net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4    Copyright 2023 NXP
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI event handling. */
  27
  28 #include <asm/unaligned.h>
  29 #include <linux/crypto.h>
  30 #include <crypto/algapi.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34 #include <net/bluetooth/mgmt.h>
  35
  36 #include "hci_request.h"
  37 #include "hci_debugfs.h"
  38 #include "hci_codec.h"
  39 #include "a2mp.h"
  40 #include "amp.h"
  41 #include "smp.h"
  42 #include "msft.h"
  43 #include "eir.h"
  44
  45 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  46                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  47
  48 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  49
  50 /* Handle HCI Event packets */
  51
  52 static void *hci_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  53                              u8 ev, size_t len)
  54 {
  55         void *data;
  56
  57         data = skb_pull_data(skb, len);
  58         if (!data)
  59                 bt_dev_err(hdev, "Malformed Event: 0x%2.2x", ev);
  60
  61         return data;
  62 }
  63
  64 static void *hci_cc_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  65                              u16 op, size_t len)
  66 {
  67         void *data;
  68
  69         data = skb_pull_data(skb, len);
  70         if (!data)
  71                 bt_dev_err(hdev, "Malformed Command Complete: 0x%4.4x", op);
  72
  73         return data;
  74 }
  75
  76 static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb,
  77                                 u8 ev, size_t len)
  78 {
  79         void *data;
  80
  81         data = skb_pull_data(skb, len);
  82         if (!data)
  83                 bt_dev_err(hdev, "Malformed LE Event: 0x%2.2x", ev);
  84
  85         return data;
  86 }
  87
  88 static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data,
  89                                 struct sk_buff *skb)
  90 {
  91         struct hci_ev_status *rp = data;
  92
  93         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
  94
  95         /* It is possible that we receive Inquiry Complete event right
  96          * before we receive Inquiry Cancel Command Complete event, in
  97          * which case the latter event should have status of Command
  98          * Disallowed (0x0c). This should not be treated as error, since
  99          * we actually achieve what Inquiry Cancel wants to achieve,
 100          * which is to end the last Inquiry session.
 101          */
 102         if (rp->status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
 103                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
 104                 rp->status = 0x00;
 105         }
 106
 107         if (rp->status)
 108                 return rp->status;
 109
 110         clear_bit(HCI_INQUIRY, &hdev->flags);
 111         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
 112         wake_up_bit(&hdev->flags, HCI_INQUIRY);
 113
 114         hci_dev_lock(hdev);
 115         /* Set discovery state to stopped if we're not doing LE active
 116          * scanning.
 117          */
 118         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
 119             hdev->le_scan_type != LE_SCAN_ACTIVE)
 120                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 121         hci_dev_unlock(hdev);
 122
 123         hci_conn_check_pending(hdev);
 124
 125         return rp->status;
 126 }
 127
 128 static u8 hci_cc_periodic_inq(struct hci_dev *hdev, void *data,
 129                               struct sk_buff *skb)
 130 {
 131         struct hci_ev_status *rp = data;
 132
 133         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 134
 135         if (rp->status)
 136                 return rp->status;
 137
 138         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
 139
 140         return rp->status;
 141 }
 142
 143 static u8 hci_cc_exit_periodic_inq(struct hci_dev *hdev, void *data,
 144                                    struct sk_buff *skb)
 145 {
 146         struct hci_ev_status *rp = data;
 147
 148         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 149
 150         if (rp->status)
 151                 return rp->status;
 152
 153         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 154
 155         hci_conn_check_pending(hdev);
 156
 157         return rp->status;
 158 }
 159
 160 static u8 hci_cc_remote_name_req_cancel(struct hci_dev *hdev, void *data,
 161                                         struct sk_buff *skb)
 162 {
 163         struct hci_ev_status *rp = data;
 164
 165         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 166
 167         return rp->status;
 168 }
 169
 170 static u8 hci_cc_role_discovery(struct hci_dev *hdev, void *data,
 171                                 struct sk_buff *skb)
 172 {
 173         struct hci_rp_role_discovery *rp = data;
 174         struct hci_conn *conn;
 175
 176         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 177
 178         if (rp->status)
 179                 return rp->status;
 180
 181         hci_dev_lock(hdev);
 182
 183         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 184         if (conn)
 185                 conn->role = rp->role;
 186
 187         hci_dev_unlock(hdev);
 188
 189         return rp->status;
 190 }
 191
 192 static u8 hci_cc_read_link_policy(struct hci_dev *hdev, void *data,
 193                                   struct sk_buff *skb)
 194 {
 195         struct hci_rp_read_link_policy *rp = data;
 196         struct hci_conn *conn;
 197
 198         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 199
 200         if (rp->status)
 201                 return rp->status;
 202
 203         hci_dev_lock(hdev);
 204
 205         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 206         if (conn)
 207                 conn->link_policy = __le16_to_cpu(rp->policy);
 208
 209         hci_dev_unlock(hdev);
 210
 211         return rp->status;
 212 }
 213
 214 static u8 hci_cc_write_link_policy(struct hci_dev *hdev, void *data,
 215                                    struct sk_buff *skb)
 216 {
 217         struct hci_rp_write_link_policy *rp = data;
 218         struct hci_conn *conn;
 219         void *sent;
 220 #ifdef TIZEN_BT
 221         struct hci_cp_write_link_policy cp;
 222         struct hci_conn *sco_conn;
 223 #endif
 224
 225         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 226
 227         if (rp->status)
 228                 return rp->status;
 229
 230         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 231         if (!sent)
 232                 return rp->status;
 233
 234         hci_dev_lock(hdev);
 235
 236         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 237         if (conn)
 238                 conn->link_policy = get_unaligned_le16(sent + 2);
 239
 240 #ifdef TIZEN_BT
 241         sco_conn = hci_conn_hash_lookup_sco(hdev);
 242         if (sco_conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 243             conn->link_policy & HCI_LP_SNIFF) {
 244                 BT_ERR("SNIFF is not allowed during sco connection");
 245                 cp.handle = __cpu_to_le16(conn->handle);
 246                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 247                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 248         }
 249 #endif
 250
 251         hci_dev_unlock(hdev);
 252
 253         return rp->status;
 254 }
 255
 256 static u8 hci_cc_read_def_link_policy(struct hci_dev *hdev, void *data,
 257                                       struct sk_buff *skb)
 258 {
 259         struct hci_rp_read_def_link_policy *rp = data;
 260
 261         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 262
 263         if (rp->status)
 264                 return rp->status;
 265
 266         hdev->link_policy = __le16_to_cpu(rp->policy);
 267
 268         return rp->status;
 269 }
 270
 271 static u8 hci_cc_write_def_link_policy(struct hci_dev *hdev, void *data,
 272                                        struct sk_buff *skb)
 273 {
 274         struct hci_ev_status *rp = data;
 275         void *sent;
 276
 277         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 278
 279         if (rp->status)
 280                 return rp->status;
 281
 282         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 283         if (!sent)
 284                 return rp->status;
 285
 286         hdev->link_policy = get_unaligned_le16(sent);
 287
 288         return rp->status;
 289 }
 290
 291 static u8 hci_cc_reset(struct hci_dev *hdev, void *data, struct sk_buff *skb)
 292 {
 293         struct hci_ev_status *rp = data;
 294
 295         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 296
 297         clear_bit(HCI_RESET, &hdev->flags);
 298
 299         if (rp->status)
 300                 return rp->status;
 301
 302         /* Reset all non-persistent flags */
 303         hci_dev_clear_volatile_flags(hdev);
 304
 305         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 306
 307         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 308         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 309
 310         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 311         hdev->adv_data_len = 0;
 312
 313         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 314         hdev->scan_rsp_data_len = 0;
 315
 316         hdev->le_scan_type = LE_SCAN_PASSIVE;
 317
 318         hdev->ssp_debug_mode = 0;
 319
 320         hci_bdaddr_list_clear(&hdev->le_accept_list);
 321         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 322
 323         return rp->status;
 324 }
 325
 326 static u8 hci_cc_read_stored_link_key(struct hci_dev *hdev, void *data,
 327                                       struct sk_buff *skb)
 328 {
 329         struct hci_rp_read_stored_link_key *rp = data;
 330         struct hci_cp_read_stored_link_key *sent;
 331
 332         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 333
 334         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 335         if (!sent)
 336                 return rp->status;
 337
 338         if (!rp->status && sent->read_all == 0x01) {
 339                 hdev->stored_max_keys = le16_to_cpu(rp->max_keys);
 340                 hdev->stored_num_keys = le16_to_cpu(rp->num_keys);
 341         }
 342
 343         return rp->status;
 344 }
 345
 346 static u8 hci_cc_delete_stored_link_key(struct hci_dev *hdev, void *data,
 347                                         struct sk_buff *skb)
 348 {
 349         struct hci_rp_delete_stored_link_key *rp = data;
 350         u16 num_keys;
 351
 352         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 353
 354         if (rp->status)
 355                 return rp->status;
 356
 357         num_keys = le16_to_cpu(rp->num_keys);
 358
 359         if (num_keys <= hdev->stored_num_keys)
 360                 hdev->stored_num_keys -= num_keys;
 361         else
 362                 hdev->stored_num_keys = 0;
 363
 364         return rp->status;
 365 }
 366
 367 static u8 hci_cc_write_local_name(struct hci_dev *hdev, void *data,
 368                                   struct sk_buff *skb)
 369 {
 370         struct hci_ev_status *rp = data;
 371         void *sent;
 372
 373         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 374
 375         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 376         if (!sent)
 377                 return rp->status;
 378
 379         hci_dev_lock(hdev);
 380
 381         if (hci_dev_test_flag(hdev, HCI_MGMT))
 382                 mgmt_set_local_name_complete(hdev, sent, rp->status);
 383         else if (!rp->status)
 384                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 385
 386         hci_dev_unlock(hdev);
 387
 388         return rp->status;
 389 }
 390
 391 static u8 hci_cc_read_local_name(struct hci_dev *hdev, void *data,
 392                                  struct sk_buff *skb)
 393 {
 394         struct hci_rp_read_local_name *rp = data;
 395
 396         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 397
 398         if (rp->status)
 399                 return rp->status;
 400
 401         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 402             hci_dev_test_flag(hdev, HCI_CONFIG))
 403                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 404
 405         return rp->status;
 406 }
 407
 408 static u8 hci_cc_write_auth_enable(struct hci_dev *hdev, void *data,
 409                                    struct sk_buff *skb)
 410 {
 411         struct hci_ev_status *rp = data;
 412         void *sent;
 413
 414         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 415
 416         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 417         if (!sent)
 418                 return rp->status;
 419
 420         hci_dev_lock(hdev);
 421
 422         if (!rp->status) {
 423                 __u8 param = *((__u8 *) sent);
 424
 425                 if (param == AUTH_ENABLED)
 426                         set_bit(HCI_AUTH, &hdev->flags);
 427                 else
 428                         clear_bit(HCI_AUTH, &hdev->flags);
 429         }
 430
 431         if (hci_dev_test_flag(hdev, HCI_MGMT))
 432                 mgmt_auth_enable_complete(hdev, rp->status);
 433
 434         hci_dev_unlock(hdev);
 435
 436         return rp->status;
 437 }
 438
 439 static u8 hci_cc_write_encrypt_mode(struct hci_dev *hdev, void *data,
 440                                     struct sk_buff *skb)
 441 {
 442         struct hci_ev_status *rp = data;
 443         __u8 param;
 444         void *sent;
 445
 446         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 447
 448         if (rp->status)
 449                 return rp->status;
 450
 451         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 452         if (!sent)
 453                 return rp->status;
 454
 455         param = *((__u8 *) sent);
 456
 457         if (param)
 458                 set_bit(HCI_ENCRYPT, &hdev->flags);
 459         else
 460                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 461
 462         return rp->status;
 463 }
 464
 465 static u8 hci_cc_write_scan_enable(struct hci_dev *hdev, void *data,
 466                                    struct sk_buff *skb)
 467 {
 468         struct hci_ev_status *rp = data;
 469         __u8 param;
 470         void *sent;
 471
 472         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 473
 474         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 475         if (!sent)
 476                 return rp->status;
 477
 478         param = *((__u8 *) sent);
 479
 480         hci_dev_lock(hdev);
 481
 482         if (rp->status) {
 483                 hdev->discov_timeout = 0;
 484                 goto done;
 485         }
 486
 487         if (param & SCAN_INQUIRY)
 488                 set_bit(HCI_ISCAN, &hdev->flags);
 489         else
 490                 clear_bit(HCI_ISCAN, &hdev->flags);
 491
 492         if (param & SCAN_PAGE)
 493                 set_bit(HCI_PSCAN, &hdev->flags);
 494         else
 495                 clear_bit(HCI_PSCAN, &hdev->flags);
 496
 497 done:
 498         hci_dev_unlock(hdev);
 499
 500         return rp->status;
 501 }
 502
 503 static u8 hci_cc_set_event_filter(struct hci_dev *hdev, void *data,
 504                                   struct sk_buff *skb)
 505 {
 506         struct hci_ev_status *rp = data;
 507         struct hci_cp_set_event_filter *cp;
 508         void *sent;
 509
 510         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 511
 512         if (rp->status)
 513                 return rp->status;
 514
 515         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 516         if (!sent)
 517                 return rp->status;
 518
 519         cp = (struct hci_cp_set_event_filter *)sent;
 520
 521         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 522                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 523         else
 524                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 525
 526         return rp->status;
 527 }
 528
 529 static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
 530                                    struct sk_buff *skb)
 531 {
 532         struct hci_rp_read_class_of_dev *rp = data;
 533
 534         if (WARN_ON(!hdev))
 535                 return HCI_ERROR_UNSPECIFIED;
 536
 537         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 538
 539         if (rp->status)
 540                 return rp->status;
 541
 542         memcpy(hdev->dev_class, rp->dev_class, 3);
 543
 544         bt_dev_dbg(hdev, "class 0x%.2x%.2x%.2x", hdev->dev_class[2],
 545                    hdev->dev_class[1], hdev->dev_class[0]);
 546
 547         return rp->status;
 548 }
 549
 550 static u8 hci_cc_write_class_of_dev(struct hci_dev *hdev, void *data,
 551                                     struct sk_buff *skb)
 552 {
 553         struct hci_ev_status *rp = data;
 554         void *sent;
 555
 556         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 557
 558         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 559         if (!sent)
 560                 return rp->status;
 561
 562         hci_dev_lock(hdev);
 563
 564         if (!rp->status)
 565                 memcpy(hdev->dev_class, sent, 3);
 566
 567         if (hci_dev_test_flag(hdev, HCI_MGMT))
 568                 mgmt_set_class_of_dev_complete(hdev, sent, rp->status);
 569
 570         hci_dev_unlock(hdev);
 571
 572         return rp->status;
 573 }
 574
 575 static u8 hci_cc_read_voice_setting(struct hci_dev *hdev, void *data,
 576                                     struct sk_buff *skb)
 577 {
 578         struct hci_rp_read_voice_setting *rp = data;
 579         __u16 setting;
 580
 581         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 582
 583         if (rp->status)
 584                 return rp->status;
 585
 586         setting = __le16_to_cpu(rp->voice_setting);
 587
 588         if (hdev->voice_setting == setting)
 589                 return rp->status;
 590
 591         hdev->voice_setting = setting;
 592
 593         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 594
 595         if (hdev->notify)
 596                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 597
 598         return rp->status;
 599 }
 600
 601 static u8 hci_cc_write_voice_setting(struct hci_dev *hdev, void *data,
 602                                      struct sk_buff *skb)
 603 {
 604         struct hci_ev_status *rp = data;
 605         __u16 setting;
 606         void *sent;
 607
 608         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 609
 610         if (rp->status)
 611                 return rp->status;
 612
 613         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 614         if (!sent)
 615                 return rp->status;
 616
 617         setting = get_unaligned_le16(sent);
 618
 619         if (hdev->voice_setting == setting)
 620                 return rp->status;
 621
 622         hdev->voice_setting = setting;
 623
 624         bt_dev_dbg(hdev, "voice setting 0x%4.4x", setting);
 625
 626         if (hdev->notify)
 627                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 628
 629         return rp->status;
 630 }
 631
 632 static u8 hci_cc_read_num_supported_iac(struct hci_dev *hdev, void *data,
 633                                         struct sk_buff *skb)
 634 {
 635         struct hci_rp_read_num_supported_iac *rp = data;
 636
 637         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 638
 639         if (rp->status)
 640                 return rp->status;
 641
 642         hdev->num_iac = rp->num_iac;
 643
 644         bt_dev_dbg(hdev, "num iac %d", hdev->num_iac);
 645
 646         return rp->status;
 647 }
 648
 649 static u8 hci_cc_write_ssp_mode(struct hci_dev *hdev, void *data,
 650                                 struct sk_buff *skb)
 651 {
 652         struct hci_ev_status *rp = data;
 653         struct hci_cp_write_ssp_mode *sent;
 654
 655         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 656
 657         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 658         if (!sent)
 659                 return rp->status;
 660
 661         hci_dev_lock(hdev);
 662
 663         if (!rp->status) {
 664                 if (sent->mode)
 665                         hdev->features[1][0] |= LMP_HOST_SSP;
 666                 else
 667                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 668         }
 669
 670         if (!rp->status) {
 671                 if (sent->mode)
 672                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 673                 else
 674                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 675         }
 676
 677         hci_dev_unlock(hdev);
 678
 679         return rp->status;
 680 }
 681
 682 static u8 hci_cc_write_sc_support(struct hci_dev *hdev, void *data,
 683                                   struct sk_buff *skb)
 684 {
 685         struct hci_ev_status *rp = data;
 686         struct hci_cp_write_sc_support *sent;
 687
 688         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 689
 690         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 691         if (!sent)
 692                 return rp->status;
 693
 694         hci_dev_lock(hdev);
 695
 696         if (!rp->status) {
 697                 if (sent->support)
 698                         hdev->features[1][0] |= LMP_HOST_SC;
 699                 else
 700                         hdev->features[1][0] &= ~LMP_HOST_SC;
 701         }
 702
 703         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !rp->status) {
 704                 if (sent->support)
 705                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 706                 else
 707                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 708         }
 709
 710         hci_dev_unlock(hdev);
 711
 712         return rp->status;
 713 }
 714
 715 static u8 hci_cc_read_local_version(struct hci_dev *hdev, void *data,
 716                                     struct sk_buff *skb)
 717 {
 718         struct hci_rp_read_local_version *rp = data;
 719
 720         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 721
 722         if (rp->status)
 723                 return rp->status;
 724
 725         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 726             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 727                 hdev->hci_ver = rp->hci_ver;
 728                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 729                 hdev->lmp_ver = rp->lmp_ver;
 730                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 731                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 732         }
 733
 734         return rp->status;
 735 }
 736
 737 static u8 hci_cc_read_enc_key_size(struct hci_dev *hdev, void *data,
 738                                    struct sk_buff *skb)
 739 {
 740         struct hci_rp_read_enc_key_size *rp = data;
 741         struct hci_conn *conn;
 742         u16 handle;
 743         u8 status = rp->status;
 744
 745         bt_dev_dbg(hdev, "status 0x%2.2x", status);
 746
 747         handle = le16_to_cpu(rp->handle);
 748
 749         hci_dev_lock(hdev);
 750
 751         conn = hci_conn_hash_lookup_handle(hdev, handle);
 752         if (!conn) {
 753                 status = 0xFF;
 754                 goto done;
 755         }
 756
 757         /* While unexpected, the read_enc_key_size command may fail. The most
 758          * secure approach is to then assume the key size is 0 to force a
 759          * disconnection.
 760          */
 761         if (status) {
 762                 bt_dev_err(hdev, "failed to read key size for handle %u",
 763                            handle);
 764                 conn->enc_key_size = 0;
 765         } else {
 766                 conn->enc_key_size = rp->key_size;
 767                 status = 0;
 768
 769                 if (conn->enc_key_size < hdev->min_enc_key_size) {
 770                         /* As slave role, the conn->state has been set to
 771                          * BT_CONNECTED and l2cap conn req might not be received
 772                          * yet, at this moment the l2cap layer almost does
 773                          * nothing with the non-zero status.
 774                          * So we also clear encrypt related bits, and then the
 775                          * handler of l2cap conn req will get the right secure
 776                          * state at a later time.
 777                          */
 778                         status = HCI_ERROR_AUTH_FAILURE;
 779                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
 780                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
 781                 }
 782         }
 783
 784         hci_encrypt_cfm(conn, status);
 785
 786 done:
 787         hci_dev_unlock(hdev);
 788
 789         return status;
 790 }
 791
 792 static u8 hci_cc_read_local_commands(struct hci_dev *hdev, void *data,
 793                                      struct sk_buff *skb)
 794 {
 795         struct hci_rp_read_local_commands *rp = data;
 796
 797         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 798
 799         if (rp->status)
 800                 return rp->status;
 801
 802         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 803             hci_dev_test_flag(hdev, HCI_CONFIG))
 804                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 805
 806         return rp->status;
 807 }
 808
 809 static u8 hci_cc_read_auth_payload_timeout(struct hci_dev *hdev, void *data,
 810                                            struct sk_buff *skb)
 811 {
 812         struct hci_rp_read_auth_payload_to *rp = data;
 813         struct hci_conn *conn;
 814
 815         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 816
 817         if (rp->status)
 818                 return rp->status;
 819
 820         hci_dev_lock(hdev);
 821
 822         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 823         if (conn)
 824                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 825
 826         hci_dev_unlock(hdev);
 827
 828         return rp->status;
 829 }
 830
 831 static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
 832                                             struct sk_buff *skb)
 833 {
 834         struct hci_rp_write_auth_payload_to *rp = data;
 835         struct hci_conn *conn;
 836         void *sent;
 837
 838         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 839
 840         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 841         if (!sent)
 842                 return rp->status;
 843
 844         hci_dev_lock(hdev);
 845
 846         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 847         if (!conn) {
 848                 rp->status = 0xff;
 849                 goto unlock;
 850         }
 851
 852         if (!rp->status)
 853                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 854
 855 unlock:
 856         hci_dev_unlock(hdev);
 857
 858         return rp->status;
 859 }
 860
 861 static u8 hci_cc_read_local_features(struct hci_dev *hdev, void *data,
 862                                      struct sk_buff *skb)
 863 {
 864         struct hci_rp_read_local_features *rp = data;
 865
 866         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 867
 868         if (rp->status)
 869                 return rp->status;
 870
 871         memcpy(hdev->features, rp->features, 8);
 872
 873         /* Adjust default settings according to features
 874          * supported by device. */
 875
 876         if (hdev->features[0][0] & LMP_3SLOT)
 877                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 878
 879         if (hdev->features[0][0] & LMP_5SLOT)
 880                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 881
 882         if (hdev->features[0][1] & LMP_HV2) {
 883                 hdev->pkt_type  |= (HCI_HV2);
 884                 hdev->esco_type |= (ESCO_HV2);
 885         }
 886
 887         if (hdev->features[0][1] & LMP_HV3) {
 888                 hdev->pkt_type  |= (HCI_HV3);
 889                 hdev->esco_type |= (ESCO_HV3);
 890         }
 891
 892         if (lmp_esco_capable(hdev))
 893                 hdev->esco_type |= (ESCO_EV3);
 894
 895         if (hdev->features[0][4] & LMP_EV4)
 896                 hdev->esco_type |= (ESCO_EV4);
 897
 898         if (hdev->features[0][4] & LMP_EV5)
 899                 hdev->esco_type |= (ESCO_EV5);
 900
 901         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 902                 hdev->esco_type |= (ESCO_2EV3);
 903
 904         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 905                 hdev->esco_type |= (ESCO_3EV3);
 906
 907         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 908                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 909
 910         return rp->status;
 911 }
 912
 913 static u8 hci_cc_read_local_ext_features(struct hci_dev *hdev, void *data,
 914                                          struct sk_buff *skb)
 915 {
 916         struct hci_rp_read_local_ext_features *rp = data;
 917
 918         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 919
 920         if (rp->status)
 921                 return rp->status;
 922
 923         if (hdev->max_page < rp->max_page) {
 924                 if (test_bit(HCI_QUIRK_BROKEN_LOCAL_EXT_FEATURES_PAGE_2,
 925                              &hdev->quirks))
 926                         bt_dev_warn(hdev, "broken local ext features page 2");
 927                 else
 928                         hdev->max_page = rp->max_page;
 929         }
 930
 931         if (rp->page < HCI_MAX_PAGES)
 932                 memcpy(hdev->features[rp->page], rp->features, 8);
 933
 934         return rp->status;
 935 }
 936
 937 static u8 hci_cc_read_flow_control_mode(struct hci_dev *hdev, void *data,
 938                                         struct sk_buff *skb)
 939 {
 940         struct hci_rp_read_flow_control_mode *rp = data;
 941
 942         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 943
 944         if (rp->status)
 945                 return rp->status;
 946
 947         hdev->flow_ctl_mode = rp->mode;
 948
 949         return rp->status;
 950 }
 951
 952 static u8 hci_cc_read_buffer_size(struct hci_dev *hdev, void *data,
 953                                   struct sk_buff *skb)
 954 {
 955         struct hci_rp_read_buffer_size *rp = data;
 956
 957         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 958
 959         if (rp->status)
 960                 return rp->status;
 961
 962         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 963         hdev->sco_mtu  = rp->sco_mtu;
 964         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 965         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 966
 967         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 968                 hdev->sco_mtu  = 64;
 969                 hdev->sco_pkts = 8;
 970         }
 971
 972         hdev->acl_cnt = hdev->acl_pkts;
 973         hdev->sco_cnt = hdev->sco_pkts;
 974
 975         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 976                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 977
 978         return rp->status;
 979 }
 980
 981 static u8 hci_cc_read_bd_addr(struct hci_dev *hdev, void *data,
 982                               struct sk_buff *skb)
 983 {
 984         struct hci_rp_read_bd_addr *rp = data;
 985
 986         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
 987
 988         if (rp->status)
 989                 return rp->status;
 990
 991         if (test_bit(HCI_INIT, &hdev->flags))
 992                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 993
 994         if (hci_dev_test_flag(hdev, HCI_SETUP))
 995                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 996
 997         return rp->status;
 998 }
 999
1000 static u8 hci_cc_read_local_pairing_opts(struct hci_dev *hdev, void *data,
1001                                          struct sk_buff *skb)
1002 {
1003         struct hci_rp_read_local_pairing_opts *rp = data;
1004
1005         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1006
1007         if (rp->status)
1008                 return rp->status;
1009
1010         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1011             hci_dev_test_flag(hdev, HCI_CONFIG)) {
1012                 hdev->pairing_opts = rp->pairing_opts;
1013                 hdev->max_enc_key_size = rp->max_key_size;
1014         }
1015
1016         return rp->status;
1017 }
1018
1019 static u8 hci_cc_read_page_scan_activity(struct hci_dev *hdev, void *data,
1020                                          struct sk_buff *skb)
1021 {
1022         struct hci_rp_read_page_scan_activity *rp = data;
1023
1024         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1025
1026         if (rp->status)
1027                 return rp->status;
1028
1029         if (test_bit(HCI_INIT, &hdev->flags)) {
1030                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
1031                 hdev->page_scan_window = __le16_to_cpu(rp->window);
1032         }
1033
1034         return rp->status;
1035 }
1036
1037 static u8 hci_cc_write_page_scan_activity(struct hci_dev *hdev, void *data,
1038                                           struct sk_buff *skb)
1039 {
1040         struct hci_ev_status *rp = data;
1041         struct hci_cp_write_page_scan_activity *sent;
1042
1043         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1044
1045         if (rp->status)
1046                 return rp->status;
1047
1048         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
1049         if (!sent)
1050                 return rp->status;
1051
1052         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
1053         hdev->page_scan_window = __le16_to_cpu(sent->window);
1054
1055         return rp->status;
1056 }
1057
1058 static u8 hci_cc_read_page_scan_type(struct hci_dev *hdev, void *data,
1059                                      struct sk_buff *skb)
1060 {
1061         struct hci_rp_read_page_scan_type *rp = data;
1062
1063         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1064
1065         if (rp->status)
1066                 return rp->status;
1067
1068         if (test_bit(HCI_INIT, &hdev->flags))
1069                 hdev->page_scan_type = rp->type;
1070
1071         return rp->status;
1072 }
1073
1074 static u8 hci_cc_write_page_scan_type(struct hci_dev *hdev, void *data,
1075                                       struct sk_buff *skb)
1076 {
1077         struct hci_ev_status *rp = data;
1078         u8 *type;
1079
1080         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1081
1082         if (rp->status)
1083                 return rp->status;
1084
1085         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
1086         if (type)
1087                 hdev->page_scan_type = *type;
1088
1089         return rp->status;
1090 }
1091
1092 static u8 hci_cc_read_data_block_size(struct hci_dev *hdev, void *data,
1093                                       struct sk_buff *skb)
1094 {
1095         struct hci_rp_read_data_block_size *rp = data;
1096
1097         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1098
1099         if (rp->status)
1100                 return rp->status;
1101
1102         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
1103         hdev->block_len = __le16_to_cpu(rp->block_len);
1104         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
1105
1106         hdev->block_cnt = hdev->num_blocks;
1107
1108         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
1109                hdev->block_cnt, hdev->block_len);
1110
1111         return rp->status;
1112 }
1113
1114 static u8 hci_cc_read_clock(struct hci_dev *hdev, void *data,
1115                             struct sk_buff *skb)
1116 {
1117         struct hci_rp_read_clock *rp = data;
1118         struct hci_cp_read_clock *cp;
1119         struct hci_conn *conn;
1120
1121         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1122
1123         if (rp->status)
1124                 return rp->status;
1125
1126         hci_dev_lock(hdev);
1127
1128         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
1129         if (!cp)
1130                 goto unlock;
1131
1132         if (cp->which == 0x00) {
1133                 hdev->clock = le32_to_cpu(rp->clock);
1134                 goto unlock;
1135         }
1136
1137         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1138         if (conn) {
1139                 conn->clock = le32_to_cpu(rp->clock);
1140                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
1141         }
1142
1143 unlock:
1144         hci_dev_unlock(hdev);
1145         return rp->status;
1146 }
1147
1148 static u8 hci_cc_read_local_amp_info(struct hci_dev *hdev, void *data,
1149                                      struct sk_buff *skb)
1150 {
1151         struct hci_rp_read_local_amp_info *rp = data;
1152
1153         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1154
1155         if (rp->status)
1156                 return rp->status;
1157
1158         hdev->amp_status = rp->amp_status;
1159         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
1160         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
1161         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
1162         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
1163         hdev->amp_type = rp->amp_type;
1164         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
1165         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
1166         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
1167         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
1168
1169         return rp->status;
1170 }
1171
1172 static u8 hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev, void *data,
1173                                        struct sk_buff *skb)
1174 {
1175         struct hci_rp_read_inq_rsp_tx_power *rp = data;
1176
1177         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1178
1179         if (rp->status)
1180                 return rp->status;
1181
1182         hdev->inq_tx_power = rp->tx_power;
1183
1184         return rp->status;
1185 }
1186
1187 static u8 hci_cc_read_def_err_data_reporting(struct hci_dev *hdev, void *data,
1188                                              struct sk_buff *skb)
1189 {
1190         struct hci_rp_read_def_err_data_reporting *rp = data;
1191
1192         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1193
1194         if (rp->status)
1195                 return rp->status;
1196
1197         hdev->err_data_reporting = rp->err_data_reporting;
1198
1199         return rp->status;
1200 }
1201
1202 static u8 hci_cc_write_def_err_data_reporting(struct hci_dev *hdev, void *data,
1203                                               struct sk_buff *skb)
1204 {
1205         struct hci_ev_status *rp = data;
1206         struct hci_cp_write_def_err_data_reporting *cp;
1207
1208         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1209
1210         if (rp->status)
1211                 return rp->status;
1212
1213         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
1214         if (!cp)
1215                 return rp->status;
1216
1217         hdev->err_data_reporting = cp->err_data_reporting;
1218
1219         return rp->status;
1220 }
1221
1222 static u8 hci_cc_pin_code_reply(struct hci_dev *hdev, void *data,
1223                                 struct sk_buff *skb)
1224 {
1225         struct hci_rp_pin_code_reply *rp = data;
1226         struct hci_cp_pin_code_reply *cp;
1227         struct hci_conn *conn;
1228
1229         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1230
1231         hci_dev_lock(hdev);
1232
1233         if (hci_dev_test_flag(hdev, HCI_MGMT))
1234                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1235
1236         if (rp->status)
1237                 goto unlock;
1238
1239         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1240         if (!cp)
1241                 goto unlock;
1242
1243         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1244         if (conn)
1245                 conn->pin_length = cp->pin_len;
1246
1247 unlock:
1248         hci_dev_unlock(hdev);
1249         return rp->status;
1250 }
1251
1252 static u8 hci_cc_pin_code_neg_reply(struct hci_dev *hdev, void *data,
1253                                     struct sk_buff *skb)
1254 {
1255         struct hci_rp_pin_code_neg_reply *rp = data;
1256
1257         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1258
1259         hci_dev_lock(hdev);
1260
1261         if (hci_dev_test_flag(hdev, HCI_MGMT))
1262                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1263                                                  rp->status);
1264
1265         hci_dev_unlock(hdev);
1266
1267         return rp->status;
1268 }
1269
1270 static u8 hci_cc_le_read_buffer_size(struct hci_dev *hdev, void *data,
1271                                      struct sk_buff *skb)
1272 {
1273         struct hci_rp_le_read_buffer_size *rp = data;
1274
1275         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1276
1277         if (rp->status)
1278                 return rp->status;
1279
1280         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1281         hdev->le_pkts = rp->le_max_pkt;
1282
1283         hdev->le_cnt = hdev->le_pkts;
1284
1285         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1286
1287         return rp->status;
1288 }
1289
1290 static u8 hci_cc_le_read_local_features(struct hci_dev *hdev, void *data,
1291                                         struct sk_buff *skb)
1292 {
1293         struct hci_rp_le_read_local_features *rp = data;
1294
1295         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1296
1297         if (rp->status)
1298                 return rp->status;
1299
1300         memcpy(hdev->le_features, rp->features, 8);
1301
1302         return rp->status;
1303 }
1304
1305 static u8 hci_cc_le_read_adv_tx_power(struct hci_dev *hdev, void *data,
1306                                       struct sk_buff *skb)
1307 {
1308         struct hci_rp_le_read_adv_tx_power *rp = data;
1309
1310         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1311
1312         if (rp->status)
1313                 return rp->status;
1314
1315         hdev->adv_tx_power = rp->tx_power;
1316
1317         return rp->status;
1318 }
1319
1320 static u8 hci_cc_user_confirm_reply(struct hci_dev *hdev, void *data,
1321                                     struct sk_buff *skb)
1322 {
1323         struct hci_rp_user_confirm_reply *rp = data;
1324
1325         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1326
1327         hci_dev_lock(hdev);
1328
1329         if (hci_dev_test_flag(hdev, HCI_MGMT))
1330                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1331                                                  rp->status);
1332
1333         hci_dev_unlock(hdev);
1334
1335         return rp->status;
1336 }
1337
1338 static u8 hci_cc_user_confirm_neg_reply(struct hci_dev *hdev, void *data,
1339                                         struct sk_buff *skb)
1340 {
1341         struct hci_rp_user_confirm_reply *rp = data;
1342
1343         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1344
1345         hci_dev_lock(hdev);
1346
1347         if (hci_dev_test_flag(hdev, HCI_MGMT))
1348                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1349                                                      ACL_LINK, 0, rp->status);
1350
1351         hci_dev_unlock(hdev);
1352
1353         return rp->status;
1354 }
1355
1356 static u8 hci_cc_user_passkey_reply(struct hci_dev *hdev, void *data,
1357                                     struct sk_buff *skb)
1358 {
1359         struct hci_rp_user_confirm_reply *rp = data;
1360
1361         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1362
1363         hci_dev_lock(hdev);
1364
1365         if (hci_dev_test_flag(hdev, HCI_MGMT))
1366                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1367                                                  0, rp->status);
1368
1369         hci_dev_unlock(hdev);
1370
1371         return rp->status;
1372 }
1373
1374 static u8 hci_cc_user_passkey_neg_reply(struct hci_dev *hdev, void *data,
1375                                         struct sk_buff *skb)
1376 {
1377         struct hci_rp_user_confirm_reply *rp = data;
1378
1379         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1380
1381         hci_dev_lock(hdev);
1382
1383         if (hci_dev_test_flag(hdev, HCI_MGMT))
1384                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1385                                                      ACL_LINK, 0, rp->status);
1386
1387         hci_dev_unlock(hdev);
1388
1389         return rp->status;
1390 }
1391
1392 static u8 hci_cc_read_local_oob_data(struct hci_dev *hdev, void *data,
1393                                      struct sk_buff *skb)
1394 {
1395         struct hci_rp_read_local_oob_data *rp = data;
1396
1397         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1398
1399         return rp->status;
1400 }
1401
1402 static u8 hci_cc_read_local_oob_ext_data(struct hci_dev *hdev, void *data,
1403                                          struct sk_buff *skb)
1404 {
1405         struct hci_rp_read_local_oob_ext_data *rp = data;
1406
1407         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1408
1409         return rp->status;
1410 }
1411
1412 static u8 hci_cc_le_set_random_addr(struct hci_dev *hdev, void *data,
1413                                     struct sk_buff *skb)
1414 {
1415         struct hci_ev_status *rp = data;
1416         bdaddr_t *sent;
1417
1418         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1419
1420         if (rp->status)
1421                 return rp->status;
1422
1423         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1424         if (!sent)
1425                 return rp->status;
1426
1427         hci_dev_lock(hdev);
1428
1429         bacpy(&hdev->random_addr, sent);
1430
1431         if (!bacmp(&hdev->rpa, sent)) {
1432                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1433                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1434                                    secs_to_jiffies(hdev->rpa_timeout));
1435         }
1436
1437         hci_dev_unlock(hdev);
1438
1439         return rp->status;
1440 }
1441
1442 static u8 hci_cc_le_set_default_phy(struct hci_dev *hdev, void *data,
1443                                     struct sk_buff *skb)
1444 {
1445         struct hci_ev_status *rp = data;
1446         struct hci_cp_le_set_default_phy *cp;
1447
1448         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1449
1450         if (rp->status)
1451                 return rp->status;
1452
1453         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1454         if (!cp)
1455                 return rp->status;
1456
1457         hci_dev_lock(hdev);
1458
1459         hdev->le_tx_def_phys = cp->tx_phys;
1460         hdev->le_rx_def_phys = cp->rx_phys;
1461
1462         hci_dev_unlock(hdev);
1463
1464         return rp->status;
1465 }
1466
1467 static u8 hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev, void *data,
1468                                             struct sk_buff *skb)
1469 {
1470         struct hci_ev_status *rp = data;
1471         struct hci_cp_le_set_adv_set_rand_addr *cp;
1472         struct adv_info *adv;
1473
1474         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1475
1476         if (rp->status)
1477                 return rp->status;
1478
1479         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1480         /* Update only in case the adv instance since handle 0x00 shall be using
1481          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1482          * non-extended adverting.
