net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  44
  45 /* Handle HCI Event packets */
  46
  47 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  48                                   u8 *new_status)
  49 {
  50         __u8 status = *((__u8 *) skb->data);
  51
  52         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  53
  54         /* It is possible that we receive Inquiry Complete event right
  55          * before we receive Inquiry Cancel Command Complete event, in
  56          * which case the latter event should have status of Command
  57          * Disallowed (0x0c). This should not be treated as error, since
  58          * we actually achieve what Inquiry Cancel wants to achieve,
  59          * which is to end the last Inquiry session.
  60          */
  61         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  62                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  63                 status = 0x00;
  64         }
  65
  66         *new_status = status;
  67
  68         if (status)
  69                 return;
  70
  71         clear_bit(HCI_INQUIRY, &hdev->flags);
  72         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  73         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  74
  75         hci_dev_lock(hdev);
  76         /* Set discovery state to stopped if we're not doing LE active
  77          * scanning.
  78          */
  79         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  80             hdev->le_scan_type != LE_SCAN_ACTIVE)
  81                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  82         hci_dev_unlock(hdev);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         __u8 status = *((__u8 *) skb->data);
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  92
  93         if (status)
  94                 return;
  95
  96         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  97 }
  98
  99 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 100 {
 101         __u8 status = *((__u8 *) skb->data);
 102
 103         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 104
 105         if (status)
 106                 return;
 107
 108         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 109
 110         hci_conn_check_pending(hdev);
 111 }
 112
 113 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 114                                           struct sk_buff *skb)
 115 {
 116         BT_DBG("%s", hdev->name);
 117 }
 118
 119 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 120 {
 121         struct hci_rp_role_discovery *rp = (void *) skb->data;
 122         struct hci_conn *conn;
 123
 124         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 125
 126         if (rp->status)
 127                 return;
 128
 129         hci_dev_lock(hdev);
 130
 131         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 132         if (conn)
 133                 conn->role = rp->role;
 134
 135         hci_dev_unlock(hdev);
 136 }
 137
 138 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 139 {
 140         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 141         struct hci_conn *conn;
 142
 143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 144
 145         if (rp->status)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = __le16_to_cpu(rp->policy);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 160         struct hci_conn *conn;
 161         void *sent;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 169         if (!sent)
 170                 return;
 171
 172         hci_dev_lock(hdev);
 173
 174         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 175         if (conn)
 176                 conn->link_policy = get_unaligned_le16(sent + 2);
 177
 178         hci_dev_unlock(hdev);
 179 }
 180
 181 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 182                                         struct sk_buff *skb)
 183 {
 184         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 185
 186         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 187
 188         if (rp->status)
 189                 return;
 190
 191         hdev->link_policy = __le16_to_cpu(rp->policy);
 192 }
 193
 194 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 195                                          struct sk_buff *skb)
 196 {
 197         __u8 status = *((__u8 *) skb->data);
 198         void *sent;
 199
 200         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 201
 202         if (status)
 203                 return;
 204
 205         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 206         if (!sent)
 207                 return;
 208
 209         hdev->link_policy = get_unaligned_le16(sent);
 210 }
 211
 212 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 213 {
 214         __u8 status = *((__u8 *) skb->data);
 215
 216         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 217
 218         clear_bit(HCI_RESET, &hdev->flags);
 219
 220         if (status)
 221                 return;
 222
 223         /* Reset all non-persistent flags */
 224         hci_dev_clear_volatile_flags(hdev);
 225
 226         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 227
 228         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 229         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 230
 231         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 232         hdev->adv_data_len = 0;
 233
 234         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 235         hdev->scan_rsp_data_len = 0;
 236
 237         hdev->le_scan_type = LE_SCAN_PASSIVE;
 238
 239         hdev->ssp_debug_mode = 0;
 240
 241         hci_bdaddr_list_clear(&hdev->le_accept_list);
 242         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 243 }
 244
 245 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 246                                         struct sk_buff *skb)
 247 {
 248         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 249         struct hci_cp_read_stored_link_key *sent;
 250
 251         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 254         if (!sent)
 255                 return;
 256
 257         if (!rp->status && sent->read_all == 0x01) {
 258                 hdev->stored_max_keys = rp->max_keys;
 259                 hdev->stored_num_keys = rp->num_keys;
 260         }
 261 }
 262
 263 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 264                                           struct sk_buff *skb)
 265 {
 266         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 267
 268         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 269
 270         if (rp->status)
 271                 return;
 272
 273         if (rp->num_keys <= hdev->stored_num_keys)
 274                 hdev->stored_num_keys -= rp->num_keys;
 275         else
 276                 hdev->stored_num_keys = 0;
 277 }
 278
 279 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 280 {
 281         __u8 status = *((__u8 *) skb->data);
 282         void *sent;
 283
 284         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 285
 286         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 287         if (!sent)
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         if (hci_dev_test_flag(hdev, HCI_MGMT))
 293                 mgmt_set_local_name_complete(hdev, sent, status);
 294         else if (!status)
 295                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 296
 297         hci_dev_unlock(hdev);
 298 }
 299
 300 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_local_name *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 310             hci_dev_test_flag(hdev, HCI_CONFIG))
 311                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 312 }
 313
 314 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 315 {
 316         __u8 status = *((__u8 *) skb->data);
 317         void *sent;
 318
 319         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 320
 321         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 322         if (!sent)
 323                 return;
 324
 325         hci_dev_lock(hdev);
 326
 327         if (!status) {
 328                 __u8 param = *((__u8 *) sent);
 329
 330                 if (param == AUTH_ENABLED)
 331                         set_bit(HCI_AUTH, &hdev->flags);
 332                 else
 333                         clear_bit(HCI_AUTH, &hdev->flags);
 334         }
 335
 336         if (hci_dev_test_flag(hdev, HCI_MGMT))
 337                 mgmt_auth_enable_complete(hdev, status);
 338
 339         hci_dev_unlock(hdev);
 340 }
 341
 342 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 343 {
 344         __u8 status = *((__u8 *) skb->data);
 345         __u8 param;
 346         void *sent;
 347
 348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 349
 350         if (status)
 351                 return;
 352
 353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 354         if (!sent)
 355                 return;
 356
 357         param = *((__u8 *) sent);
 358
 359         if (param)
 360                 set_bit(HCI_ENCRYPT, &hdev->flags);
 361         else
 362                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 363 }
 364
 365 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 366 {
 367         __u8 status = *((__u8 *) skb->data);
 368         __u8 param;
 369         void *sent;
 370
 371         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 372
 373         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 374         if (!sent)
 375                 return;
 376
 377         param = *((__u8 *) sent);
 378
 379         hci_dev_lock(hdev);
 380
 381         if (status) {
 382                 hdev->discov_timeout = 0;
 383                 goto done;
 384         }
 385
 386         if (param & SCAN_INQUIRY)
 387                 set_bit(HCI_ISCAN, &hdev->flags);
 388         else
 389                 clear_bit(HCI_ISCAN, &hdev->flags);
 390
 391         if (param & SCAN_PAGE)
 392                 set_bit(HCI_PSCAN, &hdev->flags);
 393         else
 394                 clear_bit(HCI_PSCAN, &hdev->flags);
 395
 396 done:
 397         hci_dev_unlock(hdev);
 398 }
 399
 400 static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *)skb->data);
 403         struct hci_cp_set_event_filter *cp;
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 412         if (!sent)
 413                 return;
 414
 415         cp = (struct hci_cp_set_event_filter *)sent;
 416
 417         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 418                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 419         else
 420                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 421 }
 422
 423 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 426
 427         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 428
 429         if (rp->status)
 430                 return;
 431
 432         memcpy(hdev->dev_class, rp->dev_class, 3);
 433
 434         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 435                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 436 }
 437
 438 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 446         if (!sent)
 447                 return;
 448
 449         hci_dev_lock(hdev);
 450
 451         if (status == 0)
 452                 memcpy(hdev->dev_class, sent, 3);
 453
 454         if (hci_dev_test_flag(hdev, HCI_MGMT))
 455                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 456
 457         hci_dev_unlock(hdev);
 458 }
 459
 460 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 461 {
 462         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 463         __u16 setting;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 466
 467         if (rp->status)
 468                 return;
 469
 470         setting = __le16_to_cpu(rp->voice_setting);
 471
 472         if (hdev->voice_setting == setting)
 473                 return;
 474
 475         hdev->voice_setting = setting;
 476
 477         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 478
 479         if (hdev->notify)
 480                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 481 }
 482
 483 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 484                                        struct sk_buff *skb)
 485 {
 486         __u8 status = *((__u8 *) skb->data);
 487         __u16 setting;
 488         void *sent;
 489
 490         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 491
 492         if (status)
 493                 return;
 494
 495         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 496         if (!sent)
 497                 return;
 498
 499         setting = get_unaligned_le16(sent);
 500
 501         if (hdev->voice_setting == setting)
 502                 return;
 503
 504         hdev->voice_setting = setting;
 505
 506         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 507
 508         if (hdev->notify)
 509                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 510 }
 511
 512 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 513                                           struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 518
 519         if (rp->status)
 520                 return;
 521
 522         hdev->num_iac = rp->num_iac;
 523
 524         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 525 }
 526
 527 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 528 {
 529         __u8 status = *((__u8 *) skb->data);
 530         struct hci_cp_write_ssp_mode *sent;
 531
 532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 533
 534         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 535         if (!sent)
 536                 return;
 537
 538         hci_dev_lock(hdev);
 539
 540         if (!status) {
 541                 if (sent->mode)
 542                         hdev->features[1][0] |= LMP_HOST_SSP;
 543                 else
 544                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 545         }
 546
 547         if (hci_dev_test_flag(hdev, HCI_MGMT))
 548                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 549         else if (!status) {
 550                 if (sent->mode)
 551                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 552                 else
 553                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 554         }
 555
 556         hci_dev_unlock(hdev);
 557 }
 558
 559 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 560 {
 561         u8 status = *((u8 *) skb->data);
 562         struct hci_cp_write_sc_support *sent;
 563
 564         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 565
 566         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 567         if (!sent)
 568                 return;
 569
 570         hci_dev_lock(hdev);
 571
 572         if (!status) {
 573                 if (sent->support)
 574                         hdev->features[1][0] |= LMP_HOST_SC;
 575                 else
 576                         hdev->features[1][0] &= ~LMP_HOST_SC;
 577         }
 578
 579         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 580                 if (sent->support)
 581                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 582                 else
 583                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 584         }
 585
 586         hci_dev_unlock(hdev);
 587 }
 588
 589 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 590 {
 591         struct hci_rp_read_local_version *rp = (void *) skb->data;
 592
 593         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 594
 595         if (rp->status)
 596                 return;
 597
 598         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 599             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 600                 hdev->hci_ver = rp->hci_ver;
 601                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 602                 hdev->lmp_ver = rp->lmp_ver;
 603                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 604                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 605         }
 606 }
 607
 608 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 609                                        struct sk_buff *skb)
 610 {
 611         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 612
 613         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 614
 615         if (rp->status)
 616                 return;
 617
 618         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 619             hci_dev_test_flag(hdev, HCI_CONFIG))
 620                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 621 }
 622
 623 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 624                                              struct sk_buff *skb)
 625 {
 626         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 627         struct hci_conn *conn;
 628
 629         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 630
 631         if (rp->status)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 644                                               struct sk_buff *skb)
 645 {
 646         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 647         struct hci_conn *conn;
 648         void *sent;
 649
 650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 656         if (!sent)
 657                 return;
 658
 659         hci_dev_lock(hdev);
 660
 661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 662         if (conn)
 663                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 664
 665         hci_dev_unlock(hdev);
 666 }
 667
 668 static void hci_cc_read_local_features(struct hci_dev *hdev,
 669                                        struct sk_buff *skb)
 670 {
 671         struct hci_rp_read_local_features *rp = (void *) skb->data;
 672
 673         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 674
 675         if (rp->status)
 676                 return;
 677
 678         memcpy(hdev->features, rp->features, 8);
 679
 680         /* Adjust default settings according to features
 681          * supported by device. */
 682
 683         if (hdev->features[0][0] & LMP_3SLOT)
 684                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 685
 686         if (hdev->features[0][0] & LMP_5SLOT)
 687                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 688
 689         if (hdev->features[0][1] & LMP_HV2) {
 690                 hdev->pkt_type  |= (HCI_HV2);
 691                 hdev->esco_type |= (ESCO_HV2);
 692         }
 693
 694         if (hdev->features[0][1] & LMP_HV3) {
 695                 hdev->pkt_type  |= (HCI_HV3);
 696                 hdev->esco_type |= (ESCO_HV3);
 697         }
 698
 699         if (lmp_esco_capable(hdev))
 700                 hdev->esco_type |= (ESCO_EV3);
 701
 702         if (hdev->features[0][4] & LMP_EV4)
 703                 hdev->esco_type |= (ESCO_EV4);
 704
 705         if (hdev->features[0][4] & LMP_EV5)
 706                 hdev->esco_type |= (ESCO_EV5);
 707
 708         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 709                 hdev->esco_type |= (ESCO_2EV3);
 710
 711         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 712                 hdev->esco_type |= (ESCO_3EV3);
 713
 714         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 715                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 716 }
 717
 718 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 719                                            struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 return;
 727
 728         if (hdev->max_page < rp->max_page)
 729                 hdev->max_page = rp->max_page;
 730
 731         if (rp->page < HCI_MAX_PAGES)
 732                 memcpy(hdev->features[rp->page], rp->features, 8);
 733 }
 734
 735 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 736                                           struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 741
 742         if (rp->status)
 743                 return;
 744
 745         hdev->flow_ctl_mode = rp->mode;
 746 }
 747
 748 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 751
 752         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 753
 754         if (rp->status)
 755                 return;
 756
 757         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 758         hdev->sco_mtu  = rp->sco_mtu;
 759         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 760         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 761
 762         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 763                 hdev->sco_mtu  = 64;
 764                 hdev->sco_pkts = 8;
 765         }
 766
 767         hdev->acl_cnt = hdev->acl_pkts;
 768         hdev->sco_cnt = hdev->sco_pkts;
 769
 770         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 771                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 772 }
 773
 774 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         if (test_bit(HCI_INIT, &hdev->flags))
 784                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 785
 786         if (hci_dev_test_flag(hdev, HCI_SETUP))
 787                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 788 }
 789
 790 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 791                                            struct sk_buff *skb)
 792 {
 793         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 794
 795         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 796
 797         if (rp->status)
 798                 return;
 799
 800         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 801             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 802                 hdev->pairing_opts = rp->pairing_opts;
 803                 hdev->max_enc_key_size = rp->max_key_size;
 804         }
 805 }
 806
 807 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 808                                            struct sk_buff *skb)
 809 {
 810         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 811
 812         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 813
 814         if (rp->status)
 815                 return;
 816
 817         if (test_bit(HCI_INIT, &hdev->flags)) {
 818                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 819                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 820         }
 821 }
 822
 823 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 824                                             struct sk_buff *skb)
 825 {
 826         u8 status = *((u8 *) skb->data);
 827         struct hci_cp_write_page_scan_activity *sent;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 830
 831         if (status)
 832                 return;
 833
 834         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 835         if (!sent)
 836                 return;
 837
 838         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 839         hdev->page_scan_window = __le16_to_cpu(sent->window);
 840 }
 841
 842 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 843                                            struct sk_buff *skb)
 844 {
 845         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 846
 847         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 848
 849         if (rp->status)
 850                 return;
 851
 852         if (test_bit(HCI_INIT, &hdev->flags))
 853                 hdev->page_scan_type = rp->type;
 854 }
 855
 856 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 857                                         struct sk_buff *skb)
 858 {
 859         u8 status = *((u8 *) skb->data);
 860         u8 *type;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 863
 864         if (status)
 865                 return;
 866
 867         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 868         if (type)
 869                 hdev->page_scan_type = *type;
 870 }
 871
 872 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 873                                         struct sk_buff *skb)
 874 {
 875         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         if (rp->status)
 880                 return;
 881
 882         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 883         hdev->block_len = __le16_to_cpu(rp->block_len);
 884         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 885
 886         hdev->block_cnt = hdev->num_blocks;
 887
 888         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 889                hdev->block_cnt, hdev->block_len);
 890 }
 891
 892 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_read_clock *rp = (void *) skb->data;
 895         struct hci_cp_read_clock *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s", hdev->name);
 899
 900         if (skb->len < sizeof(*rp))
 901                 return;
 902
 903         if (rp->status)
 904                 return;
 905
 906         hci_dev_lock(hdev);
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 909         if (!cp)
 910                 goto unlock;
 911
 912         if (cp->which == 0x00) {
 913                 hdev->clock = le32_to_cpu(rp->clock);
 914                 goto unlock;
 915         }
 916
 917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 918         if (conn) {
 919                 conn->clock = le32_to_cpu(rp->clock);
 920                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 921         }
 922
 923 unlock:
 924         hci_dev_unlock(hdev);
 925 }
 926
 927 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 928                                        struct sk_buff *skb)
 929 {
 930         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 931
 932         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 933
 934         if (rp->status)
 935                 return;
 936
 937         hdev->amp_status = rp->amp_status;
 938         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 939         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 940         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 941         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 942         hdev->amp_type = rp->amp_type;
 943         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 944         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 945         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 946         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 947 }
 948
 949 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 950                                          struct sk_buff *skb)
 951 {
 952         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 953
 954         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 955
 956         if (rp->status)
 957                 return;
 958
 959         hdev->inq_tx_power = rp->tx_power;
 960 }
 961
 962 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 963                                                struct sk_buff *skb)
 964 {
 965         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 966
 967         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 968
 969         if (rp->status)
 970                 return;
 971
 972         hdev->err_data_reporting = rp->err_data_reporting;
 973 }
 974
 975 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 976                                                 struct sk_buff *skb)
 977 {
 978         __u8 status = *((__u8 *)skb->data);
 979         struct hci_cp_write_def_err_data_reporting *cp;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 982
 983         if (status)
 984                 return;
 985
 986         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 987         if (!cp)
 988                 return;
 989
 990         hdev->err_data_reporting = cp->err_data_reporting;
 991 }
 992
 993 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 994 {
 995         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 996         struct hci_cp_pin_code_reply *cp;
 997         struct hci_conn *conn;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (hci_dev_test_flag(hdev, HCI_MGMT))
1004                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1005
1006         if (rp->status)
1007                 goto unlock;
1008
1009         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1010         if (!cp)
1011                 goto unlock;
1012
1013         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1014         if (conn)
1015                 conn->pin_length = cp->pin_len;
1016
1017 unlock:
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1026
1027         hci_dev_lock(hdev);
1028
1029         if (hci_dev_test_flag(hdev, HCI_MGMT))
1030                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1031                                                  rp->status);
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1037                                        struct sk_buff *skb)
1038 {
1039         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1040
1041         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1042
1043         if (rp->status)
1044                 return;
1045
1046         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1047         hdev->le_pkts = rp->le_max_pkt;
1048
1049         hdev->le_cnt = hdev->le_pkts;
1050
1051         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1052 }
1053
1054 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1055                                           struct sk_buff *skb)
1056 {
1057         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         if (rp->status)
1062                 return;
1063
1064         memcpy(hdev->le_features, rp->features, 8);
1065 }
1066
1067 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1068                                         struct sk_buff *skb)
1069 {
1070         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1073
1074         if (rp->status)
1075                 return;
1076
1077         hdev->adv_tx_power = rp->tx_power;
1078 }
1079
1080 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1081 {
1082         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1083
1084         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1085
1086         hci_dev_lock(hdev);
1087
1088         if (hci_dev_test_flag(hdev, HCI_MGMT))
1089                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1090                                                  rp->status);
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1096                                           struct sk_buff *skb)
1097 {
1098         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1101
1102         hci_dev_lock(hdev);
1103
1104         if (hci_dev_test_flag(hdev, HCI_MGMT))
1105                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1106                                                      ACL_LINK, 0, rp->status);
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (hci_dev_test_flag(hdev, HCI_MGMT))
1120                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1121                                                  0, rp->status);
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1127                                           struct sk_buff *skb)
1128 {
1129         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1132
1133         hci_dev_lock(hdev);
1134
1135         if (hci_dev_test_flag(hdev, HCI_MGMT))
1136                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1137                                                      ACL_LINK, 0, rp->status);
1138
1139         hci_dev_unlock(hdev);
1140 }
1141
1142 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1143                                        struct sk_buff *skb)
1144 {
1145         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1146
1147         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1148 }
1149
1150 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1151                                            struct sk_buff *skb)
1152 {
1153         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1154
1155         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1156 }
1157
1158 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1159 {
1160         __u8 status = *((__u8 *) skb->data);
1161         bdaddr_t *sent;
1162
1163         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1164
1165         if (status)
1166                 return;
1167
1168         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1169         if (!sent)
1170                 return;
1171
1172         hci_dev_lock(hdev);
1173
1174         bacpy(&hdev->random_addr, sent);
1175
1176         if (!bacmp(&hdev->rpa, sent)) {
1177                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1178                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1179                                    secs_to_jiffies(hdev->rpa_timeout));
1180         }
1181
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1186 {
1187         __u8 status = *((__u8 *) skb->data);
1188         struct hci_cp_le_set_default_phy *cp;
1189
1190         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1191
1192         if (status)
1193                 return;
1194
1195         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1196         if (!cp)
1197                 return;
1198
1199         hci_dev_lock(hdev);
1200
1201         hdev->le_tx_def_phys = cp->tx_phys;
1202         hdev->le_rx_def_phys = cp->rx_phys;
1203
1204         hci_dev_unlock(hdev);
1205 }
1206
1207 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1208                                               struct sk_buff *skb)
1209 {
1210         __u8 status = *((__u8 *) skb->data);
1211         struct hci_cp_le_set_adv_set_rand_addr *cp;
1212         struct adv_info *adv;
1213
1214         if (status)
1215                 return;
1216
1217         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1218         /* Update only in case the adv instance since handle 0x00 shall be using
1219          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1220          * non-extended adverting.
