2001                 else
2002                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2003         }
2004 #else
2005         if (conn &&
2006             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2007             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2008                 mgmt_device_connected(hdev, conn, 0, name, name_len);
2009 #endif
2010
2011         if (discov->state == DISCOVERY_STOPPED)
2012                 return;
2013
2014         if (discov->state == DISCOVERY_STOPPING)
2015                 goto discov_complete;
2016
2017         if (discov->state != DISCOVERY_RESOLVING)
2018                 return;
2019
2020         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2021         /* If the device was not found in a list of found devices names of which
2022          * are pending. there is no need to continue resolving a next name as it
2023          * will be done upon receiving another Remote Name Request Complete
2024          * Event */
2025         if (!e)
2026                 return;
2027
2028         list_del(&e->list);
2029         if (name) {
2030                 e->name_state = NAME_KNOWN;
2031                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2032                                  e->data.rssi, name, name_len);
2033         } else {
2034                 e->name_state = NAME_NOT_KNOWN;
2035         }
2036
2037         if (hci_resolve_next_name(hdev))
2038                 return;
2039
2040 discov_complete:
2041         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2042 }
2043
2044 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2045 {
2046         struct hci_cp_remote_name_req *cp;
2047         struct hci_conn *conn;
2048
2049         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2050
2051         /* If successful wait for the name req complete event before
2052          * checking for the need to do authentication */
2053         if (!status)
2054                 return;
2055
2056         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2057         if (!cp)
2058                 return;
2059
2060         hci_dev_lock(hdev);
2061
2062         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2063
2064         if (hci_dev_test_flag(hdev, HCI_MGMT))
2065                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2066
2067         if (!conn)
2068                 goto unlock;
2069
2070         if (!hci_outgoing_auth_needed(hdev, conn))
2071                 goto unlock;
2072
2073         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2074                 struct hci_cp_auth_requested auth_cp;
2075
2076                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2077
2078                 auth_cp.handle = __cpu_to_le16(conn->handle);
2079                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2080                              sizeof(auth_cp), &auth_cp);
2081         }
2082
2083 unlock:
2084         hci_dev_unlock(hdev);
2085 }
2086
2087 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2088 {
2089         struct hci_cp_read_remote_features *cp;
2090         struct hci_conn *conn;
2091
2092         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2093
2094         if (!status)
2095                 return;
2096
2097         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2098         if (!cp)
2099                 return;
2100
2101         hci_dev_lock(hdev);
2102
2103         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2104         if (conn) {
2105                 if (conn->state == BT_CONFIG) {
2106                         hci_connect_cfm(conn, status);
2107                         hci_conn_drop(conn);
2108                 }
2109         }
2110
2111         hci_dev_unlock(hdev);
2112 }
2113
2114 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2115 {
2116         struct hci_cp_read_remote_ext_features *cp;
2117         struct hci_conn *conn;
2118
2119         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2120
2121         if (!status)
2122                 return;
2123
2124         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2125         if (!cp)
2126                 return;
2127
2128         hci_dev_lock(hdev);
2129
2130         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2131         if (conn) {
2132                 if (conn->state == BT_CONFIG) {
2133                         hci_connect_cfm(conn, status);
2134                         hci_conn_drop(conn);
2135                 }
2136         }
2137
2138         hci_dev_unlock(hdev);
2139 }
2140
2141 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2142 {
2143         struct hci_cp_setup_sync_conn *cp;
2144         struct hci_conn *acl, *sco;
2145         __u16 handle;
2146
2147         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2148
2149         if (!status)
2150                 return;
2151
2152         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2153         if (!cp)
2154                 return;
2155
2156         handle = __le16_to_cpu(cp->handle);
2157
2158         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2159
2160         hci_dev_lock(hdev);
2161
2162         acl = hci_conn_hash_lookup_handle(hdev, handle);
2163         if (acl) {
2164                 sco = acl->link;
2165                 if (sco) {
2166                         sco->state = BT_CLOSED;
2167
2168                         hci_connect_cfm(sco, status);
2169                         hci_conn_del(sco);
2170                 }
2171         }
2172
2173         hci_dev_unlock(hdev);
2174 }
2175
2176 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2177 {
2178         struct hci_cp_sniff_mode *cp;
2179         struct hci_conn *conn;
2180
2181         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2182
2183         if (!status)
2184                 return;
2185
2186         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2187         if (!cp)
2188                 return;
2189
2190         hci_dev_lock(hdev);
2191
2192         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2193         if (conn) {
2194                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2195
2196                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2197                         hci_sco_setup(conn, status);
2198         }
2199
2200         hci_dev_unlock(hdev);
2201 }
2202
2203 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2204 {
2205         struct hci_cp_exit_sniff_mode *cp;
2206         struct hci_conn *conn;
2207
2208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2209
2210         if (!status)
2211                 return;
2212
2213         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2214         if (!cp)
2215                 return;
2216
2217         hci_dev_lock(hdev);
2218
2219         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2220         if (conn) {
2221                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2222
2223                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2224                         hci_sco_setup(conn, status);
2225         }
2226
2227         hci_dev_unlock(hdev);
2228 }
2229
2230 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2231 {
2232         struct hci_cp_disconnect *cp;
2233         struct hci_conn *conn;
2234
2235         if (!status)
2236                 return;
2237
2238         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2239         if (!cp)
2240                 return;
2241
2242         hci_dev_lock(hdev);
2243
2244         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2245         if (conn)
2246                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2247                                        conn->dst_type, status);
2248
2249         hci_dev_unlock(hdev);
2250 }
2251
2252 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2253                               u8 peer_addr_type, u8 own_address_type,
2254                               u8 filter_policy)
2255 {
2256         struct hci_conn *conn;
2257
2258         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2259                                        peer_addr_type);
2260         if (!conn)
2261                 return;
2262
2263         /* Store the initiator and responder address information which
2264          * is needed for SMP. These values will not change during the
2265          * lifetime of the connection.
2266          */
2267         conn->init_addr_type = own_address_type;
2268         if (own_address_type == ADDR_LE_DEV_RANDOM)
2269                 bacpy(&conn->init_addr, &hdev->random_addr);
2270         else
2271                 bacpy(&conn->init_addr, &hdev->bdaddr);
2272
2273         conn->resp_addr_type = peer_addr_type;
2274         bacpy(&conn->resp_addr, peer_addr);
2275
2276         /* We don't want the connection attempt to stick around
2277          * indefinitely since LE doesn't have a page timeout concept
2278          * like BR/EDR. Set a timer for any connection that doesn't use
2279          * the white list for connecting.
2280          */
2281         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2282                 queue_delayed_work(conn->hdev->workqueue,
2283                                    &conn->le_conn_timeout,
2284                                    conn->conn_timeout);
2285 }
2286
2287 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2288 {
2289         struct hci_cp_le_create_conn *cp;
2290
2291         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2292
2293         /* All connection failure handling is taken care of by the
2294          * hci_le_conn_failed function which is triggered by the HCI
2295          * request completion callbacks used for connecting.
2296          */
2297         if (status)
2298                 return;
2299
2300         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2301         if (!cp)
2302                 return;
2303
2304         hci_dev_lock(hdev);
2305
2306         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2307                           cp->own_address_type, cp->filter_policy);
2308
2309         hci_dev_unlock(hdev);
2310 }
2311
2312 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2313 {
2314         struct hci_cp_le_ext_create_conn *cp;
2315
2316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2317
2318         /* All connection failure handling is taken care of by the
2319          * hci_le_conn_failed function which is triggered by the HCI
2320          * request completion callbacks used for connecting.
2321          */
2322         if (status)
2323                 return;
2324
2325         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2326         if (!cp)
2327                 return;
2328
2329         hci_dev_lock(hdev);
2330
2331         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2332                           cp->own_addr_type, cp->filter_policy);
2333
2334         hci_dev_unlock(hdev);
2335 }
2336
2337 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2338 {
2339         struct hci_cp_le_read_remote_features *cp;
2340         struct hci_conn *conn;
2341
2342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2343
2344         if (!status)
2345                 return;
2346
2347         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2348         if (!cp)
2349                 return;
2350
2351         hci_dev_lock(hdev);
2352
2353         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2354         if (conn) {
2355                 if (conn->state == BT_CONFIG) {
2356                         hci_connect_cfm(conn, status);
2357                         hci_conn_drop(conn);
2358                 }
2359         }
2360
2361         hci_dev_unlock(hdev);
2362 }
2363
2364 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2365 {
2366         struct hci_cp_le_start_enc *cp;
2367         struct hci_conn *conn;
2368
2369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2370
2371         if (!status)
2372                 return;
2373
2374         hci_dev_lock(hdev);
2375
2376         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2377         if (!cp)
2378                 goto unlock;
2379
2380         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2381         if (!conn)
2382                 goto unlock;
2383
2384         if (conn->state != BT_CONNECTED)
2385                 goto unlock;
2386
2387         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2388         hci_conn_drop(conn);
2389
2390 unlock:
2391         hci_dev_unlock(hdev);
2392 }
2393
2394 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2395 {
2396         struct hci_cp_switch_role *cp;
2397         struct hci_conn *conn;
2398
2399         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2400
2401         if (!status)
2402                 return;
2403
2404         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2405         if (!cp)
2406                 return;
2407
2408         hci_dev_lock(hdev);
2409
2410         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2411         if (conn)
2412                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2413
2414         hci_dev_unlock(hdev);
2415 }
2416
2417 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2418 {
2419         __u8 status = *((__u8 *) skb->data);
2420         struct discovery_state *discov = &hdev->discovery;
2421         struct inquiry_entry *e;
2422
2423         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2424
2425         hci_conn_check_pending(hdev);
2426
2427         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2428                 return;
2429
2430         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2431         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2432
2433         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2434                 return;
2435
2436         hci_dev_lock(hdev);
2437
2438         if (discov->state != DISCOVERY_FINDING)
2439                 goto unlock;
2440
2441         if (list_empty(&discov->resolve)) {
2442                 /* When BR/EDR inquiry is active and no LE scanning is in
2443                  * progress, then change discovery state to indicate completion.
2444                  *
2445                  * When running LE scanning and BR/EDR inquiry simultaneously
2446                  * and the LE scan already finished, then change the discovery
2447                  * state to indicate completion.
2448                  */
2449                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2450                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2451                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2452                 goto unlock;
2453         }
2454
2455         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2456         if (e && hci_resolve_name(hdev, e) == 0) {
2457                 e->name_state = NAME_PENDING;
2458                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2459         } else {
2460                 /* When BR/EDR inquiry is active and no LE scanning is in
2461                  * progress, then change discovery state to indicate completion.
2462                  *
2463                  * When running LE scanning and BR/EDR inquiry simultaneously
2464                  * and the LE scan already finished, then change the discovery
2465                  * state to indicate completion.
2466                  */
2467                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2468                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2469                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2470         }
2471
2472 unlock:
2473         hci_dev_unlock(hdev);
2474 }
2475
2476 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2477 {
2478         struct inquiry_data data;
2479         struct inquiry_info *info = (void *) (skb->data + 1);
2480         int num_rsp = *((__u8 *) skb->data);
2481
2482         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2483
2484         if (!num_rsp)
2485                 return;
2486
2487         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2488                 return;
2489
2490         hci_dev_lock(hdev);
2491
2492         for (; num_rsp; num_rsp--, info++) {
2493                 u32 flags;
2494
2495                 bacpy(&data.bdaddr, &info->bdaddr);
2496                 data.pscan_rep_mode     = info->pscan_rep_mode;
2497                 data.pscan_period_mode  = info->pscan_period_mode;
2498                 data.pscan_mode         = info->pscan_mode;
2499                 memcpy(data.dev_class, info->dev_class, 3);
2500                 data.clock_offset       = info->clock_offset;
2501                 data.rssi               = HCI_RSSI_INVALID;
2502                 data.ssp_mode           = 0x00;
2503
2504                 flags = hci_inquiry_cache_update(hdev, &data, false);
2505
2506                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2507                                   info->dev_class, HCI_RSSI_INVALID,
2508                                   flags, NULL, 0, NULL, 0);
2509         }
2510
2511         hci_dev_unlock(hdev);
2512 }
2513
2514 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2515 {
2516         struct hci_ev_conn_complete *ev = (void *) skb->data;
2517         struct hci_conn *conn;
2518
2519         BT_DBG("%s", hdev->name);
2520
2521         hci_dev_lock(hdev);
2522
2523         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2524         if (!conn) {
2525                 if (ev->link_type != SCO_LINK)
2526                         goto unlock;
2527
2528                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2529                 if (!conn)
2530                         goto unlock;
2531
2532                 conn->type = SCO_LINK;
2533         }
2534
2535         if (!ev->status) {
2536                 conn->handle = __le16_to_cpu(ev->handle);
2537
2538                 if (conn->type == ACL_LINK) {
2539                         conn->state = BT_CONFIG;
2540                         hci_conn_hold(conn);
2541
2542                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2543                             !hci_find_link_key(hdev, &ev->bdaddr))
2544                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2545                         else
2546                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2547                 } else
2548                         conn->state = BT_CONNECTED;
2549
2550                 hci_debugfs_create_conn(conn);
2551                 hci_conn_add_sysfs(conn);
2552
2553                 if (test_bit(HCI_AUTH, &hdev->flags))
2554                         set_bit(HCI_CONN_AUTH, &conn->flags);
2555
2556                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2557                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2558
2559                 /* Get remote features */
2560                 if (conn->type == ACL_LINK) {
2561                         struct hci_cp_read_remote_features cp;
2562                         cp.handle = ev->handle;
2563                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2564                                      sizeof(cp), &cp);
2565
2566                         hci_req_update_scan(hdev);
2567                 }
2568
2569                 /* Set packet type for incoming connection */
2570                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2571                         struct hci_cp_change_conn_ptype cp;
2572                         cp.handle = ev->handle;
2573                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2574                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2575                                      &cp);
2576                 }
2577 #ifdef TIZEN_BT
2578                 if (get_link_mode(conn) & HCI_LM_MASTER)
2579                         hci_conn_change_supervision_timeout(conn,
2580                                         LINK_SUPERVISION_TIMEOUT);
2581 #endif
2582         } else {
2583                 conn->state = BT_CLOSED;
2584                 if (conn->type == ACL_LINK)
2585                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2586                                             conn->dst_type, ev->status);
2587         }
2588
2589         if (conn->type == ACL_LINK)
2590                 hci_sco_setup(conn, ev->status);
2591
2592         if (ev->status) {
2593                 hci_connect_cfm(conn, ev->status);
2594                 hci_conn_del(conn);
2595         } else if (ev->link_type != ACL_LINK)
2596                 hci_connect_cfm(conn, ev->status);
2597
2598 unlock:
2599         hci_dev_unlock(hdev);
2600
2601         hci_conn_check_pending(hdev);
2602 }
2603
2604 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2605 {
2606         struct hci_cp_reject_conn_req cp;
2607
2608         bacpy(&cp.bdaddr, bdaddr);
2609         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2610         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2611 }
2612
2613 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2614 {
2615         struct hci_ev_conn_request *ev = (void *) skb->data;
2616         int mask = hdev->link_mode;
2617         struct inquiry_entry *ie;
2618         struct hci_conn *conn;
2619         __u8 flags = 0;
2620
2621         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2622                ev->link_type);
2623
2624         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2625                                       &flags);
2626
2627         if (!(mask & HCI_LM_ACCEPT)) {
2628                 hci_reject_conn(hdev, &ev->bdaddr);
2629                 return;
2630         }
2631
2632         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2633                                    BDADDR_BREDR)) {
2634                 hci_reject_conn(hdev, &ev->bdaddr);
2635                 return;
2636         }
2637
2638         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2639          * connection. These features are only touched through mgmt so
2640          * only do the checks if HCI_MGMT is set.