1483          */
1484         if (!cp || !cp->handle)
1485                 return rp->status;
1486
1487         hci_dev_lock(hdev);
1488
1489         adv = hci_find_adv_instance(hdev, cp->handle);
1490         if (adv) {
1491                 bacpy(&adv->random_addr, &cp->bdaddr);
1492                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1493                         adv->rpa_expired = false;
1494                         queue_delayed_work(hdev->workqueue,
1495                                            &adv->rpa_expired_cb,
1496                                            secs_to_jiffies(hdev->rpa_timeout));
1497                 }
1498         }
1499
1500         hci_dev_unlock(hdev);
1501
1502         return rp->status;
1503 }
1504
1505 static u8 hci_cc_le_remove_adv_set(struct hci_dev *hdev, void *data,
1506                                    struct sk_buff *skb)
1507 {
1508         struct hci_ev_status *rp = data;
1509         u8 *instance;
1510         int err;
1511
1512         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1513
1514         if (rp->status)
1515                 return rp->status;
1516
1517         instance = hci_sent_cmd_data(hdev, HCI_OP_LE_REMOVE_ADV_SET);
1518         if (!instance)
1519                 return rp->status;
1520
1521         hci_dev_lock(hdev);
1522
1523         err = hci_remove_adv_instance(hdev, *instance);
1524         if (!err)
1525                 mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd), hdev,
1526                                          *instance);
1527
1528         hci_dev_unlock(hdev);
1529
1530         return rp->status;
1531 }
1532
1533 static u8 hci_cc_le_clear_adv_sets(struct hci_dev *hdev, void *data,
1534                                    struct sk_buff *skb)
1535 {
1536         struct hci_ev_status *rp = data;
1537         struct adv_info *adv, *n;
1538         int err;
1539
1540         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1541
1542         if (rp->status)
1543                 return rp->status;
1544
1545         if (!hci_sent_cmd_data(hdev, HCI_OP_LE_CLEAR_ADV_SETS))
1546                 return rp->status;
1547
1548         hci_dev_lock(hdev);
1549
1550         list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1551                 u8 instance = adv->instance;
1552
1553                 err = hci_remove_adv_instance(hdev, instance);
1554                 if (!err)
1555                         mgmt_advertising_removed(hci_skb_sk(hdev->sent_cmd),
1556                                                  hdev, instance);
1557         }
1558
1559         hci_dev_unlock(hdev);
1560
1561         return rp->status;
1562 }
1563
1564 static u8 hci_cc_le_read_transmit_power(struct hci_dev *hdev, void *data,
1565                                         struct sk_buff *skb)
1566 {
1567         struct hci_rp_le_read_transmit_power *rp = data;
1568
1569         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1570
1571         if (rp->status)
1572                 return rp->status;
1573
1574         hdev->min_le_tx_power = rp->min_le_tx_power;
1575         hdev->max_le_tx_power = rp->max_le_tx_power;
1576
1577         return rp->status;
1578 }
1579
1580 static u8 hci_cc_le_set_privacy_mode(struct hci_dev *hdev, void *data,
1581                                      struct sk_buff *skb)
1582 {
1583         struct hci_ev_status *rp = data;
1584         struct hci_cp_le_set_privacy_mode *cp;
1585         struct hci_conn_params *params;
1586
1587         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1588
1589         if (rp->status)
1590                 return rp->status;
1591
1592         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PRIVACY_MODE);
1593         if (!cp)
1594                 return rp->status;
1595
1596         hci_dev_lock(hdev);
1597
1598         params = hci_conn_params_lookup(hdev, &cp->bdaddr, cp->bdaddr_type);
1599         if (params)
1600                 WRITE_ONCE(params->privacy_mode, cp->mode);
1601
1602         hci_dev_unlock(hdev);
1603
1604         return rp->status;
1605 }
1606
1607 static u8 hci_cc_le_set_adv_enable(struct hci_dev *hdev, void *data,
1608                                    struct sk_buff *skb)
1609 {
1610         struct hci_ev_status *rp = data;
1611         __u8 *sent;
1612
1613         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1614
1615         if (rp->status)
1616                 return rp->status;
1617
1618         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1619         if (!sent)
1620                 return rp->status;
1621
1622         hci_dev_lock(hdev);
1623
1624         /* If we're doing connection initiation as peripheral. Set a
1625          * timeout in case something goes wrong.
1626          */
1627         if (*sent) {
1628                 struct hci_conn *conn;
1629
1630                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1631
1632                 conn = hci_lookup_le_connect(hdev);
1633                 if (conn)
1634                         queue_delayed_work(hdev->workqueue,
1635                                            &conn->le_conn_timeout,
1636                                            conn->conn_timeout);
1637         } else {
1638                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1639         }
1640
1641         hci_dev_unlock(hdev);
1642
1643         return rp->status;
1644 }
1645
1646 static u8 hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev, void *data,
1647                                        struct sk_buff *skb)
1648 {
1649         struct hci_cp_le_set_ext_adv_enable *cp;
1650         struct hci_cp_ext_adv_set *set;
1651         struct adv_info *adv = NULL, *n;
1652         struct hci_ev_status *rp = data;
1653
1654         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1655
1656         if (rp->status)
1657                 return rp->status;
1658
1659         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1660         if (!cp)
1661                 return rp->status;
1662
1663         set = (void *)cp->data;
1664
1665         hci_dev_lock(hdev);
1666
1667         if (cp->num_of_sets)
1668                 adv = hci_find_adv_instance(hdev, set->handle);
1669
1670         if (cp->enable) {
1671                 struct hci_conn *conn;
1672
1673                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1674
1675                 if (adv && !adv->periodic)
1676                         adv->enabled = true;
1677
1678                 conn = hci_lookup_le_connect(hdev);
1679                 if (conn)
1680                         queue_delayed_work(hdev->workqueue,
1681                                            &conn->le_conn_timeout,
1682                                            conn->conn_timeout);
1683         } else {
1684                 if (cp->num_of_sets) {
1685                         if (adv)
1686                                 adv->enabled = false;
1687
1688                         /* If just one instance was disabled check if there are
1689                          * any other instance enabled before clearing HCI_LE_ADV
1690                          */
1691                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1692                                                  list) {
1693                                 if (adv->enabled)
1694                                         goto unlock;
1695                         }
1696                 } else {
1697                         /* All instances shall be considered disabled */
1698                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1699                                                  list)
1700                                 adv->enabled = false;
1701                 }
1702
1703                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1704         }
1705
1706 unlock:
1707         hci_dev_unlock(hdev);
1708         return rp->status;
1709 }
1710
1711 static u8 hci_cc_le_set_scan_param(struct hci_dev *hdev, void *data,
1712                                    struct sk_buff *skb)
1713 {
1714         struct hci_cp_le_set_scan_param *cp;
1715         struct hci_ev_status *rp = data;
1716
1717         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1718
1719         if (rp->status)
1720                 return rp->status;
1721
1722         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1723         if (!cp)
1724                 return rp->status;
1725
1726         hci_dev_lock(hdev);
1727
1728         hdev->le_scan_type = cp->type;
1729
1730         hci_dev_unlock(hdev);
1731
1732         return rp->status;
1733 }
1734
1735 static u8 hci_cc_le_set_ext_scan_param(struct hci_dev *hdev, void *data,
1736                                        struct sk_buff *skb)
1737 {
1738         struct hci_cp_le_set_ext_scan_params *cp;
1739         struct hci_ev_status *rp = data;
1740         struct hci_cp_le_scan_phy_params *phy_param;
1741
1742         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1743
1744         if (rp->status)
1745                 return rp->status;
1746
1747         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1748         if (!cp)
1749                 return rp->status;
1750
1751         phy_param = (void *)cp->data;
1752
1753         hci_dev_lock(hdev);
1754
1755         hdev->le_scan_type = phy_param->type;
1756
1757         hci_dev_unlock(hdev);
1758
1759         return rp->status;
1760 }
1761
1762 static bool has_pending_adv_report(struct hci_dev *hdev)
1763 {
1764         struct discovery_state *d = &hdev->discovery;
1765
1766         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1767 }
1768
1769 static void clear_pending_adv_report(struct hci_dev *hdev)
1770 {
1771         struct discovery_state *d = &hdev->discovery;
1772
1773         bacpy(&d->last_adv_addr, BDADDR_ANY);
1774         d->last_adv_data_len = 0;
1775 }
1776
1777 #ifndef TIZEN_BT
1778 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1779                                      u8 bdaddr_type, s8 rssi, u32 flags,
1780                                      u8 *data, u8 len)
1781 {
1782         struct discovery_state *d = &hdev->discovery;
1783
1784         if (len > max_adv_len(hdev))
1785                 return;
1786
1787         bacpy(&d->last_adv_addr, bdaddr);
1788         d->last_adv_addr_type = bdaddr_type;
1789         d->last_adv_rssi = rssi;
1790         d->last_adv_flags = flags;
1791         memcpy(d->last_adv_data, data, len);
1792         d->last_adv_data_len = len;
1793 }
1794 #endif
1795
1796 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1797 {
1798         hci_dev_lock(hdev);
1799
1800         switch (enable) {
1801         case LE_SCAN_ENABLE:
1802                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1803                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1804                         clear_pending_adv_report(hdev);
1805                 if (hci_dev_test_flag(hdev, HCI_MESH))
1806                         hci_discovery_set_state(hdev, DISCOVERY_FINDING);
1807                 break;
1808
1809         case LE_SCAN_DISABLE:
1810                 /* We do this here instead of when setting DISCOVERY_STOPPED
1811                  * since the latter would potentially require waiting for
1812                  * inquiry to stop too.
1813                  */
1814                 if (has_pending_adv_report(hdev)) {
1815                         struct discovery_state *d = &hdev->discovery;
1816
1817                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1818                                           d->last_adv_addr_type, NULL,
1819                                           d->last_adv_rssi, d->last_adv_flags,
1820                                           d->last_adv_data,
1821                                           d->last_adv_data_len, NULL, 0, 0);
1822                 }
1823
1824                 /* Cancel this timer so that we don't try to disable scanning
1825                  * when it's already disabled.
1826                  */
1827                 cancel_delayed_work(&hdev->le_scan_disable);
1828
1829                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1830
1831                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1832                  * interrupted scanning due to a connect request. Mark
1833                  * therefore discovery as stopped.
1834                  */
1835                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1836 #ifndef TIZEN_BT /* The below line is kernel bug. */
1837                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1838 #else
1839                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1840 #endif
1841                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1842                          hdev->discovery.state == DISCOVERY_FINDING)
1843                         queue_work(hdev->workqueue, &hdev->reenable_adv_work);
1844
1845                 break;
1846
1847         default:
1848                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1849                            enable);
1850                 break;
1851         }
1852
1853         hci_dev_unlock(hdev);
1854 }
1855
1856 static u8 hci_cc_le_set_scan_enable(struct hci_dev *hdev, void *data,
1857                                     struct sk_buff *skb)
1858 {
1859         struct hci_cp_le_set_scan_enable *cp;
1860         struct hci_ev_status *rp = data;
1861
1862         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1863
1864         if (rp->status)
1865                 return rp->status;
1866
1867         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1868         if (!cp)
1869                 return rp->status;
1870
1871         le_set_scan_enable_complete(hdev, cp->enable);
1872
1873         return rp->status;
1874 }
1875
1876 static u8 hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev, void *data,
1877                                         struct sk_buff *skb)
1878 {
1879         struct hci_cp_le_set_ext_scan_enable *cp;
1880         struct hci_ev_status *rp = data;
1881
1882         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1883
1884         if (rp->status)
1885                 return rp->status;
1886
1887         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1888         if (!cp)
1889                 return rp->status;
1890
1891         le_set_scan_enable_complete(hdev, cp->enable);
1892
1893         return rp->status;
1894 }
1895
1896 static u8 hci_cc_le_read_num_adv_sets(struct hci_dev *hdev, void *data,
1897                                       struct sk_buff *skb)
1898 {
1899         struct hci_rp_le_read_num_supported_adv_sets *rp = data;
1900
1901         bt_dev_dbg(hdev, "status 0x%2.2x No of Adv sets %u", rp->status,
1902                    rp->num_of_sets);
1903
1904         if (rp->status)
1905                 return rp->status;
1906
1907         hdev->le_num_of_adv_sets = rp->num_of_sets;
1908
1909         return rp->status;
1910 }
1911
1912 static u8 hci_cc_le_read_accept_list_size(struct hci_dev *hdev, void *data,
1913                                           struct sk_buff *skb)
1914 {
1915         struct hci_rp_le_read_accept_list_size *rp = data;
1916
1917         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
1918
1919         if (rp->status)
1920                 return rp->status;
1921
1922         hdev->le_accept_list_size = rp->size;
1923
1924         return rp->status;
1925 }
1926
1927 static u8 hci_cc_le_clear_accept_list(struct hci_dev *hdev, void *data,
1928                                       struct sk_buff *skb)
1929 {
1930         struct hci_ev_status *rp = data;
1931
1932         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1933
1934         if (rp->status)
1935                 return rp->status;
1936
1937         hci_dev_lock(hdev);
1938         hci_bdaddr_list_clear(&hdev->le_accept_list);
1939         hci_dev_unlock(hdev);
1940
1941         return rp->status;
1942 }
1943
1944 static u8 hci_cc_le_add_to_accept_list(struct hci_dev *hdev, void *data,
1945                                        struct sk_buff *skb)
1946 {
1947         struct hci_cp_le_add_to_accept_list *sent;
1948         struct hci_ev_status *rp = data;
1949
1950         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1951
1952         if (rp->status)
1953                 return rp->status;
1954
1955         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1956         if (!sent)
1957                 return rp->status;
1958
1959         hci_dev_lock(hdev);
1960         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1961                             sent->bdaddr_type);
1962         hci_dev_unlock(hdev);
1963
1964         return rp->status;
1965 }
1966
1967 static u8 hci_cc_le_del_from_accept_list(struct hci_dev *hdev, void *data,
1968                                          struct sk_buff *skb)
1969 {
1970         struct hci_cp_le_del_from_accept_list *sent;
1971         struct hci_ev_status *rp = data;
1972
1973         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1974
1975         if (rp->status)
1976                 return rp->status;
1977
1978         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1979         if (!sent)
1980                 return rp->status;
1981
1982         hci_dev_lock(hdev);
1983         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1984                             sent->bdaddr_type);
1985         hci_dev_unlock(hdev);
1986
1987         return rp->status;
1988 }
1989
1990 static u8 hci_cc_le_read_supported_states(struct hci_dev *hdev, void *data,
1991                                           struct sk_buff *skb)
1992 {
1993         struct hci_rp_le_read_supported_states *rp = data;
1994
1995         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
1996
1997         if (rp->status)
1998                 return rp->status;
1999
2000         memcpy(hdev->le_states, rp->le_states, 8);
2001
2002         return rp->status;
2003 }
2004
2005 static u8 hci_cc_le_read_def_data_len(struct hci_dev *hdev, void *data,
2006                                       struct sk_buff *skb)
2007 {
2008         struct hci_rp_le_read_def_data_len *rp = data;
2009
2010         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2011
2012         if (rp->status)
2013                 return rp->status;
2014
2015         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
2016         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
2017
2018         return rp->status;
2019 }
2020
2021 static u8 hci_cc_le_write_def_data_len(struct hci_dev *hdev, void *data,
2022                                        struct sk_buff *skb)
2023 {
2024         struct hci_cp_le_write_def_data_len *sent;
2025         struct hci_ev_status *rp = data;
2026
2027         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2028
2029         if (rp->status)
2030                 return rp->status;
2031
2032         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
2033         if (!sent)
2034                 return rp->status;
2035
2036         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
2037         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
2038
2039         return rp->status;
2040 }
2041
2042 static u8 hci_cc_le_add_to_resolv_list(struct hci_dev *hdev, void *data,
2043                                        struct sk_buff *skb)
2044 {
2045         struct hci_cp_le_add_to_resolv_list *sent;
2046         struct hci_ev_status *rp = data;
2047
2048         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2049
2050         if (rp->status)
2051                 return rp->status;
2052
2053         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
2054         if (!sent)
2055                 return rp->status;
2056
2057         hci_dev_lock(hdev);
2058         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2059                                 sent->bdaddr_type, sent->peer_irk,
2060                                 sent->local_irk);
2061         hci_dev_unlock(hdev);
2062
2063         return rp->status;
2064 }
2065
2066 static u8 hci_cc_le_del_from_resolv_list(struct hci_dev *hdev, void *data,
2067                                          struct sk_buff *skb)
2068 {
2069         struct hci_cp_le_del_from_resolv_list *sent;
2070         struct hci_ev_status *rp = data;
2071
2072         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2073
2074         if (rp->status)
2075                 return rp->status;
2076
2077         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
2078         if (!sent)
2079                 return rp->status;
2080
2081         hci_dev_lock(hdev);
2082         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
2083                             sent->bdaddr_type);
2084         hci_dev_unlock(hdev);
2085
2086         return rp->status;
2087 }
2088
2089 static u8 hci_cc_le_clear_resolv_list(struct hci_dev *hdev, void *data,
2090                                       struct sk_buff *skb)
2091 {
2092         struct hci_ev_status *rp = data;
2093
2094         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2095
2096         if (rp->status)
2097                 return rp->status;
2098
2099         hci_dev_lock(hdev);
2100         hci_bdaddr_list_clear(&hdev->le_resolv_list);
2101         hci_dev_unlock(hdev);
2102
2103         return rp->status;
2104 }
2105
2106 static u8 hci_cc_le_read_resolv_list_size(struct hci_dev *hdev, void *data,
2107                                           struct sk_buff *skb)
2108 {
2109         struct hci_rp_le_read_resolv_list_size *rp = data;
2110
2111         bt_dev_dbg(hdev, "status 0x%2.2x size %u", rp->status, rp->size);
2112
2113         if (rp->status)
2114                 return rp->status;
2115
2116         hdev->le_resolv_list_size = rp->size;
2117
2118         return rp->status;
2119 }
2120
2121 static u8 hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev, void *data,
2122                                                struct sk_buff *skb)
2123 {
2124         struct hci_ev_status *rp = data;
2125         __u8 *sent;
2126
2127         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2128
2129         if (rp->status)
2130                 return rp->status;
2131
2132         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
2133         if (!sent)
2134                 return rp->status;
2135
2136         hci_dev_lock(hdev);
2137
2138         if (*sent)
2139                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
2140         else
2141                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
2142
2143         hci_dev_unlock(hdev);
2144
2145         return rp->status;
2146 }
2147
2148 static u8 hci_cc_le_read_max_data_len(struct hci_dev *hdev, void *data,
2149                                       struct sk_buff *skb)
2150 {
2151         struct hci_rp_le_read_max_data_len *rp = data;
2152
2153         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2154
2155         if (rp->status)
2156                 return rp->status;
2157
2158         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
2159         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
2160         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
2161         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
2162
2163         return rp->status;
2164 }
2165
2166 static u8 hci_cc_write_le_host_supported(struct hci_dev *hdev, void *data,
2167                                          struct sk_buff *skb)
2168 {
2169         struct hci_cp_write_le_host_supported *sent;
2170         struct hci_ev_status *rp = data;
2171
2172         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2173
2174         if (rp->status)
2175                 return rp->status;
2176
2177         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
2178         if (!sent)
2179                 return rp->status;
2180
2181         hci_dev_lock(hdev);
2182
2183         if (sent->le) {
2184                 hdev->features[1][0] |= LMP_HOST_LE;
2185                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2186         } else {
2187                 hdev->features[1][0] &= ~LMP_HOST_LE;
2188                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
2189                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
2190         }
2191
2192         if (sent->simul)
2193                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
2194         else
2195                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
2196
2197         hci_dev_unlock(hdev);
2198
2199         return rp->status;
2200 }
2201
2202 static u8 hci_cc_set_adv_param(struct hci_dev *hdev, void *data,
2203                                struct sk_buff *skb)
2204 {
2205         struct hci_cp_le_set_adv_param *cp;
2206         struct hci_ev_status *rp = data;
2207
2208         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2209
2210         if (rp->status)
2211                 return rp->status;
2212
2213         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
2214         if (!cp)
2215                 return rp->status;
2216
2217         hci_dev_lock(hdev);
2218         hdev->adv_addr_type = cp->own_address_type;
2219         hci_dev_unlock(hdev);
2220
2221         return rp->status;
2222 }
2223
2224 static u8 hci_cc_set_ext_adv_param(struct hci_dev *hdev, void *data,
2225                                    struct sk_buff *skb)
2226 {
2227         struct hci_rp_le_set_ext_adv_params *rp = data;
2228         struct hci_cp_le_set_ext_adv_params *cp;
2229         struct adv_info *adv_instance;
2230
2231         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2232
2233         if (rp->status)
2234                 return rp->status;
2235
2236         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
2237         if (!cp)
2238                 return rp->status;
2239
2240         hci_dev_lock(hdev);
2241         hdev->adv_addr_type = cp->own_addr_type;
2242         if (!cp->handle) {
2243                 /* Store in hdev for instance 0 */
2244                 hdev->adv_tx_power = rp->tx_power;
2245         } else {
2246                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
2247                 if (adv_instance)
2248                         adv_instance->tx_power = rp->tx_power;
2249         }
2250         /* Update adv data as tx power is known now */
2251         hci_update_adv_data(hdev, cp->handle);
2252
2253         hci_dev_unlock(hdev);
2254
2255         return rp->status;
2256 }
2257
2258 #ifdef TIZEN_BT
2259 static u8 hci_cc_enable_rssi(struct hci_dev *hdev, void *data,
2260                              struct sk_buff *skb)
2261 {
2262         struct hci_cc_rsp_enable_rssi *rp = data;
2263
2264         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
2265                hdev->name, rp->status, rp->le_ext_opcode);
2266
2267         mgmt_enable_rssi_cc(hdev, rp, rp->status);
2268
2269         return rp->status;
2270 }
2271
2272 static u8 hci_cc_get_raw_rssi(struct hci_dev *hdev, void *data,
2273                               struct sk_buff *skb)
2274 {
2275         struct hci_cc_rp_get_raw_rssi *rp = data;
2276
2277         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
2278                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
2279
2280         mgmt_raw_rssi_response(hdev, rp, rp->status);
2281
2282         return rp->status;
2283 }
2284
2285 static void hci_vendor_ext_rssi_link_alert_evt(struct hci_dev *hdev,
2286                                                struct sk_buff *skb)
2287 {
2288         struct hci_ev_vendor_specific_rssi_alert *ev = (void *)skb->data;
2289
2290         BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X", LE_RSSI_LINK_ALERT);
2291
2292         mgmt_rssi_alert_evt(hdev, ev->conn_handle, ev->alert_type,
2293                             ev->rssi_dbm);
2294 }
2295
2296 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
2297                                               struct sk_buff *skb)
2298 {
2299         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
2300         __u8 event_le_ext_sub_code;
2301
2302         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
2303                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
2304
2305         skb_pull(skb, sizeof(*ev));
2306         event_le_ext_sub_code = ev->event_le_ext_sub_code;
2307
2308         switch (event_le_ext_sub_code) {
2309         case LE_RSSI_LINK_ALERT:
2310                 hci_vendor_ext_rssi_link_alert_evt(hdev, skb);
2311                 break;
2312
2313         default:
2314                 break;
2315         }
2316 }
2317
2318 static void hci_vendor_multi_adv_state_change_evt(struct hci_dev *hdev,
2319                                                   struct sk_buff *skb)
2320 {
2321         struct hci_ev_vendor_specific_multi_adv_state *ev = (void *)skb->data;
2322
2323         BT_DBG("LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT");
2324
2325         mgmt_multi_adv_state_change_evt(hdev, ev->adv_instance,
2326                                         ev->state_change_reason,
2327                                         ev->connection_handle);
2328 }
2329
2330 static void hci_vendor_specific_evt(struct hci_dev *hdev, void *data,
2331                                     struct sk_buff *skb)
2332 {
2333         struct hci_ev_vendor_specific *ev = (void *)skb->data;
2334         __u8 event_sub_code;
2335
2336         BT_DBG("hci_vendor_specific_evt");
2337
2338         skb_pull(skb, sizeof(*ev));
2339         event_sub_code = ev->event_sub_code;
2340
2341         switch (event_sub_code) {
2342         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
2343                 hci_vendor_specific_group_ext_evt(hdev, skb);
2344                 break;
2345
2346         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
2347                 hci_vendor_multi_adv_state_change_evt(hdev, skb);
2348                 break;
2349
2350         default:
2351                 break;
2352         }
2353 }
2354 #endif
2355
2356 static u8 hci_cc_read_rssi(struct hci_dev *hdev, void *data,
2357                            struct sk_buff *skb)
2358 {
2359         struct hci_rp_read_rssi *rp = data;
2360         struct hci_conn *conn;
2361
2362         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2363
2364         if (rp->status)
2365                 return rp->status;
2366
2367         hci_dev_lock(hdev);
2368
2369         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2370         if (conn)
2371                 conn->rssi = rp->rssi;
2372
2373         hci_dev_unlock(hdev);
2374
2375         return rp->status;
2376 }
2377
2378 static u8 hci_cc_read_tx_power(struct hci_dev *hdev, void *data,
2379                                struct sk_buff *skb)
2380 {
2381         struct hci_cp_read_tx_power *sent;
2382         struct hci_rp_read_tx_power *rp = data;
2383         struct hci_conn *conn;
2384
2385         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2386
2387         if (rp->status)
2388                 return rp->status;
2389
2390         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
2391         if (!sent)
2392                 return rp->status;
2393
2394         hci_dev_lock(hdev);
2395
2396         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
2397         if (!conn)
2398                 goto unlock;
2399
2400         switch (sent->type) {
2401         case 0x00:
2402                 conn->tx_power = rp->tx_power;
2403                 break;
2404         case 0x01:
2405                 conn->max_tx_power = rp->tx_power;
2406                 break;
2407         }
2408
2409 unlock:
2410         hci_dev_unlock(hdev);
2411         return rp->status;
2412 }
2413
2414 static u8 hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, void *data,
2415                                       struct sk_buff *skb)
2416 {
2417         struct hci_ev_status *rp = data;
2418         u8 *mode;
2419
2420         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
2421
2422         if (rp->status)
2423                 return rp->status;
2424
2425         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
2426         if (mode)
2427                 hdev->ssp_debug_mode = *mode;
2428
2429         return rp->status;
2430 }
2431
2432 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
2433 {
2434         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2435
2436         if (status) {
2437                 hci_conn_check_pending(hdev);
2438                 return;
2439         }
2440
2441         if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
2442                 set_bit(HCI_INQUIRY, &hdev->flags);
2443 }
2444
2445 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
2446 {
2447         struct hci_cp_create_conn *cp;
2448         struct hci_conn *conn;
2449
2450         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2451
2452         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
2453         if (!cp)
2454                 return;
2455
2456         hci_dev_lock(hdev);
2457
2458         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2459
2460         bt_dev_dbg(hdev, "bdaddr %pMR hcon %p", &cp->bdaddr, conn);
2461
2462         if (status) {
2463                 if (conn && conn->state == BT_CONNECT) {
2464                         if (status != 0x0c || conn->attempt > 2) {
2465                                 conn->state = BT_CLOSED;
2466                                 hci_connect_cfm(conn, status);
2467                                 hci_conn_del(conn);
2468                         } else
2469                                 conn->state = BT_CONNECT2;
2470                 }
2471         } else {
2472                 if (!conn) {
2473                         conn = hci_conn_add_unset(hdev, ACL_LINK, &cp->bdaddr,
2474                                                   HCI_ROLE_MASTER);
2475                         if (!conn)
2476                                 bt_dev_err(hdev, "no memory for new connection");
2477                 }
2478         }
2479
2480         hci_dev_unlock(hdev);
2481 }
2482
2483 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2484 {
2485         struct hci_cp_add_sco *cp;
2486         struct hci_conn *acl;
2487         struct hci_link *link;
2488         __u16 handle;
2489
2490         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2491
2492         if (!status)
2493                 return;
2494
2495         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2496         if (!cp)
2497                 return;
2498
2499         handle = __le16_to_cpu(cp->handle);
2500
2501         bt_dev_dbg(hdev, "handle 0x%4.4x", handle);
2502
2503         hci_dev_lock(hdev);
2504
2505         acl = hci_conn_hash_lookup_handle(hdev, handle);
2506         if (acl) {
2507                 link = list_first_entry_or_null(&acl->link_list,
2508                                                 struct hci_link, list);
2509                 if (link && link->conn) {
2510                         link->conn->state = BT_CLOSED;
2511
2512                         hci_connect_cfm(link->conn, status);
2513                         hci_conn_del(link->conn);
2514                 }
2515         }
2516
2517         hci_dev_unlock(hdev);
2518 }
2519
2520 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2521 {
2522         struct hci_cp_auth_requested *cp;
2523         struct hci_conn *conn;
2524
2525         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2526
2527         if (!status)
2528                 return;
2529
2530         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2531         if (!cp)
2532                 return;
2533
2534         hci_dev_lock(hdev);
2535
2536         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2537         if (conn) {
2538                 if (conn->state == BT_CONFIG) {
2539                         hci_connect_cfm(conn, status);
2540                         hci_conn_drop(conn);
2541                 }
2542         }
2543
2544         hci_dev_unlock(hdev);
2545 }
2546
2547 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2548 {
2549         struct hci_cp_set_conn_encrypt *cp;
2550         struct hci_conn *conn;
2551
2552         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2553
2554         if (!status)
2555                 return;
2556
2557         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2558         if (!cp)
2559                 return;
2560
2561         hci_dev_lock(hdev);
2562
2563         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2564         if (conn) {
2565                 if (conn->state == BT_CONFIG) {
2566                         hci_connect_cfm(conn, status);
2567                         hci_conn_drop(conn);
2568                 }
2569         }
2570
2571         hci_dev_unlock(hdev);
2572 }
2573
2574 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2575                                     struct hci_conn *conn)
2576 {
2577         if (conn->state != BT_CONFIG || !conn->out)
2578                 return 0;
2579
2580         if (conn->pending_sec_level == BT_SECURITY_SDP)
2581                 return 0;
2582
2583         /* Only request authentication for SSP connections or non-SSP
2584          * devices with sec_level MEDIUM or HIGH or if MITM protection
2585          * is requested.
