net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         /* Set discovery state to stopped if we're not doing LE active
  59          * scanning.
  60          */
  61         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  62             hdev->le_scan_type != LE_SCAN_ACTIVE)
  63                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  64         hci_dev_unlock(hdev);
  65
  66         hci_conn_check_pending(hdev);
  67 }
  68
  69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  70 {
  71         __u8 status = *((__u8 *) skb->data);
  72
  73         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  74
  75         if (status)
  76                 return;
  77
  78         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  79 }
  80
  81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  82 {
  83         __u8 status = *((__u8 *) skb->data);
  84
  85         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  86
  87         if (status)
  88                 return;
  89
  90         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  91
  92         hci_conn_check_pending(hdev);
  93 }
  94
  95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  96                                           struct sk_buff *skb)
  97 {
  98         BT_DBG("%s", hdev->name);
  99 }
 100
 101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 102 {
 103         struct hci_rp_role_discovery *rp = (void *) skb->data;
 104         struct hci_conn *conn;
 105
 106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 107
 108         if (rp->status)
 109                 return;
 110
 111         hci_dev_lock(hdev);
 112
 113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 114         if (conn)
 115                 conn->role = rp->role;
 116
 117         hci_dev_unlock(hdev);
 118 }
 119
 120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 121 {
 122         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 123         struct hci_conn *conn;
 124
 125         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 126
 127         if (rp->status)
 128                 return;
 129
 130         hci_dev_lock(hdev);
 131
 132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 133         if (conn)
 134                 conn->link_policy = __le16_to_cpu(rp->policy);
 135
 136         hci_dev_unlock(hdev);
 137 }
 138
 139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 140 {
 141         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 142         struct hci_conn *conn;
 143         void *sent;
 144 #ifdef TIZEN_BT
 145         struct hci_cp_write_link_policy cp;
 146         struct hci_conn *sco_conn;
 147 #endif
 148
 149         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 150
 151         if (rp->status)
 152                 return;
 153
 154         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 155         if (!sent)
 156                 return;
 157
 158         hci_dev_lock(hdev);
 159
 160         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 161         if (conn)
 162                 conn->link_policy = get_unaligned_le16(sent + 2);
 163
 164 #ifdef TIZEN_BT
 165         sco_conn = hci_conn_hash_lookup_sco(hdev);
 166         if (sco_conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 167             conn->link_policy & HCI_LP_SNIFF) {
 168                 BT_ERR("SNIFF is not allowed during sco connection");
 169                 cp.handle = __cpu_to_le16(conn->handle);
 170                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 171                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 172         }
 173 #endif
 174
 175         hci_dev_unlock(hdev);
 176 }
 177
 178 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 179                                         struct sk_buff *skb)
 180 {
 181         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 182
 183         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 184
 185         if (rp->status)
 186                 return;
 187
 188         hdev->link_policy = __le16_to_cpu(rp->policy);
 189 }
 190
 191 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 192                                          struct sk_buff *skb)
 193 {
 194         __u8 status = *((__u8 *) skb->data);
 195         void *sent;
 196
 197         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 198
 199         if (status)
 200                 return;
 201
 202         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 203         if (!sent)
 204                 return;
 205
 206         hdev->link_policy = get_unaligned_le16(sent);
 207 }
 208
 209 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 210 {
 211         __u8 status = *((__u8 *) skb->data);
 212
 213         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 214
 215         clear_bit(HCI_RESET, &hdev->flags);
 216
 217         if (status)
 218                 return;
 219
 220         /* Reset all non-persistent flags */
 221         hci_dev_clear_volatile_flags(hdev);
 222
 223         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 224
 225         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 226         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 227
 228         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 229         hdev->adv_data_len = 0;
 230
 231         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 232         hdev->scan_rsp_data_len = 0;
 233
 234         hdev->le_scan_type = LE_SCAN_PASSIVE;
 235
 236         hdev->ssp_debug_mode = 0;
 237
 238         hci_bdaddr_list_clear(&hdev->le_white_list);
 239         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (hci_dev_test_flag(hdev, HCI_MGMT))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 307             hci_dev_test_flag(hdev, HCI_CONFIG))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (hci_dev_test_flag(hdev, HCI_MGMT))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (hci_dev_test_flag(hdev, HCI_MGMT))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (hci_dev_test_flag(hdev, HCI_MGMT))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 526                 else
 527                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 554                 if (sent->support)
 555                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 556                 else
 557                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 573             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 593             hci_dev_test_flag(hdev, HCI_CONFIG))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (hci_dev_test_flag(hdev, HCI_SETUP))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 return;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859 }
 860
 861 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 862                                          struct sk_buff *skb)
 863 {
 864         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 865
 866         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 867
 868         if (rp->status)
 869                 return;
 870
 871         hdev->inq_tx_power = rp->tx_power;
 872 }
 873
 874 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 877         struct hci_cp_pin_code_reply *cp;
 878         struct hci_conn *conn;
 879
 880         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 881
 882         hci_dev_lock(hdev);
 883
 884         if (hci_dev_test_flag(hdev, HCI_MGMT))
 885                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 886
 887         if (rp->status)
 888                 goto unlock;
 889
 890         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 891         if (!cp)
 892                 goto unlock;
 893
 894         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 895         if (conn)
 896                 conn->pin_length = cp->pin_len;
 897
 898 unlock:
 899         hci_dev_unlock(hdev);
 900 }
 901
 902 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 903 {
 904         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         hci_dev_lock(hdev);
 909
 910         if (hci_dev_test_flag(hdev, HCI_MGMT))
 911                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 912                                                  rp->status);
 913
 914         hci_dev_unlock(hdev);
 915 }
 916
 917 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 918                                        struct sk_buff *skb)
 919 {
 920         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 921
 922         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 923
 924         if (rp->status)
 925                 return;
 926
 927         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 928         hdev->le_pkts = rp->le_max_pkt;
 929
 930         hdev->le_cnt = hdev->le_pkts;
 931
 932         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 933 }
 934
 935 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 936                                           struct sk_buff *skb)
 937 {
 938         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 939
 940         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 941
 942         if (rp->status)
 943                 return;
 944
 945         memcpy(hdev->le_features, rp->features, 8);
 946 }
 947
 948 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 949                                         struct sk_buff *skb)
 950 {
 951         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 952
 953         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 954
 955         if (rp->status)
 956                 return;
 957
 958         hdev->adv_tx_power = rp->tx_power;
 959 }
 960
 961 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 962 {
 963         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 964
 965         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 966
 967         hci_dev_lock(hdev);
 968
 969         if (hci_dev_test_flag(hdev, HCI_MGMT))
 970                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
 971                                                  rp->status);
 972
 973         hci_dev_unlock(hdev);
 974 }
 975
 976 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 977                                           struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (hci_dev_test_flag(hdev, HCI_MGMT))
 986                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 987                                                      ACL_LINK, 0, rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 993 {
 994         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 995
 996         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 997
 998         hci_dev_lock(hdev);
 999
1000         if (hci_dev_test_flag(hdev, HCI_MGMT))
1001                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1002                                                  0, rp->status);
1003
1004         hci_dev_unlock(hdev);
1005 }
1006
1007 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1008                                           struct sk_buff *skb)
1009 {
1010         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1011
1012         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1013
1014         hci_dev_lock(hdev);
1015
1016         if (hci_dev_test_flag(hdev, HCI_MGMT))
1017                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1018                                                      ACL_LINK, 0, rp->status);
1019
1020         hci_dev_unlock(hdev);
1021 }
1022
1023 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1024                                        struct sk_buff *skb)
1025 {
1026         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1027
1028         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1029 }
1030
1031 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1032                                            struct sk_buff *skb)
1033 {
1034         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037 }
1038
1039 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1040 {
1041         __u8 status = *((__u8 *) skb->data);
1042         bdaddr_t *sent;
1043
1044         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1045
1046         if (status)
1047                 return;
1048
1049         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1050         if (!sent)
1051                 return;
1052
1053         hci_dev_lock(hdev);
1054
1055         bacpy(&hdev->random_addr, sent);
1056
1057         hci_dev_unlock(hdev);
1058 }
1059
1060 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1061 {
1062         __u8 status = *((__u8 *) skb->data);
1063         struct hci_cp_le_set_default_phy *cp;
1064
1065         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1066
1067         if (status)
1068                 return;
1069
1070         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1071         if (!cp)
1072                 return;
1073
1074         hci_dev_lock(hdev);
1075
1076         hdev->le_tx_def_phys = cp->tx_phys;
1077         hdev->le_rx_def_phys = cp->rx_phys;
1078
1079         hci_dev_unlock(hdev);
1080 }
1081
1082 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1083                                               struct sk_buff *skb)
1084 {
1085         __u8 status = *((__u8 *) skb->data);
1086         struct hci_cp_le_set_adv_set_rand_addr *cp;
1087         struct adv_info *adv_instance;
1088
1089         if (status)
1090                 return;
1091
1092         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1093         if (!cp)
1094                 return;
1095
1096         hci_dev_lock(hdev);
1097
1098         if (!hdev->cur_adv_instance) {
1099                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1100                 bacpy(&hdev->random_addr, &cp->bdaddr);
1101         } else {
1102                 adv_instance = hci_find_adv_instance(hdev,
1103                                                      hdev->cur_adv_instance);
1104                 if (adv_instance)
1105                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1106         }
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         __u8 *sent, status = *((__u8 *) skb->data);
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1116
1117         if (status)
1118                 return;
1119
1120         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1121         if (!sent)
1122                 return;
1123
1124         hci_dev_lock(hdev);
1125
1126         /* If we're doing connection initiation as peripheral. Set a
1127          * timeout in case something goes wrong.
1128          */
1129         if (*sent) {
1130                 struct hci_conn *conn;
1131
1132                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1133
1134                 conn = hci_lookup_le_connect(hdev);
1135                 if (conn)
1136                         queue_delayed_work(hdev->workqueue,
1137                                            &conn->le_conn_timeout,
1138                                            conn->conn_timeout);
1139         } else {
1140                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1141         }
1142
1143         hci_dev_unlock(hdev);
1144 }
1145
1146 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1147                                          struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_ext_adv_enable *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         if (cp->enable) {
1164                 struct hci_conn *conn;
1165
1166                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1167
1168                 conn = hci_lookup_le_connect(hdev);
1169                 if (conn)
1170                         queue_delayed_work(hdev->workqueue,
1171                                            &conn->le_conn_timeout,
1172                                            conn->conn_timeout);
1173         } else {
1174                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1175         }
1176
1177         hci_dev_unlock(hdev);
1178 }
1179
1180 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1181 {
1182         struct hci_cp_le_set_scan_param *cp;
1183         __u8 status = *((__u8 *) skb->data);
1184
1185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1186
1187         if (status)
1188                 return;
1189
1190         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1191         if (!cp)
1192                 return;
1193
1194         hci_dev_lock(hdev);
1195
1196         hdev->le_scan_type = cp->type;
1197
1198         hci_dev_unlock(hdev);
1199 }
1200
1201 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1202                                          struct sk_buff *skb)
1203 {
1204         struct hci_cp_le_set_ext_scan_params *cp;
1205         __u8 status = *((__u8 *) skb->data);
1206         struct hci_cp_le_scan_phy_params *phy_param;
1207
1208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1209
1210         if (status)
1211                 return;
1212
1213         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1214         if (!cp)
1215                 return;
1216
1217         phy_param = (void *)cp->data;
1218
1219         hci_dev_lock(hdev);
1220
1221         hdev->le_scan_type = phy_param->type;
1222
1223         hci_dev_unlock(hdev);
1224 }
1225
1226 static bool has_pending_adv_report(struct hci_dev *hdev)
1227 {
1228         struct discovery_state *d = &hdev->discovery;
1229
1230         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1231 }
1232
1233 static void clear_pending_adv_report(struct hci_dev *hdev)
1234 {
1235         struct discovery_state *d = &hdev->discovery;
1236
1237         bacpy(&d->last_adv_addr, BDADDR_ANY);
1238         d->last_adv_data_len = 0;
1239 }
1240
1241 #ifndef TIZEN_BT
1242 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1243                                      u8 bdaddr_type, s8 rssi, u32 flags,
1244                                      u8 *data, u8 len)
1245 {
1246         struct discovery_state *d = &hdev->discovery;
1247
1248         bacpy(&d->last_adv_addr, bdaddr);
1249         d->last_adv_addr_type = bdaddr_type;
1250         d->last_adv_rssi = rssi;
1251         d->last_adv_flags = flags;
1252         memcpy(d->last_adv_data, data, len);
1253         d->last_adv_data_len = len;
1254 }
1255 #endif
1256
1257 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1258 {
1259         hci_dev_lock(hdev);
1260
1261         switch (enable) {
1262         case LE_SCAN_ENABLE:
1263                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1264                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1265                         clear_pending_adv_report(hdev);
1266                 break;
1267
1268         case LE_SCAN_DISABLE:
1269                 /* We do this here instead of when setting DISCOVERY_STOPPED
1270                  * since the latter would potentially require waiting for
1271                  * inquiry to stop too.
1272                  */
1273                 if (has_pending_adv_report(hdev)) {
1274                         struct discovery_state *d = &hdev->discovery;
1275
1276                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1277                                           d->last_adv_addr_type, NULL,
1278                                           d->last_adv_rssi, d->last_adv_flags,
1279                                           d->last_adv_data,
1280                                           d->last_adv_data_len, NULL, 0);
1281                 }
1282
1283                 /* Cancel this timer so that we don't try to disable scanning
1284                  * when it's already disabled.
1285                  */
1286                 cancel_delayed_work(&hdev->le_scan_disable);
1287
1288                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1289
1290                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1291                  * interrupted scanning due to a connect request. Mark
1292                  * therefore discovery as stopped. If this was not
1293                  * because of a connect request advertising might have
1294                  * been disabled because of active scanning, so
1295                  * re-enable it again if necessary.