2641          */
2642         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2643             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2644             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2645                                     BDADDR_BREDR)) {
2646                     hci_reject_conn(hdev, &ev->bdaddr);
2647                     return;
2648         }
2649
2650         /* Connection accepted */
2651
2652         hci_dev_lock(hdev);
2653
2654         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2655         if (ie)
2656                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2657
2658 #ifdef TIZEN_BT
2659                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2660                     hci_conn_hash_lookup_sco(hdev)) {
2661                         struct hci_cp_reject_conn_req cp;
2662
2663                         bacpy(&cp.bdaddr, &ev->bdaddr);
2664                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2665                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2666                                      sizeof(cp), &cp);
2667                         hci_dev_unlock(hdev);
2668                         return;
2669                 }
2670 #endif
2671
2672         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2673                         &ev->bdaddr);
2674         if (!conn) {
2675                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2676                                     HCI_ROLE_SLAVE);
2677                 if (!conn) {
2678                         bt_dev_err(hdev, "no memory for new connection");
2679                         hci_dev_unlock(hdev);
2680                         return;
2681                 }
2682         }
2683
2684         memcpy(conn->dev_class, ev->dev_class, 3);
2685
2686         hci_dev_unlock(hdev);
2687
2688         if (ev->link_type == ACL_LINK ||
2689             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2690                 struct hci_cp_accept_conn_req cp;
2691                 conn->state = BT_CONNECT;
2692
2693                 bacpy(&cp.bdaddr, &ev->bdaddr);
2694
2695                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2696                         cp.role = 0x00; /* Become master */
2697                 else
2698                         cp.role = 0x01; /* Remain slave */
2699
2700                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2701         } else if (!(flags & HCI_PROTO_DEFER)) {
2702                 struct hci_cp_accept_sync_conn_req cp;
2703                 conn->state = BT_CONNECT;
2704
2705                 bacpy(&cp.bdaddr, &ev->bdaddr);
2706                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2707
2708                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2709                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2710                 cp.max_latency    = cpu_to_le16(0xffff);
2711                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2712                 cp.retrans_effort = 0xff;
2713
2714                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2715                              &cp);
2716         } else {
2717                 conn->state = BT_CONNECT2;
2718                 hci_connect_cfm(conn, 0);
2719         }
2720 }
2721
2722 static u8 hci_to_mgmt_reason(u8 err)
2723 {
2724         switch (err) {
2725         case HCI_ERROR_CONNECTION_TIMEOUT:
2726                 return MGMT_DEV_DISCONN_TIMEOUT;
2727         case HCI_ERROR_REMOTE_USER_TERM:
2728         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2729         case HCI_ERROR_REMOTE_POWER_OFF:
2730                 return MGMT_DEV_DISCONN_REMOTE;
2731         case HCI_ERROR_LOCAL_HOST_TERM:
2732                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2733         default:
2734                 return MGMT_DEV_DISCONN_UNKNOWN;
2735         }
2736 }
2737
2738 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2739 {
2740         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2741         u8 reason;
2742         struct hci_conn_params *params;
2743         struct hci_conn *conn;
2744         bool mgmt_connected;
2745         u8 type;
2746
2747         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2748
2749         hci_dev_lock(hdev);
2750
2751         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2752         if (!conn)
2753                 goto unlock;
2754
2755         if (ev->status) {
2756                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2757                                        conn->dst_type, ev->status);
2758                 goto unlock;
2759         }
2760
2761         conn->state = BT_CLOSED;
2762
2763         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2764
2765         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2766                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2767         else
2768                 reason = hci_to_mgmt_reason(ev->reason);
2769
2770         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2771                                 reason, mgmt_connected);
2772
2773         if (conn->type == ACL_LINK) {
2774                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2775                         hci_remove_link_key(hdev, &conn->dst);
2776
2777                 hci_req_update_scan(hdev);
2778         }
2779
2780         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2781         if (params) {
2782                 switch (params->auto_connect) {
2783                 case HCI_AUTO_CONN_LINK_LOSS:
2784                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2785                                 break;
2786                         /* Fall through */
2787
2788                 case HCI_AUTO_CONN_DIRECT:
2789                 case HCI_AUTO_CONN_ALWAYS:
2790                         list_del_init(&params->action);
2791                         list_add(&params->action, &hdev->pend_le_conns);
2792                         hci_update_background_scan(hdev);
2793                         break;
2794
2795                 default:
2796                         break;
2797                 }
2798         }
2799
2800         type = conn->type;
2801
2802         hci_disconn_cfm(conn, ev->reason);
2803         hci_conn_del(conn);
2804
2805         /* Re-enable advertising if necessary, since it might
2806          * have been disabled by the connection. From the
2807          * HCI_LE_Set_Advertise_Enable command description in
2808          * the core specification (v4.0):
2809          * "The Controller shall continue advertising until the Host
2810          * issues an LE_Set_Advertise_Enable command with
2811          * Advertising_Enable set to 0x00 (Advertising is disabled)
2812          * or until a connection is created or until the Advertising
2813          * is timed out due to Directed Advertising."
2814          */
2815         if (type == LE_LINK)
2816                 hci_req_reenable_advertising(hdev);
2817
2818 #ifdef TIZEN_BT
2819         if (type == ACL_LINK && !hci_conn_num(hdev, ACL_LINK)) {
2820                 int iscan;
2821                 int pscan;
2822
2823                 iscan = test_bit(HCI_ISCAN, &hdev->flags);
2824                 pscan = test_bit(HCI_PSCAN, &hdev->flags);
2825                 if (!iscan && !pscan) {
2826                         u8 scan_enable = SCAN_PAGE;
2827
2828                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE,
2829                                      sizeof(scan_enable), &scan_enable);
2830                 }
2831         }
2832 #endif
2833
2834 unlock:
2835         hci_dev_unlock(hdev);
2836 }
2837
2838 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2839 {
2840         struct hci_ev_auth_complete *ev = (void *) skb->data;
2841         struct hci_conn *conn;
2842
2843         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2844
2845         hci_dev_lock(hdev);
2846
2847         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2848         if (!conn)
2849                 goto unlock;
2850
2851 #ifdef TIZEN_BT
2852         /*  PIN or Key Missing patch */
2853         BT_DBG("remote_auth %x, remote_cap %x, auth_type %x, io_capability %x",
2854                conn->remote_auth, conn->remote_cap,
2855                conn->auth_type, conn->io_capability);
2856
2857         if (ev->status == 0x06 && hci_conn_ssp_enabled(conn)) {
2858                 struct hci_cp_auth_requested cp;
2859
2860                 BT_DBG("Pin or key missing");
2861                 hci_remove_link_key(hdev, &conn->dst);
2862                 cp.handle = cpu_to_le16(conn->handle);
2863                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
2864                              sizeof(cp), &cp);
2865                 goto unlock;
2866         }
2867 #endif
2868
2869         if (!ev->status) {
2870                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2871
2872                 if (!hci_conn_ssp_enabled(conn) &&
2873                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2874                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2875                 } else {
2876                         set_bit(HCI_CONN_AUTH, &conn->flags);
2877                         conn->sec_level = conn->pending_sec_level;
2878                 }
2879         } else {
2880                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2881                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2882
2883                 mgmt_auth_failed(conn, ev->status);
2884         }
2885
2886         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2887         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2888
2889         if (conn->state == BT_CONFIG) {
2890                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2891                         struct hci_cp_set_conn_encrypt cp;
2892                         cp.handle  = ev->handle;
2893                         cp.encrypt = 0x01;
2894                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2895                                      &cp);
2896                 } else {
2897                         conn->state = BT_CONNECTED;
2898                         hci_connect_cfm(conn, ev->status);
2899                         hci_conn_drop(conn);
2900                 }
2901         } else {
2902                 hci_auth_cfm(conn, ev->status);
2903
2904                 hci_conn_hold(conn);
2905                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2906                 hci_conn_drop(conn);
2907         }
2908
2909         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2910                 if (!ev->status) {
2911                         struct hci_cp_set_conn_encrypt cp;
2912                         cp.handle  = ev->handle;
2913                         cp.encrypt = 0x01;
2914                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2915                                      &cp);
2916                 } else {
2917                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2918                         hci_encrypt_cfm(conn, ev->status, 0x00);
2919                 }
2920         }
2921
2922 unlock:
2923         hci_dev_unlock(hdev);
2924 }
2925
2926 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2927 {
2928         struct hci_ev_remote_name *ev = (void *) skb->data;
2929         struct hci_conn *conn;
2930
2931         BT_DBG("%s", hdev->name);
2932
2933         hci_conn_check_pending(hdev);
2934
2935         hci_dev_lock(hdev);
2936
2937         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2938
2939         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2940                 goto check_auth;
2941
2942         if (ev->status == 0)
2943                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2944                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2945         else
2946                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2947
2948 check_auth:
2949         if (!conn)
2950                 goto unlock;
2951
2952         if (!hci_outgoing_auth_needed(hdev, conn))
2953                 goto unlock;
2954
2955         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2956                 struct hci_cp_auth_requested cp;
2957
2958                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2959
2960                 cp.handle = __cpu_to_le16(conn->handle);
2961                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2962         }
2963
2964 unlock:
2965         hci_dev_unlock(hdev);
2966 }
2967
2968 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2969                                        u16 opcode, struct sk_buff *skb)
2970 {
2971         const struct hci_rp_read_enc_key_size *rp;
2972         struct hci_conn *conn;
2973         u16 handle;
2974
2975         BT_DBG("%s status 0x%02x", hdev->name, status);
2976
2977         if (!skb || skb->len < sizeof(*rp)) {
2978                 bt_dev_err(hdev, "invalid read key size response");
2979                 return;
2980         }
2981
2982         rp = (void *)skb->data;
2983         handle = le16_to_cpu(rp->handle);
2984
2985         hci_dev_lock(hdev);
2986
2987         conn = hci_conn_hash_lookup_handle(hdev, handle);
2988         if (!conn)
2989                 goto unlock;
2990
2991         /* If we fail to read the encryption key size, assume maximum
2992          * (which is the same we do also when this HCI command isn't
2993          * supported.
2994          */
2995         if (rp->status) {
2996                 bt_dev_err(hdev, "failed to read key size for handle %u",
2997                            handle);
2998                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2999         } else {
3000                 conn->enc_key_size = rp->key_size;
3001         }
3002
3003         if (conn->state == BT_CONFIG) {
3004                 conn->state = BT_CONNECTED;
3005                 hci_connect_cfm(conn, 0);
3006                 hci_conn_drop(conn);
3007         } else {
3008                 u8 encrypt;
3009
3010                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
3011                         encrypt = 0x00;
3012                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
3013                         encrypt = 0x02;
3014                 else
3015                         encrypt = 0x01;
3016
3017                 hci_encrypt_cfm(conn, 0, encrypt);
3018         }
3019
3020 unlock:
3021         hci_dev_unlock(hdev);
3022 }
3023
3024 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3025 {
3026         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3027         struct hci_conn *conn;
3028
3029         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3030
3031         hci_dev_lock(hdev);
3032
3033         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3034         if (!conn)
3035                 goto unlock;
3036
3037         if (!ev->status) {
3038                 if (ev->encrypt) {
3039                         /* Encryption implies authentication */
3040                         set_bit(HCI_CONN_AUTH, &conn->flags);
3041                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3042                         conn->sec_level = conn->pending_sec_level;
3043
3044                         /* P-256 authentication key implies FIPS */
3045                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3046                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3047
3048                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3049                             conn->type == LE_LINK)
3050                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3051                 } else {
3052                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3053                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3054                 }
3055         }
3056
3057         /* We should disregard the current RPA and generate a new one
3058          * whenever the encryption procedure fails.
3059          */
3060         if (ev->status && conn->type == LE_LINK) {
3061                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3062                 hci_adv_instances_set_rpa_expired(hdev, true);
3063         }
3064
3065         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3066
3067         if (ev->status && conn->state == BT_CONNECTED) {
3068                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3069                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3070
3071                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3072                 hci_conn_drop(conn);
3073                 goto unlock;
3074         }
3075
3076         /* In Secure Connections Only mode, do not allow any connections
3077          * that are not encrypted with AES-CCM using a P-256 authenticated
3078          * combination key.
3079          */
3080         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
3081             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
3082              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
3083                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
3084                 hci_conn_drop(conn);
3085                 goto unlock;
3086         }
3087
3088         /* Try reading the encryption key size for encrypted ACL links */
3089         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3090                 struct hci_cp_read_enc_key_size cp;
3091                 struct hci_request req;
3092
3093                 /* Only send HCI_Read_Encryption_Key_Size if the
3094                  * controller really supports it. If it doesn't, assume
3095                  * the default size (16).