2586          */
2587         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2588             conn->pending_sec_level != BT_SECURITY_FIPS &&
2589             conn->pending_sec_level != BT_SECURITY_HIGH &&
2590             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2591                 return 0;
2592
2593         return 1;
2594 }
2595
2596 static int hci_resolve_name(struct hci_dev *hdev,
2597                                    struct inquiry_entry *e)
2598 {
2599         struct hci_cp_remote_name_req cp;
2600
2601         memset(&cp, 0, sizeof(cp));
2602
2603         bacpy(&cp.bdaddr, &e->data.bdaddr);
2604         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2605         cp.pscan_mode = e->data.pscan_mode;
2606         cp.clock_offset = e->data.clock_offset;
2607
2608         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2609 }
2610
2611 static bool hci_resolve_next_name(struct hci_dev *hdev)
2612 {
2613         struct discovery_state *discov = &hdev->discovery;
2614         struct inquiry_entry *e;
2615
2616         if (list_empty(&discov->resolve))
2617                 return false;
2618
2619         /* We should stop if we already spent too much time resolving names. */
2620         if (time_after(jiffies, discov->name_resolve_timeout)) {
2621                 bt_dev_warn_ratelimited(hdev, "Name resolve takes too long.");
2622                 return false;
2623         }
2624
2625         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2626         if (!e)
2627                 return false;
2628
2629         if (hci_resolve_name(hdev, e) == 0) {
2630                 e->name_state = NAME_PENDING;
2631                 return true;
2632         }
2633
2634         return false;
2635 }
2636
2637 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2638                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2639 {
2640         struct discovery_state *discov = &hdev->discovery;
2641         struct inquiry_entry *e;
2642
2643 #ifdef TIZEN_BT
2644         /* Update the mgmt connected state if necessary. Be careful with
2645          * conn objects that exist but are not (yet) connected however.
2646          * Only those in BT_CONFIG or BT_CONNECTED states can be
2647          * considered connected.
2648          */
2649         if (conn &&
2650             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2651                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2652                         mgmt_device_connected(hdev, conn, name, name_len);
2653                 else
2654                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2655         }
2656 #else
2657         if (conn &&
2658             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2659             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2660                 mgmt_device_connected(hdev, conn, name, name_len);
2661 #endif
2662
2663         if (discov->state == DISCOVERY_STOPPED)
2664                 return;
2665
2666         if (discov->state == DISCOVERY_STOPPING)
2667                 goto discov_complete;
2668
2669         if (discov->state != DISCOVERY_RESOLVING)
2670                 return;
2671
2672         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2673         /* If the device was not found in a list of found devices names of which
2674          * are pending. there is no need to continue resolving a next name as it
2675          * will be done upon receiving another Remote Name Request Complete
2676          * Event */
2677         if (!e)
2678                 return;
2679
2680         list_del(&e->list);
2681
2682         e->name_state = name ? NAME_KNOWN : NAME_NOT_KNOWN;
2683         mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00, e->data.rssi,
2684                          name, name_len);
2685
2686         if (hci_resolve_next_name(hdev))
2687                 return;
2688
2689 discov_complete:
2690         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2691 }
2692
2693 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2694 {
2695         struct hci_cp_remote_name_req *cp;
2696         struct hci_conn *conn;
2697
2698         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2699
2700         /* If successful wait for the name req complete event before
2701          * checking for the need to do authentication */
2702         if (!status)
2703                 return;
2704
2705         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2706         if (!cp)
2707                 return;
2708
2709         hci_dev_lock(hdev);
2710
2711         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2712
2713         if (hci_dev_test_flag(hdev, HCI_MGMT))
2714                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2715
2716         if (!conn)
2717                 goto unlock;
2718
2719         if (!hci_outgoing_auth_needed(hdev, conn))
2720                 goto unlock;
2721
2722         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2723                 struct hci_cp_auth_requested auth_cp;
2724
2725                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2726
2727                 auth_cp.handle = __cpu_to_le16(conn->handle);
2728                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2729                              sizeof(auth_cp), &auth_cp);
2730         }
2731
2732 unlock:
2733         hci_dev_unlock(hdev);
2734 }
2735
2736 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2737 {
2738         struct hci_cp_read_remote_features *cp;
2739         struct hci_conn *conn;
2740
2741         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2742
2743         if (!status)
2744                 return;
2745
2746         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2747         if (!cp)
2748                 return;
2749
2750         hci_dev_lock(hdev);
2751
2752         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2753         if (conn) {
2754                 if (conn->state == BT_CONFIG) {
2755                         hci_connect_cfm(conn, status);
2756                         hci_conn_drop(conn);
2757                 }
2758         }
2759
2760         hci_dev_unlock(hdev);
2761 }
2762
2763 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2764 {
2765         struct hci_cp_read_remote_ext_features *cp;
2766         struct hci_conn *conn;
2767
2768         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2769
2770         if (!status)
2771                 return;
2772
2773         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2774         if (!cp)
2775                 return;
2776
2777         hci_dev_lock(hdev);
2778
2779         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2780         if (conn) {
2781                 if (conn->state == BT_CONFIG) {
2782                         hci_connect_cfm(conn, status);
2783                         hci_conn_drop(conn);
2784                 }
2785         }
2786
2787         hci_dev_unlock(hdev);
2788 }
2789
2790 static void hci_setup_sync_conn_status(struct hci_dev *hdev, __u16 handle,
2791                                        __u8 status)
2792 {
2793         struct hci_conn *acl;
2794         struct hci_link *link;
2795
2796         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x", handle, status);
2797
2798         hci_dev_lock(hdev);
2799
2800         acl = hci_conn_hash_lookup_handle(hdev, handle);
2801         if (acl) {
2802                 link = list_first_entry_or_null(&acl->link_list,
2803                                                 struct hci_link, list);
2804                 if (link && link->conn) {
2805                         link->conn->state = BT_CLOSED;
2806
2807                         hci_connect_cfm(link->conn, status);
2808                         hci_conn_del(link->conn);
2809                 }
2810         }
2811
2812         hci_dev_unlock(hdev);
2813 }
2814
2815 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2816 {
2817         struct hci_cp_setup_sync_conn *cp;
2818
2819         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2820
2821         if (!status)
2822                 return;
2823
2824         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2825         if (!cp)
2826                 return;
2827
2828         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2829 }
2830
2831 static void hci_cs_enhanced_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2832 {
2833         struct hci_cp_enhanced_setup_sync_conn *cp;
2834
2835         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2836
2837         if (!status)
2838                 return;
2839
2840         cp = hci_sent_cmd_data(hdev, HCI_OP_ENHANCED_SETUP_SYNC_CONN);
2841         if (!cp)
2842                 return;
2843
2844         hci_setup_sync_conn_status(hdev, __le16_to_cpu(cp->handle), status);
2845 }
2846
2847 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2848 {
2849         struct hci_cp_sniff_mode *cp;
2850         struct hci_conn *conn;
2851
2852         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2853
2854         if (!status)
2855                 return;
2856
2857         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2858         if (!cp)
2859                 return;
2860
2861         hci_dev_lock(hdev);
2862
2863         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2864         if (conn) {
2865                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2866
2867                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2868                         hci_sco_setup(conn, status);
2869         }
2870
2871         hci_dev_unlock(hdev);
2872 }
2873
2874 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2875 {
2876         struct hci_cp_exit_sniff_mode *cp;
2877         struct hci_conn *conn;
2878
2879         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2880
2881         if (!status)
2882                 return;
2883
2884         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2885         if (!cp)
2886                 return;
2887
2888         hci_dev_lock(hdev);
2889
2890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2891         if (conn) {
2892                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2893
2894                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2895                         hci_sco_setup(conn, status);
2896         }
2897
2898         hci_dev_unlock(hdev);
2899 }
2900
2901 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2902 {
2903         struct hci_cp_disconnect *cp;
2904         struct hci_conn_params *params;
2905         struct hci_conn *conn;
2906         bool mgmt_conn;
2907
2908         bt_dev_dbg(hdev, "status 0x%2.2x", status);
2909
2910         /* Wait for HCI_EV_DISCONN_COMPLETE if status 0x00 and not suspended
2911          * otherwise cleanup the connection immediately.
2912          */
2913         if (!status && !hdev->suspended)
2914                 return;
2915
2916         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2917         if (!cp)
2918                 return;
2919
2920         hci_dev_lock(hdev);
2921
2922         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2923         if (!conn)
2924                 goto unlock;
2925
2926         if (status) {
2927                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2928                                        conn->dst_type, status);
2929
2930                 if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
2931                         hdev->cur_adv_instance = conn->adv_instance;
2932                         hci_enable_advertising(hdev);
2933                 }
2934
2935                 /* Inform sockets conn is gone before we delete it */
2936                 hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED);
2937
2938                 goto done;
2939         }
2940
2941         mgmt_conn = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2942
2943         if (conn->type == ACL_LINK) {
2944                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2945                         hci_remove_link_key(hdev, &conn->dst);
2946         }
2947
2948         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2949         if (params) {
2950                 switch (params->auto_connect) {
2951                 case HCI_AUTO_CONN_LINK_LOSS:
2952                         if (cp->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2953                                 break;
2954                         fallthrough;
2955
2956                 case HCI_AUTO_CONN_DIRECT:
2957                 case HCI_AUTO_CONN_ALWAYS:
2958                         hci_pend_le_list_del_init(params);
2959                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
2960                         break;
2961
2962                 default:
2963                         break;
2964                 }
2965         }
2966
2967         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2968                                  cp->reason, mgmt_conn);
2969
2970         hci_disconn_cfm(conn, cp->reason);
2971
2972 done:
2973         /* If the disconnection failed for any reason, the upper layer
2974          * does not retry to disconnect in current implementation.
2975          * Hence, we need to do some basic cleanup here and re-enable
2976          * advertising if necessary.
2977          */
2978         hci_conn_del(conn);
2979 unlock:
2980         hci_dev_unlock(hdev);
2981 }
2982
2983 static u8 ev_bdaddr_type(struct hci_dev *hdev, u8 type, bool *resolved)
2984 {
2985         /* When using controller based address resolution, then the new
2986          * address types 0x02 and 0x03 are used. These types need to be
2987          * converted back into either public address or random address type
2988          */
2989         switch (type) {
2990         case ADDR_LE_DEV_PUBLIC_RESOLVED:
2991                 if (resolved)
2992                         *resolved = true;
2993                 return ADDR_LE_DEV_PUBLIC;
2994         case ADDR_LE_DEV_RANDOM_RESOLVED:
2995                 if (resolved)
2996                         *resolved = true;
2997                 return ADDR_LE_DEV_RANDOM;
2998         }
2999
3000         if (resolved)
3001                 *resolved = false;
3002         return type;
3003 }
3004
3005 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
3006                               u8 peer_addr_type, u8 own_address_type,
3007                               u8 filter_policy)
3008 {
3009         struct hci_conn *conn;
3010
3011         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
3012                                        peer_addr_type);
3013         if (!conn)
3014                 return;
3015
3016         own_address_type = ev_bdaddr_type(hdev, own_address_type, NULL);
3017
3018         /* Store the initiator and responder address information which
3019          * is needed for SMP. These values will not change during the
3020          * lifetime of the connection.
3021          */
3022         conn->init_addr_type = own_address_type;
3023         if (own_address_type == ADDR_LE_DEV_RANDOM)
3024                 bacpy(&conn->init_addr, &hdev->random_addr);
3025         else
3026                 bacpy(&conn->init_addr, &hdev->bdaddr);
3027
3028         conn->resp_addr_type = peer_addr_type;
3029         bacpy(&conn->resp_addr, peer_addr);
3030 }
3031
3032 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
3033 {
3034         struct hci_cp_le_create_conn *cp;
3035
3036         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3037
3038         /* All connection failure handling is taken care of by the
3039          * hci_conn_failed function which is triggered by the HCI
3040          * request completion callbacks used for connecting.
3041          */
3042         if (status)
3043                 return;
3044
3045         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
3046         if (!cp)
3047                 return;
3048
3049         hci_dev_lock(hdev);
3050
3051         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
3052                           cp->own_address_type, cp->filter_policy);
3053
3054         hci_dev_unlock(hdev);
3055 }
3056
3057 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
3058 {
3059         struct hci_cp_le_ext_create_conn *cp;
3060
3061         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3062
3063         /* All connection failure handling is taken care of by the
3064          * hci_conn_failed function which is triggered by the HCI
3065          * request completion callbacks used for connecting.
3066          */
3067         if (status)
3068                 return;
3069
3070         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
3071         if (!cp)
3072                 return;
3073
3074         hci_dev_lock(hdev);
3075
3076         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
3077                           cp->own_addr_type, cp->filter_policy);
3078
3079         hci_dev_unlock(hdev);
3080 }
3081
3082 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
3083 {
3084         struct hci_cp_le_read_remote_features *cp;
3085         struct hci_conn *conn;
3086
3087         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3088
3089         if (!status)
3090                 return;
3091
3092         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
3093         if (!cp)
3094                 return;
3095
3096         hci_dev_lock(hdev);
3097
3098         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3099         if (conn) {
3100                 if (conn->state == BT_CONFIG) {
3101                         hci_connect_cfm(conn, status);
3102                         hci_conn_drop(conn);
3103                 }
3104         }
3105
3106         hci_dev_unlock(hdev);
3107 }
3108
3109 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
3110 {
3111         struct hci_cp_le_start_enc *cp;
3112         struct hci_conn *conn;
3113
3114         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3115
3116         if (!status)
3117                 return;
3118
3119         hci_dev_lock(hdev);
3120
3121         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
3122         if (!cp)
3123                 goto unlock;
3124
3125         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
3126         if (!conn)
3127                 goto unlock;
3128
3129         if (conn->state != BT_CONNECTED)
3130                 goto unlock;
3131
3132         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3133         hci_conn_drop(conn);
3134
3135 unlock:
3136         hci_dev_unlock(hdev);
3137 }
3138
3139 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
3140 {
3141         struct hci_cp_switch_role *cp;
3142         struct hci_conn *conn;
3143
3144         BT_DBG("%s status 0x%2.2x", hdev->name, status);
3145
3146         if (!status)
3147                 return;
3148
3149         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
3150         if (!cp)
3151                 return;
3152
3153         hci_dev_lock(hdev);
3154
3155         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
3156         if (conn)
3157                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3158
3159         hci_dev_unlock(hdev);
3160 }
3161
3162 static void hci_inquiry_complete_evt(struct hci_dev *hdev, void *data,
3163                                      struct sk_buff *skb)
3164 {
3165         struct hci_ev_status *ev = data;
3166         struct discovery_state *discov = &hdev->discovery;
3167         struct inquiry_entry *e;
3168
3169         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3170
3171         hci_conn_check_pending(hdev);
3172
3173         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
3174                 return;
3175
3176         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
3177         wake_up_bit(&hdev->flags, HCI_INQUIRY);
3178
3179         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3180                 return;
3181
3182         hci_dev_lock(hdev);
3183
3184         if (discov->state != DISCOVERY_FINDING)
3185                 goto unlock;
3186
3187         if (list_empty(&discov->resolve)) {
3188                 /* When BR/EDR inquiry is active and no LE scanning is in
3189                  * progress, then change discovery state to indicate completion.
3190                  *
3191                  * When running LE scanning and BR/EDR inquiry simultaneously
3192                  * and the LE scan already finished, then change the discovery
3193                  * state to indicate completion.
3194                  */
3195                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3196                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3197                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3198                 goto unlock;
3199         }
3200
3201         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
3202         if (e && hci_resolve_name(hdev, e) == 0) {
3203                 e->name_state = NAME_PENDING;
3204                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
3205                 discov->name_resolve_timeout = jiffies + NAME_RESOLVE_DURATION;
3206         } else {
3207                 /* When BR/EDR inquiry is active and no LE scanning is in
3208                  * progress, then change discovery state to indicate completion.
3209                  *
3210                  * When running LE scanning and BR/EDR inquiry simultaneously
3211                  * and the LE scan already finished, then change the discovery
3212                  * state to indicate completion.
3213                  */
3214                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
3215                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
3216                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3217         }
3218
3219 unlock:
3220         hci_dev_unlock(hdev);
3221 }
3222
3223 static void hci_inquiry_result_evt(struct hci_dev *hdev, void *edata,
3224                                    struct sk_buff *skb)
3225 {
3226         struct hci_ev_inquiry_result *ev = edata;
3227         struct inquiry_data data;
3228         int i;
3229
3230         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_INQUIRY_RESULT,
3231                              flex_array_size(ev, info, ev->num)))
3232                 return;
3233
3234         bt_dev_dbg(hdev, "num %d", ev->num);
3235
3236         if (!ev->num)
3237                 return;
3238
3239         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
3240                 return;
3241
3242         hci_dev_lock(hdev);
3243
3244         for (i = 0; i < ev->num; i++) {
3245                 struct inquiry_info *info = &ev->info[i];
3246                 u32 flags;
3247
3248                 bacpy(&data.bdaddr, &info->bdaddr);
3249                 data.pscan_rep_mode     = info->pscan_rep_mode;
3250                 data.pscan_period_mode  = info->pscan_period_mode;
3251                 data.pscan_mode         = info->pscan_mode;
3252                 memcpy(data.dev_class, info->dev_class, 3);
3253                 data.clock_offset       = info->clock_offset;
3254                 data.rssi               = HCI_RSSI_INVALID;
3255                 data.ssp_mode           = 0x00;
3256
3257                 flags = hci_inquiry_cache_update(hdev, &data, false);
3258
3259                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3260                                   info->dev_class, HCI_RSSI_INVALID,
3261                                   flags, NULL, 0, NULL, 0, 0);
3262         }
3263
3264         hci_dev_unlock(hdev);
3265 }
3266
3267 static void hci_conn_complete_evt(struct hci_dev *hdev, void *data,
3268                                   struct sk_buff *skb)
3269 {
3270         struct hci_ev_conn_complete *ev = data;
3271         struct hci_conn *conn;
3272         u8 status = ev->status;
3273
3274         bt_dev_dbg(hdev, "status 0x%2.2x", status);
3275
3276         hci_dev_lock(hdev);
3277
3278         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3279         if (!conn) {
3280                 /* In case of error status and there is no connection pending
3281                  * just unlock as there is nothing to cleanup.
3282                  */
3283                 if (ev->status)
3284                         goto unlock;
3285
3286                 /* Connection may not exist if auto-connected. Check the bredr
3287                  * allowlist to see if this device is allowed to auto connect.
3288                  * If link is an ACL type, create a connection class
3289                  * automatically.
3290                  *
3291                  * Auto-connect will only occur if the event filter is
3292                  * programmed with a given address. Right now, event filter is
3293                  * only used during suspend.
3294                  */
3295                 if (ev->link_type == ACL_LINK &&
3296                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
3297                                                       &ev->bdaddr,
3298                                                       BDADDR_BREDR)) {
3299                         conn = hci_conn_add_unset(hdev, ev->link_type,
3300                                                   &ev->bdaddr, HCI_ROLE_SLAVE);
3301                         if (!conn) {
3302                                 bt_dev_err(hdev, "no memory for new conn");
3303                                 goto unlock;
3304                         }
3305                 } else {
3306                         if (ev->link_type != SCO_LINK)
3307                                 goto unlock;
3308
3309                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
3310                                                        &ev->bdaddr);
3311                         if (!conn)
3312                                 goto unlock;
3313
3314                         conn->type = SCO_LINK;
3315                 }
3316         }
3317
3318         /* The HCI_Connection_Complete event is only sent once per connection.
3319          * Processing it more than once per connection can corrupt kernel memory.
3320          *
3321          * As the connection handle is set here for the first time, it indicates
3322          * whether the connection is already set up.
3323          */
3324         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
3325                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
3326                 goto unlock;
3327         }
3328
3329         if (!status) {
3330                 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
3331                 if (status)
3332                         goto done;
3333
3334                 if (conn->type == ACL_LINK) {
3335                         conn->state = BT_CONFIG;
3336                         hci_conn_hold(conn);
3337
3338                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
3339                             !hci_find_link_key(hdev, &ev->bdaddr))
3340                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3341                         else
3342                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3343                 } else
3344                         conn->state = BT_CONNECTED;
3345
3346                 hci_debugfs_create_conn(conn);
3347                 hci_conn_add_sysfs(conn);
3348
3349                 if (test_bit(HCI_AUTH, &hdev->flags))
3350                         set_bit(HCI_CONN_AUTH, &conn->flags);
3351
3352                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
3353                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3354
3355                 /* Get remote features */
3356                 if (conn->type == ACL_LINK) {
3357                         struct hci_cp_read_remote_features cp;
3358                         cp.handle = ev->handle;
3359                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
3360                                      sizeof(cp), &cp);
3361
3362                         hci_update_scan(hdev);
3363                 }
3364
3365                 /* Set packet type for incoming connection */
3366                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
3367                         struct hci_cp_change_conn_ptype cp;
3368                         cp.handle = ev->handle;
3369                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
3370                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
3371                                      &cp);
3372                 }
3373
3374 #ifdef TIZEN_BT
3375                 if (get_link_mode(conn) & HCI_LM_MASTER)
3376                         hci_conn_change_supervision_timeout(conn,
3377                                         LINK_SUPERVISION_TIMEOUT);
3378 #endif
3379         }
3380
3381         if (conn->type == ACL_LINK)
3382                 hci_sco_setup(conn, ev->status);
3383
3384 done:
3385         if (status) {
3386                 hci_conn_failed(conn, status);
3387         } else if (ev->link_type == SCO_LINK) {
3388                 switch (conn->setting & SCO_AIRMODE_MASK) {
3389                 case SCO_AIRMODE_CVSD:
3390                         if (hdev->notify)
3391                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
3392                         break;
3393                 }
3394
3395                 hci_connect_cfm(conn, status);
3396         }
3397
3398 unlock:
3399         hci_dev_unlock(hdev);
3400
3401         hci_conn_check_pending(hdev);
3402 }
3403
3404 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
3405 {
3406         struct hci_cp_reject_conn_req cp;
3407
3408         bacpy(&cp.bdaddr, bdaddr);
3409         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
3410         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
3411 }
3412
3413 static void hci_conn_request_evt(struct hci_dev *hdev, void *data,
3414                                  struct sk_buff *skb)
3415 {
3416         struct hci_ev_conn_request *ev = data;
3417         int mask = hdev->link_mode;
3418         struct inquiry_entry *ie;
3419         struct hci_conn *conn;
3420         __u8 flags = 0;
3421
3422         bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type);
3423
3424         /* Reject incoming connection from device with same BD ADDR against
3425          * CVE-2020-26555
3426          */
3427         if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
3428                 bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
3429                            &ev->bdaddr);
3430                 hci_reject_conn(hdev, &ev->bdaddr);
3431                 return;
3432         }
3433
3434         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
3435                                       &flags);
3436
3437         if (!(mask & HCI_LM_ACCEPT)) {
3438                 hci_reject_conn(hdev, &ev->bdaddr);
3439                 return;
3440         }
3441
3442         hci_dev_lock(hdev);
3443
3444         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
3445                                    BDADDR_BREDR)) {
3446                 hci_reject_conn(hdev, &ev->bdaddr);
3447                 goto unlock;
3448         }
3449
3450         /* Require HCI_CONNECTABLE or an accept list entry to accept the
3451          * connection. These features are only touched through mgmt so
3452          * only do the checks if HCI_MGMT is set.
3453          */
3454         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
3455             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
3456             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
3457                                                BDADDR_BREDR)) {
3458                 hci_reject_conn(hdev, &ev->bdaddr);
3459                 goto unlock;
3460         }
3461
3462         /* Connection accepted */
3463
3464         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3465         if (ie)
3466                 memcpy(ie->data.dev_class, ev->dev_class, 3);
3467
3468 #ifdef TIZEN_BT
3469                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
3470                     hci_conn_hash_lookup_sco(hdev)) {
3471                         struct hci_cp_reject_conn_req cp;
3472
3473                         bacpy(&cp.bdaddr, &ev->bdaddr);
3474                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
3475                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
3476                                      sizeof(cp), &cp);
3477                         hci_dev_unlock(hdev);
3478                         return;
3479                 }
3480 #endif
3481
3482         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
3483                         &ev->bdaddr);
3484         if (!conn) {
3485                 conn = hci_conn_add_unset(hdev, ev->link_type, &ev->bdaddr,
3486                                           HCI_ROLE_SLAVE);
3487                 if (!conn) {
3488                         bt_dev_err(hdev, "no memory for new connection");
3489                         goto unlock;
3490                 }
3491         }
3492
3493         memcpy(conn->dev_class, ev->dev_class, 3);
3494
3495         hci_dev_unlock(hdev);
3496
3497         if (ev->link_type == ACL_LINK ||
3498             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
3499                 struct hci_cp_accept_conn_req cp;
3500                 conn->state = BT_CONNECT;
3501
3502                 bacpy(&cp.bdaddr, &ev->bdaddr);
3503
3504                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
3505                         cp.role = 0x00; /* Become central */
3506                 else
3507                         cp.role = 0x01; /* Remain peripheral */
3508
3509                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
3510         } else if (!(flags & HCI_PROTO_DEFER)) {
3511                 struct hci_cp_accept_sync_conn_req cp;
3512                 conn->state = BT_CONNECT;
3513
3514                 bacpy(&cp.bdaddr, &ev->bdaddr);
3515                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
3516
3517                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
3518                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
3519                 cp.max_latency    = cpu_to_le16(0xffff);
3520                 cp.content_format = cpu_to_le16(hdev->voice_setting);
3521                 cp.retrans_effort = 0xff;
3522
3523                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
3524                              &cp);
3525         } else {
3526                 conn->state = BT_CONNECT2;
3527                 hci_connect_cfm(conn, 0);
3528         }
3529
3530         return;
3531 unlock:
3532         hci_dev_unlock(hdev);
3533 }
3534
3535 static u8 hci_to_mgmt_reason(u8 err)
3536 {
3537         switch (err) {
3538         case HCI_ERROR_CONNECTION_TIMEOUT:
3539                 return MGMT_DEV_DISCONN_TIMEOUT;
3540         case HCI_ERROR_REMOTE_USER_TERM:
3541         case HCI_ERROR_REMOTE_LOW_RESOURCES:
3542         case HCI_ERROR_REMOTE_POWER_OFF:
3543                 return MGMT_DEV_DISCONN_REMOTE;
3544         case HCI_ERROR_LOCAL_HOST_TERM:
3545                 return MGMT_DEV_DISCONN_LOCAL_HOST;
3546         default:
3547                 return MGMT_DEV_DISCONN_UNKNOWN;
3548         }
3549 }
3550
3551 static void hci_disconn_complete_evt(struct hci_dev *hdev, void *data,
3552                                      struct sk_buff *skb)
3553 {
3554         struct hci_ev_disconn_complete *ev = data;
3555         u8 reason;
3556         struct hci_conn_params *params;
3557         struct hci_conn *conn;
3558         bool mgmt_connected;
3559
3560         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3561
3562         hci_dev_lock(hdev);
3563
3564         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3565         if (!conn)
3566                 goto unlock;
3567
3568         if (ev->status) {
3569                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
3570                                        conn->dst_type, ev->status);
3571                 goto unlock;
3572         }
3573
3574         conn->state = BT_CLOSED;
3575
3576         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
3577
3578         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
3579                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
3580         else
3581                 reason = hci_to_mgmt_reason(ev->reason);
3582
3583         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
3584                                 reason, mgmt_connected);
3585
3586         if (conn->type == ACL_LINK) {
3587                 if (test_and_clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3588                         hci_remove_link_key(hdev, &conn->dst);
3589
3590                 hci_update_scan(hdev);
3591         }
3592
3593         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3594         if (params) {
3595                 switch (params->auto_connect) {
3596                 case HCI_AUTO_CONN_LINK_LOSS:
3597                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3598                                 break;
3599                         fallthrough;
3600
3601                 case HCI_AUTO_CONN_DIRECT:
3602                 case HCI_AUTO_CONN_ALWAYS:
3603                         hci_pend_le_list_del_init(params);
3604                         hci_pend_le_list_add(params, &hdev->pend_le_conns);
3605                         hci_update_passive_scan(hdev);
3606                         break;
3607
3608                 default:
3609                         break;
3610                 }
3611         }
3612
3613         hci_disconn_cfm(conn, ev->reason);
3614
3615         /* Re-enable advertising if necessary, since it might
3616          * have been disabled by the connection. From the
3617          * HCI_LE_Set_Advertise_Enable command description in
3618          * the core specification (v4.0):
3619          * "The Controller shall continue advertising until the Host
3620          * issues an LE_Set_Advertise_Enable command with
3621          * Advertising_Enable set to 0x00 (Advertising is disabled)
3622          * or until a connection is created or until the Advertising
3623          * is timed out due to Directed Advertising."