1221          */
1222         if (!cp || !cp->handle)
1223                 return;
1224
1225         hci_dev_lock(hdev);
1226
1227         adv = hci_find_adv_instance(hdev, cp->handle);
1228         if (adv) {
1229                 bacpy(&adv->random_addr, &cp->bdaddr);
1230                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1231                         adv->rpa_expired = false;
1232                         queue_delayed_work(hdev->workqueue,
1233                                            &adv->rpa_expired_cb,
1234                                            secs_to_jiffies(hdev->rpa_timeout));
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1242                                           struct sk_buff *skb)
1243 {
1244         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1245
1246         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1247
1248         if (rp->status)
1249                 return;
1250
1251         hdev->min_le_tx_power = rp->min_le_tx_power;
1252         hdev->max_le_tx_power = rp->max_le_tx_power;
1253 }
1254
1255 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1256 {
1257         __u8 *sent, status = *((__u8 *) skb->data);
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1260
1261         if (status)
1262                 return;
1263
1264         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1265         if (!sent)
1266                 return;
1267
1268         hci_dev_lock(hdev);
1269
1270         /* If we're doing connection initiation as peripheral. Set a
1271          * timeout in case something goes wrong.
1272          */
1273         if (*sent) {
1274                 struct hci_conn *conn;
1275
1276                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1277
1278                 conn = hci_lookup_le_connect(hdev);
1279                 if (conn)
1280                         queue_delayed_work(hdev->workqueue,
1281                                            &conn->le_conn_timeout,
1282                                            conn->conn_timeout);
1283         } else {
1284                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1285         }
1286
1287         hci_dev_unlock(hdev);
1288 }
1289
1290 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1291                                          struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_set_ext_adv_enable *cp;
1294         struct hci_cp_ext_adv_set *set;
1295         __u8 status = *((__u8 *) skb->data);
1296         struct adv_info *adv = NULL, *n;
1297
1298         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1299
1300         if (status)
1301                 return;
1302
1303         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1304         if (!cp)
1305                 return;
1306
1307         set = (void *)cp->data;
1308
1309         hci_dev_lock(hdev);
1310
1311         if (cp->num_of_sets)
1312                 adv = hci_find_adv_instance(hdev, set->handle);
1313
1314         if (cp->enable) {
1315                 struct hci_conn *conn;
1316
1317                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1318
1319                 if (adv)
1320                         adv->enabled = true;
1321
1322                 conn = hci_lookup_le_connect(hdev);
1323                 if (conn)
1324                         queue_delayed_work(hdev->workqueue,
1325                                            &conn->le_conn_timeout,
1326                                            conn->conn_timeout);
1327         } else {
1328                 if (cp->num_of_sets) {
1329                         if (adv)
1330                                 adv->enabled = false;
1331
1332                         /* If just one instance was disabled check if there are
1333                          * any other instance enabled before clearing HCI_LE_ADV
1334                          */
1335                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1336                                                  list) {
1337                                 if (adv->enabled)
1338                                         goto unlock;
1339                         }
1340                 } else {
1341                         /* All instances shall be considered disabled */
1342                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1343                                                  list)
1344                                 adv->enabled = false;
1345                 }
1346
1347                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1348         }
1349
1350 unlock:
1351         hci_dev_unlock(hdev);
1352 }
1353
1354 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1355 {
1356         struct hci_cp_le_set_scan_param *cp;
1357         __u8 status = *((__u8 *) skb->data);
1358
1359         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1360
1361         if (status)
1362                 return;
1363
1364         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1365         if (!cp)
1366                 return;
1367
1368         hci_dev_lock(hdev);
1369
1370         hdev->le_scan_type = cp->type;
1371
1372         hci_dev_unlock(hdev);
1373 }
1374
1375 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1376                                          struct sk_buff *skb)
1377 {
1378         struct hci_cp_le_set_ext_scan_params *cp;
1379         __u8 status = *((__u8 *) skb->data);
1380         struct hci_cp_le_scan_phy_params *phy_param;
1381
1382         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1383
1384         if (status)
1385                 return;
1386
1387         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1388         if (!cp)
1389                 return;
1390
1391         phy_param = (void *)cp->data;
1392
1393         hci_dev_lock(hdev);
1394
1395         hdev->le_scan_type = phy_param->type;
1396
1397         hci_dev_unlock(hdev);
1398 }
1399
1400 static bool has_pending_adv_report(struct hci_dev *hdev)
1401 {
1402         struct discovery_state *d = &hdev->discovery;
1403
1404         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1405 }
1406
1407 static void clear_pending_adv_report(struct hci_dev *hdev)
1408 {
1409         struct discovery_state *d = &hdev->discovery;
1410
1411         bacpy(&d->last_adv_addr, BDADDR_ANY);
1412         d->last_adv_data_len = 0;
1413 }
1414
1415 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1416                                      u8 bdaddr_type, s8 rssi, u32 flags,
1417                                      u8 *data, u8 len)
1418 {
1419         struct discovery_state *d = &hdev->discovery;
1420
1421         if (len > HCI_MAX_AD_LENGTH)
1422                 return;
1423
1424         bacpy(&d->last_adv_addr, bdaddr);
1425         d->last_adv_addr_type = bdaddr_type;
1426         d->last_adv_rssi = rssi;
1427         d->last_adv_flags = flags;
1428         memcpy(d->last_adv_data, data, len);
1429         d->last_adv_data_len = len;
1430 }
1431
1432 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1433 {
1434         hci_dev_lock(hdev);
1435
1436         switch (enable) {
1437         case LE_SCAN_ENABLE:
1438                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1439                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1440                         clear_pending_adv_report(hdev);
1441                 break;
1442
1443         case LE_SCAN_DISABLE:
1444                 /* We do this here instead of when setting DISCOVERY_STOPPED
1445                  * since the latter would potentially require waiting for
1446                  * inquiry to stop too.
1447                  */
1448                 if (has_pending_adv_report(hdev)) {
1449                         struct discovery_state *d = &hdev->discovery;
1450
1451                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1452                                           d->last_adv_addr_type, NULL,
1453                                           d->last_adv_rssi, d->last_adv_flags,
1454                                           d->last_adv_data,
1455                                           d->last_adv_data_len, NULL, 0);
1456                 }
1457
1458                 /* Cancel this timer so that we don't try to disable scanning
1459                  * when it's already disabled.
1460                  */
1461                 cancel_delayed_work(&hdev->le_scan_disable);
1462
1463                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1464
1465                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1466                  * interrupted scanning due to a connect request. Mark
1467                  * therefore discovery as stopped. If this was not
1468                  * because of a connect request advertising might have
1469                  * been disabled because of active scanning, so
1470                  * re-enable it again if necessary.
1471                  */
1472                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1473 #ifndef TIZEN_BT /* The below line is kernel bug. */
1474                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1475 #else
1476                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1477 #endif
1478                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1479                          hdev->discovery.state == DISCOVERY_FINDING)
1480                         hci_req_reenable_advertising(hdev);
1481
1482                 break;
1483
1484         default:
1485                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1486                            enable);
1487                 break;
1488         }
1489
1490         hci_dev_unlock(hdev);
1491 }
1492
1493 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1494                                       struct sk_buff *skb)
1495 {
1496         struct hci_cp_le_set_scan_enable *cp;
1497         __u8 status = *((__u8 *) skb->data);
1498
1499         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1500
1501         if (status)
1502                 return;
1503
1504         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1505         if (!cp)
1506                 return;
1507
1508         le_set_scan_enable_complete(hdev, cp->enable);
1509 }
1510
1511 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1512                                       struct sk_buff *skb)
1513 {
1514         struct hci_cp_le_set_ext_scan_enable *cp;
1515         __u8 status = *((__u8 *) skb->data);
1516
1517         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1518
1519         if (status)
1520                 return;
1521
1522         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1523         if (!cp)
1524                 return;
1525
1526         le_set_scan_enable_complete(hdev, cp->enable);
1527 }
1528
1529 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1530                                       struct sk_buff *skb)
1531 {
1532         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1533
1534         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1535                rp->num_of_sets);
1536
1537         if (rp->status)
1538                 return;
1539
1540         hdev->le_num_of_adv_sets = rp->num_of_sets;
1541 }
1542
1543 static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1544                                             struct sk_buff *skb)
1545 {
1546         struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1547
1548         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1549
1550         if (rp->status)
1551                 return;
1552
1553         hdev->le_accept_list_size = rp->size;
1554 }
1555
1556 static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1557                                         struct sk_buff *skb)
1558 {
1559         __u8 status = *((__u8 *) skb->data);
1560
1561         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1562
1563         if (status)
1564                 return;
1565
1566         hci_dev_lock(hdev);
1567         hci_bdaddr_list_clear(&hdev->le_accept_list);
1568         hci_dev_unlock(hdev);
1569 }
1570
1571 static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1572                                          struct sk_buff *skb)
1573 {
1574         struct hci_cp_le_add_to_accept_list *sent;
1575         __u8 status = *((__u8 *) skb->data);
1576
1577         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1578
1579         if (status)
1580                 return;
1581
1582         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1583         if (!sent)
1584                 return;
1585
1586         hci_dev_lock(hdev);
1587         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1588                             sent->bdaddr_type);
1589         hci_dev_unlock(hdev);
1590 }
1591
1592 static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1593                                            struct sk_buff *skb)
1594 {
1595         struct hci_cp_le_del_from_accept_list *sent;
1596         __u8 status = *((__u8 *) skb->data);
1597
1598         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1599
1600         if (status)
1601                 return;
1602
1603         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1604         if (!sent)
1605                 return;
1606
1607         hci_dev_lock(hdev);
1608         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1609                             sent->bdaddr_type);
1610         hci_dev_unlock(hdev);
1611 }
1612
1613 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1614                                             struct sk_buff *skb)
1615 {
1616         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1617
1618         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1619
1620         if (rp->status)
1621                 return;
1622
1623         memcpy(hdev->le_states, rp->le_states, 8);
1624 }
1625
1626 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1627                                         struct sk_buff *skb)
1628 {
1629         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1630
1631         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1632
1633         if (rp->status)
1634                 return;
1635
1636         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1637         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1638 }
1639
1640 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1641                                          struct sk_buff *skb)
1642 {
1643         struct hci_cp_le_write_def_data_len *sent;
1644         __u8 status = *((__u8 *) skb->data);
1645
1646         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1647
1648         if (status)
1649                 return;
1650
1651         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1652         if (!sent)
1653                 return;
1654
1655         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1656         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1657 }
1658
1659 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1660                                          struct sk_buff *skb)
1661 {
1662         struct hci_cp_le_add_to_resolv_list *sent;
1663         __u8 status = *((__u8 *) skb->data);
1664
1665         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1666
1667         if (status)
1668                 return;
1669
1670         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1671         if (!sent)
1672                 return;
1673
1674         hci_dev_lock(hdev);
1675         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1676                                 sent->bdaddr_type, sent->peer_irk,
1677                                 sent->local_irk);
1678         hci_dev_unlock(hdev);
1679 }
1680
1681 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1682                                           struct sk_buff *skb)
1683 {
1684         struct hci_cp_le_del_from_resolv_list *sent;
1685         __u8 status = *((__u8 *) skb->data);
1686
1687         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1688
1689         if (status)
1690                 return;
1691
1692         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1693         if (!sent)
1694                 return;
1695
1696         hci_dev_lock(hdev);
1697         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1698                             sent->bdaddr_type);
1699         hci_dev_unlock(hdev);
1700 }
1701
1702 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1703                                        struct sk_buff *skb)
1704 {
1705         __u8 status = *((__u8 *) skb->data);
1706
1707         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1708
1709         if (status)
1710                 return;
1711
1712         hci_dev_lock(hdev);
1713         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1714         hci_dev_unlock(hdev);
1715 }
1716
1717 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1718                                            struct sk_buff *skb)
1719 {
1720         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1721
1722         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1723
1724         if (rp->status)
1725                 return;
1726
1727         hdev->le_resolv_list_size = rp->size;
1728 }
1729
1730 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1731                                                 struct sk_buff *skb)
1732 {
1733         __u8 *sent, status = *((__u8 *) skb->data);
1734
1735         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1736
1737         if (status)
1738                 return;
1739
1740         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1741         if (!sent)
1742                 return;
1743
1744         hci_dev_lock(hdev);
1745
1746         if (*sent)
1747                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1748         else
1749                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1750
1751         hci_dev_unlock(hdev);
1752 }
1753
1754 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1755                                         struct sk_buff *skb)
1756 {
1757         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1758
1759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1760
1761         if (rp->status)
1762                 return;
1763
1764         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1765         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1766         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1767         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1768 }
1769
1770 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1771                                            struct sk_buff *skb)
1772 {
1773         struct hci_cp_write_le_host_supported *sent;
1774         __u8 status = *((__u8 *) skb->data);
1775
1776         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1777
1778         if (status)
1779                 return;
1780
1781         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1782         if (!sent)
1783                 return;
1784
1785         hci_dev_lock(hdev);
1786
1787         if (sent->le) {
1788                 hdev->features[1][0] |= LMP_HOST_LE;
1789                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1790         } else {
1791                 hdev->features[1][0] &= ~LMP_HOST_LE;
1792                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1793                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1794         }
1795
1796         if (sent->simul)
1797                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1798         else
1799                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1800
1801         hci_dev_unlock(hdev);
1802 }
1803
1804 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1805 {
1806         struct hci_cp_le_set_adv_param *cp;
1807         u8 status = *((u8 *) skb->data);
1808
1809         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1810
1811         if (status)
1812                 return;
1813
1814         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1815         if (!cp)
1816                 return;
1817
1818         hci_dev_lock(hdev);
1819         hdev->adv_addr_type = cp->own_address_type;
1820         hci_dev_unlock(hdev);
1821 }
1822
1823 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1824 {
1825         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1826         struct hci_cp_le_set_ext_adv_params *cp;
1827         struct adv_info *adv_instance;
1828
1829         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1830
1831         if (rp->status)
1832                 return;
1833
1834         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1835         if (!cp)
1836                 return;
1837
1838         hci_dev_lock(hdev);
1839         hdev->adv_addr_type = cp->own_addr_type;
1840         if (!cp->handle) {
1841                 /* Store in hdev for instance 0 */
1842                 hdev->adv_tx_power = rp->tx_power;
1843         } else {
1844                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
1845                 if (adv_instance)
1846                         adv_instance->tx_power = rp->tx_power;
1847         }
1848         /* Update adv data as tx power is known now */
1849         hci_req_update_adv_data(hdev, cp->handle);
1850
1851         hci_dev_unlock(hdev);
1852 }
1853
1854 #ifdef TIZEN_BT
1855 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1856                                           struct sk_buff *skb)
1857 {
1858         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1859
1860         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1861                hdev->name, rp->status, rp->le_ext_opcode);
1862
1863         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1864 }
1865
1866 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1867                                           struct sk_buff *skb)
1868 {
1869         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1870
1871         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1872                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1873
1874         mgmt_raw_rssi_response(hdev, rp, rp->status);
1875 }
1876
1877 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1878                                               struct sk_buff *skb)
1879 {
1880         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1881         __u8 event_le_ext_sub_code;
1882
1883         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1884                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1885
1886         skb_pull(skb, sizeof(*ev));
1887         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1888
1889         switch (event_le_ext_sub_code) {
1890         case LE_RSSI_LINK_ALERT:
1891                 BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X",
1892                        LE_RSSI_LINK_ALERT);
1893                 mgmt_rssi_alert_evt(hdev, skb);
1894                 break;
1895
1896         default:
1897                 break;
1898         }
1899 }
1900
1901 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1902 {
1903         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1904         __u8 event_sub_code;
1905
1906         BT_DBG("hci_vendor_specific_evt");
1907
1908         skb_pull(skb, sizeof(*ev));
1909         event_sub_code = ev->event_sub_code;
1910
1911         switch (event_sub_code) {
1912         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1913                 hci_vendor_specific_group_ext_evt(hdev, skb);
1914                 break;
1915
1916         default:
1917                 break;
1918         }
1919 }
1920 #endif
1921
1922 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1923 {
1924         struct hci_rp_read_rssi *rp = (void *) skb->data;
1925         struct hci_conn *conn;
1926
1927         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1928
1929         if (rp->status)
1930                 return;
1931
1932         hci_dev_lock(hdev);
1933
1934         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1935         if (conn)
1936                 conn->rssi = rp->rssi;
1937
1938         hci_dev_unlock(hdev);
1939 }
1940
1941 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1942 {
1943         struct hci_cp_read_tx_power *sent;
1944         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1945         struct hci_conn *conn;
1946
1947         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1948
1949         if (rp->status)
1950                 return;
1951
1952         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1953         if (!sent)
1954                 return;
1955
1956         hci_dev_lock(hdev);
1957
1958         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1959         if (!conn)
1960                 goto unlock;
1961
1962         switch (sent->type) {
1963         case 0x00:
1964                 conn->tx_power = rp->tx_power;
1965                 break;
1966         case 0x01:
1967                 conn->max_tx_power = rp->tx_power;
1968                 break;
1969         }
1970
1971 unlock:
1972         hci_dev_unlock(hdev);
1973 }
1974
1975 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1976 {
1977         u8 status = *((u8 *) skb->data);
1978         u8 *mode;
1979
1980         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1981
1982         if (status)
1983                 return;
1984
1985         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1986         if (mode)
1987                 hdev->ssp_debug_mode = *mode;
1988 }
1989
1990 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1991 {
1992         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1993
1994         if (status) {
1995                 hci_conn_check_pending(hdev);
1996                 return;
1997         }
1998
1999         set_bit(HCI_INQUIRY, &hdev->flags);
2000 }
2001
2002 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2003 {
2004         struct hci_cp_create_conn *cp;
2005         struct hci_conn *conn;
2006
2007         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2008
2009         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2010         if (!cp)
2011                 return;
2012
2013         hci_dev_lock(hdev);
2014
2015         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2016
2017         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
2018
2019         if (status) {
2020                 if (conn && conn->state == BT_CONNECT) {
2021                         if (status != 0x0c || conn->attempt > 2) {
2022                                 conn->state = BT_CLOSED;
2023                                 hci_connect_cfm(conn, status);
2024                                 hci_conn_del(conn);
2025                         } else
2026                                 conn->state = BT_CONNECT2;
2027                 }
2028         } else {
2029                 if (!conn) {
2030                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2031                                             HCI_ROLE_MASTER);
2032                         if (!conn)
2033                                 bt_dev_err(hdev, "no memory for new connection");
2034                 }
2035         }
2036
2037         hci_dev_unlock(hdev);
2038 }
2039
2040 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2041 {
2042         struct hci_cp_add_sco *cp;
2043         struct hci_conn *acl, *sco;
2044         __u16 handle;
2045
2046         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2047
2048         if (!status)
2049                 return;
2050
2051         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2052         if (!cp)
2053                 return;
2054
2055         handle = __le16_to_cpu(cp->handle);
2056
2057         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2058
2059         hci_dev_lock(hdev);
2060
2061         acl = hci_conn_hash_lookup_handle(hdev, handle);
2062         if (acl) {
2063                 sco = acl->link;
2064                 if (sco) {
2065                         sco->state = BT_CLOSED;
2066
2067                         hci_connect_cfm(sco, status);
2068                         hci_conn_del(sco);
2069                 }
2070         }
2071
2072         hci_dev_unlock(hdev);
2073 }
2074
2075 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2076 {
2077         struct hci_cp_auth_requested *cp;
2078         struct hci_conn *conn;
2079
2080         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2081
2082         if (!status)
2083                 return;
2084
2085         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2086         if (!cp)
2087                 return;
2088
2089         hci_dev_lock(hdev);
2090
2091         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2092         if (conn) {
2093                 if (conn->state == BT_CONFIG) {
2094                         hci_connect_cfm(conn, status);
2095                         hci_conn_drop(conn);
2096                 }
2097         }
2098
2099         hci_dev_unlock(hdev);
2100 }
2101
2102 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2103 {
2104         struct hci_cp_set_conn_encrypt *cp;
2105         struct hci_conn *conn;
2106
2107         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2108
2109         if (!status)
2110                 return;
2111
2112         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2113         if (!cp)
2114                 return;
2115
2116         hci_dev_lock(hdev);
2117
2118         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2119         if (conn) {
2120                 if (conn->state == BT_CONFIG) {
2121                         hci_connect_cfm(conn, status);
2122                         hci_conn_drop(conn);
2123                 }
2124         }
2125
2126         hci_dev_unlock(hdev);
2127 }
2128
2129 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2130                                     struct hci_conn *conn)
2131 {
2132         if (conn->state != BT_CONFIG || !conn->out)
2133                 return 0;
2134
2135         if (conn->pending_sec_level == BT_SECURITY_SDP)
2136                 return 0;
2137
2138         /* Only request authentication for SSP connections or non-SSP
2139          * devices with sec_level MEDIUM or HIGH or if MITM protection
2140          * is requested.