3096                  */
3097                 if (!(hdev->commands[20] & 0x10)) {
3098                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3099                         goto notify;
3100                 }
3101
3102                 hci_req_init(&req, hdev);
3103
3104                 cp.handle = cpu_to_le16(conn->handle);
3105                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3106
3107                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3108                         bt_dev_err(hdev, "sending read key size failed");
3109                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3110                         goto notify;
3111                 }
3112
3113                 goto unlock;
3114         }
3115
3116 notify:
3117         if (conn->state == BT_CONFIG) {
3118                 if (!ev->status)
3119                         conn->state = BT_CONNECTED;
3120
3121                 hci_connect_cfm(conn, ev->status);
3122                 hci_conn_drop(conn);
3123         } else
3124                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
3125
3126 unlock:
3127         hci_dev_unlock(hdev);
3128 }
3129
3130 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3131                                              struct sk_buff *skb)
3132 {
3133         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3134         struct hci_conn *conn;
3135
3136         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3137
3138         hci_dev_lock(hdev);
3139
3140         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3141         if (conn) {
3142                 if (!ev->status)
3143                         set_bit(HCI_CONN_SECURE, &conn->flags);
3144
3145                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3146
3147                 hci_key_change_cfm(conn, ev->status);
3148         }
3149
3150         hci_dev_unlock(hdev);
3151 }
3152
3153 static void hci_remote_features_evt(struct hci_dev *hdev,
3154                                     struct sk_buff *skb)
3155 {
3156         struct hci_ev_remote_features *ev = (void *) skb->data;
3157         struct hci_conn *conn;
3158
3159         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3160
3161         hci_dev_lock(hdev);
3162
3163         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3164         if (!conn)
3165                 goto unlock;
3166
3167         if (!ev->status)
3168                 memcpy(conn->features[0], ev->features, 8);
3169
3170         if (conn->state != BT_CONFIG)
3171                 goto unlock;
3172
3173         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3174             lmp_ext_feat_capable(conn)) {
3175                 struct hci_cp_read_remote_ext_features cp;
3176                 cp.handle = ev->handle;
3177                 cp.page = 0x01;
3178                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3179                              sizeof(cp), &cp);
3180                 goto unlock;
3181         }
3182
3183         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3184                 struct hci_cp_remote_name_req cp;
3185                 memset(&cp, 0, sizeof(cp));
3186                 bacpy(&cp.bdaddr, &conn->dst);
3187                 cp.pscan_rep_mode = 0x02;
3188                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3189         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3190                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3191
3192         if (!hci_outgoing_auth_needed(hdev, conn)) {
3193                 conn->state = BT_CONNECTED;
3194                 hci_connect_cfm(conn, ev->status);
3195                 hci_conn_drop(conn);
3196         }
3197
3198 unlock:
3199         hci_dev_unlock(hdev);
3200 }
3201
3202 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3203                                  u16 *opcode, u8 *status,
3204                                  hci_req_complete_t *req_complete,
3205                                  hci_req_complete_skb_t *req_complete_skb)
3206 {
3207         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3208
3209         *opcode = __le16_to_cpu(ev->opcode);
3210         *status = skb->data[sizeof(*ev)];
3211
3212         skb_pull(skb, sizeof(*ev));
3213
3214         switch (*opcode) {
3215         case HCI_OP_INQUIRY_CANCEL:
3216                 hci_cc_inquiry_cancel(hdev, skb);
3217                 break;
3218
3219         case HCI_OP_PERIODIC_INQ:
3220                 hci_cc_periodic_inq(hdev, skb);
3221                 break;
3222
3223         case HCI_OP_EXIT_PERIODIC_INQ:
3224                 hci_cc_exit_periodic_inq(hdev, skb);
3225                 break;
3226
3227         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3228                 hci_cc_remote_name_req_cancel(hdev, skb);
3229                 break;
3230
3231         case HCI_OP_ROLE_DISCOVERY:
3232                 hci_cc_role_discovery(hdev, skb);
3233                 break;
3234
3235         case HCI_OP_READ_LINK_POLICY:
3236                 hci_cc_read_link_policy(hdev, skb);
3237                 break;
3238
3239         case HCI_OP_WRITE_LINK_POLICY:
3240                 hci_cc_write_link_policy(hdev, skb);
3241                 break;
3242
3243         case HCI_OP_READ_DEF_LINK_POLICY:
3244                 hci_cc_read_def_link_policy(hdev, skb);
3245                 break;
3246
3247         case HCI_OP_WRITE_DEF_LINK_POLICY:
3248                 hci_cc_write_def_link_policy(hdev, skb);
3249                 break;
3250
3251         case HCI_OP_RESET:
3252                 hci_cc_reset(hdev, skb);
3253                 break;
3254
3255         case HCI_OP_READ_STORED_LINK_KEY:
3256                 hci_cc_read_stored_link_key(hdev, skb);
3257                 break;
3258
3259         case HCI_OP_DELETE_STORED_LINK_KEY:
3260                 hci_cc_delete_stored_link_key(hdev, skb);
3261                 break;
3262
3263         case HCI_OP_WRITE_LOCAL_NAME:
3264                 hci_cc_write_local_name(hdev, skb);
3265                 break;
3266
3267         case HCI_OP_READ_LOCAL_NAME:
3268                 hci_cc_read_local_name(hdev, skb);
3269                 break;
3270
3271         case HCI_OP_WRITE_AUTH_ENABLE:
3272                 hci_cc_write_auth_enable(hdev, skb);
3273                 break;
3274
3275         case HCI_OP_WRITE_ENCRYPT_MODE:
3276                 hci_cc_write_encrypt_mode(hdev, skb);
3277                 break;
3278
3279         case HCI_OP_WRITE_SCAN_ENABLE:
3280                 hci_cc_write_scan_enable(hdev, skb);
3281                 break;
3282
3283         case HCI_OP_READ_CLASS_OF_DEV:
3284                 hci_cc_read_class_of_dev(hdev, skb);
3285                 break;
3286
3287         case HCI_OP_WRITE_CLASS_OF_DEV:
3288                 hci_cc_write_class_of_dev(hdev, skb);
3289                 break;
3290
3291         case HCI_OP_READ_VOICE_SETTING:
3292                 hci_cc_read_voice_setting(hdev, skb);
3293                 break;
3294
3295         case HCI_OP_WRITE_VOICE_SETTING:
3296                 hci_cc_write_voice_setting(hdev, skb);
3297                 break;
3298
3299         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3300                 hci_cc_read_num_supported_iac(hdev, skb);
3301                 break;
3302
3303         case HCI_OP_WRITE_SSP_MODE:
3304                 hci_cc_write_ssp_mode(hdev, skb);
3305                 break;
3306
3307         case HCI_OP_WRITE_SC_SUPPORT:
3308                 hci_cc_write_sc_support(hdev, skb);
3309                 break;
3310
3311         case HCI_OP_READ_LOCAL_VERSION:
3312                 hci_cc_read_local_version(hdev, skb);
3313                 break;
3314
3315         case HCI_OP_READ_LOCAL_COMMANDS:
3316                 hci_cc_read_local_commands(hdev, skb);
3317                 break;
3318
3319         case HCI_OP_READ_LOCAL_FEATURES:
3320                 hci_cc_read_local_features(hdev, skb);
3321                 break;
3322
3323         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3324                 hci_cc_read_local_ext_features(hdev, skb);
3325                 break;
3326
3327         case HCI_OP_READ_BUFFER_SIZE:
3328                 hci_cc_read_buffer_size(hdev, skb);
3329                 break;
3330
3331         case HCI_OP_READ_BD_ADDR:
3332                 hci_cc_read_bd_addr(hdev, skb);
3333                 break;
3334
3335         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3336                 hci_cc_read_page_scan_activity(hdev, skb);
3337                 break;
3338
3339         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3340                 hci_cc_write_page_scan_activity(hdev, skb);
3341                 break;
3342
3343         case HCI_OP_READ_PAGE_SCAN_TYPE:
3344                 hci_cc_read_page_scan_type(hdev, skb);
3345                 break;
3346
3347         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3348                 hci_cc_write_page_scan_type(hdev, skb);
3349                 break;
3350
3351         case HCI_OP_READ_DATA_BLOCK_SIZE:
3352                 hci_cc_read_data_block_size(hdev, skb);
3353                 break;
3354
3355         case HCI_OP_READ_FLOW_CONTROL_MODE:
3356                 hci_cc_read_flow_control_mode(hdev, skb);
3357                 break;
3358
3359         case HCI_OP_READ_LOCAL_AMP_INFO:
3360                 hci_cc_read_local_amp_info(hdev, skb);
3361                 break;
3362
3363         case HCI_OP_READ_CLOCK:
3364                 hci_cc_read_clock(hdev, skb);
3365                 break;
3366
3367         case HCI_OP_READ_INQ_RSP_TX_POWER:
3368                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3369                 break;
3370
3371         case HCI_OP_PIN_CODE_REPLY:
3372                 hci_cc_pin_code_reply(hdev, skb);
3373                 break;
3374
3375         case HCI_OP_PIN_CODE_NEG_REPLY:
3376                 hci_cc_pin_code_neg_reply(hdev, skb);
3377                 break;
3378
3379         case HCI_OP_READ_LOCAL_OOB_DATA:
3380                 hci_cc_read_local_oob_data(hdev, skb);
3381                 break;
3382
3383         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3384                 hci_cc_read_local_oob_ext_data(hdev, skb);
3385                 break;
3386
3387         case HCI_OP_LE_READ_BUFFER_SIZE:
3388                 hci_cc_le_read_buffer_size(hdev, skb);
3389                 break;
3390
3391         case HCI_OP_LE_READ_LOCAL_FEATURES:
3392                 hci_cc_le_read_local_features(hdev, skb);
3393                 break;
3394
3395         case HCI_OP_LE_READ_ADV_TX_POWER:
3396                 hci_cc_le_read_adv_tx_power(hdev, skb);
3397                 break;
3398
3399         case HCI_OP_USER_CONFIRM_REPLY:
3400                 hci_cc_user_confirm_reply(hdev, skb);
3401                 break;
3402
3403         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3404                 hci_cc_user_confirm_neg_reply(hdev, skb);
3405                 break;
3406
3407         case HCI_OP_USER_PASSKEY_REPLY:
3408                 hci_cc_user_passkey_reply(hdev, skb);
3409                 break;
3410
3411         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3412                 hci_cc_user_passkey_neg_reply(hdev, skb);
3413                 break;
3414
3415         case HCI_OP_LE_SET_RANDOM_ADDR:
3416                 hci_cc_le_set_random_addr(hdev, skb);
3417                 break;
3418
3419         case HCI_OP_LE_SET_ADV_ENABLE:
3420                 hci_cc_le_set_adv_enable(hdev, skb);
3421                 break;
3422
3423         case HCI_OP_LE_SET_SCAN_PARAM:
3424                 hci_cc_le_set_scan_param(hdev, skb);
3425                 break;
3426
3427         case HCI_OP_LE_SET_SCAN_ENABLE:
3428                 hci_cc_le_set_scan_enable(hdev, skb);
3429                 break;
3430
3431         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3432                 hci_cc_le_read_white_list_size(hdev, skb);
3433                 break;
3434
3435         case HCI_OP_LE_CLEAR_WHITE_LIST:
3436                 hci_cc_le_clear_white_list(hdev, skb);
3437                 break;
3438
3439         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3440                 hci_cc_le_add_to_white_list(hdev, skb);
3441                 break;
3442
3443         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3444                 hci_cc_le_del_from_white_list(hdev, skb);
3445                 break;
3446
3447         case HCI_OP_LE_READ_SUPPORTED_STATES:
3448                 hci_cc_le_read_supported_states(hdev, skb);
3449                 break;
3450
3451         case HCI_OP_LE_READ_DEF_DATA_LEN:
3452                 hci_cc_le_read_def_data_len(hdev, skb);
3453                 break;
3454
3455         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3456                 hci_cc_le_write_def_data_len(hdev, skb);
3457                 break;
3458
3459         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3460                 hci_cc_le_clear_resolv_list(hdev, skb);
3461                 break;
3462
3463         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3464                 hci_cc_le_read_resolv_list_size(hdev, skb);
3465                 break;
3466
3467         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3468                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3469                 break;
3470
3471         case HCI_OP_LE_READ_MAX_DATA_LEN:
3472                 hci_cc_le_read_max_data_len(hdev, skb);
3473                 break;
3474
3475         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3476                 hci_cc_write_le_host_supported(hdev, skb);
3477                 break;
3478
3479         case HCI_OP_LE_SET_ADV_PARAM:
3480                 hci_cc_set_adv_param(hdev, skb);
3481                 break;
3482
3483         case HCI_OP_READ_RSSI:
3484                 hci_cc_read_rssi(hdev, skb);
3485                 break;
3486
3487         case HCI_OP_READ_TX_POWER:
3488                 hci_cc_read_tx_power(hdev, skb);
3489                 break;
3490
3491         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3492                 hci_cc_write_ssp_debug_mode(hdev, skb);
3493                 break;
3494
3495         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3496                 hci_cc_le_set_ext_scan_param(hdev, skb);
3497                 break;
3498
3499         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3500                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3501                 break;
3502
3503         case HCI_OP_LE_SET_DEFAULT_PHY:
3504                 hci_cc_le_set_default_phy(hdev, skb);
3505                 break;
3506
3507         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3508                 hci_cc_le_read_num_adv_sets(hdev, skb);
3509                 break;
3510
3511         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3512                 hci_cc_set_ext_adv_param(hdev, skb);
3513                 break;
3514
3515         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3516                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3517                 break;
3518
3519         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3520                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3521                 break;
3522 #ifdef TIZEN_BT
3523         case HCI_OP_ENABLE_RSSI:
3524                 hci_cc_enable_rssi(hdev, skb);
3525                 break;
3526
3527         case HCI_OP_GET_RAW_RSSI:
3528                 hci_cc_get_raw_rssi(hdev, skb);
3529                 break;
3530 #endif
3531         default:
3532                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3533                 break;
3534         }
3535
3536         if (*opcode != HCI_OP_NOP)
3537                 cancel_delayed_work(&hdev->cmd_timer);
3538
3539         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3540                 atomic_set(&hdev->cmd_cnt, 1);
3541
3542         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3543                              req_complete_skb);
3544
3545         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3546                 bt_dev_err(hdev,
3547                            "unexpected event for opcode 0x%4.4x", *opcode);
3548                 return;
3549         }
3550
3551         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3552                 queue_work(hdev->workqueue, &hdev->cmd_work);
3553 }
3554
3555 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3556                                u16 *opcode, u8 *status,
3557                                hci_req_complete_t *req_complete,
3558                                hci_req_complete_skb_t *req_complete_skb)
3559 {
3560         struct hci_ev_cmd_status *ev = (void *) skb->data;
3561
3562         skb_pull(skb, sizeof(*ev));
3563
3564         *opcode = __le16_to_cpu(ev->opcode);
3565         *status = ev->status;
3566
3567         switch (*opcode) {
3568         case HCI_OP_INQUIRY:
3569                 hci_cs_inquiry(hdev, ev->status);
3570                 break;
3571
3572         case HCI_OP_CREATE_CONN:
3573                 hci_cs_create_conn(hdev, ev->status);
3574                 break;
3575
3576         case HCI_OP_DISCONNECT:
3577                 hci_cs_disconnect(hdev, ev->status);
3578                 break;
3579
3580         case HCI_OP_ADD_SCO:
3581                 hci_cs_add_sco(hdev, ev->status);
3582                 break;
3583
3584         case HCI_OP_AUTH_REQUESTED:
3585                 hci_cs_auth_requested(hdev, ev->status);
3586                 break;
3587
3588         case HCI_OP_SET_CONN_ENCRYPT:
3589                 hci_cs_set_conn_encrypt(hdev, ev->status);
3590                 break;
3591
3592         case HCI_OP_REMOTE_NAME_REQ:
3593                 hci_cs_remote_name_req(hdev, ev->status);
3594                 break;
3595
3596         case HCI_OP_READ_REMOTE_FEATURES:
3597                 hci_cs_read_remote_features(hdev, ev->status);
3598                 break;
3599
3600         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3601                 hci_cs_read_remote_ext_features(hdev, ev->status);
3602                 break;
3603
3604         case HCI_OP_SETUP_SYNC_CONN:
3605                 hci_cs_setup_sync_conn(hdev, ev->status);
3606                 break;
3607
3608         case HCI_OP_SNIFF_MODE:
3609                 hci_cs_sniff_mode(hdev, ev->status);
3610                 break;
3611
3612         case HCI_OP_EXIT_SNIFF_MODE:
3613                 hci_cs_exit_sniff_mode(hdev, ev->status);
3614                 break;
3615
3616         case HCI_OP_SWITCH_ROLE:
3617                 hci_cs_switch_role(hdev, ev->status);
3618                 break;
3619
3620         case HCI_OP_LE_CREATE_CONN:
3621                 hci_cs_le_create_conn(hdev, ev->status);
3622                 break;
3623
3624         case HCI_OP_LE_READ_REMOTE_FEATURES:
3625                 hci_cs_le_read_remote_features(hdev, ev->status);
3626                 break;
3627
3628         case HCI_OP_LE_START_ENC:
3629                 hci_cs_le_start_enc(hdev, ev->status);
3630                 break;
3631
3632         case HCI_OP_LE_EXT_CREATE_CONN:
3633                 hci_cs_le_ext_create_conn(hdev, ev->status);
3634                 break;
3635
3636         default:
3637                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3638                 break;
3639         }
3640
3641         if (*opcode != HCI_OP_NOP)
3642                 cancel_delayed_work(&hdev->cmd_timer);
3643
3644         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3645                 atomic_set(&hdev->cmd_cnt, 1);
3646
3647         /* Indicate request completion if the command failed. Also, if
3648          * we're not waiting for a special event and we get a success
3649          * command status we should try to flag the request as completed
3650          * (since for this kind of commands there will not be a command
3651          * complete event).