3624          */
3625         if (conn->type == LE_LINK && conn->role == HCI_ROLE_SLAVE) {
3626                 hdev->cur_adv_instance = conn->adv_instance;
3627                 hci_enable_advertising(hdev);
3628         }
3629
3630         hci_conn_del(conn);
3631
3632 unlock:
3633         hci_dev_unlock(hdev);
3634 }
3635
3636 static void hci_auth_complete_evt(struct hci_dev *hdev, void *data,
3637                                   struct sk_buff *skb)
3638 {
3639         struct hci_ev_auth_complete *ev = data;
3640         struct hci_conn *conn;
3641
3642         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3643
3644         hci_dev_lock(hdev);
3645
3646         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3647         if (!conn)
3648                 goto unlock;
3649
3650         if (!ev->status) {
3651                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3652                 set_bit(HCI_CONN_AUTH, &conn->flags);
3653                 conn->sec_level = conn->pending_sec_level;
3654         } else {
3655                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3656                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3657
3658                 mgmt_auth_failed(conn, ev->status);
3659         }
3660
3661         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3662
3663         if (conn->state == BT_CONFIG) {
3664                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3665                         struct hci_cp_set_conn_encrypt cp;
3666                         cp.handle  = ev->handle;
3667                         cp.encrypt = 0x01;
3668                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3669                                      &cp);
3670                 } else {
3671                         conn->state = BT_CONNECTED;
3672                         hci_connect_cfm(conn, ev->status);
3673                         hci_conn_drop(conn);
3674                 }
3675         } else {
3676                 hci_auth_cfm(conn, ev->status);
3677
3678                 hci_conn_hold(conn);
3679                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3680                 hci_conn_drop(conn);
3681         }
3682
3683         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3684                 if (!ev->status) {
3685                         struct hci_cp_set_conn_encrypt cp;
3686                         cp.handle  = ev->handle;
3687                         cp.encrypt = 0x01;
3688                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3689                                      &cp);
3690                 } else {
3691                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3692                         hci_encrypt_cfm(conn, ev->status);
3693                 }
3694         }
3695
3696 unlock:
3697         hci_dev_unlock(hdev);
3698 }
3699
3700 static void hci_remote_name_evt(struct hci_dev *hdev, void *data,
3701                                 struct sk_buff *skb)
3702 {
3703         struct hci_ev_remote_name *ev = data;
3704         struct hci_conn *conn;
3705
3706         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3707
3708         hci_conn_check_pending(hdev);
3709
3710         hci_dev_lock(hdev);
3711
3712         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3713
3714         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3715                 goto check_auth;
3716
3717         if (ev->status == 0)
3718                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3719                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3720         else
3721                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3722
3723 check_auth:
3724         if (!conn)
3725                 goto unlock;
3726
3727         if (!hci_outgoing_auth_needed(hdev, conn))
3728                 goto unlock;
3729
3730         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3731                 struct hci_cp_auth_requested cp;
3732
3733                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3734
3735                 cp.handle = __cpu_to_le16(conn->handle);
3736                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3737         }
3738
3739 unlock:
3740         hci_dev_unlock(hdev);
3741 }
3742
3743 static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
3744                                    struct sk_buff *skb)
3745 {
3746         struct hci_ev_encrypt_change *ev = data;
3747         struct hci_conn *conn;
3748
3749         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3750
3751         hci_dev_lock(hdev);
3752
3753         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3754         if (!conn)
3755                 goto unlock;
3756
3757         if (!ev->status) {
3758                 if (ev->encrypt) {
3759                         /* Encryption implies authentication */
3760                         set_bit(HCI_CONN_AUTH, &conn->flags);
3761                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3762                         conn->sec_level = conn->pending_sec_level;
3763
3764                         /* P-256 authentication key implies FIPS */
3765                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3766                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3767
3768                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3769                             conn->type == LE_LINK)
3770                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3771                 } else {
3772                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3773                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3774                 }
3775         }
3776
3777         /* We should disregard the current RPA and generate a new one
3778          * whenever the encryption procedure fails.
3779          */
3780         if (ev->status && conn->type == LE_LINK) {
3781                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3782                 hci_adv_instances_set_rpa_expired(hdev, true);
3783         }
3784
3785         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3786
3787         /* Check link security requirements are met */
3788         if (!hci_conn_check_link_mode(conn))
3789                 ev->status = HCI_ERROR_AUTH_FAILURE;
3790
3791         if (ev->status && conn->state == BT_CONNECTED) {
3792                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3793                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3794
3795                 /* Notify upper layers so they can cleanup before
3796                  * disconnecting.
3797                  */
3798                 hci_encrypt_cfm(conn, ev->status);
3799                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3800                 hci_conn_drop(conn);
3801                 goto unlock;
3802         }
3803
3804         /* Try reading the encryption key size for encrypted ACL links */
3805         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3806                 struct hci_cp_read_enc_key_size cp;
3807
3808                 /* Only send HCI_Read_Encryption_Key_Size if the
3809                  * controller really supports it. If it doesn't, assume
3810                  * the default size (16).
3811                  */
3812                 if (!(hdev->commands[20] & 0x10)) {
3813                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3814                         goto notify;
3815                 }
3816
3817                 cp.handle = cpu_to_le16(conn->handle);
3818                 if (hci_send_cmd(hdev, HCI_OP_READ_ENC_KEY_SIZE,
3819                                  sizeof(cp), &cp)) {
3820                         bt_dev_err(hdev, "sending read key size failed");
3821                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3822                         goto notify;
3823                 }
3824
3825                 goto unlock;
3826         }
3827
3828         /* Set the default Authenticated Payload Timeout after
3829          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3830          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3831          * sent when the link is active and Encryption is enabled, the conn
3832          * type can be either LE or ACL and controller must support LMP Ping.
3833          * Ensure for AES-CCM encryption as well.
3834          */
3835         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3836             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3837             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3838              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3839                 struct hci_cp_write_auth_payload_to cp;
3840
3841                 cp.handle = cpu_to_le16(conn->handle);
3842                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3843                 if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3844                                  sizeof(cp), &cp))
3845                         bt_dev_err(hdev, "write auth payload timeout failed");
3846         }
3847
3848 notify:
3849         hci_encrypt_cfm(conn, ev->status);
3850
3851 unlock:
3852         hci_dev_unlock(hdev);
3853 }
3854
3855 static void hci_change_link_key_complete_evt(struct hci_dev *hdev, void *data,
3856                                              struct sk_buff *skb)
3857 {
3858         struct hci_ev_change_link_key_complete *ev = data;
3859         struct hci_conn *conn;
3860
3861         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3862
3863         hci_dev_lock(hdev);
3864
3865         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3866         if (conn) {
3867                 if (!ev->status)
3868                         set_bit(HCI_CONN_SECURE, &conn->flags);
3869
3870                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3871
3872                 hci_key_change_cfm(conn, ev->status);
3873         }
3874
3875         hci_dev_unlock(hdev);
3876 }
3877
3878 static void hci_remote_features_evt(struct hci_dev *hdev, void *data,
3879                                     struct sk_buff *skb)
3880 {
3881         struct hci_ev_remote_features *ev = data;
3882         struct hci_conn *conn;
3883
3884         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
3885
3886         hci_dev_lock(hdev);
3887
3888         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3889         if (!conn)
3890                 goto unlock;
3891
3892         if (!ev->status)
3893                 memcpy(conn->features[0], ev->features, 8);
3894
3895         if (conn->state != BT_CONFIG)
3896                 goto unlock;
3897
3898         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3899             lmp_ext_feat_capable(conn)) {
3900                 struct hci_cp_read_remote_ext_features cp;
3901                 cp.handle = ev->handle;
3902                 cp.page = 0x01;
3903                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3904                              sizeof(cp), &cp);
3905                 goto unlock;
3906         }
3907
3908         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3909                 struct hci_cp_remote_name_req cp;
3910                 memset(&cp, 0, sizeof(cp));
3911                 bacpy(&cp.bdaddr, &conn->dst);
3912                 cp.pscan_rep_mode = 0x02;
3913                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3914         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3915                 mgmt_device_connected(hdev, conn, NULL, 0);
3916
3917         if (!hci_outgoing_auth_needed(hdev, conn)) {
3918                 conn->state = BT_CONNECTED;
3919                 hci_connect_cfm(conn, ev->status);
3920                 hci_conn_drop(conn);
3921         }
3922
3923 unlock:
3924         hci_dev_unlock(hdev);
3925 }
3926
3927 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3928 {
3929         cancel_delayed_work(&hdev->cmd_timer);
3930
3931         rcu_read_lock();
3932         if (!test_bit(HCI_RESET, &hdev->flags)) {
3933                 if (ncmd) {
3934                         cancel_delayed_work(&hdev->ncmd_timer);
3935                         atomic_set(&hdev->cmd_cnt, 1);
3936                 } else {
3937                         if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
3938                                 queue_delayed_work(hdev->workqueue, &hdev->ncmd_timer,
3939                                                    HCI_NCMD_TIMEOUT);
3940                 }
3941         }
3942         rcu_read_unlock();
3943 }
3944
3945 static u8 hci_cc_le_read_buffer_size_v2(struct hci_dev *hdev, void *data,
3946                                         struct sk_buff *skb)
3947 {
3948         struct hci_rp_le_read_buffer_size_v2 *rp = data;
3949
3950         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3951
3952         if (rp->status)
3953                 return rp->status;
3954
3955         hdev->le_mtu   = __le16_to_cpu(rp->acl_mtu);
3956         hdev->le_pkts  = rp->acl_max_pkt;
3957         hdev->iso_mtu  = __le16_to_cpu(rp->iso_mtu);
3958         hdev->iso_pkts = rp->iso_max_pkt;
3959
3960         hdev->le_cnt  = hdev->le_pkts;
3961         hdev->iso_cnt = hdev->iso_pkts;
3962
3963         BT_DBG("%s acl mtu %d:%d iso mtu %d:%d", hdev->name, hdev->acl_mtu,
3964                hdev->acl_pkts, hdev->iso_mtu, hdev->iso_pkts);
3965
3966         return rp->status;
3967 }
3968
3969 static void hci_unbound_cis_failed(struct hci_dev *hdev, u8 cig, u8 status)
3970 {
3971         struct hci_conn *conn, *tmp;
3972
3973         lockdep_assert_held(&hdev->lock);
3974
3975         list_for_each_entry_safe(conn, tmp, &hdev->conn_hash.list, list) {
3976                 if (conn->type != ISO_LINK || !bacmp(&conn->dst, BDADDR_ANY) ||
3977                     conn->state == BT_OPEN || conn->iso_qos.ucast.cig != cig)
3978                         continue;
3979
3980                 if (HCI_CONN_HANDLE_UNSET(conn->handle))
3981                         hci_conn_failed(conn, status);
3982         }
3983 }
3984
3985 static u8 hci_cc_le_set_cig_params(struct hci_dev *hdev, void *data,
3986                                    struct sk_buff *skb)
3987 {
3988         struct hci_rp_le_set_cig_params *rp = data;
3989         struct hci_cp_le_set_cig_params *cp;
3990         struct hci_conn *conn;
3991         u8 status = rp->status;
3992         bool pending = false;
3993         int i;
3994
3995         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
3996
3997         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_CIG_PARAMS);
3998         if (!rp->status && (!cp || rp->num_handles != cp->num_cis ||
3999                             rp->cig_id != cp->cig_id)) {
4000                 bt_dev_err(hdev, "unexpected Set CIG Parameters response data");
4001                 status = HCI_ERROR_UNSPECIFIED;
4002         }
4003
4004         hci_dev_lock(hdev);
4005
4006         /* BLUETOOTH CORE SPECIFICATION Version 5.4 | Vol 4, Part E page 2554
4007          *
4008          * If the Status return parameter is non-zero, then the state of the CIG
4009          * and its CIS configurations shall not be changed by the command. If
4010          * the CIG did not already exist, it shall not be created.
4011          */
4012         if (status) {
4013                 /* Keep current configuration, fail only the unbound CIS */
4014                 hci_unbound_cis_failed(hdev, rp->cig_id, status);
4015                 goto unlock;
4016         }
4017
4018         /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2553
4019          *
4020          * If the Status return parameter is zero, then the Controller shall
4021          * set the Connection_Handle arrayed return parameter to the connection
4022          * handle(s) corresponding to the CIS configurations specified in
4023          * the CIS_IDs command parameter, in the same order.
4024          */
4025         for (i = 0; i < rp->num_handles; ++i) {
4026                 conn = hci_conn_hash_lookup_cis(hdev, NULL, 0, rp->cig_id,
4027                                                 cp->cis[i].cis_id);
4028                 if (!conn || !bacmp(&conn->dst, BDADDR_ANY))
4029                         continue;
4030
4031                 if (conn->state != BT_BOUND && conn->state != BT_CONNECT)
4032                         continue;
4033
4034                 if (hci_conn_set_handle(conn, __le16_to_cpu(rp->handle[i])))
4035                         continue;
4036
4037                 if (conn->state == BT_CONNECT)
4038                         pending = true;
4039         }
4040
4041 unlock:
4042         if (pending)
4043                 hci_le_create_cis_pending(hdev);
4044
4045         hci_dev_unlock(hdev);
4046
4047         return rp->status;
4048 }
4049
4050 static u8 hci_cc_le_setup_iso_path(struct hci_dev *hdev, void *data,
4051                                    struct sk_buff *skb)
4052 {
4053         struct hci_rp_le_setup_iso_path *rp = data;
4054         struct hci_cp_le_setup_iso_path *cp;
4055         struct hci_conn *conn;
4056
4057         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
4058
4059         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SETUP_ISO_PATH);
4060         if (!cp)
4061                 return rp->status;
4062
4063         hci_dev_lock(hdev);
4064
4065         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
4066         if (!conn)
4067                 goto unlock;
4068
4069         if (rp->status) {
4070                 hci_connect_cfm(conn, rp->status);
4071                 hci_conn_del(conn);
4072                 goto unlock;
4073         }
4074
4075         switch (cp->direction) {
4076         /* Input (Host to Controller) */
4077         case 0x00:
4078                 /* Only confirm connection if output only */
4079                 if (conn->iso_qos.ucast.out.sdu && !conn->iso_qos.ucast.in.sdu)
4080                         hci_connect_cfm(conn, rp->status);
4081                 break;
4082         /* Output (Controller to Host) */
4083         case 0x01:
4084                 /* Confirm connection since conn->iso_qos is always configured
4085                  * last.
4086                  */
4087                 hci_connect_cfm(conn, rp->status);
4088                 break;
4089         }
4090
4091 unlock:
4092         hci_dev_unlock(hdev);
4093         return rp->status;
4094 }
4095
4096 static void hci_cs_le_create_big(struct hci_dev *hdev, u8 status)
4097 {
4098         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4099 }
4100
4101 static u8 hci_cc_set_per_adv_param(struct hci_dev *hdev, void *data,
4102                                    struct sk_buff *skb)
4103 {
4104         struct hci_ev_status *rp = data;
4105         struct hci_cp_le_set_per_adv_params *cp;
4106
4107         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
4108
4109         if (rp->status)
4110                 return rp->status;
4111
4112         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS);
4113         if (!cp)
4114                 return rp->status;
4115
4116         /* TODO: set the conn state */
4117         return rp->status;
4118 }
4119
4120 static u8 hci_cc_le_set_per_adv_enable(struct hci_dev *hdev, void *data,
4121                                        struct sk_buff *skb)
4122 {
4123         struct hci_ev_status *rp = data;
4124         struct hci_cp_le_set_per_adv_enable *cp;
4125         struct adv_info *adv = NULL, *n;
4126         u8 per_adv_cnt = 0;
4127
4128         bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
4129
4130         if (rp->status)
4131                 return rp->status;
4132
4133         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE);
4134         if (!cp)
4135                 return rp->status;
4136
4137         hci_dev_lock(hdev);
4138
4139         adv = hci_find_adv_instance(hdev, cp->handle);
4140
4141         if (cp->enable) {
4142                 hci_dev_set_flag(hdev, HCI_LE_PER_ADV);
4143
4144                 if (adv)
4145                         adv->enabled = true;
4146         } else {
4147                 /* If just one instance was disabled check if there are
4148                  * any other instance enabled before clearing HCI_LE_PER_ADV.
4149                  * The current periodic adv instance will be marked as
4150                  * disabled once extended advertising is also disabled.
4151                  */
4152                 list_for_each_entry_safe(adv, n, &hdev->adv_instances,
4153                                          list) {
4154                         if (adv->periodic && adv->enabled)
4155                                 per_adv_cnt++;
4156                 }
4157
4158                 if (per_adv_cnt > 1)
4159                         goto unlock;
4160
4161                 hci_dev_clear_flag(hdev, HCI_LE_PER_ADV);
4162         }
4163
4164 unlock:
4165         hci_dev_unlock(hdev);
4166
4167         return rp->status;
4168 }
4169
4170 #define HCI_CC_VL(_op, _func, _min, _max) \
4171 { \
4172         .op = _op, \
4173         .func = _func, \
4174         .min_len = _min, \
4175         .max_len = _max, \
4176 }
4177
4178 #define HCI_CC(_op, _func, _len) \
4179         HCI_CC_VL(_op, _func, _len, _len)
4180
4181 #define HCI_CC_STATUS(_op, _func) \
4182         HCI_CC(_op, _func, sizeof(struct hci_ev_status))
4183
4184 static const struct hci_cc {
4185         u16  op;
4186         u8 (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
4187         u16  min_len;
4188         u16  max_len;
4189 } hci_cc_table[] = {
4190         HCI_CC_STATUS(HCI_OP_INQUIRY_CANCEL, hci_cc_inquiry_cancel),
4191         HCI_CC_STATUS(HCI_OP_PERIODIC_INQ, hci_cc_periodic_inq),
4192         HCI_CC_STATUS(HCI_OP_EXIT_PERIODIC_INQ, hci_cc_exit_periodic_inq),
4193         HCI_CC_STATUS(HCI_OP_REMOTE_NAME_REQ_CANCEL,
4194                       hci_cc_remote_name_req_cancel),
4195         HCI_CC(HCI_OP_ROLE_DISCOVERY, hci_cc_role_discovery,
4196                sizeof(struct hci_rp_role_discovery)),
4197         HCI_CC(HCI_OP_READ_LINK_POLICY, hci_cc_read_link_policy,
4198                sizeof(struct hci_rp_read_link_policy)),
4199         HCI_CC(HCI_OP_WRITE_LINK_POLICY, hci_cc_write_link_policy,
4200                sizeof(struct hci_rp_write_link_policy)),
4201         HCI_CC(HCI_OP_READ_DEF_LINK_POLICY, hci_cc_read_def_link_policy,
4202                sizeof(struct hci_rp_read_def_link_policy)),
4203         HCI_CC_STATUS(HCI_OP_WRITE_DEF_LINK_POLICY,
4204                       hci_cc_write_def_link_policy),
4205         HCI_CC_STATUS(HCI_OP_RESET, hci_cc_reset),
4206         HCI_CC(HCI_OP_READ_STORED_LINK_KEY, hci_cc_read_stored_link_key,
4207                sizeof(struct hci_rp_read_stored_link_key)),
4208         HCI_CC(HCI_OP_DELETE_STORED_LINK_KEY, hci_cc_delete_stored_link_key,
4209                sizeof(struct hci_rp_delete_stored_link_key)),
4210         HCI_CC_STATUS(HCI_OP_WRITE_LOCAL_NAME, hci_cc_write_local_name),
4211         HCI_CC(HCI_OP_READ_LOCAL_NAME, hci_cc_read_local_name,
4212                sizeof(struct hci_rp_read_local_name)),
4213         HCI_CC_STATUS(HCI_OP_WRITE_AUTH_ENABLE, hci_cc_write_auth_enable),
4214         HCI_CC_STATUS(HCI_OP_WRITE_ENCRYPT_MODE, hci_cc_write_encrypt_mode),
4215         HCI_CC_STATUS(HCI_OP_WRITE_SCAN_ENABLE, hci_cc_write_scan_enable),
4216         HCI_CC_STATUS(HCI_OP_SET_EVENT_FLT, hci_cc_set_event_filter),
4217         HCI_CC(HCI_OP_READ_CLASS_OF_DEV, hci_cc_read_class_of_dev,
4218                sizeof(struct hci_rp_read_class_of_dev)),
4219         HCI_CC_STATUS(HCI_OP_WRITE_CLASS_OF_DEV, hci_cc_write_class_of_dev),
4220         HCI_CC(HCI_OP_READ_VOICE_SETTING, hci_cc_read_voice_setting,
4221                sizeof(struct hci_rp_read_voice_setting)),
4222         HCI_CC_STATUS(HCI_OP_WRITE_VOICE_SETTING, hci_cc_write_voice_setting),
4223         HCI_CC(HCI_OP_READ_NUM_SUPPORTED_IAC, hci_cc_read_num_supported_iac,
4224                sizeof(struct hci_rp_read_num_supported_iac)),
4225         HCI_CC_STATUS(HCI_OP_WRITE_SSP_MODE, hci_cc_write_ssp_mode),
4226         HCI_CC_STATUS(HCI_OP_WRITE_SC_SUPPORT, hci_cc_write_sc_support),
4227         HCI_CC(HCI_OP_READ_AUTH_PAYLOAD_TO, hci_cc_read_auth_payload_timeout,
4228                sizeof(struct hci_rp_read_auth_payload_to)),
4229         HCI_CC(HCI_OP_WRITE_AUTH_PAYLOAD_TO, hci_cc_write_auth_payload_timeout,
4230                sizeof(struct hci_rp_write_auth_payload_to)),
4231         HCI_CC(HCI_OP_READ_LOCAL_VERSION, hci_cc_read_local_version,
4232                sizeof(struct hci_rp_read_local_version)),
4233         HCI_CC(HCI_OP_READ_LOCAL_COMMANDS, hci_cc_read_local_commands,
4234                sizeof(struct hci_rp_read_local_commands)),
4235         HCI_CC(HCI_OP_READ_LOCAL_FEATURES, hci_cc_read_local_features,
4236                sizeof(struct hci_rp_read_local_features)),
4237         HCI_CC(HCI_OP_READ_LOCAL_EXT_FEATURES, hci_cc_read_local_ext_features,
4238                sizeof(struct hci_rp_read_local_ext_features)),
4239         HCI_CC(HCI_OP_READ_BUFFER_SIZE, hci_cc_read_buffer_size,
4240                sizeof(struct hci_rp_read_buffer_size)),
4241         HCI_CC(HCI_OP_READ_BD_ADDR, hci_cc_read_bd_addr,
4242                sizeof(struct hci_rp_read_bd_addr)),
4243         HCI_CC(HCI_OP_READ_LOCAL_PAIRING_OPTS, hci_cc_read_local_pairing_opts,
4244                sizeof(struct hci_rp_read_local_pairing_opts)),
4245         HCI_CC(HCI_OP_READ_PAGE_SCAN_ACTIVITY, hci_cc_read_page_scan_activity,
4246                sizeof(struct hci_rp_read_page_scan_activity)),
4247         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
4248                       hci_cc_write_page_scan_activity),
4249         HCI_CC(HCI_OP_READ_PAGE_SCAN_TYPE, hci_cc_read_page_scan_type,
4250                sizeof(struct hci_rp_read_page_scan_type)),
4251         HCI_CC_STATUS(HCI_OP_WRITE_PAGE_SCAN_TYPE, hci_cc_write_page_scan_type),
4252         HCI_CC(HCI_OP_READ_DATA_BLOCK_SIZE, hci_cc_read_data_block_size,
4253                sizeof(struct hci_rp_read_data_block_size)),
4254         HCI_CC(HCI_OP_READ_FLOW_CONTROL_MODE, hci_cc_read_flow_control_mode,
4255                sizeof(struct hci_rp_read_flow_control_mode)),
4256         HCI_CC(HCI_OP_READ_LOCAL_AMP_INFO, hci_cc_read_local_amp_info,
4257                sizeof(struct hci_rp_read_local_amp_info)),
4258         HCI_CC(HCI_OP_READ_CLOCK, hci_cc_read_clock,
4259                sizeof(struct hci_rp_read_clock)),
4260         HCI_CC(HCI_OP_READ_ENC_KEY_SIZE, hci_cc_read_enc_key_size,
4261                sizeof(struct hci_rp_read_enc_key_size)),
4262         HCI_CC(HCI_OP_READ_INQ_RSP_TX_POWER, hci_cc_read_inq_rsp_tx_power,
4263                sizeof(struct hci_rp_read_inq_rsp_tx_power)),
4264         HCI_CC(HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4265                hci_cc_read_def_err_data_reporting,
4266                sizeof(struct hci_rp_read_def_err_data_reporting)),
4267         HCI_CC_STATUS(HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4268                       hci_cc_write_def_err_data_reporting),
4269         HCI_CC(HCI_OP_PIN_CODE_REPLY, hci_cc_pin_code_reply,
4270                sizeof(struct hci_rp_pin_code_reply)),
4271         HCI_CC(HCI_OP_PIN_CODE_NEG_REPLY, hci_cc_pin_code_neg_reply,
4272                sizeof(struct hci_rp_pin_code_neg_reply)),
4273         HCI_CC(HCI_OP_READ_LOCAL_OOB_DATA, hci_cc_read_local_oob_data,
4274                sizeof(struct hci_rp_read_local_oob_data)),
4275         HCI_CC(HCI_OP_READ_LOCAL_OOB_EXT_DATA, hci_cc_read_local_oob_ext_data,
4276                sizeof(struct hci_rp_read_local_oob_ext_data)),
4277         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE, hci_cc_le_read_buffer_size,
4278                sizeof(struct hci_rp_le_read_buffer_size)),
4279         HCI_CC(HCI_OP_LE_READ_LOCAL_FEATURES, hci_cc_le_read_local_features,
4280                sizeof(struct hci_rp_le_read_local_features)),
4281         HCI_CC(HCI_OP_LE_READ_ADV_TX_POWER, hci_cc_le_read_adv_tx_power,
4282                sizeof(struct hci_rp_le_read_adv_tx_power)),
4283         HCI_CC(HCI_OP_USER_CONFIRM_REPLY, hci_cc_user_confirm_reply,
4284                sizeof(struct hci_rp_user_confirm_reply)),
4285         HCI_CC(HCI_OP_USER_CONFIRM_NEG_REPLY, hci_cc_user_confirm_neg_reply,
4286                sizeof(struct hci_rp_user_confirm_reply)),
4287         HCI_CC(HCI_OP_USER_PASSKEY_REPLY, hci_cc_user_passkey_reply,
4288                sizeof(struct hci_rp_user_confirm_reply)),
4289         HCI_CC(HCI_OP_USER_PASSKEY_NEG_REPLY, hci_cc_user_passkey_neg_reply,
4290                sizeof(struct hci_rp_user_confirm_reply)),
4291         HCI_CC_STATUS(HCI_OP_LE_SET_RANDOM_ADDR, hci_cc_le_set_random_addr),
4292         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_ENABLE, hci_cc_le_set_adv_enable),
4293         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_PARAM, hci_cc_le_set_scan_param),
4294         HCI_CC_STATUS(HCI_OP_LE_SET_SCAN_ENABLE, hci_cc_le_set_scan_enable),
4295         HCI_CC(HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4296                hci_cc_le_read_accept_list_size,
4297                sizeof(struct hci_rp_le_read_accept_list_size)),
4298         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ACCEPT_LIST, hci_cc_le_clear_accept_list),
4299         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_ACCEPT_LIST,
4300                       hci_cc_le_add_to_accept_list),
4301         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
4302                       hci_cc_le_del_from_accept_list),
4303         HCI_CC(HCI_OP_LE_READ_SUPPORTED_STATES, hci_cc_le_read_supported_states,
4304                sizeof(struct hci_rp_le_read_supported_states)),
4305         HCI_CC(HCI_OP_LE_READ_DEF_DATA_LEN, hci_cc_le_read_def_data_len,
4306                sizeof(struct hci_rp_le_read_def_data_len)),
4307         HCI_CC_STATUS(HCI_OP_LE_WRITE_DEF_DATA_LEN,
4308                       hci_cc_le_write_def_data_len),
4309         HCI_CC_STATUS(HCI_OP_LE_ADD_TO_RESOLV_LIST,
4310                       hci_cc_le_add_to_resolv_list),
4311         HCI_CC_STATUS(HCI_OP_LE_DEL_FROM_RESOLV_LIST,
4312                       hci_cc_le_del_from_resolv_list),
4313         HCI_CC_STATUS(HCI_OP_LE_CLEAR_RESOLV_LIST,
4314                       hci_cc_le_clear_resolv_list),
4315         HCI_CC(HCI_OP_LE_READ_RESOLV_LIST_SIZE, hci_cc_le_read_resolv_list_size,
4316                sizeof(struct hci_rp_le_read_resolv_list_size)),
4317         HCI_CC_STATUS(HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
4318                       hci_cc_le_set_addr_resolution_enable),
4319         HCI_CC(HCI_OP_LE_READ_MAX_DATA_LEN, hci_cc_le_read_max_data_len,
4320                sizeof(struct hci_rp_le_read_max_data_len)),
4321         HCI_CC_STATUS(HCI_OP_WRITE_LE_HOST_SUPPORTED,
4322                       hci_cc_write_le_host_supported),
4323         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_PARAM, hci_cc_set_adv_param),
4324         HCI_CC(HCI_OP_READ_RSSI, hci_cc_read_rssi,
4325                sizeof(struct hci_rp_read_rssi)),
4326         HCI_CC(HCI_OP_READ_TX_POWER, hci_cc_read_tx_power,
4327                sizeof(struct hci_rp_read_tx_power)),
4328         HCI_CC_STATUS(HCI_OP_WRITE_SSP_DEBUG_MODE, hci_cc_write_ssp_debug_mode),
4329         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_PARAMS,
4330                       hci_cc_le_set_ext_scan_param),
4331         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_SCAN_ENABLE,
4332                       hci_cc_le_set_ext_scan_enable),
4333         HCI_CC_STATUS(HCI_OP_LE_SET_DEFAULT_PHY, hci_cc_le_set_default_phy),
4334         HCI_CC(HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4335                hci_cc_le_read_num_adv_sets,
4336                sizeof(struct hci_rp_le_read_num_supported_adv_sets)),
4337         HCI_CC(HCI_OP_LE_SET_EXT_ADV_PARAMS, hci_cc_set_ext_adv_param,
4338                sizeof(struct hci_rp_le_set_ext_adv_params)),
4339         HCI_CC_STATUS(HCI_OP_LE_SET_EXT_ADV_ENABLE,
4340                       hci_cc_le_set_ext_adv_enable),
4341         HCI_CC_STATUS(HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
4342                       hci_cc_le_set_adv_set_random_addr),
4343         HCI_CC_STATUS(HCI_OP_LE_REMOVE_ADV_SET, hci_cc_le_remove_adv_set),
4344         HCI_CC_STATUS(HCI_OP_LE_CLEAR_ADV_SETS, hci_cc_le_clear_adv_sets),
4345         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_PARAMS, hci_cc_set_per_adv_param),
4346         HCI_CC_STATUS(HCI_OP_LE_SET_PER_ADV_ENABLE,
4347                       hci_cc_le_set_per_adv_enable),
4348         HCI_CC(HCI_OP_LE_READ_TRANSMIT_POWER, hci_cc_le_read_transmit_power,
4349                sizeof(struct hci_rp_le_read_transmit_power)),
4350 #ifdef TIZEN_BT
4351         HCI_CC(HCI_OP_ENABLE_RSSI, hci_cc_enable_rssi,
4352                sizeof(struct hci_cc_rsp_enable_rssi)),
4353         HCI_CC(HCI_OP_GET_RAW_RSSI, hci_cc_get_raw_rssi,
4354                sizeof(struct hci_cc_rp_get_raw_rssi)),
4355 #endif
4356         HCI_CC_STATUS(HCI_OP_LE_SET_PRIVACY_MODE, hci_cc_le_set_privacy_mode),
4357         HCI_CC(HCI_OP_LE_READ_BUFFER_SIZE_V2, hci_cc_le_read_buffer_size_v2,
4358                sizeof(struct hci_rp_le_read_buffer_size_v2)),
4359         HCI_CC_VL(HCI_OP_LE_SET_CIG_PARAMS, hci_cc_le_set_cig_params,
4360                   sizeof(struct hci_rp_le_set_cig_params), HCI_MAX_EVENT_SIZE),
4361         HCI_CC(HCI_OP_LE_SETUP_ISO_PATH, hci_cc_le_setup_iso_path,
4362                sizeof(struct hci_rp_le_setup_iso_path)),
4363 };
4364
4365 static u8 hci_cc_func(struct hci_dev *hdev, const struct hci_cc *cc,
4366                       struct sk_buff *skb)
4367 {
4368         void *data;
4369
4370         if (skb->len < cc->min_len) {
4371                 bt_dev_err(hdev, "unexpected cc 0x%4.4x length: %u < %u",
4372                            cc->op, skb->len, cc->min_len);
4373                 return HCI_ERROR_UNSPECIFIED;
4374         }
4375
4376         /* Just warn if the length is over max_len size it still be possible to
4377          * partially parse the cc so leave to callback to decide if that is
4378          * acceptable.