2141          */
2142         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2143             conn->pending_sec_level != BT_SECURITY_FIPS &&
2144             conn->pending_sec_level != BT_SECURITY_HIGH &&
2145             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2146                 return 0;
2147
2148         return 1;
2149 }
2150
2151 static int hci_resolve_name(struct hci_dev *hdev,
2152                                    struct inquiry_entry *e)
2153 {
2154         struct hci_cp_remote_name_req cp;
2155
2156         memset(&cp, 0, sizeof(cp));
2157
2158         bacpy(&cp.bdaddr, &e->data.bdaddr);
2159         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2160         cp.pscan_mode = e->data.pscan_mode;
2161         cp.clock_offset = e->data.clock_offset;
2162
2163         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2164 }
2165
2166 static bool hci_resolve_next_name(struct hci_dev *hdev)
2167 {
2168         struct discovery_state *discov = &hdev->discovery;
2169         struct inquiry_entry *e;
2170
2171         if (list_empty(&discov->resolve))
2172                 return false;
2173
2174         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2175         if (!e)
2176                 return false;
2177
2178         if (hci_resolve_name(hdev, e) == 0) {
2179                 e->name_state = NAME_PENDING;
2180                 return true;
2181         }
2182
2183         return false;
2184 }
2185
2186 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2187                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2188 {
2189         struct discovery_state *discov = &hdev->discovery;
2190         struct inquiry_entry *e;
2191
2192 #ifdef TIZEN_BT
2193         /* Update the mgmt connected state if necessary. Be careful with
2194          * conn objects that exist but are not (yet) connected however.
2195          * Only those in BT_CONFIG or BT_CONNECTED states can be
2196          * considered connected.
2197          */
2198         if (conn &&
2199             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2200                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2201                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2202                 else
2203                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2204         }
2205 #else
2206         if (conn &&
2207             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2208             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2209                 mgmt_device_connected(hdev, conn, name, name_len);
2210 #endif
2211
2212         if (discov->state == DISCOVERY_STOPPED)
2213                 return;
2214
2215         if (discov->state == DISCOVERY_STOPPING)
2216                 goto discov_complete;
2217
2218         if (discov->state != DISCOVERY_RESOLVING)
2219                 return;
2220
2221         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2222         /* If the device was not found in a list of found devices names of which
2223          * are pending. there is no need to continue resolving a next name as it
2224          * will be done upon receiving another Remote Name Request Complete
2225          * Event */
2226         if (!e)
2227                 return;
2228
2229         list_del(&e->list);
2230         if (name) {
2231                 e->name_state = NAME_KNOWN;
2232                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2233                                  e->data.rssi, name, name_len);
2234         } else {
2235                 e->name_state = NAME_NOT_KNOWN;
2236         }
2237
2238         if (hci_resolve_next_name(hdev))
2239                 return;
2240
2241 discov_complete:
2242         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2243 }
2244
2245 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2246 {
2247         struct hci_cp_remote_name_req *cp;
2248         struct hci_conn *conn;
2249
2250         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2251
2252         /* If successful wait for the name req complete event before
2253          * checking for the need to do authentication */
2254         if (!status)
2255                 return;
2256
2257         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2258         if (!cp)
2259                 return;
2260
2261         hci_dev_lock(hdev);
2262
2263         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2264
2265         if (hci_dev_test_flag(hdev, HCI_MGMT))
2266                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2267
2268         if (!conn)
2269                 goto unlock;
2270
2271         if (!hci_outgoing_auth_needed(hdev, conn))
2272                 goto unlock;
2273
2274         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2275                 struct hci_cp_auth_requested auth_cp;
2276
2277                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2278
2279                 auth_cp.handle = __cpu_to_le16(conn->handle);
2280                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2281                              sizeof(auth_cp), &auth_cp);
2282         }
2283
2284 unlock:
2285         hci_dev_unlock(hdev);
2286 }
2287
2288 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2289 {
2290         struct hci_cp_read_remote_features *cp;
2291         struct hci_conn *conn;
2292
2293         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2294
2295         if (!status)
2296                 return;
2297
2298         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2299         if (!cp)
2300                 return;
2301
2302         hci_dev_lock(hdev);
2303
2304         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2305         if (conn) {
2306                 if (conn->state == BT_CONFIG) {
2307                         hci_connect_cfm(conn, status);
2308                         hci_conn_drop(conn);
2309                 }
2310         }
2311
2312         hci_dev_unlock(hdev);
2313 }
2314
2315 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2316 {
2317         struct hci_cp_read_remote_ext_features *cp;
2318         struct hci_conn *conn;
2319
2320         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2321
2322         if (!status)
2323                 return;
2324
2325         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2326         if (!cp)
2327                 return;
2328
2329         hci_dev_lock(hdev);
2330
2331         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2332         if (conn) {
2333                 if (conn->state == BT_CONFIG) {
2334                         hci_connect_cfm(conn, status);
2335                         hci_conn_drop(conn);
2336                 }
2337         }
2338
2339         hci_dev_unlock(hdev);
2340 }
2341
2342 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2343 {
2344         struct hci_cp_setup_sync_conn *cp;
2345         struct hci_conn *acl, *sco;
2346         __u16 handle;
2347
2348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2349
2350         if (!status)
2351                 return;
2352
2353         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2354         if (!cp)
2355                 return;
2356
2357         handle = __le16_to_cpu(cp->handle);
2358
2359         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2360
2361         hci_dev_lock(hdev);
2362
2363         acl = hci_conn_hash_lookup_handle(hdev, handle);
2364         if (acl) {
2365                 sco = acl->link;
2366                 if (sco) {
2367                         sco->state = BT_CLOSED;
2368
2369                         hci_connect_cfm(sco, status);
2370                         hci_conn_del(sco);
2371                 }
2372         }
2373
2374         hci_dev_unlock(hdev);
2375 }
2376
2377 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2378 {
2379         struct hci_cp_sniff_mode *cp;
2380         struct hci_conn *conn;
2381
2382         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2383
2384         if (!status)
2385                 return;
2386
2387         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2388         if (!cp)
2389                 return;
2390
2391         hci_dev_lock(hdev);
2392
2393         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2394         if (conn) {
2395                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2396
2397                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2398                         hci_sco_setup(conn, status);
2399         }
2400
2401         hci_dev_unlock(hdev);
2402 }
2403
2404 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2405 {
2406         struct hci_cp_exit_sniff_mode *cp;
2407         struct hci_conn *conn;
2408
2409         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2410
2411         if (!status)
2412                 return;
2413
2414         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2415         if (!cp)
2416                 return;
2417
2418         hci_dev_lock(hdev);
2419
2420         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2421         if (conn) {
2422                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2423
2424                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2425                         hci_sco_setup(conn, status);
2426         }
2427
2428         hci_dev_unlock(hdev);
2429 }
2430
2431 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2432 {
2433         struct hci_cp_disconnect *cp;
2434         struct hci_conn *conn;
2435
2436         if (!status)
2437                 return;
2438
2439         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2440         if (!cp)
2441                 return;
2442
2443         hci_dev_lock(hdev);
2444
2445         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2446         if (conn) {
2447                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2448                                        conn->dst_type, status);
2449
2450                 if (conn->type == LE_LINK) {
2451                         hdev->cur_adv_instance = conn->adv_instance;
2452                         hci_req_reenable_advertising(hdev);
2453                 }
2454
2455                 /* If the disconnection failed for any reason, the upper layer
2456                  * does not retry to disconnect in current implementation.
2457                  * Hence, we need to do some basic cleanup here and re-enable
2458                  * advertising if necessary.
2459                  */
2460                 hci_conn_del(conn);
2461         }
2462
2463         hci_dev_unlock(hdev);
2464 }
2465
2466 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2467                               u8 peer_addr_type, u8 own_address_type,
2468                               u8 filter_policy)
2469 {
2470         struct hci_conn *conn;
2471
2472         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2473                                        peer_addr_type);
2474         if (!conn)
2475                 return;
2476
2477         /* When using controller based address resolution, then the new
2478          * address types 0x02 and 0x03 are used. These types need to be
2479          * converted back into either public address or random address type
2480          */
2481         if (use_ll_privacy(hdev) &&
2482             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2483                 switch (own_address_type) {
2484                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2485                         own_address_type = ADDR_LE_DEV_PUBLIC;
2486                         break;
2487                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2488                         own_address_type = ADDR_LE_DEV_RANDOM;
2489                         break;
2490                 }
2491         }
2492
2493         /* Store the initiator and responder address information which
2494          * is needed for SMP. These values will not change during the
2495          * lifetime of the connection.
2496          */
2497         conn->init_addr_type = own_address_type;
2498         if (own_address_type == ADDR_LE_DEV_RANDOM)
2499                 bacpy(&conn->init_addr, &hdev->random_addr);
2500         else
2501                 bacpy(&conn->init_addr, &hdev->bdaddr);
2502
2503         conn->resp_addr_type = peer_addr_type;
2504         bacpy(&conn->resp_addr, peer_addr);
2505
2506         /* We don't want the connection attempt to stick around
2507          * indefinitely since LE doesn't have a page timeout concept
2508          * like BR/EDR. Set a timer for any connection that doesn't use
2509          * the accept list for connecting.
2510          */
2511         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2512                 queue_delayed_work(conn->hdev->workqueue,
2513                                    &conn->le_conn_timeout,
2514                                    conn->conn_timeout);
2515 }
2516
2517 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2518 {
2519         struct hci_cp_le_create_conn *cp;
2520
2521         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2522
2523         /* All connection failure handling is taken care of by the
2524          * hci_le_conn_failed function which is triggered by the HCI
2525          * request completion callbacks used for connecting.
2526          */
2527         if (status)
2528                 return;
2529
2530         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2531         if (!cp)
2532                 return;
2533
2534         hci_dev_lock(hdev);
2535
2536         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2537                           cp->own_address_type, cp->filter_policy);
2538
2539         hci_dev_unlock(hdev);
2540 }
2541
2542 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2543 {
2544         struct hci_cp_le_ext_create_conn *cp;
2545
2546         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2547
2548         /* All connection failure handling is taken care of by the
2549          * hci_le_conn_failed function which is triggered by the HCI
2550          * request completion callbacks used for connecting.
2551          */
2552         if (status)
2553                 return;
2554
2555         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2556         if (!cp)
2557                 return;
2558
2559         hci_dev_lock(hdev);
2560
2561         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2562                           cp->own_addr_type, cp->filter_policy);
2563
2564         hci_dev_unlock(hdev);
2565 }
2566
2567 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2568 {
2569         struct hci_cp_le_read_remote_features *cp;
2570         struct hci_conn *conn;
2571
2572         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2573
2574         if (!status)
2575                 return;
2576
2577         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2578         if (!cp)
2579                 return;
2580
2581         hci_dev_lock(hdev);
2582
2583         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2584         if (conn) {
2585                 if (conn->state == BT_CONFIG) {
2586                         hci_connect_cfm(conn, status);
2587                         hci_conn_drop(conn);
2588                 }
2589         }
2590
2591         hci_dev_unlock(hdev);
2592 }
2593
2594 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2595 {
2596         struct hci_cp_le_start_enc *cp;
2597         struct hci_conn *conn;
2598
2599         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2600
2601         if (!status)
2602                 return;
2603
2604         hci_dev_lock(hdev);
2605
2606         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2607         if (!cp)
2608                 goto unlock;
2609
2610         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2611         if (!conn)
2612                 goto unlock;
2613
2614         if (conn->state != BT_CONNECTED)
2615                 goto unlock;
2616
2617         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2618         hci_conn_drop(conn);
2619
2620 unlock:
2621         hci_dev_unlock(hdev);
2622 }
2623
2624 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2625 {
2626         struct hci_cp_switch_role *cp;
2627         struct hci_conn *conn;
2628
2629         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2630
2631         if (!status)
2632                 return;
2633
2634         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2635         if (!cp)
2636                 return;
2637
2638         hci_dev_lock(hdev);
2639
2640         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2641         if (conn)
2642                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2643
2644         hci_dev_unlock(hdev);
2645 }
2646
2647 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2648 {
2649         __u8 status = *((__u8 *) skb->data);
2650         struct discovery_state *discov = &hdev->discovery;
2651         struct inquiry_entry *e;
2652
2653         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2654
2655         hci_conn_check_pending(hdev);
2656
2657         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2658                 return;
2659
2660         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2661         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2662
2663         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2664                 return;
2665
2666         hci_dev_lock(hdev);
2667
2668         if (discov->state != DISCOVERY_FINDING)
2669                 goto unlock;
2670
2671         if (list_empty(&discov->resolve)) {
2672                 /* When BR/EDR inquiry is active and no LE scanning is in
2673                  * progress, then change discovery state to indicate completion.
2674                  *
2675                  * When running LE scanning and BR/EDR inquiry simultaneously
2676                  * and the LE scan already finished, then change the discovery
2677                  * state to indicate completion.
2678                  */
2679                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2680                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2681                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2682                 goto unlock;
2683         }
2684
2685         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2686         if (e && hci_resolve_name(hdev, e) == 0) {
2687                 e->name_state = NAME_PENDING;
2688                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2689         } else {
2690                 /* When BR/EDR inquiry is active and no LE scanning is in
2691                  * progress, then change discovery state to indicate completion.
2692                  *
2693                  * When running LE scanning and BR/EDR inquiry simultaneously
2694                  * and the LE scan already finished, then change the discovery
2695                  * state to indicate completion.
2696                  */
2697                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2698                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2699                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2700         }
2701
2702 unlock:
2703         hci_dev_unlock(hdev);
2704 }
2705
2706 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2707 {
2708         struct inquiry_data data;
2709         struct inquiry_info *info = (void *) (skb->data + 1);
2710         int num_rsp = *((__u8 *) skb->data);
2711
2712         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2713
2714         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2715                 return;
2716
2717         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2718                 return;
2719
2720         hci_dev_lock(hdev);
2721
2722         for (; num_rsp; num_rsp--, info++) {
2723                 u32 flags;
2724
2725                 bacpy(&data.bdaddr, &info->bdaddr);
2726                 data.pscan_rep_mode     = info->pscan_rep_mode;
2727                 data.pscan_period_mode  = info->pscan_period_mode;
2728                 data.pscan_mode         = info->pscan_mode;
2729                 memcpy(data.dev_class, info->dev_class, 3);
2730                 data.clock_offset       = info->clock_offset;
2731                 data.rssi               = HCI_RSSI_INVALID;
2732                 data.ssp_mode           = 0x00;
2733
2734                 flags = hci_inquiry_cache_update(hdev, &data, false);
2735
2736                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2737                                   info->dev_class, HCI_RSSI_INVALID,
2738                                   flags, NULL, 0, NULL, 0);
2739         }
2740
2741         hci_dev_unlock(hdev);
2742 }
2743
2744 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2745 {
2746         struct hci_ev_conn_complete *ev = (void *) skb->data;
2747         struct hci_conn *conn;
2748
2749         BT_DBG("%s", hdev->name);
2750
2751         hci_dev_lock(hdev);
2752
2753         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2754         if (!conn) {
2755                 /* Connection may not exist if auto-connected. Check the bredr
2756                  * allowlist to see if this device is allowed to auto connect.
2757                  * If link is an ACL type, create a connection class
2758                  * automatically.
2759                  *
2760                  * Auto-connect will only occur if the event filter is
2761                  * programmed with a given address. Right now, event filter is
2762                  * only used during suspend.
2763                  */
2764                 if (ev->link_type == ACL_LINK &&
2765                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2766                                                       &ev->bdaddr,
2767                                                       BDADDR_BREDR)) {
2768                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2769                                             HCI_ROLE_SLAVE);
2770                         if (!conn) {
2771                                 bt_dev_err(hdev, "no memory for new conn");
2772                                 goto unlock;
2773                         }
2774                 } else {
2775                         if (ev->link_type != SCO_LINK)
2776                                 goto unlock;
2777
2778                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2779                                                        &ev->bdaddr);
2780                         if (!conn)
2781                                 goto unlock;
2782
2783                         conn->type = SCO_LINK;
2784                 }
2785         }
2786
2787         if (!ev->status) {
2788                 conn->handle = __le16_to_cpu(ev->handle);
2789
2790                 if (conn->type == ACL_LINK) {
2791                         conn->state = BT_CONFIG;
2792                         hci_conn_hold(conn);
2793
2794                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2795                             !hci_find_link_key(hdev, &ev->bdaddr))
2796                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2797                         else
2798                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2799                 } else
2800                         conn->state = BT_CONNECTED;
2801
2802                 hci_debugfs_create_conn(conn);
2803                 hci_conn_add_sysfs(conn);
2804
2805                 if (test_bit(HCI_AUTH, &hdev->flags))
2806                         set_bit(HCI_CONN_AUTH, &conn->flags);
2807
2808                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2809                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2810
2811                 /* Get remote features */
2812                 if (conn->type == ACL_LINK) {
2813                         struct hci_cp_read_remote_features cp;
2814                         cp.handle = ev->handle;
2815                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2816                                      sizeof(cp), &cp);
2817
2818                         hci_req_update_scan(hdev);
2819                 }
2820
2821                 /* Set packet type for incoming connection */
2822                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2823                         struct hci_cp_change_conn_ptype cp;
2824                         cp.handle = ev->handle;
2825                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2826                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2827                                      &cp);
2828                 }
2829         } else {
2830                 conn->state = BT_CLOSED;
2831                 if (conn->type == ACL_LINK)
2832                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2833                                             conn->dst_type, ev->status);
2834         }
2835
2836         if (conn->type == ACL_LINK)
2837                 hci_sco_setup(conn, ev->status);
2838
2839         if (ev->status) {
2840                 hci_connect_cfm(conn, ev->status);
2841                 hci_conn_del(conn);
2842         } else if (ev->link_type == SCO_LINK) {
2843                 switch (conn->setting & SCO_AIRMODE_MASK) {
2844                 case SCO_AIRMODE_CVSD:
2845                         if (hdev->notify)
2846                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2847                         break;
2848                 }
2849
2850                 hci_connect_cfm(conn, ev->status);
2851         }
2852
2853 unlock:
2854         hci_dev_unlock(hdev);
2855
2856         hci_conn_check_pending(hdev);
2857 }
2858
2859 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2860 {
2861         struct hci_cp_reject_conn_req cp;
2862
2863         bacpy(&cp.bdaddr, bdaddr);
2864         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2865         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2866 }
2867
2868 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2869 {
2870         struct hci_ev_conn_request *ev = (void *) skb->data;
2871         int mask = hdev->link_mode;
2872         struct inquiry_entry *ie;
2873         struct hci_conn *conn;
2874         __u8 flags = 0;
2875
2876         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2877                ev->link_type);
2878
2879         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2880                                       &flags);
2881
2882         if (!(mask & HCI_LM_ACCEPT)) {
2883                 hci_reject_conn(hdev, &ev->bdaddr);
2884                 return;
2885         }
2886
2887         hci_dev_lock(hdev);
2888
2889         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2890                                    BDADDR_BREDR)) {
2891                 hci_reject_conn(hdev, &ev->bdaddr);
2892                 goto unlock;
2893         }
2894
2895         /* Require HCI_CONNECTABLE or an accept list entry to accept the
2896          * connection. These features are only touched through mgmt so
2897          * only do the checks if HCI_MGMT is set.
