net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  44
  45 /* Handle HCI Event packets */
  46
  47 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  48                                   u8 *new_status)
  49 {
  50         __u8 status = *((__u8 *) skb->data);
  51
  52         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  53
  54         /* It is possible that we receive Inquiry Complete event right
  55          * before we receive Inquiry Cancel Command Complete event, in
  56          * which case the latter event should have status of Command
  57          * Disallowed (0x0c). This should not be treated as error, since
  58          * we actually achieve what Inquiry Cancel wants to achieve,
  59          * which is to end the last Inquiry session.
  60          */
  61         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  62                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  63                 status = 0x00;
  64         }
  65
  66         *new_status = status;
  67
  68         if (status)
  69                 return;
  70
  71         clear_bit(HCI_INQUIRY, &hdev->flags);
  72         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  73         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  74
  75         hci_dev_lock(hdev);
  76         /* Set discovery state to stopped if we're not doing LE active
  77          * scanning.
  78          */
  79         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  80             hdev->le_scan_type != LE_SCAN_ACTIVE)
  81                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  82         hci_dev_unlock(hdev);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         __u8 status = *((__u8 *) skb->data);
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  92
  93         if (status)
  94                 return;
  95
  96         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  97 }
  98
  99 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 100 {
 101         __u8 status = *((__u8 *) skb->data);
 102
 103         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 104
 105         if (status)
 106                 return;
 107
 108         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 109
 110         hci_conn_check_pending(hdev);
 111 }
 112
 113 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 114                                           struct sk_buff *skb)
 115 {
 116         BT_DBG("%s", hdev->name);
 117 }
 118
 119 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 120 {
 121         struct hci_rp_role_discovery *rp = (void *) skb->data;
 122         struct hci_conn *conn;
 123
 124         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 125
 126         if (rp->status)
 127                 return;
 128
 129         hci_dev_lock(hdev);
 130
 131         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 132         if (conn)
 133                 conn->role = rp->role;
 134
 135         hci_dev_unlock(hdev);
 136 }
 137
 138 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 139 {
 140         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 141         struct hci_conn *conn;
 142
 143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 144
 145         if (rp->status)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = __le16_to_cpu(rp->policy);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 160         struct hci_conn *conn;
 161         void *sent;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 169         if (!sent)
 170                 return;
 171
 172         hci_dev_lock(hdev);
 173
 174         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 175         if (conn)
 176                 conn->link_policy = get_unaligned_le16(sent + 2);
 177
 178         hci_dev_unlock(hdev);
 179 }
 180
 181 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 182                                         struct sk_buff *skb)
 183 {
 184         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 185
 186         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 187
 188         if (rp->status)
 189                 return;
 190
 191         hdev->link_policy = __le16_to_cpu(rp->policy);
 192 }
 193
 194 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 195                                          struct sk_buff *skb)
 196 {
 197         __u8 status = *((__u8 *) skb->data);
 198         void *sent;
 199
 200         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 201
 202         if (status)
 203                 return;
 204
 205         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 206         if (!sent)
 207                 return;
 208
 209         hdev->link_policy = get_unaligned_le16(sent);
 210 }
 211
 212 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 213 {
 214         __u8 status = *((__u8 *) skb->data);
 215
 216         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 217
 218         clear_bit(HCI_RESET, &hdev->flags);
 219
 220         if (status)
 221                 return;
 222
 223         /* Reset all non-persistent flags */
 224         hci_dev_clear_volatile_flags(hdev);
 225
 226         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 227
 228         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 229         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 230
 231         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 232         hdev->adv_data_len = 0;
 233
 234         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 235         hdev->scan_rsp_data_len = 0;
 236
 237         hdev->le_scan_type = LE_SCAN_PASSIVE;
 238
 239         hdev->ssp_debug_mode = 0;
 240
 241         hci_bdaddr_list_clear(&hdev->le_accept_list);
 242         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 243 }
 244