4379          */
4380         if (skb->len > cc->max_len)
4381                 bt_dev_warn(hdev, "unexpected cc 0x%4.4x length: %u > %u",
4382                             cc->op, skb->len, cc->max_len);
4383
4384         data = hci_cc_skb_pull(hdev, skb, cc->op, cc->min_len);
4385         if (!data)
4386                 return HCI_ERROR_UNSPECIFIED;
4387
4388         return cc->func(hdev, data, skb);
4389 }
4390
4391 static void hci_cmd_complete_evt(struct hci_dev *hdev, void *data,
4392                                  struct sk_buff *skb, u16 *opcode, u8 *status,
4393                                  hci_req_complete_t *req_complete,
4394                                  hci_req_complete_skb_t *req_complete_skb)
4395 {
4396         struct hci_ev_cmd_complete *ev = data;
4397         int i;
4398
4399         *opcode = __le16_to_cpu(ev->opcode);
4400
4401         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4402
4403         for (i = 0; i < ARRAY_SIZE(hci_cc_table); i++) {
4404                 if (hci_cc_table[i].op == *opcode) {
4405                         *status = hci_cc_func(hdev, &hci_cc_table[i], skb);
4406                         break;
4407                 }
4408         }
4409
4410         if (i == ARRAY_SIZE(hci_cc_table)) {
4411                 /* Unknown opcode, assume byte 0 contains the status, so
4412                  * that e.g. __hci_cmd_sync() properly returns errors
4413                  * for vendor specific commands send by HCI drivers.
4414                  * If a vendor doesn't actually follow this convention we may
4415                  * need to introduce a vendor CC table in order to properly set
4416                  * the status.
4417                  */
4418                 *status = skb->data[0];
4419         }
4420
4421         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4422
4423         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
4424                              req_complete_skb);
4425
4426         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4427                 bt_dev_err(hdev,
4428                            "unexpected event for opcode 0x%4.4x", *opcode);
4429                 return;
4430         }
4431
4432         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4433                 queue_work(hdev->workqueue, &hdev->cmd_work);
4434 }
4435
4436 static void hci_cs_le_create_cis(struct hci_dev *hdev, u8 status)
4437 {
4438         struct hci_cp_le_create_cis *cp;
4439         bool pending = false;
4440         int i;
4441
4442         bt_dev_dbg(hdev, "status 0x%2.2x", status);
4443
4444         if (!status)
4445                 return;
4446
4447         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CIS);
4448         if (!cp)
4449                 return;
4450
4451         hci_dev_lock(hdev);
4452
4453         /* Remove connection if command failed */
4454         for (i = 0; cp->num_cis; cp->num_cis--, i++) {
4455                 struct hci_conn *conn;
4456                 u16 handle;
4457
4458                 handle = __le16_to_cpu(cp->cis[i].cis_handle);
4459
4460                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4461                 if (conn) {
4462                         if (test_and_clear_bit(HCI_CONN_CREATE_CIS,
4463                                                &conn->flags))
4464                                 pending = true;
4465                         conn->state = BT_CLOSED;
4466                         hci_connect_cfm(conn, status);
4467                         hci_conn_del(conn);
4468                 }
4469         }
4470
4471         if (pending)
4472                 hci_le_create_cis_pending(hdev);
4473
4474         hci_dev_unlock(hdev);
4475 }
4476
4477 #define HCI_CS(_op, _func) \
4478 { \
4479         .op = _op, \
4480         .func = _func, \
4481 }
4482
4483 static const struct hci_cs {
4484         u16  op;
4485         void (*func)(struct hci_dev *hdev, __u8 status);
4486 } hci_cs_table[] = {
4487         HCI_CS(HCI_OP_INQUIRY, hci_cs_inquiry),
4488         HCI_CS(HCI_OP_CREATE_CONN, hci_cs_create_conn),
4489         HCI_CS(HCI_OP_DISCONNECT, hci_cs_disconnect),
4490         HCI_CS(HCI_OP_ADD_SCO, hci_cs_add_sco),
4491         HCI_CS(HCI_OP_AUTH_REQUESTED, hci_cs_auth_requested),
4492         HCI_CS(HCI_OP_SET_CONN_ENCRYPT, hci_cs_set_conn_encrypt),
4493         HCI_CS(HCI_OP_REMOTE_NAME_REQ, hci_cs_remote_name_req),
4494         HCI_CS(HCI_OP_READ_REMOTE_FEATURES, hci_cs_read_remote_features),
4495         HCI_CS(HCI_OP_READ_REMOTE_EXT_FEATURES,
4496                hci_cs_read_remote_ext_features),
4497         HCI_CS(HCI_OP_SETUP_SYNC_CONN, hci_cs_setup_sync_conn),
4498         HCI_CS(HCI_OP_ENHANCED_SETUP_SYNC_CONN,
4499                hci_cs_enhanced_setup_sync_conn),
4500         HCI_CS(HCI_OP_SNIFF_MODE, hci_cs_sniff_mode),
4501         HCI_CS(HCI_OP_EXIT_SNIFF_MODE, hci_cs_exit_sniff_mode),
4502         HCI_CS(HCI_OP_SWITCH_ROLE, hci_cs_switch_role),
4503         HCI_CS(HCI_OP_LE_CREATE_CONN, hci_cs_le_create_conn),
4504         HCI_CS(HCI_OP_LE_READ_REMOTE_FEATURES, hci_cs_le_read_remote_features),
4505         HCI_CS(HCI_OP_LE_START_ENC, hci_cs_le_start_enc),
4506         HCI_CS(HCI_OP_LE_EXT_CREATE_CONN, hci_cs_le_ext_create_conn),
4507         HCI_CS(HCI_OP_LE_CREATE_CIS, hci_cs_le_create_cis),
4508         HCI_CS(HCI_OP_LE_CREATE_BIG, hci_cs_le_create_big),
4509 };
4510
4511 static void hci_cmd_status_evt(struct hci_dev *hdev, void *data,
4512                                struct sk_buff *skb, u16 *opcode, u8 *status,
4513                                hci_req_complete_t *req_complete,
4514                                hci_req_complete_skb_t *req_complete_skb)
4515 {
4516         struct hci_ev_cmd_status *ev = data;
4517         int i;
4518
4519         *opcode = __le16_to_cpu(ev->opcode);
4520         *status = ev->status;
4521
4522         bt_dev_dbg(hdev, "opcode 0x%4.4x", *opcode);
4523
4524         for (i = 0; i < ARRAY_SIZE(hci_cs_table); i++) {
4525                 if (hci_cs_table[i].op == *opcode) {
4526                         hci_cs_table[i].func(hdev, ev->status);
4527                         break;
4528                 }
4529         }
4530
4531         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
4532
4533         /* Indicate request completion if the command failed. Also, if
4534          * we're not waiting for a special event and we get a success
4535          * command status we should try to flag the request as completed
4536          * (since for this kind of commands there will not be a command
4537          * complete event).
4538          */
4539         if (ev->status || (hdev->sent_cmd && !hci_skb_event(hdev->sent_cmd))) {
4540                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
4541                                      req_complete_skb);
4542                 if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
4543                         bt_dev_err(hdev, "unexpected event for opcode 0x%4.4x",
4544                                    *opcode);
4545                         return;
4546                 }
4547         }
4548
4549         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
4550                 queue_work(hdev->workqueue, &hdev->cmd_work);
4551 }
4552
4553 static void hci_hardware_error_evt(struct hci_dev *hdev, void *data,
4554                                    struct sk_buff *skb)
4555 {
4556         struct hci_ev_hardware_error *ev = data;
4557
4558         bt_dev_dbg(hdev, "code 0x%2.2x", ev->code);
4559
4560 #ifdef TIZEN_BT
4561         hci_dev_lock(hdev);
4562         mgmt_hardware_error(hdev, ev->code);
4563         hci_dev_unlock(hdev);
4564 #endif
4565         hdev->hw_error_code = ev->code;
4566
4567         queue_work(hdev->req_workqueue, &hdev->error_reset);
4568 }
4569
4570 static void hci_role_change_evt(struct hci_dev *hdev, void *data,
4571                                 struct sk_buff *skb)
4572 {
4573         struct hci_ev_role_change *ev = data;
4574         struct hci_conn *conn;
4575
4576         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4577
4578         hci_dev_lock(hdev);
4579
4580         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4581         if (conn) {
4582                 if (!ev->status)
4583                         conn->role = ev->role;
4584
4585                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
4586
4587                 hci_role_switch_cfm(conn, ev->status, ev->role);
4588 #ifdef TIZEN_BT
4589                 if (!ev->status && (get_link_mode(conn) & HCI_LM_MASTER))
4590                         hci_conn_change_supervision_timeout(conn,
4591                                         LINK_SUPERVISION_TIMEOUT);
4592 #endif
4593         }
4594
4595         hci_dev_unlock(hdev);
4596 }
4597
4598 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, void *data,
4599                                   struct sk_buff *skb)
4600 {
4601         struct hci_ev_num_comp_pkts *ev = data;
4602         int i;
4603
4604         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_PKTS,
4605                              flex_array_size(ev, handles, ev->num)))
4606                 return;
4607
4608         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
4609                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4610                 return;
4611         }
4612
4613         bt_dev_dbg(hdev, "num %d", ev->num);
4614
4615         for (i = 0; i < ev->num; i++) {
4616                 struct hci_comp_pkts_info *info = &ev->handles[i];
4617                 struct hci_conn *conn;
4618                 __u16  handle, count;
4619
4620                 handle = __le16_to_cpu(info->handle);
4621                 count  = __le16_to_cpu(info->count);
4622
4623                 conn = hci_conn_hash_lookup_handle(hdev, handle);
4624                 if (!conn)
4625                         continue;
4626
4627                 conn->sent -= count;
4628
4629                 switch (conn->type) {
4630                 case ACL_LINK:
4631                         hdev->acl_cnt += count;
4632                         if (hdev->acl_cnt > hdev->acl_pkts)
4633                                 hdev->acl_cnt = hdev->acl_pkts;
4634                         break;
4635
4636                 case LE_LINK:
4637                         if (hdev->le_pkts) {
4638                                 hdev->le_cnt += count;
4639                                 if (hdev->le_cnt > hdev->le_pkts)
4640                                         hdev->le_cnt = hdev->le_pkts;
4641                         } else {
4642                                 hdev->acl_cnt += count;
4643                                 if (hdev->acl_cnt > hdev->acl_pkts)
4644                                         hdev->acl_cnt = hdev->acl_pkts;
4645                         }
4646                         break;
4647
4648                 case SCO_LINK:
4649                         hdev->sco_cnt += count;
4650                         if (hdev->sco_cnt > hdev->sco_pkts)
4651                                 hdev->sco_cnt = hdev->sco_pkts;
4652                         break;
4653
4654                 case ISO_LINK:
4655                         if (hdev->iso_pkts) {
4656                                 hdev->iso_cnt += count;
4657                                 if (hdev->iso_cnt > hdev->iso_pkts)
4658                                         hdev->iso_cnt = hdev->iso_pkts;
4659                         } else if (hdev->le_pkts) {
4660                                 hdev->le_cnt += count;
4661                                 if (hdev->le_cnt > hdev->le_pkts)
4662                                         hdev->le_cnt = hdev->le_pkts;
4663                         } else {
4664                                 hdev->acl_cnt += count;
4665                                 if (hdev->acl_cnt > hdev->acl_pkts)
4666                                         hdev->acl_cnt = hdev->acl_pkts;
4667                         }
4668                         break;
4669
4670                 default:
4671                         bt_dev_err(hdev, "unknown type %d conn %p",
4672                                    conn->type, conn);
4673                         break;
4674                 }
4675         }
4676
4677         queue_work(hdev->workqueue, &hdev->tx_work);
4678 }
4679
4680 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4681                                                  __u16 handle)
4682 {
4683         struct hci_chan *chan;
4684
4685         switch (hdev->dev_type) {
4686         case HCI_PRIMARY:
4687                 return hci_conn_hash_lookup_handle(hdev, handle);
4688         case HCI_AMP:
4689                 chan = hci_chan_lookup_handle(hdev, handle);
4690                 if (chan)
4691                         return chan->conn;
4692                 break;
4693         default:
4694                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4695                 break;
4696         }
4697
4698         return NULL;
4699 }
4700
4701 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, void *data,
4702                                     struct sk_buff *skb)
4703 {
4704         struct hci_ev_num_comp_blocks *ev = data;
4705         int i;
4706
4707         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_NUM_COMP_BLOCKS,
4708                              flex_array_size(ev, handles, ev->num_hndl)))
4709                 return;
4710
4711         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4712                 bt_dev_err(hdev, "wrong event for mode %d",
4713                            hdev->flow_ctl_mode);
4714                 return;
4715         }
4716
4717         bt_dev_dbg(hdev, "num_blocks %d num_hndl %d", ev->num_blocks,
4718                    ev->num_hndl);
4719
4720         for (i = 0; i < ev->num_hndl; i++) {
4721                 struct hci_comp_blocks_info *info = &ev->handles[i];
4722                 struct hci_conn *conn = NULL;
4723                 __u16  handle, block_count;
4724
4725                 handle = __le16_to_cpu(info->handle);
4726                 block_count = __le16_to_cpu(info->blocks);
4727
4728                 conn = __hci_conn_lookup_handle(hdev, handle);
4729                 if (!conn)
4730                         continue;
4731
4732                 conn->sent -= block_count;
4733
4734                 switch (conn->type) {
4735                 case ACL_LINK:
4736                 case AMP_LINK:
4737                         hdev->block_cnt += block_count;
4738                         if (hdev->block_cnt > hdev->num_blocks)
4739                                 hdev->block_cnt = hdev->num_blocks;
4740                         break;
4741
4742                 default:
4743                         bt_dev_err(hdev, "unknown type %d conn %p",
4744                                    conn->type, conn);
4745                         break;
4746                 }
4747         }
4748
4749         queue_work(hdev->workqueue, &hdev->tx_work);
4750 }
4751
4752 static void hci_mode_change_evt(struct hci_dev *hdev, void *data,
4753                                 struct sk_buff *skb)
4754 {
4755         struct hci_ev_mode_change *ev = data;
4756         struct hci_conn *conn;
4757
4758         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4759
4760         hci_dev_lock(hdev);
4761
4762         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4763         if (conn) {
4764                 conn->mode = ev->mode;
4765
4766                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4767                                         &conn->flags)) {
4768                         if (conn->mode == HCI_CM_ACTIVE)
4769                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4770                         else
4771                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4772                 }
4773
4774                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4775                         hci_sco_setup(conn, ev->status);
4776         }
4777
4778         hci_dev_unlock(hdev);
4779 }
4780
4781 static void hci_pin_code_request_evt(struct hci_dev *hdev, void *data,
4782                                      struct sk_buff *skb)
4783 {
4784         struct hci_ev_pin_code_req *ev = data;
4785         struct hci_conn *conn;
4786
4787         bt_dev_dbg(hdev, "");
4788
4789         hci_dev_lock(hdev);
4790
4791         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4792         if (!conn)
4793                 goto unlock;
4794
4795         if (conn->state == BT_CONNECTED) {
4796                 hci_conn_hold(conn);
4797                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4798                 hci_conn_drop(conn);
4799         }
4800
4801         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4802             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4803                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4804                              sizeof(ev->bdaddr), &ev->bdaddr);
4805         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4806                 u8 secure;
4807
4808                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4809                         secure = 1;
4810                 else
4811                         secure = 0;
4812
4813                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4814         }
4815
4816 unlock:
4817         hci_dev_unlock(hdev);
4818 }
4819
4820 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4821 {
4822         if (key_type == HCI_LK_CHANGED_COMBINATION)
4823                 return;
4824
4825         conn->pin_length = pin_len;
4826         conn->key_type = key_type;
4827
4828         switch (key_type) {
4829         case HCI_LK_LOCAL_UNIT:
4830         case HCI_LK_REMOTE_UNIT:
4831         case HCI_LK_DEBUG_COMBINATION:
4832                 return;
4833         case HCI_LK_COMBINATION:
4834                 if (pin_len == 16)
4835                         conn->pending_sec_level = BT_SECURITY_HIGH;
4836                 else
4837                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4838                 break;
4839         case HCI_LK_UNAUTH_COMBINATION_P192:
4840         case HCI_LK_UNAUTH_COMBINATION_P256:
4841                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4842                 break;
4843         case HCI_LK_AUTH_COMBINATION_P192:
4844                 conn->pending_sec_level = BT_SECURITY_HIGH;
4845                 break;
4846         case HCI_LK_AUTH_COMBINATION_P256:
4847                 conn->pending_sec_level = BT_SECURITY_FIPS;
4848                 break;
4849         }
4850 }
4851
4852 static void hci_link_key_request_evt(struct hci_dev *hdev, void *data,
4853                                      struct sk_buff *skb)
4854 {
4855         struct hci_ev_link_key_req *ev = data;
4856         struct hci_cp_link_key_reply cp;
4857         struct hci_conn *conn;
4858         struct link_key *key;
4859
4860         bt_dev_dbg(hdev, "");
4861
4862         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4863                 return;
4864
4865         hci_dev_lock(hdev);
4866
4867         key = hci_find_link_key(hdev, &ev->bdaddr);
4868         if (!key) {
4869                 bt_dev_dbg(hdev, "link key not found for %pMR", &ev->bdaddr);
4870                 goto not_found;
4871         }
4872
4873         bt_dev_dbg(hdev, "found key type %u for %pMR", key->type, &ev->bdaddr);
4874
4875         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4876         if (conn) {
4877                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4878
4879                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4880                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4881                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4882                         bt_dev_dbg(hdev, "ignoring unauthenticated key");
4883                         goto not_found;
4884                 }
4885
4886                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4887                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4888                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4889                         bt_dev_dbg(hdev, "ignoring key unauthenticated for high security");
4890                         goto not_found;
4891                 }
4892
4893                 conn_set_key(conn, key->type, key->pin_len);
4894         }
4895
4896         bacpy(&cp.bdaddr, &ev->bdaddr);
4897         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4898
4899         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4900
4901         hci_dev_unlock(hdev);
4902
4903         return;
4904
4905 not_found:
4906         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4907         hci_dev_unlock(hdev);
4908 }
4909
4910 static void hci_link_key_notify_evt(struct hci_dev *hdev, void *data,
4911                                     struct sk_buff *skb)
4912 {
4913         struct hci_ev_link_key_notify *ev = data;
4914         struct hci_conn *conn;
4915         struct link_key *key;
4916         bool persistent;
4917         u8 pin_len = 0;
4918
4919         bt_dev_dbg(hdev, "");
4920
4921         hci_dev_lock(hdev);
4922
4923         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4924         if (!conn)
4925                 goto unlock;
4926
4927         /* Ignore NULL link key against CVE-2020-26555 */
4928         if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
4929                 bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
4930                            &ev->bdaddr);
4931                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4932                 hci_conn_drop(conn);
4933                 goto unlock;
4934         }
4935
4936         hci_conn_hold(conn);
4937         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4938         hci_conn_drop(conn);
4939
4940         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4941         conn_set_key(conn, ev->key_type, conn->pin_length);
4942
4943         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4944                 goto unlock;
4945
4946         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4947                                 ev->key_type, pin_len, &persistent);
4948         if (!key)
4949                 goto unlock;
4950
4951         /* Update connection information since adding the key will have
4952          * fixed up the type in the case of changed combination keys.
4953          */
4954         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4955                 conn_set_key(conn, key->type, key->pin_len);
4956
4957         mgmt_new_link_key(hdev, key, persistent);
4958
4959         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4960          * is set. If it's not set simply remove the key from the kernel
4961          * list (we've still notified user space about it but with
4962          * store_hint being 0).
4963          */
4964         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4965             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4966                 list_del_rcu(&key->list);
4967                 kfree_rcu(key, rcu);
4968                 goto unlock;
4969         }
4970
4971         if (persistent)
4972                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4973         else
4974                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4975
4976 unlock:
4977         hci_dev_unlock(hdev);
4978 }
4979
4980 static void hci_clock_offset_evt(struct hci_dev *hdev, void *data,
4981                                  struct sk_buff *skb)
4982 {
4983         struct hci_ev_clock_offset *ev = data;
4984         struct hci_conn *conn;
4985
4986         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
4987
4988         hci_dev_lock(hdev);
4989
4990         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4991         if (conn && !ev->status) {
4992                 struct inquiry_entry *ie;
4993
4994                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4995                 if (ie) {
4996                         ie->data.clock_offset = ev->clock_offset;
4997                         ie->timestamp = jiffies;
4998                 }
4999         }
5000
5001         hci_dev_unlock(hdev);
5002 }
5003
5004 static void hci_pkt_type_change_evt(struct hci_dev *hdev, void *data,
5005                                     struct sk_buff *skb)
5006 {
5007         struct hci_ev_pkt_type_change *ev = data;
5008         struct hci_conn *conn;
5009
5010         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5011
5012         hci_dev_lock(hdev);
5013
5014         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5015         if (conn && !ev->status)
5016                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
5017
5018         hci_dev_unlock(hdev);
5019 }
5020
5021 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, void *data,
5022                                    struct sk_buff *skb)
5023 {
5024         struct hci_ev_pscan_rep_mode *ev = data;
5025         struct inquiry_entry *ie;
5026
5027         bt_dev_dbg(hdev, "");
5028
5029         hci_dev_lock(hdev);
5030
5031         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5032         if (ie) {
5033                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
5034                 ie->timestamp = jiffies;
5035         }
5036
5037         hci_dev_unlock(hdev);
5038 }
5039
5040 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, void *edata,
5041                                              struct sk_buff *skb)
5042 {
5043         struct hci_ev_inquiry_result_rssi *ev = edata;
5044         struct inquiry_data data;
5045         int i;
5046
5047         bt_dev_dbg(hdev, "num_rsp %d", ev->num);
5048
5049         if (!ev->num)
5050                 return;
5051
5052         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5053                 return;
5054
5055         hci_dev_lock(hdev);
5056
5057         if (skb->len == array_size(ev->num,
5058                                    sizeof(struct inquiry_info_rssi_pscan))) {
5059                 struct inquiry_info_rssi_pscan *info;
5060
5061                 for (i = 0; i < ev->num; i++) {
5062                         u32 flags;
5063
5064                         info = hci_ev_skb_pull(hdev, skb,
5065                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
5066                                                sizeof(*info));
5067                         if (!info) {
5068                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
5069                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
5070                                 goto unlock;
5071                         }
5072
5073                         bacpy(&data.bdaddr, &info->bdaddr);
5074                         data.pscan_rep_mode     = info->pscan_rep_mode;
5075                         data.pscan_period_mode  = info->pscan_period_mode;
5076                         data.pscan_mode         = info->pscan_mode;
5077                         memcpy(data.dev_class, info->dev_class, 3);
5078                         data.clock_offset       = info->clock_offset;
5079                         data.rssi               = info->rssi;
5080                         data.ssp_mode           = 0x00;
5081
5082                         flags = hci_inquiry_cache_update(hdev, &data, false);
5083
5084                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5085                                           info->dev_class, info->rssi,
5086                                           flags, NULL, 0, NULL, 0, 0);
5087                 }
5088         } else if (skb->len == array_size(ev->num,
5089                                           sizeof(struct inquiry_info_rssi))) {
5090                 struct inquiry_info_rssi *info;
5091
5092                 for (i = 0; i < ev->num; i++) {
5093                         u32 flags;
5094
5095                         info = hci_ev_skb_pull(hdev, skb,
5096                                                HCI_EV_INQUIRY_RESULT_WITH_RSSI,
5097                                                sizeof(*info));
5098                         if (!info) {
5099                                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
5100                                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
5101                                 goto unlock;
5102                         }
5103
5104                         bacpy(&data.bdaddr, &info->bdaddr);
5105                         data.pscan_rep_mode     = info->pscan_rep_mode;
5106                         data.pscan_period_mode  = info->pscan_period_mode;
5107                         data.pscan_mode         = 0x00;
5108                         memcpy(data.dev_class, info->dev_class, 3);
5109                         data.clock_offset       = info->clock_offset;
5110                         data.rssi               = info->rssi;
5111                         data.ssp_mode           = 0x00;
5112
5113                         flags = hci_inquiry_cache_update(hdev, &data, false);
5114
5115                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5116                                           info->dev_class, info->rssi,
5117                                           flags, NULL, 0, NULL, 0, 0);
5118                 }
5119         } else {
5120                 bt_dev_err(hdev, "Malformed HCI Event: 0x%2.2x",
5121                            HCI_EV_INQUIRY_RESULT_WITH_RSSI);
5122         }
5123 unlock:
5124         hci_dev_unlock(hdev);
5125 }
5126
5127 static void hci_remote_ext_features_evt(struct hci_dev *hdev, void *data,
5128                                         struct sk_buff *skb)
5129 {
5130         struct hci_ev_remote_ext_features *ev = data;
5131         struct hci_conn *conn;
5132
5133         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5134
5135         hci_dev_lock(hdev);
5136
5137         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5138         if (!conn)
5139                 goto unlock;
5140
5141         if (ev->page < HCI_MAX_PAGES)
5142                 memcpy(conn->features[ev->page], ev->features, 8);
5143
5144         if (!ev->status && ev->page == 0x01) {
5145                 struct inquiry_entry *ie;
5146
5147                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
5148                 if (ie)
5149                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5150
5151                 if (ev->features[0] & LMP_HOST_SSP) {
5152                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
5153                 } else {
5154                         /* It is mandatory by the Bluetooth specification that
5155                          * Extended Inquiry Results are only used when Secure
5156                          * Simple Pairing is enabled, but some devices violate
5157                          * this.
5158                          *
5159                          * To make these devices work, the internal SSP
5160                          * enabled flag needs to be cleared if the remote host
5161                          * features do not indicate SSP support */
5162                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
5163                 }
5164
5165                 if (ev->features[0] & LMP_HOST_SC)
5166                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
5167         }
5168
5169         if (conn->state != BT_CONFIG)
5170                 goto unlock;
5171
5172         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
5173                 struct hci_cp_remote_name_req cp;
5174                 memset(&cp, 0, sizeof(cp));
5175                 bacpy(&cp.bdaddr, &conn->dst);
5176                 cp.pscan_rep_mode = 0x02;
5177                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
5178         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5179                 mgmt_device_connected(hdev, conn, NULL, 0);
5180
5181         if (!hci_outgoing_auth_needed(hdev, conn)) {
5182                 conn->state = BT_CONNECTED;
5183                 hci_connect_cfm(conn, ev->status);
5184                 hci_conn_drop(conn);
5185         }
5186
5187 unlock:
5188         hci_dev_unlock(hdev);
5189 }
5190
5191 static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data,
5192                                        struct sk_buff *skb)
5193 {
5194         struct hci_ev_sync_conn_complete *ev = data;
5195         struct hci_conn *conn;
5196         u8 status = ev->status;
5197
5198         switch (ev->link_type) {
5199         case SCO_LINK:
5200         case ESCO_LINK:
5201                 break;
5202         default:
5203                 /* As per Core 5.3 Vol 4 Part E 7.7.35 (p.2219), Link_Type
5204                  * for HCI_Synchronous_Connection_Complete is limited to
5205                  * either SCO or eSCO
5206                  */
5207                 bt_dev_err(hdev, "Ignoring connect complete event for invalid link type");
5208                 return;
5209         }
5210
5211         bt_dev_dbg(hdev, "status 0x%2.2x", status);
5212
5213         hci_dev_lock(hdev);
5214
5215         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
5216         if (!conn) {
5217                 if (ev->link_type == ESCO_LINK)
5218                         goto unlock;
5219
5220                 /* When the link type in the event indicates SCO connection
5221                  * and lookup of the connection object fails, then check
5222                  * if an eSCO connection object exists.
5223                  *
5224                  * The core limits the synchronous connections to either
5225                  * SCO or eSCO. The eSCO connection is preferred and tried
5226                  * to be setup first and until successfully established,
5227                  * the link type will be hinted as eSCO.
5228                  */
5229                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
5230                 if (!conn)
5231                         goto unlock;
5232         }
5233
5234         /* The HCI_Synchronous_Connection_Complete event is only sent once per connection.
5235          * Processing it more than once per connection can corrupt kernel memory.
5236          *
5237          * As the connection handle is set here for the first time, it indicates
5238          * whether the connection is already set up.
5239          */
5240         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
5241                 bt_dev_err(hdev, "Ignoring HCI_Sync_Conn_Complete event for existing connection");
5242                 goto unlock;
5243         }
5244
5245         switch (status) {
5246         case 0x00:
5247                 status = hci_conn_set_handle(conn, __le16_to_cpu(ev->handle));
5248                 if (status) {
5249                         conn->state = BT_CLOSED;
5250                         break;
5251                 }
5252
5253                 conn->state  = BT_CONNECTED;
5254                 conn->type   = ev->link_type;
5255
5256                 hci_debugfs_create_conn(conn);
5257                 hci_conn_add_sysfs(conn);
5258                 break;
5259
5260         case 0x10:      /* Connection Accept Timeout */
5261         case 0x0d:      /* Connection Rejected due to Limited Resources */
5262         case 0x11:      /* Unsupported Feature or Parameter Value */
5263         case 0x1c:      /* SCO interval rejected */
5264         case 0x1a:      /* Unsupported Remote Feature */
5265         case 0x1e:      /* Invalid LMP Parameters */
5266         case 0x1f:      /* Unspecified error */
5267         case 0x20:      /* Unsupported LMP Parameter value */
5268                 if (conn->out) {
5269                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
5270                                         (hdev->esco_type & EDR_ESCO_MASK);
5271                         if (hci_setup_sync(conn, conn->parent->handle))
5272                                 goto unlock;
5273                 }
5274                 fallthrough;
5275
5276         default:
5277                 conn->state = BT_CLOSED;
5278                 break;
5279         }
5280
5281         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
5282         /* Notify only in case of SCO over HCI transport data path which
5283          * is zero and non-zero value shall be non-HCI transport data path
5284          */
5285         if (conn->codec.data_path == 0 && hdev->notify) {
5286                 switch (ev->air_mode) {
5287                 case 0x02:
5288                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
5289                         break;
5290                 case 0x03:
5291                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
5292                         break;
5293                 }
5294         }
5295
5296         hci_connect_cfm(conn, status);
5297         if (status)
5298                 hci_conn_del(conn);
5299
5300 unlock:
5301         hci_dev_unlock(hdev);
5302 }
5303
5304 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
5305 {
5306         size_t parsed = 0;
5307
5308         while (parsed < eir_len) {
5309                 u8 field_len = eir[0];
5310
5311                 if (field_len == 0)
5312                         return parsed;
5313
5314                 parsed += field_len + 1;
5315                 eir += field_len + 1;
5316         }
5317
5318         return eir_len;
5319 }
5320
5321 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, void *edata,
5322                                             struct sk_buff *skb)
5323 {
5324         struct hci_ev_ext_inquiry_result *ev = edata;
5325         struct inquiry_data data;
5326         size_t eir_len;
5327         int i;
5328
5329         if (!hci_ev_skb_pull(hdev, skb, HCI_EV_EXTENDED_INQUIRY_RESULT,
5330                              flex_array_size(ev, info, ev->num)))
5331                 return;
5332
5333         bt_dev_dbg(hdev, "num %d", ev->num);
5334
5335         if (!ev->num)
5336                 return;
5337
5338         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
5339                 return;
5340
5341         hci_dev_lock(hdev);
5342
5343         for (i = 0; i < ev->num; i++) {
5344                 struct extended_inquiry_info *info = &ev->info[i];
5345                 u32 flags;
5346                 bool name_known;
5347
5348                 bacpy(&data.bdaddr, &info->bdaddr);
5349                 data.pscan_rep_mode     = info->pscan_rep_mode;
5350                 data.pscan_period_mode  = info->pscan_period_mode;
5351                 data.pscan_mode         = 0x00;
5352                 memcpy(data.dev_class, info->dev_class, 3);
5353                 data.clock_offset       = info->clock_offset;
5354                 data.rssi               = info->rssi;
5355                 data.ssp_mode           = 0x01;
5356
5357                 if (hci_dev_test_flag(hdev, HCI_MGMT))
5358                         name_known = eir_get_data(info->data,
5359                                                   sizeof(info->data),
5360                                                   EIR_NAME_COMPLETE, NULL);
5361                 else
5362                         name_known = true;
5363
5364                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
5365
5366                 eir_len = eir_get_length(info->data, sizeof(info->data));
5367
5368                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
5369                                   info->dev_class, info->rssi,
5370                                   flags, info->data, eir_len, NULL, 0, 0);
5371         }
5372
5373         hci_dev_unlock(hdev);
5374 }
5375
5376 static void hci_key_refresh_complete_evt(struct hci_dev *hdev, void *data,
5377                                          struct sk_buff *skb)
5378 {
5379         struct hci_ev_key_refresh_complete *ev = data;
5380         struct hci_conn *conn;
5381
5382         bt_dev_dbg(hdev, "status 0x%2.2x handle 0x%4.4x", ev->status,
5383                    __le16_to_cpu(ev->handle));
5384
5385         hci_dev_lock(hdev);
5386
5387         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5388         if (!conn)
5389                 goto unlock;
5390
5391         /* For BR/EDR the necessary steps are taken through the
5392          * auth_complete event.