3652          */
3653         if (ev->status ||
3654             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3655                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3656                                      req_complete_skb);
3657
3658         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3659                 bt_dev_err(hdev,
3660                            "unexpected event for opcode 0x%4.4x", *opcode);
3661                 return;
3662         }
3663
3664         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3665                 queue_work(hdev->workqueue, &hdev->cmd_work);
3666 }
3667
3668 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3669 {
3670         struct hci_ev_hardware_error *ev = (void *) skb->data;
3671
3672 #ifdef TIZEN_BT
3673         hci_dev_lock(hdev);
3674         mgmt_hardware_error(hdev, ev->code);
3675         hci_dev_unlock(hdev);
3676 #endif
3677         hdev->hw_error_code = ev->code;
3678
3679         queue_work(hdev->req_workqueue, &hdev->error_reset);
3680 }
3681
3682 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3683 {
3684         struct hci_ev_role_change *ev = (void *) skb->data;
3685         struct hci_conn *conn;
3686
3687         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3688
3689         hci_dev_lock(hdev);
3690
3691         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3692         if (conn) {
3693                 if (!ev->status)
3694                         conn->role = ev->role;
3695
3696                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3697
3698                 hci_role_switch_cfm(conn, ev->status, ev->role);
3699 #ifdef TIZEN_BT
3700                 if (!ev->status && (get_link_mode(conn) & HCI_LM_MASTER))
3701                         hci_conn_change_supervision_timeout(conn,
3702                                         LINK_SUPERVISION_TIMEOUT);
3703 #endif
3704         }
3705
3706         hci_dev_unlock(hdev);
3707 }
3708
3709 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3710 {
3711         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3712         int i;
3713
3714         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3715                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3716                 return;
3717         }
3718
3719         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3720             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3721                 BT_DBG("%s bad parameters", hdev->name);
3722                 return;
3723         }
3724
3725         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3726
3727         for (i = 0; i < ev->num_hndl; i++) {
3728                 struct hci_comp_pkts_info *info = &ev->handles[i];
3729                 struct hci_conn *conn;
3730                 __u16  handle, count;
3731
3732                 handle = __le16_to_cpu(info->handle);
3733                 count  = __le16_to_cpu(info->count);
3734
3735                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3736                 if (!conn)
3737                         continue;
3738
3739                 conn->sent -= count;
3740
3741                 switch (conn->type) {
3742                 case ACL_LINK:
3743                         hdev->acl_cnt += count;
3744                         if (hdev->acl_cnt > hdev->acl_pkts)
3745                                 hdev->acl_cnt = hdev->acl_pkts;
3746                         break;
3747
3748                 case LE_LINK:
3749                         if (hdev->le_pkts) {
3750                                 hdev->le_cnt += count;
3751                                 if (hdev->le_cnt > hdev->le_pkts)
3752                                         hdev->le_cnt = hdev->le_pkts;
3753                         } else {
3754                                 hdev->acl_cnt += count;
3755                                 if (hdev->acl_cnt > hdev->acl_pkts)
3756                                         hdev->acl_cnt = hdev->acl_pkts;
3757                         }
3758                         break;
3759
3760                 case SCO_LINK:
3761                         hdev->sco_cnt += count;
3762                         if (hdev->sco_cnt > hdev->sco_pkts)
3763                                 hdev->sco_cnt = hdev->sco_pkts;
3764                         break;
3765
3766                 default:
3767                         bt_dev_err(hdev, "unknown type %d conn %p",
3768                                    conn->type, conn);
3769                         break;
3770                 }
3771         }
3772
3773         queue_work(hdev->workqueue, &hdev->tx_work);
3774 }
3775
3776 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3777                                                  __u16 handle)
3778 {
3779         struct hci_chan *chan;
3780
3781         switch (hdev->dev_type) {
3782         case HCI_PRIMARY:
3783                 return hci_conn_hash_lookup_handle(hdev, handle);
3784         case HCI_AMP:
3785                 chan = hci_chan_lookup_handle(hdev, handle);
3786                 if (chan)
3787                         return chan->conn;
3788                 break;
3789         default:
3790                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3791                 break;
3792         }
3793
3794         return NULL;
3795 }
3796
3797 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3798 {
3799         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3800         int i;
3801
3802         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3803                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3804                 return;
3805         }
3806
3807         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3808             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3809                 BT_DBG("%s bad parameters", hdev->name);
3810                 return;
3811         }
3812
3813         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3814                ev->num_hndl);
3815
3816         for (i = 0; i < ev->num_hndl; i++) {
3817                 struct hci_comp_blocks_info *info = &ev->handles[i];
3818                 struct hci_conn *conn = NULL;
3819                 __u16  handle, block_count;
3820
3821                 handle = __le16_to_cpu(info->handle);
3822                 block_count = __le16_to_cpu(info->blocks);
3823
3824                 conn = __hci_conn_lookup_handle(hdev, handle);
3825                 if (!conn)
3826                         continue;
3827
3828                 conn->sent -= block_count;
3829
3830                 switch (conn->type) {
3831                 case ACL_LINK:
3832                 case AMP_LINK:
3833                         hdev->block_cnt += block_count;
3834                         if (hdev->block_cnt > hdev->num_blocks)
3835                                 hdev->block_cnt = hdev->num_blocks;
3836                         break;
3837
3838                 default:
3839                         bt_dev_err(hdev, "unknown type %d conn %p",
3840                                    conn->type, conn);
3841                         break;
3842                 }
3843         }
3844
3845         queue_work(hdev->workqueue, &hdev->tx_work);
3846 }
3847
3848 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3849 {
3850         struct hci_ev_mode_change *ev = (void *) skb->data;
3851         struct hci_conn *conn;
3852
3853         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3854
3855         hci_dev_lock(hdev);
3856
3857         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3858         if (conn) {
3859                 conn->mode = ev->mode;
3860
3861                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3862                                         &conn->flags)) {
3863                         if (conn->mode == HCI_CM_ACTIVE)
3864                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3865                         else
3866                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3867                 }
3868
3869                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3870                         hci_sco_setup(conn, ev->status);
3871         }
3872
3873         hci_dev_unlock(hdev);
3874 }
3875
3876 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3877 {
3878         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3879         struct hci_conn *conn;
3880
3881         BT_DBG("%s", hdev->name);
3882
3883         hci_dev_lock(hdev);
3884
3885         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3886         if (!conn)
3887                 goto unlock;
3888
3889         if (conn->state == BT_CONNECTED) {
3890                 hci_conn_hold(conn);
3891                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3892                 hci_conn_drop(conn);
3893         }
3894
3895         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3896             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3897                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3898                              sizeof(ev->bdaddr), &ev->bdaddr);
3899         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3900                 u8 secure;
3901
3902                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3903                         secure = 1;
3904                 else
3905                         secure = 0;
3906
3907                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3908         }
3909
3910 unlock:
3911         hci_dev_unlock(hdev);
3912 }
3913
3914 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3915 {
3916         if (key_type == HCI_LK_CHANGED_COMBINATION)
3917                 return;
3918
3919         conn->pin_length = pin_len;
3920         conn->key_type = key_type;
3921
3922         switch (key_type) {
3923         case HCI_LK_LOCAL_UNIT:
3924         case HCI_LK_REMOTE_UNIT:
3925         case HCI_LK_DEBUG_COMBINATION:
3926                 return;
3927         case HCI_LK_COMBINATION:
3928                 if (pin_len == 16)
3929                         conn->pending_sec_level = BT_SECURITY_HIGH;
3930                 else
3931                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3932                 break;
3933         case HCI_LK_UNAUTH_COMBINATION_P192:
3934         case HCI_LK_UNAUTH_COMBINATION_P256:
3935                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3936                 break;
3937         case HCI_LK_AUTH_COMBINATION_P192:
3938                 conn->pending_sec_level = BT_SECURITY_HIGH;
3939                 break;
3940         case HCI_LK_AUTH_COMBINATION_P256:
3941                 conn->pending_sec_level = BT_SECURITY_FIPS;
3942                 break;
3943         }
3944 }
3945
3946 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3947 {
3948         struct hci_ev_link_key_req *ev = (void *) skb->data;
3949         struct hci_cp_link_key_reply cp;
3950         struct hci_conn *conn;
3951         struct link_key *key;
3952
3953         BT_DBG("%s", hdev->name);
3954
3955         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3956                 return;
3957
3958         hci_dev_lock(hdev);
3959
3960         key = hci_find_link_key(hdev, &ev->bdaddr);
3961         if (!key) {
3962                 BT_DBG("%s link key not found for %pMR", hdev->name,
3963                        &ev->bdaddr);
3964                 goto not_found;
3965         }
3966
3967         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3968                &ev->bdaddr);
3969
3970         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3971         if (conn) {
3972                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3973
3974                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3975                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3976                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3977                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3978                         goto not_found;
3979                 }
3980
3981                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3982                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3983                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3984                         BT_DBG("%s ignoring key unauthenticated for high security",
3985                                hdev->name);
3986                         goto not_found;
3987                 }
3988
3989                 conn_set_key(conn, key->type, key->pin_len);
3990         }
3991
3992         bacpy(&cp.bdaddr, &ev->bdaddr);
3993         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3994
3995         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3996
3997         hci_dev_unlock(hdev);
3998
3999         return;
4000
4001 not_found:
4002         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4003         hci_dev_unlock(hdev);
4004 }
4005
4006 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4007 {
4008         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4009         struct hci_conn *conn;
4010         struct link_key *key;
4011         bool persistent;
4012         u8 pin_len = 0;
4013
4014         BT_DBG("%s", hdev->name);
4015
4016         hci_dev_lock(hdev);
4017
4018         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4019         if (!conn)
4020                 goto unlock;
4021
4022         hci_conn_hold(conn);
4023         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4024         hci_conn_drop(conn);
4025
4026         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4027         conn_set_key(conn, ev->key_type, conn->pin_length);
4028
4029         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4030                 goto unlock;
4031
4032         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4033                                 ev->key_type, pin_len, &persistent);
4034         if (!key)
4035                 goto unlock;
4036
4037         /* Update connection information since adding the key will have
4038          * fixed up the type in the case of changed combination keys.
4039          */
4040         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4041                 conn_set_key(conn, key->type, key->pin_len);
4042
4043         mgmt_new_link_key(hdev, key, persistent);
4044
4045         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4046          * is set. If it's not set simply remove the key from the kernel
4047          * list (we've still notified user space about it but with
4048          * store_hint being 0).