2898          */
2899         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2900             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2901             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2902                                                BDADDR_BREDR)) {
2903                 hci_reject_conn(hdev, &ev->bdaddr);
2904                 goto unlock;
2905         }
2906
2907         /* Connection accepted */
2908
2909         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2910         if (ie)
2911                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2912
2913         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2914                         &ev->bdaddr);
2915         if (!conn) {
2916                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2917                                     HCI_ROLE_SLAVE);
2918                 if (!conn) {
2919                         bt_dev_err(hdev, "no memory for new connection");
2920                         goto unlock;
2921                 }
2922         }
2923
2924         memcpy(conn->dev_class, ev->dev_class, 3);
2925
2926         hci_dev_unlock(hdev);
2927
2928         if (ev->link_type == ACL_LINK ||
2929             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2930                 struct hci_cp_accept_conn_req cp;
2931                 conn->state = BT_CONNECT;
2932
2933                 bacpy(&cp.bdaddr, &ev->bdaddr);
2934
2935                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2936                         cp.role = 0x00; /* Become central */
2937                 else
2938                         cp.role = 0x01; /* Remain peripheral */
2939
2940                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2941         } else if (!(flags & HCI_PROTO_DEFER)) {
2942                 struct hci_cp_accept_sync_conn_req cp;
2943                 conn->state = BT_CONNECT;
2944
2945                 bacpy(&cp.bdaddr, &ev->bdaddr);
2946                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2947
2948                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2949                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2950                 cp.max_latency    = cpu_to_le16(0xffff);
2951                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2952                 cp.retrans_effort = 0xff;
2953
2954                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2955                              &cp);
2956         } else {
2957                 conn->state = BT_CONNECT2;
2958                 hci_connect_cfm(conn, 0);
2959         }
2960
2961         return;
2962 unlock:
2963         hci_dev_unlock(hdev);
2964 }
2965
2966 static u8 hci_to_mgmt_reason(u8 err)
2967 {
2968         switch (err) {
2969         case HCI_ERROR_CONNECTION_TIMEOUT:
2970                 return MGMT_DEV_DISCONN_TIMEOUT;
2971         case HCI_ERROR_REMOTE_USER_TERM:
2972         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2973         case HCI_ERROR_REMOTE_POWER_OFF:
2974                 return MGMT_DEV_DISCONN_REMOTE;
2975         case HCI_ERROR_LOCAL_HOST_TERM:
2976                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2977         default:
2978                 return MGMT_DEV_DISCONN_UNKNOWN;
2979         }
2980 }
2981
2982 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2983 {
2984         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2985         u8 reason;
2986         struct hci_conn_params *params;
2987         struct hci_conn *conn;
2988         bool mgmt_connected;
2989
2990         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2991
2992         hci_dev_lock(hdev);
2993
2994         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2995         if (!conn)
2996                 goto unlock;
2997
2998         if (ev->status) {
2999                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3000                                        conn->dst_type, ev->status);
3001                 goto unlock;
3002         }
3003
3004         conn->state = BT_CLOSED;
3005
3006         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3007
3008         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3009                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3010         else
3011                 reason = hci_to_mgmt_reason(ev->reason);
3012
3013         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3014                                 reason, mgmt_connected);
3015
3016         if (conn->type == ACL_LINK) {
3017                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3018                         hci_remove_link_key(hdev, &conn->dst);
3019
3020                 hci_req_update_scan(hdev);
3021         }
3022
3023         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3024         if (params) {
3025                 switch (params->auto_connect) {
3026                 case HCI_AUTO_CONN_LINK_LOSS:
3027                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3028                                 break;
3029                         fallthrough;
3030
3031                 case HCI_AUTO_CONN_DIRECT:
3032                 case HCI_AUTO_CONN_ALWAYS:
3033                         list_del_init(&params->action);
3034                         list_add(&params->action, &hdev->pend_le_conns);
3035                         hci_update_background_scan(hdev);
3036                         break;
3037
3038                 default:
3039                         break;
3040                 }
3041         }
3042
3043         hci_disconn_cfm(conn, ev->reason);
3044
3045         /* The suspend notifier is waiting for all devices to disconnect so
3046          * clear the bit from pending tasks and inform the wait queue.
3047          */
3048         if (list_empty(&hdev->conn_hash.list) &&
3049             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
3050                 wake_up(&hdev->suspend_wait_q);
3051         }
3052
3053         /* Re-enable advertising if necessary, since it might
3054          * have been disabled by the connection. From the
3055          * HCI_LE_Set_Advertise_Enable command description in
3056          * the core specification (v4.0):
3057          * "The Controller shall continue advertising until the Host
3058          * issues an LE_Set_Advertise_Enable command with
3059          * Advertising_Enable set to 0x00 (Advertising is disabled)
3060          * or until a connection is created or until the Advertising
3061          * is timed out due to Directed Advertising."
3062          */
3063         if (conn->type == LE_LINK) {
3064                 hdev->cur_adv_instance = conn->adv_instance;
3065                 hci_req_reenable_advertising(hdev);
3066         }
3067
3068         hci_conn_del(conn);
3069
3070 unlock:
3071         hci_dev_unlock(hdev);
3072 }
3073
3074 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3075 {
3076         struct hci_ev_auth_complete *ev = (void *) skb->data;
3077         struct hci_conn *conn;
3078
3079         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3080
3081         hci_dev_lock(hdev);
3082
3083         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3084         if (!conn)
3085                 goto unlock;
3086
3087         if (!ev->status) {
3088                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3089
3090                 if (!hci_conn_ssp_enabled(conn) &&
3091                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3092                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3093                 } else {
3094                         set_bit(HCI_CONN_AUTH, &conn->flags);
3095                         conn->sec_level = conn->pending_sec_level;
3096                 }
3097         } else {
3098                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3099                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3100
3101                 mgmt_auth_failed(conn, ev->status);
3102         }
3103
3104         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3105         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3106
3107         if (conn->state == BT_CONFIG) {
3108                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3109                         struct hci_cp_set_conn_encrypt cp;
3110                         cp.handle  = ev->handle;
3111                         cp.encrypt = 0x01;
3112                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3113                                      &cp);
3114                 } else {
3115                         conn->state = BT_CONNECTED;
3116                         hci_connect_cfm(conn, ev->status);
3117                         hci_conn_drop(conn);
3118                 }
3119         } else {
3120                 hci_auth_cfm(conn, ev->status);
3121
3122                 hci_conn_hold(conn);
3123                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3124                 hci_conn_drop(conn);
3125         }
3126
3127         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3128                 if (!ev->status) {
3129                         struct hci_cp_set_conn_encrypt cp;
3130                         cp.handle  = ev->handle;
3131                         cp.encrypt = 0x01;
3132                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3133                                      &cp);
3134                 } else {
3135                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3136                         hci_encrypt_cfm(conn, ev->status);
3137                 }
3138         }
3139
3140 unlock:
3141         hci_dev_unlock(hdev);
3142 }
3143
3144 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3145 {
3146         struct hci_ev_remote_name *ev = (void *) skb->data;
3147         struct hci_conn *conn;
3148
3149         BT_DBG("%s", hdev->name);
3150
3151         hci_conn_check_pending(hdev);
3152
3153         hci_dev_lock(hdev);
3154
3155         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3156
3157         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3158                 goto check_auth;
3159
3160         if (ev->status == 0)
3161                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3162                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3163         else
3164                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3165
3166 check_auth:
3167         if (!conn)
3168                 goto unlock;
3169
3170         if (!hci_outgoing_auth_needed(hdev, conn))
3171                 goto unlock;
3172
3173         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3174                 struct hci_cp_auth_requested cp;
3175
3176                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3177
3178                 cp.handle = __cpu_to_le16(conn->handle);
3179                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3180         }
3181
3182 unlock:
3183         hci_dev_unlock(hdev);
3184 }
3185
3186 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3187                                        u16 opcode, struct sk_buff *skb)
3188 {
3189         const struct hci_rp_read_enc_key_size *rp;
3190         struct hci_conn *conn;
3191         u16 handle;
3192
3193         BT_DBG("%s status 0x%02x", hdev->name, status);
3194
3195         if (!skb || skb->len < sizeof(*rp)) {
3196                 bt_dev_err(hdev, "invalid read key size response");
3197                 return;
3198         }
3199
3200         rp = (void *)skb->data;
3201         handle = le16_to_cpu(rp->handle);
3202
3203         hci_dev_lock(hdev);
3204
3205         conn = hci_conn_hash_lookup_handle(hdev, handle);
3206         if (!conn)
3207                 goto unlock;
3208
3209         /* While unexpected, the read_enc_key_size command may fail. The most
3210          * secure approach is to then assume the key size is 0 to force a
3211          * disconnection.
3212          */
3213         if (rp->status) {
3214                 bt_dev_err(hdev, "failed to read key size for handle %u",
3215                            handle);
3216                 conn->enc_key_size = 0;
3217         } else {
3218                 conn->enc_key_size = rp->key_size;
3219         }
3220
3221         hci_encrypt_cfm(conn, 0);
3222
3223 unlock:
3224         hci_dev_unlock(hdev);
3225 }
3226
3227 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3228 {
3229         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3230         struct hci_conn *conn;
3231
3232         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3233
3234         hci_dev_lock(hdev);
3235
3236         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3237         if (!conn)
3238                 goto unlock;
3239
3240         if (!ev->status) {
3241                 if (ev->encrypt) {
3242                         /* Encryption implies authentication */
3243                         set_bit(HCI_CONN_AUTH, &conn->flags);
3244                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3245                         conn->sec_level = conn->pending_sec_level;
3246
3247                         /* P-256 authentication key implies FIPS */
3248                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3249                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3250
3251                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3252                             conn->type == LE_LINK)
3253                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3254                 } else {
3255                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3256                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3257                 }
3258         }
3259
3260         /* We should disregard the current RPA and generate a new one
3261          * whenever the encryption procedure fails.
3262          */
3263         if (ev->status && conn->type == LE_LINK) {
3264                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3265                 hci_adv_instances_set_rpa_expired(hdev, true);
3266         }
3267
3268         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3269
3270         /* Check link security requirements are met */
3271         if (!hci_conn_check_link_mode(conn))
3272                 ev->status = HCI_ERROR_AUTH_FAILURE;
3273
3274         if (ev->status && conn->state == BT_CONNECTED) {
3275                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3276                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3277
3278                 /* Notify upper layers so they can cleanup before
3279                  * disconnecting.
3280                  */
3281                 hci_encrypt_cfm(conn, ev->status);
3282                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3283                 hci_conn_drop(conn);
3284                 goto unlock;
3285         }
3286
3287         /* Try reading the encryption key size for encrypted ACL links */
3288         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3289                 struct hci_cp_read_enc_key_size cp;
3290                 struct hci_request req;
3291
3292                 /* Only send HCI_Read_Encryption_Key_Size if the
3293                  * controller really supports it. If it doesn't, assume
3294                  * the default size (16).
3295                  */
3296                 if (!(hdev->commands[20] & 0x10)) {
3297                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3298                         goto notify;
3299                 }
3300
3301                 hci_req_init(&req, hdev);
3302
3303                 cp.handle = cpu_to_le16(conn->handle);
3304                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3305
3306                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3307                         bt_dev_err(hdev, "sending read key size failed");
3308                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3309                         goto notify;
3310                 }
3311
3312                 goto unlock;
3313         }
3314
3315         /* Set the default Authenticated Payload Timeout after
3316          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3317          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3318          * sent when the link is active and Encryption is enabled, the conn
3319          * type can be either LE or ACL and controller must support LMP Ping.
3320          * Ensure for AES-CCM encryption as well.
3321          */
3322         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3323             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3324             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3325              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3326                 struct hci_cp_write_auth_payload_to cp;
3327
3328                 cp.handle = cpu_to_le16(conn->handle);
3329                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3330                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3331                              sizeof(cp), &cp);
3332         }
3333
3334 notify:
3335         hci_encrypt_cfm(conn, ev->status);
3336
3337 unlock:
3338         hci_dev_unlock(hdev);
3339 }
3340
3341 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3342                                              struct sk_buff *skb)
3343 {
3344         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3345         struct hci_conn *conn;
3346
3347         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3348
3349         hci_dev_lock(hdev);
3350
3351         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3352         if (conn) {
3353                 if (!ev->status)
3354                         set_bit(HCI_CONN_SECURE, &conn->flags);
3355
3356                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3357
3358                 hci_key_change_cfm(conn, ev->status);
3359         }
3360
3361         hci_dev_unlock(hdev);
3362 }
3363
3364 static void hci_remote_features_evt(struct hci_dev *hdev,
3365                                     struct sk_buff *skb)
3366 {
3367         struct hci_ev_remote_features *ev = (void *) skb->data;
3368         struct hci_conn *conn;
3369
3370         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3371
3372         hci_dev_lock(hdev);
3373
3374         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3375         if (!conn)
3376                 goto unlock;
3377
3378         if (!ev->status)
3379                 memcpy(conn->features[0], ev->features, 8);
3380
3381         if (conn->state != BT_CONFIG)
3382                 goto unlock;
3383
3384         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3385             lmp_ext_feat_capable(conn)) {
3386                 struct hci_cp_read_remote_ext_features cp;
3387                 cp.handle = ev->handle;
3388                 cp.page = 0x01;
3389                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3390                              sizeof(cp), &cp);
3391                 goto unlock;
3392         }
3393
3394         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3395                 struct hci_cp_remote_name_req cp;
3396                 memset(&cp, 0, sizeof(cp));
3397                 bacpy(&cp.bdaddr, &conn->dst);
3398                 cp.pscan_rep_mode = 0x02;
3399                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3400         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3401                 mgmt_device_connected(hdev, conn, NULL, 0);
3402
3403         if (!hci_outgoing_auth_needed(hdev, conn)) {
3404                 conn->state = BT_CONNECTED;
3405                 hci_connect_cfm(conn, ev->status);
3406                 hci_conn_drop(conn);
3407         }
3408
3409 unlock:
3410         hci_dev_unlock(hdev);
3411 }
3412
3413 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3414 {
3415         cancel_delayed_work(&hdev->cmd_timer);
3416
3417         if (!test_bit(HCI_RESET, &hdev->flags)) {
3418                 if (ncmd) {
3419                         cancel_delayed_work(&hdev->ncmd_timer);
3420                         atomic_set(&hdev->cmd_cnt, 1);
3421                 } else {
3422                         schedule_delayed_work(&hdev->ncmd_timer,
3423                                               HCI_NCMD_TIMEOUT);
3424                 }
3425         }
3426 }
3427
3428 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3429                                  u16 *opcode, u8 *status,
3430                                  hci_req_complete_t *req_complete,
3431                                  hci_req_complete_skb_t *req_complete_skb)
3432 {
3433         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3434
3435         *opcode = __le16_to_cpu(ev->opcode);
3436         *status = skb->data[sizeof(*ev)];
3437
3438         skb_pull(skb, sizeof(*ev));
3439
3440         switch (*opcode) {
3441         case HCI_OP_INQUIRY_CANCEL:
3442                 hci_cc_inquiry_cancel(hdev, skb, status);
3443                 break;
3444
3445         case HCI_OP_PERIODIC_INQ:
3446                 hci_cc_periodic_inq(hdev, skb);
3447                 break;
3448
3449         case HCI_OP_EXIT_PERIODIC_INQ:
3450                 hci_cc_exit_periodic_inq(hdev, skb);
3451                 break;
3452
3453         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3454                 hci_cc_remote_name_req_cancel(hdev, skb);
3455                 break;
3456
3457         case HCI_OP_ROLE_DISCOVERY:
3458                 hci_cc_role_discovery(hdev, skb);
3459                 break;
3460
3461         case HCI_OP_READ_LINK_POLICY:
3462                 hci_cc_read_link_policy(hdev, skb);
3463                 break;
3464
3465         case HCI_OP_WRITE_LINK_POLICY:
3466                 hci_cc_write_link_policy(hdev, skb);
3467                 break;
3468
3469         case HCI_OP_READ_DEF_LINK_POLICY:
3470                 hci_cc_read_def_link_policy(hdev, skb);
3471                 break;
3472
3473         case HCI_OP_WRITE_DEF_LINK_POLICY:
3474                 hci_cc_write_def_link_policy(hdev, skb);
3475                 break;
3476
3477         case HCI_OP_RESET:
3478                 hci_cc_reset(hdev, skb);
3479                 break;
3480
3481         case HCI_OP_READ_STORED_LINK_KEY:
3482                 hci_cc_read_stored_link_key(hdev, skb);
3483                 break;
3484
3485         case HCI_OP_DELETE_STORED_LINK_KEY:
3486                 hci_cc_delete_stored_link_key(hdev, skb);
3487                 break;
3488
3489         case HCI_OP_WRITE_LOCAL_NAME:
3490                 hci_cc_write_local_name(hdev, skb);
3491                 break;
3492
3493         case HCI_OP_READ_LOCAL_NAME:
3494                 hci_cc_read_local_name(hdev, skb);
3495                 break;
3496
3497         case HCI_OP_WRITE_AUTH_ENABLE:
3498                 hci_cc_write_auth_enable(hdev, skb);
3499                 break;
3500
3501         case HCI_OP_WRITE_ENCRYPT_MODE:
3502                 hci_cc_write_encrypt_mode(hdev, skb);
3503                 break;
3504
3505         case HCI_OP_WRITE_SCAN_ENABLE:
3506                 hci_cc_write_scan_enable(hdev, skb);
3507                 break;
3508
3509         case HCI_OP_SET_EVENT_FLT:
3510                 hci_cc_set_event_filter(hdev, skb);
3511                 break;
3512
3513         case HCI_OP_READ_CLASS_OF_DEV:
3514                 hci_cc_read_class_of_dev(hdev, skb);
3515                 break;
3516
3517         case HCI_OP_WRITE_CLASS_OF_DEV:
3518                 hci_cc_write_class_of_dev(hdev, skb);
3519                 break;
3520
3521         case HCI_OP_READ_VOICE_SETTING:
3522                 hci_cc_read_voice_setting(hdev, skb);
3523                 break;
3524
3525         case HCI_OP_WRITE_VOICE_SETTING:
3526                 hci_cc_write_voice_setting(hdev, skb);
3527                 break;
3528
3529         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3530                 hci_cc_read_num_supported_iac(hdev, skb);
3531                 break;
3532
3533         case HCI_OP_WRITE_SSP_MODE:
3534                 hci_cc_write_ssp_mode(hdev, skb);
3535                 break;
3536
3537         case HCI_OP_WRITE_SC_SUPPORT:
3538                 hci_cc_write_sc_support(hdev, skb);
3539                 break;
3540
3541         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3542                 hci_cc_read_auth_payload_timeout(hdev, skb);
3543                 break;
3544
3545         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3546                 hci_cc_write_auth_payload_timeout(hdev, skb);
3547                 break;
3548
3549         case HCI_OP_READ_LOCAL_VERSION:
3550                 hci_cc_read_local_version(hdev, skb);
3551                 break;
3552
3553         case HCI_OP_READ_LOCAL_COMMANDS:
3554                 hci_cc_read_local_commands(hdev, skb);
3555                 break;
3556
3557         case HCI_OP_READ_LOCAL_FEATURES:
3558                 hci_cc_read_local_features(hdev, skb);
3559                 break;
3560
3561         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3562                 hci_cc_read_local_ext_features(hdev, skb);
3563                 break;
3564
3565         case HCI_OP_READ_BUFFER_SIZE:
3566                 hci_cc_read_buffer_size(hdev, skb);
3567                 break;
3568
3569         case HCI_OP_READ_BD_ADDR:
3570                 hci_cc_read_bd_addr(hdev, skb);
3571                 break;
3572
3573         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3574                 hci_cc_read_local_pairing_opts(hdev, skb);
3575                 break;
3576
3577         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3578                 hci_cc_read_page_scan_activity(hdev, skb);
3579                 break;
3580
3581         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3582                 hci_cc_write_page_scan_activity(hdev, skb);
3583                 break;
3584
3585         case HCI_OP_READ_PAGE_SCAN_TYPE:
3586                 hci_cc_read_page_scan_type(hdev, skb);
3587                 break;
3588
3589         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3590                 hci_cc_write_page_scan_type(hdev, skb);
3591                 break;
3592
3593         case HCI_OP_READ_DATA_BLOCK_SIZE:
3594                 hci_cc_read_data_block_size(hdev, skb);
3595                 break;
3596
3597         case HCI_OP_READ_FLOW_CONTROL_MODE:
3598                 hci_cc_read_flow_control_mode(hdev, skb);
3599                 break;
3600
3601         case HCI_OP_READ_LOCAL_AMP_INFO:
3602                 hci_cc_read_local_amp_info(hdev, skb);
3603                 break;
3604
3605         case HCI_OP_READ_CLOCK:
3606                 hci_cc_read_clock(hdev, skb);
3607                 break;
3608
3609         case HCI_OP_READ_INQ_RSP_TX_POWER:
3610                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3611                 break;
3612
3613         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3614                 hci_cc_read_def_err_data_reporting(hdev, skb);
3615                 break;
3616
3617         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3618                 hci_cc_write_def_err_data_reporting(hdev, skb);
3619                 break;
3620
3621         case HCI_OP_PIN_CODE_REPLY:
3622                 hci_cc_pin_code_reply(hdev, skb);
3623                 break;
3624
3625         case HCI_OP_PIN_CODE_NEG_REPLY:
3626                 hci_cc_pin_code_neg_reply(hdev, skb);
3627                 break;
3628
3629         case HCI_OP_READ_LOCAL_OOB_DATA:
3630                 hci_cc_read_local_oob_data(hdev, skb);
3631                 break;
3632
3633         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3634                 hci_cc_read_local_oob_ext_data(hdev, skb);
3635                 break;
3636
3637         case HCI_OP_LE_READ_BUFFER_SIZE:
3638                 hci_cc_le_read_buffer_size(hdev, skb);
3639                 break;
3640
3641         case HCI_OP_LE_READ_LOCAL_FEATURES:
3642                 hci_cc_le_read_local_features(hdev, skb);
3643                 break;
3644
3645         case HCI_OP_LE_READ_ADV_TX_POWER:
3646                 hci_cc_le_read_adv_tx_power(hdev, skb);
3647                 break;
3648
3649         case HCI_OP_USER_CONFIRM_REPLY:
3650                 hci_cc_user_confirm_reply(hdev, skb);
3651                 break;
3652
3653         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3654                 hci_cc_user_confirm_neg_reply(hdev, skb);
3655                 break;
3656
3657         case HCI_OP_USER_PASSKEY_REPLY:
3658                 hci_cc_user_passkey_reply(hdev, skb);
3659                 break;
3660
3661         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3662                 hci_cc_user_passkey_neg_reply(hdev, skb);
3663                 break;
3664
3665         case HCI_OP_LE_SET_RANDOM_ADDR:
3666                 hci_cc_le_set_random_addr(hdev, skb);
3667                 break;
3668
3669         case HCI_OP_LE_SET_ADV_ENABLE:
3670                 hci_cc_le_set_adv_enable(hdev, skb);
3671                 break;
3672
3673         case HCI_OP_LE_SET_SCAN_PARAM:
3674                 hci_cc_le_set_scan_param(hdev, skb);
3675                 break;
3676
3677         case HCI_OP_LE_SET_SCAN_ENABLE:
3678                 hci_cc_le_set_scan_enable(hdev, skb);