5393          */
5394         if (conn->type != LE_LINK)
5395                 goto unlock;
5396
5397         if (!ev->status)
5398                 conn->sec_level = conn->pending_sec_level;
5399
5400         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
5401
5402         if (ev->status && conn->state == BT_CONNECTED) {
5403                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
5404                 hci_conn_drop(conn);
5405                 goto unlock;
5406         }
5407
5408         if (conn->state == BT_CONFIG) {
5409                 if (!ev->status)
5410                         conn->state = BT_CONNECTED;
5411
5412                 hci_connect_cfm(conn, ev->status);
5413                 hci_conn_drop(conn);
5414         } else {
5415                 hci_auth_cfm(conn, ev->status);
5416
5417                 hci_conn_hold(conn);
5418                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
5419                 hci_conn_drop(conn);
5420         }
5421
5422 unlock:
5423         hci_dev_unlock(hdev);
5424 }
5425
5426 static u8 hci_get_auth_req(struct hci_conn *conn)
5427 {
5428         /* If remote requests no-bonding follow that lead */
5429         if (conn->remote_auth == HCI_AT_NO_BONDING ||
5430             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
5431                 return conn->remote_auth | (conn->auth_type & 0x01);
5432
5433         /* If both remote and local have enough IO capabilities, require
5434          * MITM protection
5435          */
5436         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
5437             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
5438                 return conn->remote_auth | 0x01;
5439
5440         /* No MITM protection possible so ignore remote requirement */
5441         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
5442 }
5443
5444 static u8 bredr_oob_data_present(struct hci_conn *conn)
5445 {
5446         struct hci_dev *hdev = conn->hdev;
5447         struct oob_data *data;
5448
5449         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
5450         if (!data)
5451                 return 0x00;
5452
5453         if (bredr_sc_enabled(hdev)) {
5454                 /* When Secure Connections is enabled, then just
5455                  * return the present value stored with the OOB
5456                  * data. The stored value contains the right present
5457                  * information. However it can only be trusted when
5458                  * not in Secure Connection Only mode.
5459                  */
5460                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
5461                         return data->present;
5462
5463                 /* When Secure Connections Only mode is enabled, then
5464                  * the P-256 values are required. If they are not
5465                  * available, then do not declare that OOB data is
5466                  * present.
5467                  */
5468                 if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
5469                     !crypto_memneq(data->hash256, ZERO_KEY, 16))
5470                         return 0x00;
5471
5472                 return 0x02;
5473         }
5474
5475         /* When Secure Connections is not enabled or actually
5476          * not supported by the hardware, then check that if
5477          * P-192 data values are present.
5478          */
5479         if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
5480             !crypto_memneq(data->hash192, ZERO_KEY, 16))
5481                 return 0x00;
5482
5483         return 0x01;
5484 }
5485
5486 static void hci_io_capa_request_evt(struct hci_dev *hdev, void *data,
5487                                     struct sk_buff *skb)
5488 {
5489         struct hci_ev_io_capa_request *ev = data;
5490         struct hci_conn *conn;
5491
5492         bt_dev_dbg(hdev, "");
5493
5494         hci_dev_lock(hdev);
5495
5496         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5497         if (!conn || !hci_conn_ssp_enabled(conn))
5498                 goto unlock;
5499
5500         hci_conn_hold(conn);
5501
5502         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5503                 goto unlock;
5504
5505         /* Allow pairing if we're pairable, the initiators of the
5506          * pairing or if the remote is not requesting bonding.
5507          */
5508         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
5509             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
5510             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
5511                 struct hci_cp_io_capability_reply cp;
5512
5513                 bacpy(&cp.bdaddr, &ev->bdaddr);
5514                 /* Change the IO capability from KeyboardDisplay
5515                  * to DisplayYesNo as it is not supported by BT spec. */
5516                 cp.capability = (conn->io_capability == 0x04) ?
5517                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
5518
5519                 /* If we are initiators, there is no remote information yet */
5520                 if (conn->remote_auth == 0xff) {
5521                         /* Request MITM protection if our IO caps allow it
5522                          * except for the no-bonding case.
5523                          */
5524                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5525                             conn->auth_type != HCI_AT_NO_BONDING)
5526                                 conn->auth_type |= 0x01;
5527                 } else {
5528                         conn->auth_type = hci_get_auth_req(conn);
5529                 }
5530
5531                 /* If we're not bondable, force one of the non-bondable
5532                  * authentication requirement values.
5533                  */
5534                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
5535                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
5536
5537                 cp.authentication = conn->auth_type;
5538                 cp.oob_data = bredr_oob_data_present(conn);
5539
5540                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
5541                              sizeof(cp), &cp);
5542         } else {
5543                 struct hci_cp_io_capability_neg_reply cp;
5544
5545                 bacpy(&cp.bdaddr, &ev->bdaddr);
5546                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
5547
5548                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
5549                              sizeof(cp), &cp);
5550         }
5551
5552 unlock:
5553         hci_dev_unlock(hdev);
5554 }
5555
5556 static void hci_io_capa_reply_evt(struct hci_dev *hdev, void *data,
5557                                   struct sk_buff *skb)
5558 {
5559         struct hci_ev_io_capa_reply *ev = data;
5560         struct hci_conn *conn;
5561
5562         bt_dev_dbg(hdev, "");
5563
5564         hci_dev_lock(hdev);
5565
5566         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5567         if (!conn)
5568                 goto unlock;
5569
5570         conn->remote_cap = ev->capability;
5571         conn->remote_auth = ev->authentication;
5572
5573 unlock:
5574         hci_dev_unlock(hdev);
5575 }
5576
5577 static void hci_user_confirm_request_evt(struct hci_dev *hdev, void *data,
5578                                          struct sk_buff *skb)
5579 {
5580         struct hci_ev_user_confirm_req *ev = data;
5581         int loc_mitm, rem_mitm, confirm_hint = 0;
5582         struct hci_conn *conn;
5583
5584         bt_dev_dbg(hdev, "");
5585
5586         hci_dev_lock(hdev);
5587
5588         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5589                 goto unlock;
5590
5591         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5592         if (!conn)
5593                 goto unlock;
5594
5595         loc_mitm = (conn->auth_type & 0x01);
5596         rem_mitm = (conn->remote_auth & 0x01);
5597
5598         /* If we require MITM but the remote device can't provide that
5599          * (it has NoInputNoOutput) then reject the confirmation
5600          * request. We check the security level here since it doesn't
5601          * necessarily match conn->auth_type.
5602          */
5603         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
5604             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
5605                 bt_dev_dbg(hdev, "Rejecting request: remote device can't provide MITM");
5606                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
5607                              sizeof(ev->bdaddr), &ev->bdaddr);
5608                 goto unlock;
5609         }
5610
5611         /* If no side requires MITM protection; auto-accept */
5612         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
5613             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
5614
5615                 /* If we're not the initiators request authorization to
5616                  * proceed from user space (mgmt_user_confirm with
5617                  * confirm_hint set to 1). The exception is if neither
5618                  * side had MITM or if the local IO capability is
5619                  * NoInputNoOutput, in which case we do auto-accept
5620                  */
5621                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
5622                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
5623                     (loc_mitm || rem_mitm)) {
5624                         bt_dev_dbg(hdev, "Confirming auto-accept as acceptor");
5625                         confirm_hint = 1;
5626                         goto confirm;
5627                 }
5628
5629                 /* If there already exists link key in local host, leave the
5630                  * decision to user space since the remote device could be
5631                  * legitimate or malicious.
5632                  */
5633                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
5634                         bt_dev_dbg(hdev, "Local host already has link key");
5635                         confirm_hint = 1;
5636                         goto confirm;
5637                 }
5638
5639                 BT_DBG("Auto-accept of user confirmation with %ums delay",
5640                        hdev->auto_accept_delay);
5641
5642                 if (hdev->auto_accept_delay > 0) {
5643                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
5644                         queue_delayed_work(conn->hdev->workqueue,
5645                                            &conn->auto_accept_work, delay);
5646                         goto unlock;
5647                 }
5648
5649                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
5650                              sizeof(ev->bdaddr), &ev->bdaddr);
5651                 goto unlock;
5652         }
5653
5654 confirm:
5655         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
5656                                   le32_to_cpu(ev->passkey), confirm_hint);
5657
5658 unlock:
5659         hci_dev_unlock(hdev);
5660 }
5661
5662 static void hci_user_passkey_request_evt(struct hci_dev *hdev, void *data,
5663                                          struct sk_buff *skb)
5664 {
5665         struct hci_ev_user_passkey_req *ev = data;
5666
5667         bt_dev_dbg(hdev, "");
5668
5669         if (hci_dev_test_flag(hdev, HCI_MGMT))
5670                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
5671 }
5672
5673 static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data,
5674                                         struct sk_buff *skb)
5675 {
5676         struct hci_ev_user_passkey_notify *ev = data;
5677         struct hci_conn *conn;
5678
5679         bt_dev_dbg(hdev, "");
5680
5681         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5682         if (!conn)
5683                 return;
5684
5685         conn->passkey_notify = __le32_to_cpu(ev->passkey);
5686         conn->passkey_entered = 0;
5687
5688         if (hci_dev_test_flag(hdev, HCI_MGMT))
5689                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5690                                          conn->dst_type, conn->passkey_notify,
5691                                          conn->passkey_entered);
5692 }
5693
5694 static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data,
5695                                     struct sk_buff *skb)
5696 {
5697         struct hci_ev_keypress_notify *ev = data;
5698         struct hci_conn *conn;
5699
5700         bt_dev_dbg(hdev, "");
5701
5702         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5703         if (!conn)
5704                 return;
5705
5706         switch (ev->type) {
5707         case HCI_KEYPRESS_STARTED:
5708                 conn->passkey_entered = 0;
5709                 return;
5710
5711         case HCI_KEYPRESS_ENTERED:
5712                 conn->passkey_entered++;
5713                 break;
5714
5715         case HCI_KEYPRESS_ERASED:
5716                 conn->passkey_entered--;
5717                 break;
5718
5719         case HCI_KEYPRESS_CLEARED:
5720                 conn->passkey_entered = 0;
5721                 break;
5722
5723         case HCI_KEYPRESS_COMPLETED:
5724                 return;
5725         }
5726
5727         if (hci_dev_test_flag(hdev, HCI_MGMT))
5728                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5729                                          conn->dst_type, conn->passkey_notify,
5730                                          conn->passkey_entered);
5731 }
5732
5733 static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data,
5734                                          struct sk_buff *skb)
5735 {
5736         struct hci_ev_simple_pair_complete *ev = data;
5737         struct hci_conn *conn;
5738
5739         bt_dev_dbg(hdev, "");
5740
5741         hci_dev_lock(hdev);
5742
5743         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5744         if (!conn || !hci_conn_ssp_enabled(conn))
5745                 goto unlock;
5746
5747         /* Reset the authentication requirement to unknown */
5748         conn->remote_auth = 0xff;
5749
5750         /* To avoid duplicate auth_failed events to user space we check
5751          * the HCI_CONN_AUTH_PEND flag which will be set if we
5752          * initiated the authentication. A traditional auth_complete
5753          * event gets always produced as initiator and is also mapped to
5754          * the mgmt_auth_failed event */
5755         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5756                 mgmt_auth_failed(conn, ev->status);
5757
5758         hci_conn_drop(conn);
5759
5760 unlock:
5761         hci_dev_unlock(hdev);
5762 }
5763
5764 static void hci_remote_host_features_evt(struct hci_dev *hdev, void *data,
5765                                          struct sk_buff *skb)
5766 {
5767         struct hci_ev_remote_host_features *ev = data;
5768         struct inquiry_entry *ie;
5769         struct hci_conn *conn;
5770
5771         bt_dev_dbg(hdev, "");
5772
5773         hci_dev_lock(hdev);
5774
5775         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5776         if (conn)
5777                 memcpy(conn->features[1], ev->features, 8);
5778
5779         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5780         if (ie)
5781                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5782
5783         hci_dev_unlock(hdev);
5784 }
5785
5786 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev, void *edata,
5787                                             struct sk_buff *skb)
5788 {
5789         struct hci_ev_remote_oob_data_request *ev = edata;
5790         struct oob_data *data;
5791
5792         bt_dev_dbg(hdev, "");
5793
5794         hci_dev_lock(hdev);
5795
5796         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5797                 goto unlock;
5798
5799         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5800         if (!data) {
5801                 struct hci_cp_remote_oob_data_neg_reply cp;
5802
5803                 bacpy(&cp.bdaddr, &ev->bdaddr);
5804                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5805                              sizeof(cp), &cp);
5806                 goto unlock;
5807         }
5808
5809         if (bredr_sc_enabled(hdev)) {
5810                 struct hci_cp_remote_oob_ext_data_reply cp;
5811
5812                 bacpy(&cp.bdaddr, &ev->bdaddr);
5813                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5814                         memset(cp.hash192, 0, sizeof(cp.hash192));
5815                         memset(cp.rand192, 0, sizeof(cp.rand192));
5816                 } else {
5817                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5818                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5819                 }
5820                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5821                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5822
5823                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5824                              sizeof(cp), &cp);
5825         } else {
5826                 struct hci_cp_remote_oob_data_reply cp;
5827
5828                 bacpy(&cp.bdaddr, &ev->bdaddr);
5829                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5830                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5831
5832                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5833                              sizeof(cp), &cp);
5834         }
5835
5836 unlock:
5837         hci_dev_unlock(hdev);
5838 }
5839
5840 #if IS_ENABLED(CONFIG_BT_HS)
5841 static void hci_chan_selected_evt(struct hci_dev *hdev, void *data,
5842                                   struct sk_buff *skb)
5843 {
5844         struct hci_ev_channel_selected *ev = data;
5845         struct hci_conn *hcon;
5846
5847         bt_dev_dbg(hdev, "handle 0x%2.2x", ev->phy_handle);
5848
5849         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5850         if (!hcon)
5851                 return;
5852
5853         amp_read_loc_assoc_final_data(hdev, hcon);
5854 }
5855
5856 static void hci_phy_link_complete_evt(struct hci_dev *hdev, void *data,
5857                                       struct sk_buff *skb)
5858 {
5859         struct hci_ev_phy_link_complete *ev = data;
5860         struct hci_conn *hcon, *bredr_hcon;
5861
5862         bt_dev_dbg(hdev, "handle 0x%2.2x status 0x%2.2x", ev->phy_handle,
5863                    ev->status);
5864
5865         hci_dev_lock(hdev);
5866
5867         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5868         if (!hcon)
5869                 goto unlock;
5870
5871         if (!hcon->amp_mgr)
5872                 goto unlock;
5873
5874         if (ev->status) {
5875                 hci_conn_del(hcon);
5876                 goto unlock;
5877         }
5878
5879         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5880
5881         hcon->state = BT_CONNECTED;
5882         bacpy(&hcon->dst, &bredr_hcon->dst);
5883
5884         hci_conn_hold(hcon);
5885         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5886         hci_conn_drop(hcon);
5887
5888         hci_debugfs_create_conn(hcon);
5889         hci_conn_add_sysfs(hcon);
5890
5891         amp_physical_cfm(bredr_hcon, hcon);
5892
5893 unlock:
5894         hci_dev_unlock(hdev);
5895 }
5896
5897 static void hci_loglink_complete_evt(struct hci_dev *hdev, void *data,
5898                                      struct sk_buff *skb)
5899 {
5900         struct hci_ev_logical_link_complete *ev = data;
5901         struct hci_conn *hcon;
5902         struct hci_chan *hchan;
5903         struct amp_mgr *mgr;
5904
5905         bt_dev_dbg(hdev, "log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5906                    le16_to_cpu(ev->handle), ev->phy_handle, ev->status);
5907
5908         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5909         if (!hcon)
5910                 return;
5911
5912         /* Create AMP hchan */
5913         hchan = hci_chan_create(hcon);
5914         if (!hchan)
5915                 return;
5916
5917         hchan->handle = le16_to_cpu(ev->handle);
5918         hchan->amp = true;
5919
5920         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5921
5922         mgr = hcon->amp_mgr;
5923         if (mgr && mgr->bredr_chan) {
5924                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5925
5926                 l2cap_chan_lock(bredr_chan);
5927
5928                 bredr_chan->conn->mtu = hdev->block_mtu;
5929                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5930                 hci_conn_hold(hcon);
5931
5932                 l2cap_chan_unlock(bredr_chan);
5933         }
5934 }
5935
5936 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev, void *data,
5937                                              struct sk_buff *skb)
5938 {
5939         struct hci_ev_disconn_logical_link_complete *ev = data;
5940         struct hci_chan *hchan;
5941
5942         bt_dev_dbg(hdev, "handle 0x%4.4x status 0x%2.2x",
5943                    le16_to_cpu(ev->handle), ev->status);
5944
5945         if (ev->status)
5946                 return;
5947
5948         hci_dev_lock(hdev);
5949
5950         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5951         if (!hchan || !hchan->amp)
5952                 goto unlock;
5953
5954         amp_destroy_logical_link(hchan, ev->reason);
5955
5956 unlock:
5957         hci_dev_unlock(hdev);
5958 }
5959
5960 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, void *data,
5961                                              struct sk_buff *skb)
5962 {
5963         struct hci_ev_disconn_phy_link_complete *ev = data;
5964         struct hci_conn *hcon;
5965
5966         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
5967
5968         if (ev->status)
5969                 return;
5970
5971         hci_dev_lock(hdev);
5972
5973         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5974         if (hcon && hcon->type == AMP_LINK) {
5975                 hcon->state = BT_CLOSED;
5976                 hci_disconn_cfm(hcon, ev->reason);
5977                 hci_conn_del(hcon);
5978         }
5979
5980         hci_dev_unlock(hdev);
5981 }
5982 #endif
5983
5984 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5985                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5986 {
5987         if (conn->out) {
5988                 conn->dst_type = bdaddr_type;
5989                 conn->resp_addr_type = bdaddr_type;
5990                 bacpy(&conn->resp_addr, bdaddr);
5991
5992                 /* Check if the controller has set a Local RPA then it must be
5993                  * used instead or hdev->rpa.
5994                  */
5995                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5996                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5997                         bacpy(&conn->init_addr, local_rpa);
5998                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5999                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
6000                         bacpy(&conn->init_addr, &conn->hdev->rpa);
6001                 } else {
6002                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
6003                                                   &conn->init_addr_type);
6004                 }
6005         } else {
6006                 conn->resp_addr_type = conn->hdev->adv_addr_type;
6007                 /* Check if the controller has set a Local RPA then it must be
6008                  * used instead or hdev->rpa.
6009                  */
6010                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
6011                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
6012                         bacpy(&conn->resp_addr, local_rpa);
6013                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
6014                         /* In case of ext adv, resp_addr will be updated in
6015                          * Adv Terminated event.
6016                          */
6017                         if (!ext_adv_capable(conn->hdev))
6018                                 bacpy(&conn->resp_addr,
6019                                       &conn->hdev->random_addr);
6020                 } else {
6021                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
6022                 }
6023
6024                 conn->init_addr_type = bdaddr_type;
6025                 bacpy(&conn->init_addr, bdaddr);
6026
6027                 /* For incoming connections, set the default minimum
6028                  * and maximum connection interval. They will be used
6029                  * to check if the parameters are in range and if not
6030                  * trigger the connection update procedure.
6031                  */
6032                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
6033                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
6034         }
6035 }
6036
6037 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
6038                                  bdaddr_t *bdaddr, u8 bdaddr_type,
6039                                  bdaddr_t *local_rpa, u8 role, u16 handle,
6040                                  u16 interval, u16 latency,
6041                                  u16 supervision_timeout)
6042 {
6043         struct hci_conn_params *params;
6044         struct hci_conn *conn;
6045         struct smp_irk *irk;
6046         u8 addr_type;
6047
6048         hci_dev_lock(hdev);
6049
6050         /* All controllers implicitly stop advertising in the event of a
6051          * connection, so ensure that the state bit is cleared.
6052          */
6053         hci_dev_clear_flag(hdev, HCI_LE_ADV);
6054
6055         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, bdaddr);
6056         if (!conn) {
6057                 /* In case of error status and there is no connection pending
6058                  * just unlock as there is nothing to cleanup.
6059                  */
6060                 if (status)
6061                         goto unlock;
6062
6063                 conn = hci_conn_add_unset(hdev, LE_LINK, bdaddr, role);
6064                 if (!conn) {
6065                         bt_dev_err(hdev, "no memory for new connection");
6066                         goto unlock;
6067                 }
6068
6069                 conn->dst_type = bdaddr_type;
6070
6071                 /* If we didn't have a hci_conn object previously
6072                  * but we're in central role this must be something
6073                  * initiated using an accept list. Since accept list based
6074                  * connections are not "first class citizens" we don't
6075                  * have full tracking of them. Therefore, we go ahead
6076                  * with a "best effort" approach of determining the
6077                  * initiator address based on the HCI_PRIVACY flag.
6078                  */
6079                 if (conn->out) {
6080                         conn->resp_addr_type = bdaddr_type;
6081                         bacpy(&conn->resp_addr, bdaddr);
6082                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
6083                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
6084                                 bacpy(&conn->init_addr, &hdev->rpa);
6085                         } else {
6086                                 hci_copy_identity_address(hdev,
6087                                                           &conn->init_addr,
6088                                                           &conn->init_addr_type);
6089                         }
6090                 }
6091         } else {
6092 #ifdef TIZEN_BT
6093                 /* LE auto connect */
6094                 bacpy(&conn->dst, bdaddr);
6095 #endif
6096                 cancel_delayed_work(&conn->le_conn_timeout);
6097         }
6098
6099         /* The HCI_LE_Connection_Complete event is only sent once per connection.
6100          * Processing it more than once per connection can corrupt kernel memory.
6101          *
6102          * As the connection handle is set here for the first time, it indicates
6103          * whether the connection is already set up.
6104          */
6105         if (!HCI_CONN_HANDLE_UNSET(conn->handle)) {
6106                 bt_dev_err(hdev, "Ignoring HCI_Connection_Complete for existing connection");
6107                 goto unlock;
6108         }
6109
6110         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
6111
6112         /* Lookup the identity address from the stored connection
6113          * address and address type.
6114          *
6115          * When establishing connections to an identity address, the
6116          * connection procedure will store the resolvable random
6117          * address first. Now if it can be converted back into the
6118          * identity address, start using the identity address from
6119          * now on.
6120          */
6121         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
6122         if (irk) {
6123                 bacpy(&conn->dst, &irk->bdaddr);
6124                 conn->dst_type = irk->addr_type;
6125         }
6126
6127         conn->dst_type = ev_bdaddr_type(hdev, conn->dst_type, NULL);
6128
6129         /* All connection failure handling is taken care of by the
6130          * hci_conn_failed function which is triggered by the HCI
6131          * request completion callbacks used for connecting.
6132          */
6133         if (status || hci_conn_set_handle(conn, handle))
6134                 goto unlock;
6135
6136         /* Drop the connection if it has been aborted */
6137         if (test_bit(HCI_CONN_CANCEL, &conn->flags)) {
6138                 hci_conn_drop(conn);
6139                 goto unlock;
6140         }
6141
6142         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
6143                 addr_type = BDADDR_LE_PUBLIC;
6144         else
6145                 addr_type = BDADDR_LE_RANDOM;
6146
6147         /* Drop the connection if the device is blocked */
6148         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
6149                 hci_conn_drop(conn);
6150                 goto unlock;
6151         }
6152
6153         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
6154                 mgmt_device_connected(hdev, conn, NULL, 0);
6155
6156         conn->sec_level = BT_SECURITY_LOW;
6157         conn->state = BT_CONFIG;
6158
6159         /* Store current advertising instance as connection advertising instance
6160          * when sotfware rotation is in use so it can be re-enabled when
6161          * disconnected.
6162          */
6163         if (!ext_adv_capable(hdev))
6164                 conn->adv_instance = hdev->cur_adv_instance;
6165
6166         conn->le_conn_interval = interval;
6167         conn->le_conn_latency = latency;
6168         conn->le_supv_timeout = supervision_timeout;
6169
6170         hci_debugfs_create_conn(conn);
6171         hci_conn_add_sysfs(conn);
6172
6173         /* The remote features procedure is defined for central
6174          * role only. So only in case of an initiated connection
6175          * request the remote features.
6176          *
6177          * If the local controller supports peripheral-initiated features
6178          * exchange, then requesting the remote features in peripheral
6179          * role is possible. Otherwise just transition into the
6180          * connected state without requesting the remote features.
6181          */
6182         if (conn->out ||
6183             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
6184                 struct hci_cp_le_read_remote_features cp;
6185
6186                 cp.handle = __cpu_to_le16(conn->handle);
6187
6188                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
6189                              sizeof(cp), &cp);
6190
6191                 hci_conn_hold(conn);
6192         } else {
6193                 conn->state = BT_CONNECTED;
6194                 hci_connect_cfm(conn, status);
6195         }
6196
6197         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
6198                                            conn->dst_type);
6199         if (params) {
6200                 hci_pend_le_list_del_init(params);
6201                 if (params->conn) {
6202                         hci_conn_drop(params->conn);
6203                         hci_conn_put(params->conn);
6204                         params->conn = NULL;
6205                 }
6206         }
6207
6208 unlock:
6209         hci_update_passive_scan(hdev);
6210         hci_dev_unlock(hdev);
6211 }
6212
6213 static void hci_le_conn_complete_evt(struct hci_dev *hdev, void *data,
6214                                      struct sk_buff *skb)
6215 {
6216         struct hci_ev_le_conn_complete *ev = data;
6217
6218         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6219
6220         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
6221                              NULL, ev->role, le16_to_cpu(ev->handle),
6222                              le16_to_cpu(ev->interval),
6223                              le16_to_cpu(ev->latency),
6224                              le16_to_cpu(ev->supervision_timeout));
6225 }
6226
6227 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev, void *data,
6228                                          struct sk_buff *skb)
6229 {
6230         struct hci_ev_le_enh_conn_complete *ev = data;
6231
6232         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6233
6234         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
6235                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
6236                              le16_to_cpu(ev->interval),
6237                              le16_to_cpu(ev->latency),
6238                              le16_to_cpu(ev->supervision_timeout));
6239 }
6240
6241 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, void *data,
6242                                     struct sk_buff *skb)
6243 {
6244         struct hci_evt_le_ext_adv_set_term *ev = data;
6245         struct hci_conn *conn;
6246         struct adv_info *adv, *n;
6247
6248         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6249
6250         /* The Bluetooth Core 5.3 specification clearly states that this event
6251          * shall not be sent when the Host disables the advertising set. So in
6252          * case of HCI_ERROR_CANCELLED_BY_HOST, just ignore the event.
6253          *
6254          * When the Host disables an advertising set, all cleanup is done via
6255          * its command callback and not needed to be duplicated here.
6256          */
6257         if (ev->status == HCI_ERROR_CANCELLED_BY_HOST) {
6258                 bt_dev_warn_ratelimited(hdev, "Unexpected advertising set terminated event");
6259                 return;
6260         }
6261
6262         hci_dev_lock(hdev);
6263
6264         adv = hci_find_adv_instance(hdev, ev->handle);
6265
6266         if (ev->status) {
6267                 if (!adv)
6268                         goto unlock;
6269
6270                 /* Remove advertising as it has been terminated */
6271                 hci_remove_adv_instance(hdev, ev->handle);
6272                 mgmt_advertising_removed(NULL, hdev, ev->handle);
6273
6274                 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
6275                         if (adv->enabled)
6276                                 goto unlock;
6277                 }
6278
6279                 /* We are no longer advertising, clear HCI_LE_ADV */
6280                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
6281                 goto unlock;
6282         }
6283
6284         if (adv)
6285                 adv->enabled = false;
6286
6287         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
6288         if (conn) {
6289                 /* Store handle in the connection so the correct advertising
6290                  * instance can be re-enabled when disconnected.
6291                  */
6292                 conn->adv_instance = ev->handle;
6293
6294                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
6295                     bacmp(&conn->resp_addr, BDADDR_ANY))
6296                         goto unlock;
6297
6298                 if (!ev->handle) {
6299                         bacpy(&conn->resp_addr, &hdev->random_addr);
6300                         goto unlock;
6301                 }
6302
6303                 if (adv)
6304                         bacpy(&conn->resp_addr, &adv->random_addr);
6305         }
6306
6307 unlock:
6308         hci_dev_unlock(hdev);
6309 }
6310
6311 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, void *data,
6312                                             struct sk_buff *skb)
6313 {
6314         struct hci_ev_le_conn_update_complete *ev = data;
6315         struct hci_conn *conn;
6316
6317         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6318
6319         if (ev->status)
6320                 return;
6321
6322         hci_dev_lock(hdev);
6323
6324         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6325         if (conn) {
6326 #ifdef TIZEN_BT
6327                 if (ev->status) {
6328                         hci_dev_unlock(hdev);
6329                         mgmt_le_conn_update_failed(hdev, &conn->dst,
6330                                 conn->type, conn->dst_type, ev->status);
6331                         return;
6332                 }
6333 #endif
6334                 conn->le_conn_interval = le16_to_cpu(ev->interval);
6335                 conn->le_conn_latency = le16_to_cpu(ev->latency);
6336                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
6337         }
6338
6339         hci_dev_unlock(hdev);
6340
6341 #ifdef TIZEN_BT
6342         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
6343                                 conn->dst_type, conn->le_conn_interval,
6344                                 conn->le_conn_latency, conn->le_supv_timeout);
6345 #endif
6346 }
6347
6348 /* This function requires the caller holds hdev->lock */
6349 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
6350                                               bdaddr_t *addr,
6351                                               u8 addr_type, bool addr_resolved,
6352                                               u8 adv_type)
6353 {
6354         struct hci_conn *conn;
6355         struct hci_conn_params *params;
6356
6357         /* If the event is not connectable don't proceed further */
6358         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
6359                 return NULL;
6360
6361         /* Ignore if the device is blocked or hdev is suspended */
6362         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type) ||
6363             hdev->suspended)
6364                 return NULL;
6365
6366         /* Most controller will fail if we try to create new connections
6367          * while we have an existing one in peripheral role.
6368          */
6369         if (hdev->conn_hash.le_num_peripheral > 0 &&
6370             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
6371              !(hdev->le_states[3] & 0x10)))
6372                 return NULL;
6373
6374         /* If we're not connectable only connect devices that we have in
6375          * our pend_le_conns list.
6376          */
6377         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
6378                                            addr_type);
6379         if (!params)
6380                 return NULL;
6381
6382         if (!params->explicit_connect) {
6383                 switch (params->auto_connect) {
6384                 case HCI_AUTO_CONN_DIRECT:
6385                         /* Only devices advertising with ADV_DIRECT_IND are
6386                          * triggering a connection attempt. This is allowing
6387                          * incoming connections from peripheral devices.
