net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  55         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  56
  57         hci_dev_lock(hdev);
  58         /* Set discovery state to stopped if we're not doing LE active
  59          * scanning.
  60          */
  61         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  62             hdev->le_scan_type != LE_SCAN_ACTIVE)
  63                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  64         hci_dev_unlock(hdev);
  65
  66         hci_conn_check_pending(hdev);
  67 }
  68
  69 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  70 {
  71         __u8 status = *((__u8 *) skb->data);
  72
  73         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  74
  75         if (status)
  76                 return;
  77
  78         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  79 }
  80
  81 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  82 {
  83         __u8 status = *((__u8 *) skb->data);
  84
  85         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  86
  87         if (status)
  88                 return;
  89
  90         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
  91
  92         hci_conn_check_pending(hdev);
  93 }
  94
  95 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  96                                           struct sk_buff *skb)
  97 {
  98         BT_DBG("%s", hdev->name);
  99 }
 100
 101 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 102 {
 103         struct hci_rp_role_discovery *rp = (void *) skb->data;
 104         struct hci_conn *conn;
 105
 106         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 107
 108         if (rp->status)
 109                 return;
 110
 111         hci_dev_lock(hdev);
 112
 113         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 114         if (conn)
 115                 conn->role = rp->role;
 116
 117         hci_dev_unlock(hdev);
 118 }
 119
 120 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 121 {
 122         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 123         struct hci_conn *conn;
 124
 125         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 126
 127         if (rp->status)
 128                 return;
 129
 130         hci_dev_lock(hdev);
 131
 132         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 133         if (conn)
 134                 conn->link_policy = __le16_to_cpu(rp->policy);
 135
 136         hci_dev_unlock(hdev);
 137 }
 138
 139 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 140 {
 141         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 142         struct hci_conn *conn;
 143         void *sent;
 144
 145         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 146
 147         if (rp->status)
 148                 return;
 149
 150         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 151         if (!sent)
 152                 return;
 153
 154         hci_dev_lock(hdev);
 155
 156         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 157         if (conn)
 158                 conn->link_policy = get_unaligned_le16(sent + 2);
 159
 160         hci_dev_unlock(hdev);
 161 }
 162
 163 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 164                                         struct sk_buff *skb)
 165 {
 166         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 167
 168         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 169
 170         if (rp->status)
 171                 return;
 172
 173         hdev->link_policy = __le16_to_cpu(rp->policy);
 174 }
 175
 176 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 177                                          struct sk_buff *skb)
 178 {
 179         __u8 status = *((__u8 *) skb->data);
 180         void *sent;
 181
 182         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 183
 184         if (status)
 185                 return;
 186
 187         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 188         if (!sent)
 189                 return;
 190
 191         hdev->link_policy = get_unaligned_le16(sent);
 192 }
 193
 194 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197
 198         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 199
 200         clear_bit(HCI_RESET, &hdev->flags);
 201
 202         if (status)
 203                 return;
 204
 205         /* Reset all non-persistent flags */
 206         hci_dev_clear_volatile_flags(hdev);
 207
 208         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 209
 210         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 211         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 212
 213         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 214         hdev->adv_data_len = 0;
 215
 216         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 217         hdev->scan_rsp_data_len = 0;
 218
 219         hdev->le_scan_type = LE_SCAN_PASSIVE;
 220
 221         hdev->ssp_debug_mode = 0;
 222
 223         hci_bdaddr_list_clear(&hdev->le_white_list);
 224         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 225 }
 226
 227 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 228                                         struct sk_buff *skb)
 229 {
 230         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 231         struct hci_cp_read_stored_link_key *sent;
 232
 233         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 234
 235         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 236         if (!sent)
 237                 return;
 238
 239         if (!rp->status && sent->read_all == 0x01) {
 240                 hdev->stored_max_keys = rp->max_keys;
 241                 hdev->stored_num_keys = rp->num_keys;
 242         }
 243 }
 244
 245 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 246                                           struct sk_buff *skb)
 247 {
 248         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 249
 250         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 251
 252         if (rp->status)
 253                 return;
 254
 255         if (rp->num_keys <= hdev->stored_num_keys)
 256                 hdev->stored_num_keys -= rp->num_keys;
 257         else
 258                 hdev->stored_num_keys = 0;
 259 }
 260
 261 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 262 {
 263         __u8 status = *((__u8 *) skb->data);
 264         void *sent;
 265
 266         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 267
 268         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 269         if (!sent)
 270                 return;
 271
 272         hci_dev_lock(hdev);
 273
 274         if (hci_dev_test_flag(hdev, HCI_MGMT))
 275                 mgmt_set_local_name_complete(hdev, sent, status);
 276         else if (!status)
 277                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 278
 279         hci_dev_unlock(hdev);
 280 }
 281
 282 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 283 {
 284         struct hci_rp_read_local_name *rp = (void *) skb->data;
 285
 286         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 287
 288         if (rp->status)
 289                 return;
 290
 291         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 292             hci_dev_test_flag(hdev, HCI_CONFIG))
 293                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 294 }
 295
 296 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 297 {
 298         __u8 status = *((__u8 *) skb->data);
 299         void *sent;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 302
 303         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 304         if (!sent)
 305                 return;
 306
 307         hci_dev_lock(hdev);
 308
 309         if (!status) {
 310                 __u8 param = *((__u8 *) sent);
 311
 312                 if (param == AUTH_ENABLED)
 313                         set_bit(HCI_AUTH, &hdev->flags);
 314                 else
 315                         clear_bit(HCI_AUTH, &hdev->flags);
 316         }
 317
 318         if (hci_dev_test_flag(hdev, HCI_MGMT))
 319                 mgmt_auth_enable_complete(hdev, status);
 320
 321         hci_dev_unlock(hdev);
 322 }
 323
 324 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 325 {
 326         __u8 status = *((__u8 *) skb->data);
 327         __u8 param;
 328         void *sent;
 329
 330         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 331
 332         if (status)
 333                 return;
 334
 335         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 336         if (!sent)
 337                 return;
 338
 339         param = *((__u8 *) sent);
 340
 341         if (param)
 342                 set_bit(HCI_ENCRYPT, &hdev->flags);
 343         else
 344                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 345 }
 346
 347 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 348 {
 349         __u8 status = *((__u8 *) skb->data);
 350         __u8 param;
 351         void *sent;
 352
 353         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 356         if (!sent)
 357                 return;
 358
 359         param = *((__u8 *) sent);
 360
 361         hci_dev_lock(hdev);
 362
 363         if (status) {
 364                 hdev->discov_timeout = 0;
 365                 goto done;
 366         }
 367
 368         if (param & SCAN_INQUIRY)
 369                 set_bit(HCI_ISCAN, &hdev->flags);
 370         else
 371                 clear_bit(HCI_ISCAN, &hdev->flags);
 372
 373         if (param & SCAN_PAGE)
 374                 set_bit(HCI_PSCAN, &hdev->flags);
 375         else
 376                 clear_bit(HCI_PSCAN, &hdev->flags);
 377
 378 done:
 379         hci_dev_unlock(hdev);
 380 }
 381
 382 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 383 {
 384         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 385
 386         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 387
 388         if (rp->status)
 389                 return;
 390
 391         memcpy(hdev->dev_class, rp->dev_class, 3);
 392
 393         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 394                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 395 }
 396
 397 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         __u8 status = *((__u8 *) skb->data);
 400         void *sent;
 401
 402         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 403
 404         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 405         if (!sent)
 406                 return;
 407
 408         hci_dev_lock(hdev);
 409
 410         if (status == 0)
 411                 memcpy(hdev->dev_class, sent, 3);
 412
 413         if (hci_dev_test_flag(hdev, HCI_MGMT))
 414                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 415
 416         hci_dev_unlock(hdev);
 417 }
 418
 419 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 420 {
 421         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 422         __u16 setting;
 423
 424         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 425
 426         if (rp->status)
 427                 return;
 428
 429         setting = __le16_to_cpu(rp->voice_setting);
 430
 431         if (hdev->voice_setting == setting)
 432                 return;
 433
 434         hdev->voice_setting = setting;
 435
 436         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 437
 438         if (hdev->notify)
 439                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 440 }
 441
 442 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 443                                        struct sk_buff *skb)
 444 {
 445         __u8 status = *((__u8 *) skb->data);
 446         __u16 setting;
 447         void *sent;
 448
 449         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 450
 451         if (status)
 452                 return;
 453
 454         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 455         if (!sent)
 456                 return;
 457
 458         setting = get_unaligned_le16(sent);
 459
 460         if (hdev->voice_setting == setting)
 461                 return;
 462
 463         hdev->voice_setting = setting;
 464
 465         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 466
 467         if (hdev->notify)
 468                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 469 }
 470
 471 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 472                                           struct sk_buff *skb)
 473 {
 474         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 475
 476         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 477
 478         if (rp->status)
 479                 return;
 480
 481         hdev->num_iac = rp->num_iac;
 482
 483         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 484 }
 485
 486 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 487 {
 488         __u8 status = *((__u8 *) skb->data);
 489         struct hci_cp_write_ssp_mode *sent;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 492
 493         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 494         if (!sent)
 495                 return;
 496
 497         hci_dev_lock(hdev);
 498
 499         if (!status) {
 500                 if (sent->mode)
 501                         hdev->features[1][0] |= LMP_HOST_SSP;
 502                 else
 503                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 504         }
 505
 506         if (hci_dev_test_flag(hdev, HCI_MGMT))
 507                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 508         else if (!status) {
 509                 if (sent->mode)
 510                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 511                 else
 512                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 513         }
 514
 515         hci_dev_unlock(hdev);
 516 }
 517
 518 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 519 {
 520         u8 status = *((u8 *) skb->data);
 521         struct hci_cp_write_sc_support *sent;
 522
 523         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 524
 525         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 526         if (!sent)
 527                 return;
 528
 529         hci_dev_lock(hdev);
 530
 531         if (!status) {
 532                 if (sent->support)
 533                         hdev->features[1][0] |= LMP_HOST_SC;
 534                 else
 535                         hdev->features[1][0] &= ~LMP_HOST_SC;
 536         }
 537
 538         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 539                 if (sent->support)
 540                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 541                 else
 542                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 543         }
 544
 545         hci_dev_unlock(hdev);
 546 }
 547
 548 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 549 {
 550         struct hci_rp_read_local_version *rp = (void *) skb->data;
 551
 552         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 553
 554         if (rp->status)
 555                 return;
 556
 557         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 558             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 559                 hdev->hci_ver = rp->hci_ver;
 560                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 561                 hdev->lmp_ver = rp->lmp_ver;
 562                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 563                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 564         }
 565 }
 566
 567 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 568                                        struct sk_buff *skb)
 569 {
 570         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 571
 572         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 573
 574         if (rp->status)
 575                 return;
 576
 577         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 578             hci_dev_test_flag(hdev, HCI_CONFIG))
 579                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 580 }
 581
 582 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 583                                              struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 586         struct hci_conn *conn;
 587
 588         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 589
 590         if (rp->status)
 591                 return;
 592
 593         hci_dev_lock(hdev);
 594
 595         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 596         if (conn)
 597                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 598
 599         hci_dev_unlock(hdev);
 600 }
 601
 602 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 603                                               struct sk_buff *skb)
 604 {
 605         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 606         struct hci_conn *conn;
 607         void *sent;
 608
 609         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 610
 611         if (rp->status)
 612                 return;
 613
 614         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 615         if (!sent)
 616                 return;
 617
 618         hci_dev_lock(hdev);
 619
 620         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 621         if (conn)
 622                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 623
 624         hci_dev_unlock(hdev);
 625 }
 626
 627 static void hci_cc_read_local_features(struct hci_dev *hdev,
 628                                        struct sk_buff *skb)
 629 {
 630         struct hci_rp_read_local_features *rp = (void *) skb->data;
 631
 632         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 633
 634         if (rp->status)
 635                 return;
 636
 637         memcpy(hdev->features, rp->features, 8);
 638
 639         /* Adjust default settings according to features
 640          * supported by device. */
 641
 642         if (hdev->features[0][0] & LMP_3SLOT)
 643                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 644
 645         if (hdev->features[0][0] & LMP_5SLOT)
 646                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 647
 648         if (hdev->features[0][1] & LMP_HV2) {
 649                 hdev->pkt_type  |= (HCI_HV2);
 650                 hdev->esco_type |= (ESCO_HV2);
 651         }
 652
 653         if (hdev->features[0][1] & LMP_HV3) {
 654                 hdev->pkt_type  |= (HCI_HV3);
 655                 hdev->esco_type |= (ESCO_HV3);
 656         }
 657
 658         if (lmp_esco_capable(hdev))
 659                 hdev->esco_type |= (ESCO_EV3);
 660
 661         if (hdev->features[0][4] & LMP_EV4)
 662                 hdev->esco_type |= (ESCO_EV4);
 663
 664         if (hdev->features[0][4] & LMP_EV5)
 665                 hdev->esco_type |= (ESCO_EV5);
 666
 667         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 668                 hdev->esco_type |= (ESCO_2EV3);
 669
 670         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 671                 hdev->esco_type |= (ESCO_3EV3);
 672
 673         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 674                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 675 }
 676
 677 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 678                                            struct sk_buff *skb)
 679 {
 680         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 681
 682         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 683
 684         if (rp->status)
 685                 return;
 686
 687         if (hdev->max_page < rp->max_page)
 688                 hdev->max_page = rp->max_page;
 689
 690         if (rp->page < HCI_MAX_PAGES)
 691                 memcpy(hdev->features[rp->page], rp->features, 8);
 692 }
 693
 694 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 695                                           struct sk_buff *skb)
 696 {
 697         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 698
 699         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 700
 701         if (rp->status)
 702                 return;
 703
 704         hdev->flow_ctl_mode = rp->mode;
 705 }
 706
 707 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 708 {
 709         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 710
 711         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 712
 713         if (rp->status)
 714                 return;
 715
 716         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 717         hdev->sco_mtu  = rp->sco_mtu;
 718         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 719         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 720
 721         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 722                 hdev->sco_mtu  = 64;
 723                 hdev->sco_pkts = 8;
 724         }
 725
 726         hdev->acl_cnt = hdev->acl_pkts;
 727         hdev->sco_cnt = hdev->sco_pkts;
 728
 729         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 730                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 731 }
 732
 733 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 734 {
 735         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 736
 737         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 738
 739         if (rp->status)
 740                 return;
 741
 742         if (test_bit(HCI_INIT, &hdev->flags))
 743                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 744
 745         if (hci_dev_test_flag(hdev, HCI_SETUP))
 746                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 747 }
 748
 749 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 750                                            struct sk_buff *skb)
 751 {
 752         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 753
 754         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 755
 756         if (rp->status)
 757                 return;
 758
 759         if (test_bit(HCI_INIT, &hdev->flags)) {
 760                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 761                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 762         }
 763 }
 764
 765 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 766                                             struct sk_buff *skb)
 767 {
 768         u8 status = *((u8 *) skb->data);
 769         struct hci_cp_write_page_scan_activity *sent;
 770
 771         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 772
 773         if (status)
 774                 return;
 775
 776         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 777         if (!sent)
 778                 return;
 779
 780         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 781         hdev->page_scan_window = __le16_to_cpu(sent->window);
 782 }
 783
 784 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 785                                            struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         if (test_bit(HCI_INIT, &hdev->flags))
 795                 hdev->page_scan_type = rp->type;
 796 }
 797
 798 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 799                                         struct sk_buff *skb)
 800 {
 801         u8 status = *((u8 *) skb->data);
 802         u8 *type;
 803
 804         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 805
 806         if (status)
 807                 return;
 808
 809         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 810         if (type)
 811                 hdev->page_scan_type = *type;
 812 }
 813
 814 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 815                                         struct sk_buff *skb)
 816 {
 817         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 818
 819         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 820
 821         if (rp->status)
 822                 return;
 823
 824         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 825         hdev->block_len = __le16_to_cpu(rp->block_len);
 826         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 827
 828         hdev->block_cnt = hdev->num_blocks;
 829
 830         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 831                hdev->block_cnt, hdev->block_len);
 832 }
 833
 834 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 835 {
 836         struct hci_rp_read_clock *rp = (void *) skb->data;
 837         struct hci_cp_read_clock *cp;
 838         struct hci_conn *conn;
 839
 840         BT_DBG("%s", hdev->name);
 841
 842         if (skb->len < sizeof(*rp))
 843                 return;
 844
 845         if (rp->status)
 846                 return;
 847
 848         hci_dev_lock(hdev);
 849
 850         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 851         if (!cp)
 852                 goto unlock;
 853
 854         if (cp->which == 0x00) {
 855                 hdev->clock = le32_to_cpu(rp->clock);
 856                 goto unlock;
 857         }
 858
 859         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 860         if (conn) {
 861                 conn->clock = le32_to_cpu(rp->clock);
 862                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 863         }
 864
 865 unlock:
 866         hci_dev_unlock(hdev);
 867 }
 868
 869 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 870                                        struct sk_buff *skb)
 871 {
 872         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 873
 874         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 875
 876         if (rp->status)
 877                 return;
 878
 879         hdev->amp_status = rp->amp_status;
 880         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 881         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 882         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 883         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 884         hdev->amp_type = rp->amp_type;
 885         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 886         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 887         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 888         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 889 }
 890
 891 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 892                                          struct sk_buff *skb)
 893 {
 894         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 895
 896         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 897
 898         if (rp->status)
 899                 return;
 900
 901         hdev->inq_tx_power = rp->tx_power;
 902 }
 903
 904 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 905 {
 906         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 907         struct hci_cp_pin_code_reply *cp;
 908         struct hci_conn *conn;
 909
 910         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 911
 912         hci_dev_lock(hdev);
 913
 914         if (hci_dev_test_flag(hdev, HCI_MGMT))
 915                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 916
 917         if (rp->status)
 918                 goto unlock;
 919
 920         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 921         if (!cp)
 922                 goto unlock;
 923
 924         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 925         if (conn)
 926                 conn->pin_length = cp->pin_len;
 927
 928 unlock:
 929         hci_dev_unlock(hdev);
 930 }
 931
 932 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 933 {
 934         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 935
 936         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 937
 938         hci_dev_lock(hdev);
 939
 940         if (hci_dev_test_flag(hdev, HCI_MGMT))
 941                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 942                                                  rp->status);
 943
 944         hci_dev_unlock(hdev);
 945 }
 946
 947 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 948                                        struct sk_buff *skb)
 949 {
 950         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 951
 952         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 953
 954         if (rp->status)
 955                 return;
 956
 957         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 958         hdev->le_pkts = rp->le_max_pkt;
 959
 960         hdev->le_cnt = hdev->le_pkts;
 961
 962         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 963 }
 964
 965 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 966                                           struct sk_buff *skb)
 967 {
 968         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 969
 970         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 971
 972         if (rp->status)
 973                 return;
 974
 975         memcpy(hdev->le_features, rp->features, 8);
 976 }
 977
 978 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 979                                         struct sk_buff *skb)
 980 {
 981         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 982
 983         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 984
 985         if (rp->status)
 986                 return;
 987
 988         hdev->adv_tx_power = rp->tx_power;
 989 }
 990
 991 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 992 {
 993         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 994
 995         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 996
 997         hci_dev_lock(hdev);
 998
 999         if (hci_dev_test_flag(hdev, HCI_MGMT))
1000                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1001                                                  rp->status);
1002
1003         hci_dev_unlock(hdev);
1004 }
1005
1006 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1007                                           struct sk_buff *skb)
1008 {
1009         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1010
1011         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1012
1013         hci_dev_lock(hdev);
1014
1015         if (hci_dev_test_flag(hdev, HCI_MGMT))
1016                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1017                                                      ACL_LINK, 0, rp->status);
1018
1019         hci_dev_unlock(hdev);
1020 }
1021
1022 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1023 {
1024         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1025
1026         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1027
1028         hci_dev_lock(hdev);
1029
1030         if (hci_dev_test_flag(hdev, HCI_MGMT))
1031                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1032                                                  0, rp->status);
1033
1034         hci_dev_unlock(hdev);
1035 }
1036
1037 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1038                                           struct sk_buff *skb)
1039 {
1040         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1041
1042         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1043
1044         hci_dev_lock(hdev);
1045
1046         if (hci_dev_test_flag(hdev, HCI_MGMT))
1047                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1048                                                      ACL_LINK, 0, rp->status);
1049
1050         hci_dev_unlock(hdev);
1051 }
1052
1053 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1054                                        struct sk_buff *skb)
1055 {
1056         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1057
1058         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1059 }
1060
1061 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1062                                            struct sk_buff *skb)
1063 {
1064         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1065
1066         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1067 }
1068
1069 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1070 {
1071         __u8 status = *((__u8 *) skb->data);
1072         bdaddr_t *sent;
1073
1074         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1075
1076         if (status)
1077                 return;
1078
1079         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1080         if (!sent)
1081                 return;
1082
1083         hci_dev_lock(hdev);
1084
1085         bacpy(&hdev->random_addr, sent);
1086
1087         hci_dev_unlock(hdev);
1088 }
1089
1090 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1091 {
1092         __u8 status = *((__u8 *) skb->data);
1093         struct hci_cp_le_set_default_phy *cp;
1094
1095         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1096
1097         if (status)
1098                 return;
1099
1100         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1101         if (!cp)
1102                 return;
1103
1104         hci_dev_lock(hdev);
1105
1106         hdev->le_tx_def_phys = cp->tx_phys;
1107         hdev->le_rx_def_phys = cp->rx_phys;
1108
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1113                                               struct sk_buff *skb)
1114 {
1115         __u8 status = *((__u8 *) skb->data);
1116         struct hci_cp_le_set_adv_set_rand_addr *cp;
1117         struct adv_info *adv_instance;
1118
1119         if (status)
1120                 return;
1121
1122         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1123         if (!cp)
1124                 return;
1125
1126         hci_dev_lock(hdev);
1127
1128         if (!hdev->cur_adv_instance) {
1129                 /* Store in hdev for instance 0 (Set adv and Directed advs) */
1130                 bacpy(&hdev->random_addr, &cp->bdaddr);
1131         } else {
1132                 adv_instance = hci_find_adv_instance(hdev,
1133                                                      hdev->cur_adv_instance);
1134                 if (adv_instance)
1135                         bacpy(&adv_instance->random_addr, &cp->bdaddr);
1136         }
1137
1138         hci_dev_unlock(hdev);
1139 }
1140
1141 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1142 {
1143         __u8 *sent, status = *((__u8 *) skb->data);
1144
1145         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1146
1147         if (status)
1148                 return;
1149
1150         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1151         if (!sent)
1152                 return;
1153
1154         hci_dev_lock(hdev);
1155
1156         /* If we're doing connection initiation as peripheral. Set a
1157          * timeout in case something goes wrong.