3679                 break;
3680
3681         case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3682                 hci_cc_le_read_accept_list_size(hdev, skb);
3683                 break;
3684
3685         case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3686                 hci_cc_le_clear_accept_list(hdev, skb);
3687                 break;
3688
3689         case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3690                 hci_cc_le_add_to_accept_list(hdev, skb);
3691                 break;
3692
3693         case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3694                 hci_cc_le_del_from_accept_list(hdev, skb);
3695                 break;
3696
3697         case HCI_OP_LE_READ_SUPPORTED_STATES:
3698                 hci_cc_le_read_supported_states(hdev, skb);
3699                 break;
3700
3701         case HCI_OP_LE_READ_DEF_DATA_LEN:
3702                 hci_cc_le_read_def_data_len(hdev, skb);
3703                 break;
3704
3705         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3706                 hci_cc_le_write_def_data_len(hdev, skb);
3707                 break;
3708
3709         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3710                 hci_cc_le_add_to_resolv_list(hdev, skb);
3711                 break;
3712
3713         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3714                 hci_cc_le_del_from_resolv_list(hdev, skb);
3715                 break;
3716
3717         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3718                 hci_cc_le_clear_resolv_list(hdev, skb);
3719                 break;
3720
3721         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3722                 hci_cc_le_read_resolv_list_size(hdev, skb);
3723                 break;
3724
3725         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3726                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3727                 break;
3728
3729         case HCI_OP_LE_READ_MAX_DATA_LEN:
3730                 hci_cc_le_read_max_data_len(hdev, skb);
3731                 break;
3732
3733         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3734                 hci_cc_write_le_host_supported(hdev, skb);
3735                 break;
3736
3737         case HCI_OP_LE_SET_ADV_PARAM:
3738                 hci_cc_set_adv_param(hdev, skb);
3739                 break;
3740
3741         case HCI_OP_READ_RSSI:
3742                 hci_cc_read_rssi(hdev, skb);
3743                 break;
3744
3745         case HCI_OP_READ_TX_POWER:
3746                 hci_cc_read_tx_power(hdev, skb);
3747                 break;
3748
3749         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3750                 hci_cc_write_ssp_debug_mode(hdev, skb);
3751                 break;
3752
3753         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3754                 hci_cc_le_set_ext_scan_param(hdev, skb);
3755                 break;
3756
3757         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3758                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3759                 break;
3760
3761         case HCI_OP_LE_SET_DEFAULT_PHY:
3762                 hci_cc_le_set_default_phy(hdev, skb);
3763                 break;
3764
3765         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3766                 hci_cc_le_read_num_adv_sets(hdev, skb);
3767                 break;
3768
3769         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3770                 hci_cc_set_ext_adv_param(hdev, skb);
3771                 break;
3772
3773         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3774                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3775                 break;
3776
3777         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3778                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3779                 break;
3780
3781         case HCI_OP_LE_READ_TRANSMIT_POWER:
3782                 hci_cc_le_read_transmit_power(hdev, skb);
3783                 break;
3784 #ifdef TIZEN_BT
3785         case HCI_OP_ENABLE_RSSI:
3786                 hci_cc_enable_rssi(hdev, skb);
3787                 break;
3788
3789         case HCI_OP_GET_RAW_RSSI:
3790                 hci_cc_get_raw_rssi(hdev, skb);
3791                 break;
3792 #endif
3793         default:
3794                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3795                 break;
3796         }
3797
3798         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3799
3800         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3801                              req_complete_skb);
3802
3803         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3804                 bt_dev_err(hdev,
3805                            "unexpected event for opcode 0x%4.4x", *opcode);
3806                 return;
3807         }
3808
3809         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3810                 queue_work(hdev->workqueue, &hdev->cmd_work);
3811 }
3812
3813 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3814                                u16 *opcode, u8 *status,
3815                                hci_req_complete_t *req_complete,
3816                                hci_req_complete_skb_t *req_complete_skb)
3817 {
3818         struct hci_ev_cmd_status *ev = (void *) skb->data;
3819
3820         skb_pull(skb, sizeof(*ev));
3821
3822         *opcode = __le16_to_cpu(ev->opcode);
3823         *status = ev->status;
3824
3825         switch (*opcode) {
3826         case HCI_OP_INQUIRY:
3827                 hci_cs_inquiry(hdev, ev->status);
3828                 break;
3829
3830         case HCI_OP_CREATE_CONN:
3831                 hci_cs_create_conn(hdev, ev->status);
3832                 break;
3833
3834         case HCI_OP_DISCONNECT:
3835                 hci_cs_disconnect(hdev, ev->status);
3836                 break;
3837
3838         case HCI_OP_ADD_SCO:
3839                 hci_cs_add_sco(hdev, ev->status);
3840                 break;
3841
3842         case HCI_OP_AUTH_REQUESTED:
3843                 hci_cs_auth_requested(hdev, ev->status);
3844                 break;
3845
3846         case HCI_OP_SET_CONN_ENCRYPT:
3847                 hci_cs_set_conn_encrypt(hdev, ev->status);
3848                 break;
3849
3850         case HCI_OP_REMOTE_NAME_REQ:
3851                 hci_cs_remote_name_req(hdev, ev->status);
3852                 break;
3853
3854         case HCI_OP_READ_REMOTE_FEATURES:
3855                 hci_cs_read_remote_features(hdev, ev->status);
3856                 break;
3857
3858         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3859                 hci_cs_read_remote_ext_features(hdev, ev->status);
3860                 break;
3861
3862         case HCI_OP_SETUP_SYNC_CONN:
3863                 hci_cs_setup_sync_conn(hdev, ev->status);
3864                 break;
3865
3866         case HCI_OP_SNIFF_MODE:
3867                 hci_cs_sniff_mode(hdev, ev->status);
3868                 break;
3869
3870         case HCI_OP_EXIT_SNIFF_MODE:
3871                 hci_cs_exit_sniff_mode(hdev, ev->status);
3872                 break;
3873
3874         case HCI_OP_SWITCH_ROLE:
3875                 hci_cs_switch_role(hdev, ev->status);
3876                 break;
3877
3878         case HCI_OP_LE_CREATE_CONN:
3879                 hci_cs_le_create_conn(hdev, ev->status);
3880                 break;
3881
3882         case HCI_OP_LE_READ_REMOTE_FEATURES:
3883                 hci_cs_le_read_remote_features(hdev, ev->status);
3884                 break;
3885
3886         case HCI_OP_LE_START_ENC:
3887                 hci_cs_le_start_enc(hdev, ev->status);
3888                 break;
3889
3890         case HCI_OP_LE_EXT_CREATE_CONN:
3891                 hci_cs_le_ext_create_conn(hdev, ev->status);
3892                 break;
3893
3894         default:
3895                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3896                 break;
3897         }
3898
3899         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3900
3901         /* Indicate request completion if the command failed. Also, if
3902          * we're not waiting for a special event and we get a success
3903          * command status we should try to flag the request as completed
3904          * (since for this kind of commands there will not be a command
3905          * complete event).
3906          */
3907         if (ev->status ||
3908             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3909                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3910                                      req_complete_skb);
3911
3912         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3913                 bt_dev_err(hdev,
3914                            "unexpected event for opcode 0x%4.4x", *opcode);
3915                 return;
3916         }
3917
3918         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3919                 queue_work(hdev->workqueue, &hdev->cmd_work);
3920 }
3921
3922 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3923 {
3924         struct hci_ev_hardware_error *ev = (void *) skb->data;
3925
3926 #ifdef TIZEN_BT
3927         hci_dev_lock(hdev);
3928         mgmt_hardware_error(hdev, ev->code);
3929         hci_dev_unlock(hdev);
3930 #endif
3931         hdev->hw_error_code = ev->code;
3932
3933         queue_work(hdev->req_workqueue, &hdev->error_reset);
3934 }
3935
3936 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3937 {
3938         struct hci_ev_role_change *ev = (void *) skb->data;
3939         struct hci_conn *conn;
3940
3941         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3942
3943         hci_dev_lock(hdev);
3944
3945         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3946         if (conn) {
3947                 if (!ev->status)
3948                         conn->role = ev->role;
3949
3950                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3951
3952                 hci_role_switch_cfm(conn, ev->status, ev->role);
3953         }
3954
3955         hci_dev_unlock(hdev);
3956 }
3957
3958 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3959 {
3960         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3961         int i;
3962
3963         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3964                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3965                 return;
3966         }
3967
3968         if (skb->len < sizeof(*ev) ||
3969             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3970                 BT_DBG("%s bad parameters", hdev->name);
3971                 return;
3972         }
3973
3974         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3975
3976         for (i = 0; i < ev->num_hndl; i++) {
3977                 struct hci_comp_pkts_info *info = &ev->handles[i];
3978                 struct hci_conn *conn;
3979                 __u16  handle, count;
3980
3981                 handle = __le16_to_cpu(info->handle);
3982                 count  = __le16_to_cpu(info->count);
3983
3984                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3985                 if (!conn)
3986                         continue;
3987
3988                 conn->sent -= count;
3989
3990                 switch (conn->type) {
3991                 case ACL_LINK:
3992                         hdev->acl_cnt += count;
3993                         if (hdev->acl_cnt > hdev->acl_pkts)
3994                                 hdev->acl_cnt = hdev->acl_pkts;
3995                         break;
3996
3997                 case LE_LINK:
3998                         if (hdev->le_pkts) {
3999                                 hdev->le_cnt += count;
4000                                 if (hdev->le_cnt > hdev->le_pkts)
4001                                         hdev->le_cnt = hdev->le_pkts;
4002                         } else {
4003                                 hdev->acl_cnt += count;
4004                                 if (hdev->acl_cnt > hdev->acl_pkts)
4005                                         hdev->acl_cnt = hdev->acl_pkts;
4006                         }
4007                         break;
4008
4009                 case SCO_LINK:
4010                         hdev->sco_cnt += count;
4011                         if (hdev->sco_cnt > hdev->sco_pkts)
4012                                 hdev->sco_cnt = hdev->sco_pkts;
4013                         break;
4014
4015                 default:
4016                         bt_dev_err(hdev, "unknown type %d conn %p",
4017                                    conn->type, conn);
4018                         break;
4019                 }
4020         }
4021
4022         queue_work(hdev->workqueue, &hdev->tx_work);
4023 }
4024
4025 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4026                                                  __u16 handle)
4027 {
4028         struct hci_chan *chan;
4029
4030         switch (hdev->dev_type) {
4031         case HCI_PRIMARY:
4032                 return hci_conn_hash_lookup_handle(hdev, handle);
4033         case HCI_AMP:
4034                 chan = hci_chan_lookup_handle(hdev, handle);
4035                 if (chan)
4036                         return chan->conn;
4037                 break;
4038         default:
4039                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4040                 break;
4041         }
4042
4043         return NULL;
4044 }
4045
4046 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
4047 {
4048         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
4049         int i;
4050
4051         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4052                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4053                 return;
4054         }
4055
4056         if (skb->len < sizeof(*ev) ||
4057             skb->len < struct_size(ev, handles, ev->num_hndl)) {
4058                 BT_DBG("%s bad parameters", hdev->name);
4059                 return;
4060         }
4061
4062         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
4063                ev->num_hndl);
4064
4065         for (i = 0; i < ev->num_hndl; i++) {
4066                 struct hci_comp_blocks_info *info = &ev->handles[i];
4067                 struct hci_conn *conn = NULL;
4068                 __u16  handle, block_count;
4069
4070                 handle = __le16_to_cpu(info->handle);
4071                 block_count = __le16_to_cpu(info->blocks);
4072
4073                 conn = __hci_conn_lookup_handle(hdev, handle);
4074                 if (!conn)
4075                         continue;
4076
4077                 conn->sent -= block_count;
4078
4079                 switch (conn->type) {
4080                 case ACL_LINK:
4081                 case AMP_LINK:
4082                         hdev->block_cnt += block_count;
4083                         if (hdev->block_cnt > hdev->num_blocks)
4084                                 hdev->block_cnt = hdev->num_blocks;
4085                         break;
4086
4087                 default:
4088                         bt_dev_err(hdev, "unknown type %d conn %p",
4089                                    conn->type, conn);
4090                         break;
4091                 }
4092         }
4093
4094         queue_work(hdev->workqueue, &hdev->tx_work);
4095 }
4096
4097 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4098 {
4099         struct hci_ev_mode_change *ev = (void *) skb->data;
4100         struct hci_conn *conn;
4101
4102         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4103
4104         hci_dev_lock(hdev);
4105
4106         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4107         if (conn) {
4108                 conn->mode = ev->mode;
4109
4110                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4111                                         &conn->flags)) {
4112                         if (conn->mode == HCI_CM_ACTIVE)
4113                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4114                         else
4115                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4116                 }
4117
4118                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4119                         hci_sco_setup(conn, ev->status);
4120         }
4121
4122         hci_dev_unlock(hdev);
4123 }
4124
4125 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4126 {
4127         struct hci_ev_pin_code_req *ev = (void *) skb->data;
4128         struct hci_conn *conn;
4129
4130         BT_DBG("%s", hdev->name);
4131
4132         hci_dev_lock(hdev);
4133
4134         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4135         if (!conn)
4136                 goto unlock;
4137
4138         if (conn->state == BT_CONNECTED) {
4139                 hci_conn_hold(conn);
4140                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4141                 hci_conn_drop(conn);
4142         }
4143
4144         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4145             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4146                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4147                              sizeof(ev->bdaddr), &ev->bdaddr);
4148         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4149                 u8 secure;
4150
4151                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4152                         secure = 1;
4153                 else
4154                         secure = 0;
4155
4156                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4157         }
4158
4159 unlock:
4160         hci_dev_unlock(hdev);
4161 }
4162
4163 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4164 {
4165         if (key_type == HCI_LK_CHANGED_COMBINATION)
4166                 return;
4167
4168         conn->pin_length = pin_len;
4169         conn->key_type = key_type;
4170
4171         switch (key_type) {
4172         case HCI_LK_LOCAL_UNIT:
4173         case HCI_LK_REMOTE_UNIT:
4174         case HCI_LK_DEBUG_COMBINATION:
4175                 return;
4176         case HCI_LK_COMBINATION:
4177                 if (pin_len == 16)
4178                         conn->pending_sec_level = BT_SECURITY_HIGH;
4179                 else
4180                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4181                 break;
4182         case HCI_LK_UNAUTH_COMBINATION_P192:
4183         case HCI_LK_UNAUTH_COMBINATION_P256:
4184                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4185                 break;
4186         case HCI_LK_AUTH_COMBINATION_P192:
4187                 conn->pending_sec_level = BT_SECURITY_HIGH;
4188                 break;
4189         case HCI_LK_AUTH_COMBINATION_P256:
4190                 conn->pending_sec_level = BT_SECURITY_FIPS;
4191                 break;
4192         }
4193 }
4194
4195 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4196 {
4197         struct hci_ev_link_key_req *ev = (void *) skb->data;
4198         struct hci_cp_link_key_reply cp;
4199         struct hci_conn *conn;
4200         struct link_key *key;
4201
4202         BT_DBG("%s", hdev->name);
4203
4204         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4205                 return;
4206
4207         hci_dev_lock(hdev);
4208
4209         key = hci_find_link_key(hdev, &ev->bdaddr);
4210         if (!key) {
4211                 BT_DBG("%s link key not found for %pMR", hdev->name,
4212                        &ev->bdaddr);
4213                 goto not_found;
4214         }
4215
4216         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4217                &ev->bdaddr);
4218
4219         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4220         if (conn) {
4221                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4222
4223                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4224                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4225                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4226                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4227                         goto not_found;
4228                 }
4229
4230                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4231                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4232                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4233                         BT_DBG("%s ignoring key unauthenticated for high security",
4234                                hdev->name);
4235                         goto not_found;
4236                 }
4237
4238                 conn_set_key(conn, key->type, key->pin_len);
4239         }
4240
4241         bacpy(&cp.bdaddr, &ev->bdaddr);
4242         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4243
4244         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4245
4246         hci_dev_unlock(hdev);
4247
4248         return;
4249
4250 not_found:
4251         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4252         hci_dev_unlock(hdev);
4253 }
4254
4255 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4256 {
4257         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4258         struct hci_conn *conn;
4259         struct link_key *key;
4260         bool persistent;
4261         u8 pin_len = 0;
4262
4263         BT_DBG("%s", hdev->name);
4264
4265         hci_dev_lock(hdev);
4266
4267         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4268         if (!conn)
4269                 goto unlock;
4270
4271         hci_conn_hold(conn);
4272         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4273         hci_conn_drop(conn);
4274
4275         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4276         conn_set_key(conn, ev->key_type, conn->pin_length);
4277
4278         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4279                 goto unlock;
4280
4281         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4282                                 ev->key_type, pin_len, &persistent);
4283         if (!key)
4284                 goto unlock;
4285
4286         /* Update connection information since adding the key will have
4287          * fixed up the type in the case of changed combination keys.
4288          */
4289         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4290                 conn_set_key(conn, key->type, key->pin_len);
4291
4292         mgmt_new_link_key(hdev, key, persistent);
4293
4294         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4295          * is set. If it's not set simply remove the key from the kernel
4296          * list (we've still notified user space about it but with
4297          * store_hint being 0).
4298          */
4299         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4300             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4301                 list_del_rcu(&key->list);
4302                 kfree_rcu(key, rcu);
4303                 goto unlock;
4304         }
4305
4306         if (persistent)
4307                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4308         else
4309                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4310
4311 unlock:
4312         hci_dev_unlock(hdev);
4313 }
4314
4315 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4316 {
4317         struct hci_ev_clock_offset *ev = (void *) skb->data;
4318         struct hci_conn *conn;
4319
4320         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4321
4322         hci_dev_lock(hdev);
4323
4324         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4325         if (conn && !ev->status) {
4326                 struct inquiry_entry *ie;
4327
4328                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4329                 if (ie) {
4330                         ie->data.clock_offset = ev->clock_offset;
4331                         ie->timestamp = jiffies;
4332                 }
4333         }
4334
4335         hci_dev_unlock(hdev);
4336 }
4337
4338 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4339 {
4340         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4341         struct hci_conn *conn;
4342
4343         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4344
4345         hci_dev_lock(hdev);
4346
4347         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4348         if (conn && !ev->status)
4349                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4350
4351         hci_dev_unlock(hdev);
4352 }
4353
4354 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4355 {
4356         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4357         struct inquiry_entry *ie;
4358
4359         BT_DBG("%s", hdev->name);
4360
4361         hci_dev_lock(hdev);
4362
4363         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4364         if (ie) {
4365                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4366                 ie->timestamp = jiffies;
4367         }
4368
4369         hci_dev_unlock(hdev);
4370 }
4371
4372 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4373                                              struct sk_buff *skb)
4374 {
4375         struct inquiry_data data;
4376         int num_rsp = *((__u8 *) skb->data);
4377
4378         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4379
4380         if (!num_rsp)
4381                 return;
4382
4383         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4384                 return;
4385
4386         hci_dev_lock(hdev);
4387
4388         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4389                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4390                 info = (void *) (skb->data + 1);
4391
4392                 if (skb->len < num_rsp * sizeof(*info) + 1)
4393                         goto unlock;
4394
4395                 for (; num_rsp; num_rsp--, info++) {
4396                         u32 flags;
4397
4398                         bacpy(&data.bdaddr, &info->bdaddr);
4399                         data.pscan_rep_mode     = info->pscan_rep_mode;
4400                         data.pscan_period_mode  = info->pscan_period_mode;
4401                         data.pscan_mode         = info->pscan_mode;
4402                         memcpy(data.dev_class, info->dev_class, 3);
4403                         data.clock_offset       = info->clock_offset;
4404                         data.rssi               = info->rssi;
4405                         data.ssp_mode           = 0x00;
4406
4407                         flags = hci_inquiry_cache_update(hdev, &data, false);
4408
4409                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4410                                           info->dev_class, info->rssi,
4411                                           flags, NULL, 0, NULL, 0);
4412                 }
4413         } else {
4414                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4415
4416                 if (skb->len < num_rsp * sizeof(*info) + 1)
4417                         goto unlock;
4418
4419                 for (; num_rsp; num_rsp--, info++) {
4420                         u32 flags;
4421
4422                         bacpy(&data.bdaddr, &info->bdaddr);
4423                         data.pscan_rep_mode     = info->pscan_rep_mode;
4424                         data.pscan_period_mode  = info->pscan_period_mode;
4425                         data.pscan_mode         = 0x00;
4426                         memcpy(data.dev_class, info->dev_class, 3);
4427                         data.clock_offset       = info->clock_offset;
4428                         data.rssi               = info->rssi;
4429                         data.ssp_mode           = 0x00;
4430
4431                         flags = hci_inquiry_cache_update(hdev, &data, false);
4432
4433                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4434                                           info->dev_class, info->rssi,
4435                                           flags, NULL, 0, NULL, 0);
4436                 }
4437         }
4438
4439 unlock:
4440         hci_dev_unlock(hdev);
4441 }
4442
4443 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4444                                         struct sk_buff *skb)
4445 {
4446         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4447         struct hci_conn *conn;
4448
4449         BT_DBG("%s", hdev->name);
4450
4451         hci_dev_lock(hdev);
4452
4453         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4454         if (!conn)
4455                 goto unlock;
4456
4457         if (ev->page < HCI_MAX_PAGES)
4458                 memcpy(conn->features[ev->page], ev->features, 8);
4459
4460         if (!ev->status && ev->page == 0x01) {
4461                 struct inquiry_entry *ie;
4462
4463                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4464                 if (ie)
4465                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4466
4467                 if (ev->features[0] & LMP_HOST_SSP) {
4468                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4469                 } else {
4470                         /* It is mandatory by the Bluetooth specification that
4471                          * Extended Inquiry Results are only used when Secure
4472                          * Simple Pairing is enabled, but some devices violate
4473                          * this.