1296                  */
1297                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1298 #ifndef TIZEN_BT /* The below line is kernel bug. */
1299                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1300 #else
1301                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1302 #endif
1303                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1304                          hdev->discovery.state == DISCOVERY_FINDING)
1305                         hci_req_reenable_advertising(hdev);
1306
1307                 break;
1308
1309         default:
1310                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1311                            enable);
1312                 break;
1313         }
1314
1315         hci_dev_unlock(hdev);
1316 }
1317
1318 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1319                                       struct sk_buff *skb)
1320 {
1321         struct hci_cp_le_set_scan_enable *cp;
1322         __u8 status = *((__u8 *) skb->data);
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (status)
1327                 return;
1328
1329         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1330         if (!cp)
1331                 return;
1332
1333         le_set_scan_enable_complete(hdev, cp->enable);
1334 }
1335
1336 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1337                                       struct sk_buff *skb)
1338 {
1339         struct hci_cp_le_set_ext_scan_enable *cp;
1340         __u8 status = *((__u8 *) skb->data);
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1343
1344         if (status)
1345                 return;
1346
1347         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1348         if (!cp)
1349                 return;
1350
1351         le_set_scan_enable_complete(hdev, cp->enable);
1352 }
1353
1354 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1355                                       struct sk_buff *skb)
1356 {
1357         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1358
1359         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1360                rp->num_of_sets);
1361
1362         if (rp->status)
1363                 return;
1364
1365         hdev->le_num_of_adv_sets = rp->num_of_sets;
1366 }
1367
1368 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1369                                            struct sk_buff *skb)
1370 {
1371         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1372
1373         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1374
1375         if (rp->status)
1376                 return;
1377
1378         hdev->le_white_list_size = rp->size;
1379 }
1380
1381 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1382                                        struct sk_buff *skb)
1383 {
1384         __u8 status = *((__u8 *) skb->data);
1385
1386         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1387
1388         if (status)
1389                 return;
1390
1391         hci_bdaddr_list_clear(&hdev->le_white_list);
1392 }
1393
1394 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1395                                         struct sk_buff *skb)
1396 {
1397         struct hci_cp_le_add_to_white_list *sent;
1398         __u8 status = *((__u8 *) skb->data);
1399
1400         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1401
1402         if (status)
1403                 return;
1404
1405         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1406         if (!sent)
1407                 return;
1408
1409         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1410                            sent->bdaddr_type);
1411 }
1412
1413 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1414                                           struct sk_buff *skb)
1415 {
1416         struct hci_cp_le_del_from_white_list *sent;
1417         __u8 status = *((__u8 *) skb->data);
1418
1419         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1420
1421         if (status)
1422                 return;
1423
1424         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1425         if (!sent)
1426                 return;
1427
1428         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1429                             sent->bdaddr_type);
1430 }
1431
1432 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1433                                             struct sk_buff *skb)
1434 {
1435         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1436
1437         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1438
1439         if (rp->status)
1440                 return;
1441
1442         memcpy(hdev->le_states, rp->le_states, 8);
1443 }
1444
1445 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1446                                         struct sk_buff *skb)
1447 {
1448         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1449
1450         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1451
1452         if (rp->status)
1453                 return;
1454
1455         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1456         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1457 }
1458
1459 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1460                                          struct sk_buff *skb)
1461 {
1462         struct hci_cp_le_write_def_data_len *sent;
1463         __u8 status = *((__u8 *) skb->data);
1464
1465         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1466
1467         if (status)
1468                 return;
1469
1470         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1471         if (!sent)
1472                 return;
1473
1474         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1475         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1476 }
1477
1478 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1479                                        struct sk_buff *skb)
1480 {
1481         __u8 status = *((__u8 *) skb->data);
1482
1483         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1484
1485         if (status)
1486                 return;
1487
1488         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1489 }
1490
1491 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1492                                            struct sk_buff *skb)
1493 {
1494         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1495
1496         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1497
1498         if (rp->status)
1499                 return;
1500
1501         hdev->le_resolv_list_size = rp->size;
1502 }
1503
1504 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1505                                                 struct sk_buff *skb)
1506 {
1507         __u8 *sent, status = *((__u8 *) skb->data);
1508
1509         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1510
1511         if (status)
1512                 return;
1513
1514         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1515         if (!sent)
1516                 return;
1517
1518         hci_dev_lock(hdev);
1519
1520         if (*sent)
1521                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1522         else
1523                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1524
1525         hci_dev_unlock(hdev);
1526 }
1527
1528 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1529                                         struct sk_buff *skb)
1530 {
1531         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1532
1533         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1534
1535         if (rp->status)
1536                 return;
1537
1538         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1539         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1540         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1541         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1542 }
1543
1544 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1545                                            struct sk_buff *skb)
1546 {
1547         struct hci_cp_write_le_host_supported *sent;
1548         __u8 status = *((__u8 *) skb->data);
1549
1550         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1551
1552         if (status)
1553                 return;
1554
1555         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1556         if (!sent)
1557                 return;
1558
1559         hci_dev_lock(hdev);
1560
1561         if (sent->le) {
1562                 hdev->features[1][0] |= LMP_HOST_LE;
1563                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1564         } else {
1565                 hdev->features[1][0] &= ~LMP_HOST_LE;
1566                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1567                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1568         }
1569
1570         if (sent->simul)
1571                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1572         else
1573                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1574
1575         hci_dev_unlock(hdev);
1576 }
1577
1578 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1579 {
1580         struct hci_cp_le_set_adv_param *cp;
1581         u8 status = *((u8 *) skb->data);
1582
1583         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1584
1585         if (status)
1586                 return;
1587
1588         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1589         if (!cp)
1590                 return;
1591
1592         hci_dev_lock(hdev);
1593         hdev->adv_addr_type = cp->own_address_type;
1594         hci_dev_unlock(hdev);
1595 }
1596
1597 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1598 {
1599         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1600         struct hci_cp_le_set_ext_adv_params *cp;
1601         struct adv_info *adv_instance;
1602
1603         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1604
1605         if (rp->status)
1606                 return;
1607
1608         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1609         if (!cp)
1610                 return;
1611
1612         hci_dev_lock(hdev);
1613         hdev->adv_addr_type = cp->own_addr_type;
1614         if (!hdev->cur_adv_instance) {
1615                 /* Store in hdev for instance 0 */
1616                 hdev->adv_tx_power = rp->tx_power;
1617         } else {
1618                 adv_instance = hci_find_adv_instance(hdev,
1619                                                      hdev->cur_adv_instance);
1620                 if (adv_instance)
1621                         adv_instance->tx_power = rp->tx_power;
1622         }
1623         /* Update adv data as tx power is known now */
1624         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1625         hci_dev_unlock(hdev);
1626 }
1627
1628 #ifdef TIZEN_BT
1629 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1630                                           struct sk_buff *skb)
1631 {
1632         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1633
1634         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1635                hdev->name, rp->status, rp->le_ext_opcode);
1636
1637         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1638 }
1639
1640 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1641                                           struct sk_buff *skb)
1642 {
1643         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1644
1645         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1646                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1647
1648         mgmt_raw_rssi_response(hdev, rp, rp->status);
1649 }
1650
1651 static void hci_vendor_ext_rssi_link_alert_evt(struct hci_dev *hdev,
1652                                                struct sk_buff *skb)
1653 {
1654         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
1655
1656         BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X", LE_RSSI_LINK_ALERT);
1657
1658         mgmt_rssi_alert_evt(hdev, ev->conn_handle, ev->alert_type,
1659                             ev->rssi_dbm);
1660 }
1661
1662 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1663                                               struct sk_buff *skb)
1664 {
1665         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1666         __u8 event_le_ext_sub_code;
1667
1668         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1669                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1670
1671         skb_pull(skb, sizeof(*ev));
1672         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1673
1674         switch (event_le_ext_sub_code) {
1675         case LE_RSSI_LINK_ALERT:
1676                 hci_vendor_ext_rssi_link_alert_evt(hdev, skb);
1677                 break;
1678
1679         default:
1680                 break;
1681         }
1682 }
1683
1684 static void hci_vendor_multi_adv_state_change_evt(struct hci_dev *hdev,
1685                                                   struct sk_buff *skb)
1686 {
1687         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *)skb->data;
1688
1689         BT_DBG("LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT");
1690
1691         mgmt_multi_adv_state_change_evt(hdev, ev->adv_instance,
1692                                         ev->state_change_reason,
1693                                         ev->connection_handle);
1694 }
1695
1696 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1697 {
1698         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1699         __u8 event_sub_code;
1700
1701         BT_DBG("hci_vendor_specific_evt");
1702
1703         skb_pull(skb, sizeof(*ev));
1704         event_sub_code = ev->event_sub_code;
1705
1706         switch (event_sub_code) {
1707         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1708                 hci_vendor_specific_group_ext_evt(hdev, skb);
1709                 break;
1710
1711         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
1712                 hci_vendor_multi_adv_state_change_evt(hdev, skb);
1713                 break;
1714
1715         default:
1716                 break;
1717         }
1718 }
1719 #endif
1720
1721 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1722 {
1723         struct hci_rp_read_rssi *rp = (void *) skb->data;
1724         struct hci_conn *conn;
1725
1726         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1727
1728         if (rp->status)
1729                 return;
1730
1731         hci_dev_lock(hdev);
1732
1733         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1734         if (conn)
1735                 conn->rssi = rp->rssi;
1736
1737         hci_dev_unlock(hdev);
1738 }
1739
1740 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1741 {
1742         struct hci_cp_read_tx_power *sent;
1743         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1744         struct hci_conn *conn;
1745
1746         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1747
1748         if (rp->status)
1749                 return;
1750
1751         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1752         if (!sent)
1753                 return;
1754
1755         hci_dev_lock(hdev);
1756
1757         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1758         if (!conn)
1759                 goto unlock;
1760
1761         switch (sent->type) {
1762         case 0x00:
1763                 conn->tx_power = rp->tx_power;
1764                 break;
1765         case 0x01:
1766                 conn->max_tx_power = rp->tx_power;
1767                 break;
1768         }
1769
1770 unlock:
1771         hci_dev_unlock(hdev);
1772 }
1773
1774 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1775 {
1776         u8 status = *((u8 *) skb->data);
1777         u8 *mode;
1778
1779         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1780
1781         if (status)
1782                 return;
1783
1784         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1785         if (mode)
1786                 hdev->ssp_debug_mode = *mode;
1787 }
1788
1789 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1790 {
1791         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1792
1793         if (status) {
1794                 hci_conn_check_pending(hdev);
1795                 return;
1796         }
1797
1798         set_bit(HCI_INQUIRY, &hdev->flags);
1799 }
1800
1801 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1802 {
1803         struct hci_cp_create_conn *cp;
1804         struct hci_conn *conn;
1805
1806         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1807
1808         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1809         if (!cp)
1810                 return;
1811
1812         hci_dev_lock(hdev);
1813
1814         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1815
1816         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1817
1818         if (status) {
1819                 if (conn && conn->state == BT_CONNECT) {
1820                         if (status != 0x0c || conn->attempt > 2) {
1821                                 conn->state = BT_CLOSED;
1822                                 hci_connect_cfm(conn, status);
1823                                 hci_conn_del(conn);
1824                         } else
1825                                 conn->state = BT_CONNECT2;
1826                 }
1827         } else {
1828                 if (!conn) {
1829                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1830                                             HCI_ROLE_MASTER);
1831                         if (!conn)
1832                                 bt_dev_err(hdev, "no memory for new connection");
1833                 }
1834         }
1835
1836         hci_dev_unlock(hdev);
1837 }
1838
1839 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1840 {
1841         struct hci_cp_add_sco *cp;
1842         struct hci_conn *acl, *sco;
1843         __u16 handle;
1844
1845         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1846
1847         if (!status)
1848                 return;
1849
1850         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1851         if (!cp)
1852                 return;
1853
1854         handle = __le16_to_cpu(cp->handle);
1855
1856         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1857
1858         hci_dev_lock(hdev);
1859
1860         acl = hci_conn_hash_lookup_handle(hdev, handle);
1861         if (acl) {
1862                 sco = acl->link;
1863                 if (sco) {
1864                         sco->state = BT_CLOSED;
1865
1866                         hci_connect_cfm(sco, status);
1867                         hci_conn_del(sco);
1868                 }
1869         }
1870
1871         hci_dev_unlock(hdev);
1872 }
1873
1874 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1875 {
1876         struct hci_cp_auth_requested *cp;
1877         struct hci_conn *conn;
1878
1879         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1880
1881         if (!status)
1882                 return;
1883
1884         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1885         if (!cp)
1886                 return;
1887
1888         hci_dev_lock(hdev);
1889
1890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1891         if (conn) {
1892                 if (conn->state == BT_CONFIG) {
1893                         hci_connect_cfm(conn, status);
1894                         hci_conn_drop(conn);
1895                 }
1896         }
1897
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1902 {
1903         struct hci_cp_set_conn_encrypt *cp;
1904         struct hci_conn *conn;
1905
1906         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1907
1908         if (!status)
1909                 return;
1910
1911         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1912         if (!cp)
1913                 return;
1914
1915         hci_dev_lock(hdev);
1916
1917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1918         if (conn) {
1919                 if (conn->state == BT_CONFIG) {
1920                         hci_connect_cfm(conn, status);
1921                         hci_conn_drop(conn);
1922                 }
1923         }
1924
1925         hci_dev_unlock(hdev);
1926 }
1927
1928 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1929                                     struct hci_conn *conn)
1930 {
1931         if (conn->state != BT_CONFIG || !conn->out)
1932                 return 0;
1933
1934         if (conn->pending_sec_level == BT_SECURITY_SDP)
1935                 return 0;
1936
1937         /* Only request authentication for SSP connections or non-SSP
1938          * devices with sec_level MEDIUM or HIGH or if MITM protection
1939          * is requested.
1940          */
1941         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1942             conn->pending_sec_level != BT_SECURITY_FIPS &&
1943             conn->pending_sec_level != BT_SECURITY_HIGH &&
1944             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1945                 return 0;
1946
1947         return 1;
1948 }
1949
1950 static int hci_resolve_name(struct hci_dev *hdev,
1951                                    struct inquiry_entry *e)
1952 {
1953         struct hci_cp_remote_name_req cp;
1954
1955         memset(&cp, 0, sizeof(cp));
1956
1957         bacpy(&cp.bdaddr, &e->data.bdaddr);
1958         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1959         cp.pscan_mode = e->data.pscan_mode;
1960         cp.clock_offset = e->data.clock_offset;
1961
1962         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1963 }
1964
1965 static bool hci_resolve_next_name(struct hci_dev *hdev)
1966 {
1967         struct discovery_state *discov = &hdev->discovery;
1968         struct inquiry_entry *e;
1969
1970         if (list_empty(&discov->resolve))
1971                 return false;
1972
1973         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1974         if (!e)
1975                 return false;
1976
1977         if (hci_resolve_name(hdev, e) == 0) {
1978                 e->name_state = NAME_PENDING;
1979                 return true;
1980         }
1981
1982         return false;
1983 }
1984
1985 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1986                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1987 {
1988         struct discovery_state *discov = &hdev->discovery;
1989         struct inquiry_entry *e;
1990
1991 #ifdef TIZEN_BT
1992         /* Update the mgmt connected state if necessary. Be careful with
1993          * conn objects that exist but are not (yet) connected however.
1994          * Only those in BT_CONFIG or BT_CONNECTED states can be
1995          * considered connected.
1996          */
1997         if (conn &&
1998             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1999                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2000                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2001                 else
2002                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2003         }
2004 #else
2005         if (conn &&
2006             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2007             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2008                 mgmt_device_connected(hdev, conn, 0, name, name_len);
2009 #endif
2010
2011         if (discov->state == DISCOVERY_STOPPED)
2012                 return;
2013
2014         if (discov->state == DISCOVERY_STOPPING)
2015                 goto discov_complete;
2016
2017         if (discov->state != DISCOVERY_RESOLVING)
2018                 return;
2019
2020         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2021         /* If the device was not found in a list of found devices names of which
2022          * are pending. there is no need to continue resolving a next name as it
2023          * will be done upon receiving another Remote Name Request Complete
2024          * Event */
2025         if (!e)
2026                 return;
2027
2028         list_del(&e->list);
2029         if (name) {
2030                 e->name_state = NAME_KNOWN;
2031                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2032                                  e->data.rssi, name, name_len);
2033         } else {
2034                 e->name_state = NAME_NOT_KNOWN;
2035         }
2036
2037         if (hci_resolve_next_name(hdev))
2038                 return;
2039
2040 discov_complete:
2041         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2042 }
2043
2044 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2045 {
2046         struct hci_cp_remote_name_req *cp;
2047         struct hci_conn *conn;
2048
2049         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2050
2051         /* If successful wait for the name req complete event before
2052          * checking for the need to do authentication */
2053         if (!status)
2054                 return;
2055
2056         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2057         if (!cp)
2058                 return;
2059
2060         hci_dev_lock(hdev);
2061
2062         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2063
2064         if (hci_dev_test_flag(hdev, HCI_MGMT))
2065                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2066
2067         if (!conn)
2068                 goto unlock;
2069
2070         if (!hci_outgoing_auth_needed(hdev, conn))
2071                 goto unlock;
2072
2073         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2074                 struct hci_cp_auth_requested auth_cp;
2075
2076                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2077
2078                 auth_cp.handle = __cpu_to_le16(conn->handle);
2079                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2080                              sizeof(auth_cp), &auth_cp);
2081         }
2082
2083 unlock:
2084         hci_dev_unlock(hdev);
2085 }
2086
2087 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2088 {
2089         struct hci_cp_read_remote_features *cp;
2090         struct hci_conn *conn;
2091
2092         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2093
2094         if (!status)
2095                 return;
2096
2097         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2098         if (!cp)
2099                 return;
2100
2101         hci_dev_lock(hdev);
2102
2103         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2104         if (conn) {
2105                 if (conn->state == BT_CONFIG) {
2106                         hci_connect_cfm(conn, status);
2107                         hci_conn_drop(conn);
2108                 }
2109         }
2110
2111         hci_dev_unlock(hdev);
2112 }
2113
2114 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2115 {
2116         struct hci_cp_read_remote_ext_features *cp;
2117         struct hci_conn *conn;
2118
2119         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2120
2121         if (!status)
2122                 return;
2123
2124         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2125         if (!cp)
2126                 return;
2127
2128         hci_dev_lock(hdev);
2129
2130         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2131         if (conn) {
2132                 if (conn->state == BT_CONFIG) {
2133                         hci_connect_cfm(conn, status);
2134                         hci_conn_drop(conn);
2135                 }
2136         }
2137
2138         hci_dev_unlock(hdev);
2139 }
2140
2141 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2142 {
2143         struct hci_cp_setup_sync_conn *cp;
2144         struct hci_conn *acl, *sco;
2145         __u16 handle;
2146
2147         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2148
2149         if (!status)
2150                 return;
2151
2152         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2153         if (!cp)
2154                 return;
2155
2156         handle = __le16_to_cpu(cp->handle);
2157
2158         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2159
2160         hci_dev_lock(hdev);
2161
2162         acl = hci_conn_hash_lookup_handle(hdev, handle);
2163         if (acl) {
2164                 sco = acl->link;
2165                 if (sco) {
2166                         sco->state = BT_CLOSED;
2167
2168                         hci_connect_cfm(sco, status);
2169                         hci_conn_del(sco);
2170                 }
2171         }
2172
2173         hci_dev_unlock(hdev);
2174 }
2175
2176 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2177 {
2178         struct hci_cp_sniff_mode *cp;
2179         struct hci_conn *conn;
2180
2181         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2182
2183         if (!status)
2184                 return;
2185
2186         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2187         if (!cp)
2188                 return;
2189
2190         hci_dev_lock(hdev);
2191
2192         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2193         if (conn) {
2194                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2195
2196                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2197                         hci_sco_setup(conn, status);
2198         }
2199
2200         hci_dev_unlock(hdev);
2201 }
2202
2203 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2204 {
2205         struct hci_cp_exit_sniff_mode *cp;
2206         struct hci_conn *conn;
2207
2208         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2209
2210         if (!status)
2211                 return;
2212
2213         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2214         if (!cp)
2215                 return;
2216
2217         hci_dev_lock(hdev);
2218
2219         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2220         if (conn) {
2221                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2222
2223                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2224                         hci_sco_setup(conn, status);
2225         }
2226
2227         hci_dev_unlock(hdev);
2228 }
2229
2230 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2231 {
2232         struct hci_cp_disconnect *cp;
2233         struct hci_conn *conn;
2234
2235         if (!status)
2236                 return;
2237
2238         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2239         if (!cp)
2240                 return;
2241
2242         hci_dev_lock(hdev);
2243
2244         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2245         if (conn)
2246                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2247                                        conn->dst_type, status);
2248
2249         hci_dev_unlock(hdev);
2250 }
2251
2252 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2253                               u8 peer_addr_type, u8 own_address_type,
2254                               u8 filter_policy)
2255 {
2256         struct hci_conn *conn;
2257
2258         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2259                                        peer_addr_type);
2260         if (!conn)
2261                 return;
2262
2263         /* Store the initiator and responder address information which
2264          * is needed for SMP. These values will not change during the
2265          * lifetime of the connection.
2266          */
2267         conn->init_addr_type = own_address_type;
2268         if (own_address_type == ADDR_LE_DEV_RANDOM)
2269                 bacpy(&conn->init_addr, &hdev->random_addr);
2270         else
2271                 bacpy(&conn->init_addr, &hdev->bdaddr);
2272
2273         conn->resp_addr_type = peer_addr_type;
2274         bacpy(&conn->resp_addr, peer_addr);
2275
2276         /* We don't want the connection attempt to stick around
2277          * indefinitely since LE doesn't have a page timeout concept
2278          * like BR/EDR. Set a timer for any connection that doesn't use
2279          * the white list for connecting.
2280          */
2281         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2282                 queue_delayed_work(conn->hdev->workqueue,
2283                                    &conn->le_conn_timeout,
2284                                    conn->conn_timeout);
2285 }
2286
2287 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2288 {
2289         struct hci_cp_le_create_conn *cp;
2290
2291         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2292
2293         /* All connection failure handling is taken care of by the
2294          * hci_le_conn_failed function which is triggered by the HCI
2295          * request completion callbacks used for connecting.