1158          */
1159         if (*sent) {
1160                 struct hci_conn *conn;
1161
1162                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1163
1164                 conn = hci_lookup_le_connect(hdev);
1165                 if (conn)
1166                         queue_delayed_work(hdev->workqueue,
1167                                            &conn->le_conn_timeout,
1168                                            conn->conn_timeout);
1169         } else {
1170                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1171         }
1172
1173         hci_dev_unlock(hdev);
1174 }
1175
1176 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1177                                          struct sk_buff *skb)
1178 {
1179         struct hci_cp_le_set_ext_adv_enable *cp;
1180         __u8 status = *((__u8 *) skb->data);
1181
1182         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1183
1184         if (status)
1185                 return;
1186
1187         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1188         if (!cp)
1189                 return;
1190
1191         hci_dev_lock(hdev);
1192
1193         if (cp->enable) {
1194                 struct hci_conn *conn;
1195
1196                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1197
1198                 conn = hci_lookup_le_connect(hdev);
1199                 if (conn)
1200                         queue_delayed_work(hdev->workqueue,
1201                                            &conn->le_conn_timeout,
1202                                            conn->conn_timeout);
1203         } else {
1204                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1205         }
1206
1207         hci_dev_unlock(hdev);
1208 }
1209
1210 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1211 {
1212         struct hci_cp_le_set_scan_param *cp;
1213         __u8 status = *((__u8 *) skb->data);
1214
1215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1216
1217         if (status)
1218                 return;
1219
1220         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1221         if (!cp)
1222                 return;
1223
1224         hci_dev_lock(hdev);
1225
1226         hdev->le_scan_type = cp->type;
1227
1228         hci_dev_unlock(hdev);
1229 }
1230
1231 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1232                                          struct sk_buff *skb)
1233 {
1234         struct hci_cp_le_set_ext_scan_params *cp;
1235         __u8 status = *((__u8 *) skb->data);
1236         struct hci_cp_le_scan_phy_params *phy_param;
1237
1238         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1239
1240         if (status)
1241                 return;
1242
1243         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1244         if (!cp)
1245                 return;
1246
1247         phy_param = (void *)cp->data;
1248
1249         hci_dev_lock(hdev);
1250
1251         hdev->le_scan_type = phy_param->type;
1252
1253         hci_dev_unlock(hdev);
1254 }
1255
1256 static bool has_pending_adv_report(struct hci_dev *hdev)
1257 {
1258         struct discovery_state *d = &hdev->discovery;
1259
1260         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1261 }
1262
1263 static void clear_pending_adv_report(struct hci_dev *hdev)
1264 {
1265         struct discovery_state *d = &hdev->discovery;
1266
1267         bacpy(&d->last_adv_addr, BDADDR_ANY);
1268         d->last_adv_data_len = 0;
1269 }
1270
1271 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1272                                      u8 bdaddr_type, s8 rssi, u32 flags,
1273                                      u8 *data, u8 len)
1274 {
1275         struct discovery_state *d = &hdev->discovery;
1276
1277         bacpy(&d->last_adv_addr, bdaddr);
1278         d->last_adv_addr_type = bdaddr_type;
1279         d->last_adv_rssi = rssi;
1280         d->last_adv_flags = flags;
1281         memcpy(d->last_adv_data, data, len);
1282         d->last_adv_data_len = len;
1283 }
1284
1285 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1286 {
1287         hci_dev_lock(hdev);
1288
1289         switch (enable) {
1290         case LE_SCAN_ENABLE:
1291                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1292                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1293                         clear_pending_adv_report(hdev);
1294                 break;
1295
1296         case LE_SCAN_DISABLE:
1297                 /* We do this here instead of when setting DISCOVERY_STOPPED
1298                  * since the latter would potentially require waiting for
1299                  * inquiry to stop too.
1300                  */
1301                 if (has_pending_adv_report(hdev)) {
1302                         struct discovery_state *d = &hdev->discovery;
1303
1304                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1305                                           d->last_adv_addr_type, NULL,
1306                                           d->last_adv_rssi, d->last_adv_flags,
1307                                           d->last_adv_data,
1308                                           d->last_adv_data_len, NULL, 0);
1309                 }
1310
1311                 /* Cancel this timer so that we don't try to disable scanning
1312                  * when it's already disabled.
1313                  */
1314                 cancel_delayed_work(&hdev->le_scan_disable);
1315
1316                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1317
1318                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1319                  * interrupted scanning due to a connect request. Mark
1320                  * therefore discovery as stopped. If this was not
1321                  * because of a connect request advertising might have
1322                  * been disabled because of active scanning, so
1323                  * re-enable it again if necessary.
1324                  */
1325                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1326 #ifndef TIZEN_BT /* The below line is kernel bug. */
1327                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1328 #else
1329                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1330 #endif
1331                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1332                          hdev->discovery.state == DISCOVERY_FINDING)
1333                         hci_req_reenable_advertising(hdev);
1334
1335                 break;
1336
1337         default:
1338                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1339                            enable);
1340                 break;
1341         }
1342
1343         hci_dev_unlock(hdev);
1344 }
1345
1346 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1347                                       struct sk_buff *skb)
1348 {
1349         struct hci_cp_le_set_scan_enable *cp;
1350         __u8 status = *((__u8 *) skb->data);
1351
1352         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1353
1354         if (status)
1355                 return;
1356
1357         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1358         if (!cp)
1359                 return;
1360
1361         le_set_scan_enable_complete(hdev, cp->enable);
1362 }
1363
1364 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1365                                       struct sk_buff *skb)
1366 {
1367         struct hci_cp_le_set_ext_scan_enable *cp;
1368         __u8 status = *((__u8 *) skb->data);
1369
1370         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1371
1372         if (status)
1373                 return;
1374
1375         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1376         if (!cp)
1377                 return;
1378
1379         le_set_scan_enable_complete(hdev, cp->enable);
1380 }
1381
1382 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1383                                       struct sk_buff *skb)
1384 {
1385         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1386
1387         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1388                rp->num_of_sets);
1389
1390         if (rp->status)
1391                 return;
1392
1393         hdev->le_num_of_adv_sets = rp->num_of_sets;
1394 }
1395
1396 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1397                                            struct sk_buff *skb)
1398 {
1399         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1400
1401         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1402
1403         if (rp->status)
1404                 return;
1405
1406         hdev->le_white_list_size = rp->size;
1407 }
1408
1409 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1410                                        struct sk_buff *skb)
1411 {
1412         __u8 status = *((__u8 *) skb->data);
1413
1414         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1415
1416         if (status)
1417                 return;
1418
1419         hci_bdaddr_list_clear(&hdev->le_white_list);
1420 }
1421
1422 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1423                                         struct sk_buff *skb)
1424 {
1425         struct hci_cp_le_add_to_white_list *sent;
1426         __u8 status = *((__u8 *) skb->data);
1427
1428         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1429
1430         if (status)
1431                 return;
1432
1433         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1434         if (!sent)
1435                 return;
1436
1437         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1438                            sent->bdaddr_type);
1439 }
1440
1441 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1442                                           struct sk_buff *skb)
1443 {
1444         struct hci_cp_le_del_from_white_list *sent;
1445         __u8 status = *((__u8 *) skb->data);
1446
1447         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1448
1449         if (status)
1450                 return;
1451
1452         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1453         if (!sent)
1454                 return;
1455
1456         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1457                             sent->bdaddr_type);
1458 }
1459
1460 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1461                                             struct sk_buff *skb)
1462 {
1463         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1464
1465         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1466
1467         if (rp->status)
1468                 return;
1469
1470         memcpy(hdev->le_states, rp->le_states, 8);
1471 }
1472
1473 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1474                                         struct sk_buff *skb)
1475 {
1476         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1477
1478         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1479
1480         if (rp->status)
1481                 return;
1482
1483         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1484         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1485 }
1486
1487 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1488                                          struct sk_buff *skb)
1489 {
1490         struct hci_cp_le_write_def_data_len *sent;
1491         __u8 status = *((__u8 *) skb->data);
1492
1493         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1494
1495         if (status)
1496                 return;
1497
1498         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1499         if (!sent)
1500                 return;
1501
1502         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1503         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1504 }
1505
1506 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1507                                          struct sk_buff *skb)
1508 {
1509         struct hci_cp_le_add_to_resolv_list *sent;
1510         __u8 status = *((__u8 *) skb->data);
1511
1512         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1513
1514         if (status)
1515                 return;
1516
1517         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1518         if (!sent)
1519                 return;
1520
1521         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1522                                 sent->bdaddr_type, sent->peer_irk,
1523                                 sent->local_irk);
1524 }
1525
1526 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1527                                           struct sk_buff *skb)
1528 {
1529         struct hci_cp_le_del_from_resolv_list *sent;
1530         __u8 status = *((__u8 *) skb->data);
1531
1532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1533
1534         if (status)
1535                 return;
1536
1537         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1538         if (!sent)
1539                 return;
1540
1541         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1542                             sent->bdaddr_type);
1543 }
1544
1545 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1546                                        struct sk_buff *skb)
1547 {
1548         __u8 status = *((__u8 *) skb->data);
1549
1550         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1551
1552         if (status)
1553                 return;
1554
1555         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1556 }
1557
1558 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1559                                            struct sk_buff *skb)
1560 {
1561         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1562
1563         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1564
1565         if (rp->status)
1566                 return;
1567
1568         hdev->le_resolv_list_size = rp->size;
1569 }
1570
1571 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1572                                                 struct sk_buff *skb)
1573 {
1574         __u8 *sent, status = *((__u8 *) skb->data);
1575
1576         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1577
1578         if (status)
1579                 return;
1580
1581         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1582         if (!sent)
1583                 return;
1584
1585         hci_dev_lock(hdev);
1586
1587         if (*sent)
1588                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1589         else
1590                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1591
1592         hci_dev_unlock(hdev);
1593 }
1594
1595 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1596                                         struct sk_buff *skb)
1597 {
1598         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1599
1600         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1601
1602         if (rp->status)
1603                 return;
1604
1605         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1606         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1607         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1608         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1609 }
1610
1611 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1612                                            struct sk_buff *skb)
1613 {
1614         struct hci_cp_write_le_host_supported *sent;
1615         __u8 status = *((__u8 *) skb->data);
1616
1617         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1618
1619         if (status)
1620                 return;
1621
1622         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1623         if (!sent)
1624                 return;
1625
1626         hci_dev_lock(hdev);
1627
1628         if (sent->le) {
1629                 hdev->features[1][0] |= LMP_HOST_LE;
1630                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1631         } else {
1632                 hdev->features[1][0] &= ~LMP_HOST_LE;
1633                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1634                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1635         }
1636
1637         if (sent->simul)
1638                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1639         else
1640                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1641
1642         hci_dev_unlock(hdev);
1643 }
1644
1645 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1646 {
1647         struct hci_cp_le_set_adv_param *cp;
1648         u8 status = *((u8 *) skb->data);
1649
1650         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1651
1652         if (status)
1653                 return;
1654
1655         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1656         if (!cp)
1657                 return;
1658
1659         hci_dev_lock(hdev);
1660         hdev->adv_addr_type = cp->own_address_type;
1661         hci_dev_unlock(hdev);
1662 }
1663
1664 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1665 {
1666         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1667         struct hci_cp_le_set_ext_adv_params *cp;
1668         struct adv_info *adv_instance;
1669
1670         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1671
1672         if (rp->status)
1673                 return;
1674
1675         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1676         if (!cp)
1677                 return;
1678
1679         hci_dev_lock(hdev);
1680         hdev->adv_addr_type = cp->own_addr_type;
1681         if (!hdev->cur_adv_instance) {
1682                 /* Store in hdev for instance 0 */
1683                 hdev->adv_tx_power = rp->tx_power;
1684         } else {
1685                 adv_instance = hci_find_adv_instance(hdev,
1686                                                      hdev->cur_adv_instance);
1687                 if (adv_instance)
1688                         adv_instance->tx_power = rp->tx_power;
1689         }
1690         /* Update adv data as tx power is known now */
1691         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1692         hci_dev_unlock(hdev);
1693 }
1694
1695 #ifdef TIZEN_BT
1696 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1697                                           struct sk_buff *skb)
1698 {
1699         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1700
1701         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1702                hdev->name, rp->status, rp->le_ext_opcode);
1703
1704         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1705 }
1706
1707 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1708                                           struct sk_buff *skb)
1709 {
1710         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1711
1712         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1713                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1714
1715         mgmt_raw_rssi_response(hdev, rp, rp->status);
1716 }
1717 #endif
1718
1719 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1720 {
1721         struct hci_rp_read_rssi *rp = (void *) skb->data;
1722         struct hci_conn *conn;
1723
1724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1725
1726         if (rp->status)
1727                 return;
1728
1729         hci_dev_lock(hdev);
1730
1731         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1732         if (conn)
1733                 conn->rssi = rp->rssi;
1734
1735         hci_dev_unlock(hdev);
1736 }
1737
1738 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1739 {
1740         struct hci_cp_read_tx_power *sent;
1741         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1742         struct hci_conn *conn;
1743
1744         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1745
1746         if (rp->status)
1747                 return;
1748
1749         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1750         if (!sent)
1751                 return;
1752
1753         hci_dev_lock(hdev);
1754
1755         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1756         if (!conn)
1757                 goto unlock;
1758
1759         switch (sent->type) {
1760         case 0x00:
1761                 conn->tx_power = rp->tx_power;
1762                 break;
1763         case 0x01:
1764                 conn->max_tx_power = rp->tx_power;
1765                 break;
1766         }
1767
1768 unlock:
1769         hci_dev_unlock(hdev);
1770 }
1771
1772 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1773 {
1774         u8 status = *((u8 *) skb->data);
1775         u8 *mode;
1776
1777         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1778
1779         if (status)
1780                 return;
1781
1782         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1783         if (mode)
1784                 hdev->ssp_debug_mode = *mode;
1785 }
1786
1787 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1788 {
1789         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1790
1791         if (status) {
1792                 hci_conn_check_pending(hdev);
1793                 return;
1794         }
1795
1796         set_bit(HCI_INQUIRY, &hdev->flags);
1797 }
1798
1799 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1800 {
1801         struct hci_cp_create_conn *cp;
1802         struct hci_conn *conn;
1803
1804         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1805
1806         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1807         if (!cp)
1808                 return;
1809
1810         hci_dev_lock(hdev);
1811
1812         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1813
1814         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1815
1816         if (status) {
1817                 if (conn && conn->state == BT_CONNECT) {
1818                         if (status != 0x0c || conn->attempt > 2) {
1819                                 conn->state = BT_CLOSED;
1820                                 hci_connect_cfm(conn, status);
1821                                 hci_conn_del(conn);
1822                         } else
1823                                 conn->state = BT_CONNECT2;
1824                 }
1825         } else {
1826                 if (!conn) {
1827                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1828                                             HCI_ROLE_MASTER);
1829                         if (!conn)
1830                                 bt_dev_err(hdev, "no memory for new connection");
1831                 }
1832         }
1833
1834         hci_dev_unlock(hdev);
1835 }
1836
1837 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1838 {
1839         struct hci_cp_add_sco *cp;
1840         struct hci_conn *acl, *sco;
1841         __u16 handle;
1842
1843         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1844
1845         if (!status)
1846                 return;
1847
1848         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1849         if (!cp)
1850                 return;
1851
1852         handle = __le16_to_cpu(cp->handle);
1853
1854         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1855
1856         hci_dev_lock(hdev);
1857
1858         acl = hci_conn_hash_lookup_handle(hdev, handle);
1859         if (acl) {
1860                 sco = acl->link;
1861                 if (sco) {
1862                         sco->state = BT_CLOSED;
1863
1864                         hci_connect_cfm(sco, status);
1865                         hci_conn_del(sco);
1866                 }
1867         }
1868
1869         hci_dev_unlock(hdev);
1870 }
1871
1872 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1873 {
1874         struct hci_cp_auth_requested *cp;
1875         struct hci_conn *conn;
1876
1877         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1878
1879         if (!status)
1880                 return;
1881
1882         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1883         if (!cp)
1884                 return;
1885
1886         hci_dev_lock(hdev);
1887
1888         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1889         if (conn) {
1890                 if (conn->state == BT_CONFIG) {
1891                         hci_connect_cfm(conn, status);
1892                         hci_conn_drop(conn);
1893                 }
1894         }
1895
1896         hci_dev_unlock(hdev);
1897 }
1898
1899 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1900 {
1901         struct hci_cp_set_conn_encrypt *cp;
1902         struct hci_conn *conn;
1903
1904         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1905
1906         if (!status)
1907                 return;
1908
1909         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1910         if (!cp)
1911                 return;
1912
1913         hci_dev_lock(hdev);
1914
1915         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1916         if (conn) {
1917                 if (conn->state == BT_CONFIG) {
1918                         hci_connect_cfm(conn, status);
1919                         hci_conn_drop(conn);
1920                 }
1921         }
1922
1923         hci_dev_unlock(hdev);
1924 }
1925
1926 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1927                                     struct hci_conn *conn)
1928 {
1929         if (conn->state != BT_CONFIG || !conn->out)
1930                 return 0;
1931
1932         if (conn->pending_sec_level == BT_SECURITY_SDP)
1933                 return 0;
1934
1935         /* Only request authentication for SSP connections or non-SSP
1936          * devices with sec_level MEDIUM or HIGH or if MITM protection
1937          * is requested.