4049          */
4050         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4051             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4052                 list_del_rcu(&key->list);
4053                 kfree_rcu(key, rcu);
4054                 goto unlock;
4055         }
4056
4057         if (persistent)
4058                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4059         else
4060                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4061
4062 unlock:
4063         hci_dev_unlock(hdev);
4064 }
4065
4066 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4067 {
4068         struct hci_ev_clock_offset *ev = (void *) skb->data;
4069         struct hci_conn *conn;
4070
4071         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4072
4073         hci_dev_lock(hdev);
4074
4075         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4076         if (conn && !ev->status) {
4077                 struct inquiry_entry *ie;
4078
4079                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4080                 if (ie) {
4081                         ie->data.clock_offset = ev->clock_offset;
4082                         ie->timestamp = jiffies;
4083                 }
4084         }
4085
4086         hci_dev_unlock(hdev);
4087 }
4088
4089 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4090 {
4091         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4092         struct hci_conn *conn;
4093
4094         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4095
4096         hci_dev_lock(hdev);
4097
4098         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4099         if (conn && !ev->status)
4100                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4101
4102         hci_dev_unlock(hdev);
4103 }
4104
4105 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4106 {
4107         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4108         struct inquiry_entry *ie;
4109
4110         BT_DBG("%s", hdev->name);
4111
4112         hci_dev_lock(hdev);
4113
4114         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4115         if (ie) {
4116                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4117                 ie->timestamp = jiffies;
4118         }
4119
4120         hci_dev_unlock(hdev);
4121 }
4122
4123 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4124                                              struct sk_buff *skb)
4125 {
4126         struct inquiry_data data;
4127         int num_rsp = *((__u8 *) skb->data);
4128
4129         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4130
4131         if (!num_rsp)
4132                 return;
4133
4134         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4135                 return;
4136
4137         hci_dev_lock(hdev);
4138
4139         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4140                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4141                 info = (void *) (skb->data + 1);
4142
4143                 for (; num_rsp; num_rsp--, info++) {
4144                         u32 flags;
4145
4146                         bacpy(&data.bdaddr, &info->bdaddr);
4147                         data.pscan_rep_mode     = info->pscan_rep_mode;
4148                         data.pscan_period_mode  = info->pscan_period_mode;
4149                         data.pscan_mode         = info->pscan_mode;
4150                         memcpy(data.dev_class, info->dev_class, 3);
4151                         data.clock_offset       = info->clock_offset;
4152                         data.rssi               = info->rssi;
4153                         data.ssp_mode           = 0x00;
4154
4155                         flags = hci_inquiry_cache_update(hdev, &data, false);
4156
4157                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4158                                           info->dev_class, info->rssi,
4159                                           flags, NULL, 0, NULL, 0);
4160                 }
4161         } else {
4162                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4163
4164                 for (; num_rsp; num_rsp--, info++) {
4165                         u32 flags;
4166
4167                         bacpy(&data.bdaddr, &info->bdaddr);
4168                         data.pscan_rep_mode     = info->pscan_rep_mode;
4169                         data.pscan_period_mode  = info->pscan_period_mode;
4170                         data.pscan_mode         = 0x00;
4171                         memcpy(data.dev_class, info->dev_class, 3);
4172                         data.clock_offset       = info->clock_offset;
4173                         data.rssi               = info->rssi;
4174                         data.ssp_mode           = 0x00;
4175
4176                         flags = hci_inquiry_cache_update(hdev, &data, false);
4177
4178                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4179                                           info->dev_class, info->rssi,
4180                                           flags, NULL, 0, NULL, 0);
4181                 }
4182         }
4183
4184         hci_dev_unlock(hdev);
4185 }
4186
4187 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4188                                         struct sk_buff *skb)
4189 {
4190         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4191         struct hci_conn *conn;
4192
4193         BT_DBG("%s", hdev->name);
4194
4195         hci_dev_lock(hdev);
4196
4197         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4198         if (!conn)
4199                 goto unlock;
4200
4201         if (ev->page < HCI_MAX_PAGES)
4202                 memcpy(conn->features[ev->page], ev->features, 8);
4203
4204         if (!ev->status && ev->page == 0x01) {
4205                 struct inquiry_entry *ie;
4206
4207                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4208                 if (ie)
4209                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4210
4211                 if (ev->features[0] & LMP_HOST_SSP) {
4212                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4213                 } else {
4214                         /* It is mandatory by the Bluetooth specification that
4215                          * Extended Inquiry Results are only used when Secure
4216                          * Simple Pairing is enabled, but some devices violate
4217                          * this.
4218                          *
4219                          * To make these devices work, the internal SSP
4220                          * enabled flag needs to be cleared if the remote host
4221                          * features do not indicate SSP support */
4222                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4223                 }
4224
4225                 if (ev->features[0] & LMP_HOST_SC)
4226                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4227         }
4228
4229         if (conn->state != BT_CONFIG)
4230                 goto unlock;
4231
4232         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4233                 struct hci_cp_remote_name_req cp;
4234                 memset(&cp, 0, sizeof(cp));
4235                 bacpy(&cp.bdaddr, &conn->dst);
4236                 cp.pscan_rep_mode = 0x02;
4237                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4238         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4239                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4240
4241         if (!hci_outgoing_auth_needed(hdev, conn)) {
4242                 conn->state = BT_CONNECTED;
4243                 hci_connect_cfm(conn, ev->status);
4244                 hci_conn_drop(conn);
4245         }
4246
4247 unlock:
4248         hci_dev_unlock(hdev);
4249 }
4250
4251 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4252                                        struct sk_buff *skb)
4253 {
4254         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4255         struct hci_conn *conn;
4256
4257         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4258
4259         hci_dev_lock(hdev);
4260
4261         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4262         if (!conn) {
4263                 if (ev->link_type == ESCO_LINK)
4264                         goto unlock;
4265
4266                 /* When the link type in the event indicates SCO connection
4267                  * and lookup of the connection object fails, then check
4268                  * if an eSCO connection object exists.
4269                  *
4270                  * The core limits the synchronous connections to either
4271                  * SCO or eSCO. The eSCO connection is preferred and tried
4272                  * to be setup first and until successfully established,
4273                  * the link type will be hinted as eSCO.
4274                  */
4275                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4276                 if (!conn)
4277                         goto unlock;
4278         }
4279
4280         switch (ev->status) {
4281         case 0x00:
4282                 conn->handle = __le16_to_cpu(ev->handle);
4283                 conn->state  = BT_CONNECTED;
4284                 conn->type   = ev->link_type;
4285
4286                 hci_debugfs_create_conn(conn);
4287                 hci_conn_add_sysfs(conn);
4288                 break;
4289
4290         case 0x10:      /* Connection Accept Timeout */
4291         case 0x0d:      /* Connection Rejected due to Limited Resources */
4292         case 0x11:      /* Unsupported Feature or Parameter Value */
4293         case 0x1c:      /* SCO interval rejected */
4294         case 0x1a:      /* Unsupported Remote Feature */
4295         case 0x1f:      /* Unspecified error */
4296         case 0x20:      /* Unsupported LMP Parameter value */
4297                 if (conn->out) {
4298                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4299                                         (hdev->esco_type & EDR_ESCO_MASK);
4300                         if (hci_setup_sync(conn, conn->link->handle))
4301                                 goto unlock;
4302                 }
4303                 /* fall through */
4304
4305         default:
4306                 conn->state = BT_CLOSED;
4307                 break;
4308         }
4309
4310         hci_connect_cfm(conn, ev->status);
4311         if (ev->status)
4312                 hci_conn_del(conn);
4313
4314 unlock:
4315         hci_dev_unlock(hdev);
4316 }
4317
4318 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4319 {
4320         size_t parsed = 0;
4321
4322         while (parsed < eir_len) {
4323                 u8 field_len = eir[0];
4324
4325                 if (field_len == 0)
4326                         return parsed;
4327
4328                 parsed += field_len + 1;
4329                 eir += field_len + 1;
4330         }
4331
4332         return eir_len;
4333 }
4334
4335 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4336                                             struct sk_buff *skb)
4337 {
4338         struct inquiry_data data;
4339         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4340         int num_rsp = *((__u8 *) skb->data);
4341         size_t eir_len;
4342
4343         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4344
4345         if (!num_rsp)
4346                 return;
4347
4348         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4349                 return;
4350
4351         hci_dev_lock(hdev);
4352
4353         for (; num_rsp; num_rsp--, info++) {
4354                 u32 flags;
4355                 bool name_known;
4356
4357                 bacpy(&data.bdaddr, &info->bdaddr);
4358                 data.pscan_rep_mode     = info->pscan_rep_mode;
4359                 data.pscan_period_mode  = info->pscan_period_mode;
4360                 data.pscan_mode         = 0x00;
4361                 memcpy(data.dev_class, info->dev_class, 3);
4362                 data.clock_offset       = info->clock_offset;
4363                 data.rssi               = info->rssi;
4364                 data.ssp_mode           = 0x01;
4365
4366                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4367                         name_known = eir_get_data(info->data,
4368                                                   sizeof(info->data),
4369                                                   EIR_NAME_COMPLETE, NULL);
4370                 else
4371                         name_known = true;
4372
4373                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4374
4375                 eir_len = eir_get_length(info->data, sizeof(info->data));
4376
4377                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4378                                   info->dev_class, info->rssi,
4379                                   flags, info->data, eir_len, NULL, 0);
4380         }
4381
4382         hci_dev_unlock(hdev);
4383 }
4384
4385 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4386                                          struct sk_buff *skb)
4387 {
4388         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4389         struct hci_conn *conn;
4390
4391         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4392                __le16_to_cpu(ev->handle));
4393
4394         hci_dev_lock(hdev);
4395
4396         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4397         if (!conn)
4398                 goto unlock;
4399
4400         /* For BR/EDR the necessary steps are taken through the
4401          * auth_complete event.
4402          */
4403         if (conn->type != LE_LINK)
4404                 goto unlock;
4405
4406         if (!ev->status)
4407                 conn->sec_level = conn->pending_sec_level;
4408
4409         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4410
4411         if (ev->status && conn->state == BT_CONNECTED) {
4412                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4413                 hci_conn_drop(conn);
4414                 goto unlock;
4415         }
4416
4417         if (conn->state == BT_CONFIG) {
4418                 if (!ev->status)
4419                         conn->state = BT_CONNECTED;
4420
4421                 hci_connect_cfm(conn, ev->status);
4422                 hci_conn_drop(conn);
4423         } else {
4424                 hci_auth_cfm(conn, ev->status);
4425
4426                 hci_conn_hold(conn);
4427                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4428                 hci_conn_drop(conn);
4429         }
4430
4431 unlock:
4432         hci_dev_unlock(hdev);
4433 }
4434
4435 static u8 hci_get_auth_req(struct hci_conn *conn)
4436 {
4437 #ifdef TIZEN_BT
4438         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4439                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4440                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4441                         return HCI_AT_GENERAL_BONDING_MITM;
4442         }
4443 #endif
4444
4445         /* If remote requests no-bonding follow that lead */
4446         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4447             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4448                 return conn->remote_auth | (conn->auth_type & 0x01);
4449
4450         /* If both remote and local have enough IO capabilities, require
4451          * MITM protection
4452          */
4453         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4454             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4455                 return conn->remote_auth | 0x01;
4456
4457         /* No MITM protection possible so ignore remote requirement */
4458         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4459 }
4460
4461 static u8 bredr_oob_data_present(struct hci_conn *conn)
4462 {
4463         struct hci_dev *hdev = conn->hdev;
4464         struct oob_data *data;
4465
4466         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4467         if (!data)
4468                 return 0x00;
4469
4470         if (bredr_sc_enabled(hdev)) {
4471                 /* When Secure Connections is enabled, then just
4472                  * return the present value stored with the OOB
4473                  * data. The stored value contains the right present
4474                  * information. However it can only be trusted when
4475                  * not in Secure Connection Only mode.
4476                  */
4477                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4478                         return data->present;
4479
4480                 /* When Secure Connections Only mode is enabled, then
4481                  * the P-256 values are required. If they are not
4482                  * available, then do not declare that OOB data is
4483                  * present.
4484                  */
4485                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4486                     !memcmp(data->hash256, ZERO_KEY, 16))
4487                         return 0x00;
4488
4489                 return 0x02;
4490         }
4491
4492         /* When Secure Connections is not enabled or actually
4493          * not supported by the hardware, then check that if
4494          * P-192 data values are present.
4495          */
4496         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4497             !memcmp(data->hash192, ZERO_KEY, 16))
4498                 return 0x00;
4499
4500         return 0x01;
4501 }
4502
4503 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4504 {
4505         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4506         struct hci_conn *conn;
4507
4508         BT_DBG("%s", hdev->name);
4509
4510         hci_dev_lock(hdev);
4511
4512         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4513         if (!conn)
4514                 goto unlock;
4515
4516         hci_conn_hold(conn);
4517
4518         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4519                 goto unlock;
4520
4521         /* Allow pairing if we're pairable, the initiators of the
4522          * pairing or if the remote is not requesting bonding.
4523          */
4524         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4525             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4526             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4527                 struct hci_cp_io_capability_reply cp;
4528
4529                 bacpy(&cp.bdaddr, &ev->bdaddr);
4530                 /* Change the IO capability from KeyboardDisplay
4531                  * to DisplayYesNo as it is not supported by BT spec. */
4532                 cp.capability = (conn->io_capability == 0x04) ?
4533                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4534
4535                 /* If we are initiators, there is no remote information yet */
4536                 if (conn->remote_auth == 0xff) {
4537                         /* Request MITM protection if our IO caps allow it
4538                          * except for the no-bonding case.
4539                          */
4540                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4541                             conn->auth_type != HCI_AT_NO_BONDING)
4542                                 conn->auth_type |= 0x01;
4543                 } else {
4544                         conn->auth_type = hci_get_auth_req(conn);
4545                 }
4546
4547                 /* If we're not bondable, force one of the non-bondable
4548                  * authentication requirement values.
4549                  */
4550                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4551                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4552
4553                 cp.authentication = conn->auth_type;
4554                 cp.oob_data = bredr_oob_data_present(conn);
4555
4556                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4557                              sizeof(cp), &cp);
4558         } else {
4559                 struct hci_cp_io_capability_neg_reply cp;
4560
4561                 bacpy(&cp.bdaddr, &ev->bdaddr);
4562                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4563
4564                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4565                              sizeof(cp), &cp);
4566         }
4567
4568 unlock:
4569         hci_dev_unlock(hdev);
4570 }
4571
4572 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4573 {
4574         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4575         struct hci_conn *conn;
4576
4577         BT_DBG("%s", hdev->name);
4578
4579         hci_dev_lock(hdev);
4580
4581         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4582         if (!conn)
4583                 goto unlock;
4584
4585         conn->remote_cap = ev->capability;
4586         conn->remote_auth = ev->authentication;
4587
4588 unlock:
4589         hci_dev_unlock(hdev);
4590 }
4591
4592 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4593                                          struct sk_buff *skb)
4594 {
4595         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4596         int loc_mitm, rem_mitm, confirm_hint = 0;
4597         struct hci_conn *conn;
4598
4599         BT_DBG("%s", hdev->name);
4600
4601         hci_dev_lock(hdev);
4602
4603         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4604                 goto unlock;
4605
4606         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4607         if (!conn)
4608                 goto unlock;
4609
4610         loc_mitm = (conn->auth_type & 0x01);
4611         rem_mitm = (conn->remote_auth & 0x01);
4612
4613         /* If we require MITM but the remote device can't provide that
4614          * (it has NoInputNoOutput) then reject the confirmation
4615          * request. We check the security level here since it doesn't
4616          * necessarily match conn->auth_type.