2296          */
2297         if (status)
2298                 return;
2299
2300         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2301         if (!cp)
2302                 return;
2303
2304         hci_dev_lock(hdev);
2305
2306         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2307                           cp->own_address_type, cp->filter_policy);
2308
2309         hci_dev_unlock(hdev);
2310 }
2311
2312 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2313 {
2314         struct hci_cp_le_ext_create_conn *cp;
2315
2316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2317
2318         /* All connection failure handling is taken care of by the
2319          * hci_le_conn_failed function which is triggered by the HCI
2320          * request completion callbacks used for connecting.
2321          */
2322         if (status)
2323                 return;
2324
2325         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2326         if (!cp)
2327                 return;
2328
2329         hci_dev_lock(hdev);
2330
2331         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2332                           cp->own_addr_type, cp->filter_policy);
2333
2334         hci_dev_unlock(hdev);
2335 }
2336
2337 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2338 {
2339         struct hci_cp_le_read_remote_features *cp;
2340         struct hci_conn *conn;
2341
2342         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2343
2344         if (!status)
2345                 return;
2346
2347         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2348         if (!cp)
2349                 return;
2350
2351         hci_dev_lock(hdev);
2352
2353         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2354         if (conn) {
2355                 if (conn->state == BT_CONFIG) {
2356                         hci_connect_cfm(conn, status);
2357                         hci_conn_drop(conn);
2358                 }
2359         }
2360
2361         hci_dev_unlock(hdev);
2362 }
2363
2364 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2365 {
2366         struct hci_cp_le_start_enc *cp;
2367         struct hci_conn *conn;
2368
2369         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2370
2371         if (!status)
2372                 return;
2373
2374         hci_dev_lock(hdev);
2375
2376         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2377         if (!cp)
2378                 goto unlock;
2379
2380         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2381         if (!conn)
2382                 goto unlock;
2383
2384         if (conn->state != BT_CONNECTED)
2385                 goto unlock;
2386
2387         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2388         hci_conn_drop(conn);
2389
2390 unlock:
2391         hci_dev_unlock(hdev);
2392 }
2393
2394 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2395 {
2396         struct hci_cp_switch_role *cp;
2397         struct hci_conn *conn;
2398
2399         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2400
2401         if (!status)
2402                 return;
2403
2404         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2405         if (!cp)
2406                 return;
2407
2408         hci_dev_lock(hdev);
2409
2410         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2411         if (conn)
2412                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2413
2414         hci_dev_unlock(hdev);
2415 }
2416
2417 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2418 {
2419         __u8 status = *((__u8 *) skb->data);
2420         struct discovery_state *discov = &hdev->discovery;
2421         struct inquiry_entry *e;
2422
2423         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2424
2425         hci_conn_check_pending(hdev);
2426
2427         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2428                 return;
2429
2430         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2431         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2432
2433         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2434                 return;
2435
2436         hci_dev_lock(hdev);
2437
2438         if (discov->state != DISCOVERY_FINDING)
2439                 goto unlock;
2440
2441         if (list_empty(&discov->resolve)) {
2442                 /* When BR/EDR inquiry is active and no LE scanning is in
2443                  * progress, then change discovery state to indicate completion.
2444                  *
2445                  * When running LE scanning and BR/EDR inquiry simultaneously
2446                  * and the LE scan already finished, then change the discovery
2447                  * state to indicate completion.
2448                  */
2449                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2450                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2451                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2452                 goto unlock;
2453         }
2454
2455         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2456         if (e && hci_resolve_name(hdev, e) == 0) {
2457                 e->name_state = NAME_PENDING;
2458                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2459         } else {
2460                 /* When BR/EDR inquiry is active and no LE scanning is in
2461                  * progress, then change discovery state to indicate completion.
2462                  *
2463                  * When running LE scanning and BR/EDR inquiry simultaneously
2464                  * and the LE scan already finished, then change the discovery
2465                  * state to indicate completion.
2466                  */
2467                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2468                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2469                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2470         }
2471
2472 unlock:
2473         hci_dev_unlock(hdev);
2474 }
2475
2476 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2477 {
2478         struct inquiry_data data;
2479         struct inquiry_info *info = (void *) (skb->data + 1);
2480         int num_rsp = *((__u8 *) skb->data);
2481
2482         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2483
2484         if (!num_rsp)
2485                 return;
2486
2487         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2488                 return;
2489
2490         hci_dev_lock(hdev);
2491
2492         for (; num_rsp; num_rsp--, info++) {
2493                 u32 flags;
2494
2495                 bacpy(&data.bdaddr, &info->bdaddr);
2496                 data.pscan_rep_mode     = info->pscan_rep_mode;
2497                 data.pscan_period_mode  = info->pscan_period_mode;
2498                 data.pscan_mode         = info->pscan_mode;
2499                 memcpy(data.dev_class, info->dev_class, 3);
2500                 data.clock_offset       = info->clock_offset;
2501                 data.rssi               = HCI_RSSI_INVALID;
2502                 data.ssp_mode           = 0x00;
2503
2504                 flags = hci_inquiry_cache_update(hdev, &data, false);
2505
2506                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2507                                   info->dev_class, HCI_RSSI_INVALID,
2508                                   flags, NULL, 0, NULL, 0);
2509         }
2510
2511         hci_dev_unlock(hdev);
2512 }
2513
2514 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2515 {
2516         struct hci_ev_conn_complete *ev = (void *) skb->data;
2517         struct hci_conn *conn;
2518
2519         BT_DBG("%s", hdev->name);
2520
2521         hci_dev_lock(hdev);
2522
2523         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2524         if (!conn) {
2525                 if (ev->link_type != SCO_LINK)
2526                         goto unlock;
2527
2528                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2529                 if (!conn)
2530                         goto unlock;
2531
2532                 conn->type = SCO_LINK;
2533         }
2534
2535         if (!ev->status) {
2536                 conn->handle = __le16_to_cpu(ev->handle);
2537
2538                 if (conn->type == ACL_LINK) {
2539                         conn->state = BT_CONFIG;
2540                         hci_conn_hold(conn);
2541
2542                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2543                             !hci_find_link_key(hdev, &ev->bdaddr))
2544                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2545                         else
2546                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2547                 } else
2548                         conn->state = BT_CONNECTED;
2549
2550                 hci_debugfs_create_conn(conn);
2551                 hci_conn_add_sysfs(conn);
2552
2553                 if (test_bit(HCI_AUTH, &hdev->flags))
2554                         set_bit(HCI_CONN_AUTH, &conn->flags);
2555
2556                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2557                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2558
2559                 /* Get remote features */
2560                 if (conn->type == ACL_LINK) {
2561                         struct hci_cp_read_remote_features cp;
2562                         cp.handle = ev->handle;
2563                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2564                                      sizeof(cp), &cp);
2565
2566                         hci_req_update_scan(hdev);
2567                 }
2568
2569                 /* Set packet type for incoming connection */
2570                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2571                         struct hci_cp_change_conn_ptype cp;
2572                         cp.handle = ev->handle;
2573                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2574                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2575                                      &cp);
2576                 }
2577 #ifdef TIZEN_BT
2578                 if (get_link_mode(conn) & HCI_LM_MASTER)
2579                         hci_conn_change_supervision_timeout(conn,
2580                                         LINK_SUPERVISION_TIMEOUT);
2581 #endif
2582         } else {
2583                 conn->state = BT_CLOSED;
2584                 if (conn->type == ACL_LINK)
2585                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2586                                             conn->dst_type, ev->status);
2587         }
2588
2589         if (conn->type == ACL_LINK)
2590                 hci_sco_setup(conn, ev->status);
2591
2592         if (ev->status) {
2593                 hci_connect_cfm(conn, ev->status);
2594                 hci_conn_del(conn);
2595         } else if (ev->link_type != ACL_LINK)
2596                 hci_connect_cfm(conn, ev->status);
2597
2598 unlock:
2599         hci_dev_unlock(hdev);
2600
2601         hci_conn_check_pending(hdev);
2602 }
2603
2604 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2605 {
2606         struct hci_cp_reject_conn_req cp;
2607
2608         bacpy(&cp.bdaddr, bdaddr);
2609         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2610         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2611 }
2612
2613 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2614 {
2615         struct hci_ev_conn_request *ev = (void *) skb->data;
2616         int mask = hdev->link_mode;
2617         struct inquiry_entry *ie;
2618         struct hci_conn *conn;
2619         __u8 flags = 0;
2620
2621         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2622                ev->link_type);
2623
2624         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2625                                       &flags);
2626
2627         if (!(mask & HCI_LM_ACCEPT)) {
2628                 hci_reject_conn(hdev, &ev->bdaddr);
2629                 return;
2630         }
2631
2632         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2633                                    BDADDR_BREDR)) {
2634                 hci_reject_conn(hdev, &ev->bdaddr);
2635                 return;
2636         }
2637
2638         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2639          * connection. These features are only touched through mgmt so
2640          * only do the checks if HCI_MGMT is set.
2641          */
2642         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2643             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2644             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2645                                     BDADDR_BREDR)) {
2646                     hci_reject_conn(hdev, &ev->bdaddr);
2647                     return;
2648         }
2649
2650         /* Connection accepted */
2651
2652         hci_dev_lock(hdev);
2653
2654         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2655         if (ie)
2656                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2657
2658 #ifdef TIZEN_BT
2659                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2660                     hci_conn_hash_lookup_sco(hdev)) {
2661                         struct hci_cp_reject_conn_req cp;
2662
2663                         bacpy(&cp.bdaddr, &ev->bdaddr);
2664                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2665                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2666                                      sizeof(cp), &cp);
2667                         hci_dev_unlock(hdev);
2668                         return;
2669                 }
2670 #endif
2671
2672         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2673                         &ev->bdaddr);
2674         if (!conn) {
2675                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2676                                     HCI_ROLE_SLAVE);
2677                 if (!conn) {
2678                         bt_dev_err(hdev, "no memory for new connection");
2679                         hci_dev_unlock(hdev);
2680                         return;
2681                 }
2682         }
2683
2684         memcpy(conn->dev_class, ev->dev_class, 3);
2685
2686         hci_dev_unlock(hdev);
2687
2688         if (ev->link_type == ACL_LINK ||
2689             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2690                 struct hci_cp_accept_conn_req cp;
2691                 conn->state = BT_CONNECT;
2692
2693                 bacpy(&cp.bdaddr, &ev->bdaddr);
2694
2695                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2696                         cp.role = 0x00; /* Become master */
2697                 else
2698                         cp.role = 0x01; /* Remain slave */
2699
2700                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2701         } else if (!(flags & HCI_PROTO_DEFER)) {
2702                 struct hci_cp_accept_sync_conn_req cp;
2703                 conn->state = BT_CONNECT;
2704
2705                 bacpy(&cp.bdaddr, &ev->bdaddr);
2706                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2707
2708                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2709                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2710                 cp.max_latency    = cpu_to_le16(0xffff);
2711                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2712                 cp.retrans_effort = 0xff;
2713
2714                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2715                              &cp);
2716         } else {
2717                 conn->state = BT_CONNECT2;
2718                 hci_connect_cfm(conn, 0);
2719         }
2720 }
2721
2722 static u8 hci_to_mgmt_reason(u8 err)
2723 {
2724         switch (err) {
2725         case HCI_ERROR_CONNECTION_TIMEOUT:
2726                 return MGMT_DEV_DISCONN_TIMEOUT;
2727         case HCI_ERROR_REMOTE_USER_TERM:
2728         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2729         case HCI_ERROR_REMOTE_POWER_OFF:
2730                 return MGMT_DEV_DISCONN_REMOTE;
2731         case HCI_ERROR_LOCAL_HOST_TERM:
2732                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2733         default:
2734                 return MGMT_DEV_DISCONN_UNKNOWN;
2735         }
2736 }
2737
2738 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2739 {
2740         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2741         u8 reason;
2742         struct hci_conn_params *params;
2743         struct hci_conn *conn;
2744         bool mgmt_connected;
2745         u8 type;
2746
2747         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2748
2749         hci_dev_lock(hdev);
2750
2751         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2752         if (!conn)
2753                 goto unlock;
2754
2755         if (ev->status) {
2756                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2757                                        conn->dst_type, ev->status);
2758                 goto unlock;
2759         }
2760
2761         conn->state = BT_CLOSED;
2762
2763         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2764
2765         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2766                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2767         else
2768                 reason = hci_to_mgmt_reason(ev->reason);
2769
2770         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2771                                 reason, mgmt_connected);
2772
2773         if (conn->type == ACL_LINK) {
2774                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2775                         hci_remove_link_key(hdev, &conn->dst);
2776
2777                 hci_req_update_scan(hdev);
2778         }
2779
2780         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2781         if (params) {
2782                 switch (params->auto_connect) {
2783                 case HCI_AUTO_CONN_LINK_LOSS:
2784                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2785                                 break;
2786                         /* Fall through */
2787
2788                 case HCI_AUTO_CONN_DIRECT:
2789                 case HCI_AUTO_CONN_ALWAYS:
2790                         list_del_init(&params->action);
2791                         list_add(&params->action, &hdev->pend_le_conns);
2792                         hci_update_background_scan(hdev);
2793                         break;
2794
2795                 default:
2796                         break;
2797                 }
2798         }
2799
2800         type = conn->type;
2801
2802         hci_disconn_cfm(conn, ev->reason);
2803         hci_conn_del(conn);
2804
2805         /* Re-enable advertising if necessary, since it might
2806          * have been disabled by the connection. From the
2807          * HCI_LE_Set_Advertise_Enable command description in
2808          * the core specification (v4.0):
2809          * "The Controller shall continue advertising until the Host
2810          * issues an LE_Set_Advertise_Enable command with
2811          * Advertising_Enable set to 0x00 (Advertising is disabled)
2812          * or until a connection is created or until the Advertising
2813          * is timed out due to Directed Advertising."
2814          */
2815         if (type == LE_LINK)
2816                 hci_req_reenable_advertising(hdev);
2817
2818 unlock:
2819         hci_dev_unlock(hdev);
2820 }
2821
2822 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2823 {
2824         struct hci_ev_auth_complete *ev = (void *) skb->data;
2825         struct hci_conn *conn;
2826
2827         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2828
2829         hci_dev_lock(hdev);
2830
2831         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2832         if (!conn)
2833                 goto unlock;
2834
2835         if (!ev->status) {
2836                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2837
2838                 if (!hci_conn_ssp_enabled(conn) &&
2839                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2840                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2841                 } else {
2842                         set_bit(HCI_CONN_AUTH, &conn->flags);
2843                         conn->sec_level = conn->pending_sec_level;
2844                 }
2845         } else {
2846                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2847                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2848
2849                 mgmt_auth_failed(conn, ev->status);
2850         }
2851
2852         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2853         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2854
2855         if (conn->state == BT_CONFIG) {
2856                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2857                         struct hci_cp_set_conn_encrypt cp;
2858                         cp.handle  = ev->handle;
2859                         cp.encrypt = 0x01;
2860                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2861                                      &cp);
2862                 } else {
2863                         conn->state = BT_CONNECTED;
2864                         hci_connect_cfm(conn, ev->status);
2865                         hci_conn_drop(conn);
2866                 }
2867         } else {
2868                 hci_auth_cfm(conn, ev->status);
2869
2870                 hci_conn_hold(conn);
2871                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2872                 hci_conn_drop(conn);
2873         }
2874
2875         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2876                 if (!ev->status) {
2877                         struct hci_cp_set_conn_encrypt cp;
2878                         cp.handle  = ev->handle;
2879                         cp.encrypt = 0x01;
2880                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2881                                      &cp);
2882                 } else {
2883                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2884                         hci_encrypt_cfm(conn, ev->status, 0x00);
2885                 }
2886         }
2887
2888 unlock:
2889         hci_dev_unlock(hdev);
2890 }
2891
2892 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2893 {
2894         struct hci_ev_remote_name *ev = (void *) skb->data;
2895         struct hci_conn *conn;
2896
2897         BT_DBG("%s", hdev->name);
2898
2899         hci_conn_check_pending(hdev);
2900
2901         hci_dev_lock(hdev);
2902
2903         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2904
2905         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2906                 goto check_auth;
2907
2908         if (ev->status == 0)
2909                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2910                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2911         else
2912                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2913
2914 check_auth:
2915         if (!conn)
2916                 goto unlock;
2917
2918         if (!hci_outgoing_auth_needed(hdev, conn))
2919                 goto unlock;
2920
2921         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2922                 struct hci_cp_auth_requested cp;
2923
2924                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2925
2926                 cp.handle = __cpu_to_le16(conn->handle);
2927                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2928         }
2929
2930 unlock:
2931         hci_dev_unlock(hdev);
2932 }
2933
2934 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2935                                        u16 opcode, struct sk_buff *skb)
2936 {
2937         const struct hci_rp_read_enc_key_size *rp;
2938         struct hci_conn *conn;
2939         u16 handle;
2940
2941         BT_DBG("%s status 0x%02x", hdev->name, status);
2942
2943         if (!skb || skb->len < sizeof(*rp)) {
2944                 bt_dev_err(hdev, "invalid read key size response");
2945                 return;
2946         }
2947
2948         rp = (void *)skb->data;
2949         handle = le16_to_cpu(rp->handle);
2950
2951         hci_dev_lock(hdev);
2952
2953         conn = hci_conn_hash_lookup_handle(hdev, handle);
2954         if (!conn)
2955                 goto unlock;
2956
2957         /* If we fail to read the encryption key size, assume maximum
2958          * (which is the same we do also when this HCI command isn't
2959          * supported.