1938          */
1939         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1940             conn->pending_sec_level != BT_SECURITY_FIPS &&
1941             conn->pending_sec_level != BT_SECURITY_HIGH &&
1942             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1943                 return 0;
1944
1945         return 1;
1946 }
1947
1948 static int hci_resolve_name(struct hci_dev *hdev,
1949                                    struct inquiry_entry *e)
1950 {
1951         struct hci_cp_remote_name_req cp;
1952
1953         memset(&cp, 0, sizeof(cp));
1954
1955         bacpy(&cp.bdaddr, &e->data.bdaddr);
1956         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1957         cp.pscan_mode = e->data.pscan_mode;
1958         cp.clock_offset = e->data.clock_offset;
1959
1960         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1961 }
1962
1963 static bool hci_resolve_next_name(struct hci_dev *hdev)
1964 {
1965         struct discovery_state *discov = &hdev->discovery;
1966         struct inquiry_entry *e;
1967
1968         if (list_empty(&discov->resolve))
1969                 return false;
1970
1971         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1972         if (!e)
1973                 return false;
1974
1975         if (hci_resolve_name(hdev, e) == 0) {
1976                 e->name_state = NAME_PENDING;
1977                 return true;
1978         }
1979
1980         return false;
1981 }
1982
1983 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1984                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1985 {
1986         struct discovery_state *discov = &hdev->discovery;
1987         struct inquiry_entry *e;
1988
1989 #ifdef TIZEN_BT
1990         /* Update the mgmt connected state if necessary. Be careful with
1991          * conn objects that exist but are not (yet) connected however.
1992          * Only those in BT_CONFIG or BT_CONNECTED states can be
1993          * considered connected.
1994          */
1995         if (conn &&
1996             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1997                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1998                         mgmt_device_connected(hdev, conn, 0, name, name_len);
1999                 else
2000                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2001         }
2002 #else
2003         if (conn &&
2004             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2005             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2006                 mgmt_device_connected(hdev, conn, 0, name, name_len);
2007 #endif
2008
2009         if (discov->state == DISCOVERY_STOPPED)
2010                 return;
2011
2012         if (discov->state == DISCOVERY_STOPPING)
2013                 goto discov_complete;
2014
2015         if (discov->state != DISCOVERY_RESOLVING)
2016                 return;
2017
2018         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2019         /* If the device was not found in a list of found devices names of which
2020          * are pending. there is no need to continue resolving a next name as it
2021          * will be done upon receiving another Remote Name Request Complete
2022          * Event */
2023         if (!e)
2024                 return;
2025
2026         list_del(&e->list);
2027         if (name) {
2028                 e->name_state = NAME_KNOWN;
2029                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2030                                  e->data.rssi, name, name_len);
2031         } else {
2032                 e->name_state = NAME_NOT_KNOWN;
2033         }
2034
2035         if (hci_resolve_next_name(hdev))
2036                 return;
2037
2038 discov_complete:
2039         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2040 }
2041
2042 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2043 {
2044         struct hci_cp_remote_name_req *cp;
2045         struct hci_conn *conn;
2046
2047         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2048
2049         /* If successful wait for the name req complete event before
2050          * checking for the need to do authentication */
2051         if (!status)
2052                 return;
2053
2054         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2055         if (!cp)
2056                 return;
2057
2058         hci_dev_lock(hdev);
2059
2060         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2061
2062         if (hci_dev_test_flag(hdev, HCI_MGMT))
2063                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2064
2065         if (!conn)
2066                 goto unlock;
2067
2068         if (!hci_outgoing_auth_needed(hdev, conn))
2069                 goto unlock;
2070
2071         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2072                 struct hci_cp_auth_requested auth_cp;
2073
2074                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2075
2076                 auth_cp.handle = __cpu_to_le16(conn->handle);
2077                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2078                              sizeof(auth_cp), &auth_cp);
2079         }
2080
2081 unlock:
2082         hci_dev_unlock(hdev);
2083 }
2084
2085 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2086 {
2087         struct hci_cp_read_remote_features *cp;
2088         struct hci_conn *conn;
2089
2090         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2091
2092         if (!status)
2093                 return;
2094
2095         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2096         if (!cp)
2097                 return;
2098
2099         hci_dev_lock(hdev);
2100
2101         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2102         if (conn) {
2103                 if (conn->state == BT_CONFIG) {
2104                         hci_connect_cfm(conn, status);
2105                         hci_conn_drop(conn);
2106                 }
2107         }
2108
2109         hci_dev_unlock(hdev);
2110 }
2111
2112 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2113 {
2114         struct hci_cp_read_remote_ext_features *cp;
2115         struct hci_conn *conn;
2116
2117         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2118
2119         if (!status)
2120                 return;
2121
2122         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2123         if (!cp)
2124                 return;
2125
2126         hci_dev_lock(hdev);
2127
2128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2129         if (conn) {
2130                 if (conn->state == BT_CONFIG) {
2131                         hci_connect_cfm(conn, status);
2132                         hci_conn_drop(conn);
2133                 }
2134         }
2135
2136         hci_dev_unlock(hdev);
2137 }
2138
2139 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2140 {
2141         struct hci_cp_setup_sync_conn *cp;
2142         struct hci_conn *acl, *sco;
2143         __u16 handle;
2144
2145         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2146
2147         if (!status)
2148                 return;
2149
2150         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2151         if (!cp)
2152                 return;
2153
2154         handle = __le16_to_cpu(cp->handle);
2155
2156         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2157
2158         hci_dev_lock(hdev);
2159
2160         acl = hci_conn_hash_lookup_handle(hdev, handle);
2161         if (acl) {
2162                 sco = acl->link;
2163                 if (sco) {
2164                         sco->state = BT_CLOSED;
2165
2166                         hci_connect_cfm(sco, status);
2167                         hci_conn_del(sco);
2168                 }
2169         }
2170
2171         hci_dev_unlock(hdev);
2172 }
2173
2174 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2175 {
2176         struct hci_cp_sniff_mode *cp;
2177         struct hci_conn *conn;
2178
2179         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2180
2181         if (!status)
2182                 return;
2183
2184         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2185         if (!cp)
2186                 return;
2187
2188         hci_dev_lock(hdev);
2189
2190         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2191         if (conn) {
2192                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2193
2194                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2195                         hci_sco_setup(conn, status);
2196         }
2197
2198         hci_dev_unlock(hdev);
2199 }
2200
2201 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2202 {
2203         struct hci_cp_exit_sniff_mode *cp;
2204         struct hci_conn *conn;
2205
2206         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2207
2208         if (!status)
2209                 return;
2210
2211         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2212         if (!cp)
2213                 return;
2214
2215         hci_dev_lock(hdev);
2216
2217         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2218         if (conn) {
2219                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2220
2221                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2222                         hci_sco_setup(conn, status);
2223         }
2224
2225         hci_dev_unlock(hdev);
2226 }
2227
2228 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2229 {
2230         struct hci_cp_disconnect *cp;
2231         struct hci_conn *conn;
2232
2233         if (!status)
2234                 return;
2235
2236         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2237         if (!cp)
2238                 return;
2239
2240         hci_dev_lock(hdev);
2241
2242         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2243         if (conn)
2244                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2245                                        conn->dst_type, status);
2246
2247         hci_dev_unlock(hdev);
2248 }
2249
2250 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2251                               u8 peer_addr_type, u8 own_address_type,
2252                               u8 filter_policy)
2253 {
2254         struct hci_conn *conn;
2255
2256         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2257                                        peer_addr_type);
2258         if (!conn)
2259                 return;
2260
2261         /* Store the initiator and responder address information which
2262          * is needed for SMP. These values will not change during the
2263          * lifetime of the connection.
2264          */
2265         conn->init_addr_type = own_address_type;
2266         if (own_address_type == ADDR_LE_DEV_RANDOM)
2267                 bacpy(&conn->init_addr, &hdev->random_addr);
2268         else
2269                 bacpy(&conn->init_addr, &hdev->bdaddr);
2270
2271         conn->resp_addr_type = peer_addr_type;
2272         bacpy(&conn->resp_addr, peer_addr);
2273
2274         /* We don't want the connection attempt to stick around
2275          * indefinitely since LE doesn't have a page timeout concept
2276          * like BR/EDR. Set a timer for any connection that doesn't use
2277          * the white list for connecting.
2278          */
2279         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2280                 queue_delayed_work(conn->hdev->workqueue,
2281                                    &conn->le_conn_timeout,
2282                                    conn->conn_timeout);
2283 }
2284
2285 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2286 {
2287         struct hci_cp_le_create_conn *cp;
2288
2289         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2290
2291         /* All connection failure handling is taken care of by the
2292          * hci_le_conn_failed function which is triggered by the HCI
2293          * request completion callbacks used for connecting.
2294          */
2295         if (status)
2296                 return;
2297
2298         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2299         if (!cp)
2300                 return;
2301
2302         hci_dev_lock(hdev);
2303
2304         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2305                           cp->own_address_type, cp->filter_policy);
2306
2307         hci_dev_unlock(hdev);
2308 }
2309
2310 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2311 {
2312         struct hci_cp_le_ext_create_conn *cp;
2313
2314         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2315
2316         /* All connection failure handling is taken care of by the
2317          * hci_le_conn_failed function which is triggered by the HCI
2318          * request completion callbacks used for connecting.
2319          */
2320         if (status)
2321                 return;
2322
2323         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2324         if (!cp)
2325                 return;
2326
2327         hci_dev_lock(hdev);
2328
2329         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2330                           cp->own_addr_type, cp->filter_policy);
2331
2332         hci_dev_unlock(hdev);
2333 }
2334
2335 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2336 {
2337         struct hci_cp_le_read_remote_features *cp;
2338         struct hci_conn *conn;
2339
2340         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2341
2342         if (!status)
2343                 return;
2344
2345         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2346         if (!cp)
2347                 return;
2348
2349         hci_dev_lock(hdev);
2350
2351         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2352         if (conn) {
2353                 if (conn->state == BT_CONFIG) {
2354                         hci_connect_cfm(conn, status);
2355                         hci_conn_drop(conn);
2356                 }
2357         }
2358
2359         hci_dev_unlock(hdev);
2360 }
2361
2362 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2363 {
2364         struct hci_cp_le_start_enc *cp;
2365         struct hci_conn *conn;
2366
2367         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2368
2369         if (!status)
2370                 return;
2371
2372         hci_dev_lock(hdev);
2373
2374         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2375         if (!cp)
2376                 goto unlock;
2377
2378         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2379         if (!conn)
2380                 goto unlock;
2381
2382         if (conn->state != BT_CONNECTED)
2383                 goto unlock;
2384
2385         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2386         hci_conn_drop(conn);
2387
2388 unlock:
2389         hci_dev_unlock(hdev);
2390 }
2391
2392 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2393 {
2394         struct hci_cp_switch_role *cp;
2395         struct hci_conn *conn;
2396
2397         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2398
2399         if (!status)
2400                 return;
2401
2402         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2403         if (!cp)
2404                 return;
2405
2406         hci_dev_lock(hdev);
2407
2408         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2409         if (conn)
2410                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2411
2412         hci_dev_unlock(hdev);
2413 }
2414
2415 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2416 {
2417         __u8 status = *((__u8 *) skb->data);
2418         struct discovery_state *discov = &hdev->discovery;
2419         struct inquiry_entry *e;
2420
2421         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2422
2423         hci_conn_check_pending(hdev);
2424
2425         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2426                 return;
2427
2428         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2429         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2430
2431         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2432                 return;
2433
2434         hci_dev_lock(hdev);
2435
2436         if (discov->state != DISCOVERY_FINDING)
2437                 goto unlock;
2438
2439         if (list_empty(&discov->resolve)) {
2440                 /* When BR/EDR inquiry is active and no LE scanning is in
2441                  * progress, then change discovery state to indicate completion.
2442                  *
2443                  * When running LE scanning and BR/EDR inquiry simultaneously
2444                  * and the LE scan already finished, then change the discovery
2445                  * state to indicate completion.
2446                  */
2447                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2448                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2449                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2450                 goto unlock;
2451         }
2452
2453         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2454         if (e && hci_resolve_name(hdev, e) == 0) {
2455                 e->name_state = NAME_PENDING;
2456                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2457         } else {
2458                 /* When BR/EDR inquiry is active and no LE scanning is in
2459                  * progress, then change discovery state to indicate completion.
2460                  *
2461                  * When running LE scanning and BR/EDR inquiry simultaneously
2462                  * and the LE scan already finished, then change the discovery
2463                  * state to indicate completion.
2464                  */
2465                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2466                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2467                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2468         }
2469
2470 unlock:
2471         hci_dev_unlock(hdev);
2472 }
2473
2474 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2475 {
2476         struct inquiry_data data;
2477         struct inquiry_info *info = (void *) (skb->data + 1);
2478         int num_rsp = *((__u8 *) skb->data);
2479
2480         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2481
2482         if (!num_rsp)
2483                 return;
2484
2485         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2486                 return;
2487
2488         hci_dev_lock(hdev);
2489
2490         for (; num_rsp; num_rsp--, info++) {
2491                 u32 flags;
2492
2493                 bacpy(&data.bdaddr, &info->bdaddr);
2494                 data.pscan_rep_mode     = info->pscan_rep_mode;
2495                 data.pscan_period_mode  = info->pscan_period_mode;
2496                 data.pscan_mode         = info->pscan_mode;
2497                 memcpy(data.dev_class, info->dev_class, 3);
2498                 data.clock_offset       = info->clock_offset;
2499                 data.rssi               = HCI_RSSI_INVALID;
2500                 data.ssp_mode           = 0x00;
2501
2502                 flags = hci_inquiry_cache_update(hdev, &data, false);
2503
2504                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2505                                   info->dev_class, HCI_RSSI_INVALID,
2506                                   flags, NULL, 0, NULL, 0);
2507         }
2508
2509         hci_dev_unlock(hdev);
2510 }
2511
2512 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2513 {
2514         struct hci_ev_conn_complete *ev = (void *) skb->data;
2515         struct hci_conn *conn;
2516
2517         BT_DBG("%s", hdev->name);
2518
2519         hci_dev_lock(hdev);
2520
2521         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2522         if (!conn) {
2523                 if (ev->link_type != SCO_LINK)
2524                         goto unlock;
2525
2526                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2527                 if (!conn)
2528                         goto unlock;
2529
2530                 conn->type = SCO_LINK;
2531         }
2532
2533         if (!ev->status) {
2534                 conn->handle = __le16_to_cpu(ev->handle);
2535
2536                 if (conn->type == ACL_LINK) {
2537                         conn->state = BT_CONFIG;
2538                         hci_conn_hold(conn);
2539
2540                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2541                             !hci_find_link_key(hdev, &ev->bdaddr))
2542                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2543                         else
2544                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2545                 } else
2546                         conn->state = BT_CONNECTED;
2547
2548                 hci_debugfs_create_conn(conn);
2549                 hci_conn_add_sysfs(conn);
2550
2551                 if (test_bit(HCI_AUTH, &hdev->flags))
2552                         set_bit(HCI_CONN_AUTH, &conn->flags);
2553
2554                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2555                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2556
2557                 /* Get remote features */
2558                 if (conn->type == ACL_LINK) {
2559                         struct hci_cp_read_remote_features cp;
2560                         cp.handle = ev->handle;
2561                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2562                                      sizeof(cp), &cp);
2563
2564                         hci_req_update_scan(hdev);
2565                 }
2566
2567                 /* Set packet type for incoming connection */
2568                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2569                         struct hci_cp_change_conn_ptype cp;
2570                         cp.handle = ev->handle;
2571                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2572                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2573                                      &cp);
2574                 }
2575         } else {
2576                 conn->state = BT_CLOSED;
2577                 if (conn->type == ACL_LINK)
2578                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2579                                             conn->dst_type, ev->status);
2580         }
2581
2582         if (conn->type == ACL_LINK)
2583                 hci_sco_setup(conn, ev->status);
2584
2585         if (ev->status) {
2586                 hci_connect_cfm(conn, ev->status);
2587                 hci_conn_del(conn);
2588         } else if (ev->link_type != ACL_LINK)
2589                 hci_connect_cfm(conn, ev->status);
2590
2591 unlock:
2592         hci_dev_unlock(hdev);
2593
2594         hci_conn_check_pending(hdev);
2595 }
2596
2597 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2598 {
2599         struct hci_cp_reject_conn_req cp;
2600
2601         bacpy(&cp.bdaddr, bdaddr);
2602         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2603         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2604 }
2605
2606 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2607 {
2608         struct hci_ev_conn_request *ev = (void *) skb->data;
2609         int mask = hdev->link_mode;
2610         struct inquiry_entry *ie;
2611         struct hci_conn *conn;
2612         __u8 flags = 0;
2613
2614         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2615                ev->link_type);
2616
2617         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2618                                       &flags);
2619
2620         if (!(mask & HCI_LM_ACCEPT)) {
2621                 hci_reject_conn(hdev, &ev->bdaddr);
2622                 return;
2623         }
2624
2625         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2626                                    BDADDR_BREDR)) {
2627                 hci_reject_conn(hdev, &ev->bdaddr);
2628                 return;
2629         }
2630
2631         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2632          * connection. These features are only touched through mgmt so
2633          * only do the checks if HCI_MGMT is set.