4617          */
4618         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4619             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4620                 BT_DBG("Rejecting request: remote device can't provide MITM");
4621                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4622                              sizeof(ev->bdaddr), &ev->bdaddr);
4623                 goto unlock;
4624         }
4625
4626         /* If no side requires MITM protection; auto-accept */
4627         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4628             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4629
4630                 /* If we're not the initiators request authorization to
4631                  * proceed from user space (mgmt_user_confirm with
4632                  * confirm_hint set to 1). The exception is if neither
4633                  * side had MITM or if the local IO capability is
4634                  * NoInputNoOutput, in which case we do auto-accept
4635                  */
4636                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4637                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4638                     (loc_mitm || rem_mitm)) {
4639                         BT_DBG("Confirming auto-accept as acceptor");
4640                         confirm_hint = 1;
4641                         goto confirm;
4642                 }
4643
4644                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4645                        hdev->auto_accept_delay);
4646
4647                 if (hdev->auto_accept_delay > 0) {
4648                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4649                         queue_delayed_work(conn->hdev->workqueue,
4650                                            &conn->auto_accept_work, delay);
4651                         goto unlock;
4652                 }
4653
4654                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4655                              sizeof(ev->bdaddr), &ev->bdaddr);
4656                 goto unlock;
4657         }
4658
4659 confirm:
4660         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4661                                   le32_to_cpu(ev->passkey), confirm_hint);
4662
4663 unlock:
4664         hci_dev_unlock(hdev);
4665 }
4666
4667 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4668                                          struct sk_buff *skb)
4669 {
4670         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4671
4672         BT_DBG("%s", hdev->name);
4673
4674         if (hci_dev_test_flag(hdev, HCI_MGMT))
4675                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4676 }
4677
4678 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4679                                         struct sk_buff *skb)
4680 {
4681         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4682         struct hci_conn *conn;
4683
4684         BT_DBG("%s", hdev->name);
4685
4686         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4687         if (!conn)
4688                 return;
4689
4690         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4691         conn->passkey_entered = 0;
4692
4693         if (hci_dev_test_flag(hdev, HCI_MGMT))
4694                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4695                                          conn->dst_type, conn->passkey_notify,
4696                                          conn->passkey_entered);
4697 }
4698
4699 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4700 {
4701         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4702         struct hci_conn *conn;
4703
4704         BT_DBG("%s", hdev->name);
4705
4706         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4707         if (!conn)
4708                 return;
4709
4710         switch (ev->type) {
4711         case HCI_KEYPRESS_STARTED:
4712                 conn->passkey_entered = 0;
4713                 return;
4714
4715         case HCI_KEYPRESS_ENTERED:
4716                 conn->passkey_entered++;
4717                 break;
4718
4719         case HCI_KEYPRESS_ERASED:
4720                 conn->passkey_entered--;
4721                 break;
4722
4723         case HCI_KEYPRESS_CLEARED:
4724                 conn->passkey_entered = 0;
4725                 break;
4726
4727         case HCI_KEYPRESS_COMPLETED:
4728                 return;
4729         }
4730
4731         if (hci_dev_test_flag(hdev, HCI_MGMT))
4732                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4733                                          conn->dst_type, conn->passkey_notify,
4734                                          conn->passkey_entered);
4735 }
4736
4737 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4738                                          struct sk_buff *skb)
4739 {
4740         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4741         struct hci_conn *conn;
4742
4743         BT_DBG("%s", hdev->name);
4744
4745         hci_dev_lock(hdev);
4746
4747         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4748         if (!conn)
4749                 goto unlock;
4750
4751         /* Reset the authentication requirement to unknown */
4752         conn->remote_auth = 0xff;
4753
4754         /* To avoid duplicate auth_failed events to user space we check
4755          * the HCI_CONN_AUTH_PEND flag which will be set if we
4756          * initiated the authentication. A traditional auth_complete
4757          * event gets always produced as initiator and is also mapped to
4758          * the mgmt_auth_failed event */
4759         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4760                 mgmt_auth_failed(conn, ev->status);
4761
4762         hci_conn_drop(conn);
4763
4764 unlock:
4765         hci_dev_unlock(hdev);
4766 }
4767
4768 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4769                                          struct sk_buff *skb)
4770 {
4771         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4772         struct inquiry_entry *ie;
4773         struct hci_conn *conn;
4774
4775         BT_DBG("%s", hdev->name);
4776
4777         hci_dev_lock(hdev);
4778
4779         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4780         if (conn)
4781                 memcpy(conn->features[1], ev->features, 8);
4782
4783         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4784         if (ie)
4785                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4786
4787         hci_dev_unlock(hdev);
4788 }
4789
4790 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4791                                             struct sk_buff *skb)
4792 {
4793         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4794         struct oob_data *data;
4795
4796         BT_DBG("%s", hdev->name);
4797
4798         hci_dev_lock(hdev);
4799
4800         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4801                 goto unlock;
4802
4803         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4804         if (!data) {
4805                 struct hci_cp_remote_oob_data_neg_reply cp;
4806
4807                 bacpy(&cp.bdaddr, &ev->bdaddr);
4808                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4809                              sizeof(cp), &cp);
4810                 goto unlock;
4811         }
4812
4813         if (bredr_sc_enabled(hdev)) {
4814                 struct hci_cp_remote_oob_ext_data_reply cp;
4815
4816                 bacpy(&cp.bdaddr, &ev->bdaddr);
4817                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4818                         memset(cp.hash192, 0, sizeof(cp.hash192));
4819                         memset(cp.rand192, 0, sizeof(cp.rand192));
4820                 } else {
4821                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4822                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4823                 }
4824                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4825                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4826
4827                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4828                              sizeof(cp), &cp);
4829         } else {
4830                 struct hci_cp_remote_oob_data_reply cp;
4831
4832                 bacpy(&cp.bdaddr, &ev->bdaddr);
4833                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4834                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4835
4836                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4837                              sizeof(cp), &cp);
4838         }
4839
4840 unlock:
4841         hci_dev_unlock(hdev);
4842 }
4843
4844 #if IS_ENABLED(CONFIG_BT_HS)
4845 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4846 {
4847         struct hci_ev_channel_selected *ev = (void *)skb->data;
4848         struct hci_conn *hcon;
4849
4850         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4851
4852         skb_pull(skb, sizeof(*ev));
4853
4854         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4855         if (!hcon)
4856                 return;
4857
4858         amp_read_loc_assoc_final_data(hdev, hcon);
4859 }
4860
4861 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4862                                       struct sk_buff *skb)
4863 {
4864         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4865         struct hci_conn *hcon, *bredr_hcon;
4866
4867         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4868                ev->status);
4869
4870         hci_dev_lock(hdev);
4871
4872         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4873         if (!hcon) {
4874                 hci_dev_unlock(hdev);
4875                 return;
4876         }
4877
4878         if (ev->status) {
4879                 hci_conn_del(hcon);
4880                 hci_dev_unlock(hdev);
4881                 return;
4882         }
4883
4884         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4885
4886         hcon->state = BT_CONNECTED;
4887         bacpy(&hcon->dst, &bredr_hcon->dst);
4888
4889         hci_conn_hold(hcon);
4890         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4891         hci_conn_drop(hcon);
4892
4893         hci_debugfs_create_conn(hcon);
4894         hci_conn_add_sysfs(hcon);
4895
4896         amp_physical_cfm(bredr_hcon, hcon);
4897
4898         hci_dev_unlock(hdev);
4899 }
4900
4901 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4902 {
4903         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4904         struct hci_conn *hcon;
4905         struct hci_chan *hchan;
4906         struct amp_mgr *mgr;
4907
4908         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4909                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4910                ev->status);
4911
4912         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4913         if (!hcon)
4914                 return;
4915
4916         /* Create AMP hchan */
4917         hchan = hci_chan_create(hcon);
4918         if (!hchan)
4919                 return;
4920
4921         hchan->handle = le16_to_cpu(ev->handle);
4922
4923         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4924
4925         mgr = hcon->amp_mgr;
4926         if (mgr && mgr->bredr_chan) {
4927                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4928
4929                 l2cap_chan_lock(bredr_chan);
4930
4931                 bredr_chan->conn->mtu = hdev->block_mtu;
4932                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4933                 hci_conn_hold(hcon);
4934
4935                 l2cap_chan_unlock(bredr_chan);
4936         }
4937 }
4938
4939 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4940                                              struct sk_buff *skb)
4941 {
4942         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4943         struct hci_chan *hchan;
4944
4945         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4946                le16_to_cpu(ev->handle), ev->status);
4947
4948         if (ev->status)
4949                 return;
4950
4951         hci_dev_lock(hdev);
4952
4953         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4954         if (!hchan)
4955                 goto unlock;
4956
4957         amp_destroy_logical_link(hchan, ev->reason);
4958
4959 unlock:
4960         hci_dev_unlock(hdev);
4961 }
4962
4963 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4964                                              struct sk_buff *skb)
4965 {
4966         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4967         struct hci_conn *hcon;
4968
4969         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4970
4971         if (ev->status)
4972                 return;
4973
4974         hci_dev_lock(hdev);
4975
4976         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4977         if (hcon) {
4978                 hcon->state = BT_CLOSED;
4979                 hci_conn_del(hcon);
4980         }
4981
4982         hci_dev_unlock(hdev);
4983 }
4984 #endif
4985
4986 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4987                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4988                         u16 interval, u16 latency, u16 supervision_timeout)
4989 {
4990         struct hci_conn_params *params;
4991         struct hci_conn *conn;
4992         struct smp_irk *irk;
4993         u8 addr_type;
4994
4995         hci_dev_lock(hdev);
4996
4997         /* All controllers implicitly stop advertising in the event of a
4998          * connection, so ensure that the state bit is cleared.
4999          */
5000         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5001
5002         conn = hci_lookup_le_connect(hdev);
5003         if (!conn) {
5004                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5005                 if (!conn) {
5006                         bt_dev_err(hdev, "no memory for new connection");
5007                         goto unlock;
5008                 }
5009
5010                 conn->dst_type = bdaddr_type;
5011
5012                 /* If we didn't have a hci_conn object previously
5013                  * but we're in master role this must be something
5014                  * initiated using a white list. Since white list based
5015                  * connections are not "first class citizens" we don't
5016                  * have full tracking of them. Therefore, we go ahead
5017                  * with a "best effort" approach of determining the
5018                  * initiator address based on the HCI_PRIVACY flag.
5019                  */
5020                 if (conn->out) {
5021                         conn->resp_addr_type = bdaddr_type;
5022                         bacpy(&conn->resp_addr, bdaddr);
5023                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5024                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5025                                 bacpy(&conn->init_addr, &hdev->rpa);
5026                         } else {
5027                                 hci_copy_identity_address(hdev,
5028                                                           &conn->init_addr,
5029                                                           &conn->init_addr_type);
5030                         }
5031                 }
5032         } else {
5033 #ifdef TIZEN_BT
5034                 /* LE auto connect */
5035                 bacpy(&conn->dst, bdaddr);
5036 #endif
5037                 cancel_delayed_work(&conn->le_conn_timeout);
5038         }
5039
5040         if (!conn->out) {
5041                 /* Set the responder (our side) address type based on
5042                  * the advertising address type.
5043                  */
5044                 conn->resp_addr_type = hdev->adv_addr_type;
5045                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5046                         /* In case of ext adv, resp_addr will be updated in
5047                          * Adv Terminated event.
5048                          */
5049                         if (!ext_adv_capable(hdev))
5050                                 bacpy(&conn->resp_addr, &hdev->random_addr);
5051                 } else {
5052                         bacpy(&conn->resp_addr, &hdev->bdaddr);
5053                 }
5054
5055                 conn->init_addr_type = bdaddr_type;
5056                 bacpy(&conn->init_addr, bdaddr);
5057
5058                 /* For incoming connections, set the default minimum
5059                  * and maximum connection interval. They will be used
5060                  * to check if the parameters are in range and if not
5061                  * trigger the connection update procedure.
5062                  */
5063                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
5064                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
5065         }
5066
5067         /* Lookup the identity address from the stored connection
5068          * address and address type.
5069          *
5070          * When establishing connections to an identity address, the
5071          * connection procedure will store the resolvable random
5072          * address first. Now if it can be converted back into the
5073          * identity address, start using the identity address from
5074          * now on.
5075          */
5076         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5077         if (irk) {
5078                 bacpy(&conn->dst, &irk->bdaddr);
5079                 conn->dst_type = irk->addr_type;
5080         }
5081
5082         if (status) {
5083                 hci_le_conn_failed(conn, status);
5084                 goto unlock;
5085         }
5086
5087         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5088                 addr_type = BDADDR_LE_PUBLIC;
5089         else
5090                 addr_type = BDADDR_LE_RANDOM;
5091
5092         /* Drop the connection if the device is blocked */
5093         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5094                 hci_conn_drop(conn);
5095                 goto unlock;
5096         }
5097
5098         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5099                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
5100
5101         conn->sec_level = BT_SECURITY_LOW;
5102         conn->handle = handle;
5103         conn->state = BT_CONFIG;
5104
5105         conn->le_conn_interval = interval;
5106         conn->le_conn_latency = latency;
5107         conn->le_supv_timeout = supervision_timeout;
5108
5109         hci_debugfs_create_conn(conn);
5110         hci_conn_add_sysfs(conn);
5111
5112         if (!status) {
5113                 /* The remote features procedure is defined for master
5114                  * role only. So only in case of an initiated connection
5115                  * request the remote features.
5116                  *
5117                  * If the local controller supports slave-initiated features
5118                  * exchange, then requesting the remote features in slave
5119                  * role is possible. Otherwise just transition into the
5120                  * connected state without requesting the remote features.