2960          */
2961         if (rp->status) {
2962                 bt_dev_err(hdev, "failed to read key size for handle %u",
2963                            handle);
2964                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2965         } else {
2966                 conn->enc_key_size = rp->key_size;
2967         }
2968
2969         if (conn->state == BT_CONFIG) {
2970                 conn->state = BT_CONNECTED;
2971                 hci_connect_cfm(conn, 0);
2972                 hci_conn_drop(conn);
2973         } else {
2974                 u8 encrypt;
2975
2976                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2977                         encrypt = 0x00;
2978                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2979                         encrypt = 0x02;
2980                 else
2981                         encrypt = 0x01;
2982
2983                 hci_encrypt_cfm(conn, 0, encrypt);
2984         }
2985
2986 unlock:
2987         hci_dev_unlock(hdev);
2988 }
2989
2990 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2991 {
2992         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2993         struct hci_conn *conn;
2994
2995         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2996
2997         hci_dev_lock(hdev);
2998
2999         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3000         if (!conn)
3001                 goto unlock;
3002
3003         if (!ev->status) {
3004                 if (ev->encrypt) {
3005                         /* Encryption implies authentication */
3006                         set_bit(HCI_CONN_AUTH, &conn->flags);
3007                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3008                         conn->sec_level = conn->pending_sec_level;
3009
3010                         /* P-256 authentication key implies FIPS */
3011                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3012                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3013
3014                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3015                             conn->type == LE_LINK)
3016                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3017                 } else {
3018                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3019                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3020                 }
3021         }
3022
3023         /* We should disregard the current RPA and generate a new one
3024          * whenever the encryption procedure fails.
3025          */
3026         if (ev->status && conn->type == LE_LINK) {
3027                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3028                 hci_adv_instances_set_rpa_expired(hdev, true);
3029         }
3030
3031         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3032
3033         if (ev->status && conn->state == BT_CONNECTED) {
3034                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3035                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3036
3037                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3038                 hci_conn_drop(conn);
3039                 goto unlock;
3040         }
3041
3042         /* In Secure Connections Only mode, do not allow any connections
3043          * that are not encrypted with AES-CCM using a P-256 authenticated
3044          * combination key.
3045          */
3046         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
3047             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
3048              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
3049                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
3050                 hci_conn_drop(conn);
3051                 goto unlock;
3052         }
3053
3054         /* Try reading the encryption key size for encrypted ACL links */
3055         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3056                 struct hci_cp_read_enc_key_size cp;
3057                 struct hci_request req;
3058
3059                 /* Only send HCI_Read_Encryption_Key_Size if the
3060                  * controller really supports it. If it doesn't, assume
3061                  * the default size (16).
3062                  */
3063                 if (!(hdev->commands[20] & 0x10)) {
3064                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3065                         goto notify;
3066                 }
3067
3068                 hci_req_init(&req, hdev);
3069
3070                 cp.handle = cpu_to_le16(conn->handle);
3071                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3072
3073                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3074                         bt_dev_err(hdev, "sending read key size failed");
3075                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3076                         goto notify;
3077                 }
3078
3079                 goto unlock;
3080         }
3081
3082 notify:
3083         if (conn->state == BT_CONFIG) {
3084                 if (!ev->status)
3085                         conn->state = BT_CONNECTED;
3086
3087                 hci_connect_cfm(conn, ev->status);
3088                 hci_conn_drop(conn);
3089         } else
3090                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
3091
3092 unlock:
3093         hci_dev_unlock(hdev);
3094 }
3095
3096 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3097                                              struct sk_buff *skb)
3098 {
3099         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3100         struct hci_conn *conn;
3101
3102         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3103
3104         hci_dev_lock(hdev);
3105
3106         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3107         if (conn) {
3108                 if (!ev->status)
3109                         set_bit(HCI_CONN_SECURE, &conn->flags);
3110
3111                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3112
3113                 hci_key_change_cfm(conn, ev->status);
3114         }
3115
3116         hci_dev_unlock(hdev);
3117 }
3118
3119 static void hci_remote_features_evt(struct hci_dev *hdev,
3120                                     struct sk_buff *skb)
3121 {
3122         struct hci_ev_remote_features *ev = (void *) skb->data;
3123         struct hci_conn *conn;
3124
3125         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3126
3127         hci_dev_lock(hdev);
3128
3129         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3130         if (!conn)
3131                 goto unlock;
3132
3133         if (!ev->status)
3134                 memcpy(conn->features[0], ev->features, 8);
3135
3136         if (conn->state != BT_CONFIG)
3137                 goto unlock;
3138
3139         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3140             lmp_ext_feat_capable(conn)) {
3141                 struct hci_cp_read_remote_ext_features cp;
3142                 cp.handle = ev->handle;
3143                 cp.page = 0x01;
3144                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3145                              sizeof(cp), &cp);
3146                 goto unlock;
3147         }
3148
3149         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3150                 struct hci_cp_remote_name_req cp;
3151                 memset(&cp, 0, sizeof(cp));
3152                 bacpy(&cp.bdaddr, &conn->dst);
3153                 cp.pscan_rep_mode = 0x02;
3154                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3155         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3156                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3157
3158         if (!hci_outgoing_auth_needed(hdev, conn)) {
3159                 conn->state = BT_CONNECTED;
3160                 hci_connect_cfm(conn, ev->status);
3161                 hci_conn_drop(conn);
3162         }
3163
3164 unlock:
3165         hci_dev_unlock(hdev);
3166 }
3167
3168 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3169                                  u16 *opcode, u8 *status,
3170                                  hci_req_complete_t *req_complete,
3171                                  hci_req_complete_skb_t *req_complete_skb)
3172 {
3173         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3174
3175         *opcode = __le16_to_cpu(ev->opcode);
3176         *status = skb->data[sizeof(*ev)];
3177
3178         skb_pull(skb, sizeof(*ev));
3179
3180         switch (*opcode) {
3181         case HCI_OP_INQUIRY_CANCEL:
3182                 hci_cc_inquiry_cancel(hdev, skb);
3183                 break;
3184
3185         case HCI_OP_PERIODIC_INQ:
3186                 hci_cc_periodic_inq(hdev, skb);
3187                 break;
3188
3189         case HCI_OP_EXIT_PERIODIC_INQ:
3190                 hci_cc_exit_periodic_inq(hdev, skb);
3191                 break;
3192
3193         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3194                 hci_cc_remote_name_req_cancel(hdev, skb);
3195                 break;
3196
3197         case HCI_OP_ROLE_DISCOVERY:
3198                 hci_cc_role_discovery(hdev, skb);
3199                 break;
3200
3201         case HCI_OP_READ_LINK_POLICY:
3202                 hci_cc_read_link_policy(hdev, skb);
3203                 break;
3204
3205         case HCI_OP_WRITE_LINK_POLICY:
3206                 hci_cc_write_link_policy(hdev, skb);
3207                 break;
3208
3209         case HCI_OP_READ_DEF_LINK_POLICY:
3210                 hci_cc_read_def_link_policy(hdev, skb);
3211                 break;
3212
3213         case HCI_OP_WRITE_DEF_LINK_POLICY:
3214                 hci_cc_write_def_link_policy(hdev, skb);
3215                 break;
3216
3217         case HCI_OP_RESET:
3218                 hci_cc_reset(hdev, skb);
3219                 break;
3220
3221         case HCI_OP_READ_STORED_LINK_KEY:
3222                 hci_cc_read_stored_link_key(hdev, skb);
3223                 break;
3224
3225         case HCI_OP_DELETE_STORED_LINK_KEY:
3226                 hci_cc_delete_stored_link_key(hdev, skb);
3227                 break;
3228
3229         case HCI_OP_WRITE_LOCAL_NAME:
3230                 hci_cc_write_local_name(hdev, skb);
3231                 break;
3232
3233         case HCI_OP_READ_LOCAL_NAME:
3234                 hci_cc_read_local_name(hdev, skb);
3235                 break;
3236
3237         case HCI_OP_WRITE_AUTH_ENABLE:
3238                 hci_cc_write_auth_enable(hdev, skb);
3239                 break;
3240
3241         case HCI_OP_WRITE_ENCRYPT_MODE:
3242                 hci_cc_write_encrypt_mode(hdev, skb);
3243                 break;
3244
3245         case HCI_OP_WRITE_SCAN_ENABLE:
3246                 hci_cc_write_scan_enable(hdev, skb);
3247                 break;
3248
3249         case HCI_OP_READ_CLASS_OF_DEV:
3250                 hci_cc_read_class_of_dev(hdev, skb);
3251                 break;
3252
3253         case HCI_OP_WRITE_CLASS_OF_DEV:
3254                 hci_cc_write_class_of_dev(hdev, skb);
3255                 break;
3256
3257         case HCI_OP_READ_VOICE_SETTING:
3258                 hci_cc_read_voice_setting(hdev, skb);
3259                 break;
3260
3261         case HCI_OP_WRITE_VOICE_SETTING:
3262                 hci_cc_write_voice_setting(hdev, skb);
3263                 break;
3264
3265         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3266                 hci_cc_read_num_supported_iac(hdev, skb);
3267                 break;
3268
3269         case HCI_OP_WRITE_SSP_MODE:
3270                 hci_cc_write_ssp_mode(hdev, skb);
3271                 break;
3272
3273         case HCI_OP_WRITE_SC_SUPPORT:
3274                 hci_cc_write_sc_support(hdev, skb);
3275                 break;
3276
3277         case HCI_OP_READ_LOCAL_VERSION:
3278                 hci_cc_read_local_version(hdev, skb);
3279                 break;
3280
3281         case HCI_OP_READ_LOCAL_COMMANDS:
3282                 hci_cc_read_local_commands(hdev, skb);
3283                 break;
3284
3285         case HCI_OP_READ_LOCAL_FEATURES:
3286                 hci_cc_read_local_features(hdev, skb);
3287                 break;
3288
3289         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3290                 hci_cc_read_local_ext_features(hdev, skb);
3291                 break;
3292
3293         case HCI_OP_READ_BUFFER_SIZE:
3294                 hci_cc_read_buffer_size(hdev, skb);
3295                 break;
3296
3297         case HCI_OP_READ_BD_ADDR:
3298                 hci_cc_read_bd_addr(hdev, skb);
3299                 break;
3300
3301         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3302                 hci_cc_read_page_scan_activity(hdev, skb);
3303                 break;
3304
3305         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3306                 hci_cc_write_page_scan_activity(hdev, skb);
3307                 break;
3308
3309         case HCI_OP_READ_PAGE_SCAN_TYPE:
3310                 hci_cc_read_page_scan_type(hdev, skb);
3311                 break;
3312
3313         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3314                 hci_cc_write_page_scan_type(hdev, skb);
3315                 break;
3316
3317         case HCI_OP_READ_DATA_BLOCK_SIZE:
3318                 hci_cc_read_data_block_size(hdev, skb);
3319                 break;
3320
3321         case HCI_OP_READ_FLOW_CONTROL_MODE:
3322                 hci_cc_read_flow_control_mode(hdev, skb);
3323                 break;
3324
3325         case HCI_OP_READ_LOCAL_AMP_INFO:
3326                 hci_cc_read_local_amp_info(hdev, skb);
3327                 break;
3328
3329         case HCI_OP_READ_CLOCK:
3330                 hci_cc_read_clock(hdev, skb);
3331                 break;
3332
3333         case HCI_OP_READ_INQ_RSP_TX_POWER:
3334                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3335                 break;
3336
3337         case HCI_OP_PIN_CODE_REPLY:
3338                 hci_cc_pin_code_reply(hdev, skb);
3339                 break;
3340
3341         case HCI_OP_PIN_CODE_NEG_REPLY:
3342                 hci_cc_pin_code_neg_reply(hdev, skb);
3343                 break;
3344
3345         case HCI_OP_READ_LOCAL_OOB_DATA:
3346                 hci_cc_read_local_oob_data(hdev, skb);
3347                 break;
3348
3349         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3350                 hci_cc_read_local_oob_ext_data(hdev, skb);
3351                 break;
3352
3353         case HCI_OP_LE_READ_BUFFER_SIZE:
3354                 hci_cc_le_read_buffer_size(hdev, skb);
3355                 break;
3356
3357         case HCI_OP_LE_READ_LOCAL_FEATURES:
3358                 hci_cc_le_read_local_features(hdev, skb);
3359                 break;
3360
3361         case HCI_OP_LE_READ_ADV_TX_POWER:
3362                 hci_cc_le_read_adv_tx_power(hdev, skb);
3363                 break;
3364
3365         case HCI_OP_USER_CONFIRM_REPLY:
3366                 hci_cc_user_confirm_reply(hdev, skb);
3367                 break;
3368
3369         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3370                 hci_cc_user_confirm_neg_reply(hdev, skb);
3371                 break;
3372
3373         case HCI_OP_USER_PASSKEY_REPLY:
3374                 hci_cc_user_passkey_reply(hdev, skb);
3375                 break;
3376
3377         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3378                 hci_cc_user_passkey_neg_reply(hdev, skb);
3379                 break;
3380
3381         case HCI_OP_LE_SET_RANDOM_ADDR:
3382                 hci_cc_le_set_random_addr(hdev, skb);
3383                 break;
3384
3385         case HCI_OP_LE_SET_ADV_ENABLE:
3386                 hci_cc_le_set_adv_enable(hdev, skb);
3387                 break;
3388
3389         case HCI_OP_LE_SET_SCAN_PARAM:
3390                 hci_cc_le_set_scan_param(hdev, skb);
3391                 break;
3392
3393         case HCI_OP_LE_SET_SCAN_ENABLE:
3394                 hci_cc_le_set_scan_enable(hdev, skb);
3395                 break;
3396
3397         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3398                 hci_cc_le_read_white_list_size(hdev, skb);
3399                 break;
3400
3401         case HCI_OP_LE_CLEAR_WHITE_LIST:
3402                 hci_cc_le_clear_white_list(hdev, skb);
3403                 break;
3404
3405         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3406                 hci_cc_le_add_to_white_list(hdev, skb);
3407                 break;
3408
3409         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3410                 hci_cc_le_del_from_white_list(hdev, skb);
3411                 break;
3412
3413         case HCI_OP_LE_READ_SUPPORTED_STATES:
3414                 hci_cc_le_read_supported_states(hdev, skb);
3415                 break;
3416
3417         case HCI_OP_LE_READ_DEF_DATA_LEN:
3418                 hci_cc_le_read_def_data_len(hdev, skb);
3419                 break;
3420
3421         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3422                 hci_cc_le_write_def_data_len(hdev, skb);
3423                 break;
3424
3425         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3426                 hci_cc_le_clear_resolv_list(hdev, skb);
3427                 break;
3428
3429         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3430                 hci_cc_le_read_resolv_list_size(hdev, skb);
3431                 break;
3432
3433         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3434                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3435                 break;
3436
3437         case HCI_OP_LE_READ_MAX_DATA_LEN:
3438                 hci_cc_le_read_max_data_len(hdev, skb);
3439                 break;
3440
3441         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3442                 hci_cc_write_le_host_supported(hdev, skb);
3443                 break;
3444
3445         case HCI_OP_LE_SET_ADV_PARAM:
3446                 hci_cc_set_adv_param(hdev, skb);
3447                 break;
3448
3449         case HCI_OP_READ_RSSI:
3450                 hci_cc_read_rssi(hdev, skb);
3451                 break;
3452
3453         case HCI_OP_READ_TX_POWER:
3454                 hci_cc_read_tx_power(hdev, skb);
3455                 break;
3456
3457         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3458                 hci_cc_write_ssp_debug_mode(hdev, skb);
3459                 break;
3460
3461         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3462                 hci_cc_le_set_ext_scan_param(hdev, skb);
3463                 break;
3464
3465         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3466                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3467                 break;
3468
3469         case HCI_OP_LE_SET_DEFAULT_PHY:
3470                 hci_cc_le_set_default_phy(hdev, skb);
3471                 break;
3472
3473         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3474                 hci_cc_le_read_num_adv_sets(hdev, skb);
3475                 break;
3476
3477         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3478                 hci_cc_set_ext_adv_param(hdev, skb);
3479                 break;
3480
3481         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3482                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3483                 break;
3484
3485         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3486                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3487                 break;
3488 #ifdef TIZEN_BT
3489         case HCI_OP_ENABLE_RSSI:
3490                 hci_cc_enable_rssi(hdev, skb);
3491                 break;
3492
3493         case HCI_OP_GET_RAW_RSSI:
3494                 hci_cc_get_raw_rssi(hdev, skb);
3495                 break;
3496 #endif
3497         default:
3498                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3499                 break;
3500         }
3501
3502         if (*opcode != HCI_OP_NOP)
3503                 cancel_delayed_work(&hdev->cmd_timer);
3504
3505         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3506                 atomic_set(&hdev->cmd_cnt, 1);
3507
3508         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3509                              req_complete_skb);
3510
3511         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3512                 bt_dev_err(hdev,
3513                            "unexpected event for opcode 0x%4.4x", *opcode);
3514                 return;
3515         }
3516
3517         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3518                 queue_work(hdev->workqueue, &hdev->cmd_work);
3519 }
3520
3521 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3522                                u16 *opcode, u8 *status,
3523                                hci_req_complete_t *req_complete,
3524                                hci_req_complete_skb_t *req_complete_skb)
3525 {
3526         struct hci_ev_cmd_status *ev = (void *) skb->data;
3527
3528         skb_pull(skb, sizeof(*ev));
3529
3530         *opcode = __le16_to_cpu(ev->opcode);
3531         *status = ev->status;
3532
3533         switch (*opcode) {
3534         case HCI_OP_INQUIRY:
3535                 hci_cs_inquiry(hdev, ev->status);
3536                 break;
3537
3538         case HCI_OP_CREATE_CONN:
3539                 hci_cs_create_conn(hdev, ev->status);
3540                 break;
3541
3542         case HCI_OP_DISCONNECT:
3543                 hci_cs_disconnect(hdev, ev->status);
3544                 break;
3545
3546         case HCI_OP_ADD_SCO:
3547                 hci_cs_add_sco(hdev, ev->status);
3548                 break;
3549
3550         case HCI_OP_AUTH_REQUESTED:
3551                 hci_cs_auth_requested(hdev, ev->status);
3552                 break;
3553
3554         case HCI_OP_SET_CONN_ENCRYPT:
3555                 hci_cs_set_conn_encrypt(hdev, ev->status);
3556                 break;
3557
3558         case HCI_OP_REMOTE_NAME_REQ:
3559                 hci_cs_remote_name_req(hdev, ev->status);
3560                 break;
3561
3562         case HCI_OP_READ_REMOTE_FEATURES:
3563                 hci_cs_read_remote_features(hdev, ev->status);
3564                 break;
3565
3566         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3567                 hci_cs_read_remote_ext_features(hdev, ev->status);
3568                 break;
3569
3570         case HCI_OP_SETUP_SYNC_CONN:
3571                 hci_cs_setup_sync_conn(hdev, ev->status);
3572                 break;
3573
3574         case HCI_OP_SNIFF_MODE:
3575                 hci_cs_sniff_mode(hdev, ev->status);
3576                 break;
3577
3578         case HCI_OP_EXIT_SNIFF_MODE:
3579                 hci_cs_exit_sniff_mode(hdev, ev->status);
3580                 break;
3581
3582         case HCI_OP_SWITCH_ROLE:
3583                 hci_cs_switch_role(hdev, ev->status);
3584                 break;
3585
3586         case HCI_OP_LE_CREATE_CONN:
3587                 hci_cs_le_create_conn(hdev, ev->status);
3588                 break;
3589
3590         case HCI_OP_LE_READ_REMOTE_FEATURES:
3591                 hci_cs_le_read_remote_features(hdev, ev->status);
3592                 break;
3593
3594         case HCI_OP_LE_START_ENC:
3595                 hci_cs_le_start_enc(hdev, ev->status);
3596                 break;
3597
3598         case HCI_OP_LE_EXT_CREATE_CONN:
3599                 hci_cs_le_ext_create_conn(hdev, ev->status);
3600                 break;
3601
3602         default:
3603                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3604                 break;
3605         }
3606
3607         if (*opcode != HCI_OP_NOP)
3608                 cancel_delayed_work(&hdev->cmd_timer);
3609
3610         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3611                 atomic_set(&hdev->cmd_cnt, 1);
3612
3613         /* Indicate request completion if the command failed. Also, if
3614          * we're not waiting for a special event and we get a success
3615          * command status we should try to flag the request as completed
3616          * (since for this kind of commands there will not be a command
3617          * complete event).