 245 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 246                                         struct sk_buff *skb)
 247 {
 248         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 249         struct hci_cp_read_stored_link_key *sent;
 250
 251         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 254         if (!sent)
 255                 return;
 256
 257         if (!rp->status && sent->read_all == 0x01) {
 258                 hdev->stored_max_keys = rp->max_keys;
 259                 hdev->stored_num_keys = rp->num_keys;
 260         }
 261 }
 262
 263 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 264                                           struct sk_buff *skb)
 265 {
 266         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 267
 268         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 269
 270         if (rp->status)
 271                 return;
 272
 273         if (rp->num_keys <= hdev->stored_num_keys)
 274                 hdev->stored_num_keys -= rp->num_keys;
 275         else
 276                 hdev->stored_num_keys = 0;
 277 }
 278
 279 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 280 {
 281         __u8 status = *((__u8 *) skb->data);
 282         void *sent;
 283
 284         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 285
 286         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 287         if (!sent)
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         if (hci_dev_test_flag(hdev, HCI_MGMT))
 293                 mgmt_set_local_name_complete(hdev, sent, status);
 294         else if (!status)
 295                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 296
 297         hci_dev_unlock(hdev);
 298 }
 299
 300 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_local_name *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 310             hci_dev_test_flag(hdev, HCI_CONFIG))
 311                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 312 }
 313
 314 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 315 {
 316         __u8 status = *((__u8 *) skb->data);
 317         void *sent;
 318
 319         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 320
 321         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 322         if (!sent)
 323                 return;
 324
 325         hci_dev_lock(hdev);
 326
 327         if (!status) {
 328                 __u8 param = *((__u8 *) sent);
 329
 330                 if (param == AUTH_ENABLED)
 331                         set_bit(HCI_AUTH, &hdev->flags);
 332                 else
 333                         clear_bit(HCI_AUTH, &hdev->flags);
 334         }
 335
 336         if (hci_dev_test_flag(hdev, HCI_MGMT))
 337                 mgmt_auth_enable_complete(hdev, status);
 338
 339         hci_dev_unlock(hdev);
 340 }
 341
 342 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 343 {
 344         __u8 status = *((__u8 *) skb->data);
 345         __u8 param;
 346         void *sent;
 347
 348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 349
 350         if (status)
 351                 return;
 352
 353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 354         if (!sent)
 355                 return;
 356
 357         param = *((__u8 *) sent);
 358
 359         if (param)
 360                 set_bit(HCI_ENCRYPT, &hdev->flags);
 361         else
 362                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 363 }
 364
 365 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 366 {
 367         __u8 status = *((__u8 *) skb->data);
 368         __u8 param;
 369         void *sent;
 370
 371         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 372
 373         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 374         if (!sent)
 375                 return;
 376
 377         param = *((__u8 *) sent);
 378
 379         hci_dev_lock(hdev);
 380
 381         if (status) {
 382                 hdev->discov_timeout = 0;
 383                 goto done;
 384         }
 385
 386         if (param & SCAN_INQUIRY)
 387                 set_bit(HCI_ISCAN, &hdev->flags);
 388         else
 389                 clear_bit(HCI_ISCAN, &hdev->flags);
 390
 391         if (param & SCAN_PAGE)
 392                 set_bit(HCI_PSCAN, &hdev->flags);
 393         else
 394                 clear_bit(HCI_PSCAN, &hdev->flags);
 395
 396 done:
 397         hci_dev_unlock(hdev);
 398 }
 399
 400 static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *)skb->data);
 403         struct hci_cp_set_event_filter *cp;
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 412         if (!sent)
 413                 return;
 414
 415         cp = (struct hci_cp_set_event_filter *)sent;
 416
 417         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 418                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 419         else
 420                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 421 }
 422
 423 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 426
 427         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 428
 429         if (rp->status)
 430                 return;
 431
 432         memcpy(hdev->dev_class, rp->dev_class, 3);
 433
 434         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 435                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 436 }
 437
 438 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 446         if (!sent)
 447                 return;
 448
 449         hci_dev_lock(hdev);
 450
 451         if (status == 0)
 452                 memcpy(hdev->dev_class, sent, 3);
 453
 454         if (hci_dev_test_flag(hdev, HCI_MGMT))
 455                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 456
 457         hci_dev_unlock(hdev);
 458 }
 459
 460 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 461 {
 462         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 463         __u16 setting;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 466