5121                  */
5122                 if (conn->out ||
5123                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5124                         struct hci_cp_le_read_remote_features cp;
5125
5126                         cp.handle = __cpu_to_le16(conn->handle);
5127
5128                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5129                                      sizeof(cp), &cp);
5130
5131                         hci_conn_hold(conn);
5132                 } else {
5133                         conn->state = BT_CONNECTED;
5134                         hci_connect_cfm(conn, status);
5135                 }
5136         } else {
5137                 hci_connect_cfm(conn, status);
5138         }
5139
5140         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5141                                            conn->dst_type);
5142         if (params) {
5143                 list_del_init(&params->action);
5144                 if (params->conn) {
5145                         hci_conn_drop(params->conn);
5146                         hci_conn_put(params->conn);
5147                         params->conn = NULL;
5148                 }
5149         }
5150
5151 unlock:
5152         hci_update_background_scan(hdev);
5153         hci_dev_unlock(hdev);
5154 }
5155
5156 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5157 {
5158         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5159
5160         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5161
5162         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5163                              ev->role, le16_to_cpu(ev->handle),
5164                              le16_to_cpu(ev->interval),
5165                              le16_to_cpu(ev->latency),
5166                              le16_to_cpu(ev->supervision_timeout));
5167 }
5168
5169 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5170                                          struct sk_buff *skb)
5171 {
5172         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5173
5174         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5175
5176         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5177                              ev->role, le16_to_cpu(ev->handle),
5178                              le16_to_cpu(ev->interval),
5179                              le16_to_cpu(ev->latency),
5180                              le16_to_cpu(ev->supervision_timeout));
5181 }
5182
5183 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5184 {
5185         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5186         struct hci_conn *conn;
5187
5188         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5189
5190         if (ev->status)
5191                 return;
5192
5193         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5194         if (conn) {
5195                 struct adv_info *adv_instance;
5196
5197                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5198                         return;
5199
5200                 if (!hdev->cur_adv_instance) {
5201                         bacpy(&conn->resp_addr, &hdev->random_addr);
5202                         return;
5203                 }
5204
5205                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5206                 if (adv_instance)
5207                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5208         }
5209 }
5210
5211 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5212                                             struct sk_buff *skb)
5213 {
5214         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5215         struct hci_conn *conn;
5216
5217         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5218
5219         if (ev->status)
5220                 return;
5221
5222         hci_dev_lock(hdev);
5223
5224         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5225         if (conn) {
5226 #ifdef TIZEN_BT
5227                 if (ev->status) {
5228                         hci_dev_unlock(hdev);
5229                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5230                                 conn->type, conn->dst_type, ev->status);
5231                         return;
5232                 }
5233 #endif
5234                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5235                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5236                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5237         }
5238
5239         hci_dev_unlock(hdev);
5240
5241 #ifdef TIZEN_BT
5242         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5243                                 conn->dst_type, conn->le_conn_interval,
5244                                 conn->le_conn_latency, conn->le_supv_timeout);
5245 #endif
5246 }
5247
5248 /* This function requires the caller holds hdev->lock */
5249 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5250                                               bdaddr_t *addr,
5251                                               u8 addr_type, u8 adv_type,
5252                                               bdaddr_t *direct_rpa)
5253 {
5254         struct hci_conn *conn;
5255         struct hci_conn_params *params;
5256
5257         /* If the event is not connectable don't proceed further */
5258         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5259                 return NULL;
5260
5261         /* Ignore if the device is blocked */
5262         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5263                 return NULL;
5264
5265         /* Most controller will fail if we try to create new connections
5266          * while we have an existing one in slave role.
5267          */
5268         if (hdev->conn_hash.le_num_slave > 0)
5269                 return NULL;
5270
5271         /* If we're not connectable only connect devices that we have in
5272          * our pend_le_conns list.
5273          */
5274         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5275                                            addr_type);
5276         if (!params)
5277                 return NULL;
5278
5279         if (!params->explicit_connect) {
5280                 switch (params->auto_connect) {
5281                 case HCI_AUTO_CONN_DIRECT:
5282                         /* Only devices advertising with ADV_DIRECT_IND are
5283                          * triggering a connection attempt. This is allowing
5284                          * incoming connections from slave devices.
5285                          */
5286                         if (adv_type != LE_ADV_DIRECT_IND)
5287                                 return NULL;
5288                         break;
5289                 case HCI_AUTO_CONN_ALWAYS:
5290                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5291                          * are triggering a connection attempt. This means
5292                          * that incoming connectioms from slave device are
5293                          * accepted and also outgoing connections to slave
5294                          * devices are established when found.
5295                          */
5296                         break;
5297                 default:
5298                         return NULL;
5299                 }
5300         }
5301
5302         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5303                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5304                               direct_rpa);
5305         if (!IS_ERR(conn)) {
5306                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5307                  * by higher layer that tried to connect, if no then
5308                  * store the pointer since we don't really have any
5309                  * other owner of the object besides the params that
5310                  * triggered it. This way we can abort the connection if
5311                  * the parameters get removed and keep the reference
5312                  * count consistent once the connection is established.
5313                  */
5314
5315                 if (!params->explicit_connect)
5316                         params->conn = hci_conn_get(conn);
5317
5318                 return conn;
5319         }
5320
5321         switch (PTR_ERR(conn)) {
5322         case -EBUSY:
5323                 /* If hci_connect() returns -EBUSY it means there is already
5324                  * an LE connection attempt going on. Since controllers don't
5325                  * support more than one connection attempt at the time, we
5326                  * don't consider this an error case.
5327                  */
5328                 break;
5329         default:
5330                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5331                 return NULL;
5332         }
5333
5334         return NULL;
5335 }
5336
5337 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5338                                u8 bdaddr_type, bdaddr_t *direct_addr,
5339                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5340 {
5341 #ifndef TIZEN_BT
5342         struct discovery_state *d = &hdev->discovery;
5343 #endif
5344         struct smp_irk *irk;
5345         struct hci_conn *conn;
5346 #ifndef TIZEN_BT
5347         bool match;
5348 #endif
5349         u32 flags;
5350         u8 *ptr, real_len;
5351
5352         switch (type) {
5353         case LE_ADV_IND:
5354         case LE_ADV_DIRECT_IND:
5355         case LE_ADV_SCAN_IND:
5356         case LE_ADV_NONCONN_IND:
5357         case LE_ADV_SCAN_RSP:
5358                 break;
5359         default:
5360                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5361                                        "type: 0x%02x", type);
5362                 return;
5363         }
5364
5365         /* Find the end of the data in case the report contains padded zero
5366          * bytes at the end causing an invalid length value.
5367          *
5368          * When data is NULL, len is 0 so there is no need for extra ptr
5369          * check as 'ptr < data + 0' is already false in such case.
5370          */
5371         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5372                 if (ptr + 1 + *ptr > data + len)
5373                         break;
5374         }
5375
5376         real_len = ptr - data;
5377
5378         /* Adjust for actual length */
5379         if (len != real_len) {
5380                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5381                 len = real_len;
5382         }
5383
5384         /* If the direct address is present, then this report is from
5385          * a LE Direct Advertising Report event. In that case it is
5386          * important to see if the address is matching the local
5387          * controller address.
5388          */
5389         if (direct_addr) {
5390                 /* Only resolvable random addresses are valid for these
5391                  * kind of reports and others can be ignored.
5392                  */
5393                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5394                         return;
5395
5396                 /* If the controller is not using resolvable random
5397                  * addresses, then this report can be ignored.
5398                  */
5399                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5400                         return;
5401
5402                 /* If the local IRK of the controller does not match
5403                  * with the resolvable random address provided, then
5404                  * this report can be ignored.
5405                  */
5406                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5407                         return;
5408         }
5409
5410         /* Check if we need to convert to identity address */
5411         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5412         if (irk) {
5413                 bdaddr = &irk->bdaddr;
5414                 bdaddr_type = irk->addr_type;
5415         }
5416
5417         /* Check if we have been requested to connect to this device.
5418          *
5419          * direct_addr is set only for directed advertising reports (it is NULL
5420          * for advertising reports) and is already verified to be RPA above.
5421          */
5422         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5423                                                                 direct_addr);
5424         if (conn && type == LE_ADV_IND) {
5425                 /* Store report for later inclusion by
5426                  * mgmt_device_connected
5427                  */
5428                 memcpy(conn->le_adv_data, data, len);
5429                 conn->le_adv_data_len = len;
5430         }
5431
5432         /* Passive scanning shouldn't trigger any device found events,
5433          * except for devices marked as CONN_REPORT for which we do send
5434          * device found events.
5435          */
5436         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5437                 if (type == LE_ADV_DIRECT_IND)
5438                         return;
5439
5440 #ifndef TIZEN_BT
5441                 /* Handle all adv packet in platform */
5442                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5443                                                bdaddr, bdaddr_type))
5444                         return;
5445 #endif
5446
5447                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5448                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5449                 else
5450                         flags = 0;
5451 #ifdef TIZEN_BT
5452                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5453                                      rssi, flags, data, len, NULL, 0, type);
5454 #else
5455                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5456                                   rssi, flags, data, len, NULL, 0);
5457 #endif
5458                 return;
5459         }
5460
5461         /* When receiving non-connectable or scannable undirected
5462          * advertising reports, this means that the remote device is
5463          * not connectable and then clearly indicate this in the
5464          * device found event.
5465          *
5466          * When receiving a scan response, then there is no way to
5467          * know if the remote device is connectable or not. However
5468          * since scan responses are merged with a previously seen
5469          * advertising report, the flags field from that report
5470          * will be used.
5471          *
5472          * In the really unlikely case that a controller get confused
5473          * and just sends a scan response event, then it is marked as
5474          * not connectable as well.
5475          */
5476         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5477             type == LE_ADV_SCAN_RSP)
5478                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5479         else
5480                 flags = 0;
5481
5482 #ifdef TIZEN_BT
5483         /* Disable adv ind and scan rsp merging */
5484         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5485                              rssi, flags, data, len, NULL, 0, type);
5486 #else
5487         /* If there's nothing pending either store the data from this
5488          * event or send an immediate device found event if the data
5489          * should not be stored for later.
5490          */
5491         if (!has_pending_adv_report(hdev)) {
5492                 /* If the report will trigger a SCAN_REQ store it for
5493                  * later merging.
5494                  */
5495                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5496                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5497                                                  rssi, flags, data, len);
5498                         return;
5499                 }
5500
5501                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5502                                   rssi, flags, data, len, NULL, 0);
5503                 return;
5504         }
5505
5506         /* Check if the pending report is for the same device as the new one */
5507         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5508                  bdaddr_type == d->last_adv_addr_type);
5509
5510         /* If the pending data doesn't match this report or this isn't a
5511          * scan response (e.g. we got a duplicate ADV_IND) then force
5512          * sending of the pending data.
5513          */
5514         if (type != LE_ADV_SCAN_RSP || !match) {
5515                 /* Send out whatever is in the cache, but skip duplicates */
5516                 if (!match)
5517                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5518                                           d->last_adv_addr_type, NULL,
5519                                           d->last_adv_rssi, d->last_adv_flags,
5520                                           d->last_adv_data,
5521                                           d->last_adv_data_len, NULL, 0);
5522
5523                 /* If the new report will trigger a SCAN_REQ store it for
5524                  * later merging.
5525                  */
5526                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5527                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5528                                                  rssi, flags, data, len);
5529                         return;
5530                 }
5531
5532                 /* The advertising reports cannot be merged, so clear
5533                  * the pending report and send out a device found event.
5534                  */
5535                 clear_pending_adv_report(hdev);
5536                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5537                                   rssi, flags, data, len, NULL, 0);
5538                 return;
5539         }
5540
5541         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5542          * the new event is a SCAN_RSP. We can therefore proceed with
5543          * sending a merged device found event.
5544          */
5545         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5546                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5547                           d->last_adv_data, d->last_adv_data_len, data, len);
5548         clear_pending_adv_report(hdev);
5549 #endif
5550 }
5551
5552 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5553 {
5554         u8 num_reports = skb->data[0];
5555         void *ptr = &skb->data[1];
5556
5557         hci_dev_lock(hdev);
5558
5559         while (num_reports--) {
5560                 struct hci_ev_le_advertising_info *ev = ptr;
5561                 s8 rssi;
5562
5563                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5564                         rssi = ev->data[ev->length];
5565                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5566                                            ev->bdaddr_type, NULL, 0, rssi,
5567                                            ev->data, ev->length);
5568                 } else {
5569                         bt_dev_err(hdev, "Dropping invalid advertising data");
5570                 }
5571
5572                 ptr += sizeof(*ev) + ev->length + 1;
5573         }
5574
5575         hci_dev_unlock(hdev);
5576 }
5577
5578 static u8 ext_evt_type_to_legacy(u16 evt_type)
5579 {
5580         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5581                 switch (evt_type) {
5582                 case LE_LEGACY_ADV_IND:
5583                         return LE_ADV_IND;
5584                 case LE_LEGACY_ADV_DIRECT_IND:
5585                         return LE_ADV_DIRECT_IND;
5586                 case LE_LEGACY_ADV_SCAN_IND:
5587                         return LE_ADV_SCAN_IND;
5588                 case LE_LEGACY_NONCONN_IND:
5589                         return LE_ADV_NONCONN_IND;
5590                 case LE_LEGACY_SCAN_RSP_ADV:
5591                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5592                         return LE_ADV_SCAN_RSP;
5593                 }
5594
5595                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5596                                    evt_type);
5597
5598                 return LE_ADV_INVALID;
5599         }
5600
5601         if (evt_type & LE_EXT_ADV_CONN_IND) {
5602                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5603                         return LE_ADV_DIRECT_IND;
5604
5605                 return LE_ADV_IND;
5606         }
5607
5608         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5609                 return LE_ADV_SCAN_RSP;
5610
5611         if (evt_type & LE_EXT_ADV_SCAN_IND)
5612                 return LE_ADV_SCAN_IND;
5613
5614         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5615             evt_type & LE_EXT_ADV_DIRECT_IND)
5616                 return LE_ADV_NONCONN_IND;
5617
5618         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5619                                    evt_type);
5620
5621         return LE_ADV_INVALID;
5622 }
5623
5624 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5625 {
5626         u8 num_reports = skb->data[0];
5627         void *ptr = &skb->data[1];
5628
5629         hci_dev_lock(hdev);
5630
5631         while (num_reports--) {
5632                 struct hci_ev_le_ext_adv_report *ev = ptr;
5633                 u8 legacy_evt_type;
5634                 u16 evt_type;
5635
5636                 evt_type = __le16_to_cpu(ev->evt_type);
5637                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5638                 if (legacy_evt_type != LE_ADV_INVALID) {
5639                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5640                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5641                                            ev->data, ev->length);
5642                 }
5643
5644                 ptr += sizeof(*ev) + ev->length + 1;
5645         }
5646
5647         hci_dev_unlock(hdev);
5648 }
5649
5650 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5651                                             struct sk_buff *skb)
5652 {
5653         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5654         struct hci_conn *conn;
5655
5656         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5657
5658         hci_dev_lock(hdev);
5659
5660         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5661         if (conn) {
5662                 if (!ev->status)
5663                         memcpy(conn->features[0], ev->features, 8);
5664
5665                 if (conn->state == BT_CONFIG) {
5666                         __u8 status;
5667
5668                         /* If the local controller supports slave-initiated
5669                          * features exchange, but the remote controller does
5670                          * not, then it is possible that the error code 0x1a
5671                          * for unsupported remote feature gets returned.
5672                          *
5673                          * In this specific case, allow the connection to
5674                          * transition into connected state and mark it as
5675                          * successful.