3618          */
3619         if (ev->status ||
3620             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3621                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3622                                      req_complete_skb);
3623
3624         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3625                 bt_dev_err(hdev,
3626                            "unexpected event for opcode 0x%4.4x", *opcode);
3627                 return;
3628         }
3629
3630         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3631                 queue_work(hdev->workqueue, &hdev->cmd_work);
3632 }
3633
3634 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3635 {
3636         struct hci_ev_hardware_error *ev = (void *) skb->data;
3637
3638 #ifdef TIZEN_BT
3639         hci_dev_lock(hdev);
3640         mgmt_hardware_error(hdev, ev->code);
3641         hci_dev_unlock(hdev);
3642 #endif
3643         hdev->hw_error_code = ev->code;
3644
3645         queue_work(hdev->req_workqueue, &hdev->error_reset);
3646 }
3647
3648 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3649 {
3650         struct hci_ev_role_change *ev = (void *) skb->data;
3651         struct hci_conn *conn;
3652
3653         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3654
3655         hci_dev_lock(hdev);
3656
3657         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3658         if (conn) {
3659                 if (!ev->status)
3660                         conn->role = ev->role;
3661
3662                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3663
3664                 hci_role_switch_cfm(conn, ev->status, ev->role);
3665 #ifdef TIZEN_BT
3666                 if (!ev->status && (get_link_mode(conn) & HCI_LM_MASTER))
3667                         hci_conn_change_supervision_timeout(conn,
3668                                         LINK_SUPERVISION_TIMEOUT);
3669 #endif
3670         }
3671
3672         hci_dev_unlock(hdev);
3673 }
3674
3675 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3676 {
3677         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3678         int i;
3679
3680         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3681                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3682                 return;
3683         }
3684
3685         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3686             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3687                 BT_DBG("%s bad parameters", hdev->name);
3688                 return;
3689         }
3690
3691         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3692
3693         for (i = 0; i < ev->num_hndl; i++) {
3694                 struct hci_comp_pkts_info *info = &ev->handles[i];
3695                 struct hci_conn *conn;
3696                 __u16  handle, count;
3697
3698                 handle = __le16_to_cpu(info->handle);
3699                 count  = __le16_to_cpu(info->count);
3700
3701                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3702                 if (!conn)
3703                         continue;
3704
3705                 conn->sent -= count;
3706
3707                 switch (conn->type) {
3708                 case ACL_LINK:
3709                         hdev->acl_cnt += count;
3710                         if (hdev->acl_cnt > hdev->acl_pkts)
3711                                 hdev->acl_cnt = hdev->acl_pkts;
3712                         break;
3713
3714                 case LE_LINK:
3715                         if (hdev->le_pkts) {
3716                                 hdev->le_cnt += count;
3717                                 if (hdev->le_cnt > hdev->le_pkts)
3718                                         hdev->le_cnt = hdev->le_pkts;
3719                         } else {
3720                                 hdev->acl_cnt += count;
3721                                 if (hdev->acl_cnt > hdev->acl_pkts)
3722                                         hdev->acl_cnt = hdev->acl_pkts;
3723                         }
3724                         break;
3725
3726                 case SCO_LINK:
3727                         hdev->sco_cnt += count;
3728                         if (hdev->sco_cnt > hdev->sco_pkts)
3729                                 hdev->sco_cnt = hdev->sco_pkts;
3730                         break;
3731
3732                 default:
3733                         bt_dev_err(hdev, "unknown type %d conn %p",
3734                                    conn->type, conn);
3735                         break;
3736                 }
3737         }
3738
3739         queue_work(hdev->workqueue, &hdev->tx_work);
3740 }
3741
3742 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3743                                                  __u16 handle)
3744 {
3745         struct hci_chan *chan;
3746
3747         switch (hdev->dev_type) {
3748         case HCI_PRIMARY:
3749                 return hci_conn_hash_lookup_handle(hdev, handle);
3750         case HCI_AMP:
3751                 chan = hci_chan_lookup_handle(hdev, handle);
3752                 if (chan)
3753                         return chan->conn;
3754                 break;
3755         default:
3756                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3757                 break;
3758         }
3759
3760         return NULL;
3761 }
3762
3763 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3764 {
3765         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3766         int i;
3767
3768         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3769                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3770                 return;
3771         }
3772
3773         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3774             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3775                 BT_DBG("%s bad parameters", hdev->name);
3776                 return;
3777         }
3778
3779         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3780                ev->num_hndl);
3781
3782         for (i = 0; i < ev->num_hndl; i++) {
3783                 struct hci_comp_blocks_info *info = &ev->handles[i];
3784                 struct hci_conn *conn = NULL;
3785                 __u16  handle, block_count;
3786
3787                 handle = __le16_to_cpu(info->handle);
3788                 block_count = __le16_to_cpu(info->blocks);
3789
3790                 conn = __hci_conn_lookup_handle(hdev, handle);
3791                 if (!conn)
3792                         continue;
3793
3794                 conn->sent -= block_count;
3795
3796                 switch (conn->type) {
3797                 case ACL_LINK:
3798                 case AMP_LINK:
3799                         hdev->block_cnt += block_count;
3800                         if (hdev->block_cnt > hdev->num_blocks)
3801                                 hdev->block_cnt = hdev->num_blocks;
3802                         break;
3803
3804                 default:
3805                         bt_dev_err(hdev, "unknown type %d conn %p",
3806                                    conn->type, conn);
3807                         break;
3808                 }
3809         }
3810
3811         queue_work(hdev->workqueue, &hdev->tx_work);
3812 }
3813
3814 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3815 {
3816         struct hci_ev_mode_change *ev = (void *) skb->data;
3817         struct hci_conn *conn;
3818
3819         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3820
3821         hci_dev_lock(hdev);
3822
3823         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3824         if (conn) {
3825                 conn->mode = ev->mode;
3826
3827                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3828                                         &conn->flags)) {
3829                         if (conn->mode == HCI_CM_ACTIVE)
3830                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3831                         else
3832                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3833                 }
3834
3835                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3836                         hci_sco_setup(conn, ev->status);
3837         }
3838
3839         hci_dev_unlock(hdev);
3840 }
3841
3842 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3843 {
3844         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3845         struct hci_conn *conn;
3846
3847         BT_DBG("%s", hdev->name);
3848
3849         hci_dev_lock(hdev);
3850
3851         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3852         if (!conn)
3853                 goto unlock;
3854
3855         if (conn->state == BT_CONNECTED) {
3856                 hci_conn_hold(conn);
3857                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3858                 hci_conn_drop(conn);
3859         }
3860
3861         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3862             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3863                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3864                              sizeof(ev->bdaddr), &ev->bdaddr);
3865         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3866                 u8 secure;
3867
3868                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3869                         secure = 1;
3870                 else
3871                         secure = 0;
3872
3873                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3874         }
3875
3876 unlock:
3877         hci_dev_unlock(hdev);
3878 }
3879
3880 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3881 {
3882         if (key_type == HCI_LK_CHANGED_COMBINATION)
3883                 return;
3884
3885         conn->pin_length = pin_len;
3886         conn->key_type = key_type;
3887
3888         switch (key_type) {
3889         case HCI_LK_LOCAL_UNIT:
3890         case HCI_LK_REMOTE_UNIT:
3891         case HCI_LK_DEBUG_COMBINATION:
3892                 return;
3893         case HCI_LK_COMBINATION:
3894                 if (pin_len == 16)
3895                         conn->pending_sec_level = BT_SECURITY_HIGH;
3896                 else
3897                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3898                 break;
3899         case HCI_LK_UNAUTH_COMBINATION_P192:
3900         case HCI_LK_UNAUTH_COMBINATION_P256:
3901                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3902                 break;
3903         case HCI_LK_AUTH_COMBINATION_P192:
3904                 conn->pending_sec_level = BT_SECURITY_HIGH;
3905                 break;
3906         case HCI_LK_AUTH_COMBINATION_P256:
3907                 conn->pending_sec_level = BT_SECURITY_FIPS;
3908                 break;
3909         }
3910 }
3911
3912 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3913 {
3914         struct hci_ev_link_key_req *ev = (void *) skb->data;
3915         struct hci_cp_link_key_reply cp;
3916         struct hci_conn *conn;
3917         struct link_key *key;
3918
3919         BT_DBG("%s", hdev->name);
3920
3921         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3922                 return;
3923
3924         hci_dev_lock(hdev);
3925
3926         key = hci_find_link_key(hdev, &ev->bdaddr);
3927         if (!key) {
3928                 BT_DBG("%s link key not found for %pMR", hdev->name,
3929                        &ev->bdaddr);
3930                 goto not_found;
3931         }
3932
3933         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3934                &ev->bdaddr);
3935
3936         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3937         if (conn) {
3938                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3939
3940                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3941                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3942                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3943                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3944                         goto not_found;
3945                 }
3946
3947                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3948                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3949                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3950                         BT_DBG("%s ignoring key unauthenticated for high security",
3951                                hdev->name);
3952                         goto not_found;
3953                 }
3954
3955                 conn_set_key(conn, key->type, key->pin_len);
3956         }
3957
3958         bacpy(&cp.bdaddr, &ev->bdaddr);
3959         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3960
3961         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3962
3963         hci_dev_unlock(hdev);
3964
3965         return;
3966
3967 not_found:
3968         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3969         hci_dev_unlock(hdev);
3970 }
3971
3972 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3973 {
3974         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3975         struct hci_conn *conn;
3976         struct link_key *key;
3977         bool persistent;
3978         u8 pin_len = 0;
3979
3980         BT_DBG("%s", hdev->name);
3981
3982         hci_dev_lock(hdev);
3983
3984         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3985         if (!conn)
3986                 goto unlock;
3987
3988         hci_conn_hold(conn);
3989         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3990         hci_conn_drop(conn);
3991
3992         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3993         conn_set_key(conn, ev->key_type, conn->pin_length);
3994
3995         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3996                 goto unlock;
3997
3998         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3999                                 ev->key_type, pin_len, &persistent);
4000         if (!key)
4001                 goto unlock;
4002
4003         /* Update connection information since adding the key will have
4004          * fixed up the type in the case of changed combination keys.
4005          */
4006         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4007                 conn_set_key(conn, key->type, key->pin_len);
4008
4009         mgmt_new_link_key(hdev, key, persistent);
4010
4011         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4012          * is set. If it's not set simply remove the key from the kernel
4013          * list (we've still notified user space about it but with
4014          * store_hint being 0).
4015          */
4016         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4017             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4018                 list_del_rcu(&key->list);
4019                 kfree_rcu(key, rcu);
4020                 goto unlock;
4021         }
4022
4023         if (persistent)
4024                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4025         else
4026                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4027
4028 unlock:
4029         hci_dev_unlock(hdev);
4030 }
4031
4032 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4033 {
4034         struct hci_ev_clock_offset *ev = (void *) skb->data;
4035         struct hci_conn *conn;
4036
4037         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4038
4039         hci_dev_lock(hdev);
4040
4041         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4042         if (conn && !ev->status) {
4043                 struct inquiry_entry *ie;
4044
4045                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4046                 if (ie) {
4047                         ie->data.clock_offset = ev->clock_offset;
4048                         ie->timestamp = jiffies;
4049                 }
4050         }
4051
4052         hci_dev_unlock(hdev);
4053 }
4054
4055 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4056 {
4057         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4058         struct hci_conn *conn;
4059
4060         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4061
4062         hci_dev_lock(hdev);
4063
4064         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4065         if (conn && !ev->status)
4066                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4067
4068         hci_dev_unlock(hdev);
4069 }
4070
4071 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4072 {
4073         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4074         struct inquiry_entry *ie;
4075
4076         BT_DBG("%s", hdev->name);
4077
4078         hci_dev_lock(hdev);
4079
4080         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4081         if (ie) {
4082                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4083                 ie->timestamp = jiffies;
4084         }
4085
4086         hci_dev_unlock(hdev);
4087 }
4088
4089 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4090                                              struct sk_buff *skb)
4091 {
4092         struct inquiry_data data;
4093         int num_rsp = *((__u8 *) skb->data);
4094
4095         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4096
4097         if (!num_rsp)
4098                 return;
4099
4100         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4101                 return;
4102
4103         hci_dev_lock(hdev);
4104
4105         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4106                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4107                 info = (void *) (skb->data + 1);
4108
4109                 for (; num_rsp; num_rsp--, info++) {
4110                         u32 flags;
4111
4112                         bacpy(&data.bdaddr, &info->bdaddr);
4113                         data.pscan_rep_mode     = info->pscan_rep_mode;
4114                         data.pscan_period_mode  = info->pscan_period_mode;
4115                         data.pscan_mode         = info->pscan_mode;
4116                         memcpy(data.dev_class, info->dev_class, 3);
4117                         data.clock_offset       = info->clock_offset;
4118                         data.rssi               = info->rssi;
4119                         data.ssp_mode           = 0x00;
4120
4121                         flags = hci_inquiry_cache_update(hdev, &data, false);
4122
4123                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4124                                           info->dev_class, info->rssi,
4125                                           flags, NULL, 0, NULL, 0);
4126                 }
4127         } else {
4128                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4129
4130                 for (; num_rsp; num_rsp--, info++) {
4131                         u32 flags;
4132
4133                         bacpy(&data.bdaddr, &info->bdaddr);
4134                         data.pscan_rep_mode     = info->pscan_rep_mode;
4135                         data.pscan_period_mode  = info->pscan_period_mode;
4136                         data.pscan_mode         = 0x00;
4137                         memcpy(data.dev_class, info->dev_class, 3);
4138                         data.clock_offset       = info->clock_offset;
4139                         data.rssi               = info->rssi;
4140                         data.ssp_mode           = 0x00;
4141
4142                         flags = hci_inquiry_cache_update(hdev, &data, false);
4143
4144                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4145                                           info->dev_class, info->rssi,
4146                                           flags, NULL, 0, NULL, 0);
4147                 }
4148         }
4149
4150         hci_dev_unlock(hdev);
4151 }
4152
4153 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4154                                         struct sk_buff *skb)
4155 {
4156         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4157         struct hci_conn *conn;
4158
4159         BT_DBG("%s", hdev->name);
4160
4161         hci_dev_lock(hdev);
4162
4163         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4164         if (!conn)
4165                 goto unlock;
4166
4167         if (ev->page < HCI_MAX_PAGES)
4168                 memcpy(conn->features[ev->page], ev->features, 8);
4169
4170         if (!ev->status && ev->page == 0x01) {
4171                 struct inquiry_entry *ie;
4172
4173                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4174                 if (ie)
4175                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4176
4177                 if (ev->features[0] & LMP_HOST_SSP) {
4178                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4179                 } else {
4180                         /* It is mandatory by the Bluetooth specification that
4181                          * Extended Inquiry Results are only used when Secure
4182                          * Simple Pairing is enabled, but some devices violate
4183                          * this.
4184                          *
4185                          * To make these devices work, the internal SSP
4186                          * enabled flag needs to be cleared if the remote host
4187                          * features do not indicate SSP support */
4188                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4189                 }
4190
4191                 if (ev->features[0] & LMP_HOST_SC)
4192                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4193         }
4194
4195         if (conn->state != BT_CONFIG)
4196                 goto unlock;
4197
4198         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4199                 struct hci_cp_remote_name_req cp;
4200                 memset(&cp, 0, sizeof(cp));
4201                 bacpy(&cp.bdaddr, &conn->dst);
4202                 cp.pscan_rep_mode = 0x02;
4203                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4204         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4205                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4206
4207         if (!hci_outgoing_auth_needed(hdev, conn)) {
4208                 conn->state = BT_CONNECTED;
4209                 hci_connect_cfm(conn, ev->status);
4210                 hci_conn_drop(conn);
4211         }
4212
4213 unlock:
4214         hci_dev_unlock(hdev);
4215 }
4216
4217 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4218                                        struct sk_buff *skb)
4219 {
4220         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4221         struct hci_conn *conn;
4222
4223         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4224
4225         hci_dev_lock(hdev);
4226
4227         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4228         if (!conn) {
4229                 if (ev->link_type == ESCO_LINK)
4230                         goto unlock;
4231
4232                 /* When the link type in the event indicates SCO connection
4233                  * and lookup of the connection object fails, then check
4234                  * if an eSCO connection object exists.