 467         if (rp->status)
 468                 return;
 469
 470         setting = __le16_to_cpu(rp->voice_setting);
 471
 472         if (hdev->voice_setting == setting)
 473                 return;
 474
 475         hdev->voice_setting = setting;
 476
 477         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 478
 479         if (hdev->notify)
 480                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 481 }
 482
 483 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 484                                        struct sk_buff *skb)
 485 {
 486         __u8 status = *((__u8 *) skb->data);
 487         __u16 setting;
 488         void *sent;
 489
 490         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 491
 492         if (status)
 493                 return;
 494
 495         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 496         if (!sent)
 497                 return;
 498
 499         setting = get_unaligned_le16(sent);
 500
 501         if (hdev->voice_setting == setting)
 502                 return;
 503
 504         hdev->voice_setting = setting;
 505
 506         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 507
 508         if (hdev->notify)
 509                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 510 }
 511
 512 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 513                                           struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 518
 519         if (rp->status)
 520                 return;
 521
 522         hdev->num_iac = rp->num_iac;
 523
 524         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 525 }
 526
 527 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 528 {
 529         __u8 status = *((__u8 *) skb->data);
 530         struct hci_cp_write_ssp_mode *sent;
 531
 532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 533
 534         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 535         if (!sent)
 536                 return;
 537
 538         hci_dev_lock(hdev);
 539
 540         if (!status) {
 541                 if (sent->mode)
 542                         hdev->features[1][0] |= LMP_HOST_SSP;
 543                 else
 544                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 545         }
 546
 547         if (hci_dev_test_flag(hdev, HCI_MGMT))
 548                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 549         else if (!status) {
 550                 if (sent->mode)
 551                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 552                 else
 553                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 554         }
 555
 556         hci_dev_unlock(hdev);
 557 }
 558
 559 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 560 {
 561         u8 status = *((u8 *) skb->data);
 562         struct hci_cp_write_sc_support *sent;
 563
 564         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 565
 566         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 567         if (!sent)
 568                 return;
 569
 570         hci_dev_lock(hdev);
 571
 572         if (!status) {
 573                 if (sent->support)
 574                         hdev->features[1][0] |= LMP_HOST_SC;
 575                 else
 576                         hdev->features[1][0] &= ~LMP_HOST_SC;
 577         }
 578
 579         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 580                 if (sent->support)
 581                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 582                 else
 583                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 584         }
 585
 586         hci_dev_unlock(hdev);
 587 }
 588
 589 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 590 {
 591         struct hci_rp_read_local_version *rp = (void *) skb->data;
 592
 593         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 594
 595         if (rp->status)
 596                 return;
 597
 598         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 599             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 600                 hdev->hci_ver = rp->hci_ver;
 601                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 602                 hdev->lmp_ver = rp->lmp_ver;
 603                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 604                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 605         }
 606 }
 607
 608 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 609                                        struct sk_buff *skb)
 610 {
 611         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 612
 613         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 614
 615         if (rp->status)
 616                 return;
 617
 618         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 619             hci_dev_test_flag(hdev, HCI_CONFIG))
 620                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 621 }
 622
 623 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 624                                              struct sk_buff *skb)
 625 {
 626         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 627         struct hci_conn *conn;
 628
 629         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 630
 631         if (rp->status)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 644                                               struct sk_buff *skb)
 645 {
 646         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 647         struct hci_conn *conn;
 648         void *sent;
 649
 650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 656         if (!sent)
 657                 return;
 658
 659         hci_dev_lock(hdev);
 660
 661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 662         if (conn)