4474                          *
4475                          * To make these devices work, the internal SSP
4476                          * enabled flag needs to be cleared if the remote host
4477                          * features do not indicate SSP support */
4478                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4479                 }
4480
4481                 if (ev->features[0] & LMP_HOST_SC)
4482                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4483         }
4484
4485         if (conn->state != BT_CONFIG)
4486                 goto unlock;
4487
4488         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4489                 struct hci_cp_remote_name_req cp;
4490                 memset(&cp, 0, sizeof(cp));
4491                 bacpy(&cp.bdaddr, &conn->dst);
4492                 cp.pscan_rep_mode = 0x02;
4493                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4494         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4495                 mgmt_device_connected(hdev, conn, NULL, 0);
4496
4497         if (!hci_outgoing_auth_needed(hdev, conn)) {
4498                 conn->state = BT_CONNECTED;
4499                 hci_connect_cfm(conn, ev->status);
4500                 hci_conn_drop(conn);
4501         }
4502
4503 unlock:
4504         hci_dev_unlock(hdev);
4505 }
4506
4507 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4508                                        struct sk_buff *skb)
4509 {
4510         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4511         struct hci_conn *conn;
4512
4513         switch (ev->link_type) {
4514         case SCO_LINK:
4515         case ESCO_LINK:
4516                 break;
4517         default:
4518                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
4519                  * for HCI_Synchronous_Connection_Complete is limited to
4520                  * either SCO or eSCO
4521                  */
4522                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
4523                 return;
4524         }
4525
4526         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4527
4528         hci_dev_lock(hdev);
4529
4530         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4531         if (!conn) {
4532                 if (ev->link_type == ESCO_LINK)
4533                         goto unlock;
4534
4535                 /* When the link type in the event indicates SCO connection
4536                  * and lookup of the connection object fails, then check
4537                  * if an eSCO connection object exists.
4538                  *
4539                  * The core limits the synchronous connections to either
4540                  * SCO or eSCO. The eSCO connection is preferred and tried
4541                  * to be setup first and until successfully established,
4542                  * the link type will be hinted as eSCO.
4543                  */
4544                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4545                 if (!conn)
4546                         goto unlock;
4547         }
4548
4549         switch (ev->status) {
4550         case 0x00:
4551                 /* The synchronous connection complete event should only be
4552                  * sent once per new connection. Receiving a successful
4553                  * complete event when the connection status is already
4554                  * BT_CONNECTED means that the device is misbehaving and sent
4555                  * multiple complete event packets for the same new connection.
4556                  *
4557                  * Registering the device more than once can corrupt kernel
4558                  * memory, hence upon detecting this invalid event, we report
4559                  * an error and ignore the packet.
4560                  */
4561                 if (conn->state == BT_CONNECTED) {
4562                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4563                         goto unlock;
4564                 }
4565
4566                 conn->handle = __le16_to_cpu(ev->handle);
4567                 conn->state  = BT_CONNECTED;
4568                 conn->type   = ev->link_type;
4569
4570                 hci_debugfs_create_conn(conn);
4571                 hci_conn_add_sysfs(conn);
4572                 break;
4573
4574         case 0x10:      /* Connection Accept Timeout */
4575         case 0x0d:      /* Connection Rejected due to Limited Resources */
4576         case 0x11:      /* Unsupported Feature or Parameter Value */
4577         case 0x1c:      /* SCO interval rejected */
4578         case 0x1a:      /* Unsupported Remote Feature */
4579         case 0x1e:      /* Invalid LMP Parameters */
4580         case 0x1f:      /* Unspecified error */
4581         case 0x20:      /* Unsupported LMP Parameter value */
4582                 if (conn->out) {
4583                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4584                                         (hdev->esco_type & EDR_ESCO_MASK);
4585                         if (hci_setup_sync(conn, conn->link->handle))
4586                                 goto unlock;
4587                 }
4588                 fallthrough;
4589
4590         default:
4591                 conn->state = BT_CLOSED;
4592                 break;
4593         }
4594
4595         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4596
4597         switch (ev->air_mode) {
4598         case 0x02:
4599                 if (hdev->notify)
4600                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4601                 break;
4602         case 0x03:
4603                 if (hdev->notify)
4604                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4605                 break;
4606         }
4607
4608         hci_connect_cfm(conn, ev->status);
4609         if (ev->status)
4610                 hci_conn_del(conn);
4611
4612 unlock:
4613         hci_dev_unlock(hdev);
4614 }
4615
4616 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4617 {
4618         size_t parsed = 0;
4619
4620         while (parsed < eir_len) {
4621                 u8 field_len = eir[0];
4622
4623                 if (field_len == 0)
4624                         return parsed;
4625
4626                 parsed += field_len + 1;
4627                 eir += field_len + 1;
4628         }
4629
4630         return eir_len;
4631 }
4632
4633 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4634                                             struct sk_buff *skb)
4635 {
4636         struct inquiry_data data;
4637         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4638         int num_rsp = *((__u8 *) skb->data);
4639         size_t eir_len;
4640
4641         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4642
4643         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4644                 return;
4645
4646         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4647                 return;
4648
4649         hci_dev_lock(hdev);
4650
4651         for (; num_rsp; num_rsp--, info++) {
4652                 u32 flags;
4653                 bool name_known;
4654
4655                 bacpy(&data.bdaddr, &info->bdaddr);
4656                 data.pscan_rep_mode     = info->pscan_rep_mode;
4657                 data.pscan_period_mode  = info->pscan_period_mode;
4658                 data.pscan_mode         = 0x00;
4659                 memcpy(data.dev_class, info->dev_class, 3);
4660                 data.clock_offset       = info->clock_offset;
4661                 data.rssi               = info->rssi;
4662                 data.ssp_mode           = 0x01;
4663
4664                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4665                         name_known = eir_get_data(info->data,
4666                                                   sizeof(info->data),
4667                                                   EIR_NAME_COMPLETE, NULL);
4668                 else
4669                         name_known = true;
4670
4671                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4672
4673                 eir_len = eir_get_length(info->data, sizeof(info->data));
4674
4675                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4676                                   info->dev_class, info->rssi,
4677                                   flags, info->data, eir_len, NULL, 0);
4678         }
4679
4680         hci_dev_unlock(hdev);
4681 }
4682
4683 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4684                                          struct sk_buff *skb)
4685 {
4686         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4687         struct hci_conn *conn;
4688
4689         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4690                __le16_to_cpu(ev->handle));
4691
4692         hci_dev_lock(hdev);
4693
4694         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4695         if (!conn)
4696                 goto unlock;
4697
4698         /* For BR/EDR the necessary steps are taken through the
4699          * auth_complete event.
4700          */
4701         if (conn->type != LE_LINK)
4702                 goto unlock;
4703
4704         if (!ev->status)
4705                 conn->sec_level = conn->pending_sec_level;
4706
4707         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4708
4709         if (ev->status && conn->state == BT_CONNECTED) {
4710                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4711                 hci_conn_drop(conn);
4712                 goto unlock;
4713         }
4714
4715         if (conn->state == BT_CONFIG) {
4716                 if (!ev->status)
4717                         conn->state = BT_CONNECTED;
4718
4719                 hci_connect_cfm(conn, ev->status);
4720                 hci_conn_drop(conn);
4721         } else {
4722                 hci_auth_cfm(conn, ev->status);
4723
4724                 hci_conn_hold(conn);
4725                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4726                 hci_conn_drop(conn);
4727         }
4728
4729 unlock:
4730         hci_dev_unlock(hdev);
4731 }
4732
4733 static u8 hci_get_auth_req(struct hci_conn *conn)
4734 {
4735         /* If remote requests no-bonding follow that lead */
4736         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4737             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4738                 return conn->remote_auth | (conn->auth_type & 0x01);
4739
4740         /* If both remote and local have enough IO capabilities, require
4741          * MITM protection
4742          */
4743         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4744             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4745                 return conn->remote_auth | 0x01;
4746
4747         /* No MITM protection possible so ignore remote requirement */
4748         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4749 }
4750
4751 static u8 bredr_oob_data_present(struct hci_conn *conn)
4752 {
4753         struct hci_dev *hdev = conn->hdev;
4754         struct oob_data *data;
4755
4756         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4757         if (!data)
4758                 return 0x00;
4759
4760         if (bredr_sc_enabled(hdev)) {
4761                 /* When Secure Connections is enabled, then just
4762                  * return the present value stored with the OOB
4763                  * data. The stored value contains the right present
4764                  * information. However it can only be trusted when
4765                  * not in Secure Connection Only mode.
4766                  */
4767                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4768                         return data->present;
4769
4770                 /* When Secure Connections Only mode is enabled, then
4771                  * the P-256 values are required. If they are not
4772                  * available, then do not declare that OOB data is
4773                  * present.
4774                  */
4775                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4776                     !memcmp(data->hash256, ZERO_KEY, 16))
4777                         return 0x00;
4778
4779                 return 0x02;
4780         }
4781
4782         /* When Secure Connections is not enabled or actually
4783          * not supported by the hardware, then check that if
4784          * P-192 data values are present.
4785          */
4786         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4787             !memcmp(data->hash192, ZERO_KEY, 16))
4788                 return 0x00;
4789
4790         return 0x01;
4791 }
4792
4793 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4794 {
4795         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4796         struct hci_conn *conn;
4797
4798         BT_DBG("%s", hdev->name);
4799
4800         hci_dev_lock(hdev);
4801
4802         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4803         if (!conn)
4804                 goto unlock;
4805
4806         hci_conn_hold(conn);
4807
4808         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4809                 goto unlock;
4810
4811         /* Allow pairing if we're pairable, the initiators of the
4812          * pairing or if the remote is not requesting bonding.
4813          */
4814         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4815             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4816             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4817                 struct hci_cp_io_capability_reply cp;
4818
4819                 bacpy(&cp.bdaddr, &ev->bdaddr);
4820                 /* Change the IO capability from KeyboardDisplay
4821                  * to DisplayYesNo as it is not supported by BT spec. */
4822                 cp.capability = (conn->io_capability == 0x04) ?
4823                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4824
4825                 /* If we are initiators, there is no remote information yet */
4826                 if (conn->remote_auth == 0xff) {
4827                         /* Request MITM protection if our IO caps allow it
4828                          * except for the no-bonding case.
4829                          */
4830                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4831                             conn->auth_type != HCI_AT_NO_BONDING)
4832                                 conn->auth_type |= 0x01;
4833                 } else {
4834                         conn->auth_type = hci_get_auth_req(conn);
4835                 }
4836
4837                 /* If we're not bondable, force one of the non-bondable
4838                  * authentication requirement values.
4839                  */
4840                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4841                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4842
4843                 cp.authentication = conn->auth_type;
4844                 cp.oob_data = bredr_oob_data_present(conn);
4845
4846                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4847                              sizeof(cp), &cp);
4848         } else {
4849                 struct hci_cp_io_capability_neg_reply cp;
4850
4851                 bacpy(&cp.bdaddr, &ev->bdaddr);
4852                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4853
4854                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4855                              sizeof(cp), &cp);
4856         }
4857
4858 unlock:
4859         hci_dev_unlock(hdev);
4860 }
4861
4862 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4863 {
4864         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4865         struct hci_conn *conn;
4866
4867         BT_DBG("%s", hdev->name);
4868
4869         hci_dev_lock(hdev);
4870
4871         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4872         if (!conn)
4873                 goto unlock;
4874
4875         conn->remote_cap = ev->capability;
4876         conn->remote_auth = ev->authentication;
4877
4878 unlock:
4879         hci_dev_unlock(hdev);
4880 }
4881
4882 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4883                                          struct sk_buff *skb)
4884 {
4885         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4886         int loc_mitm, rem_mitm, confirm_hint = 0;
4887         struct hci_conn *conn;
4888
4889         BT_DBG("%s", hdev->name);
4890
4891         hci_dev_lock(hdev);
4892
4893         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4894                 goto unlock;
4895
4896         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4897         if (!conn)
4898                 goto unlock;
4899
4900         loc_mitm = (conn->auth_type & 0x01);
4901         rem_mitm = (conn->remote_auth & 0x01);
4902
4903         /* If we require MITM but the remote device can't provide that
4904          * (it has NoInputNoOutput) then reject the confirmation
4905          * request. We check the security level here since it doesn't
4906          * necessarily match conn->auth_type.
4907          */
4908         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4909             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4910                 BT_DBG("Rejecting request: remote device can't provide MITM");
4911                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4912                              sizeof(ev->bdaddr), &ev->bdaddr);
4913                 goto unlock;
4914         }
4915
4916         /* If no side requires MITM protection; auto-accept */
4917         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4918             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4919
4920                 /* If we're not the initiators request authorization to
4921                  * proceed from user space (mgmt_user_confirm with
4922                  * confirm_hint set to 1). The exception is if neither
4923                  * side had MITM or if the local IO capability is
4924                  * NoInputNoOutput, in which case we do auto-accept
4925                  */
4926                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4927                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4928                     (loc_mitm || rem_mitm)) {
4929                         BT_DBG("Confirming auto-accept as acceptor");
4930                         confirm_hint = 1;
4931                         goto confirm;
4932                 }
4933
4934                 /* If there already exists link key in local host, leave the
4935                  * decision to user space since the remote device could be
4936                  * legitimate or malicious.
4937                  */
4938                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4939                         bt_dev_dbg(hdev, "Local host already has link key");
4940                         confirm_hint = 1;
4941                         goto confirm;
4942                 }
4943
4944                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4945                        hdev->auto_accept_delay);
4946
4947                 if (hdev->auto_accept_delay > 0) {
4948                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4949                         queue_delayed_work(conn->hdev->workqueue,
4950                                            &conn->auto_accept_work, delay);
4951                         goto unlock;
4952                 }
4953
4954                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4955                              sizeof(ev->bdaddr), &ev->bdaddr);
4956                 goto unlock;
4957         }
4958
4959 confirm:
4960         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4961                                   le32_to_cpu(ev->passkey), confirm_hint);
4962
4963 unlock:
4964         hci_dev_unlock(hdev);
4965 }
4966
4967 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4968                                          struct sk_buff *skb)
4969 {
4970         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4971
4972         BT_DBG("%s", hdev->name);
4973
4974         if (hci_dev_test_flag(hdev, HCI_MGMT))
4975                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4976 }
4977
4978 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4979                                         struct sk_buff *skb)
4980 {
4981         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4982         struct hci_conn *conn;
4983
4984         BT_DBG("%s", hdev->name);
4985
4986         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4987         if (!conn)
4988                 return;
4989
4990         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4991         conn->passkey_entered = 0;
4992
4993         if (hci_dev_test_flag(hdev, HCI_MGMT))
4994                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4995                                          conn->dst_type, conn->passkey_notify,
4996                                          conn->passkey_entered);
4997 }
4998
4999 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
5000 {
5001         struct hci_ev_keypress_notify *ev = (void *) skb->data;
5002         struct hci_conn *conn;
5003
5004         BT_DBG("%s", hdev->name);
5005
5006         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5007         if (!conn)
5008                 return;
5009
5010         switch (ev->type) {
5011         case HCI_KEYPRESS_STARTED:
5012                 conn->passkey_entered = 0;
5013                 return;
5014
5015         case HCI_KEYPRESS_ENTERED:
5016                 conn->passkey_entered++;
5017                 break;
5018
5019         case HCI_KEYPRESS_ERASED:
5020                 conn->passkey_entered--;
5021                 break;
5022
5023         case HCI_KEYPRESS_CLEARED:
5024                 conn->passkey_entered = 0;
5025                 break;
5026
5027         case HCI_KEYPRESS_COMPLETED:
5028                 return;
5029         }
5030
5031         if (hci_dev_test_flag(hdev, HCI_MGMT))
5032                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5033                                          conn->dst_type, conn->passkey_notify,
5034                                          conn->passkey_entered);
5035 }
5036
5037 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
5038                                          struct sk_buff *skb)
5039 {
5040         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
5041         struct hci_conn *conn;
5042
5043         BT_DBG("%s", hdev->name);
5044
5045         hci_dev_lock(hdev);
5046
5047         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5048         if (!conn)
5049                 goto unlock;
5050
5051         /* Reset the authentication requirement to unknown */
5052         conn->remote_auth = 0xff;
5053
5054         /* To avoid duplicate auth_failed events to user space we check
5055          * the HCI_CONN_AUTH_PEND flag which will be set if we
5056          * initiated the authentication. A traditional auth_complete
5057          * event gets always produced as initiator and is also mapped to
5058          * the mgmt_auth_failed event */
5059         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5060                 mgmt_auth_failed(conn, ev->status);
5061
5062         hci_conn_drop(conn);
5063
5064 unlock:
5065         hci_dev_unlock(hdev);
5066 }
5067
5068 static void hci_remote_host_features_evt(struct hci_dev *hdev,
5069                                          struct sk_buff *skb)
5070 {
5071         struct hci_ev_remote_host_features *ev = (void *) skb->data;
5072         struct inquiry_entry *ie;
5073         struct hci_conn *conn;
5074
5075         BT_DBG("%s", hdev->name);
5076
5077         hci_dev_lock(hdev);
5078
5079         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5080         if (conn)
5081                 memcpy(conn->features[1], ev->features, 8);
5082
5083         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5084         if (ie)
5085                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5086
5087         hci_dev_unlock(hdev);
5088 }
5089
5090 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
5091                                             struct sk_buff *skb)
5092 {
5093         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
5094         struct oob_data *data;
5095
5096         BT_DBG("%s", hdev->name);
5097
5098         hci_dev_lock(hdev);
5099
5100         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5101                 goto unlock;
5102
5103         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5104         if (!data) {
5105                 struct hci_cp_remote_oob_data_neg_reply cp;
5106
5107                 bacpy(&cp.bdaddr, &ev->bdaddr);
5108                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5109                              sizeof(cp), &cp);
5110                 goto unlock;
5111         }
5112
5113         if (bredr_sc_enabled(hdev)) {
5114                 struct hci_cp_remote_oob_ext_data_reply cp;
5115
5116                 bacpy(&cp.bdaddr, &ev->bdaddr);
5117                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5118                         memset(cp.hash192, 0, sizeof(cp.hash192));
5119                         memset(cp.rand192, 0, sizeof(cp.rand192));
5120                 } else {
5121                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5122                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5123                 }
5124                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5125                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5126
5127                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5128                              sizeof(cp), &cp);
5129         } else {
5130                 struct hci_cp_remote_oob_data_reply cp;
5131
5132                 bacpy(&cp.bdaddr, &ev->bdaddr);
5133                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5134                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5135
5136                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5137                              sizeof(cp), &cp);
5138         }
5139
5140 unlock:
5141         hci_dev_unlock(hdev);
5142 }
5143
5144 #if IS_ENABLED(CONFIG_BT_HS)
5145 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5146 {
5147         struct hci_ev_channel_selected *ev = (void *)skb->data;
5148         struct hci_conn *hcon;
5149
5150         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5151
5152         skb_pull(skb, sizeof(*ev));
5153
5154         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5155         if (!hcon)
5156                 return;
5157
5158         amp_read_loc_assoc_final_data(hdev, hcon);
5159 }
5160
5161 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
5162                                       struct sk_buff *skb)
5163 {
5164         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
5165         struct hci_conn *hcon, *bredr_hcon;
5166
5167         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
5168                ev->status);
5169
5170         hci_dev_lock(hdev);
5171
5172         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5173         if (!hcon)
5174                 goto unlock;
5175
5176         if (!hcon->amp_mgr)
5177                 goto unlock;
5178
5179         if (ev->status) {
5180                 hci_conn_del(hcon);
5181                 goto unlock;
5182         }
5183
5184         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5185
5186         hcon->state = BT_CONNECTED;
5187         bacpy(&hcon->dst, &bredr_hcon->dst);
5188
5189         hci_conn_hold(hcon);
5190         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5191         hci_conn_drop(hcon);
5192
5193         hci_debugfs_create_conn(hcon);
5194         hci_conn_add_sysfs(hcon);
5195
5196         amp_physical_cfm(bredr_hcon, hcon);
5197
5198 unlock:
5199         hci_dev_unlock(hdev);
5200 }
5201
5202 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5203 {
5204         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
5205         struct hci_conn *hcon;
5206         struct hci_chan *hchan;
5207         struct amp_mgr *mgr;
5208
5209         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5210                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
5211                ev->status);
5212
5213         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5214         if (!hcon)
5215                 return;
5216
5217         /* Create AMP hchan */
5218         hchan = hci_chan_create(hcon);
5219         if (!hchan)
5220                 return;
5221
5222         hchan->handle = le16_to_cpu(ev->handle);
5223         hchan->amp = true;
5224
5225         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5226
5227         mgr = hcon->amp_mgr;
5228         if (mgr && mgr->bredr_chan) {
5229                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5230
5231                 l2cap_chan_lock(bredr_chan);
5232
5233                 bredr_chan->conn->mtu = hdev->block_mtu;
5234                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5235                 hci_conn_hold(hcon);
5236
5237                 l2cap_chan_unlock(bredr_chan);
5238         }
5239 }
5240
5241 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5242                                              struct sk_buff *skb)
5243 {
5244         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5245         struct hci_chan *hchan;
5246
5247         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5248                le16_to_cpu(ev->handle), ev->status);
5249
5250         if (ev->status)
5251                 return;
5252
5253         hci_dev_lock(hdev);
5254
5255         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5256         if (!hchan || !hchan->amp)
5257                 goto unlock;
5258
5259         amp_destroy_logical_link(hchan, ev->reason);
5260
5261 unlock:
5262         hci_dev_unlock(hdev);
5263 }
5264
5265 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5266                                              struct sk_buff *skb)
5267 {
5268         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5269         struct hci_conn *hcon;
5270
5271         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5272
5273         if (ev->status)
5274                 return;
5275
5276         hci_dev_lock(hdev);
5277
5278         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5279         if (hcon && hcon->type == AMP_LINK) {
5280                 hcon->state = BT_CLOSED;
5281                 hci_disconn_cfm(hcon, ev->reason);
5282                 hci_conn_del(hcon);
5283         }
5284
5285         hci_dev_unlock(hdev);
5286 }
5287 #endif
5288
5289 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5290                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5291 {
5292         if (conn->out) {
5293                 conn->dst_type = bdaddr_type;
5294                 conn->resp_addr_type = bdaddr_type;
5295                 bacpy(&conn->resp_addr, bdaddr);
5296
5297                 /* Check if the controller has set a Local RPA then it must be
5298                  * used instead or hdev->rpa.