4235                  *
4236                  * The core limits the synchronous connections to either
4237                  * SCO or eSCO. The eSCO connection is preferred and tried
4238                  * to be setup first and until successfully established,
4239                  * the link type will be hinted as eSCO.
4240                  */
4241                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4242                 if (!conn)
4243                         goto unlock;
4244         }
4245
4246         switch (ev->status) {
4247         case 0x00:
4248                 conn->handle = __le16_to_cpu(ev->handle);
4249                 conn->state  = BT_CONNECTED;
4250                 conn->type   = ev->link_type;
4251
4252                 hci_debugfs_create_conn(conn);
4253                 hci_conn_add_sysfs(conn);
4254                 break;
4255
4256         case 0x10:      /* Connection Accept Timeout */
4257         case 0x0d:      /* Connection Rejected due to Limited Resources */
4258         case 0x11:      /* Unsupported Feature or Parameter Value */
4259         case 0x1c:      /* SCO interval rejected */
4260         case 0x1a:      /* Unsupported Remote Feature */
4261         case 0x1f:      /* Unspecified error */
4262         case 0x20:      /* Unsupported LMP Parameter value */
4263                 if (conn->out) {
4264                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4265                                         (hdev->esco_type & EDR_ESCO_MASK);
4266                         if (hci_setup_sync(conn, conn->link->handle))
4267                                 goto unlock;
4268                 }
4269                 /* fall through */
4270
4271         default:
4272                 conn->state = BT_CLOSED;
4273                 break;
4274         }
4275
4276         hci_connect_cfm(conn, ev->status);
4277         if (ev->status)
4278                 hci_conn_del(conn);
4279
4280 unlock:
4281         hci_dev_unlock(hdev);
4282 }
4283
4284 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4285 {
4286         size_t parsed = 0;
4287
4288         while (parsed < eir_len) {
4289                 u8 field_len = eir[0];
4290
4291                 if (field_len == 0)
4292                         return parsed;
4293
4294                 parsed += field_len + 1;
4295                 eir += field_len + 1;
4296         }
4297
4298         return eir_len;
4299 }
4300
4301 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4302                                             struct sk_buff *skb)
4303 {
4304         struct inquiry_data data;
4305         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4306         int num_rsp = *((__u8 *) skb->data);
4307         size_t eir_len;
4308
4309         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4310
4311         if (!num_rsp)
4312                 return;
4313
4314         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4315                 return;
4316
4317         hci_dev_lock(hdev);
4318
4319         for (; num_rsp; num_rsp--, info++) {
4320                 u32 flags;
4321                 bool name_known;
4322
4323                 bacpy(&data.bdaddr, &info->bdaddr);
4324                 data.pscan_rep_mode     = info->pscan_rep_mode;
4325                 data.pscan_period_mode  = info->pscan_period_mode;
4326                 data.pscan_mode         = 0x00;
4327                 memcpy(data.dev_class, info->dev_class, 3);
4328                 data.clock_offset       = info->clock_offset;
4329                 data.rssi               = info->rssi;
4330                 data.ssp_mode           = 0x01;
4331
4332                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4333                         name_known = eir_get_data(info->data,
4334                                                   sizeof(info->data),
4335                                                   EIR_NAME_COMPLETE, NULL);
4336                 else
4337                         name_known = true;
4338
4339                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4340
4341                 eir_len = eir_get_length(info->data, sizeof(info->data));
4342
4343                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4344                                   info->dev_class, info->rssi,
4345                                   flags, info->data, eir_len, NULL, 0);
4346         }
4347
4348         hci_dev_unlock(hdev);
4349 }
4350
4351 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4352                                          struct sk_buff *skb)
4353 {
4354         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4355         struct hci_conn *conn;
4356
4357         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4358                __le16_to_cpu(ev->handle));
4359
4360         hci_dev_lock(hdev);
4361
4362         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4363         if (!conn)
4364                 goto unlock;
4365
4366         /* For BR/EDR the necessary steps are taken through the
4367          * auth_complete event.
4368          */
4369         if (conn->type != LE_LINK)
4370                 goto unlock;
4371
4372         if (!ev->status)
4373                 conn->sec_level = conn->pending_sec_level;
4374
4375         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4376
4377         if (ev->status && conn->state == BT_CONNECTED) {
4378                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4379                 hci_conn_drop(conn);
4380                 goto unlock;
4381         }
4382
4383         if (conn->state == BT_CONFIG) {
4384                 if (!ev->status)
4385                         conn->state = BT_CONNECTED;
4386
4387                 hci_connect_cfm(conn, ev->status);
4388                 hci_conn_drop(conn);
4389         } else {
4390                 hci_auth_cfm(conn, ev->status);
4391
4392                 hci_conn_hold(conn);
4393                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4394                 hci_conn_drop(conn);
4395         }
4396
4397 unlock:
4398         hci_dev_unlock(hdev);
4399 }
4400
4401 static u8 hci_get_auth_req(struct hci_conn *conn)
4402 {
4403 #ifdef TIZEN_BT
4404         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4405                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4406                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4407                         return HCI_AT_GENERAL_BONDING_MITM;
4408         }
4409 #endif
4410
4411         /* If remote requests no-bonding follow that lead */
4412         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4413             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4414                 return conn->remote_auth | (conn->auth_type & 0x01);
4415
4416         /* If both remote and local have enough IO capabilities, require
4417          * MITM protection
4418          */
4419         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4420             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4421                 return conn->remote_auth | 0x01;
4422
4423         /* No MITM protection possible so ignore remote requirement */
4424         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4425 }
4426
4427 static u8 bredr_oob_data_present(struct hci_conn *conn)
4428 {
4429         struct hci_dev *hdev = conn->hdev;
4430         struct oob_data *data;
4431
4432         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4433         if (!data)
4434                 return 0x00;
4435
4436         if (bredr_sc_enabled(hdev)) {
4437                 /* When Secure Connections is enabled, then just
4438                  * return the present value stored with the OOB
4439                  * data. The stored value contains the right present
4440                  * information. However it can only be trusted when
4441                  * not in Secure Connection Only mode.
4442                  */
4443                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4444                         return data->present;
4445
4446                 /* When Secure Connections Only mode is enabled, then
4447                  * the P-256 values are required. If they are not
4448                  * available, then do not declare that OOB data is
4449                  * present.
4450                  */
4451                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4452                     !memcmp(data->hash256, ZERO_KEY, 16))
4453                         return 0x00;
4454
4455                 return 0x02;
4456         }
4457
4458         /* When Secure Connections is not enabled or actually
4459          * not supported by the hardware, then check that if
4460          * P-192 data values are present.
4461          */
4462         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4463             !memcmp(data->hash192, ZERO_KEY, 16))
4464                 return 0x00;
4465
4466         return 0x01;
4467 }
4468
4469 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4470 {
4471         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4472         struct hci_conn *conn;
4473
4474         BT_DBG("%s", hdev->name);
4475
4476         hci_dev_lock(hdev);
4477
4478         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4479         if (!conn)
4480                 goto unlock;
4481
4482         hci_conn_hold(conn);
4483
4484         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4485                 goto unlock;
4486
4487         /* Allow pairing if we're pairable, the initiators of the
4488          * pairing or if the remote is not requesting bonding.
4489          */
4490         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4491             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4492             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4493                 struct hci_cp_io_capability_reply cp;
4494
4495                 bacpy(&cp.bdaddr, &ev->bdaddr);
4496                 /* Change the IO capability from KeyboardDisplay
4497                  * to DisplayYesNo as it is not supported by BT spec. */
4498                 cp.capability = (conn->io_capability == 0x04) ?
4499                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4500
4501                 /* If we are initiators, there is no remote information yet */
4502                 if (conn->remote_auth == 0xff) {
4503                         /* Request MITM protection if our IO caps allow it
4504                          * except for the no-bonding case.
4505                          */
4506                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4507                             conn->auth_type != HCI_AT_NO_BONDING)
4508                                 conn->auth_type |= 0x01;
4509                 } else {
4510                         conn->auth_type = hci_get_auth_req(conn);
4511                 }
4512
4513                 /* If we're not bondable, force one of the non-bondable
4514                  * authentication requirement values.
4515                  */
4516                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4517                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4518
4519                 cp.authentication = conn->auth_type;
4520                 cp.oob_data = bredr_oob_data_present(conn);
4521
4522                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4523                              sizeof(cp), &cp);
4524         } else {
4525                 struct hci_cp_io_capability_neg_reply cp;
4526
4527                 bacpy(&cp.bdaddr, &ev->bdaddr);
4528                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4529
4530                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4531                              sizeof(cp), &cp);
4532         }
4533
4534 unlock:
4535         hci_dev_unlock(hdev);
4536 }
4537
4538 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4539 {
4540         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4541         struct hci_conn *conn;
4542
4543         BT_DBG("%s", hdev->name);
4544
4545         hci_dev_lock(hdev);
4546
4547         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4548         if (!conn)
4549                 goto unlock;
4550
4551         conn->remote_cap = ev->capability;
4552         conn->remote_auth = ev->authentication;
4553
4554 unlock:
4555         hci_dev_unlock(hdev);
4556 }
4557
4558 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4559                                          struct sk_buff *skb)
4560 {
4561         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4562         int loc_mitm, rem_mitm, confirm_hint = 0;
4563         struct hci_conn *conn;
4564
4565         BT_DBG("%s", hdev->name);
4566
4567         hci_dev_lock(hdev);
4568
4569         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4570                 goto unlock;
4571
4572         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4573         if (!conn)
4574                 goto unlock;
4575
4576         loc_mitm = (conn->auth_type & 0x01);
4577         rem_mitm = (conn->remote_auth & 0x01);
4578
4579         /* If we require MITM but the remote device can't provide that
4580          * (it has NoInputNoOutput) then reject the confirmation
4581          * request. We check the security level here since it doesn't
4582          * necessarily match conn->auth_type.
4583          */
4584         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4585             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4586                 BT_DBG("Rejecting request: remote device can't provide MITM");
4587                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4588                              sizeof(ev->bdaddr), &ev->bdaddr);
4589                 goto unlock;
4590         }
4591
4592         /* If no side requires MITM protection; auto-accept */
4593         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4594             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4595
4596                 /* If we're not the initiators request authorization to
4597                  * proceed from user space (mgmt_user_confirm with
4598                  * confirm_hint set to 1). The exception is if neither
4599                  * side had MITM or if the local IO capability is
4600                  * NoInputNoOutput, in which case we do auto-accept
4601                  */
4602                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4603                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4604                     (loc_mitm || rem_mitm)) {
4605                         BT_DBG("Confirming auto-accept as acceptor");
4606                         confirm_hint = 1;
4607                         goto confirm;
4608                 }
4609
4610                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4611                        hdev->auto_accept_delay);
4612
4613                 if (hdev->auto_accept_delay > 0) {
4614                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4615                         queue_delayed_work(conn->hdev->workqueue,
4616                                            &conn->auto_accept_work, delay);
4617                         goto unlock;
4618                 }
4619
4620                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4621                              sizeof(ev->bdaddr), &ev->bdaddr);
4622                 goto unlock;
4623         }
4624
4625 confirm:
4626         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4627                                   le32_to_cpu(ev->passkey), confirm_hint);
4628
4629 unlock:
4630         hci_dev_unlock(hdev);
4631 }
4632
4633 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4634                                          struct sk_buff *skb)
4635 {
4636         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4637
4638         BT_DBG("%s", hdev->name);
4639
4640         if (hci_dev_test_flag(hdev, HCI_MGMT))
4641                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4642 }
4643
4644 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4645                                         struct sk_buff *skb)
4646 {
4647         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4648         struct hci_conn *conn;
4649
4650         BT_DBG("%s", hdev->name);
4651
4652         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4653         if (!conn)
4654                 return;
4655
4656         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4657         conn->passkey_entered = 0;
4658
4659         if (hci_dev_test_flag(hdev, HCI_MGMT))
4660                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4661                                          conn->dst_type, conn->passkey_notify,
4662                                          conn->passkey_entered);
4663 }
4664
4665 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4666 {
4667         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4668         struct hci_conn *conn;
4669
4670         BT_DBG("%s", hdev->name);
4671
4672         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4673         if (!conn)
4674                 return;
4675
4676         switch (ev->type) {
4677         case HCI_KEYPRESS_STARTED:
4678                 conn->passkey_entered = 0;
4679                 return;
4680
4681         case HCI_KEYPRESS_ENTERED:
4682                 conn->passkey_entered++;
4683                 break;
4684
4685         case HCI_KEYPRESS_ERASED:
4686                 conn->passkey_entered--;
4687                 break;
4688
4689         case HCI_KEYPRESS_CLEARED:
4690                 conn->passkey_entered = 0;
4691                 break;
4692
4693         case HCI_KEYPRESS_COMPLETED:
4694                 return;
4695         }
4696
4697         if (hci_dev_test_flag(hdev, HCI_MGMT))
4698                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4699                                          conn->dst_type, conn->passkey_notify,
4700                                          conn->passkey_entered);
4701 }
4702
4703 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4704                                          struct sk_buff *skb)
4705 {
4706         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4707         struct hci_conn *conn;
4708
4709         BT_DBG("%s", hdev->name);
4710
4711         hci_dev_lock(hdev);
4712
4713         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4714         if (!conn)
4715                 goto unlock;
4716
4717         /* Reset the authentication requirement to unknown */
4718         conn->remote_auth = 0xff;
4719
4720         /* To avoid duplicate auth_failed events to user space we check
4721          * the HCI_CONN_AUTH_PEND flag which will be set if we
4722          * initiated the authentication. A traditional auth_complete
4723          * event gets always produced as initiator and is also mapped to
4724          * the mgmt_auth_failed event */
4725         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4726                 mgmt_auth_failed(conn, ev->status);
4727
4728         hci_conn_drop(conn);
4729
4730 unlock:
4731         hci_dev_unlock(hdev);
4732 }
4733
4734 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4735                                          struct sk_buff *skb)
4736 {
4737         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4738         struct inquiry_entry *ie;
4739         struct hci_conn *conn;
4740
4741         BT_DBG("%s", hdev->name);
4742
4743         hci_dev_lock(hdev);
4744
4745         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4746         if (conn)
4747                 memcpy(conn->features[1], ev->features, 8);
4748
4749         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4750         if (ie)
4751                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4752
4753         hci_dev_unlock(hdev);
4754 }
4755
4756 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4757                                             struct sk_buff *skb)
4758 {
4759         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4760         struct oob_data *data;
4761
4762         BT_DBG("%s", hdev->name);
4763
4764         hci_dev_lock(hdev);
4765
4766         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4767                 goto unlock;
4768
4769         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4770         if (!data) {
4771                 struct hci_cp_remote_oob_data_neg_reply cp;
4772
4773                 bacpy(&cp.bdaddr, &ev->bdaddr);
4774                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4775                              sizeof(cp), &cp);
4776                 goto unlock;
4777         }
4778
4779         if (bredr_sc_enabled(hdev)) {
4780                 struct hci_cp_remote_oob_ext_data_reply cp;
4781
4782                 bacpy(&cp.bdaddr, &ev->bdaddr);
4783                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4784                         memset(cp.hash192, 0, sizeof(cp.hash192));
4785                         memset(cp.rand192, 0, sizeof(cp.rand192));
4786                 } else {
4787                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4788                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4789                 }
4790                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4791                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4792
4793                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4794                              sizeof(cp), &cp);
4795         } else {
4796                 struct hci_cp_remote_oob_data_reply cp;
4797
4798                 bacpy(&cp.bdaddr, &ev->bdaddr);
4799                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4800                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4801
4802                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4803                              sizeof(cp), &cp);
4804         }
4805
4806 unlock:
4807         hci_dev_unlock(hdev);
4808 }
4809
4810 #if IS_ENABLED(CONFIG_BT_HS)
4811 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4812 {
4813         struct hci_ev_channel_selected *ev = (void *)skb->data;
4814         struct hci_conn *hcon;
4815
4816         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4817
4818         skb_pull(skb, sizeof(*ev));
4819
4820         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4821         if (!hcon)
4822                 return;
4823
4824         amp_read_loc_assoc_final_data(hdev, hcon);
4825 }
4826
4827 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4828                                       struct sk_buff *skb)
4829 {
4830         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4831         struct hci_conn *hcon, *bredr_hcon;
4832
4833         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4834                ev->status);
4835
4836         hci_dev_lock(hdev);
4837
4838         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4839         if (!hcon) {
4840                 hci_dev_unlock(hdev);
4841                 return;
4842         }
4843
4844         if (ev->status) {
4845                 hci_conn_del(hcon);
4846                 hci_dev_unlock(hdev);
4847                 return;
4848         }
4849
4850         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4851
4852         hcon->state = BT_CONNECTED;
4853         bacpy(&hcon->dst, &bredr_hcon->dst);
4854
4855         hci_conn_hold(hcon);
4856         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4857         hci_conn_drop(hcon);
4858
4859         hci_debugfs_create_conn(hcon);
4860         hci_conn_add_sysfs(hcon);
4861
4862         amp_physical_cfm(bredr_hcon, hcon);
4863
4864         hci_dev_unlock(hdev);
4865 }
4866
4867 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4868 {
4869         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4870         struct hci_conn *hcon;
4871         struct hci_chan *hchan;
4872         struct amp_mgr *mgr;
4873
4874         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4875                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4876                ev->status);
4877
4878         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4879         if (!hcon)
4880                 return;
4881
4882         /* Create AMP hchan */
4883         hchan = hci_chan_create(hcon);
4884         if (!hchan)
4885                 return;
4886
4887         hchan->handle = le16_to_cpu(ev->handle);
4888
4889         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4890
4891         mgr = hcon->amp_mgr;
4892         if (mgr && mgr->bredr_chan) {
4893                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4894
4895                 l2cap_chan_lock(bredr_chan);
4896
4897                 bredr_chan->conn->mtu = hdev->block_mtu;
4898                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4899                 hci_conn_hold(hcon);
4900
4901                 l2cap_chan_unlock(bredr_chan);
4902         }
4903 }
4904
4905 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4906                                              struct sk_buff *skb)
4907 {
4908         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4909         struct hci_chan *hchan;
4910
4911         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4912                le16_to_cpu(ev->handle), ev->status);
4913
4914         if (ev->status)
4915                 return;
4916
4917         hci_dev_lock(hdev);
4918
4919         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4920         if (!hchan)
4921                 goto unlock;
4922
4923         amp_destroy_logical_link(hchan, ev->reason);
4924
4925 unlock:
4926         hci_dev_unlock(hdev);
4927 }
4928
4929 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4930                                              struct sk_buff *skb)
4931 {
4932         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4933         struct hci_conn *hcon;
4934
4935         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4936
4937         if (ev->status)
4938                 return;
4939
4940         hci_dev_lock(hdev);
4941
4942         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4943         if (hcon) {
4944                 hcon->state = BT_CLOSED;
4945                 hci_conn_del(hcon);
4946         }
4947
4948         hci_dev_unlock(hdev);
4949 }
4950 #endif
4951
4952 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4953                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4954                         u16 interval, u16 latency, u16 supervision_timeout)
4955 {
4956         struct hci_conn_params *params;
4957         struct hci_conn *conn;
4958         struct smp_irk *irk;
4959         u8 addr_type;
4960
4961         hci_dev_lock(hdev);
4962
4963         /* All controllers implicitly stop advertising in the event of a
4964          * connection, so ensure that the state bit is cleared.