 663                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 664
 665         hci_dev_unlock(hdev);
 666 }
 667
 668 static void hci_cc_read_local_features(struct hci_dev *hdev,
 669                                        struct sk_buff *skb)
 670 {
 671         struct hci_rp_read_local_features *rp = (void *) skb->data;
 672
 673         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 674
 675         if (rp->status)
 676                 return;
 677
 678         memcpy(hdev->features, rp->features, 8);
 679
 680         /* Adjust default settings according to features
 681          * supported by device. */
 682
 683         if (hdev->features[0][0] & LMP_3SLOT)
 684                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 685
 686         if (hdev->features[0][0] & LMP_5SLOT)
 687                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 688
 689         if (hdev->features[0][1] & LMP_HV2) {
 690                 hdev->pkt_type  |= (HCI_HV2);
 691                 hdev->esco_type |= (ESCO_HV2);
 692         }
 693
 694         if (hdev->features[0][1] & LMP_HV3) {
 695                 hdev->pkt_type  |= (HCI_HV3);
 696                 hdev->esco_type |= (ESCO_HV3);
 697         }
 698
 699         if (lmp_esco_capable(hdev))
 700                 hdev->esco_type |= (ESCO_EV3);
 701
 702         if (hdev->features[0][4] & LMP_EV4)
 703                 hdev->esco_type |= (ESCO_EV4);
 704
 705         if (hdev->features[0][4] & LMP_EV5)
 706                 hdev->esco_type |= (ESCO_EV5);
 707
 708         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 709                 hdev->esco_type |= (ESCO_2EV3);
 710
 711         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 712                 hdev->esco_type |= (ESCO_3EV3);
 713
 714         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 715                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 716 }
 717
 718 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 719                                            struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 return;
 727
 728         if (hdev->max_page < rp->max_page)
 729                 hdev->max_page = rp->max_page;
 730
 731         if (rp->page < HCI_MAX_PAGES)
 732                 memcpy(hdev->features[rp->page], rp->features, 8);
 733 }
 734
 735 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 736                                           struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 741
 742         if (rp->status)
 743                 return;
 744
 745         hdev->flow_ctl_mode = rp->mode;
 746 }
 747
 748 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 751
 752         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 753
 754         if (rp->status)
 755                 return;
 756
 757         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 758         hdev->sco_mtu  = rp->sco_mtu;
 759         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 760         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 761
 762         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 763                 hdev->sco_mtu  = 64;
 764                 hdev->sco_pkts = 8;
 765         }
 766
 767         hdev->acl_cnt = hdev->acl_pkts;
 768         hdev->sco_cnt = hdev->sco_pkts;
 769
 770         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 771                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 772 }
 773
 774 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         if (test_bit(HCI_INIT, &hdev->flags))
 784                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 785
 786         if (hci_dev_test_flag(hdev, HCI_SETUP))
 787                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 788 }
 789
 790 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 791                                            struct sk_buff *skb)
 792 {
 793         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 794
 795         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 796
 797         if (rp->status)
 798                 return;
 799
 800         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 801             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 802                 hdev->pairing_opts = rp->pairing_opts;
 803                 hdev->max_enc_key_size = rp->max_key_size;
 804         }
 805 }
 806
 807 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 808                                            struct sk_buff *skb)
 809 {
 810         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 811
 812         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 813
 814         if (rp->status)
 815                 return;
 816
 817         if (test_bit(HCI_INIT, &hdev->flags)) {
 818                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 819                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 820         }
 821 }
 822
 823 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 824                                             struct sk_buff *skb)
 825 {
 826         u8 status = *((u8 *) skb->data);
 827         struct hci_cp_write_page_scan_activity *sent;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 830
 831         if (status)
 832                 return;
 833
 834         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 835         if (!sent)
 836                 return;
 837
 838         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 839         hdev->page_scan_window = __le16_to_cpu(sent->window);
 840 }
 841
 842 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 843                                            struct sk_buff *skb)
 844 {
 845         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 846
 847         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 848