2634          */
2635         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2636             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2637             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2638                                     BDADDR_BREDR)) {
2639                     hci_reject_conn(hdev, &ev->bdaddr);
2640                     return;
2641         }
2642
2643         /* Connection accepted */
2644
2645         hci_dev_lock(hdev);
2646
2647         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2648         if (ie)
2649                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2650
2651         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2652                         &ev->bdaddr);
2653         if (!conn) {
2654                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2655                                     HCI_ROLE_SLAVE);
2656                 if (!conn) {
2657                         bt_dev_err(hdev, "no memory for new connection");
2658                         hci_dev_unlock(hdev);
2659                         return;
2660                 }
2661         }
2662
2663         memcpy(conn->dev_class, ev->dev_class, 3);
2664
2665         hci_dev_unlock(hdev);
2666
2667         if (ev->link_type == ACL_LINK ||
2668             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2669                 struct hci_cp_accept_conn_req cp;
2670                 conn->state = BT_CONNECT;
2671
2672                 bacpy(&cp.bdaddr, &ev->bdaddr);
2673
2674                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2675                         cp.role = 0x00; /* Become master */
2676                 else
2677                         cp.role = 0x01; /* Remain slave */
2678
2679                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2680         } else if (!(flags & HCI_PROTO_DEFER)) {
2681                 struct hci_cp_accept_sync_conn_req cp;
2682                 conn->state = BT_CONNECT;
2683
2684                 bacpy(&cp.bdaddr, &ev->bdaddr);
2685                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2686
2687                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2688                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2689                 cp.max_latency    = cpu_to_le16(0xffff);
2690                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2691                 cp.retrans_effort = 0xff;
2692
2693                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2694                              &cp);
2695         } else {
2696                 conn->state = BT_CONNECT2;
2697                 hci_connect_cfm(conn, 0);
2698         }
2699 }
2700
2701 static u8 hci_to_mgmt_reason(u8 err)
2702 {
2703         switch (err) {
2704         case HCI_ERROR_CONNECTION_TIMEOUT:
2705                 return MGMT_DEV_DISCONN_TIMEOUT;
2706         case HCI_ERROR_REMOTE_USER_TERM:
2707         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2708         case HCI_ERROR_REMOTE_POWER_OFF:
2709                 return MGMT_DEV_DISCONN_REMOTE;
2710         case HCI_ERROR_LOCAL_HOST_TERM:
2711                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2712         default:
2713                 return MGMT_DEV_DISCONN_UNKNOWN;
2714         }
2715 }
2716
2717 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2718 {
2719         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2720         u8 reason;
2721         struct hci_conn_params *params;
2722         struct hci_conn *conn;
2723         bool mgmt_connected;
2724         u8 type;
2725
2726         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2727
2728         hci_dev_lock(hdev);
2729
2730         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2731         if (!conn)
2732                 goto unlock;
2733
2734         if (ev->status) {
2735                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2736                                        conn->dst_type, ev->status);
2737                 goto unlock;
2738         }
2739
2740         conn->state = BT_CLOSED;
2741
2742         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2743
2744         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2745                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2746         else
2747                 reason = hci_to_mgmt_reason(ev->reason);
2748
2749         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2750                                 reason, mgmt_connected);
2751
2752         if (conn->type == ACL_LINK) {
2753                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2754                         hci_remove_link_key(hdev, &conn->dst);
2755
2756                 hci_req_update_scan(hdev);
2757         }
2758
2759         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2760         if (params) {
2761                 switch (params->auto_connect) {
2762                 case HCI_AUTO_CONN_LINK_LOSS:
2763                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2764                                 break;
2765                         /* Fall through */
2766
2767                 case HCI_AUTO_CONN_DIRECT:
2768                 case HCI_AUTO_CONN_ALWAYS:
2769                         list_del_init(&params->action);
2770                         list_add(&params->action, &hdev->pend_le_conns);
2771                         hci_update_background_scan(hdev);
2772                         break;
2773
2774                 default:
2775                         break;
2776                 }
2777         }
2778
2779         type = conn->type;
2780
2781         hci_disconn_cfm(conn, ev->reason);
2782         hci_conn_del(conn);
2783
2784         /* Re-enable advertising if necessary, since it might
2785          * have been disabled by the connection. From the
2786          * HCI_LE_Set_Advertise_Enable command description in
2787          * the core specification (v4.0):
2788          * "The Controller shall continue advertising until the Host
2789          * issues an LE_Set_Advertise_Enable command with
2790          * Advertising_Enable set to 0x00 (Advertising is disabled)
2791          * or until a connection is created or until the Advertising
2792          * is timed out due to Directed Advertising."
2793          */
2794         if (type == LE_LINK)
2795                 hci_req_reenable_advertising(hdev);
2796
2797 unlock:
2798         hci_dev_unlock(hdev);
2799 }
2800
2801 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2802 {
2803         struct hci_ev_auth_complete *ev = (void *) skb->data;
2804         struct hci_conn *conn;
2805
2806         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2807
2808         hci_dev_lock(hdev);
2809
2810         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2811         if (!conn)
2812                 goto unlock;
2813
2814         if (!ev->status) {
2815                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2816
2817                 if (!hci_conn_ssp_enabled(conn) &&
2818                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2819                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
2820                 } else {
2821                         set_bit(HCI_CONN_AUTH, &conn->flags);
2822                         conn->sec_level = conn->pending_sec_level;
2823                 }
2824         } else {
2825                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
2826                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
2827
2828                 mgmt_auth_failed(conn, ev->status);
2829         }
2830
2831         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2832         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2833
2834         if (conn->state == BT_CONFIG) {
2835                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2836                         struct hci_cp_set_conn_encrypt cp;
2837                         cp.handle  = ev->handle;
2838                         cp.encrypt = 0x01;
2839                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2840                                      &cp);
2841                 } else {
2842                         conn->state = BT_CONNECTED;
2843                         hci_connect_cfm(conn, ev->status);
2844                         hci_conn_drop(conn);
2845                 }
2846         } else {
2847                 hci_auth_cfm(conn, ev->status);
2848
2849                 hci_conn_hold(conn);
2850                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2851                 hci_conn_drop(conn);
2852         }
2853
2854         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2855                 if (!ev->status) {
2856                         struct hci_cp_set_conn_encrypt cp;
2857                         cp.handle  = ev->handle;
2858                         cp.encrypt = 0x01;
2859                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2860                                      &cp);
2861                 } else {
2862                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2863                         hci_encrypt_cfm(conn, ev->status, 0x00);
2864                 }
2865         }
2866
2867 unlock:
2868         hci_dev_unlock(hdev);
2869 }
2870
2871 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2872 {
2873         struct hci_ev_remote_name *ev = (void *) skb->data;
2874         struct hci_conn *conn;
2875
2876         BT_DBG("%s", hdev->name);
2877
2878         hci_conn_check_pending(hdev);
2879
2880         hci_dev_lock(hdev);
2881
2882         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2883
2884         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2885                 goto check_auth;
2886
2887         if (ev->status == 0)
2888                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2889                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2890         else
2891                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2892
2893 check_auth:
2894         if (!conn)
2895                 goto unlock;
2896
2897         if (!hci_outgoing_auth_needed(hdev, conn))
2898                 goto unlock;
2899
2900         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2901                 struct hci_cp_auth_requested cp;
2902
2903                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2904
2905                 cp.handle = __cpu_to_le16(conn->handle);
2906                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2907         }
2908
2909 unlock:
2910         hci_dev_unlock(hdev);
2911 }
2912
2913 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
2914                                        u16 opcode, struct sk_buff *skb)
2915 {
2916         const struct hci_rp_read_enc_key_size *rp;
2917         struct hci_conn *conn;
2918         u16 handle;
2919
2920         BT_DBG("%s status 0x%02x", hdev->name, status);
2921
2922         if (!skb || skb->len < sizeof(*rp)) {
2923                 bt_dev_err(hdev, "invalid read key size response");
2924                 return;
2925         }
2926
2927         rp = (void *)skb->data;
2928         handle = le16_to_cpu(rp->handle);
2929
2930         hci_dev_lock(hdev);
2931
2932         conn = hci_conn_hash_lookup_handle(hdev, handle);
2933         if (!conn)
2934                 goto unlock;
2935
2936         /* If we fail to read the encryption key size, assume maximum
2937          * (which is the same we do also when this HCI command isn't
2938          * supported.
2939          */
2940         if (rp->status) {
2941                 bt_dev_err(hdev, "failed to read key size for handle %u",
2942                            handle);
2943                 conn->enc_key_size = HCI_LINK_KEY_SIZE;
2944         } else {
2945                 conn->enc_key_size = rp->key_size;
2946         }
2947
2948         if (conn->state == BT_CONFIG) {
2949                 conn->state = BT_CONNECTED;
2950                 hci_connect_cfm(conn, 0);
2951                 hci_conn_drop(conn);
2952         } else {
2953                 u8 encrypt;
2954
2955                 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
2956                         encrypt = 0x00;
2957                 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags))
2958                         encrypt = 0x02;
2959                 else
2960                         encrypt = 0x01;
2961
2962                 hci_encrypt_cfm(conn, 0, encrypt);
2963         }
2964
2965 unlock:
2966         hci_dev_unlock(hdev);
2967 }
2968
2969 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2970 {
2971         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2972         struct hci_conn *conn;
2973
2974         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2975
2976         hci_dev_lock(hdev);
2977
2978         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2979         if (!conn)
2980                 goto unlock;
2981
2982         if (!ev->status) {
2983                 if (ev->encrypt) {
2984                         /* Encryption implies authentication */
2985                         set_bit(HCI_CONN_AUTH, &conn->flags);
2986                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2987                         conn->sec_level = conn->pending_sec_level;
2988
2989                         /* P-256 authentication key implies FIPS */
2990                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2991                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2992
2993                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2994                             conn->type == LE_LINK)
2995                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2996                 } else {
2997                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2998                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2999                 }
3000         }
3001
3002         /* We should disregard the current RPA and generate a new one
3003          * whenever the encryption procedure fails.
3004          */
3005         if (ev->status && conn->type == LE_LINK) {
3006                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3007                 hci_adv_instances_set_rpa_expired(hdev, true);
3008         }
3009
3010         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3011
3012         if (ev->status && conn->state == BT_CONNECTED) {
3013                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3014                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3015
3016                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3017                 hci_conn_drop(conn);
3018                 goto unlock;
3019         }
3020
3021         /* In Secure Connections Only mode, do not allow any connections
3022          * that are not encrypted with AES-CCM using a P-256 authenticated
3023          * combination key.
3024          */
3025         if (hci_dev_test_flag(hdev, HCI_SC_ONLY) &&
3026             (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
3027              conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
3028                 hci_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
3029                 hci_conn_drop(conn);
3030                 goto unlock;
3031         }
3032
3033         /* Try reading the encryption key size for encrypted ACL links */
3034         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3035                 struct hci_cp_read_enc_key_size cp;
3036                 struct hci_request req;
3037
3038                 /* Only send HCI_Read_Encryption_Key_Size if the
3039                  * controller really supports it. If it doesn't, assume
3040                  * the default size (16).
3041                  */
3042                 if (!(hdev->commands[20] & 0x10)) {
3043                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3044                         goto notify;
3045                 }
3046
3047                 hci_req_init(&req, hdev);
3048
3049                 cp.handle = cpu_to_le16(conn->handle);
3050                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3051
3052                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3053                         bt_dev_err(hdev, "sending read key size failed");
3054                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3055                         goto notify;
3056                 }
3057
3058                 goto unlock;
3059         }
3060
3061         /* Set the default Authenticated Payload Timeout after
3062          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3063          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3064          * sent when the link is active and Encryption is enabled, the conn
3065          * type can be either LE or ACL and controller must support LMP Ping.
3066          * Ensure for AES-CCM encryption as well.
3067          */
3068         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3069             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3070             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3071              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3072                 struct hci_cp_write_auth_payload_to cp;
3073
3074                 cp.handle = cpu_to_le16(conn->handle);
3075                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3076                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3077                              sizeof(cp), &cp);
3078         }
3079
3080 notify:
3081         if (conn->state == BT_CONFIG) {
3082                 if (!ev->status)
3083                         conn->state = BT_CONNECTED;
3084
3085                 hci_connect_cfm(conn, ev->status);
3086                 hci_conn_drop(conn);
3087         } else
3088                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
3089
3090 unlock:
3091         hci_dev_unlock(hdev);
3092 }
3093
3094 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3095                                              struct sk_buff *skb)
3096 {
3097         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3098         struct hci_conn *conn;
3099
3100         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3101
3102         hci_dev_lock(hdev);
3103
3104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3105         if (conn) {
3106                 if (!ev->status)
3107                         set_bit(HCI_CONN_SECURE, &conn->flags);
3108
3109                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3110
3111                 hci_key_change_cfm(conn, ev->status);
3112         }
3113
3114         hci_dev_unlock(hdev);
3115 }
3116
3117 static void hci_remote_features_evt(struct hci_dev *hdev,
3118                                     struct sk_buff *skb)
3119 {
3120         struct hci_ev_remote_features *ev = (void *) skb->data;
3121         struct hci_conn *conn;
3122
3123         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3124
3125         hci_dev_lock(hdev);
3126
3127         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3128         if (!conn)
3129                 goto unlock;
3130
3131         if (!ev->status)
3132                 memcpy(conn->features[0], ev->features, 8);
3133
3134         if (conn->state != BT_CONFIG)
3135                 goto unlock;
3136
3137         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3138             lmp_ext_feat_capable(conn)) {
3139                 struct hci_cp_read_remote_ext_features cp;
3140                 cp.handle = ev->handle;
3141                 cp.page = 0x01;
3142                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3143                              sizeof(cp), &cp);
3144                 goto unlock;
3145         }
3146
3147         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3148                 struct hci_cp_remote_name_req cp;
3149                 memset(&cp, 0, sizeof(cp));
3150                 bacpy(&cp.bdaddr, &conn->dst);
3151                 cp.pscan_rep_mode = 0x02;
3152                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3153         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3154                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3155
3156         if (!hci_outgoing_auth_needed(hdev, conn)) {
3157                 conn->state = BT_CONNECTED;
3158                 hci_connect_cfm(conn, ev->status);
3159                 hci_conn_drop(conn);
3160         }
3161
3162 unlock:
3163         hci_dev_unlock(hdev);
3164 }
3165
3166 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3167                                  u16 *opcode, u8 *status,
3168                                  hci_req_complete_t *req_complete,
3169                                  hci_req_complete_skb_t *req_complete_skb)
3170 {
3171         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3172
3173         *opcode = __le16_to_cpu(ev->opcode);
3174         *status = skb->data[sizeof(*ev)];
3175
3176         skb_pull(skb, sizeof(*ev));
3177
3178         switch (*opcode) {
3179         case HCI_OP_INQUIRY_CANCEL:
3180                 hci_cc_inquiry_cancel(hdev, skb);
3181                 break;
3182
3183         case HCI_OP_PERIODIC_INQ:
3184                 hci_cc_periodic_inq(hdev, skb);
3185                 break;
3186
3187         case HCI_OP_EXIT_PERIODIC_INQ:
3188                 hci_cc_exit_periodic_inq(hdev, skb);
3189                 break;
3190
3191         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3192                 hci_cc_remote_name_req_cancel(hdev, skb);
3193                 break;
3194
3195         case HCI_OP_ROLE_DISCOVERY:
3196                 hci_cc_role_discovery(hdev, skb);
3197                 break;
3198
3199         case HCI_OP_READ_LINK_POLICY:
3200                 hci_cc_read_link_policy(hdev, skb);
3201                 break;
3202
3203         case HCI_OP_WRITE_LINK_POLICY:
3204                 hci_cc_write_link_policy(hdev, skb);
3205                 break;
3206
3207         case HCI_OP_READ_DEF_LINK_POLICY:
3208                 hci_cc_read_def_link_policy(hdev, skb);
3209                 break;
3210
3211         case HCI_OP_WRITE_DEF_LINK_POLICY:
3212                 hci_cc_write_def_link_policy(hdev, skb);
3213                 break;
3214
3215         case HCI_OP_RESET:
3216                 hci_cc_reset(hdev, skb);
3217                 break;
3218
3219         case HCI_OP_READ_STORED_LINK_KEY:
3220                 hci_cc_read_stored_link_key(hdev, skb);
3221                 break;
3222
3223         case HCI_OP_DELETE_STORED_LINK_KEY:
3224                 hci_cc_delete_stored_link_key(hdev, skb);
3225                 break;
3226
3227         case HCI_OP_WRITE_LOCAL_NAME:
3228                 hci_cc_write_local_name(hdev, skb);
3229                 break;
3230
3231         case HCI_OP_READ_LOCAL_NAME:
3232                 hci_cc_read_local_name(hdev, skb);
3233                 break;
3234
3235         case HCI_OP_WRITE_AUTH_ENABLE:
3236                 hci_cc_write_auth_enable(hdev, skb);
3237                 break;
3238
3239         case HCI_OP_WRITE_ENCRYPT_MODE:
3240                 hci_cc_write_encrypt_mode(hdev, skb);
3241                 break;
3242
3243         case HCI_OP_WRITE_SCAN_ENABLE:
3244                 hci_cc_write_scan_enable(hdev, skb);
3245                 break;
3246
3247         case HCI_OP_READ_CLASS_OF_DEV:
3248                 hci_cc_read_class_of_dev(hdev, skb);
3249                 break;
3250
3251         case HCI_OP_WRITE_CLASS_OF_DEV:
3252                 hci_cc_write_class_of_dev(hdev, skb);
3253                 break;
3254
3255         case HCI_OP_READ_VOICE_SETTING:
3256                 hci_cc_read_voice_setting(hdev, skb);
3257                 break;
3258
3259         case HCI_OP_WRITE_VOICE_SETTING:
3260                 hci_cc_write_voice_setting(hdev, skb);
3261                 break;
3262
3263         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3264                 hci_cc_read_num_supported_iac(hdev, skb);
3265                 break;
3266
3267         case HCI_OP_WRITE_SSP_MODE:
3268                 hci_cc_write_ssp_mode(hdev, skb);
3269                 break;
3270
3271         case HCI_OP_WRITE_SC_SUPPORT:
3272                 hci_cc_write_sc_support(hdev, skb);
3273                 break;
3274
3275         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3276                 hci_cc_read_auth_payload_timeout(hdev, skb);
3277                 break;
3278
3279         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3280                 hci_cc_write_auth_payload_timeout(hdev, skb);
3281                 break;
3282
3283         case HCI_OP_READ_LOCAL_VERSION:
3284                 hci_cc_read_local_version(hdev, skb);
3285                 break;
3286
3287         case HCI_OP_READ_LOCAL_COMMANDS:
3288                 hci_cc_read_local_commands(hdev, skb);
3289                 break;
3290
3291         case HCI_OP_READ_LOCAL_FEATURES:
3292                 hci_cc_read_local_features(hdev, skb);
3293                 break;
3294
3295         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3296                 hci_cc_read_local_ext_features(hdev, skb);
3297                 break;
3298
3299         case HCI_OP_READ_BUFFER_SIZE:
3300                 hci_cc_read_buffer_size(hdev, skb);
3301                 break;
3302
3303         case HCI_OP_READ_BD_ADDR:
3304                 hci_cc_read_bd_addr(hdev, skb);
3305                 break;
3306
3307         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3308                 hci_cc_read_page_scan_activity(hdev, skb);
3309                 break;
3310
3311         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3312                 hci_cc_write_page_scan_activity(hdev, skb);