4965          */
4966         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4967
4968         conn = hci_lookup_le_connect(hdev);
4969         if (!conn) {
4970                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4971                 if (!conn) {
4972                         bt_dev_err(hdev, "no memory for new connection");
4973                         goto unlock;
4974                 }
4975
4976                 conn->dst_type = bdaddr_type;
4977
4978                 /* If we didn't have a hci_conn object previously
4979                  * but we're in master role this must be something
4980                  * initiated using a white list. Since white list based
4981                  * connections are not "first class citizens" we don't
4982                  * have full tracking of them. Therefore, we go ahead
4983                  * with a "best effort" approach of determining the
4984                  * initiator address based on the HCI_PRIVACY flag.
4985                  */
4986                 if (conn->out) {
4987                         conn->resp_addr_type = bdaddr_type;
4988                         bacpy(&conn->resp_addr, bdaddr);
4989                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4990                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4991                                 bacpy(&conn->init_addr, &hdev->rpa);
4992                         } else {
4993                                 hci_copy_identity_address(hdev,
4994                                                           &conn->init_addr,
4995                                                           &conn->init_addr_type);
4996                         }
4997                 }
4998         } else {
4999 #ifdef TIZEN_BT
5000                 /* LE auto connect */
5001                 bacpy(&conn->dst, bdaddr);
5002 #endif
5003                 cancel_delayed_work(&conn->le_conn_timeout);
5004         }
5005
5006         if (!conn->out) {
5007                 /* Set the responder (our side) address type based on
5008                  * the advertising address type.
5009                  */
5010                 conn->resp_addr_type = hdev->adv_addr_type;
5011                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5012                         /* In case of ext adv, resp_addr will be updated in
5013                          * Adv Terminated event.
5014                          */
5015                         if (!ext_adv_capable(hdev))
5016                                 bacpy(&conn->resp_addr, &hdev->random_addr);
5017                 } else {
5018                         bacpy(&conn->resp_addr, &hdev->bdaddr);
5019                 }
5020
5021                 conn->init_addr_type = bdaddr_type;
5022                 bacpy(&conn->init_addr, bdaddr);
5023
5024                 /* For incoming connections, set the default minimum
5025                  * and maximum connection interval. They will be used
5026                  * to check if the parameters are in range and if not
5027                  * trigger the connection update procedure.
5028                  */
5029                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
5030                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
5031         }
5032
5033         /* Lookup the identity address from the stored connection
5034          * address and address type.
5035          *
5036          * When establishing connections to an identity address, the
5037          * connection procedure will store the resolvable random
5038          * address first. Now if it can be converted back into the
5039          * identity address, start using the identity address from
5040          * now on.
5041          */
5042         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5043         if (irk) {
5044                 bacpy(&conn->dst, &irk->bdaddr);
5045                 conn->dst_type = irk->addr_type;
5046         }
5047
5048         if (status) {
5049                 hci_le_conn_failed(conn, status);
5050                 goto unlock;
5051         }
5052
5053         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5054                 addr_type = BDADDR_LE_PUBLIC;
5055         else
5056                 addr_type = BDADDR_LE_RANDOM;
5057
5058         /* Drop the connection if the device is blocked */
5059         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5060                 hci_conn_drop(conn);
5061                 goto unlock;
5062         }
5063
5064         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5065                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
5066
5067         conn->sec_level = BT_SECURITY_LOW;
5068         conn->handle = handle;
5069         conn->state = BT_CONFIG;
5070
5071         conn->le_conn_interval = interval;
5072         conn->le_conn_latency = latency;
5073         conn->le_supv_timeout = supervision_timeout;
5074
5075         hci_debugfs_create_conn(conn);
5076         hci_conn_add_sysfs(conn);
5077
5078         if (!status) {
5079                 /* The remote features procedure is defined for master
5080                  * role only. So only in case of an initiated connection
5081                  * request the remote features.
5082                  *
5083                  * If the local controller supports slave-initiated features
5084                  * exchange, then requesting the remote features in slave
5085                  * role is possible. Otherwise just transition into the
5086                  * connected state without requesting the remote features.
5087                  */
5088                 if (conn->out ||
5089                     (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5090                         struct hci_cp_le_read_remote_features cp;
5091
5092                         cp.handle = __cpu_to_le16(conn->handle);
5093
5094                         hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5095                                      sizeof(cp), &cp);
5096
5097                         hci_conn_hold(conn);
5098                 } else {
5099                         conn->state = BT_CONNECTED;
5100                         hci_connect_cfm(conn, status);
5101                 }
5102         } else {
5103                 hci_connect_cfm(conn, status);
5104         }
5105
5106         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5107                                            conn->dst_type);
5108         if (params) {
5109                 list_del_init(&params->action);
5110                 if (params->conn) {
5111                         hci_conn_drop(params->conn);
5112                         hci_conn_put(params->conn);
5113                         params->conn = NULL;
5114                 }
5115         }
5116
5117 unlock:
5118         hci_update_background_scan(hdev);
5119         hci_dev_unlock(hdev);
5120 }
5121
5122 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5123 {
5124         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5125
5126         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5127
5128         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5129                              ev->role, le16_to_cpu(ev->handle),
5130                              le16_to_cpu(ev->interval),
5131                              le16_to_cpu(ev->latency),
5132                              le16_to_cpu(ev->supervision_timeout));
5133 }
5134
5135 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5136                                          struct sk_buff *skb)
5137 {
5138         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5139
5140         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5141
5142         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5143                              ev->role, le16_to_cpu(ev->handle),
5144                              le16_to_cpu(ev->interval),
5145                              le16_to_cpu(ev->latency),
5146                              le16_to_cpu(ev->supervision_timeout));
5147 }
5148
5149 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5150 {
5151         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5152         struct hci_conn *conn;
5153
5154         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5155
5156         if (ev->status)
5157                 return;
5158
5159         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5160         if (conn) {
5161                 struct adv_info *adv_instance;
5162
5163                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5164                         return;
5165
5166                 if (!hdev->cur_adv_instance) {
5167                         bacpy(&conn->resp_addr, &hdev->random_addr);
5168                         return;
5169                 }
5170
5171                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5172                 if (adv_instance)
5173                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5174         }
5175 }
5176
5177 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5178                                             struct sk_buff *skb)
5179 {
5180         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5181         struct hci_conn *conn;
5182
5183         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5184
5185         if (ev->status)
5186                 return;
5187
5188         hci_dev_lock(hdev);
5189
5190         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5191         if (conn) {
5192 #ifdef TIZEN_BT
5193                 if (ev->status) {
5194                         hci_dev_unlock(hdev);
5195                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5196                                 conn->type, conn->dst_type, ev->status);
5197                         return;
5198                 }
5199 #endif
5200                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5201                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5202                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5203         }
5204
5205         hci_dev_unlock(hdev);
5206
5207 #ifdef TIZEN_BT
5208         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5209                                 conn->dst_type, conn->le_conn_interval,
5210                                 conn->le_conn_latency, conn->le_supv_timeout);
5211 #endif
5212 }
5213
5214 /* This function requires the caller holds hdev->lock */
5215 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5216                                               bdaddr_t *addr,
5217                                               u8 addr_type, u8 adv_type,
5218                                               bdaddr_t *direct_rpa)
5219 {
5220         struct hci_conn *conn;
5221         struct hci_conn_params *params;
5222
5223         /* If the event is not connectable don't proceed further */
5224         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5225                 return NULL;
5226
5227         /* Ignore if the device is blocked */
5228         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5229                 return NULL;
5230
5231         /* Most controller will fail if we try to create new connections
5232          * while we have an existing one in slave role.
5233          */
5234         if (hdev->conn_hash.le_num_slave > 0)
5235                 return NULL;
5236
5237         /* If we're not connectable only connect devices that we have in
5238          * our pend_le_conns list.
5239          */
5240         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5241                                            addr_type);
5242         if (!params)
5243                 return NULL;
5244
5245         if (!params->explicit_connect) {
5246                 switch (params->auto_connect) {
5247                 case HCI_AUTO_CONN_DIRECT:
5248                         /* Only devices advertising with ADV_DIRECT_IND are
5249                          * triggering a connection attempt. This is allowing
5250                          * incoming connections from slave devices.
5251                          */
5252                         if (adv_type != LE_ADV_DIRECT_IND)
5253                                 return NULL;
5254                         break;
5255                 case HCI_AUTO_CONN_ALWAYS:
5256                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5257                          * are triggering a connection attempt. This means
5258                          * that incoming connectioms from slave device are
5259                          * accepted and also outgoing connections to slave
5260                          * devices are established when found.
5261                          */
5262                         break;
5263                 default:
5264                         return NULL;
5265                 }
5266         }
5267
5268         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5269                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5270                               direct_rpa);
5271         if (!IS_ERR(conn)) {
5272                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5273                  * by higher layer that tried to connect, if no then
5274                  * store the pointer since we don't really have any
5275                  * other owner of the object besides the params that
5276                  * triggered it. This way we can abort the connection if
5277                  * the parameters get removed and keep the reference
5278                  * count consistent once the connection is established.
5279                  */
5280
5281                 if (!params->explicit_connect)
5282                         params->conn = hci_conn_get(conn);
5283
5284                 return conn;
5285         }
5286
5287         switch (PTR_ERR(conn)) {
5288         case -EBUSY:
5289                 /* If hci_connect() returns -EBUSY it means there is already
5290                  * an LE connection attempt going on. Since controllers don't
5291                  * support more than one connection attempt at the time, we
5292                  * don't consider this an error case.
5293                  */
5294                 break;
5295         default:
5296                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5297                 return NULL;
5298         }
5299
5300         return NULL;
5301 }
5302
5303 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5304                                u8 bdaddr_type, bdaddr_t *direct_addr,
5305                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5306 {
5307 #ifndef TIZEN_BT
5308         struct discovery_state *d = &hdev->discovery;
5309 #endif
5310         struct smp_irk *irk;
5311         struct hci_conn *conn;
5312 #ifndef TIZEN_BT
5313         bool match;
5314 #endif
5315         u32 flags;
5316         u8 *ptr, real_len;
5317
5318         switch (type) {
5319         case LE_ADV_IND:
5320         case LE_ADV_DIRECT_IND:
5321         case LE_ADV_SCAN_IND:
5322         case LE_ADV_NONCONN_IND:
5323         case LE_ADV_SCAN_RSP:
5324                 break;
5325         default:
5326                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5327                                        "type: 0x%02x", type);
5328                 return;
5329         }
5330
5331         /* Find the end of the data in case the report contains padded zero
5332          * bytes at the end causing an invalid length value.
5333          *
5334          * When data is NULL, len is 0 so there is no need for extra ptr
5335          * check as 'ptr < data + 0' is already false in such case.
5336          */
5337         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5338                 if (ptr + 1 + *ptr > data + len)
5339                         break;
5340         }
5341
5342         real_len = ptr - data;
5343
5344         /* Adjust for actual length */
5345         if (len != real_len) {
5346                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5347                 len = real_len;
5348         }
5349
5350         /* If the direct address is present, then this report is from
5351          * a LE Direct Advertising Report event. In that case it is
5352          * important to see if the address is matching the local
5353          * controller address.
5354          */
5355         if (direct_addr) {
5356                 /* Only resolvable random addresses are valid for these
5357                  * kind of reports and others can be ignored.
5358                  */
5359                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5360                         return;
5361
5362                 /* If the controller is not using resolvable random
5363                  * addresses, then this report can be ignored.
5364                  */
5365                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5366                         return;
5367
5368                 /* If the local IRK of the controller does not match
5369                  * with the resolvable random address provided, then
5370                  * this report can be ignored.
5371                  */
5372                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5373                         return;
5374         }
5375
5376         /* Check if we need to convert to identity address */
5377         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5378         if (irk) {
5379                 bdaddr = &irk->bdaddr;
5380                 bdaddr_type = irk->addr_type;
5381         }
5382
5383         /* Check if we have been requested to connect to this device.
5384          *
5385          * direct_addr is set only for directed advertising reports (it is NULL
5386          * for advertising reports) and is already verified to be RPA above.
5387          */
5388         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5389                                                                 direct_addr);
5390         if (conn && type == LE_ADV_IND) {
5391                 /* Store report for later inclusion by
5392                  * mgmt_device_connected
5393                  */
5394                 memcpy(conn->le_adv_data, data, len);
5395                 conn->le_adv_data_len = len;
5396         }
5397
5398         /* Passive scanning shouldn't trigger any device found events,
5399          * except for devices marked as CONN_REPORT for which we do send
5400          * device found events.
5401          */
5402         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5403                 if (type == LE_ADV_DIRECT_IND)
5404                         return;
5405
5406 #ifndef TIZEN_BT
5407                 /* Handle all adv packet in platform */
5408                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5409                                                bdaddr, bdaddr_type))
5410                         return;
5411 #endif
5412
5413                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5414                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5415                 else
5416                         flags = 0;
5417 #ifdef TIZEN_BT
5418                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5419                                      rssi, flags, data, len, NULL, 0, type);
5420 #else
5421                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5422                                   rssi, flags, data, len, NULL, 0);
5423 #endif
5424                 return;
5425         }
5426
5427         /* When receiving non-connectable or scannable undirected
5428          * advertising reports, this means that the remote device is
5429          * not connectable and then clearly indicate this in the
5430          * device found event.
5431          *
5432          * When receiving a scan response, then there is no way to
5433          * know if the remote device is connectable or not. However
5434          * since scan responses are merged with a previously seen
5435          * advertising report, the flags field from that report
5436          * will be used.
5437          *
5438          * In the really unlikely case that a controller get confused
5439          * and just sends a scan response event, then it is marked as
5440          * not connectable as well.
5441          */
5442         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5443             type == LE_ADV_SCAN_RSP)
5444                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5445         else
5446                 flags = 0;
5447
5448 #ifdef TIZEN_BT
5449         /* Disable adv ind and scan rsp merging */
5450         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5451                              rssi, flags, data, len, NULL, 0, type);
5452 #else
5453         /* If there's nothing pending either store the data from this
5454          * event or send an immediate device found event if the data
5455          * should not be stored for later.
5456          */
5457         if (!has_pending_adv_report(hdev)) {
5458                 /* If the report will trigger a SCAN_REQ store it for
5459                  * later merging.
5460                  */
5461                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5462                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5463                                                  rssi, flags, data, len);
5464                         return;
5465                 }
5466
5467                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5468                                   rssi, flags, data, len, NULL, 0);
5469                 return;
5470         }
5471
5472         /* Check if the pending report is for the same device as the new one */
5473         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5474                  bdaddr_type == d->last_adv_addr_type);
5475
5476         /* If the pending data doesn't match this report or this isn't a
5477          * scan response (e.g. we got a duplicate ADV_IND) then force
5478          * sending of the pending data.
5479          */
5480         if (type != LE_ADV_SCAN_RSP || !match) {
5481                 /* Send out whatever is in the cache, but skip duplicates */
5482                 if (!match)
5483                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5484                                           d->last_adv_addr_type, NULL,
5485                                           d->last_adv_rssi, d->last_adv_flags,
5486                                           d->last_adv_data,
5487                                           d->last_adv_data_len, NULL, 0);
5488
5489                 /* If the new report will trigger a SCAN_REQ store it for
5490                  * later merging.
5491                  */
5492                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5493                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5494                                                  rssi, flags, data, len);
5495                         return;
5496                 }
5497
5498                 /* The advertising reports cannot be merged, so clear
5499                  * the pending report and send out a device found event.
5500                  */
5501                 clear_pending_adv_report(hdev);
5502                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5503                                   rssi, flags, data, len, NULL, 0);
5504                 return;
5505         }
5506
5507         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5508          * the new event is a SCAN_RSP. We can therefore proceed with
5509          * sending a merged device found event.