5299                  */
5300                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5301                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5302                         bacpy(&conn->init_addr, local_rpa);
5303                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5304                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5305                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5306                 } else {
5307                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5308                                                   &conn->init_addr_type);
5309                 }
5310         } else {
5311                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5312                 /* Check if the controller has set a Local RPA then it must be
5313                  * used instead or hdev->rpa.
5314                  */
5315                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5316                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5317                         bacpy(&conn->resp_addr, local_rpa);
5318                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5319                         /* In case of ext adv, resp_addr will be updated in
5320                          * Adv Terminated event.
5321                          */
5322                         if (!ext_adv_capable(conn->hdev))
5323                                 bacpy(&conn->resp_addr,
5324                                       &conn->hdev->random_addr);
5325                 } else {
5326                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5327                 }
5328
5329                 conn->init_addr_type = bdaddr_type;
5330                 bacpy(&conn->init_addr, bdaddr);
5331
5332                 /* For incoming connections, set the default minimum
5333                  * and maximum connection interval. They will be used
5334                  * to check if the parameters are in range and if not
5335                  * trigger the connection update procedure.
5336                  */
5337                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5338                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5339         }
5340 }
5341
5342 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5343                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5344                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5345                                  u16 interval, u16 latency,
5346                                  u16 supervision_timeout)
5347 {
5348         struct hci_conn_params *params;
5349         struct hci_conn *conn;
5350         struct smp_irk *irk;
5351         u8 addr_type;
5352
5353         hci_dev_lock(hdev);
5354
5355         /* All controllers implicitly stop advertising in the event of a
5356          * connection, so ensure that the state bit is cleared.
5357          */
5358         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5359
5360         conn = hci_lookup_le_connect(hdev);
5361         if (!conn) {
5362                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5363                 if (!conn) {
5364                         bt_dev_err(hdev, "no memory for new connection");
5365                         goto unlock;
5366                 }
5367
5368                 conn->dst_type = bdaddr_type;
5369
5370                 /* If we didn't have a hci_conn object previously
5371                  * but we're in central role this must be something
5372                  * initiated using an accept list. Since accept list based
5373                  * connections are not "first class citizens" we don't
5374                  * have full tracking of them. Therefore, we go ahead
5375                  * with a "best effort" approach of determining the
5376                  * initiator address based on the HCI_PRIVACY flag.
5377                  */
5378                 if (conn->out) {
5379                         conn->resp_addr_type = bdaddr_type;
5380                         bacpy(&conn->resp_addr, bdaddr);
5381                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5382                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5383                                 bacpy(&conn->init_addr, &hdev->rpa);
5384                         } else {
5385                                 hci_copy_identity_address(hdev,
5386                                                           &conn->init_addr,
5387                                                           &conn->init_addr_type);
5388                         }
5389                 }
5390         } else {
5391                 cancel_delayed_work(&conn->le_conn_timeout);
5392         }
5393
5394         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5395
5396         /* Lookup the identity address from the stored connection
5397          * address and address type.
5398          *
5399          * When establishing connections to an identity address, the
5400          * connection procedure will store the resolvable random
5401          * address first. Now if it can be converted back into the
5402          * identity address, start using the identity address from
5403          * now on.
5404          */
5405         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5406         if (irk) {
5407                 bacpy(&conn->dst, &irk->bdaddr);
5408                 conn->dst_type = irk->addr_type;
5409         }
5410
5411         /* When using controller based address resolution, then the new
5412          * address types 0x02 and 0x03 are used. These types need to be
5413          * converted back into either public address or random address type
5414          */
5415         if (use_ll_privacy(hdev) &&
5416             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5417             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
5418                 switch (conn->dst_type) {
5419                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
5420                         conn->dst_type = ADDR_LE_DEV_PUBLIC;
5421                         break;
5422                 case ADDR_LE_DEV_RANDOM_RESOLVED:
5423                         conn->dst_type = ADDR_LE_DEV_RANDOM;
5424                         break;
5425                 }
5426         }
5427
5428         if (status) {
5429                 hci_le_conn_failed(conn, status);
5430                 goto unlock;
5431         }
5432
5433         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5434                 addr_type = BDADDR_LE_PUBLIC;
5435         else
5436                 addr_type = BDADDR_LE_RANDOM;
5437
5438         /* Drop the connection if the device is blocked */
5439         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5440                 hci_conn_drop(conn);
5441                 goto unlock;
5442         }
5443
5444         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5445                 mgmt_device_connected(hdev, conn, NULL, 0);
5446
5447         conn->sec_level = BT_SECURITY_LOW;
5448         conn->handle = handle;
5449         conn->state = BT_CONFIG;
5450
5451         /* Store current advertising instance as connection advertising instance
5452          * when sotfware rotation is in use so it can be re-enabled when
5453          * disconnected.
5454          */
5455         if (!ext_adv_capable(hdev))
5456                 conn->adv_instance = hdev->cur_adv_instance;
5457
5458         conn->le_conn_interval = interval;
5459         conn->le_conn_latency = latency;
5460         conn->le_supv_timeout = supervision_timeout;
5461
5462         hci_debugfs_create_conn(conn);
5463         hci_conn_add_sysfs(conn);
5464
5465         /* The remote features procedure is defined for central
5466          * role only. So only in case of an initiated connection
5467          * request the remote features.
5468          *
5469          * If the local controller supports peripheral-initiated features
5470          * exchange, then requesting the remote features in peripheral
5471          * role is possible. Otherwise just transition into the
5472          * connected state without requesting the remote features.
5473          */
5474         if (conn->out ||
5475             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5476                 struct hci_cp_le_read_remote_features cp;
5477
5478                 cp.handle = __cpu_to_le16(conn->handle);
5479
5480                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5481                              sizeof(cp), &cp);
5482
5483                 hci_conn_hold(conn);
5484         } else {
5485                 conn->state = BT_CONNECTED;
5486                 hci_connect_cfm(conn, status);
5487         }
5488
5489         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5490                                            conn->dst_type);
5491         if (params) {
5492                 list_del_init(&params->action);
5493                 if (params->conn) {
5494                         hci_conn_drop(params->conn);
5495                         hci_conn_put(params->conn);
5496                         params->conn = NULL;
5497                 }
5498         }
5499
5500 unlock:
5501         hci_update_background_scan(hdev);
5502         hci_dev_unlock(hdev);
5503 }
5504
5505 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5506 {
5507         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5508
5509         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5510
5511         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5512                              NULL, ev->role, le16_to_cpu(ev->handle),
5513                              le16_to_cpu(ev->interval),
5514                              le16_to_cpu(ev->latency),
5515                              le16_to_cpu(ev->supervision_timeout));
5516 }
5517
5518 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5519                                          struct sk_buff *skb)
5520 {
5521         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5522
5523         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5524
5525         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5526                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5527                              le16_to_cpu(ev->interval),
5528                              le16_to_cpu(ev->latency),
5529                              le16_to_cpu(ev->supervision_timeout));
5530
5531         if (use_ll_privacy(hdev) &&
5532             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5533             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5534                 hci_req_disable_address_resolution(hdev);
5535 }
5536
5537 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5538 {
5539         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5540         struct hci_conn *conn;
5541         struct adv_info *adv;
5542
5543         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5544
5545         adv = hci_find_adv_instance(hdev, ev->handle);
5546
5547         if (ev->status) {
5548                 if (!adv)
5549                         return;
5550
5551                 /* Remove advertising as it has been terminated */
5552                 hci_remove_adv_instance(hdev, ev->handle);
5553                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5554
5555                 return;
5556         }
5557
5558         if (adv)
5559                 adv->enabled = false;
5560
5561         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5562         if (conn) {
5563                 /* Store handle in the connection so the correct advertising
5564                  * instance can be re-enabled when disconnected.
5565                  */
5566                 conn->adv_instance = ev->handle;
5567
5568                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5569                     bacmp(&conn->resp_addr, BDADDR_ANY))
5570                         return;
5571
5572                 if (!ev->handle) {
5573                         bacpy(&conn->resp_addr, &hdev->random_addr);
5574                         return;
5575                 }
5576
5577                 if (adv)
5578                         bacpy(&conn->resp_addr, &adv->random_addr);
5579         }
5580 }
5581
5582 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5583                                             struct sk_buff *skb)
5584 {
5585         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5586         struct hci_conn *conn;
5587
5588         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5589
5590         if (ev->status)
5591                 return;
5592
5593         hci_dev_lock(hdev);
5594
5595         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5596         if (conn) {
5597 #ifdef TIZEN_BT
5598                 if (ev->status) {
5599                         hci_dev_unlock(hdev);
5600                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5601                                 conn->type, conn->dst_type, ev->status);
5602                         return;
5603                 }
5604 #endif
5605                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5606                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5607                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5608         }
5609
5610         hci_dev_unlock(hdev);
5611
5612 #ifdef TIZEN_BT
5613         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5614                                 conn->dst_type, conn->le_conn_interval,
5615                                 conn->le_conn_latency, conn->le_supv_timeout);
5616 #endif
5617 }
5618
5619 /* This function requires the caller holds hdev->lock */
5620 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5621                                               bdaddr_t *addr,
5622                                               u8 addr_type, u8 adv_type,
5623                                               bdaddr_t *direct_rpa)
5624 {
5625         struct hci_conn *conn;
5626         struct hci_conn_params *params;
5627
5628         /* If the event is not connectable don't proceed further */
5629         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5630                 return NULL;
5631
5632         /* Ignore if the device is blocked */
5633         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type))
5634                 return NULL;
5635
5636         /* Most controller will fail if we try to create new connections
5637          * while we have an existing one in peripheral role.
5638          */
5639         if (hdev->conn_hash.le_num_peripheral > 0 &&
5640             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5641              !(hdev->le_states[3] & 0x10)))
5642                 return NULL;
5643
5644         /* If we're not connectable only connect devices that we have in
5645          * our pend_le_conns list.
5646          */
5647         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5648                                            addr_type);
5649         if (!params)
5650                 return NULL;
5651
5652         if (!params->explicit_connect) {
5653                 switch (params->auto_connect) {
5654                 case HCI_AUTO_CONN_DIRECT:
5655                         /* Only devices advertising with ADV_DIRECT_IND are
5656                          * triggering a connection attempt. This is allowing
5657                          * incoming connections from peripheral devices.
5658                          */
5659                         if (adv_type != LE_ADV_DIRECT_IND)
5660                                 return NULL;
5661                         break;
5662                 case HCI_AUTO_CONN_ALWAYS:
5663                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5664                          * are triggering a connection attempt. This means
5665                          * that incoming connections from peripheral device are
5666                          * accepted and also outgoing connections to peripheral
5667                          * devices are established when found.
5668                          */
5669                         break;
5670                 default:
5671                         return NULL;
5672                 }
5673         }
5674
5675         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5676                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5677                               direct_rpa);
5678         if (!IS_ERR(conn)) {
5679                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5680                  * by higher layer that tried to connect, if no then
5681                  * store the pointer since we don't really have any
5682                  * other owner of the object besides the params that
5683                  * triggered it. This way we can abort the connection if
5684                  * the parameters get removed and keep the reference
5685                  * count consistent once the connection is established.
5686                  */
5687
5688                 if (!params->explicit_connect)
5689                         params->conn = hci_conn_get(conn);
5690
5691                 return conn;
5692         }
5693
5694         switch (PTR_ERR(conn)) {
5695         case -EBUSY:
5696                 /* If hci_connect() returns -EBUSY it means there is already
5697                  * an LE connection attempt going on. Since controllers don't
5698                  * support more than one connection attempt at the time, we
5699                  * don't consider this an error case.
5700                  */
5701                 break;
5702         default:
5703                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5704                 return NULL;
5705         }
5706
5707         return NULL;
5708 }
5709
5710 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5711                                u8 bdaddr_type, bdaddr_t *direct_addr,
5712                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5713                                bool ext_adv)
5714 {
5715         struct discovery_state *d = &hdev->discovery;
5716         struct smp_irk *irk;
5717         struct hci_conn *conn;
5718         bool match;
5719         u32 flags;
5720         u8 *ptr;
5721
5722         switch (type) {
5723         case LE_ADV_IND:
5724         case LE_ADV_DIRECT_IND:
5725         case LE_ADV_SCAN_IND:
5726         case LE_ADV_NONCONN_IND:
5727         case LE_ADV_SCAN_RSP:
5728                 break;
5729         default:
5730                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5731                                        "type: 0x%02x", type);
5732                 return;
5733         }
5734
5735         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5736                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5737                 return;
5738         }
5739
5740         /* Find the end of the data in case the report contains padded zero
5741          * bytes at the end causing an invalid length value.
5742          *
5743          * When data is NULL, len is 0 so there is no need for extra ptr
5744          * check as 'ptr < data + 0' is already false in such case.
5745          */
5746         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5747                 if (ptr + 1 + *ptr > data + len)
5748                         break;
5749         }
5750
5751         /* Adjust for actual length. This handles the case when remote
5752          * device is advertising with incorrect data length.
5753          */
5754         len = ptr - data;
5755
5756         /* If the direct address is present, then this report is from
5757          * a LE Direct Advertising Report event. In that case it is
5758          * important to see if the address is matching the local
5759          * controller address.
5760          */
5761         if (direct_addr) {
5762                 /* Only resolvable random addresses are valid for these
5763                  * kind of reports and others can be ignored.
5764                  */
5765                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5766                         return;
5767
5768                 /* If the controller is not using resolvable random
5769                  * addresses, then this report can be ignored.
5770                  */
5771                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5772                         return;
5773
5774                 /* If the local IRK of the controller does not match
5775                  * with the resolvable random address provided, then
5776                  * this report can be ignored.
5777                  */
5778                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5779                         return;
5780         }
5781
5782         /* Check if we need to convert to identity address */
5783         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5784         if (irk) {
5785                 bdaddr = &irk->bdaddr;
5786                 bdaddr_type = irk->addr_type;
5787         }
5788
5789         /* Check if we have been requested to connect to this device.
5790          *
5791          * direct_addr is set only for directed advertising reports (it is NULL
5792          * for advertising reports) and is already verified to be RPA above.
5793          */
5794         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5795                                                                 direct_addr);
5796         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5797                 /* Store report for later inclusion by
5798                  * mgmt_device_connected
5799                  */
5800                 memcpy(conn->le_adv_data, data, len);
5801                 conn->le_adv_data_len = len;
5802         }
5803
5804         /* Passive scanning shouldn't trigger any device found events,
5805          * except for devices marked as CONN_REPORT for which we do send
5806          * device found events, or advertisement monitoring requested.
5807          */
5808         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5809                 if (type == LE_ADV_DIRECT_IND)
5810                         return;
5811
5812                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5813                                                bdaddr, bdaddr_type) &&
5814                     idr_is_empty(&hdev->adv_monitors_idr))
5815                         return;
5816
5817                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5818                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5819                 else
5820                         flags = 0;
5821                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5822                                   rssi, flags, data, len, NULL, 0);
5823                 return;
5824         }
5825
5826         /* When receiving non-connectable or scannable undirected
5827          * advertising reports, this means that the remote device is
5828          * not connectable and then clearly indicate this in the
5829          * device found event.
5830          *
5831          * When receiving a scan response, then there is no way to
5832          * know if the remote device is connectable or not. However
5833          * since scan responses are merged with a previously seen
5834          * advertising report, the flags field from that report
5835          * will be used.
5836          *
5837          * In the really unlikely case that a controller get confused
5838          * and just sends a scan response event, then it is marked as
5839          * not connectable as well.
5840          */
5841         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5842             type == LE_ADV_SCAN_RSP)
5843                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5844         else
5845                 flags = 0;
5846
5847         /* If there's nothing pending either store the data from this
5848          * event or send an immediate device found event if the data
5849          * should not be stored for later.
5850          */
5851         if (!ext_adv && !has_pending_adv_report(hdev)) {
5852                 /* If the report will trigger a SCAN_REQ store it for
5853                  * later merging.
5854                  */
5855                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5856                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5857                                                  rssi, flags, data, len);
5858                         return;
5859                 }
5860
5861                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5862                                   rssi, flags, data, len, NULL, 0);
5863                 return;
5864         }
5865
5866         /* Check if the pending report is for the same device as the new one */
5867         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5868                  bdaddr_type == d->last_adv_addr_type);
5869
5870         /* If the pending data doesn't match this report or this isn't a
5871          * scan response (e.g. we got a duplicate ADV_IND) then force
5872          * sending of the pending data.
5873          */
5874         if (type != LE_ADV_SCAN_RSP || !match) {
5875                 /* Send out whatever is in the cache, but skip duplicates */
5876                 if (!match)
5877                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5878                                           d->last_adv_addr_type, NULL,
5879                                           d->last_adv_rssi, d->last_adv_flags,
5880                                           d->last_adv_data,
5881                                           d->last_adv_data_len, NULL, 0);
5882
5883                 /* If the new report will trigger a SCAN_REQ store it for
5884                  * later merging.
5885                  */
5886                 if (!ext_adv && (type == LE_ADV_IND ||
5887                                  type == LE_ADV_SCAN_IND)) {
5888                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5889                                                  rssi, flags, data, len);
5890                         return;
5891                 }
5892
5893                 /* The advertising reports cannot be merged, so clear
5894                  * the pending report and send out a device found event.
5895                  */
5896                 clear_pending_adv_report(hdev);
5897                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5898                                   rssi, flags, data, len, NULL, 0);
5899                 return;
5900         }
5901
5902         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5903          * the new event is a SCAN_RSP. We can therefore proceed with
5904          * sending a merged device found event.