3313                 break;
3314
3315         case HCI_OP_READ_PAGE_SCAN_TYPE:
3316                 hci_cc_read_page_scan_type(hdev, skb);
3317                 break;
3318
3319         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3320                 hci_cc_write_page_scan_type(hdev, skb);
3321                 break;
3322
3323         case HCI_OP_READ_DATA_BLOCK_SIZE:
3324                 hci_cc_read_data_block_size(hdev, skb);
3325                 break;
3326
3327         case HCI_OP_READ_FLOW_CONTROL_MODE:
3328                 hci_cc_read_flow_control_mode(hdev, skb);
3329                 break;
3330
3331         case HCI_OP_READ_LOCAL_AMP_INFO:
3332                 hci_cc_read_local_amp_info(hdev, skb);
3333                 break;
3334
3335         case HCI_OP_READ_CLOCK:
3336                 hci_cc_read_clock(hdev, skb);
3337                 break;
3338
3339         case HCI_OP_READ_INQ_RSP_TX_POWER:
3340                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3341                 break;
3342
3343         case HCI_OP_PIN_CODE_REPLY:
3344                 hci_cc_pin_code_reply(hdev, skb);
3345                 break;
3346
3347         case HCI_OP_PIN_CODE_NEG_REPLY:
3348                 hci_cc_pin_code_neg_reply(hdev, skb);
3349                 break;
3350
3351         case HCI_OP_READ_LOCAL_OOB_DATA:
3352                 hci_cc_read_local_oob_data(hdev, skb);
3353                 break;
3354
3355         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3356                 hci_cc_read_local_oob_ext_data(hdev, skb);
3357                 break;
3358
3359         case HCI_OP_LE_READ_BUFFER_SIZE:
3360                 hci_cc_le_read_buffer_size(hdev, skb);
3361                 break;
3362
3363         case HCI_OP_LE_READ_LOCAL_FEATURES:
3364                 hci_cc_le_read_local_features(hdev, skb);
3365                 break;
3366
3367         case HCI_OP_LE_READ_ADV_TX_POWER:
3368                 hci_cc_le_read_adv_tx_power(hdev, skb);
3369                 break;
3370
3371         case HCI_OP_USER_CONFIRM_REPLY:
3372                 hci_cc_user_confirm_reply(hdev, skb);
3373                 break;
3374
3375         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3376                 hci_cc_user_confirm_neg_reply(hdev, skb);
3377                 break;
3378
3379         case HCI_OP_USER_PASSKEY_REPLY:
3380                 hci_cc_user_passkey_reply(hdev, skb);
3381                 break;
3382
3383         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3384                 hci_cc_user_passkey_neg_reply(hdev, skb);
3385                 break;
3386
3387         case HCI_OP_LE_SET_RANDOM_ADDR:
3388                 hci_cc_le_set_random_addr(hdev, skb);
3389                 break;
3390
3391         case HCI_OP_LE_SET_ADV_ENABLE:
3392                 hci_cc_le_set_adv_enable(hdev, skb);
3393                 break;
3394
3395         case HCI_OP_LE_SET_SCAN_PARAM:
3396                 hci_cc_le_set_scan_param(hdev, skb);
3397                 break;
3398
3399         case HCI_OP_LE_SET_SCAN_ENABLE:
3400                 hci_cc_le_set_scan_enable(hdev, skb);
3401                 break;
3402
3403         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3404                 hci_cc_le_read_white_list_size(hdev, skb);
3405                 break;
3406
3407         case HCI_OP_LE_CLEAR_WHITE_LIST:
3408                 hci_cc_le_clear_white_list(hdev, skb);
3409                 break;
3410
3411         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3412                 hci_cc_le_add_to_white_list(hdev, skb);
3413                 break;
3414
3415         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3416                 hci_cc_le_del_from_white_list(hdev, skb);
3417                 break;
3418
3419         case HCI_OP_LE_READ_SUPPORTED_STATES:
3420                 hci_cc_le_read_supported_states(hdev, skb);
3421                 break;
3422
3423         case HCI_OP_LE_READ_DEF_DATA_LEN:
3424                 hci_cc_le_read_def_data_len(hdev, skb);
3425                 break;
3426
3427         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3428                 hci_cc_le_write_def_data_len(hdev, skb);
3429                 break;
3430
3431         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3432                 hci_cc_le_add_to_resolv_list(hdev, skb);
3433                 break;
3434
3435         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3436                 hci_cc_le_del_from_resolv_list(hdev, skb);
3437                 break;
3438
3439         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3440                 hci_cc_le_clear_resolv_list(hdev, skb);
3441                 break;
3442
3443         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3444                 hci_cc_le_read_resolv_list_size(hdev, skb);
3445                 break;
3446
3447         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3448                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3449                 break;
3450
3451         case HCI_OP_LE_READ_MAX_DATA_LEN:
3452                 hci_cc_le_read_max_data_len(hdev, skb);
3453                 break;
3454
3455         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3456                 hci_cc_write_le_host_supported(hdev, skb);
3457                 break;
3458
3459         case HCI_OP_LE_SET_ADV_PARAM:
3460                 hci_cc_set_adv_param(hdev, skb);
3461                 break;
3462
3463         case HCI_OP_READ_RSSI:
3464                 hci_cc_read_rssi(hdev, skb);
3465                 break;
3466
3467         case HCI_OP_READ_TX_POWER:
3468                 hci_cc_read_tx_power(hdev, skb);
3469                 break;
3470
3471         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3472                 hci_cc_write_ssp_debug_mode(hdev, skb);
3473                 break;
3474
3475         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3476                 hci_cc_le_set_ext_scan_param(hdev, skb);
3477                 break;
3478
3479         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3480                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3481                 break;
3482
3483         case HCI_OP_LE_SET_DEFAULT_PHY:
3484                 hci_cc_le_set_default_phy(hdev, skb);
3485                 break;
3486
3487         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3488                 hci_cc_le_read_num_adv_sets(hdev, skb);
3489                 break;
3490
3491         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3492                 hci_cc_set_ext_adv_param(hdev, skb);
3493                 break;
3494
3495         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3496                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3497                 break;
3498
3499         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3500                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3501                 break;
3502 #ifdef TIZEN_BT
3503         case HCI_OP_ENABLE_RSSI:
3504                 hci_cc_enable_rssi(hdev, skb);
3505                 break;
3506
3507         case HCI_OP_GET_RAW_RSSI:
3508                 hci_cc_get_raw_rssi(hdev, skb);
3509                 break;
3510 #endif
3511         default:
3512                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3513                 break;
3514         }
3515
3516         if (*opcode != HCI_OP_NOP)
3517                 cancel_delayed_work(&hdev->cmd_timer);
3518
3519         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3520                 atomic_set(&hdev->cmd_cnt, 1);
3521
3522         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3523                              req_complete_skb);
3524
3525         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3526                 bt_dev_err(hdev,
3527                            "unexpected event for opcode 0x%4.4x", *opcode);
3528                 return;
3529         }
3530
3531         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3532                 queue_work(hdev->workqueue, &hdev->cmd_work);
3533 }
3534
3535 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3536                                u16 *opcode, u8 *status,
3537                                hci_req_complete_t *req_complete,
3538                                hci_req_complete_skb_t *req_complete_skb)
3539 {
3540         struct hci_ev_cmd_status *ev = (void *) skb->data;
3541
3542         skb_pull(skb, sizeof(*ev));
3543
3544         *opcode = __le16_to_cpu(ev->opcode);
3545         *status = ev->status;
3546
3547         switch (*opcode) {
3548         case HCI_OP_INQUIRY:
3549                 hci_cs_inquiry(hdev, ev->status);
3550                 break;
3551
3552         case HCI_OP_CREATE_CONN:
3553                 hci_cs_create_conn(hdev, ev->status);
3554                 break;
3555
3556         case HCI_OP_DISCONNECT:
3557                 hci_cs_disconnect(hdev, ev->status);
3558                 break;
3559
3560         case HCI_OP_ADD_SCO:
3561                 hci_cs_add_sco(hdev, ev->status);
3562                 break;
3563
3564         case HCI_OP_AUTH_REQUESTED:
3565                 hci_cs_auth_requested(hdev, ev->status);
3566                 break;
3567
3568         case HCI_OP_SET_CONN_ENCRYPT:
3569                 hci_cs_set_conn_encrypt(hdev, ev->status);
3570                 break;
3571
3572         case HCI_OP_REMOTE_NAME_REQ:
3573                 hci_cs_remote_name_req(hdev, ev->status);
3574                 break;
3575
3576         case HCI_OP_READ_REMOTE_FEATURES:
3577                 hci_cs_read_remote_features(hdev, ev->status);
3578                 break;
3579
3580         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3581                 hci_cs_read_remote_ext_features(hdev, ev->status);
3582                 break;
3583
3584         case HCI_OP_SETUP_SYNC_CONN:
3585                 hci_cs_setup_sync_conn(hdev, ev->status);
3586                 break;
3587
3588         case HCI_OP_SNIFF_MODE:
3589                 hci_cs_sniff_mode(hdev, ev->status);
3590                 break;
3591
3592         case HCI_OP_EXIT_SNIFF_MODE:
3593                 hci_cs_exit_sniff_mode(hdev, ev->status);
3594                 break;
3595
3596         case HCI_OP_SWITCH_ROLE:
3597                 hci_cs_switch_role(hdev, ev->status);
3598                 break;
3599
3600         case HCI_OP_LE_CREATE_CONN:
3601                 hci_cs_le_create_conn(hdev, ev->status);
3602                 break;
3603
3604         case HCI_OP_LE_READ_REMOTE_FEATURES:
3605                 hci_cs_le_read_remote_features(hdev, ev->status);
3606                 break;
3607
3608         case HCI_OP_LE_START_ENC:
3609                 hci_cs_le_start_enc(hdev, ev->status);
3610                 break;
3611
3612         case HCI_OP_LE_EXT_CREATE_CONN:
3613                 hci_cs_le_ext_create_conn(hdev, ev->status);
3614                 break;
3615
3616         default:
3617                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3618                 break;
3619         }
3620
3621         if (*opcode != HCI_OP_NOP)
3622                 cancel_delayed_work(&hdev->cmd_timer);
3623
3624         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags))
3625                 atomic_set(&hdev->cmd_cnt, 1);
3626
3627         /* Indicate request completion if the command failed. Also, if
3628          * we're not waiting for a special event and we get a success
3629          * command status we should try to flag the request as completed
3630          * (since for this kind of commands there will not be a command
3631          * complete event).
3632          */
3633         if (ev->status ||
3634             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3635                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3636                                      req_complete_skb);
3637
3638         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3639                 bt_dev_err(hdev,
3640                            "unexpected event for opcode 0x%4.4x", *opcode);
3641                 return;
3642         }
3643
3644         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3645                 queue_work(hdev->workqueue, &hdev->cmd_work);
3646 }
3647
3648 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3649 {
3650         struct hci_ev_hardware_error *ev = (void *) skb->data;
3651
3652         hdev->hw_error_code = ev->code;
3653
3654         queue_work(hdev->req_workqueue, &hdev->error_reset);
3655 }
3656
3657 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3658 {
3659         struct hci_ev_role_change *ev = (void *) skb->data;
3660         struct hci_conn *conn;
3661
3662         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3663
3664         hci_dev_lock(hdev);
3665
3666         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3667         if (conn) {
3668                 if (!ev->status)
3669                         conn->role = ev->role;
3670
3671                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3672
3673                 hci_role_switch_cfm(conn, ev->status, ev->role);
3674         }
3675
3676         hci_dev_unlock(hdev);
3677 }
3678
3679 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3680 {
3681         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3682         int i;
3683
3684         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3685                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3686                 return;
3687         }
3688
3689         if (skb->len < sizeof(*ev) ||
3690             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3691                 BT_DBG("%s bad parameters", hdev->name);
3692                 return;
3693         }
3694
3695         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3696
3697         for (i = 0; i < ev->num_hndl; i++) {
3698                 struct hci_comp_pkts_info *info = &ev->handles[i];
3699                 struct hci_conn *conn;
3700                 __u16  handle, count;
3701
3702                 handle = __le16_to_cpu(info->handle);
3703                 count  = __le16_to_cpu(info->count);
3704
3705                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3706                 if (!conn)
3707                         continue;
3708
3709                 conn->sent -= count;
3710
3711                 switch (conn->type) {
3712                 case ACL_LINK:
3713                         hdev->acl_cnt += count;
3714                         if (hdev->acl_cnt > hdev->acl_pkts)
3715                                 hdev->acl_cnt = hdev->acl_pkts;
3716                         break;
3717
3718                 case LE_LINK:
3719                         if (hdev->le_pkts) {
3720                                 hdev->le_cnt += count;
3721                                 if (hdev->le_cnt > hdev->le_pkts)
3722                                         hdev->le_cnt = hdev->le_pkts;
3723                         } else {
3724                                 hdev->acl_cnt += count;
3725                                 if (hdev->acl_cnt > hdev->acl_pkts)
3726                                         hdev->acl_cnt = hdev->acl_pkts;
3727                         }
3728                         break;
3729
3730                 case SCO_LINK:
3731                         hdev->sco_cnt += count;
3732                         if (hdev->sco_cnt > hdev->sco_pkts)
3733                                 hdev->sco_cnt = hdev->sco_pkts;
3734                         break;
3735
3736                 default:
3737                         bt_dev_err(hdev, "unknown type %d conn %p",
3738                                    conn->type, conn);
3739                         break;
3740                 }
3741         }
3742
3743         queue_work(hdev->workqueue, &hdev->tx_work);
3744 }
3745
3746 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3747                                                  __u16 handle)
3748 {
3749         struct hci_chan *chan;
3750
3751         switch (hdev->dev_type) {
3752         case HCI_PRIMARY:
3753                 return hci_conn_hash_lookup_handle(hdev, handle);
3754         case HCI_AMP:
3755                 chan = hci_chan_lookup_handle(hdev, handle);
3756                 if (chan)
3757                         return chan->conn;
3758                 break;
3759         default:
3760                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3761                 break;
3762         }
3763
3764         return NULL;
3765 }
3766
3767 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3768 {
3769         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3770         int i;
3771
3772         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3773                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3774                 return;
3775         }
3776
3777         if (skb->len < sizeof(*ev) ||
3778             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3779                 BT_DBG("%s bad parameters", hdev->name);
3780                 return;
3781         }
3782
3783         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3784                ev->num_hndl);
3785
3786         for (i = 0; i < ev->num_hndl; i++) {
3787                 struct hci_comp_blocks_info *info = &ev->handles[i];
3788                 struct hci_conn *conn = NULL;
3789                 __u16  handle, block_count;
3790
3791                 handle = __le16_to_cpu(info->handle);
3792                 block_count = __le16_to_cpu(info->blocks);
3793
3794                 conn = __hci_conn_lookup_handle(hdev, handle);
3795                 if (!conn)
3796                         continue;
3797
3798                 conn->sent -= block_count;
3799
3800                 switch (conn->type) {
3801                 case ACL_LINK:
3802                 case AMP_LINK:
3803                         hdev->block_cnt += block_count;
3804                         if (hdev->block_cnt > hdev->num_blocks)
3805                                 hdev->block_cnt = hdev->num_blocks;
3806                         break;
3807
3808                 default:
3809                         bt_dev_err(hdev, "unknown type %d conn %p",
3810                                    conn->type, conn);
3811                         break;
3812                 }
3813         }
3814
3815         queue_work(hdev->workqueue, &hdev->tx_work);
3816 }
3817
3818 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3819 {
3820         struct hci_ev_mode_change *ev = (void *) skb->data;
3821         struct hci_conn *conn;
3822
3823         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3824
3825         hci_dev_lock(hdev);
3826
3827         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3828         if (conn) {
3829                 conn->mode = ev->mode;
3830
3831                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3832                                         &conn->flags)) {
3833                         if (conn->mode == HCI_CM_ACTIVE)
3834                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3835                         else
3836                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3837                 }
3838
3839                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3840                         hci_sco_setup(conn, ev->status);
3841         }
3842
3843         hci_dev_unlock(hdev);
3844 }
3845
3846 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3847 {
3848         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3849         struct hci_conn *conn;
3850
3851         BT_DBG("%s", hdev->name);
3852
3853         hci_dev_lock(hdev);
3854
3855         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3856         if (!conn)
3857                 goto unlock;
3858
3859         if (conn->state == BT_CONNECTED) {
3860                 hci_conn_hold(conn);
3861                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3862                 hci_conn_drop(conn);
3863         }
3864
3865         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
3866             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3867                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3868                              sizeof(ev->bdaddr), &ev->bdaddr);
3869         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
3870                 u8 secure;
3871
3872                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3873                         secure = 1;
3874                 else
3875                         secure = 0;
3876
3877                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3878         }
3879
3880 unlock:
3881         hci_dev_unlock(hdev);
3882 }
3883
3884 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3885 {
3886         if (key_type == HCI_LK_CHANGED_COMBINATION)
3887                 return;
3888
3889         conn->pin_length = pin_len;
3890         conn->key_type = key_type;
3891
3892         switch (key_type) {
3893         case HCI_LK_LOCAL_UNIT:
3894         case HCI_LK_REMOTE_UNIT:
3895         case HCI_LK_DEBUG_COMBINATION:
3896                 return;
3897         case HCI_LK_COMBINATION:
3898                 if (pin_len == 16)
3899                         conn->pending_sec_level = BT_SECURITY_HIGH;
3900                 else
3901                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3902                 break;
3903         case HCI_LK_UNAUTH_COMBINATION_P192:
3904         case HCI_LK_UNAUTH_COMBINATION_P256:
3905                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3906                 break;
3907         case HCI_LK_AUTH_COMBINATION_P192:
3908                 conn->pending_sec_level = BT_SECURITY_HIGH;
3909                 break;
3910         case HCI_LK_AUTH_COMBINATION_P256:
3911                 conn->pending_sec_level = BT_SECURITY_FIPS;
3912                 break;
3913         }
3914 }
3915
3916 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3917 {
3918         struct hci_ev_link_key_req *ev = (void *) skb->data;
3919         struct hci_cp_link_key_reply cp;
3920         struct hci_conn *conn;
3921         struct link_key *key;
3922
3923         BT_DBG("%s", hdev->name);
3924
3925         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3926                 return;
3927
3928         hci_dev_lock(hdev);
3929
3930         key = hci_find_link_key(hdev, &ev->bdaddr);
3931         if (!key) {
3932                 BT_DBG("%s link key not found for %pMR", hdev->name,
3933                        &ev->bdaddr);
3934                 goto not_found;
3935         }
3936
3937         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3938                &ev->bdaddr);
3939
3940         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3941         if (conn) {
3942                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3943
3944                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3945                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3946                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3947                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3948                         goto not_found;
3949                 }
3950
3951                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3952                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3953                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3954                         BT_DBG("%s ignoring key unauthenticated for high security",
3955                                hdev->name);
3956                         goto not_found;
3957                 }
3958
3959                 conn_set_key(conn, key->type, key->pin_len);
3960         }
3961
3962         bacpy(&cp.bdaddr, &ev->bdaddr);
3963         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3964
3965         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3966
3967         hci_dev_unlock(hdev);
3968
3969         return;
3970
3971 not_found:
3972         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3973         hci_dev_unlock(hdev);
3974 }
3975
3976 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3977 {
3978         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3979         struct hci_conn *conn;
3980         struct link_key *key;
3981         bool persistent;
3982         u8 pin_len = 0;
3983
3984         BT_DBG("%s", hdev->name);
3985
3986         hci_dev_lock(hdev);
3987
3988         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3989         if (!conn)
3990                 goto unlock;
3991
3992         hci_conn_hold(conn);
3993         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3994         hci_conn_drop(conn);
3995
3996         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3997         conn_set_key(conn, ev->key_type, conn->pin_length);
3998
3999         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4000                 goto unlock;
4001
4002         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4003                                 ev->key_type, pin_len, &persistent);
4004         if (!key)
4005                 goto unlock;
4006
4007         /* Update connection information since adding the key will have
4008          * fixed up the type in the case of changed combination keys.
4009          */
4010         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4011                 conn_set_key(conn, key->type, key->pin_len);
4012
4013         mgmt_new_link_key(hdev, key, persistent);
4014
4015         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4016          * is set. If it's not set simply remove the key from the kernel
4017          * list (we've still notified user space about it but with
4018          * store_hint being 0).