6388                          */
6389                         if (adv_type != LE_ADV_DIRECT_IND)
6390                                 return NULL;
6391                         break;
6392                 case HCI_AUTO_CONN_ALWAYS:
6393                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
6394                          * are triggering a connection attempt. This means
6395                          * that incoming connections from peripheral device are
6396                          * accepted and also outgoing connections to peripheral
6397                          * devices are established when found.
6398                          */
6399                         break;
6400                 default:
6401                         return NULL;
6402                 }
6403         }
6404
6405         conn = hci_connect_le(hdev, addr, addr_type, addr_resolved,
6406                               BT_SECURITY_LOW, hdev->def_le_autoconnect_timeout,
6407                               HCI_ROLE_MASTER);
6408         if (!IS_ERR(conn)) {
6409                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
6410                  * by higher layer that tried to connect, if no then
6411                  * store the pointer since we don't really have any
6412                  * other owner of the object besides the params that
6413                  * triggered it. This way we can abort the connection if
6414                  * the parameters get removed and keep the reference
6415                  * count consistent once the connection is established.
6416                  */
6417
6418                 if (!params->explicit_connect)
6419                         params->conn = hci_conn_get(conn);
6420
6421                 return conn;
6422         }
6423
6424         switch (PTR_ERR(conn)) {
6425         case -EBUSY:
6426                 /* If hci_connect() returns -EBUSY it means there is already
6427                  * an LE connection attempt going on. Since controllers don't
6428                  * support more than one connection attempt at the time, we
6429                  * don't consider this an error case.
6430                  */
6431                 break;
6432         default:
6433                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
6434                 return NULL;
6435         }
6436
6437         return NULL;
6438 }
6439
6440 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
6441                                u8 bdaddr_type, bdaddr_t *direct_addr,
6442                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
6443                                bool ext_adv, bool ctl_time, u64 instant)
6444 {
6445 #ifndef TIZEN_BT
6446         struct discovery_state *d = &hdev->discovery;
6447         bool match;
6448 #endif
6449         struct smp_irk *irk;
6450         struct hci_conn *conn;
6451         bool bdaddr_resolved;
6452         u32 flags;
6453         u8 *ptr;
6454
6455         switch (type) {
6456         case LE_ADV_IND:
6457         case LE_ADV_DIRECT_IND:
6458         case LE_ADV_SCAN_IND:
6459         case LE_ADV_NONCONN_IND:
6460         case LE_ADV_SCAN_RSP:
6461                 break;
6462         default:
6463                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
6464                                        "type: 0x%02x", type);
6465                 return;
6466         }
6467
6468         if (len > max_adv_len(hdev)) {
6469                 bt_dev_err_ratelimited(hdev,
6470                                        "adv larger than maximum supported");
6471                 return;
6472         }
6473
6474         /* Find the end of the data in case the report contains padded zero
6475          * bytes at the end causing an invalid length value.
6476          *
6477          * When data is NULL, len is 0 so there is no need for extra ptr
6478          * check as 'ptr < data + 0' is already false in such case.
6479          */
6480         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
6481                 if (ptr + 1 + *ptr > data + len)
6482                         break;
6483         }
6484
6485         /* Adjust for actual length. This handles the case when remote
6486          * device is advertising with incorrect data length.
6487          */
6488         len = ptr - data;
6489
6490         /* If the direct address is present, then this report is from
6491          * a LE Direct Advertising Report event. In that case it is
6492          * important to see if the address is matching the local
6493          * controller address.
6494          */
6495         if (!hci_dev_test_flag(hdev, HCI_MESH) && direct_addr) {
6496                 direct_addr_type = ev_bdaddr_type(hdev, direct_addr_type,
6497                                                   &bdaddr_resolved);
6498
6499                 /* Only resolvable random addresses are valid for these
6500                  * kind of reports and others can be ignored.
6501                  */
6502                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
6503                         return;
6504
6505                 /* If the controller is not using resolvable random
6506                  * addresses, then this report can be ignored.
6507                  */
6508                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
6509                         return;
6510
6511                 /* If the local IRK of the controller does not match
6512                  * with the resolvable random address provided, then
6513                  * this report can be ignored.
6514                  */
6515                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
6516                         return;
6517         }
6518
6519         /* Check if we need to convert to identity address */
6520         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
6521         if (irk) {
6522                 bdaddr = &irk->bdaddr;
6523                 bdaddr_type = irk->addr_type;
6524         }
6525
6526         bdaddr_type = ev_bdaddr_type(hdev, bdaddr_type, &bdaddr_resolved);
6527
6528         /* Check if we have been requested to connect to this device.
6529          *
6530          * direct_addr is set only for directed advertising reports (it is NULL
6531          * for advertising reports) and is already verified to be RPA above.
6532          */
6533         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, bdaddr_resolved,
6534                                      type);
6535         if (!ext_adv && conn && type == LE_ADV_IND &&
6536             len <= max_adv_len(hdev)) {
6537                 /* Store report for later inclusion by
6538                  * mgmt_device_connected
6539                  */
6540                 memcpy(conn->le_adv_data, data, len);
6541                 conn->le_adv_data_len = len;
6542         }
6543
6544         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
6545                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
6546         else
6547                 flags = 0;
6548
6549         /* All scan results should be sent up for Mesh systems */
6550         if (hci_dev_test_flag(hdev, HCI_MESH)) {
6551                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6552                                   rssi, flags, data, len, NULL, 0, instant);
6553                 return;
6554         }
6555
6556         /* Passive scanning shouldn't trigger any device found events,
6557          * except for devices marked as CONN_REPORT for which we do send
6558          * device found events, or advertisement monitoring requested.
6559          */
6560         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
6561                 if (type == LE_ADV_DIRECT_IND)
6562                         return;
6563
6564 #ifndef TIZEN_BT
6565                 /* Handle all adv packet in platform */
6566                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
6567                                                bdaddr, bdaddr_type) &&
6568                     idr_is_empty(&hdev->adv_monitors_idr))
6569                         return;
6570 #endif
6571
6572 #ifdef TIZEN_BT
6573                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6574                                   rssi, flags, data, len, NULL, 0, type);
6575 #else
6576                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6577                                   rssi, flags, data, len, NULL, 0, 0);
6578 #endif
6579                 return;
6580         }
6581
6582         /* When receiving a scan response, then there is no way to
6583          * know if the remote device is connectable or not. However
6584          * since scan responses are merged with a previously seen
6585          * advertising report, the flags field from that report
6586          * will be used.
6587          *
6588          * In the unlikely case that a controller just sends a scan
6589          * response event that doesn't match the pending report, then
6590          * it is marked as a standalone SCAN_RSP.
6591          */
6592         if (type == LE_ADV_SCAN_RSP)
6593                 flags = MGMT_DEV_FOUND_SCAN_RSP;
6594
6595 #ifdef TIZEN_BT
6596         /* Disable adv ind and scan rsp merging */
6597         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6598                                   rssi, flags, data, len, NULL, 0, type);
6599 #else
6600         /* If there's nothing pending either store the data from this
6601          * event or send an immediate device found event if the data
6602          * should not be stored for later.
6603          */
6604         if (!ext_adv && !has_pending_adv_report(hdev)) {
6605                 /* If the report will trigger a SCAN_REQ store it for
6606                  * later merging.
6607                  */
6608                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
6609                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6610                                                  rssi, flags, data, len);
6611                         return;
6612                 }
6613
6614                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6615                                   rssi, flags, data, len, NULL, 0, 0);
6616                 return;
6617         }
6618
6619         /* Check if the pending report is for the same device as the new one */
6620         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
6621                  bdaddr_type == d->last_adv_addr_type);
6622
6623         /* If the pending data doesn't match this report or this isn't a
6624          * scan response (e.g. we got a duplicate ADV_IND) then force
6625          * sending of the pending data.
6626          */
6627         if (type != LE_ADV_SCAN_RSP || !match) {
6628                 /* Send out whatever is in the cache, but skip duplicates */
6629                 if (!match)
6630                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6631                                           d->last_adv_addr_type, NULL,
6632                                           d->last_adv_rssi, d->last_adv_flags,
6633                                           d->last_adv_data,
6634                                           d->last_adv_data_len, NULL, 0, 0);
6635
6636                 /* If the new report will trigger a SCAN_REQ store it for
6637                  * later merging.
6638                  */
6639                 if (!ext_adv && (type == LE_ADV_IND ||
6640                                  type == LE_ADV_SCAN_IND)) {
6641                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
6642                                                  rssi, flags, data, len);
6643                         return;
6644                 }
6645
6646                 /* The advertising reports cannot be merged, so clear
6647                  * the pending report and send out a device found event.
6648                  */
6649                 clear_pending_adv_report(hdev);
6650                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
6651                                   rssi, flags, data, len, NULL, 0, 0);
6652                 return;
6653         }
6654
6655         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
6656          * the new event is a SCAN_RSP. We can therefore proceed with
6657          * sending a merged device found event.
6658          */
6659         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
6660                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
6661                           d->last_adv_data, d->last_adv_data_len, data, len, 0);
6662         clear_pending_adv_report(hdev);
6663 #endif
6664 }
6665
6666 static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data,
6667                                   struct sk_buff *skb)
6668 {
6669         struct hci_ev_le_advertising_report *ev = data;
6670         u64 instant = jiffies;
6671
6672         if (!ev->num)
6673                 return;
6674
6675         hci_dev_lock(hdev);
6676
6677         while (ev->num--) {
6678                 struct hci_ev_le_advertising_info *info;
6679                 s8 rssi;
6680
6681                 info = hci_le_ev_skb_pull(hdev, skb,
6682                                           HCI_EV_LE_ADVERTISING_REPORT,
6683                                           sizeof(*info));
6684                 if (!info)
6685                         break;
6686
6687                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_ADVERTISING_REPORT,
6688                                         info->length + 1))
6689                         break;
6690
6691                 if (info->length <= max_adv_len(hdev)) {
6692                         rssi = info->data[info->length];
6693                         process_adv_report(hdev, info->type, &info->bdaddr,
6694                                            info->bdaddr_type, NULL, 0, rssi,
6695                                            info->data, info->length, false,
6696                                            false, instant);
6697                 } else {
6698                         bt_dev_err(hdev, "Dropping invalid advertising data");
6699                 }
6700         }
6701
6702         hci_dev_unlock(hdev);
6703 }
6704
6705 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
6706 {
6707         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
6708                 switch (evt_type) {
6709                 case LE_LEGACY_ADV_IND:
6710                         return LE_ADV_IND;
6711                 case LE_LEGACY_ADV_DIRECT_IND:
6712                         return LE_ADV_DIRECT_IND;
6713                 case LE_LEGACY_ADV_SCAN_IND:
6714                         return LE_ADV_SCAN_IND;
6715                 case LE_LEGACY_NONCONN_IND:
6716                         return LE_ADV_NONCONN_IND;
6717                 case LE_LEGACY_SCAN_RSP_ADV:
6718                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
6719                         return LE_ADV_SCAN_RSP;
6720                 }
6721
6722                 goto invalid;
6723         }
6724
6725         if (evt_type & LE_EXT_ADV_CONN_IND) {
6726                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
6727                         return LE_ADV_DIRECT_IND;
6728
6729                 return LE_ADV_IND;
6730         }
6731
6732         if (evt_type & LE_EXT_ADV_SCAN_RSP)
6733                 return LE_ADV_SCAN_RSP;
6734
6735         if (evt_type & LE_EXT_ADV_SCAN_IND)
6736                 return LE_ADV_SCAN_IND;
6737
6738         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
6739             evt_type & LE_EXT_ADV_DIRECT_IND)
6740                 return LE_ADV_NONCONN_IND;
6741
6742 invalid:
6743         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
6744                                evt_type);
6745
6746         return LE_ADV_INVALID;
6747 }
6748
6749 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data,
6750                                       struct sk_buff *skb)
6751 {
6752         struct hci_ev_le_ext_adv_report *ev = data;
6753         u64 instant = jiffies;
6754
6755         if (!ev->num)
6756                 return;
6757
6758         hci_dev_lock(hdev);
6759
6760         while (ev->num--) {
6761                 struct hci_ev_le_ext_adv_info *info;
6762                 u8 legacy_evt_type;
6763                 u16 evt_type;
6764
6765                 info = hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6766                                           sizeof(*info));
6767                 if (!info)
6768                         break;
6769
6770                 if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_EXT_ADV_REPORT,
6771                                         info->length))
6772                         break;
6773
6774                 evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK;
6775                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
6776                 if (legacy_evt_type != LE_ADV_INVALID) {
6777                         process_adv_report(hdev, legacy_evt_type, &info->bdaddr,
6778                                            info->bdaddr_type, NULL, 0,
6779                                            info->rssi, info->data, info->length,
6780                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU),
6781                                            false, instant);
6782                 }
6783         }
6784
6785         hci_dev_unlock(hdev);
6786 }
6787
6788 static int hci_le_pa_term_sync(struct hci_dev *hdev, __le16 handle)
6789 {
6790         struct hci_cp_le_pa_term_sync cp;
6791
6792         memset(&cp, 0, sizeof(cp));
6793         cp.handle = handle;
6794
6795         return hci_send_cmd(hdev, HCI_OP_LE_PA_TERM_SYNC, sizeof(cp), &cp);
6796 }
6797
6798 static void hci_le_pa_sync_estabilished_evt(struct hci_dev *hdev, void *data,
6799                                             struct sk_buff *skb)
6800 {
6801         struct hci_ev_le_pa_sync_established *ev = data;
6802         int mask = hdev->link_mode;
6803         __u8 flags = 0;
6804         struct hci_conn *pa_sync;
6805
6806         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6807
6808         hci_dev_lock(hdev);
6809
6810         hci_dev_clear_flag(hdev, HCI_PA_SYNC);
6811
6812         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ISO_LINK, &flags);
6813         if (!(mask & HCI_LM_ACCEPT)) {
6814                 hci_le_pa_term_sync(hdev, ev->handle);
6815                 goto unlock;
6816         }
6817
6818         if (!(flags & HCI_PROTO_DEFER))
6819                 goto unlock;
6820
6821         if (ev->status) {
6822                 /* Add connection to indicate the failed PA sync event */
6823                 pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
6824                                              HCI_ROLE_SLAVE);
6825
6826                 if (!pa_sync)
6827                         goto unlock;
6828
6829                 set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags);
6830
6831                 /* Notify iso layer */
6832                 hci_connect_cfm(pa_sync, ev->status);
6833         }
6834
6835 unlock:
6836         hci_dev_unlock(hdev);
6837 }
6838
6839 static void hci_le_per_adv_report_evt(struct hci_dev *hdev, void *data,
6840                                       struct sk_buff *skb)
6841 {
6842         struct hci_ev_le_per_adv_report *ev = data;
6843         int mask = hdev->link_mode;
6844         __u8 flags = 0;
6845
6846         bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
6847
6848         hci_dev_lock(hdev);
6849
6850         mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
6851         if (!(mask & HCI_LM_ACCEPT))
6852                 hci_le_pa_term_sync(hdev, ev->sync_handle);
6853
6854         hci_dev_unlock(hdev);
6855 }
6856
6857 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev, void *data,
6858                                             struct sk_buff *skb)
6859 {
6860         struct hci_ev_le_remote_feat_complete *ev = data;
6861         struct hci_conn *conn;
6862
6863         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
6864
6865         hci_dev_lock(hdev);
6866
6867         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6868         if (conn) {
6869                 if (!ev->status)
6870                         memcpy(conn->features[0], ev->features, 8);
6871
6872                 if (conn->state == BT_CONFIG) {
6873                         __u8 status;
6874
6875                         /* If the local controller supports peripheral-initiated
6876                          * features exchange, but the remote controller does
6877                          * not, then it is possible that the error code 0x1a
6878                          * for unsupported remote feature gets returned.
6879                          *
6880                          * In this specific case, allow the connection to
6881                          * transition into connected state and mark it as
6882                          * successful.
6883                          */
6884                         if (!conn->out && ev->status == 0x1a &&
6885                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6886                                 status = 0x00;
6887                         else
6888                                 status = ev->status;
6889
6890                         conn->state = BT_CONNECTED;
6891                         hci_connect_cfm(conn, status);
6892                         hci_conn_drop(conn);
6893                 }
6894         }
6895
6896         hci_dev_unlock(hdev);
6897 }
6898
6899 static void hci_le_ltk_request_evt(struct hci_dev *hdev, void *data,
6900                                    struct sk_buff *skb)
6901 {
6902         struct hci_ev_le_ltk_req *ev = data;
6903         struct hci_cp_le_ltk_reply cp;
6904         struct hci_cp_le_ltk_neg_reply neg;
6905         struct hci_conn *conn;
6906         struct smp_ltk *ltk;
6907
6908         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6909
6910         hci_dev_lock(hdev);
6911
6912         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6913         if (conn == NULL)
6914                 goto not_found;
6915
6916         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6917         if (!ltk)
6918                 goto not_found;
6919
6920         if (smp_ltk_is_sc(ltk)) {
6921                 /* With SC both EDiv and Rand are set to zero */
6922                 if (ev->ediv || ev->rand)
6923                         goto not_found;
6924         } else {
6925                 /* For non-SC keys check that EDiv and Rand match */
6926                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6927                         goto not_found;
6928         }
6929
6930         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6931         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6932         cp.handle = cpu_to_le16(conn->handle);
6933
6934         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6935
6936         conn->enc_key_size = ltk->enc_size;
6937
6938         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6939
6940         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6941          * temporary key used to encrypt a connection following
6942          * pairing. It is used during the Encrypted Session Setup to
6943          * distribute the keys. Later, security can be re-established
6944          * using a distributed LTK.
6945          */
6946         if (ltk->type == SMP_STK) {
6947                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6948                 list_del_rcu(&ltk->list);
6949                 kfree_rcu(ltk, rcu);
6950         } else {
6951                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6952         }
6953
6954         hci_dev_unlock(hdev);
6955
6956         return;
6957
6958 not_found:
6959         neg.handle = ev->handle;
6960         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6961         hci_dev_unlock(hdev);
6962 }
6963
6964 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6965                                       u8 reason)
6966 {
6967         struct hci_cp_le_conn_param_req_neg_reply cp;
6968
6969         cp.handle = cpu_to_le16(handle);
6970         cp.reason = reason;
6971
6972         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6973                      &cp);
6974 }
6975
6976 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev, void *data,
6977                                              struct sk_buff *skb)
6978 {
6979         struct hci_ev_le_remote_conn_param_req *ev = data;
6980         struct hci_cp_le_conn_param_req_reply cp;
6981         struct hci_conn *hcon;
6982         u16 handle, min, max, latency, timeout;
6983
6984         bt_dev_dbg(hdev, "handle 0x%4.4x", __le16_to_cpu(ev->handle));
6985
6986         handle = le16_to_cpu(ev->handle);
6987         min = le16_to_cpu(ev->interval_min);
6988         max = le16_to_cpu(ev->interval_max);
6989         latency = le16_to_cpu(ev->latency);
6990         timeout = le16_to_cpu(ev->timeout);
6991
6992         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6993         if (!hcon || hcon->state != BT_CONNECTED)
6994                 return send_conn_param_neg_reply(hdev, handle,
6995                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6996
6997         if (hci_check_conn_params(min, max, latency, timeout))
6998                 return send_conn_param_neg_reply(hdev, handle,
6999                                                  HCI_ERROR_INVALID_LL_PARAMS);
7000
7001         if (hcon->role == HCI_ROLE_MASTER) {
7002                 struct hci_conn_params *params;
7003                 u8 store_hint;
7004
7005                 hci_dev_lock(hdev);
7006
7007                 params = hci_conn_params_lookup(hdev, &hcon->dst,
7008                                                 hcon->dst_type);
7009                 if (params) {
7010                         params->conn_min_interval = min;
7011                         params->conn_max_interval = max;
7012                         params->conn_latency = latency;
7013                         params->supervision_timeout = timeout;
7014                         store_hint = 0x01;
7015                 } else {
7016                         store_hint = 0x00;
7017                 }
7018
7019                 hci_dev_unlock(hdev);
7020
7021                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
7022                                     store_hint, min, max, latency, timeout);
7023         }
7024
7025         cp.handle = ev->handle;
7026         cp.interval_min = ev->interval_min;
7027         cp.interval_max = ev->interval_max;
7028         cp.latency = ev->latency;
7029         cp.timeout = ev->timeout;
7030         cp.min_ce_len = 0;
7031         cp.max_ce_len = 0;
7032
7033         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
7034 }
7035
7036 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data,
7037                                          struct sk_buff *skb)
7038 {
7039         struct hci_ev_le_direct_adv_report *ev = data;
7040         u64 instant = jiffies;
7041         int i;
7042
7043         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EV_LE_DIRECT_ADV_REPORT,
7044                                 flex_array_size(ev, info, ev->num)))
7045                 return;
7046
7047         if (!ev->num)
7048                 return;
7049
7050         hci_dev_lock(hdev);
7051
7052         for (i = 0; i < ev->num; i++) {
7053                 struct hci_ev_le_direct_adv_info *info = &ev->info[i];
7054
7055                 process_adv_report(hdev, info->type, &info->bdaddr,
7056                                    info->bdaddr_type, &info->direct_addr,
7057                                    info->direct_addr_type, info->rssi, NULL, 0,
7058                                    false, false, instant);
7059         }
7060
7061         hci_dev_unlock(hdev);
7062 }
7063
7064 static void hci_le_phy_update_evt(struct hci_dev *hdev, void *data,
7065                                   struct sk_buff *skb)
7066 {
7067         struct hci_ev_le_phy_update_complete *ev = data;
7068         struct hci_conn *conn;
7069
7070         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
7071
7072         if (ev->status)
7073                 return;
7074
7075         hci_dev_lock(hdev);
7076
7077         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
7078         if (!conn)
7079                 goto unlock;
7080
7081         conn->le_tx_phy = ev->tx_phy;
7082         conn->le_rx_phy = ev->rx_phy;
7083
7084 unlock:
7085         hci_dev_unlock(hdev);
7086 }
7087
7088 static void hci_le_cis_estabilished_evt(struct hci_dev *hdev, void *data,
7089                                         struct sk_buff *skb)
7090 {
7091         struct hci_evt_le_cis_established *ev = data;
7092         struct hci_conn *conn;
7093         struct bt_iso_qos *qos;
7094         bool pending = false;
7095         u16 handle = __le16_to_cpu(ev->handle);
7096
7097         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
7098
7099         hci_dev_lock(hdev);
7100
7101         conn = hci_conn_hash_lookup_handle(hdev, handle);
7102         if (!conn) {
7103                 bt_dev_err(hdev,
7104                            "Unable to find connection with handle 0x%4.4x",
7105                            handle);
7106                 goto unlock;
7107         }
7108
7109         if (conn->type != ISO_LINK) {
7110                 bt_dev_err(hdev,
7111                            "Invalid connection link type handle 0x%4.4x",
7112                            handle);
7113                 goto unlock;
7114         }
7115
7116         qos = &conn->iso_qos;
7117
7118         pending = test_and_clear_bit(HCI_CONN_CREATE_CIS, &conn->flags);
7119
7120         /* Convert ISO Interval (1.25 ms slots) to SDU Interval (us) */
7121         qos->ucast.in.interval = le16_to_cpu(ev->interval) * 1250;
7122         qos->ucast.out.interval = qos->ucast.in.interval;
7123
7124         switch (conn->role) {
7125         case HCI_ROLE_SLAVE:
7126                 /* Convert Transport Latency (us) to Latency (msec) */
7127                 qos->ucast.in.latency =
7128                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
7129                                           1000);
7130                 qos->ucast.out.latency =
7131                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
7132                                           1000);
7133                 qos->ucast.in.sdu = le16_to_cpu(ev->c_mtu);
7134                 qos->ucast.out.sdu = le16_to_cpu(ev->p_mtu);
7135                 qos->ucast.in.phy = ev->c_phy;
7136                 qos->ucast.out.phy = ev->p_phy;
7137                 break;
7138         case HCI_ROLE_MASTER:
7139                 /* Convert Transport Latency (us) to Latency (msec) */
7140                 qos->ucast.out.latency =
7141                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->c_latency),
7142                                           1000);
7143                 qos->ucast.in.latency =
7144                         DIV_ROUND_CLOSEST(get_unaligned_le24(ev->p_latency),
7145                                           1000);
7146                 qos->ucast.out.sdu = le16_to_cpu(ev->c_mtu);
7147                 qos->ucast.in.sdu = le16_to_cpu(ev->p_mtu);
7148                 qos->ucast.out.phy = ev->c_phy;
7149                 qos->ucast.in.phy = ev->p_phy;
7150                 break;
7151         }
7152
7153         if (!ev->status) {
7154                 conn->state = BT_CONNECTED;
7155                 hci_debugfs_create_conn(conn);
7156                 hci_conn_add_sysfs(conn);
7157                 hci_iso_setup_path(conn);
7158                 goto unlock;
7159         }
7160
7161         conn->state = BT_CLOSED;
7162         hci_connect_cfm(conn, ev->status);
7163         hci_conn_del(conn);
7164
7165 unlock:
7166         if (pending)
7167                 hci_le_create_cis_pending(hdev);
7168
7169         hci_dev_unlock(hdev);
7170 }
7171
7172 static void hci_le_reject_cis(struct hci_dev *hdev, __le16 handle)
7173 {
7174         struct hci_cp_le_reject_cis cp;
7175
7176         memset(&cp, 0, sizeof(cp));
7177         cp.handle = handle;
7178         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
7179         hci_send_cmd(hdev, HCI_OP_LE_REJECT_CIS, sizeof(cp), &cp);
7180 }
7181
7182 static void hci_le_accept_cis(struct hci_dev *hdev, __le16 handle)
7183 {
7184         struct hci_cp_le_accept_cis cp;
7185
7186         memset(&cp, 0, sizeof(cp));
7187         cp.handle = handle;
7188         hci_send_cmd(hdev, HCI_OP_LE_ACCEPT_CIS, sizeof(cp), &cp);
7189 }
7190
7191 static void hci_le_cis_req_evt(struct hci_dev *hdev, void *data,
7192                                struct sk_buff *skb)
7193 {
7194         struct hci_evt_le_cis_req *ev = data;
7195         u16 acl_handle, cis_handle;
7196         struct hci_conn *acl, *cis;
7197         int mask;
7198         __u8 flags = 0;
7199
7200         acl_handle = __le16_to_cpu(ev->acl_handle);
7201         cis_handle = __le16_to_cpu(ev->cis_handle);
7202
7203         bt_dev_dbg(hdev, "acl 0x%4.4x handle 0x%4.4x cig 0x%2.2x cis 0x%2.2x",
7204                    acl_handle, cis_handle, ev->cig_id, ev->cis_id);
7205
7206         hci_dev_lock(hdev);
7207
7208         acl = hci_conn_hash_lookup_handle(hdev, acl_handle);
7209         if (!acl)
7210                 goto unlock;
7211
7212         mask = hci_proto_connect_ind(hdev, &acl->dst, ISO_LINK, &flags);
7213         if (!(mask & HCI_LM_ACCEPT)) {
7214                 hci_le_reject_cis(hdev, ev->cis_handle);
7215                 goto unlock;
7216         }
7217
7218         cis = hci_conn_hash_lookup_handle(hdev, cis_handle);
7219         if (!cis) {
7220                 cis = hci_conn_add(hdev, ISO_LINK, &acl->dst, HCI_ROLE_SLAVE,
7221                                    cis_handle);
7222                 if (!cis) {
7223                         hci_le_reject_cis(hdev, ev->cis_handle);
7224                         goto unlock;
7225                 }
7226         }
7227
7228         cis->iso_qos.ucast.cig = ev->cig_id;
7229         cis->iso_qos.ucast.cis = ev->cis_id;
7230
7231         if (!(flags & HCI_PROTO_DEFER)) {
7232                 hci_le_accept_cis(hdev, ev->cis_handle);
7233         } else {
7234                 cis->state = BT_CONNECT2;
7235                 hci_connect_cfm(cis, 0);
7236         }
7237
7238 unlock:
7239         hci_dev_unlock(hdev);
7240 }
7241
7242 static int hci_iso_term_big_sync(struct hci_dev *hdev, void *data)
7243 {
7244         u8 handle = PTR_UINT(data);
7245
7246         return hci_le_terminate_big_sync(hdev, handle,
7247                                          HCI_ERROR_LOCAL_HOST_TERM);
7248 }
7249
7250 static void hci_le_create_big_complete_evt(struct hci_dev *hdev, void *data,
7251                                            struct sk_buff *skb)
7252 {
7253         struct hci_evt_le_create_big_complete *ev = data;
7254         struct hci_conn *conn;
7255         __u8 i = 0;
7256
7257         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
7258
7259         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_CREATE_BIG_COMPLETE,
7260                                 flex_array_size(ev, bis_handle, ev->num_bis)))
7261                 return;
7262
7263         hci_dev_lock(hdev);
7264         rcu_read_lock();
7265
7266         /* Connect all BISes that are bound to the BIG */
7267         list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
7268                 if (bacmp(&conn->dst, BDADDR_ANY) ||
7269                     conn->type != ISO_LINK ||
7270                     conn->iso_qos.bcast.big != ev->handle)
7271                         continue;
7272
7273                 if (hci_conn_set_handle(conn,
7274                                         __le16_to_cpu(ev->bis_handle[i++])))
7275                         continue;
7276
7277                 if (!ev->status) {
7278                         conn->state = BT_CONNECTED;
7279                         set_bit(HCI_CONN_BIG_CREATED, &conn->flags);
7280                         rcu_read_unlock();
7281                         hci_debugfs_create_conn(conn);
7282                         hci_conn_add_sysfs(conn);
7283                         hci_iso_setup_path(conn);
7284                         rcu_read_lock();
7285                         continue;
7286                 }
7287
7288                 hci_connect_cfm(conn, ev->status);
7289                 rcu_read_unlock();
7290                 hci_conn_del(conn);
7291                 rcu_read_lock();
7292         }
7293
7294         rcu_read_unlock();
7295
7296         if (!ev->status && !i)
7297                 /* If no BISes have been connected for the BIG,
7298                  * terminate. This is in case all bound connections
7299                  * have been closed before the BIG creation
7300                  * has completed.