5905          */
5906         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5907                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5908                           d->last_adv_data, d->last_adv_data_len, data, len);
5909         clear_pending_adv_report(hdev);
5910 }
5911
5912 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5913 {
5914         u8 num_reports = skb->data[0];
5915         void *ptr = &skb->data[1];
5916
5917         hci_dev_lock(hdev);
5918
5919         while (num_reports--) {
5920                 struct hci_ev_le_advertising_info *ev = ptr;
5921                 s8 rssi;
5922
5923                 if (ptr > (void *)skb_tail_pointer(skb) - sizeof(*ev)) {
5924                         bt_dev_err(hdev, "Malicious advertising data.");
5925                         break;
5926                 }
5927
5928                 if (ev->length <= HCI_MAX_AD_LENGTH &&
5929                     ev->data + ev->length <= skb_tail_pointer(skb)) {
5930                         rssi = ev->data[ev->length];
5931                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5932                                            ev->bdaddr_type, NULL, 0, rssi,
5933                                            ev->data, ev->length, false);
5934                 } else {
5935                         bt_dev_err(hdev, "Dropping invalid advertising data");
5936                 }
5937
5938                 ptr += sizeof(*ev) + ev->length + 1;
5939         }
5940
5941         hci_dev_unlock(hdev);
5942 }
5943
5944 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5945 {
5946         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5947                 switch (evt_type) {
5948                 case LE_LEGACY_ADV_IND:
5949                         return LE_ADV_IND;
5950                 case LE_LEGACY_ADV_DIRECT_IND:
5951                         return LE_ADV_DIRECT_IND;
5952                 case LE_LEGACY_ADV_SCAN_IND:
5953                         return LE_ADV_SCAN_IND;
5954                 case LE_LEGACY_NONCONN_IND:
5955                         return LE_ADV_NONCONN_IND;
5956                 case LE_LEGACY_SCAN_RSP_ADV:
5957                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5958                         return LE_ADV_SCAN_RSP;
5959                 }
5960
5961                 goto invalid;
5962         }
5963
5964         if (evt_type & LE_EXT_ADV_CONN_IND) {
5965                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5966                         return LE_ADV_DIRECT_IND;
5967
5968                 return LE_ADV_IND;
5969         }
5970
5971         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5972                 return LE_ADV_SCAN_RSP;
5973
5974         if (evt_type & LE_EXT_ADV_SCAN_IND)
5975                 return LE_ADV_SCAN_IND;
5976
5977         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5978             evt_type & LE_EXT_ADV_DIRECT_IND)
5979                 return LE_ADV_NONCONN_IND;
5980
5981 invalid:
5982         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5983                                evt_type);
5984
5985         return LE_ADV_INVALID;
5986 }
5987
5988 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5989 {
5990         u8 num_reports = skb->data[0];
5991         void *ptr = &skb->data[1];
5992
5993         hci_dev_lock(hdev);
5994
5995         while (num_reports--) {
5996                 struct hci_ev_le_ext_adv_report *ev = ptr;
5997                 u8 legacy_evt_type;
5998                 u16 evt_type;
5999
6000                 evt_type = __le16_to_cpu(ev->evt_type);
6001                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6002                 if (legacy_evt_type != LE_ADV_INVALID) {
6003                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
6004                                            ev->bdaddr_type, NULL, 0, ev->rssi,
6005                                            ev->data, ev->length,
6006                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
6007                 }
6008
6009                 ptr += sizeof(*ev) + ev->length;
6010         }
6011
6012         hci_dev_unlock(hdev);
6013 }
6014
6015 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
6016                                             struct sk_buff *skb)
6017 {
6018         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
6019         struct hci_conn *conn;
6020
6021         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6022
6023         hci_dev_lock(hdev);
6024
6025         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6026         if (conn) {
6027                 if (!ev->status)
6028                         memcpy(conn->features[0], ev->features, 8);
6029
6030                 if (conn->state == BT_CONFIG) {
6031                         __u8 status;
6032
6033                         /* If the local controller supports peripheral-initiated
6034                          * features exchange, but the remote controller does
6035                          * not, then it is possible that the error code 0x1a
6036                          * for unsupported remote feature gets returned.
6037                          *
6038                          * In this specific case, allow the connection to
6039                          * transition into connected state and mark it as
6040                          * successful.
6041                          */
6042                         if (!conn->out && ev->status == 0x1a &&
6043                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6044                                 status = 0x00;
6045                         else
6046                                 status = ev->status;
6047
6048                         conn->state = BT_CONNECTED;
6049                         hci_connect_cfm(conn, status);
6050                         hci_conn_drop(conn);
6051                 }
6052         }
6053
6054         hci_dev_unlock(hdev);
6055 }
6056
6057 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
6058 {
6059         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
6060         struct hci_cp_le_ltk_reply cp;
6061         struct hci_cp_le_ltk_neg_reply neg;
6062         struct hci_conn *conn;
6063         struct smp_ltk *ltk;
6064
6065         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
6066
6067         hci_dev_lock(hdev);
6068
6069         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6070         if (conn == NULL)
6071                 goto not_found;
6072
6073         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6074         if (!ltk)
6075                 goto not_found;
6076
6077         if (smp_ltk_is_sc(ltk)) {
6078                 /* With SC both EDiv and Rand are set to zero */
6079                 if (ev->ediv || ev->rand)
6080                         goto not_found;
6081         } else {
6082                 /* For non-SC keys check that EDiv and Rand match */
6083                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6084                         goto not_found;
6085         }
6086
6087         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6088         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6089         cp.handle = cpu_to_le16(conn->handle);
6090
6091         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6092
6093         conn->enc_key_size = ltk->enc_size;
6094
6095         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6096
6097         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6098          * temporary key used to encrypt a connection following
6099          * pairing. It is used during the Encrypted Session Setup to
6100          * distribute the keys. Later, security can be re-established
6101          * using a distributed LTK.
6102          */
6103         if (ltk->type == SMP_STK) {
6104                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6105                 list_del_rcu(&ltk->list);
6106                 kfree_rcu(ltk, rcu);
6107         } else {
6108                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6109         }
6110
6111         hci_dev_unlock(hdev);
6112
6113         return;
6114
6115 not_found:
6116         neg.handle = ev->handle;
6117         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6118         hci_dev_unlock(hdev);
6119 }
6120
6121 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6122                                       u8 reason)
6123 {
6124         struct hci_cp_le_conn_param_req_neg_reply cp;
6125
6126         cp.handle = cpu_to_le16(handle);
6127         cp.reason = reason;
6128
6129         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6130                      &cp);
6131 }
6132
6133 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
6134                                              struct sk_buff *skb)
6135 {
6136         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
6137         struct hci_cp_le_conn_param_req_reply cp;
6138         struct hci_conn *hcon;
6139         u16 handle, min, max, latency, timeout;
6140
6141         handle = le16_to_cpu(ev->handle);
6142         min = le16_to_cpu(ev->interval_min);
6143         max = le16_to_cpu(ev->interval_max);
6144         latency = le16_to_cpu(ev->latency);
6145         timeout = le16_to_cpu(ev->timeout);
6146
6147         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6148         if (!hcon || hcon->state != BT_CONNECTED)
6149                 return send_conn_param_neg_reply(hdev, handle,
6150                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6151
6152         if (hci_check_conn_params(min, max, latency, timeout))
6153                 return send_conn_param_neg_reply(hdev, handle,
6154                                                  HCI_ERROR_INVALID_LL_PARAMS);
6155
6156         if (hcon->role == HCI_ROLE_MASTER) {
6157                 struct hci_conn_params *params;
6158                 u8 store_hint;
6159
6160                 hci_dev_lock(hdev);
6161
6162                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6163                                                 hcon->dst_type);
6164                 if (params) {
6165                         params->conn_min_interval = min;
6166                         params->conn_max_interval = max;
6167                         params->conn_latency = latency;
6168                         params->supervision_timeout = timeout;
6169                         store_hint = 0x01;
6170                 } else {
6171                         store_hint = 0x00;
6172                 }
6173
6174                 hci_dev_unlock(hdev);
6175
6176                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6177                                     store_hint, min, max, latency, timeout);
6178         }
6179
6180         cp.handle = ev->handle;
6181         cp.interval_min = ev->interval_min;
6182         cp.interval_max = ev->interval_max;
6183         cp.latency = ev->latency;
6184         cp.timeout = ev->timeout;
6185         cp.min_ce_len = 0;
6186         cp.max_ce_len = 0;
6187
6188         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6189 }
6190
6191 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
6192                                          struct sk_buff *skb)
6193 {
6194         u8 num_reports = skb->data[0];
6195         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6196
6197         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
6198                 return;
6199
6200         hci_dev_lock(hdev);
6201
6202         for (; num_reports; num_reports--, ev++)
6203                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6204                                    ev->bdaddr_type, &ev->direct_addr,
6205                                    ev->direct_addr_type, ev->rssi, NULL, 0,
6206                                    false);
6207
6208         hci_dev_unlock(hdev);
6209 }
6210
6211 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
6212 {
6213         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
6214         struct hci_conn *conn;
6215
6216         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6217
6218         if (ev->status)
6219                 return;
6220
6221         hci_dev_lock(hdev);
6222
6223         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6224         if (!conn)
6225                 goto unlock;
6226
6227         conn->le_tx_phy = ev->tx_phy;
6228         conn->le_rx_phy = ev->rx_phy;
6229
6230 unlock:
6231         hci_dev_unlock(hdev);
6232 }
6233
6234 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
6235 {
6236         struct hci_ev_le_meta *le_ev = (void *) skb->data;
6237
6238         skb_pull(skb, sizeof(*le_ev));
6239
6240         switch (le_ev->subevent) {
6241         case HCI_EV_LE_CONN_COMPLETE:
6242                 hci_le_conn_complete_evt(hdev, skb);
6243                 break;
6244
6245         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
6246                 hci_le_conn_update_complete_evt(hdev, skb);
6247                 break;
6248
6249         case HCI_EV_LE_ADVERTISING_REPORT:
6250                 hci_le_adv_report_evt(hdev, skb);
6251                 break;
6252
6253         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
6254                 hci_le_remote_feat_complete_evt(hdev, skb);
6255                 break;
6256
6257         case HCI_EV_LE_LTK_REQ:
6258                 hci_le_ltk_request_evt(hdev, skb);
6259                 break;
6260
6261         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
6262                 hci_le_remote_conn_param_req_evt(hdev, skb);
6263                 break;
6264
6265         case HCI_EV_LE_DIRECT_ADV_REPORT:
6266                 hci_le_direct_adv_report_evt(hdev, skb);
6267                 break;
6268
6269         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6270                 hci_le_phy_update_evt(hdev, skb);
6271                 break;
6272
6273         case HCI_EV_LE_EXT_ADV_REPORT:
6274                 hci_le_ext_adv_report_evt(hdev, skb);
6275                 break;
6276
6277         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
6278                 hci_le_enh_conn_complete_evt(hdev, skb);
6279                 break;
6280
6281         case HCI_EV_LE_EXT_ADV_SET_TERM:
6282                 hci_le_ext_adv_term_evt(hdev, skb);
6283                 break;
6284
6285         default:
6286                 break;
6287         }
6288 }
6289
6290 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6291                                  u8 event, struct sk_buff *skb)
6292 {
6293         struct hci_ev_cmd_complete *ev;
6294         struct hci_event_hdr *hdr;
6295
6296         if (!skb)
6297                 return false;
6298
6299         if (skb->len < sizeof(*hdr)) {
6300                 bt_dev_err(hdev, "too short HCI event");
6301                 return false;
6302         }
6303
6304         hdr = (void *) skb->data;
6305         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6306
6307         if (event) {
6308                 if (hdr->evt != event)
6309                         return false;
6310                 return true;
6311         }
6312
6313         /* Check if request ended in Command Status - no way to retrieve
6314          * any extra parameters in this case.
6315          */
6316         if (hdr->evt == HCI_EV_CMD_STATUS)
6317                 return false;
6318
6319         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6320                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6321                            hdr->evt);
6322                 return false;
6323         }
6324
6325         if (skb->len < sizeof(*ev)) {
6326                 bt_dev_err(hdev, "too short cmd_complete event");
6327                 return false;
6328         }
6329
6330         ev = (void *) skb->data;
6331         skb_pull(skb, sizeof(*ev));
6332
6333         if (opcode != __le16_to_cpu(ev->opcode)) {
6334                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6335                        __le16_to_cpu(ev->opcode));
6336                 return false;
6337         }
6338
6339         return true;
6340 }
6341
6342 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6343                                   struct sk_buff *skb)
6344 {
6345         struct hci_ev_le_advertising_info *adv;
6346         struct hci_ev_le_direct_adv_info *direct_adv;
6347         struct hci_ev_le_ext_adv_report *ext_adv;
6348         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6349         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6350
6351         hci_dev_lock(hdev);
6352
6353         /* If we are currently suspended and this is the first BT event seen,
6354          * save the wake reason associated with the event.
6355          */
6356         if (!hdev->suspended || hdev->wake_reason)
6357                 goto unlock;
6358
6359         /* Default to remote wake. Values for wake_reason are documented in the
6360          * Bluez mgmt api docs.
6361          */
6362         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6363
6364         /* Once configured for remote wakeup, we should only wake up for
6365          * reconnections. It's useful to see which device is waking us up so
6366          * keep track of the bdaddr of the connection event that woke us up.
6367          */
6368         if (event == HCI_EV_CONN_REQUEST) {
6369                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6370                 hdev->wake_addr_type = BDADDR_BREDR;
6371         } else if (event == HCI_EV_CONN_COMPLETE) {
6372                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6373                 hdev->wake_addr_type = BDADDR_BREDR;
6374         } else if (event == HCI_EV_LE_META) {
6375                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6376                 u8 subevent = le_ev->subevent;
6377                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6378                 u8 num_reports = *ptr;
6379
6380                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6381                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6382                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6383                     num_reports) {
6384                         adv = (void *)(ptr + 1);
6385                         direct_adv = (void *)(ptr + 1);
6386                         ext_adv = (void *)(ptr + 1);
6387
6388                         switch (subevent) {
6389                         case HCI_EV_LE_ADVERTISING_REPORT:
6390                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6391                                 hdev->wake_addr_type = adv->bdaddr_type;
6392                                 break;
6393                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6394                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6395                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6396                                 break;
6397                         case HCI_EV_LE_EXT_ADV_REPORT:
6398                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6399                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6400                                 break;
6401                         }
6402                 }
6403         } else {
6404                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6405         }
6406
6407 unlock:
6408         hci_dev_unlock(hdev);
6409 }
6410
6411 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6412 {
6413         struct hci_event_hdr *hdr = (void *) skb->data;
6414         hci_req_complete_t req_complete = NULL;
6415         hci_req_complete_skb_t req_complete_skb = NULL;
6416         struct sk_buff *orig_skb = NULL;
6417         u8 status = 0, event = hdr->evt, req_evt = 0;
6418         u16 opcode = HCI_OP_NOP;
6419
6420         if (!event) {
6421                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6422                 goto done;
6423         }
6424
6425         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6426                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6427                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6428                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6429                                      &req_complete_skb);
6430                 req_evt = event;
6431         }
6432
6433         /* If it looks like we might end up having to call
6434          * req_complete_skb, store a pristine copy of the skb since the
6435          * various handlers may modify the original one through
6436          * skb_pull() calls, etc.
6437          */
6438         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6439             event == HCI_EV_CMD_COMPLETE)
6440                 orig_skb = skb_clone(skb, GFP_KERNEL);
6441
6442         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6443
6444         /* Store wake reason if we're suspended */
6445         hci_store_wake_reason(hdev, event, skb);
6446
6447         switch (event) {
6448         case HCI_EV_INQUIRY_COMPLETE:
6449                 hci_inquiry_complete_evt(hdev, skb);
6450                 break;
6451
6452         case HCI_EV_INQUIRY_RESULT:
6453                 hci_inquiry_result_evt(hdev, skb);
6454                 break;
6455
6456         case HCI_EV_CONN_COMPLETE:
6457                 hci_conn_complete_evt(hdev, skb);
6458                 break;
6459
6460         case HCI_EV_CONN_REQUEST:
6461                 hci_conn_request_evt(hdev, skb);
6462                 break;
6463
6464         case HCI_EV_DISCONN_COMPLETE:
6465                 hci_disconn_complete_evt(hdev, skb);
6466                 break;
6467
6468         case HCI_EV_AUTH_COMPLETE:
6469                 hci_auth_complete_evt(hdev, skb);
6470                 break;
6471
6472         case HCI_EV_REMOTE_NAME:
6473                 hci_remote_name_evt(hdev, skb);
6474                 break;
6475
6476         case HCI_EV_ENCRYPT_CHANGE:
6477                 hci_encrypt_change_evt(hdev, skb);
6478                 break;
6479
6480         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6481                 hci_change_link_key_complete_evt(hdev, skb);
6482                 break;
6483
6484         case HCI_EV_REMOTE_FEATURES:
6485                 hci_remote_features_evt(hdev, skb);
6486                 break;
6487
6488         case HCI_EV_CMD_COMPLETE:
6489                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6490                                      &req_complete, &req_complete_skb);
6491                 break;
6492
6493         case HCI_EV_CMD_STATUS:
6494                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6495                                    &req_complete_skb);
6496                 break;
6497
6498         case HCI_EV_HARDWARE_ERROR:
6499                 hci_hardware_error_evt(hdev, skb);
6500                 break;
6501
6502         case HCI_EV_ROLE_CHANGE:
6503                 hci_role_change_evt(hdev, skb);
6504                 break;
6505
6506         case HCI_EV_NUM_COMP_PKTS:
6507                 hci_num_comp_pkts_evt(hdev, skb);
6508                 break;
6509
6510         case HCI_EV_MODE_CHANGE:
6511                 hci_mode_change_evt(hdev, skb);
6512                 break;
6513
6514         case HCI_EV_PIN_CODE_REQ:
6515                 hci_pin_code_request_evt(hdev, skb);
6516                 break;
6517
6518         case HCI_EV_LINK_KEY_REQ:
6519                 hci_link_key_request_evt(hdev, skb);
6520                 break;
6521
6522         case HCI_EV_LINK_KEY_NOTIFY:
6523                 hci_link_key_notify_evt(hdev, skb);
6524                 break;
6525
6526         case HCI_EV_CLOCK_OFFSET:
6527                 hci_clock_offset_evt(hdev, skb);
6528                 break;
6529
6530         case HCI_EV_PKT_TYPE_CHANGE:
6531                 hci_pkt_type_change_evt(hdev, skb);
6532                 break;
6533
6534         case HCI_EV_PSCAN_REP_MODE:
6535                 hci_pscan_rep_mode_evt(hdev, skb);
6536                 break;
6537
6538         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6539                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6540                 break;
6541
6542         case HCI_EV_REMOTE_EXT_FEATURES:
6543                 hci_remote_ext_features_evt(hdev, skb);
6544                 break;
6545
6546         case HCI_EV_SYNC_CONN_COMPLETE:
6547                 hci_sync_conn_complete_evt(hdev, skb);
6548                 break;
6549
6550         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6551                 hci_extended_inquiry_result_evt(hdev, skb);
6552                 break;
6553
6554         case HCI_EV_KEY_REFRESH_COMPLETE:
6555                 hci_key_refresh_complete_evt(hdev, skb);
6556                 break;
6557
6558         case HCI_EV_IO_CAPA_REQUEST:
6559                 hci_io_capa_request_evt(hdev, skb);
6560                 break;
6561
6562         case HCI_EV_IO_CAPA_REPLY:
6563                 hci_io_capa_reply_evt(hdev, skb);
6564                 break;
6565
6566         case HCI_EV_USER_CONFIRM_REQUEST:
6567                 hci_user_confirm_request_evt(hdev, skb);
6568                 break;
6569
6570         case HCI_EV_USER_PASSKEY_REQUEST:
6571                 hci_user_passkey_request_evt(hdev, skb);
6572                 break;
6573
6574         case HCI_EV_USER_PASSKEY_NOTIFY:
6575                 hci_user_passkey_notify_evt(hdev, skb);
6576                 break;
6577
6578         case HCI_EV_KEYPRESS_NOTIFY:
6579                 hci_keypress_notify_evt(hdev, skb);
6580                 break;
6581
6582         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6583                 hci_simple_pair_complete_evt(hdev, skb);
6584                 break;
6585
6586         case HCI_EV_REMOTE_HOST_FEATURES:
6587                 hci_remote_host_features_evt(hdev, skb);
6588                 break;
6589
6590         case HCI_EV_LE_META:
6591                 hci_le_meta_evt(hdev, skb);
6592                 break;
6593
6594         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6595                 hci_remote_oob_data_request_evt(hdev, skb);
6596                 break;
6597
6598 #if IS_ENABLED(CONFIG_BT_HS)
6599         case HCI_EV_CHANNEL_SELECTED:
6600                 hci_chan_selected_evt(hdev, skb);
6601                 break;
6602
6603         case HCI_EV_PHY_LINK_COMPLETE:
6604                 hci_phy_link_complete_evt(hdev, skb);
6605                 break;
6606
6607         case HCI_EV_LOGICAL_LINK_COMPLETE:
6608                 hci_loglink_complete_evt(hdev, skb);
6609                 break;
6610
6611         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6612                 hci_disconn_loglink_complete_evt(hdev, skb);
6613                 break;
6614
6615         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6616                 hci_disconn_phylink_complete_evt(hdev, skb);
6617                 break;
6618 #endif
6619
6620         case HCI_EV_NUM_COMP_BLOCKS:
6621                 hci_num_comp_blocks_evt(hdev, skb);
6622                 break;
6623
6624 #ifdef TIZEN_BT
6625         case HCI_EV_VENDOR_SPECIFIC:
6626                 hci_vendor_specific_evt(hdev, skb);
6627                 break;
6628 #else
6629         case HCI_EV_VENDOR:
6630                 msft_vendor_evt(hdev, skb);
6631                 break;
6632 #endif
6633
6634         default:
6635                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6636                 break;
6637         }
6638
6639         if (req_complete) {
6640                 req_complete(hdev, status, opcode);
6641         } else if (req_complete_skb) {
6642                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6643                         kfree_skb(orig_skb);
6644                         orig_skb = NULL;
6645                 }
6646                 req_complete_skb(hdev, status, opcode, orig_skb);
6647         }
6648
6649 done:
6650         kfree_skb(orig_skb);
6651         kfree_skb(skb);
6652         hdev->stat.evt_rx++;
6653 }