4019          */
4020         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4021             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4022                 list_del_rcu(&key->list);
4023                 kfree_rcu(key, rcu);
4024                 goto unlock;
4025         }
4026
4027         if (persistent)
4028                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4029         else
4030                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4031
4032 unlock:
4033         hci_dev_unlock(hdev);
4034 }
4035
4036 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4037 {
4038         struct hci_ev_clock_offset *ev = (void *) skb->data;
4039         struct hci_conn *conn;
4040
4041         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4042
4043         hci_dev_lock(hdev);
4044
4045         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4046         if (conn && !ev->status) {
4047                 struct inquiry_entry *ie;
4048
4049                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4050                 if (ie) {
4051                         ie->data.clock_offset = ev->clock_offset;
4052                         ie->timestamp = jiffies;
4053                 }
4054         }
4055
4056         hci_dev_unlock(hdev);
4057 }
4058
4059 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4060 {
4061         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4062         struct hci_conn *conn;
4063
4064         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4065
4066         hci_dev_lock(hdev);
4067
4068         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4069         if (conn && !ev->status)
4070                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4071
4072         hci_dev_unlock(hdev);
4073 }
4074
4075 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4076 {
4077         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4078         struct inquiry_entry *ie;
4079
4080         BT_DBG("%s", hdev->name);
4081
4082         hci_dev_lock(hdev);
4083
4084         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4085         if (ie) {
4086                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4087                 ie->timestamp = jiffies;
4088         }
4089
4090         hci_dev_unlock(hdev);
4091 }
4092
4093 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4094                                              struct sk_buff *skb)
4095 {
4096         struct inquiry_data data;
4097         int num_rsp = *((__u8 *) skb->data);
4098
4099         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4100
4101         if (!num_rsp)
4102                 return;
4103
4104         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4105                 return;
4106
4107         hci_dev_lock(hdev);
4108
4109         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4110                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4111                 info = (void *) (skb->data + 1);
4112
4113                 for (; num_rsp; num_rsp--, info++) {
4114                         u32 flags;
4115
4116                         bacpy(&data.bdaddr, &info->bdaddr);
4117                         data.pscan_rep_mode     = info->pscan_rep_mode;
4118                         data.pscan_period_mode  = info->pscan_period_mode;
4119                         data.pscan_mode         = info->pscan_mode;
4120                         memcpy(data.dev_class, info->dev_class, 3);
4121                         data.clock_offset       = info->clock_offset;
4122                         data.rssi               = info->rssi;
4123                         data.ssp_mode           = 0x00;
4124
4125                         flags = hci_inquiry_cache_update(hdev, &data, false);
4126
4127                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4128                                           info->dev_class, info->rssi,
4129                                           flags, NULL, 0, NULL, 0);
4130                 }
4131         } else {
4132                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4133
4134                 for (; num_rsp; num_rsp--, info++) {
4135                         u32 flags;
4136
4137                         bacpy(&data.bdaddr, &info->bdaddr);
4138                         data.pscan_rep_mode     = info->pscan_rep_mode;
4139                         data.pscan_period_mode  = info->pscan_period_mode;
4140                         data.pscan_mode         = 0x00;
4141                         memcpy(data.dev_class, info->dev_class, 3);
4142                         data.clock_offset       = info->clock_offset;
4143                         data.rssi               = info->rssi;
4144                         data.ssp_mode           = 0x00;
4145
4146                         flags = hci_inquiry_cache_update(hdev, &data, false);
4147
4148                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4149                                           info->dev_class, info->rssi,
4150                                           flags, NULL, 0, NULL, 0);
4151                 }
4152         }
4153
4154         hci_dev_unlock(hdev);
4155 }
4156
4157 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4158                                         struct sk_buff *skb)
4159 {
4160         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4161         struct hci_conn *conn;
4162
4163         BT_DBG("%s", hdev->name);
4164
4165         hci_dev_lock(hdev);
4166
4167         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4168         if (!conn)
4169                 goto unlock;
4170
4171         if (ev->page < HCI_MAX_PAGES)
4172                 memcpy(conn->features[ev->page], ev->features, 8);
4173
4174         if (!ev->status && ev->page == 0x01) {
4175                 struct inquiry_entry *ie;
4176
4177                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4178                 if (ie)
4179                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4180
4181                 if (ev->features[0] & LMP_HOST_SSP) {
4182                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4183                 } else {
4184                         /* It is mandatory by the Bluetooth specification that
4185                          * Extended Inquiry Results are only used when Secure
4186                          * Simple Pairing is enabled, but some devices violate
4187                          * this.
4188                          *
4189                          * To make these devices work, the internal SSP
4190                          * enabled flag needs to be cleared if the remote host
4191                          * features do not indicate SSP support */
4192                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4193                 }
4194
4195                 if (ev->features[0] & LMP_HOST_SC)
4196                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4197         }
4198
4199         if (conn->state != BT_CONFIG)
4200                 goto unlock;
4201
4202         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4203                 struct hci_cp_remote_name_req cp;
4204                 memset(&cp, 0, sizeof(cp));
4205                 bacpy(&cp.bdaddr, &conn->dst);
4206                 cp.pscan_rep_mode = 0x02;
4207                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4208         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4209                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4210
4211         if (!hci_outgoing_auth_needed(hdev, conn)) {
4212                 conn->state = BT_CONNECTED;
4213                 hci_connect_cfm(conn, ev->status);
4214                 hci_conn_drop(conn);
4215         }
4216
4217 unlock:
4218         hci_dev_unlock(hdev);
4219 }
4220
4221 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4222                                        struct sk_buff *skb)
4223 {
4224         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4225         struct hci_conn *conn;
4226
4227         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4228
4229         hci_dev_lock(hdev);
4230
4231         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4232         if (!conn) {
4233                 if (ev->link_type == ESCO_LINK)
4234                         goto unlock;
4235
4236                 /* When the link type in the event indicates SCO connection
4237                  * and lookup of the connection object fails, then check
4238                  * if an eSCO connection object exists.
4239                  *
4240                  * The core limits the synchronous connections to either
4241                  * SCO or eSCO. The eSCO connection is preferred and tried
4242                  * to be setup first and until successfully established,
4243                  * the link type will be hinted as eSCO.
4244                  */
4245                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4246                 if (!conn)
4247                         goto unlock;
4248         }
4249
4250         switch (ev->status) {
4251         case 0x00:
4252                 conn->handle = __le16_to_cpu(ev->handle);
4253                 conn->state  = BT_CONNECTED;
4254                 conn->type   = ev->link_type;
4255
4256                 hci_debugfs_create_conn(conn);
4257                 hci_conn_add_sysfs(conn);
4258                 break;
4259
4260         case 0x10:      /* Connection Accept Timeout */
4261         case 0x0d:      /* Connection Rejected due to Limited Resources */
4262         case 0x11:      /* Unsupported Feature or Parameter Value */
4263         case 0x1c:      /* SCO interval rejected */
4264         case 0x1a:      /* Unsupported Remote Feature */
4265         case 0x1e:      /* Invalid LMP Parameters */
4266         case 0x1f:      /* Unspecified error */
4267         case 0x20:      /* Unsupported LMP Parameter value */
4268                 if (conn->out) {
4269                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4270                                         (hdev->esco_type & EDR_ESCO_MASK);
4271                         if (hci_setup_sync(conn, conn->link->handle))
4272                                 goto unlock;
4273                 }
4274                 /* fall through */
4275
4276         default:
4277                 conn->state = BT_CLOSED;
4278                 break;
4279         }
4280
4281         hci_connect_cfm(conn, ev->status);
4282         if (ev->status)
4283                 hci_conn_del(conn);
4284
4285 unlock:
4286         hci_dev_unlock(hdev);
4287 }
4288
4289 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4290 {
4291         size_t parsed = 0;
4292
4293         while (parsed < eir_len) {
4294                 u8 field_len = eir[0];
4295
4296                 if (field_len == 0)
4297                         return parsed;
4298
4299                 parsed += field_len + 1;
4300                 eir += field_len + 1;
4301         }
4302
4303         return eir_len;
4304 }
4305
4306 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4307                                             struct sk_buff *skb)
4308 {
4309         struct inquiry_data data;
4310         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4311         int num_rsp = *((__u8 *) skb->data);
4312         size_t eir_len;
4313
4314         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4315
4316         if (!num_rsp)
4317                 return;
4318
4319         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4320                 return;
4321
4322         hci_dev_lock(hdev);
4323
4324         for (; num_rsp; num_rsp--, info++) {
4325                 u32 flags;
4326                 bool name_known;
4327
4328                 bacpy(&data.bdaddr, &info->bdaddr);
4329                 data.pscan_rep_mode     = info->pscan_rep_mode;
4330                 data.pscan_period_mode  = info->pscan_period_mode;
4331                 data.pscan_mode         = 0x00;
4332                 memcpy(data.dev_class, info->dev_class, 3);
4333                 data.clock_offset       = info->clock_offset;
4334                 data.rssi               = info->rssi;
4335                 data.ssp_mode           = 0x01;
4336
4337                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4338                         name_known = eir_get_data(info->data,
4339                                                   sizeof(info->data),
4340                                                   EIR_NAME_COMPLETE, NULL);
4341                 else
4342                         name_known = true;
4343
4344                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4345
4346                 eir_len = eir_get_length(info->data, sizeof(info->data));
4347
4348                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4349                                   info->dev_class, info->rssi,
4350                                   flags, info->data, eir_len, NULL, 0);
4351         }
4352
4353         hci_dev_unlock(hdev);
4354 }
4355
4356 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4357                                          struct sk_buff *skb)
4358 {
4359         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4360         struct hci_conn *conn;
4361
4362         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4363                __le16_to_cpu(ev->handle));
4364
4365         hci_dev_lock(hdev);
4366
4367         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4368         if (!conn)
4369                 goto unlock;
4370
4371         /* For BR/EDR the necessary steps are taken through the
4372          * auth_complete event.
4373          */
4374         if (conn->type != LE_LINK)
4375                 goto unlock;
4376
4377         if (!ev->status)
4378                 conn->sec_level = conn->pending_sec_level;
4379
4380         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4381
4382         if (ev->status && conn->state == BT_CONNECTED) {
4383                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4384                 hci_conn_drop(conn);
4385                 goto unlock;
4386         }
4387
4388         if (conn->state == BT_CONFIG) {
4389                 if (!ev->status)
4390                         conn->state = BT_CONNECTED;
4391
4392                 hci_connect_cfm(conn, ev->status);
4393                 hci_conn_drop(conn);
4394         } else {
4395                 hci_auth_cfm(conn, ev->status);
4396
4397                 hci_conn_hold(conn);
4398                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4399                 hci_conn_drop(conn);
4400         }
4401
4402 unlock:
4403         hci_dev_unlock(hdev);
4404 }
4405
4406 static u8 hci_get_auth_req(struct hci_conn *conn)
4407 {
4408         /* If remote requests no-bonding follow that lead */
4409         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4410             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4411                 return conn->remote_auth | (conn->auth_type & 0x01);
4412
4413         /* If both remote and local have enough IO capabilities, require
4414          * MITM protection
4415          */
4416         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4417             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4418                 return conn->remote_auth | 0x01;
4419
4420         /* No MITM protection possible so ignore remote requirement */
4421         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4422 }
4423
4424 static u8 bredr_oob_data_present(struct hci_conn *conn)
4425 {
4426         struct hci_dev *hdev = conn->hdev;
4427         struct oob_data *data;
4428
4429         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4430         if (!data)
4431                 return 0x00;
4432
4433         if (bredr_sc_enabled(hdev)) {
4434                 /* When Secure Connections is enabled, then just
4435                  * return the present value stored with the OOB
4436                  * data. The stored value contains the right present
4437                  * information. However it can only be trusted when
4438                  * not in Secure Connection Only mode.
4439                  */
4440                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4441                         return data->present;
4442
4443                 /* When Secure Connections Only mode is enabled, then
4444                  * the P-256 values are required. If they are not
4445                  * available, then do not declare that OOB data is
4446                  * present.
4447                  */
4448                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4449                     !memcmp(data->hash256, ZERO_KEY, 16))
4450                         return 0x00;
4451
4452                 return 0x02;
4453         }
4454
4455         /* When Secure Connections is not enabled or actually
4456          * not supported by the hardware, then check that if
4457          * P-192 data values are present.
4458          */
4459         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4460             !memcmp(data->hash192, ZERO_KEY, 16))
4461                 return 0x00;
4462
4463         return 0x01;
4464 }
4465
4466 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4467 {
4468         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4469         struct hci_conn *conn;
4470
4471         BT_DBG("%s", hdev->name);
4472
4473         hci_dev_lock(hdev);
4474
4475         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4476         if (!conn)
4477                 goto unlock;
4478
4479         hci_conn_hold(conn);
4480
4481         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4482                 goto unlock;
4483
4484         /* Allow pairing if we're pairable, the initiators of the
4485          * pairing or if the remote is not requesting bonding.
4486          */
4487         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4488             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4489             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4490                 struct hci_cp_io_capability_reply cp;
4491
4492                 bacpy(&cp.bdaddr, &ev->bdaddr);
4493                 /* Change the IO capability from KeyboardDisplay
4494                  * to DisplayYesNo as it is not supported by BT spec. */
4495                 cp.capability = (conn->io_capability == 0x04) ?
4496                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4497
4498                 /* If we are initiators, there is no remote information yet */
4499                 if (conn->remote_auth == 0xff) {
4500                         /* Request MITM protection if our IO caps allow it
4501                          * except for the no-bonding case.
4502                          */
4503                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4504                             conn->auth_type != HCI_AT_NO_BONDING)
4505                                 conn->auth_type |= 0x01;
4506                 } else {
4507                         conn->auth_type = hci_get_auth_req(conn);
4508                 }
4509
4510                 /* If we're not bondable, force one of the non-bondable
4511                  * authentication requirement values.
4512                  */
4513                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4514                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4515
4516                 cp.authentication = conn->auth_type;
4517                 cp.oob_data = bredr_oob_data_present(conn);
4518
4519                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4520                              sizeof(cp), &cp);
4521         } else {
4522                 struct hci_cp_io_capability_neg_reply cp;
4523
4524                 bacpy(&cp.bdaddr, &ev->bdaddr);
4525                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4526
4527                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4528                              sizeof(cp), &cp);
4529         }
4530
4531 unlock:
4532         hci_dev_unlock(hdev);
4533 }
4534
4535 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4536 {
4537         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4538         struct hci_conn *conn;
4539
4540         BT_DBG("%s", hdev->name);
4541
4542         hci_dev_lock(hdev);
4543
4544         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4545         if (!conn)
4546                 goto unlock;
4547
4548         conn->remote_cap = ev->capability;
4549         conn->remote_auth = ev->authentication;
4550
4551 unlock:
4552         hci_dev_unlock(hdev);
4553 }
4554
4555 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4556                                          struct sk_buff *skb)
4557 {
4558         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4559         int loc_mitm, rem_mitm, confirm_hint = 0;
4560         struct hci_conn *conn;
4561
4562         BT_DBG("%s", hdev->name);
4563
4564         hci_dev_lock(hdev);
4565
4566         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4567                 goto unlock;
4568
4569         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4570         if (!conn)
4571                 goto unlock;
4572
4573         loc_mitm = (conn->auth_type & 0x01);
4574         rem_mitm = (conn->remote_auth & 0x01);
4575
4576         /* If we require MITM but the remote device can't provide that
4577          * (it has NoInputNoOutput) then reject the confirmation
4578          * request. We check the security level here since it doesn't
4579          * necessarily match conn->auth_type.