7301                  */
7302                 hci_cmd_sync_queue(hdev, hci_iso_term_big_sync,
7303                                    UINT_PTR(ev->handle), NULL);
7304
7305         hci_dev_unlock(hdev);
7306 }
7307
7308 static void hci_le_big_sync_established_evt(struct hci_dev *hdev, void *data,
7309                                             struct sk_buff *skb)
7310 {
7311         struct hci_evt_le_big_sync_estabilished *ev = data;
7312         struct hci_conn *bis;
7313         struct hci_conn *pa_sync;
7314         int i;
7315
7316         bt_dev_dbg(hdev, "status 0x%2.2x", ev->status);
7317
7318         if (!hci_le_ev_skb_pull(hdev, skb, HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7319                                 flex_array_size(ev, bis, ev->num_bis)))
7320                 return;
7321
7322         hci_dev_lock(hdev);
7323
7324         if (!ev->status) {
7325                 pa_sync = hci_conn_hash_lookup_pa_sync_big_handle(hdev, ev->handle);
7326                 if (pa_sync)
7327                         /* Also mark the BIG sync established event on the
7328                          * associated PA sync hcon
7329                          */
7330                         set_bit(HCI_CONN_BIG_SYNC, &pa_sync->flags);
7331         }
7332
7333         for (i = 0; i < ev->num_bis; i++) {
7334                 u16 handle = le16_to_cpu(ev->bis[i]);
7335                 __le32 interval;
7336
7337                 bis = hci_conn_hash_lookup_handle(hdev, handle);
7338                 if (!bis) {
7339                         bis = hci_conn_add(hdev, ISO_LINK, BDADDR_ANY,
7340                                            HCI_ROLE_SLAVE, handle);
7341                         if (!bis)
7342                                 continue;
7343                 }
7344
7345                 if (ev->status != 0x42)
7346                         /* Mark PA sync as established */
7347                         set_bit(HCI_CONN_PA_SYNC, &bis->flags);
7348
7349                 bis->iso_qos.bcast.big = ev->handle;
7350                 memset(&interval, 0, sizeof(interval));
7351                 memcpy(&interval, ev->latency, sizeof(ev->latency));
7352                 bis->iso_qos.bcast.in.interval = le32_to_cpu(interval);
7353                 /* Convert ISO Interval (1.25 ms slots) to latency (ms) */
7354                 bis->iso_qos.bcast.in.latency = le16_to_cpu(ev->interval) * 125 / 100;
7355                 bis->iso_qos.bcast.in.sdu = le16_to_cpu(ev->max_pdu);
7356
7357                 if (!ev->status) {
7358                         set_bit(HCI_CONN_BIG_SYNC, &bis->flags);
7359                         hci_iso_setup_path(bis);
7360                 }
7361         }
7362
7363         /* In case BIG sync failed, notify each failed connection to
7364          * the user after all hci connections have been added
7365          */
7366         if (ev->status)
7367                 for (i = 0; i < ev->num_bis; i++) {
7368                         u16 handle = le16_to_cpu(ev->bis[i]);
7369
7370                         bis = hci_conn_hash_lookup_handle(hdev, handle);
7371
7372                         set_bit(HCI_CONN_BIG_SYNC_FAILED, &bis->flags);
7373                         hci_connect_cfm(bis, ev->status);
7374                 }
7375
7376         hci_dev_unlock(hdev);
7377 }
7378
7379 static void hci_le_big_info_adv_report_evt(struct hci_dev *hdev, void *data,
7380                                            struct sk_buff *skb)
7381 {
7382         struct hci_evt_le_big_info_adv_report *ev = data;
7383         int mask = hdev->link_mode;
7384         __u8 flags = 0;
7385         struct hci_conn *pa_sync;
7386
7387         bt_dev_dbg(hdev, "sync_handle 0x%4.4x", le16_to_cpu(ev->sync_handle));
7388
7389         hci_dev_lock(hdev);
7390
7391         mask |= hci_proto_connect_ind(hdev, BDADDR_ANY, ISO_LINK, &flags);
7392         if (!(mask & HCI_LM_ACCEPT)) {
7393                 hci_le_pa_term_sync(hdev, ev->sync_handle);
7394                 goto unlock;
7395         }
7396
7397         if (!(flags & HCI_PROTO_DEFER))
7398                 goto unlock;
7399
7400         pa_sync = hci_conn_hash_lookup_pa_sync_handle
7401                         (hdev,
7402                         le16_to_cpu(ev->sync_handle));
7403
7404         if (pa_sync)
7405                 goto unlock;
7406
7407         /* Add connection to indicate the PA sync event */
7408         pa_sync = hci_conn_add_unset(hdev, ISO_LINK, BDADDR_ANY,
7409                                      HCI_ROLE_SLAVE);
7410
7411         if (!pa_sync)
7412                 goto unlock;
7413
7414         pa_sync->sync_handle = le16_to_cpu(ev->sync_handle);
7415         set_bit(HCI_CONN_PA_SYNC, &pa_sync->flags);
7416
7417         /* Notify iso layer */
7418         hci_connect_cfm(pa_sync, 0x00);
7419
7420 unlock:
7421         hci_dev_unlock(hdev);
7422 }
7423
7424 #define HCI_LE_EV_VL(_op, _func, _min_len, _max_len) \
7425 [_op] = { \
7426         .func = _func, \
7427         .min_len = _min_len, \
7428         .max_len = _max_len, \
7429 }
7430
7431 #define HCI_LE_EV(_op, _func, _len) \
7432         HCI_LE_EV_VL(_op, _func, _len, _len)
7433
7434 #define HCI_LE_EV_STATUS(_op, _func) \
7435         HCI_LE_EV(_op, _func, sizeof(struct hci_ev_status))
7436
7437 /* Entries in this table shall have their position according to the subevent
7438  * opcode they handle so the use of the macros above is recommend since it does
7439  * attempt to initialize at its proper index using Designated Initializers that
7440  * way events without a callback function can be ommited.
7441  */
7442 static const struct hci_le_ev {
7443         void (*func)(struct hci_dev *hdev, void *data, struct sk_buff *skb);
7444         u16  min_len;
7445         u16  max_len;
7446 } hci_le_ev_table[U8_MAX + 1] = {
7447         /* [0x01 = HCI_EV_LE_CONN_COMPLETE] */
7448         HCI_LE_EV(HCI_EV_LE_CONN_COMPLETE, hci_le_conn_complete_evt,
7449                   sizeof(struct hci_ev_le_conn_complete)),
7450         /* [0x02 = HCI_EV_LE_ADVERTISING_REPORT] */
7451         HCI_LE_EV_VL(HCI_EV_LE_ADVERTISING_REPORT, hci_le_adv_report_evt,
7452                      sizeof(struct hci_ev_le_advertising_report),
7453                      HCI_MAX_EVENT_SIZE),
7454         /* [0x03 = HCI_EV_LE_CONN_UPDATE_COMPLETE] */
7455         HCI_LE_EV(HCI_EV_LE_CONN_UPDATE_COMPLETE,
7456                   hci_le_conn_update_complete_evt,
7457                   sizeof(struct hci_ev_le_conn_update_complete)),
7458         /* [0x04 = HCI_EV_LE_REMOTE_FEAT_COMPLETE] */
7459         HCI_LE_EV(HCI_EV_LE_REMOTE_FEAT_COMPLETE,
7460                   hci_le_remote_feat_complete_evt,
7461                   sizeof(struct hci_ev_le_remote_feat_complete)),
7462         /* [0x05 = HCI_EV_LE_LTK_REQ] */
7463         HCI_LE_EV(HCI_EV_LE_LTK_REQ, hci_le_ltk_request_evt,
7464                   sizeof(struct hci_ev_le_ltk_req)),
7465         /* [0x06 = HCI_EV_LE_REMOTE_CONN_PARAM_REQ] */
7466         HCI_LE_EV(HCI_EV_LE_REMOTE_CONN_PARAM_REQ,
7467                   hci_le_remote_conn_param_req_evt,
7468                   sizeof(struct hci_ev_le_remote_conn_param_req)),
7469         /* [0x0a = HCI_EV_LE_ENHANCED_CONN_COMPLETE] */
7470         HCI_LE_EV(HCI_EV_LE_ENHANCED_CONN_COMPLETE,
7471                   hci_le_enh_conn_complete_evt,
7472                   sizeof(struct hci_ev_le_enh_conn_complete)),
7473         /* [0x0b = HCI_EV_LE_DIRECT_ADV_REPORT] */
7474         HCI_LE_EV_VL(HCI_EV_LE_DIRECT_ADV_REPORT, hci_le_direct_adv_report_evt,
7475                      sizeof(struct hci_ev_le_direct_adv_report),
7476                      HCI_MAX_EVENT_SIZE),
7477         /* [0x0c = HCI_EV_LE_PHY_UPDATE_COMPLETE] */
7478         HCI_LE_EV(HCI_EV_LE_PHY_UPDATE_COMPLETE, hci_le_phy_update_evt,
7479                   sizeof(struct hci_ev_le_phy_update_complete)),
7480         /* [0x0d = HCI_EV_LE_EXT_ADV_REPORT] */
7481         HCI_LE_EV_VL(HCI_EV_LE_EXT_ADV_REPORT, hci_le_ext_adv_report_evt,
7482                      sizeof(struct hci_ev_le_ext_adv_report),
7483                      HCI_MAX_EVENT_SIZE),
7484         /* [0x0e = HCI_EV_LE_PA_SYNC_ESTABLISHED] */
7485         HCI_LE_EV(HCI_EV_LE_PA_SYNC_ESTABLISHED,
7486                   hci_le_pa_sync_estabilished_evt,
7487                   sizeof(struct hci_ev_le_pa_sync_established)),
7488         /* [0x0f = HCI_EV_LE_PER_ADV_REPORT] */
7489         HCI_LE_EV_VL(HCI_EV_LE_PER_ADV_REPORT,
7490                                  hci_le_per_adv_report_evt,
7491                                  sizeof(struct hci_ev_le_per_adv_report),
7492                                  HCI_MAX_EVENT_SIZE),
7493         /* [0x12 = HCI_EV_LE_EXT_ADV_SET_TERM] */
7494         HCI_LE_EV(HCI_EV_LE_EXT_ADV_SET_TERM, hci_le_ext_adv_term_evt,
7495                   sizeof(struct hci_evt_le_ext_adv_set_term)),
7496         /* [0x19 = HCI_EVT_LE_CIS_ESTABLISHED] */
7497         HCI_LE_EV(HCI_EVT_LE_CIS_ESTABLISHED, hci_le_cis_estabilished_evt,
7498                   sizeof(struct hci_evt_le_cis_established)),
7499         /* [0x1a = HCI_EVT_LE_CIS_REQ] */
7500         HCI_LE_EV(HCI_EVT_LE_CIS_REQ, hci_le_cis_req_evt,
7501                   sizeof(struct hci_evt_le_cis_req)),
7502         /* [0x1b = HCI_EVT_LE_CREATE_BIG_COMPLETE] */
7503         HCI_LE_EV_VL(HCI_EVT_LE_CREATE_BIG_COMPLETE,
7504                      hci_le_create_big_complete_evt,
7505                      sizeof(struct hci_evt_le_create_big_complete),
7506                      HCI_MAX_EVENT_SIZE),
7507         /* [0x1d = HCI_EV_LE_BIG_SYNC_ESTABILISHED] */
7508         HCI_LE_EV_VL(HCI_EVT_LE_BIG_SYNC_ESTABILISHED,
7509                      hci_le_big_sync_established_evt,
7510                      sizeof(struct hci_evt_le_big_sync_estabilished),
7511                      HCI_MAX_EVENT_SIZE),
7512         /* [0x22 = HCI_EVT_LE_BIG_INFO_ADV_REPORT] */
7513         HCI_LE_EV_VL(HCI_EVT_LE_BIG_INFO_ADV_REPORT,
7514                      hci_le_big_info_adv_report_evt,
7515                      sizeof(struct hci_evt_le_big_info_adv_report),
7516                      HCI_MAX_EVENT_SIZE),
7517 };
7518
7519 static void hci_le_meta_evt(struct hci_dev *hdev, void *data,
7520                             struct sk_buff *skb, u16 *opcode, u8 *status,
7521                             hci_req_complete_t *req_complete,
7522                             hci_req_complete_skb_t *req_complete_skb)
7523 {
7524         struct hci_ev_le_meta *ev = data;
7525         const struct hci_le_ev *subev;
7526
7527         bt_dev_dbg(hdev, "subevent 0x%2.2x", ev->subevent);
7528
7529         /* Only match event if command OGF is for LE */
7530         if (hdev->sent_cmd &&
7531             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) == 0x08 &&
7532             hci_skb_event(hdev->sent_cmd) == ev->subevent) {
7533                 *opcode = hci_skb_opcode(hdev->sent_cmd);
7534                 hci_req_cmd_complete(hdev, *opcode, 0x00, req_complete,
7535                                      req_complete_skb);
7536         }
7537
7538         subev = &hci_le_ev_table[ev->subevent];
7539         if (!subev->func)
7540                 return;
7541
7542         if (skb->len < subev->min_len) {
7543                 bt_dev_err(hdev, "unexpected subevent 0x%2.2x length: %u < %u",
7544                            ev->subevent, skb->len, subev->min_len);
7545                 return;
7546         }
7547
7548         /* Just warn if the length is over max_len size it still be
7549          * possible to partially parse the event so leave to callback to
7550          * decide if that is acceptable.
7551          */
7552         if (skb->len > subev->max_len)
7553                 bt_dev_warn(hdev, "unexpected subevent 0x%2.2x length: %u > %u",
7554                             ev->subevent, skb->len, subev->max_len);
7555         data = hci_le_ev_skb_pull(hdev, skb, ev->subevent, subev->min_len);
7556         if (!data)
7557                 return;
7558
7559         subev->func(hdev, data, skb);
7560 }
7561
7562 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
7563                                  u8 event, struct sk_buff *skb)
7564 {
7565         struct hci_ev_cmd_complete *ev;
7566         struct hci_event_hdr *hdr;
7567
7568         if (!skb)
7569                 return false;
7570
7571         hdr = hci_ev_skb_pull(hdev, skb, event, sizeof(*hdr));
7572         if (!hdr)
7573                 return false;
7574
7575         if (event) {
7576                 if (hdr->evt != event)
7577                         return false;
7578                 return true;
7579         }
7580
7581         /* Check if request ended in Command Status - no way to retrieve
7582          * any extra parameters in this case.
7583          */
7584         if (hdr->evt == HCI_EV_CMD_STATUS)
7585                 return false;
7586
7587         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
7588                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
7589                            hdr->evt);
7590                 return false;
7591         }
7592
7593         ev = hci_cc_skb_pull(hdev, skb, opcode, sizeof(*ev));
7594         if (!ev)
7595                 return false;
7596
7597         if (opcode != __le16_to_cpu(ev->opcode)) {
7598                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
7599                        __le16_to_cpu(ev->opcode));
7600                 return false;
7601         }
7602
7603         return true;
7604 }
7605
7606 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
7607                                   struct sk_buff *skb)
7608 {
7609         struct hci_ev_le_advertising_info *adv;
7610         struct hci_ev_le_direct_adv_info *direct_adv;
7611         struct hci_ev_le_ext_adv_info *ext_adv;
7612         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
7613         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
7614
7615         hci_dev_lock(hdev);
7616
7617         /* If we are currently suspended and this is the first BT event seen,
7618          * save the wake reason associated with the event.
7619          */
7620         if (!hdev->suspended || hdev->wake_reason)
7621                 goto unlock;
7622
7623         /* Default to remote wake. Values for wake_reason are documented in the
7624          * Bluez mgmt api docs.
7625          */
7626         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
7627
7628         /* Once configured for remote wakeup, we should only wake up for
7629          * reconnections. It's useful to see which device is waking us up so
7630          * keep track of the bdaddr of the connection event that woke us up.
7631          */
7632         if (event == HCI_EV_CONN_REQUEST) {
7633                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
7634                 hdev->wake_addr_type = BDADDR_BREDR;
7635         } else if (event == HCI_EV_CONN_COMPLETE) {
7636                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
7637                 hdev->wake_addr_type = BDADDR_BREDR;
7638         } else if (event == HCI_EV_LE_META) {
7639                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
7640                 u8 subevent = le_ev->subevent;
7641                 u8 *ptr = &skb->data[sizeof(*le_ev)];
7642                 u8 num_reports = *ptr;
7643
7644                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
7645                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
7646                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
7647                     num_reports) {
7648                         adv = (void *)(ptr + 1);
7649                         direct_adv = (void *)(ptr + 1);
7650                         ext_adv = (void *)(ptr + 1);
7651
7652                         switch (subevent) {
7653                         case HCI_EV_LE_ADVERTISING_REPORT:
7654                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
7655                                 hdev->wake_addr_type = adv->bdaddr_type;
7656                                 break;
7657                         case HCI_EV_LE_DIRECT_ADV_REPORT:
7658                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
7659                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
7660                                 break;
7661                         case HCI_EV_LE_EXT_ADV_REPORT:
7662                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
7663                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
7664                                 break;
7665                         }
7666                 }
7667         } else {
7668                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
7669         }
7670
7671 unlock:
7672         hci_dev_unlock(hdev);
7673 }
7674
7675 #define HCI_EV_VL(_op, _func, _min_len, _max_len) \
7676 [_op] = { \
7677         .req = false, \
7678         .func = _func, \
7679         .min_len = _min_len, \
7680         .max_len = _max_len, \
7681 }
7682
7683 #define HCI_EV(_op, _func, _len) \
7684         HCI_EV_VL(_op, _func, _len, _len)
7685
7686 #define HCI_EV_STATUS(_op, _func) \
7687         HCI_EV(_op, _func, sizeof(struct hci_ev_status))
7688
7689 #define HCI_EV_REQ_VL(_op, _func, _min_len, _max_len) \
7690 [_op] = { \
7691         .req = true, \
7692         .func_req = _func, \
7693         .min_len = _min_len, \
7694         .max_len = _max_len, \
7695 }
7696
7697 #define HCI_EV_REQ(_op, _func, _len) \
7698         HCI_EV_REQ_VL(_op, _func, _len, _len)
7699
7700 /* Entries in this table shall have their position according to the event opcode
7701  * they handle so the use of the macros above is recommend since it does attempt
7702  * to initialize at its proper index using Designated Initializers that way
7703  * events without a callback function don't have entered.
7704  */
7705 static const struct hci_ev {
7706         bool req;
7707         union {
7708                 void (*func)(struct hci_dev *hdev, void *data,
7709                              struct sk_buff *skb);
7710                 void (*func_req)(struct hci_dev *hdev, void *data,
7711                                  struct sk_buff *skb, u16 *opcode, u8 *status,
7712                                  hci_req_complete_t *req_complete,
7713                                  hci_req_complete_skb_t *req_complete_skb);
7714         };
7715         u16  min_len;
7716         u16  max_len;
7717 } hci_ev_table[U8_MAX + 1] = {
7718         /* [0x01 = HCI_EV_INQUIRY_COMPLETE] */
7719         HCI_EV_STATUS(HCI_EV_INQUIRY_COMPLETE, hci_inquiry_complete_evt),
7720         /* [0x02 = HCI_EV_INQUIRY_RESULT] */
7721         HCI_EV_VL(HCI_EV_INQUIRY_RESULT, hci_inquiry_result_evt,
7722                   sizeof(struct hci_ev_inquiry_result), HCI_MAX_EVENT_SIZE),
7723         /* [0x03 = HCI_EV_CONN_COMPLETE] */
7724         HCI_EV(HCI_EV_CONN_COMPLETE, hci_conn_complete_evt,
7725                sizeof(struct hci_ev_conn_complete)),
7726         /* [0x04 = HCI_EV_CONN_REQUEST] */
7727         HCI_EV(HCI_EV_CONN_REQUEST, hci_conn_request_evt,
7728                sizeof(struct hci_ev_conn_request)),
7729         /* [0x05 = HCI_EV_DISCONN_COMPLETE] */
7730         HCI_EV(HCI_EV_DISCONN_COMPLETE, hci_disconn_complete_evt,
7731                sizeof(struct hci_ev_disconn_complete)),
7732         /* [0x06 = HCI_EV_AUTH_COMPLETE] */
7733         HCI_EV(HCI_EV_AUTH_COMPLETE, hci_auth_complete_evt,
7734                sizeof(struct hci_ev_auth_complete)),
7735         /* [0x07 = HCI_EV_REMOTE_NAME] */
7736         HCI_EV(HCI_EV_REMOTE_NAME, hci_remote_name_evt,
7737                sizeof(struct hci_ev_remote_name)),
7738         /* [0x08 = HCI_EV_ENCRYPT_CHANGE] */
7739         HCI_EV(HCI_EV_ENCRYPT_CHANGE, hci_encrypt_change_evt,
7740                sizeof(struct hci_ev_encrypt_change)),
7741         /* [0x09 = HCI_EV_CHANGE_LINK_KEY_COMPLETE] */
7742         HCI_EV(HCI_EV_CHANGE_LINK_KEY_COMPLETE,
7743                hci_change_link_key_complete_evt,
7744                sizeof(struct hci_ev_change_link_key_complete)),
7745         /* [0x0b = HCI_EV_REMOTE_FEATURES] */
7746         HCI_EV(HCI_EV_REMOTE_FEATURES, hci_remote_features_evt,
7747                sizeof(struct hci_ev_remote_features)),
7748         /* [0x0e = HCI_EV_CMD_COMPLETE] */
7749         HCI_EV_REQ_VL(HCI_EV_CMD_COMPLETE, hci_cmd_complete_evt,
7750                       sizeof(struct hci_ev_cmd_complete), HCI_MAX_EVENT_SIZE),
7751         /* [0x0f = HCI_EV_CMD_STATUS] */
7752         HCI_EV_REQ(HCI_EV_CMD_STATUS, hci_cmd_status_evt,
7753                    sizeof(struct hci_ev_cmd_status)),
7754         /* [0x10 = HCI_EV_CMD_STATUS] */
7755         HCI_EV(HCI_EV_HARDWARE_ERROR, hci_hardware_error_evt,
7756                sizeof(struct hci_ev_hardware_error)),
7757         /* [0x12 = HCI_EV_ROLE_CHANGE] */
7758         HCI_EV(HCI_EV_ROLE_CHANGE, hci_role_change_evt,
7759                sizeof(struct hci_ev_role_change)),
7760         /* [0x13 = HCI_EV_NUM_COMP_PKTS] */
7761         HCI_EV_VL(HCI_EV_NUM_COMP_PKTS, hci_num_comp_pkts_evt,
7762                   sizeof(struct hci_ev_num_comp_pkts), HCI_MAX_EVENT_SIZE),
7763         /* [0x14 = HCI_EV_MODE_CHANGE] */
7764         HCI_EV(HCI_EV_MODE_CHANGE, hci_mode_change_evt,
7765                sizeof(struct hci_ev_mode_change)),
7766         /* [0x16 = HCI_EV_PIN_CODE_REQ] */
7767         HCI_EV(HCI_EV_PIN_CODE_REQ, hci_pin_code_request_evt,
7768                sizeof(struct hci_ev_pin_code_req)),
7769         /* [0x17 = HCI_EV_LINK_KEY_REQ] */
7770         HCI_EV(HCI_EV_LINK_KEY_REQ, hci_link_key_request_evt,
7771                sizeof(struct hci_ev_link_key_req)),
7772         /* [0x18 = HCI_EV_LINK_KEY_NOTIFY] */
7773         HCI_EV(HCI_EV_LINK_KEY_NOTIFY, hci_link_key_notify_evt,
7774                sizeof(struct hci_ev_link_key_notify)),
7775         /* [0x1c = HCI_EV_CLOCK_OFFSET] */
7776         HCI_EV(HCI_EV_CLOCK_OFFSET, hci_clock_offset_evt,
7777                sizeof(struct hci_ev_clock_offset)),
7778         /* [0x1d = HCI_EV_PKT_TYPE_CHANGE] */
7779         HCI_EV(HCI_EV_PKT_TYPE_CHANGE, hci_pkt_type_change_evt,
7780                sizeof(struct hci_ev_pkt_type_change)),
7781         /* [0x20 = HCI_EV_PSCAN_REP_MODE] */
7782         HCI_EV(HCI_EV_PSCAN_REP_MODE, hci_pscan_rep_mode_evt,
7783                sizeof(struct hci_ev_pscan_rep_mode)),
7784         /* [0x22 = HCI_EV_INQUIRY_RESULT_WITH_RSSI] */
7785         HCI_EV_VL(HCI_EV_INQUIRY_RESULT_WITH_RSSI,
7786                   hci_inquiry_result_with_rssi_evt,
7787                   sizeof(struct hci_ev_inquiry_result_rssi),
7788                   HCI_MAX_EVENT_SIZE),
7789         /* [0x23 = HCI_EV_REMOTE_EXT_FEATURES] */
7790         HCI_EV(HCI_EV_REMOTE_EXT_FEATURES, hci_remote_ext_features_evt,
7791                sizeof(struct hci_ev_remote_ext_features)),
7792         /* [0x2c = HCI_EV_SYNC_CONN_COMPLETE] */
7793         HCI_EV(HCI_EV_SYNC_CONN_COMPLETE, hci_sync_conn_complete_evt,
7794                sizeof(struct hci_ev_sync_conn_complete)),
7795         /* [0x2d = HCI_EV_EXTENDED_INQUIRY_RESULT] */
7796         HCI_EV_VL(HCI_EV_EXTENDED_INQUIRY_RESULT,
7797                   hci_extended_inquiry_result_evt,
7798                   sizeof(struct hci_ev_ext_inquiry_result), HCI_MAX_EVENT_SIZE),
7799         /* [0x30 = HCI_EV_KEY_REFRESH_COMPLETE] */
7800         HCI_EV(HCI_EV_KEY_REFRESH_COMPLETE, hci_key_refresh_complete_evt,
7801                sizeof(struct hci_ev_key_refresh_complete)),
7802         /* [0x31 = HCI_EV_IO_CAPA_REQUEST] */
7803         HCI_EV(HCI_EV_IO_CAPA_REQUEST, hci_io_capa_request_evt,
7804                sizeof(struct hci_ev_io_capa_request)),
7805         /* [0x32 = HCI_EV_IO_CAPA_REPLY] */
7806         HCI_EV(HCI_EV_IO_CAPA_REPLY, hci_io_capa_reply_evt,
7807                sizeof(struct hci_ev_io_capa_reply)),
7808         /* [0x33 = HCI_EV_USER_CONFIRM_REQUEST] */
7809         HCI_EV(HCI_EV_USER_CONFIRM_REQUEST, hci_user_confirm_request_evt,
7810                sizeof(struct hci_ev_user_confirm_req)),
7811         /* [0x34 = HCI_EV_USER_PASSKEY_REQUEST] */
7812         HCI_EV(HCI_EV_USER_PASSKEY_REQUEST, hci_user_passkey_request_evt,
7813                sizeof(struct hci_ev_user_passkey_req)),
7814         /* [0x35 = HCI_EV_REMOTE_OOB_DATA_REQUEST] */
7815         HCI_EV(HCI_EV_REMOTE_OOB_DATA_REQUEST, hci_remote_oob_data_request_evt,
7816                sizeof(struct hci_ev_remote_oob_data_request)),
7817         /* [0x36 = HCI_EV_SIMPLE_PAIR_COMPLETE] */
7818         HCI_EV(HCI_EV_SIMPLE_PAIR_COMPLETE, hci_simple_pair_complete_evt,
7819                sizeof(struct hci_ev_simple_pair_complete)),
7820         /* [0x3b = HCI_EV_USER_PASSKEY_NOTIFY] */
7821         HCI_EV(HCI_EV_USER_PASSKEY_NOTIFY, hci_user_passkey_notify_evt,
7822                sizeof(struct hci_ev_user_passkey_notify)),
7823         /* [0x3c = HCI_EV_KEYPRESS_NOTIFY] */
7824         HCI_EV(HCI_EV_KEYPRESS_NOTIFY, hci_keypress_notify_evt,
7825                sizeof(struct hci_ev_keypress_notify)),
7826         /* [0x3d = HCI_EV_REMOTE_HOST_FEATURES] */
7827         HCI_EV(HCI_EV_REMOTE_HOST_FEATURES, hci_remote_host_features_evt,
7828                sizeof(struct hci_ev_remote_host_features)),
7829         /* [0x3e = HCI_EV_LE_META] */
7830         HCI_EV_REQ_VL(HCI_EV_LE_META, hci_le_meta_evt,
7831                       sizeof(struct hci_ev_le_meta), HCI_MAX_EVENT_SIZE),
7832 #if IS_ENABLED(CONFIG_BT_HS)
7833         /* [0x40 = HCI_EV_PHY_LINK_COMPLETE] */
7834         HCI_EV(HCI_EV_PHY_LINK_COMPLETE, hci_phy_link_complete_evt,
7835                sizeof(struct hci_ev_phy_link_complete)),
7836         /* [0x41 = HCI_EV_CHANNEL_SELECTED] */
7837         HCI_EV(HCI_EV_CHANNEL_SELECTED, hci_chan_selected_evt,
7838                sizeof(struct hci_ev_channel_selected)),
7839         /* [0x42 = HCI_EV_DISCONN_PHY_LINK_COMPLETE] */
7840         HCI_EV(HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE,
7841                hci_disconn_loglink_complete_evt,
7842                sizeof(struct hci_ev_disconn_logical_link_complete)),
7843         /* [0x45 = HCI_EV_LOGICAL_LINK_COMPLETE] */
7844         HCI_EV(HCI_EV_LOGICAL_LINK_COMPLETE, hci_loglink_complete_evt,
7845                sizeof(struct hci_ev_logical_link_complete)),
7846         /* [0x46 = HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE] */
7847         HCI_EV(HCI_EV_DISCONN_PHY_LINK_COMPLETE,
7848                hci_disconn_phylink_complete_evt,
7849                sizeof(struct hci_ev_disconn_phy_link_complete)),
7850 #endif
7851         /* [0x48 = HCI_EV_NUM_COMP_BLOCKS] */
7852         HCI_EV(HCI_EV_NUM_COMP_BLOCKS, hci_num_comp_blocks_evt,
7853                sizeof(struct hci_ev_num_comp_blocks)),
7854 #ifdef TIZEN_BT
7855         /* [0xFF = HCI_EV_VENDOR_SPECIFIC] */
7856         HCI_EV(HCI_EV_VENDOR_SPECIFIC, hci_vendor_specific_evt,
7857                sizeof(struct hci_ev_vendor_specific)),
7858 #else
7859         /* [0xff = HCI_EV_VENDOR] */
7860         HCI_EV_VL(HCI_EV_VENDOR, msft_vendor_evt, 0, HCI_MAX_EVENT_SIZE),
7861 #endif
7862 };
7863
7864 static void hci_event_func(struct hci_dev *hdev, u8 event, struct sk_buff *skb,
7865                            u16 *opcode, u8 *status,
7866                            hci_req_complete_t *req_complete,
7867                            hci_req_complete_skb_t *req_complete_skb)
7868 {
7869         const struct hci_ev *ev = &hci_ev_table[event];
7870         void *data;
7871
7872         if (!ev->func)
7873                 return;
7874
7875         if (skb->len < ev->min_len) {
7876                 bt_dev_err(hdev, "unexpected event 0x%2.2x length: %u < %u",
7877                            event, skb->len, ev->min_len);
7878                 return;
7879         }
7880
7881         /* Just warn if the length is over max_len size it still be
7882          * possible to partially parse the event so leave to callback to
7883          * decide if that is acceptable.
7884          */
7885         if (skb->len > ev->max_len)
7886                 bt_dev_warn_ratelimited(hdev,
7887                                         "unexpected event 0x%2.2x length: %u > %u",
7888                                         event, skb->len, ev->max_len);
7889
7890         data = hci_ev_skb_pull(hdev, skb, event, ev->min_len);
7891         if (!data)
7892                 return;
7893
7894         if (ev->req)
7895                 ev->func_req(hdev, data, skb, opcode, status, req_complete,
7896                              req_complete_skb);
7897         else
7898                 ev->func(hdev, data, skb);
7899 }
7900
7901 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
7902 {
7903         struct hci_event_hdr *hdr = (void *) skb->data;
7904         hci_req_complete_t req_complete = NULL;
7905         hci_req_complete_skb_t req_complete_skb = NULL;
7906         struct sk_buff *orig_skb = NULL;
7907         u8 status = 0, event, req_evt = 0;
7908         u16 opcode = HCI_OP_NOP;
7909
7910         if (skb->len < sizeof(*hdr)) {
7911                 bt_dev_err(hdev, "Malformed HCI Event");
7912                 goto done;
7913         }
7914
7915         kfree_skb(hdev->recv_event);
7916         hdev->recv_event = skb_clone(skb, GFP_KERNEL);
7917
7918         event = hdr->evt;
7919         if (!event) {
7920                 bt_dev_warn(hdev, "Received unexpected HCI Event 0x%2.2x",
7921                             event);
7922                 goto done;
7923         }
7924
7925         /* Only match event if command OGF is not for LE */
7926         if (hdev->sent_cmd &&
7927             hci_opcode_ogf(hci_skb_opcode(hdev->sent_cmd)) != 0x08 &&
7928             hci_skb_event(hdev->sent_cmd) == event) {
7929                 hci_req_cmd_complete(hdev, hci_skb_opcode(hdev->sent_cmd),
7930                                      status, &req_complete, &req_complete_skb);
7931                 req_evt = event;
7932         }
7933
7934         /* If it looks like we might end up having to call
7935          * req_complete_skb, store a pristine copy of the skb since the
7936          * various handlers may modify the original one through
7937          * skb_pull() calls, etc.
7938          */
7939         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
7940             event == HCI_EV_CMD_COMPLETE)
7941                 orig_skb = skb_clone(skb, GFP_KERNEL);
7942
7943         skb_pull(skb, HCI_EVENT_HDR_SIZE);
7944
7945         /* Store wake reason if we're suspended */
7946         hci_store_wake_reason(hdev, event, skb);
7947
7948         bt_dev_dbg(hdev, "event 0x%2.2x", event);
7949
7950         hci_event_func(hdev, event, skb, &opcode, &status, &req_complete,
7951                        &req_complete_skb);
7952
7953         if (req_complete) {
7954                 req_complete(hdev, status, opcode);
7955         } else if (req_complete_skb) {
7956                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
7957                         kfree_skb(orig_skb);
7958                         orig_skb = NULL;
7959                 }
7960                 req_complete_skb(hdev, status, opcode, orig_skb);
7961         }
7962
7963 done:
7964         kfree_skb(orig_skb);
7965         kfree_skb(skb);
7966         hdev->stat.evt_rx++;
7967 }