5510          */
5511         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5512                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5513                           d->last_adv_data, d->last_adv_data_len, data, len);
5514         clear_pending_adv_report(hdev);
5515 #endif
5516 }
5517
5518 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5519 {
5520         u8 num_reports = skb->data[0];
5521         void *ptr = &skb->data[1];
5522
5523         hci_dev_lock(hdev);
5524
5525         while (num_reports--) {
5526                 struct hci_ev_le_advertising_info *ev = ptr;
5527                 s8 rssi;
5528
5529                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5530                         rssi = ev->data[ev->length];
5531                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5532                                            ev->bdaddr_type, NULL, 0, rssi,
5533                                            ev->data, ev->length);
5534                 } else {
5535                         bt_dev_err(hdev, "Dropping invalid advertising data");
5536                 }
5537
5538                 ptr += sizeof(*ev) + ev->length + 1;
5539         }
5540
5541         hci_dev_unlock(hdev);
5542 }
5543
5544 static u8 ext_evt_type_to_legacy(u16 evt_type)
5545 {
5546         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5547                 switch (evt_type) {
5548                 case LE_LEGACY_ADV_IND:
5549                         return LE_ADV_IND;
5550                 case LE_LEGACY_ADV_DIRECT_IND:
5551                         return LE_ADV_DIRECT_IND;
5552                 case LE_LEGACY_ADV_SCAN_IND:
5553                         return LE_ADV_SCAN_IND;
5554                 case LE_LEGACY_NONCONN_IND:
5555                         return LE_ADV_NONCONN_IND;
5556                 case LE_LEGACY_SCAN_RSP_ADV:
5557                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5558                         return LE_ADV_SCAN_RSP;
5559                 }
5560
5561                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5562                                    evt_type);
5563
5564                 return LE_ADV_INVALID;
5565         }
5566
5567         if (evt_type & LE_EXT_ADV_CONN_IND) {
5568                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5569                         return LE_ADV_DIRECT_IND;
5570
5571                 return LE_ADV_IND;
5572         }
5573
5574         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5575                 return LE_ADV_SCAN_RSP;
5576
5577         if (evt_type & LE_EXT_ADV_SCAN_IND)
5578                 return LE_ADV_SCAN_IND;
5579
5580         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5581             evt_type & LE_EXT_ADV_DIRECT_IND)
5582                 return LE_ADV_NONCONN_IND;
5583
5584         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5585                                    evt_type);
5586
5587         return LE_ADV_INVALID;
5588 }
5589
5590 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5591 {
5592         u8 num_reports = skb->data[0];
5593         void *ptr = &skb->data[1];
5594
5595         hci_dev_lock(hdev);
5596
5597         while (num_reports--) {
5598                 struct hci_ev_le_ext_adv_report *ev = ptr;
5599                 u8 legacy_evt_type;
5600                 u16 evt_type;
5601
5602                 evt_type = __le16_to_cpu(ev->evt_type);
5603                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5604                 if (legacy_evt_type != LE_ADV_INVALID) {
5605                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5606                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5607                                            ev->data, ev->length);
5608                 }
5609
5610                 ptr += sizeof(*ev) + ev->length + 1;
5611         }
5612
5613         hci_dev_unlock(hdev);
5614 }
5615
5616 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5617                                             struct sk_buff *skb)
5618 {
5619         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5620         struct hci_conn *conn;
5621
5622         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5623
5624         hci_dev_lock(hdev);
5625
5626         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5627         if (conn) {
5628                 if (!ev->status)
5629                         memcpy(conn->features[0], ev->features, 8);
5630
5631                 if (conn->state == BT_CONFIG) {
5632                         __u8 status;
5633
5634                         /* If the local controller supports slave-initiated
5635                          * features exchange, but the remote controller does
5636                          * not, then it is possible that the error code 0x1a
5637                          * for unsupported remote feature gets returned.
5638                          *
5639                          * In this specific case, allow the connection to
5640                          * transition into connected state and mark it as
5641                          * successful.
5642                          */
5643                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5644                             !conn->out && ev->status == 0x1a)
5645                                 status = 0x00;
5646                         else
5647                                 status = ev->status;
5648
5649                         conn->state = BT_CONNECTED;
5650                         hci_connect_cfm(conn, status);
5651                         hci_conn_drop(conn);
5652                 }
5653         }
5654
5655         hci_dev_unlock(hdev);
5656 }
5657
5658 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5659 {
5660         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5661         struct hci_cp_le_ltk_reply cp;
5662         struct hci_cp_le_ltk_neg_reply neg;
5663         struct hci_conn *conn;
5664         struct smp_ltk *ltk;
5665
5666         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5667
5668         hci_dev_lock(hdev);
5669
5670         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5671         if (conn == NULL)
5672                 goto not_found;
5673
5674         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5675         if (!ltk)
5676                 goto not_found;
5677
5678         if (smp_ltk_is_sc(ltk)) {
5679                 /* With SC both EDiv and Rand are set to zero */
5680                 if (ev->ediv || ev->rand)
5681                         goto not_found;
5682         } else {
5683                 /* For non-SC keys check that EDiv and Rand match */
5684                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5685                         goto not_found;
5686         }
5687
5688         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5689         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5690         cp.handle = cpu_to_le16(conn->handle);
5691
5692         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5693
5694         conn->enc_key_size = ltk->enc_size;
5695
5696         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5697
5698         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5699          * temporary key used to encrypt a connection following
5700          * pairing. It is used during the Encrypted Session Setup to
5701          * distribute the keys. Later, security can be re-established
5702          * using a distributed LTK.
5703          */
5704         if (ltk->type == SMP_STK) {
5705                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5706                 list_del_rcu(&ltk->list);
5707                 kfree_rcu(ltk, rcu);
5708         } else {
5709                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5710         }
5711
5712         hci_dev_unlock(hdev);
5713
5714         return;
5715
5716 not_found:
5717         neg.handle = ev->handle;
5718         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5719         hci_dev_unlock(hdev);
5720 }
5721
5722 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5723                                       u8 reason)
5724 {
5725         struct hci_cp_le_conn_param_req_neg_reply cp;
5726
5727         cp.handle = cpu_to_le16(handle);
5728         cp.reason = reason;
5729
5730         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5731                      &cp);
5732 }
5733
5734 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5735                                              struct sk_buff *skb)
5736 {
5737         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5738         struct hci_cp_le_conn_param_req_reply cp;
5739         struct hci_conn *hcon;
5740         u16 handle, min, max, latency, timeout;
5741
5742         handle = le16_to_cpu(ev->handle);
5743         min = le16_to_cpu(ev->interval_min);
5744         max = le16_to_cpu(ev->interval_max);
5745         latency = le16_to_cpu(ev->latency);
5746         timeout = le16_to_cpu(ev->timeout);
5747
5748         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5749         if (!hcon || hcon->state != BT_CONNECTED)
5750                 return send_conn_param_neg_reply(hdev, handle,
5751                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5752
5753         if (hci_check_conn_params(min, max, latency, timeout))
5754                 return send_conn_param_neg_reply(hdev, handle,
5755                                                  HCI_ERROR_INVALID_LL_PARAMS);
5756
5757         if (hcon->role == HCI_ROLE_MASTER) {
5758                 struct hci_conn_params *params;
5759                 u8 store_hint;
5760
5761                 hci_dev_lock(hdev);
5762
5763                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5764                                                 hcon->dst_type);
5765                 if (params) {
5766                         params->conn_min_interval = min;
5767                         params->conn_max_interval = max;
5768                         params->conn_latency = latency;
5769                         params->supervision_timeout = timeout;
5770                         store_hint = 0x01;
5771                 } else{
5772                         store_hint = 0x00;
5773                 }
5774
5775                 hci_dev_unlock(hdev);
5776
5777                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5778                                     store_hint, min, max, latency, timeout);
5779         }
5780
5781         cp.handle = ev->handle;
5782         cp.interval_min = ev->interval_min;
5783         cp.interval_max = ev->interval_max;
5784         cp.latency = ev->latency;
5785         cp.timeout = ev->timeout;
5786         cp.min_ce_len = 0;
5787         cp.max_ce_len = 0;
5788
5789         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5790 }
5791
5792 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5793                                          struct sk_buff *skb)
5794 {
5795         u8 num_reports = skb->data[0];
5796         void *ptr = &skb->data[1];
5797
5798         hci_dev_lock(hdev);
5799
5800         while (num_reports--) {
5801                 struct hci_ev_le_direct_adv_info *ev = ptr;
5802
5803                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5804                                    ev->bdaddr_type, &ev->direct_addr,
5805                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5806
5807                 ptr += sizeof(*ev);
5808         }
5809
5810         hci_dev_unlock(hdev);
5811 }
5812
5813 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5814 {
5815         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5816
5817         skb_pull(skb, sizeof(*le_ev));
5818
5819         switch (le_ev->subevent) {
5820         case HCI_EV_LE_CONN_COMPLETE:
5821                 hci_le_conn_complete_evt(hdev, skb);
5822                 break;
5823
5824         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5825                 hci_le_conn_update_complete_evt(hdev, skb);
5826                 break;
5827
5828         case HCI_EV_LE_ADVERTISING_REPORT:
5829                 hci_le_adv_report_evt(hdev, skb);
5830                 break;
5831
5832         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5833                 hci_le_remote_feat_complete_evt(hdev, skb);
5834                 break;
5835
5836         case HCI_EV_LE_LTK_REQ:
5837                 hci_le_ltk_request_evt(hdev, skb);
5838                 break;
5839
5840         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5841                 hci_le_remote_conn_param_req_evt(hdev, skb);
5842                 break;
5843
5844         case HCI_EV_LE_DIRECT_ADV_REPORT:
5845                 hci_le_direct_adv_report_evt(hdev, skb);
5846                 break;
5847
5848         case HCI_EV_LE_EXT_ADV_REPORT:
5849                 hci_le_ext_adv_report_evt(hdev, skb);
5850                 break;
5851
5852         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5853                 hci_le_enh_conn_complete_evt(hdev, skb);
5854                 break;
5855
5856         case HCI_EV_LE_EXT_ADV_SET_TERM:
5857                 hci_le_ext_adv_term_evt(hdev, skb);
5858                 break;
5859
5860         default:
5861                 break;
5862         }
5863 }
5864
5865 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5866                                  u8 event, struct sk_buff *skb)
5867 {
5868         struct hci_ev_cmd_complete *ev;
5869         struct hci_event_hdr *hdr;
5870
5871         if (!skb)
5872                 return false;
5873
5874         if (skb->len < sizeof(*hdr)) {
5875                 bt_dev_err(hdev, "too short HCI event");
5876                 return false;
5877         }
5878
5879         hdr = (void *) skb->data;
5880         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5881
5882         if (event) {
5883                 if (hdr->evt != event)
5884                         return false;
5885                 return true;
5886         }
5887
5888         /* Check if request ended in Command Status - no way to retreive
5889          * any extra parameters in this case.
5890          */
5891         if (hdr->evt == HCI_EV_CMD_STATUS)
5892                 return false;
5893
5894         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5895                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5896                            hdr->evt);
5897                 return false;
5898         }
5899
5900         if (skb->len < sizeof(*ev)) {
5901                 bt_dev_err(hdev, "too short cmd_complete event");
5902                 return false;
5903         }
5904
5905         ev = (void *) skb->data;
5906         skb_pull(skb, sizeof(*ev));
5907
5908         if (opcode != __le16_to_cpu(ev->opcode)) {
5909                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5910                        __le16_to_cpu(ev->opcode));
5911                 return false;
5912         }
5913
5914         return true;
5915 }
5916
5917 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5918 {
5919         struct hci_event_hdr *hdr = (void *) skb->data;
5920         hci_req_complete_t req_complete = NULL;
5921         hci_req_complete_skb_t req_complete_skb = NULL;
5922         struct sk_buff *orig_skb = NULL;
5923         u8 status = 0, event = hdr->evt, req_evt = 0;
5924         u16 opcode = HCI_OP_NOP;
5925
5926         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5927                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5928                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5929                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5930                                      &req_complete_skb);
5931                 req_evt = event;
5932         }
5933
5934         /* If it looks like we might end up having to call
5935          * req_complete_skb, store a pristine copy of the skb since the
5936          * various handlers may modify the original one through
5937          * skb_pull() calls, etc.
5938          */
5939         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5940             event == HCI_EV_CMD_COMPLETE)
5941                 orig_skb = skb_clone(skb, GFP_KERNEL);
5942
5943         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5944
5945         switch (event) {
5946         case HCI_EV_INQUIRY_COMPLETE:
5947                 hci_inquiry_complete_evt(hdev, skb);
5948                 break;
5949
5950         case HCI_EV_INQUIRY_RESULT:
5951                 hci_inquiry_result_evt(hdev, skb);
5952                 break;
5953
5954         case HCI_EV_CONN_COMPLETE:
5955                 hci_conn_complete_evt(hdev, skb);
5956                 break;
5957
5958         case HCI_EV_CONN_REQUEST:
5959                 hci_conn_request_evt(hdev, skb);
5960                 break;
5961
5962         case HCI_EV_DISCONN_COMPLETE:
5963                 hci_disconn_complete_evt(hdev, skb);
5964                 break;
5965
5966         case HCI_EV_AUTH_COMPLETE:
5967                 hci_auth_complete_evt(hdev, skb);
5968                 break;
5969
5970         case HCI_EV_REMOTE_NAME:
5971                 hci_remote_name_evt(hdev, skb);
5972                 break;
5973
5974         case HCI_EV_ENCRYPT_CHANGE:
5975                 hci_encrypt_change_evt(hdev, skb);
5976                 break;
5977
5978         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5979                 hci_change_link_key_complete_evt(hdev, skb);
5980                 break;
5981
5982         case HCI_EV_REMOTE_FEATURES:
5983                 hci_remote_features_evt(hdev, skb);
5984                 break;
5985
5986         case HCI_EV_CMD_COMPLETE:
5987                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5988                                      &req_complete, &req_complete_skb);
5989                 break;
5990
5991         case HCI_EV_CMD_STATUS:
5992                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5993                                    &req_complete_skb);
5994                 break;
5995
5996         case HCI_EV_HARDWARE_ERROR:
5997                 hci_hardware_error_evt(hdev, skb);
5998                 break;
5999
6000         case HCI_EV_ROLE_CHANGE:
6001                 hci_role_change_evt(hdev, skb);
6002                 break;
6003
6004         case HCI_EV_NUM_COMP_PKTS:
6005                 hci_num_comp_pkts_evt(hdev, skb);
6006                 break;
6007
6008         case HCI_EV_MODE_CHANGE:
6009                 hci_mode_change_evt(hdev, skb);
6010                 break;
6011
6012         case HCI_EV_PIN_CODE_REQ:
6013                 hci_pin_code_request_evt(hdev, skb);
6014                 break;
6015
6016         case HCI_EV_LINK_KEY_REQ:
6017                 hci_link_key_request_evt(hdev, skb);
6018                 break;
6019
6020         case HCI_EV_LINK_KEY_NOTIFY:
6021                 hci_link_key_notify_evt(hdev, skb);
6022                 break;
6023
6024         case HCI_EV_CLOCK_OFFSET:
6025                 hci_clock_offset_evt(hdev, skb);
6026                 break;
6027
6028         case HCI_EV_PKT_TYPE_CHANGE:
6029                 hci_pkt_type_change_evt(hdev, skb);
6030                 break;
6031
6032         case HCI_EV_PSCAN_REP_MODE:
6033                 hci_pscan_rep_mode_evt(hdev, skb);
6034                 break;
6035
6036         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6037                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6038                 break;
6039
6040         case HCI_EV_REMOTE_EXT_FEATURES:
6041                 hci_remote_ext_features_evt(hdev, skb);
6042                 break;
6043
6044         case HCI_EV_SYNC_CONN_COMPLETE:
6045                 hci_sync_conn_complete_evt(hdev, skb);
6046                 break;
6047
6048         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6049                 hci_extended_inquiry_result_evt(hdev, skb);
6050                 break;
6051
6052         case HCI_EV_KEY_REFRESH_COMPLETE:
6053                 hci_key_refresh_complete_evt(hdev, skb);
6054                 break;
6055
6056         case HCI_EV_IO_CAPA_REQUEST:
6057                 hci_io_capa_request_evt(hdev, skb);
6058                 break;
6059
6060         case HCI_EV_IO_CAPA_REPLY:
6061                 hci_io_capa_reply_evt(hdev, skb);
6062                 break;
6063
6064         case HCI_EV_USER_CONFIRM_REQUEST:
6065                 hci_user_confirm_request_evt(hdev, skb);
6066                 break;
6067
6068         case HCI_EV_USER_PASSKEY_REQUEST:
6069                 hci_user_passkey_request_evt(hdev, skb);
6070                 break;
6071
6072         case HCI_EV_USER_PASSKEY_NOTIFY:
6073                 hci_user_passkey_notify_evt(hdev, skb);
6074                 break;
6075
6076         case HCI_EV_KEYPRESS_NOTIFY:
6077                 hci_keypress_notify_evt(hdev, skb);
6078                 break;
6079
6080         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6081                 hci_simple_pair_complete_evt(hdev, skb);
6082                 break;
6083
6084         case HCI_EV_REMOTE_HOST_FEATURES:
6085                 hci_remote_host_features_evt(hdev, skb);
6086                 break;
6087
6088         case HCI_EV_LE_META:
6089                 hci_le_meta_evt(hdev, skb);
6090                 break;
6091
6092         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6093                 hci_remote_oob_data_request_evt(hdev, skb);
6094                 break;
6095
6096 #if IS_ENABLED(CONFIG_BT_HS)
6097         case HCI_EV_CHANNEL_SELECTED:
6098                 hci_chan_selected_evt(hdev, skb);
6099                 break;
6100
6101         case HCI_EV_PHY_LINK_COMPLETE:
6102                 hci_phy_link_complete_evt(hdev, skb);
6103                 break;
6104
6105         case HCI_EV_LOGICAL_LINK_COMPLETE:
6106                 hci_loglink_complete_evt(hdev, skb);
6107                 break;
6108
6109         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6110                 hci_disconn_loglink_complete_evt(hdev, skb);
6111                 break;
6112
6113         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6114                 hci_disconn_phylink_complete_evt(hdev, skb);
6115                 break;
6116 #endif
6117
6118         case HCI_EV_NUM_COMP_BLOCKS:
6119                 hci_num_comp_blocks_evt(hdev, skb);
6120                 break;
6121
6122 #ifdef TIZEN_BT
6123         case HCI_EV_VENDOR_SPECIFIC:
6124                 hci_vendor_specific_evt(hdev, skb);
6125                 break;
6126 #endif
6127
6128         default:
6129                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6130                 break;
6131         }
6132
6133         if (req_complete) {
6134                 req_complete(hdev, status, opcode);
6135         } else if (req_complete_skb) {
6136                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6137                         kfree_skb(orig_skb);
6138                         orig_skb = NULL;
6139                 }
6140                 req_complete_skb(hdev, status, opcode, orig_skb);
6141         }
6142
6143         kfree_skb(orig_skb);
6144         kfree_skb(skb);
6145         hdev->stat.evt_rx++;
6146 }