4580          */
4581         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4582             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4583                 BT_DBG("Rejecting request: remote device can't provide MITM");
4584                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4585                              sizeof(ev->bdaddr), &ev->bdaddr);
4586                 goto unlock;
4587         }
4588
4589         /* If no side requires MITM protection; auto-accept */
4590         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4591             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4592
4593                 /* If we're not the initiators request authorization to
4594                  * proceed from user space (mgmt_user_confirm with
4595                  * confirm_hint set to 1). The exception is if neither
4596                  * side had MITM or if the local IO capability is
4597                  * NoInputNoOutput, in which case we do auto-accept
4598                  */
4599                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4600                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4601                     (loc_mitm || rem_mitm)) {
4602                         BT_DBG("Confirming auto-accept as acceptor");
4603                         confirm_hint = 1;
4604                         goto confirm;
4605                 }
4606
4607                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4608                        hdev->auto_accept_delay);
4609
4610                 if (hdev->auto_accept_delay > 0) {
4611                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4612                         queue_delayed_work(conn->hdev->workqueue,
4613                                            &conn->auto_accept_work, delay);
4614                         goto unlock;
4615                 }
4616
4617                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4618                              sizeof(ev->bdaddr), &ev->bdaddr);
4619                 goto unlock;
4620         }
4621
4622 confirm:
4623         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4624                                   le32_to_cpu(ev->passkey), confirm_hint);
4625
4626 unlock:
4627         hci_dev_unlock(hdev);
4628 }
4629
4630 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4631                                          struct sk_buff *skb)
4632 {
4633         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4634
4635         BT_DBG("%s", hdev->name);
4636
4637         if (hci_dev_test_flag(hdev, HCI_MGMT))
4638                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4639 }
4640
4641 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4642                                         struct sk_buff *skb)
4643 {
4644         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4645         struct hci_conn *conn;
4646
4647         BT_DBG("%s", hdev->name);
4648
4649         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4650         if (!conn)
4651                 return;
4652
4653         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4654         conn->passkey_entered = 0;
4655
4656         if (hci_dev_test_flag(hdev, HCI_MGMT))
4657                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4658                                          conn->dst_type, conn->passkey_notify,
4659                                          conn->passkey_entered);
4660 }
4661
4662 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4663 {
4664         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4665         struct hci_conn *conn;
4666
4667         BT_DBG("%s", hdev->name);
4668
4669         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4670         if (!conn)
4671                 return;
4672
4673         switch (ev->type) {
4674         case HCI_KEYPRESS_STARTED:
4675                 conn->passkey_entered = 0;
4676                 return;
4677
4678         case HCI_KEYPRESS_ENTERED:
4679                 conn->passkey_entered++;
4680                 break;
4681
4682         case HCI_KEYPRESS_ERASED:
4683                 conn->passkey_entered--;
4684                 break;
4685
4686         case HCI_KEYPRESS_CLEARED:
4687                 conn->passkey_entered = 0;
4688                 break;
4689
4690         case HCI_KEYPRESS_COMPLETED:
4691                 return;
4692         }
4693
4694         if (hci_dev_test_flag(hdev, HCI_MGMT))
4695                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4696                                          conn->dst_type, conn->passkey_notify,
4697                                          conn->passkey_entered);
4698 }
4699
4700 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4701                                          struct sk_buff *skb)
4702 {
4703         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4704         struct hci_conn *conn;
4705
4706         BT_DBG("%s", hdev->name);
4707
4708         hci_dev_lock(hdev);
4709
4710         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4711         if (!conn)
4712                 goto unlock;
4713
4714         /* Reset the authentication requirement to unknown */
4715         conn->remote_auth = 0xff;
4716
4717         /* To avoid duplicate auth_failed events to user space we check
4718          * the HCI_CONN_AUTH_PEND flag which will be set if we
4719          * initiated the authentication. A traditional auth_complete
4720          * event gets always produced as initiator and is also mapped to
4721          * the mgmt_auth_failed event */
4722         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4723                 mgmt_auth_failed(conn, ev->status);
4724
4725         hci_conn_drop(conn);
4726
4727 unlock:
4728         hci_dev_unlock(hdev);
4729 }
4730
4731 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4732                                          struct sk_buff *skb)
4733 {
4734         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4735         struct inquiry_entry *ie;
4736         struct hci_conn *conn;
4737
4738         BT_DBG("%s", hdev->name);
4739
4740         hci_dev_lock(hdev);
4741
4742         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4743         if (conn)
4744                 memcpy(conn->features[1], ev->features, 8);
4745
4746         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4747         if (ie)
4748                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4749
4750         hci_dev_unlock(hdev);
4751 }
4752
4753 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4754                                             struct sk_buff *skb)
4755 {
4756         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4757         struct oob_data *data;
4758
4759         BT_DBG("%s", hdev->name);
4760
4761         hci_dev_lock(hdev);
4762
4763         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4764                 goto unlock;
4765
4766         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4767         if (!data) {
4768                 struct hci_cp_remote_oob_data_neg_reply cp;
4769
4770                 bacpy(&cp.bdaddr, &ev->bdaddr);
4771                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4772                              sizeof(cp), &cp);
4773                 goto unlock;
4774         }
4775
4776         if (bredr_sc_enabled(hdev)) {
4777                 struct hci_cp_remote_oob_ext_data_reply cp;
4778
4779                 bacpy(&cp.bdaddr, &ev->bdaddr);
4780                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
4781                         memset(cp.hash192, 0, sizeof(cp.hash192));
4782                         memset(cp.rand192, 0, sizeof(cp.rand192));
4783                 } else {
4784                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4785                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4786                 }
4787                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4788                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4789
4790                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4791                              sizeof(cp), &cp);
4792         } else {
4793                 struct hci_cp_remote_oob_data_reply cp;
4794
4795                 bacpy(&cp.bdaddr, &ev->bdaddr);
4796                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4797                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4798
4799                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4800                              sizeof(cp), &cp);
4801         }
4802
4803 unlock:
4804         hci_dev_unlock(hdev);
4805 }
4806
4807 #if IS_ENABLED(CONFIG_BT_HS)
4808 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
4809 {
4810         struct hci_ev_channel_selected *ev = (void *)skb->data;
4811         struct hci_conn *hcon;
4812
4813         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
4814
4815         skb_pull(skb, sizeof(*ev));
4816
4817         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4818         if (!hcon)
4819                 return;
4820
4821         amp_read_loc_assoc_final_data(hdev, hcon);
4822 }
4823
4824 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4825                                       struct sk_buff *skb)
4826 {
4827         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4828         struct hci_conn *hcon, *bredr_hcon;
4829
4830         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4831                ev->status);
4832
4833         hci_dev_lock(hdev);
4834
4835         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4836         if (!hcon) {
4837                 hci_dev_unlock(hdev);
4838                 return;
4839         }
4840
4841         if (ev->status) {
4842                 hci_conn_del(hcon);
4843                 hci_dev_unlock(hdev);
4844                 return;
4845         }
4846
4847         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4848
4849         hcon->state = BT_CONNECTED;
4850         bacpy(&hcon->dst, &bredr_hcon->dst);
4851
4852         hci_conn_hold(hcon);
4853         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4854         hci_conn_drop(hcon);
4855
4856         hci_debugfs_create_conn(hcon);
4857         hci_conn_add_sysfs(hcon);
4858
4859         amp_physical_cfm(bredr_hcon, hcon);
4860
4861         hci_dev_unlock(hdev);
4862 }
4863
4864 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4865 {
4866         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4867         struct hci_conn *hcon;
4868         struct hci_chan *hchan;
4869         struct amp_mgr *mgr;
4870
4871         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4872                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4873                ev->status);
4874
4875         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4876         if (!hcon)
4877                 return;
4878
4879         /* Create AMP hchan */
4880         hchan = hci_chan_create(hcon);
4881         if (!hchan)
4882                 return;
4883
4884         hchan->handle = le16_to_cpu(ev->handle);
4885
4886         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4887
4888         mgr = hcon->amp_mgr;
4889         if (mgr && mgr->bredr_chan) {
4890                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4891
4892                 l2cap_chan_lock(bredr_chan);
4893
4894                 bredr_chan->conn->mtu = hdev->block_mtu;
4895                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4896                 hci_conn_hold(hcon);
4897
4898                 l2cap_chan_unlock(bredr_chan);
4899         }
4900 }
4901
4902 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4903                                              struct sk_buff *skb)
4904 {
4905         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4906         struct hci_chan *hchan;
4907
4908         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4909                le16_to_cpu(ev->handle), ev->status);
4910
4911         if (ev->status)
4912                 return;
4913
4914         hci_dev_lock(hdev);
4915
4916         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4917         if (!hchan)
4918                 goto unlock;
4919
4920         amp_destroy_logical_link(hchan, ev->reason);
4921
4922 unlock:
4923         hci_dev_unlock(hdev);
4924 }
4925
4926 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4927                                              struct sk_buff *skb)
4928 {
4929         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4930         struct hci_conn *hcon;
4931
4932         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4933
4934         if (ev->status)
4935                 return;
4936
4937         hci_dev_lock(hdev);
4938
4939         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4940         if (hcon) {
4941                 hcon->state = BT_CLOSED;
4942                 hci_conn_del(hcon);
4943         }
4944
4945         hci_dev_unlock(hdev);
4946 }
4947 #endif
4948
4949 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
4950                         bdaddr_t *bdaddr, u8 bdaddr_type, u8 role, u16 handle,
4951                         u16 interval, u16 latency, u16 supervision_timeout)
4952 {
4953         struct hci_conn_params *params;
4954         struct hci_conn *conn;
4955         struct smp_irk *irk;
4956         u8 addr_type;
4957
4958         hci_dev_lock(hdev);
4959
4960         /* All controllers implicitly stop advertising in the event of a
4961          * connection, so ensure that the state bit is cleared.
4962          */
4963         hci_dev_clear_flag(hdev, HCI_LE_ADV);
4964
4965         conn = hci_lookup_le_connect(hdev);
4966         if (!conn) {
4967                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
4968                 if (!conn) {
4969                         bt_dev_err(hdev, "no memory for new connection");
4970                         goto unlock;
4971                 }
4972
4973                 conn->dst_type = bdaddr_type;
4974
4975                 /* If we didn't have a hci_conn object previously
4976                  * but we're in master role this must be something
4977                  * initiated using a white list. Since white list based
4978                  * connections are not "first class citizens" we don't
4979                  * have full tracking of them. Therefore, we go ahead
4980                  * with a "best effort" approach of determining the
4981                  * initiator address based on the HCI_PRIVACY flag.
4982                  */
4983                 if (conn->out) {
4984                         conn->resp_addr_type = bdaddr_type;
4985                         bacpy(&conn->resp_addr, bdaddr);
4986                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
4987                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4988                                 bacpy(&conn->init_addr, &hdev->rpa);
4989                         } else {
4990                                 hci_copy_identity_address(hdev,
4991                                                           &conn->init_addr,
4992                                                           &conn->init_addr_type);
4993                         }
4994                 }
4995         } else {
4996                 cancel_delayed_work(&conn->le_conn_timeout);
4997         }
4998
4999         if (!conn->out) {
5000                 /* Set the responder (our side) address type based on
5001                  * the advertising address type.
5002                  */
5003                 conn->resp_addr_type = hdev->adv_addr_type;
5004                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5005                         /* In case of ext adv, resp_addr will be updated in
5006                          * Adv Terminated event.
5007                          */
5008                         if (!ext_adv_capable(hdev))
5009                                 bacpy(&conn->resp_addr, &hdev->random_addr);
5010                 } else {
5011                         bacpy(&conn->resp_addr, &hdev->bdaddr);
5012                 }
5013
5014                 conn->init_addr_type = bdaddr_type;
5015                 bacpy(&conn->init_addr, bdaddr);
5016
5017                 /* For incoming connections, set the default minimum
5018                  * and maximum connection interval. They will be used
5019                  * to check if the parameters are in range and if not
5020                  * trigger the connection update procedure.
5021                  */
5022                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
5023                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
5024         }
5025
5026         /* Lookup the identity address from the stored connection
5027          * address and address type.
5028          *
5029          * When establishing connections to an identity address, the
5030          * connection procedure will store the resolvable random
5031          * address first. Now if it can be converted back into the
5032          * identity address, start using the identity address from
5033          * now on.
5034          */
5035         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5036         if (irk) {
5037                 bacpy(&conn->dst, &irk->bdaddr);
5038                 conn->dst_type = irk->addr_type;
5039         }
5040
5041         if (status) {
5042                 hci_le_conn_failed(conn, status);
5043                 goto unlock;
5044         }
5045
5046         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5047                 addr_type = BDADDR_LE_PUBLIC;
5048         else
5049                 addr_type = BDADDR_LE_RANDOM;
5050
5051         /* Drop the connection if the device is blocked */
5052         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
5053                 hci_conn_drop(conn);
5054                 goto unlock;
5055         }
5056
5057         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5058                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
5059
5060         conn->sec_level = BT_SECURITY_LOW;
5061         conn->handle = handle;
5062         conn->state = BT_CONFIG;
5063
5064         conn->le_conn_interval = interval;
5065         conn->le_conn_latency = latency;
5066         conn->le_supv_timeout = supervision_timeout;
5067
5068         hci_debugfs_create_conn(conn);
5069         hci_conn_add_sysfs(conn);
5070
5071         /* The remote features procedure is defined for master
5072          * role only. So only in case of an initiated connection
5073          * request the remote features.
5074          *
5075          * If the local controller supports slave-initiated features
5076          * exchange, then requesting the remote features in slave
5077          * role is possible. Otherwise just transition into the
5078          * connected state without requesting the remote features.
5079          */
5080         if (conn->out ||
5081             (hdev->le_features[0] & HCI_LE_SLAVE_FEATURES)) {
5082                 struct hci_cp_le_read_remote_features cp;
5083
5084                 cp.handle = __cpu_to_le16(conn->handle);
5085
5086                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5087                              sizeof(cp), &cp);
5088
5089                 hci_conn_hold(conn);
5090         } else {
5091                 conn->state = BT_CONNECTED;
5092                 hci_connect_cfm(conn, status);
5093         }
5094
5095         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5096                                            conn->dst_type);
5097         if (params) {
5098                 list_del_init(&params->action);
5099                 if (params->conn) {
5100                         hci_conn_drop(params->conn);
5101                         hci_conn_put(params->conn);
5102                         params->conn = NULL;
5103                 }
5104         }
5105
5106 unlock:
5107         hci_update_background_scan(hdev);
5108         hci_dev_unlock(hdev);
5109 }
5110
5111 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5112 {
5113         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5114
5115         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5116
5117         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5118                              ev->role, le16_to_cpu(ev->handle),
5119                              le16_to_cpu(ev->interval),
5120                              le16_to_cpu(ev->latency),
5121                              le16_to_cpu(ev->supervision_timeout));
5122 }
5123
5124 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5125                                          struct sk_buff *skb)
5126 {
5127         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5128
5129         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5130
5131         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5132                              ev->role, le16_to_cpu(ev->handle),
5133                              le16_to_cpu(ev->interval),
5134                              le16_to_cpu(ev->latency),
5135                              le16_to_cpu(ev->supervision_timeout));
5136 }
5137
5138 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5139 {
5140         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5141         struct hci_conn *conn;
5142
5143         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5144
5145         if (ev->status)
5146                 return;
5147
5148         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5149         if (conn) {
5150                 struct adv_info *adv_instance;
5151
5152                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM)
5153                         return;
5154
5155                 if (!hdev->cur_adv_instance) {
5156                         bacpy(&conn->resp_addr, &hdev->random_addr);
5157                         return;
5158                 }
5159
5160                 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
5161                 if (adv_instance)
5162                         bacpy(&conn->resp_addr, &adv_instance->random_addr);
5163         }
5164 }
5165
5166 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5167                                             struct sk_buff *skb)
5168 {
5169         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5170         struct hci_conn *conn;
5171
5172         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5173
5174         if (ev->status)
5175                 return;
5176
5177         hci_dev_lock(hdev);
5178
5179         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5180         if (conn) {
5181                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5182                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5183                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5184         }
5185
5186         hci_dev_unlock(hdev);
5187 }
5188
5189 /* This function requires the caller holds hdev->lock */
5190 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5191                                               bdaddr_t *addr,
5192                                               u8 addr_type, u8 adv_type,
5193                                               bdaddr_t *direct_rpa)
5194 {
5195         struct hci_conn *conn;
5196         struct hci_conn_params *params;
5197
5198         /* If the event is not connectable don't proceed further */
5199         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5200                 return NULL;
5201
5202         /* Ignore if the device is blocked */
5203         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
5204                 return NULL;
5205
5206         /* Most controller will fail if we try to create new connections
5207          * while we have an existing one in slave role.
5208          */
5209         if (hdev->conn_hash.le_num_slave > 0)
5210                 return NULL;
5211
5212         /* If we're not connectable only connect devices that we have in
5213          * our pend_le_conns list.
5214          */
5215         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5216                                            addr_type);
5217         if (!params)
5218                 return NULL;
5219
5220         if (!params->explicit_connect) {
5221                 switch (params->auto_connect) {
5222                 case HCI_AUTO_CONN_DIRECT:
5223                         /* Only devices advertising with ADV_DIRECT_IND are
5224                          * triggering a connection attempt. This is allowing
5225                          * incoming connections from slave devices.
5226                          */
5227                         if (adv_type != LE_ADV_DIRECT_IND)
5228                                 return NULL;
5229                         break;
5230                 case HCI_AUTO_CONN_ALWAYS:
5231                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5232                          * are triggering a connection attempt. This means
5233                          * that incoming connectioms from slave device are
5234                          * accepted and also outgoing connections to slave
5235                          * devices are established when found.
5236                          */
5237                         break;
5238                 default:
5239                         return NULL;
5240                 }
5241         }
5242
5243         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5244                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER,
5245                               direct_rpa);
5246         if (!IS_ERR(conn)) {
5247                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5248                  * by higher layer that tried to connect, if no then
5249                  * store the pointer since we don't really have any
5250                  * other owner of the object besides the params that
5251                  * triggered it. This way we can abort the connection if
5252                  * the parameters get removed and keep the reference
5253                  * count consistent once the connection is established.
5254                  */
5255
5256                 if (!params->explicit_connect)
5257                         params->conn = hci_conn_get(conn);
5258
5259                 return conn;
5260         }
5261
5262         switch (PTR_ERR(conn)) {
5263         case -EBUSY:
5264                 /* If hci_connect() returns -EBUSY it means there is already
5265                  * an LE connection attempt going on. Since controllers don't
5266                  * support more than one connection attempt at the time, we
5267                  * don't consider this an error case.
5268                  */
5269                 break;
5270         default:
5271                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5272                 return NULL;
5273         }
5274
5275         return NULL;
5276 }
5277
5278 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5279                                u8 bdaddr_type, bdaddr_t *direct_addr,
5280                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
5281 {
5282         struct discovery_state *d = &hdev->discovery;
5283         struct smp_irk *irk;
5284         struct hci_conn *conn;
5285         bool match;
5286         u32 flags;
5287         u8 *ptr, real_len;
5288
5289         switch (type) {
5290         case LE_ADV_IND:
5291         case LE_ADV_DIRECT_IND:
5292         case LE_ADV_SCAN_IND:
5293         case LE_ADV_NONCONN_IND:
5294         case LE_ADV_SCAN_RSP:
5295                 break;
5296         default:
5297                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5298                                        "type: 0x%02x", type);
5299                 return;
5300         }
5301
5302         /* Find the end of the data in case the report contains padded zero
5303          * bytes at the end causing an invalid length value.
5304          *
5305          * When data is NULL, len is 0 so there is no need for extra ptr
5306          * check as 'ptr < data + 0' is already false in such case.
5307          */
5308         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5309                 if (ptr + 1 + *ptr > data + len)
5310                         break;
5311         }
5312
5313         real_len = ptr - data;
5314
5315         /* Adjust for actual length */
5316         if (len != real_len) {
5317                 bt_dev_err_ratelimited(hdev, "advertising data len corrected");
5318                 len = real_len;
5319         }
5320
5321         /* If the direct address is present, then this report is from
5322          * a LE Direct Advertising Report event. In that case it is
5323          * important to see if the address is matching the local
5324          * controller address.
5325          */
5326         if (direct_addr) {
5327                 /* Only resolvable random addresses are valid for these
5328                  * kind of reports and others can be ignored.
5329                  */
5330                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5331                         return;
5332
5333                 /* If the controller is not using resolvable random
5334                  * addresses, then this report can be ignored.
5335                  */
5336                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5337                         return;
5338
5339                 /* If the local IRK of the controller does not match
5340                  * with the resolvable random address provided, then
5341                  * this report can be ignored.
5342                  */
5343                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5344                         return;
5345         }
5346
5347         /* Check if we need to convert to identity address */
5348         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5349         if (irk) {
5350                 bdaddr = &irk->bdaddr;
5351                 bdaddr_type = irk->addr_type;
5352         }
5353
5354         /* Check if we have been requested to connect to this device.
5355          *
5356          * direct_addr is set only for directed advertising reports (it is NULL
5357          * for advertising reports) and is already verified to be RPA above.
5358          */
5359         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5360                                                                 direct_addr);
5361         if (conn && type == LE_ADV_IND) {
5362                 /* Store report for later inclusion by
5363                  * mgmt_device_connected
5364                  */
5365                 memcpy(conn->le_adv_data, data, len);
5366                 conn->le_adv_data_len = len;
5367         }
5368
5369         /* Passive scanning shouldn't trigger any device found events,
5370          * except for devices marked as CONN_REPORT for which we do send
5371          * device found events.
5372          */
5373         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5374                 if (type == LE_ADV_DIRECT_IND)
5375                         return;
5376
5377                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5378                                                bdaddr, bdaddr_type))
5379                         return;
5380
5381                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5382                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5383                 else
5384                         flags = 0;
5385                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5386                                   rssi, flags, data, len, NULL, 0);
5387                 return;
5388         }
5389
5390         /* When receiving non-connectable or scannable undirected
5391          * advertising reports, this means that the remote device is
5392          * not connectable and then clearly indicate this in the
5393          * device found event.
5394          *
5395          * When receiving a scan response, then there is no way to
5396          * know if the remote device is connectable or not. However
5397          * since scan responses are merged with a previously seen
5398          * advertising report, the flags field from that report
5399          * will be used.
5400          *
5401          * In the really unlikely case that a controller get confused
5402          * and just sends a scan response event, then it is marked as
5403          * not connectable as well.
5404          */
5405         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5406             type == LE_ADV_SCAN_RSP)
5407                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5408         else
5409                 flags = 0;
5410
5411         /* If there's nothing pending either store the data from this
5412          * event or send an immediate device found event if the data
5413          * should not be stored for later.
5414          */
5415         if (!has_pending_adv_report(hdev)) {
5416                 /* If the report will trigger a SCAN_REQ store it for
5417                  * later merging.
5418                  */
5419                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5420                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5421                                                  rssi, flags, data, len);
5422                         return;
5423                 }
5424
5425                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5426                                   rssi, flags, data, len, NULL, 0);
5427                 return;
5428         }
5429
5430         /* Check if the pending report is for the same device as the new one */
5431         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5432                  bdaddr_type == d->last_adv_addr_type);
5433
5434         /* If the pending data doesn't match this report or this isn't a
5435          * scan response (e.g. we got a duplicate ADV_IND) then force
5436          * sending of the pending data.
5437          */
5438         if (type != LE_ADV_SCAN_RSP || !match) {
5439                 /* Send out whatever is in the cache, but skip duplicates */
5440                 if (!match)
5441                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5442                                           d->last_adv_addr_type, NULL,
5443                                           d->last_adv_rssi, d->last_adv_flags,
5444                                           d->last_adv_data,
5445                                           d->last_adv_data_len, NULL, 0);
5446
5447                 /* If the new report will trigger a SCAN_REQ store it for
5448                  * later merging.
5449                  */
5450                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5451                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5452                                                  rssi, flags, data, len);
5453                         return;
5454                 }
5455
5456                 /* The advertising reports cannot be merged, so clear
5457                  * the pending report and send out a device found event.