5676                          */
5677                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5678                             !conn->out && ev->status == 0x1a)
5679                                 status = 0x00;
5680                         else
5681                                 status = ev->status;
5682
5683                         conn->state = BT_CONNECTED;
5684                         hci_connect_cfm(conn, status);
5685                         hci_conn_drop(conn);
5686                 }
5687         }
5688
5689         hci_dev_unlock(hdev);
5690 }
5691
5692 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5693 {
5694         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5695         struct hci_cp_le_ltk_reply cp;
5696         struct hci_cp_le_ltk_neg_reply neg;
5697         struct hci_conn *conn;
5698         struct smp_ltk *ltk;
5699
5700         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5701
5702         hci_dev_lock(hdev);
5703
5704         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5705         if (conn == NULL)
5706                 goto not_found;
5707
5708         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5709         if (!ltk)
5710                 goto not_found;
5711
5712         if (smp_ltk_is_sc(ltk)) {
5713                 /* With SC both EDiv and Rand are set to zero */
5714                 if (ev->ediv || ev->rand)
5715                         goto not_found;
5716         } else {
5717                 /* For non-SC keys check that EDiv and Rand match */
5718                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5719                         goto not_found;
5720         }
5721
5722         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5723         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5724         cp.handle = cpu_to_le16(conn->handle);
5725
5726         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5727
5728         conn->enc_key_size = ltk->enc_size;
5729
5730         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5731
5732         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5733          * temporary key used to encrypt a connection following
5734          * pairing. It is used during the Encrypted Session Setup to
5735          * distribute the keys. Later, security can be re-established
5736          * using a distributed LTK.
5737          */
5738         if (ltk->type == SMP_STK) {
5739                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5740                 list_del_rcu(&ltk->list);
5741                 kfree_rcu(ltk, rcu);
5742         } else {
5743                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5744         }
5745
5746         hci_dev_unlock(hdev);
5747
5748         return;
5749
5750 not_found:
5751         neg.handle = ev->handle;
5752         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5753         hci_dev_unlock(hdev);
5754 }
5755
5756 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5757                                       u8 reason)
5758 {
5759         struct hci_cp_le_conn_param_req_neg_reply cp;
5760
5761         cp.handle = cpu_to_le16(handle);
5762         cp.reason = reason;
5763
5764         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5765                      &cp);
5766 }
5767
5768 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5769                                              struct sk_buff *skb)
5770 {
5771         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5772         struct hci_cp_le_conn_param_req_reply cp;
5773         struct hci_conn *hcon;
5774         u16 handle, min, max, latency, timeout;
5775
5776         handle = le16_to_cpu(ev->handle);
5777         min = le16_to_cpu(ev->interval_min);
5778         max = le16_to_cpu(ev->interval_max);
5779         latency = le16_to_cpu(ev->latency);
5780         timeout = le16_to_cpu(ev->timeout);
5781
5782         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5783         if (!hcon || hcon->state != BT_CONNECTED)
5784                 return send_conn_param_neg_reply(hdev, handle,
5785                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5786
5787         if (hci_check_conn_params(min, max, latency, timeout))
5788                 return send_conn_param_neg_reply(hdev, handle,
5789                                                  HCI_ERROR_INVALID_LL_PARAMS);
5790
5791         if (hcon->role == HCI_ROLE_MASTER) {
5792                 struct hci_conn_params *params;
5793                 u8 store_hint;
5794
5795                 hci_dev_lock(hdev);
5796
5797                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5798                                                 hcon->dst_type);
5799                 if (params) {
5800                         params->conn_min_interval = min;
5801                         params->conn_max_interval = max;
5802                         params->conn_latency = latency;
5803                         params->supervision_timeout = timeout;
5804                         store_hint = 0x01;
5805                 } else{
5806                         store_hint = 0x00;
5807                 }
5808
5809                 hci_dev_unlock(hdev);
5810
5811                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5812                                     store_hint, min, max, latency, timeout);
5813         }
5814
5815         cp.handle = ev->handle;
5816         cp.interval_min = ev->interval_min;
5817         cp.interval_max = ev->interval_max;
5818         cp.latency = ev->latency;
5819         cp.timeout = ev->timeout;
5820         cp.min_ce_len = 0;
5821         cp.max_ce_len = 0;
5822
5823         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5824 }
5825
5826 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5827                                          struct sk_buff *skb)
5828 {
5829         u8 num_reports = skb->data[0];
5830         void *ptr = &skb->data[1];
5831
5832         hci_dev_lock(hdev);
5833
5834         while (num_reports--) {
5835                 struct hci_ev_le_direct_adv_info *ev = ptr;
5836
5837                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5838                                    ev->bdaddr_type, &ev->direct_addr,
5839                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5840
5841                 ptr += sizeof(*ev);
5842         }
5843
5844         hci_dev_unlock(hdev);
5845 }
5846
5847 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5848 {
5849         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5850
5851         skb_pull(skb, sizeof(*le_ev));
5852
5853         switch (le_ev->subevent) {
5854         case HCI_EV_LE_CONN_COMPLETE:
5855                 hci_le_conn_complete_evt(hdev, skb);
5856                 break;
5857
5858         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5859                 hci_le_conn_update_complete_evt(hdev, skb);
5860                 break;
5861
5862         case HCI_EV_LE_ADVERTISING_REPORT:
5863                 hci_le_adv_report_evt(hdev, skb);
5864                 break;
5865
5866         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5867                 hci_le_remote_feat_complete_evt(hdev, skb);
5868                 break;
5869
5870         case HCI_EV_LE_LTK_REQ:
5871                 hci_le_ltk_request_evt(hdev, skb);
5872                 break;
5873
5874         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5875                 hci_le_remote_conn_param_req_evt(hdev, skb);
5876                 break;
5877
5878         case HCI_EV_LE_DIRECT_ADV_REPORT:
5879                 hci_le_direct_adv_report_evt(hdev, skb);
5880                 break;
5881
5882         case HCI_EV_LE_EXT_ADV_REPORT:
5883                 hci_le_ext_adv_report_evt(hdev, skb);
5884                 break;
5885
5886         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5887                 hci_le_enh_conn_complete_evt(hdev, skb);
5888                 break;
5889
5890         case HCI_EV_LE_EXT_ADV_SET_TERM:
5891                 hci_le_ext_adv_term_evt(hdev, skb);
5892                 break;
5893
5894         default:
5895                 break;
5896         }
5897 }
5898
5899 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5900                                  u8 event, struct sk_buff *skb)
5901 {
5902         struct hci_ev_cmd_complete *ev;
5903         struct hci_event_hdr *hdr;
5904
5905         if (!skb)
5906                 return false;
5907
5908         if (skb->len < sizeof(*hdr)) {
5909                 bt_dev_err(hdev, "too short HCI event");
5910                 return false;
5911         }
5912
5913         hdr = (void *) skb->data;
5914         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5915
5916         if (event) {
5917                 if (hdr->evt != event)
5918                         return false;
5919                 return true;
5920         }
5921
5922         /* Check if request ended in Command Status - no way to retreive
5923          * any extra parameters in this case.
5924          */
5925         if (hdr->evt == HCI_EV_CMD_STATUS)
5926                 return false;
5927
5928         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5929                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5930                            hdr->evt);
5931                 return false;
5932         }
5933
5934         if (skb->len < sizeof(*ev)) {
5935                 bt_dev_err(hdev, "too short cmd_complete event");
5936                 return false;
5937         }
5938
5939         ev = (void *) skb->data;
5940         skb_pull(skb, sizeof(*ev));
5941
5942         if (opcode != __le16_to_cpu(ev->opcode)) {
5943                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5944                        __le16_to_cpu(ev->opcode));
5945                 return false;
5946         }
5947
5948         return true;
5949 }
5950
5951 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5952 {
5953         struct hci_event_hdr *hdr = (void *) skb->data;
5954         hci_req_complete_t req_complete = NULL;
5955         hci_req_complete_skb_t req_complete_skb = NULL;
5956         struct sk_buff *orig_skb = NULL;
5957         u8 status = 0, event = hdr->evt, req_evt = 0;
5958         u16 opcode = HCI_OP_NOP;
5959
5960         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5961                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5962                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5963                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5964                                      &req_complete_skb);
5965                 req_evt = event;
5966         }
5967
5968         /* If it looks like we might end up having to call
5969          * req_complete_skb, store a pristine copy of the skb since the
5970          * various handlers may modify the original one through
5971          * skb_pull() calls, etc.
5972          */
5973         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5974             event == HCI_EV_CMD_COMPLETE)
5975                 orig_skb = skb_clone(skb, GFP_KERNEL);
5976
5977         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5978
5979         switch (event) {
5980         case HCI_EV_INQUIRY_COMPLETE:
5981                 hci_inquiry_complete_evt(hdev, skb);
5982                 break;
5983
5984         case HCI_EV_INQUIRY_RESULT:
5985                 hci_inquiry_result_evt(hdev, skb);
5986                 break;
5987
5988         case HCI_EV_CONN_COMPLETE:
5989                 hci_conn_complete_evt(hdev, skb);
5990                 break;
5991
5992         case HCI_EV_CONN_REQUEST:
5993                 hci_conn_request_evt(hdev, skb);
5994                 break;
5995
5996         case HCI_EV_DISCONN_COMPLETE:
5997                 hci_disconn_complete_evt(hdev, skb);
5998                 break;
5999
6000         case HCI_EV_AUTH_COMPLETE:
6001                 hci_auth_complete_evt(hdev, skb);
6002                 break;
6003
6004         case HCI_EV_REMOTE_NAME:
6005                 hci_remote_name_evt(hdev, skb);
6006                 break;
6007
6008         case HCI_EV_ENCRYPT_CHANGE:
6009                 hci_encrypt_change_evt(hdev, skb);
6010                 break;
6011
6012         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6013                 hci_change_link_key_complete_evt(hdev, skb);
6014                 break;
6015
6016         case HCI_EV_REMOTE_FEATURES:
6017                 hci_remote_features_evt(hdev, skb);
6018                 break;
6019
6020         case HCI_EV_CMD_COMPLETE:
6021                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6022                                      &req_complete, &req_complete_skb);
6023                 break;
6024
6025         case HCI_EV_CMD_STATUS:
6026                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6027                                    &req_complete_skb);
6028                 break;
6029
6030         case HCI_EV_HARDWARE_ERROR:
6031                 hci_hardware_error_evt(hdev, skb);
6032                 break;
6033
6034         case HCI_EV_ROLE_CHANGE:
6035                 hci_role_change_evt(hdev, skb);
6036                 break;
6037
6038         case HCI_EV_NUM_COMP_PKTS:
6039                 hci_num_comp_pkts_evt(hdev, skb);
6040                 break;
6041
6042         case HCI_EV_MODE_CHANGE:
6043                 hci_mode_change_evt(hdev, skb);
6044                 break;
6045
6046         case HCI_EV_PIN_CODE_REQ:
6047                 hci_pin_code_request_evt(hdev, skb);
6048                 break;
6049
6050         case HCI_EV_LINK_KEY_REQ:
6051                 hci_link_key_request_evt(hdev, skb);
6052                 break;
6053
6054         case HCI_EV_LINK_KEY_NOTIFY:
6055                 hci_link_key_notify_evt(hdev, skb);
6056                 break;
6057
6058         case HCI_EV_CLOCK_OFFSET:
6059                 hci_clock_offset_evt(hdev, skb);
6060                 break;
6061
6062         case HCI_EV_PKT_TYPE_CHANGE:
6063                 hci_pkt_type_change_evt(hdev, skb);
6064                 break;
6065
6066         case HCI_EV_PSCAN_REP_MODE:
6067                 hci_pscan_rep_mode_evt(hdev, skb);
6068                 break;
6069
6070         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6071                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6072                 break;
6073
6074         case HCI_EV_REMOTE_EXT_FEATURES:
6075                 hci_remote_ext_features_evt(hdev, skb);
6076                 break;
6077
6078         case HCI_EV_SYNC_CONN_COMPLETE:
6079                 hci_sync_conn_complete_evt(hdev, skb);
6080                 break;
6081
6082         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6083                 hci_extended_inquiry_result_evt(hdev, skb);
6084                 break;
6085
6086         case HCI_EV_KEY_REFRESH_COMPLETE:
6087                 hci_key_refresh_complete_evt(hdev, skb);
6088                 break;
6089
6090         case HCI_EV_IO_CAPA_REQUEST:
6091                 hci_io_capa_request_evt(hdev, skb);
6092                 break;
6093
6094         case HCI_EV_IO_CAPA_REPLY:
6095                 hci_io_capa_reply_evt(hdev, skb);
6096                 break;
6097
6098         case HCI_EV_USER_CONFIRM_REQUEST:
6099                 hci_user_confirm_request_evt(hdev, skb);
6100                 break;
6101
6102         case HCI_EV_USER_PASSKEY_REQUEST:
6103                 hci_user_passkey_request_evt(hdev, skb);
6104                 break;
6105
6106         case HCI_EV_USER_PASSKEY_NOTIFY:
6107                 hci_user_passkey_notify_evt(hdev, skb);
6108                 break;
6109
6110         case HCI_EV_KEYPRESS_NOTIFY:
6111                 hci_keypress_notify_evt(hdev, skb);
6112                 break;
6113
6114         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6115                 hci_simple_pair_complete_evt(hdev, skb);
6116                 break;
6117
6118         case HCI_EV_REMOTE_HOST_FEATURES:
6119                 hci_remote_host_features_evt(hdev, skb);
6120                 break;
6121
6122         case HCI_EV_LE_META:
6123                 hci_le_meta_evt(hdev, skb);
6124                 break;
6125
6126         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6127                 hci_remote_oob_data_request_evt(hdev, skb);
6128                 break;
6129
6130 #if IS_ENABLED(CONFIG_BT_HS)
6131         case HCI_EV_CHANNEL_SELECTED:
6132                 hci_chan_selected_evt(hdev, skb);
6133                 break;
6134
6135         case HCI_EV_PHY_LINK_COMPLETE:
6136                 hci_phy_link_complete_evt(hdev, skb);
6137                 break;
6138
6139         case HCI_EV_LOGICAL_LINK_COMPLETE:
6140                 hci_loglink_complete_evt(hdev, skb);
6141                 break;
6142
6143         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6144                 hci_disconn_loglink_complete_evt(hdev, skb);
6145                 break;
6146
6147         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6148                 hci_disconn_phylink_complete_evt(hdev, skb);
6149                 break;
6150 #endif
6151
6152         case HCI_EV_NUM_COMP_BLOCKS:
6153                 hci_num_comp_blocks_evt(hdev, skb);
6154                 break;
6155
6156 #ifdef TIZEN_BT
6157         case HCI_EV_VENDOR_SPECIFIC:
6158                 hci_vendor_specific_evt(hdev, skb);
6159                 break;
6160 #endif
6161
6162         default:
6163                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6164                 break;
6165         }
6166
6167         if (req_complete) {
6168                 req_complete(hdev, status, opcode);
6169         } else if (req_complete_skb) {
6170                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6171                         kfree_skb(orig_skb);
6172                         orig_skb = NULL;
6173                 }
6174                 req_complete_skb(hdev, status, opcode, orig_skb);
6175         }
6176
6177         kfree_skb(orig_skb);
6178         kfree_skb(skb);
6179         hdev->stat.evt_rx++;
6180 }