5458                  */
5459                 clear_pending_adv_report(hdev);
5460                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5461                                   rssi, flags, data, len, NULL, 0);
5462                 return;
5463         }
5464
5465         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5466          * the new event is a SCAN_RSP. We can therefore proceed with
5467          * sending a merged device found event.
5468          */
5469         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5470                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5471                           d->last_adv_data, d->last_adv_data_len, data, len);
5472         clear_pending_adv_report(hdev);
5473 }
5474
5475 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5476 {
5477         u8 num_reports = skb->data[0];
5478         void *ptr = &skb->data[1];
5479
5480         hci_dev_lock(hdev);
5481
5482         while (num_reports--) {
5483                 struct hci_ev_le_advertising_info *ev = ptr;
5484                 s8 rssi;
5485
5486                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5487                         rssi = ev->data[ev->length];
5488                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5489                                            ev->bdaddr_type, NULL, 0, rssi,
5490                                            ev->data, ev->length);
5491                 } else {
5492                         bt_dev_err(hdev, "Dropping invalid advertising data");
5493                 }
5494
5495                 ptr += sizeof(*ev) + ev->length + 1;
5496         }
5497
5498         hci_dev_unlock(hdev);
5499 }
5500
5501 static u8 ext_evt_type_to_legacy(u16 evt_type)
5502 {
5503         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5504                 switch (evt_type) {
5505                 case LE_LEGACY_ADV_IND:
5506                         return LE_ADV_IND;
5507                 case LE_LEGACY_ADV_DIRECT_IND:
5508                         return LE_ADV_DIRECT_IND;
5509                 case LE_LEGACY_ADV_SCAN_IND:
5510                         return LE_ADV_SCAN_IND;
5511                 case LE_LEGACY_NONCONN_IND:
5512                         return LE_ADV_NONCONN_IND;
5513                 case LE_LEGACY_SCAN_RSP_ADV:
5514                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5515                         return LE_ADV_SCAN_RSP;
5516                 }
5517
5518                 BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5519                                    evt_type);
5520
5521                 return LE_ADV_INVALID;
5522         }
5523
5524         if (evt_type & LE_EXT_ADV_CONN_IND) {
5525                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5526                         return LE_ADV_DIRECT_IND;
5527
5528                 return LE_ADV_IND;
5529         }
5530
5531         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5532                 return LE_ADV_SCAN_RSP;
5533
5534         if (evt_type & LE_EXT_ADV_SCAN_IND)
5535                 return LE_ADV_SCAN_IND;
5536
5537         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5538             evt_type & LE_EXT_ADV_DIRECT_IND)
5539                 return LE_ADV_NONCONN_IND;
5540
5541         BT_ERR_RATELIMITED("Unknown advertising packet type: 0x%02x",
5542                                    evt_type);
5543
5544         return LE_ADV_INVALID;
5545 }
5546
5547 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5548 {
5549         u8 num_reports = skb->data[0];
5550         void *ptr = &skb->data[1];
5551
5552         hci_dev_lock(hdev);
5553
5554         while (num_reports--) {
5555                 struct hci_ev_le_ext_adv_report *ev = ptr;
5556                 u8 legacy_evt_type;
5557                 u16 evt_type;
5558
5559                 evt_type = __le16_to_cpu(ev->evt_type);
5560                 legacy_evt_type = ext_evt_type_to_legacy(evt_type);
5561                 if (legacy_evt_type != LE_ADV_INVALID) {
5562                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5563                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5564                                            ev->data, ev->length);
5565                 }
5566
5567                 ptr += sizeof(*ev) + ev->length;
5568         }
5569
5570         hci_dev_unlock(hdev);
5571 }
5572
5573 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5574                                             struct sk_buff *skb)
5575 {
5576         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5577         struct hci_conn *conn;
5578
5579         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5580
5581         hci_dev_lock(hdev);
5582
5583         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5584         if (conn) {
5585                 if (!ev->status)
5586                         memcpy(conn->features[0], ev->features, 8);
5587
5588                 if (conn->state == BT_CONFIG) {
5589                         __u8 status;
5590
5591                         /* If the local controller supports slave-initiated
5592                          * features exchange, but the remote controller does
5593                          * not, then it is possible that the error code 0x1a
5594                          * for unsupported remote feature gets returned.
5595                          *
5596                          * In this specific case, allow the connection to
5597                          * transition into connected state and mark it as
5598                          * successful.
5599                          */
5600                         if ((hdev->le_features[0] & HCI_LE_SLAVE_FEATURES) &&
5601                             !conn->out && ev->status == 0x1a)
5602                                 status = 0x00;
5603                         else
5604                                 status = ev->status;
5605
5606                         conn->state = BT_CONNECTED;
5607                         hci_connect_cfm(conn, status);
5608                         hci_conn_drop(conn);
5609                 }
5610         }
5611
5612         hci_dev_unlock(hdev);
5613 }
5614
5615 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5616 {
5617         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5618         struct hci_cp_le_ltk_reply cp;
5619         struct hci_cp_le_ltk_neg_reply neg;
5620         struct hci_conn *conn;
5621         struct smp_ltk *ltk;
5622
5623         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5624
5625         hci_dev_lock(hdev);
5626
5627         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5628         if (conn == NULL)
5629                 goto not_found;
5630
5631         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5632         if (!ltk)
5633                 goto not_found;
5634
5635         if (smp_ltk_is_sc(ltk)) {
5636                 /* With SC both EDiv and Rand are set to zero */
5637                 if (ev->ediv || ev->rand)
5638                         goto not_found;
5639         } else {
5640                 /* For non-SC keys check that EDiv and Rand match */
5641                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5642                         goto not_found;
5643         }
5644
5645         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5646         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5647         cp.handle = cpu_to_le16(conn->handle);
5648
5649         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5650
5651         conn->enc_key_size = ltk->enc_size;
5652
5653         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5654
5655         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5656          * temporary key used to encrypt a connection following
5657          * pairing. It is used during the Encrypted Session Setup to
5658          * distribute the keys. Later, security can be re-established
5659          * using a distributed LTK.
5660          */
5661         if (ltk->type == SMP_STK) {
5662                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5663                 list_del_rcu(&ltk->list);
5664                 kfree_rcu(ltk, rcu);
5665         } else {
5666                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5667         }
5668
5669         hci_dev_unlock(hdev);
5670
5671         return;
5672
5673 not_found:
5674         neg.handle = ev->handle;
5675         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5676         hci_dev_unlock(hdev);
5677 }
5678
5679 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5680                                       u8 reason)
5681 {
5682         struct hci_cp_le_conn_param_req_neg_reply cp;
5683
5684         cp.handle = cpu_to_le16(handle);
5685         cp.reason = reason;
5686
5687         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5688                      &cp);
5689 }
5690
5691 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5692                                              struct sk_buff *skb)
5693 {
5694         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5695         struct hci_cp_le_conn_param_req_reply cp;
5696         struct hci_conn *hcon;
5697         u16 handle, min, max, latency, timeout;
5698
5699         handle = le16_to_cpu(ev->handle);
5700         min = le16_to_cpu(ev->interval_min);
5701         max = le16_to_cpu(ev->interval_max);
5702         latency = le16_to_cpu(ev->latency);
5703         timeout = le16_to_cpu(ev->timeout);
5704
5705         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5706         if (!hcon || hcon->state != BT_CONNECTED)
5707                 return send_conn_param_neg_reply(hdev, handle,
5708                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5709
5710         if (hci_check_conn_params(min, max, latency, timeout))
5711                 return send_conn_param_neg_reply(hdev, handle,
5712                                                  HCI_ERROR_INVALID_LL_PARAMS);
5713
5714         if (hcon->role == HCI_ROLE_MASTER) {
5715                 struct hci_conn_params *params;
5716                 u8 store_hint;
5717
5718                 hci_dev_lock(hdev);
5719
5720                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5721                                                 hcon->dst_type);
5722                 if (params) {
5723                         params->conn_min_interval = min;
5724                         params->conn_max_interval = max;
5725                         params->conn_latency = latency;
5726                         params->supervision_timeout = timeout;
5727                         store_hint = 0x01;
5728                 } else{
5729                         store_hint = 0x00;
5730                 }
5731
5732                 hci_dev_unlock(hdev);
5733
5734                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5735                                     store_hint, min, max, latency, timeout);
5736         }
5737
5738         cp.handle = ev->handle;
5739         cp.interval_min = ev->interval_min;
5740         cp.interval_max = ev->interval_max;
5741         cp.latency = ev->latency;
5742         cp.timeout = ev->timeout;
5743         cp.min_ce_len = 0;
5744         cp.max_ce_len = 0;
5745
5746         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5747 }
5748
5749 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5750                                          struct sk_buff *skb)
5751 {
5752         u8 num_reports = skb->data[0];
5753         void *ptr = &skb->data[1];
5754
5755         hci_dev_lock(hdev);
5756
5757         while (num_reports--) {
5758                 struct hci_ev_le_direct_adv_info *ev = ptr;
5759
5760                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5761                                    ev->bdaddr_type, &ev->direct_addr,
5762                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5763
5764                 ptr += sizeof(*ev);
5765         }
5766
5767         hci_dev_unlock(hdev);
5768 }
5769
5770 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5771 {
5772         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5773
5774         skb_pull(skb, sizeof(*le_ev));
5775
5776         switch (le_ev->subevent) {
5777         case HCI_EV_LE_CONN_COMPLETE:
5778                 hci_le_conn_complete_evt(hdev, skb);
5779                 break;
5780
5781         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5782                 hci_le_conn_update_complete_evt(hdev, skb);
5783                 break;
5784
5785         case HCI_EV_LE_ADVERTISING_REPORT:
5786                 hci_le_adv_report_evt(hdev, skb);
5787                 break;
5788
5789         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
5790                 hci_le_remote_feat_complete_evt(hdev, skb);
5791                 break;
5792
5793         case HCI_EV_LE_LTK_REQ:
5794                 hci_le_ltk_request_evt(hdev, skb);
5795                 break;
5796
5797         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5798                 hci_le_remote_conn_param_req_evt(hdev, skb);
5799                 break;
5800
5801         case HCI_EV_LE_DIRECT_ADV_REPORT:
5802                 hci_le_direct_adv_report_evt(hdev, skb);
5803                 break;
5804
5805         case HCI_EV_LE_EXT_ADV_REPORT:
5806                 hci_le_ext_adv_report_evt(hdev, skb);
5807                 break;
5808
5809         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
5810                 hci_le_enh_conn_complete_evt(hdev, skb);
5811                 break;
5812
5813         case HCI_EV_LE_EXT_ADV_SET_TERM:
5814                 hci_le_ext_adv_term_evt(hdev, skb);
5815                 break;
5816
5817         default:
5818                 break;
5819         }
5820 }
5821
5822 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
5823                                  u8 event, struct sk_buff *skb)
5824 {
5825         struct hci_ev_cmd_complete *ev;
5826         struct hci_event_hdr *hdr;
5827
5828         if (!skb)
5829                 return false;
5830
5831         if (skb->len < sizeof(*hdr)) {
5832                 bt_dev_err(hdev, "too short HCI event");
5833                 return false;
5834         }
5835
5836         hdr = (void *) skb->data;
5837         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5838
5839         if (event) {
5840                 if (hdr->evt != event)
5841                         return false;
5842                 return true;
5843         }
5844
5845         /* Check if request ended in Command Status - no way to retreive
5846          * any extra parameters in this case.
5847          */
5848         if (hdr->evt == HCI_EV_CMD_STATUS)
5849                 return false;
5850
5851         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
5852                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
5853                            hdr->evt);
5854                 return false;
5855         }
5856
5857         if (skb->len < sizeof(*ev)) {
5858                 bt_dev_err(hdev, "too short cmd_complete event");
5859                 return false;
5860         }
5861
5862         ev = (void *) skb->data;
5863         skb_pull(skb, sizeof(*ev));
5864
5865         if (opcode != __le16_to_cpu(ev->opcode)) {
5866                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
5867                        __le16_to_cpu(ev->opcode));
5868                 return false;
5869         }
5870
5871         return true;
5872 }
5873
5874 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5875 {
5876         struct hci_event_hdr *hdr = (void *) skb->data;
5877         hci_req_complete_t req_complete = NULL;
5878         hci_req_complete_skb_t req_complete_skb = NULL;
5879         struct sk_buff *orig_skb = NULL;
5880         u8 status = 0, event = hdr->evt, req_evt = 0;
5881         u16 opcode = HCI_OP_NOP;
5882
5883         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
5884                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5885                 opcode = __le16_to_cpu(cmd_hdr->opcode);
5886                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
5887                                      &req_complete_skb);
5888                 req_evt = event;
5889         }
5890
5891         /* If it looks like we might end up having to call
5892          * req_complete_skb, store a pristine copy of the skb since the
5893          * various handlers may modify the original one through
5894          * skb_pull() calls, etc.
5895          */
5896         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
5897             event == HCI_EV_CMD_COMPLETE)
5898                 orig_skb = skb_clone(skb, GFP_KERNEL);
5899
5900         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5901
5902         switch (event) {
5903         case HCI_EV_INQUIRY_COMPLETE:
5904                 hci_inquiry_complete_evt(hdev, skb);
5905                 break;
5906
5907         case HCI_EV_INQUIRY_RESULT:
5908                 hci_inquiry_result_evt(hdev, skb);
5909                 break;
5910
5911         case HCI_EV_CONN_COMPLETE:
5912                 hci_conn_complete_evt(hdev, skb);
5913                 break;
5914
5915         case HCI_EV_CONN_REQUEST:
5916                 hci_conn_request_evt(hdev, skb);
5917                 break;
5918
5919         case HCI_EV_DISCONN_COMPLETE:
5920                 hci_disconn_complete_evt(hdev, skb);
5921                 break;
5922
5923         case HCI_EV_AUTH_COMPLETE:
5924                 hci_auth_complete_evt(hdev, skb);
5925                 break;
5926
5927         case HCI_EV_REMOTE_NAME:
5928                 hci_remote_name_evt(hdev, skb);
5929                 break;
5930
5931         case HCI_EV_ENCRYPT_CHANGE:
5932                 hci_encrypt_change_evt(hdev, skb);
5933                 break;
5934
5935         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5936                 hci_change_link_key_complete_evt(hdev, skb);
5937                 break;
5938
5939         case HCI_EV_REMOTE_FEATURES:
5940                 hci_remote_features_evt(hdev, skb);
5941                 break;
5942
5943         case HCI_EV_CMD_COMPLETE:
5944                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
5945                                      &req_complete, &req_complete_skb);
5946                 break;
5947
5948         case HCI_EV_CMD_STATUS:
5949                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
5950                                    &req_complete_skb);
5951                 break;
5952
5953         case HCI_EV_HARDWARE_ERROR:
5954                 hci_hardware_error_evt(hdev, skb);
5955                 break;
5956
5957         case HCI_EV_ROLE_CHANGE:
5958                 hci_role_change_evt(hdev, skb);
5959                 break;
5960
5961         case HCI_EV_NUM_COMP_PKTS:
5962                 hci_num_comp_pkts_evt(hdev, skb);
5963                 break;
5964
5965         case HCI_EV_MODE_CHANGE:
5966                 hci_mode_change_evt(hdev, skb);
5967                 break;
5968
5969         case HCI_EV_PIN_CODE_REQ:
5970                 hci_pin_code_request_evt(hdev, skb);
5971                 break;
5972
5973         case HCI_EV_LINK_KEY_REQ:
5974                 hci_link_key_request_evt(hdev, skb);
5975                 break;
5976
5977         case HCI_EV_LINK_KEY_NOTIFY:
5978                 hci_link_key_notify_evt(hdev, skb);
5979                 break;
5980
5981         case HCI_EV_CLOCK_OFFSET:
5982                 hci_clock_offset_evt(hdev, skb);
5983                 break;
5984
5985         case HCI_EV_PKT_TYPE_CHANGE:
5986                 hci_pkt_type_change_evt(hdev, skb);
5987                 break;
5988
5989         case HCI_EV_PSCAN_REP_MODE:
5990                 hci_pscan_rep_mode_evt(hdev, skb);
5991                 break;
5992
5993         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5994                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5995                 break;
5996
5997         case HCI_EV_REMOTE_EXT_FEATURES:
5998                 hci_remote_ext_features_evt(hdev, skb);
5999                 break;
6000
6001         case HCI_EV_SYNC_CONN_COMPLETE:
6002                 hci_sync_conn_complete_evt(hdev, skb);
6003                 break;
6004
6005         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6006                 hci_extended_inquiry_result_evt(hdev, skb);
6007                 break;
6008
6009         case HCI_EV_KEY_REFRESH_COMPLETE:
6010                 hci_key_refresh_complete_evt(hdev, skb);
6011                 break;
6012
6013         case HCI_EV_IO_CAPA_REQUEST:
6014                 hci_io_capa_request_evt(hdev, skb);
6015                 break;
6016
6017         case HCI_EV_IO_CAPA_REPLY:
6018                 hci_io_capa_reply_evt(hdev, skb);
6019                 break;
6020
6021         case HCI_EV_USER_CONFIRM_REQUEST:
6022                 hci_user_confirm_request_evt(hdev, skb);
6023                 break;
6024
6025         case HCI_EV_USER_PASSKEY_REQUEST:
6026                 hci_user_passkey_request_evt(hdev, skb);
6027                 break;
6028
6029         case HCI_EV_USER_PASSKEY_NOTIFY:
6030                 hci_user_passkey_notify_evt(hdev, skb);
6031                 break;
6032
6033         case HCI_EV_KEYPRESS_NOTIFY:
6034                 hci_keypress_notify_evt(hdev, skb);
6035                 break;
6036
6037         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6038                 hci_simple_pair_complete_evt(hdev, skb);
6039                 break;
6040
6041         case HCI_EV_REMOTE_HOST_FEATURES:
6042                 hci_remote_host_features_evt(hdev, skb);
6043                 break;
6044
6045         case HCI_EV_LE_META:
6046                 hci_le_meta_evt(hdev, skb);
6047                 break;
6048
6049         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6050                 hci_remote_oob_data_request_evt(hdev, skb);
6051                 break;
6052
6053 #if IS_ENABLED(CONFIG_BT_HS)
6054         case HCI_EV_CHANNEL_SELECTED:
6055                 hci_chan_selected_evt(hdev, skb);
6056                 break;
6057
6058         case HCI_EV_PHY_LINK_COMPLETE:
6059                 hci_phy_link_complete_evt(hdev, skb);
6060                 break;
6061
6062         case HCI_EV_LOGICAL_LINK_COMPLETE:
6063                 hci_loglink_complete_evt(hdev, skb);
6064                 break;
6065
6066         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6067                 hci_disconn_loglink_complete_evt(hdev, skb);
6068                 break;
6069
6070         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6071                 hci_disconn_phylink_complete_evt(hdev, skb);
6072                 break;
6073 #endif
6074
6075         case HCI_EV_NUM_COMP_BLOCKS:
6076                 hci_num_comp_blocks_evt(hdev, skb);
6077                 break;
6078
6079         default:
6080                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6081                 break;
6082         }
6083
6084         if (req_complete) {
6085                 req_complete(hdev, status, opcode);
6086         } else if (req_complete_skb) {
6087                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6088                         kfree_skb(orig_skb);
6089                         orig_skb = NULL;
6090                 }
6091                 req_complete_skb(hdev, status, opcode, orig_skb);
6092         }
6093
6094         kfree_skb(orig_skb);
6095         kfree_skb(skb);
6096         hdev->stat.evt_rx++;
6097 }