 849         if (rp->status)
 850                 return;
 851
 852         if (test_bit(HCI_INIT, &hdev->flags))
 853                 hdev->page_scan_type = rp->type;
 854 }
 855
 856 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 857                                         struct sk_buff *skb)
 858 {
 859         u8 status = *((u8 *) skb->data);
 860         u8 *type;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 863
 864         if (status)
 865                 return;
 866
 867         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 868         if (type)
 869                 hdev->page_scan_type = *type;
 870 }
 871
 872 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 873                                         struct sk_buff *skb)
 874 {
 875         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         if (rp->status)
 880                 return;
 881
 882         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 883         hdev->block_len = __le16_to_cpu(rp->block_len);
 884         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 885
 886         hdev->block_cnt = hdev->num_blocks;
 887
 888         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 889                hdev->block_cnt, hdev->block_len);
 890 }
 891
 892 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_read_clock *rp = (void *) skb->data;
 895         struct hci_cp_read_clock *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s", hdev->name);
 899
 900         if (skb->len < sizeof(*rp))
 901                 return;
 902
 903         if (rp->status)
 904                 return;
 905
 906         hci_dev_lock(hdev);
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 909         if (!cp)
 910                 goto unlock;
 911
 912         if (cp->which == 0x00) {
 913                 hdev->clock = le32_to_cpu(rp->clock);
 914                 goto unlock;
 915         }
 916
 917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 918         if (conn) {
 919                 conn->clock = le32_to_cpu(rp->clock);
 920                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 921         }
 922
 923 unlock:
 924         hci_dev_unlock(hdev);
 925 }
 926
 927 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 928                                        struct sk_buff *skb)
 929 {
 930         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 931
 932         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 933
 934         if (rp->status)
 935                 return;
 936
 937         hdev->amp_status = rp->amp_status;
 938         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 939         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 940         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 941         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 942         hdev->amp_type = rp->amp_type;
 943         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 944         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 945         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 946         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 947 }
 948
 949 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 950                                          struct sk_buff *skb)
 951 {
 952         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 953
 954         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 955
 956         if (rp->status)
 957                 return;
 958
 959         hdev->inq_tx_power = rp->tx_power;
 960 }
 961
 962 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 963                                                struct sk_buff *skb)
 964 {
 965         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 966
 967         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 968
 969         if (rp->status)
 970                 return;
 971
 972         hdev->err_data_reporting = rp->err_data_reporting;
 973 }
 974
 975 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 976                                                 struct sk_buff *skb)
 977 {
 978         __u8 status = *((__u8 *)skb->data);
 979         struct hci_cp_write_def_err_data_reporting *cp;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 982
 983         if (status)
 984                 return;
 985
 986         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 987         if (!cp)
 988                 return;
 989
 990         hdev->err_data_reporting = cp->err_data_reporting;
 991 }
 992
 993 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 994 {
 995         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 996         struct hci_cp_pin_code_reply *cp;
 997         struct hci_conn *conn;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (hci_dev_test_flag(hdev, HCI_MGMT))
1004                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1005
1006         if (rp->status)
1007                 goto unlock;
1008
1009         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1010         if (!cp)
1011                 goto unlock;
1012
1013         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1014         if (conn)
1015                 conn->pin_length = cp->pin_len;
1016
1017 unlock:
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1026
1027         hci_dev_lock(hdev);
1028
1029         if (hci_dev_test_flag(hdev, HCI_MGMT))
1030                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1031                                                  rp->status);
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1037                                        struct sk_buff *skb)
1038 {
1039         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1040
1041         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1042
1043         if (rp->status)
1044                 return;
1045
1046         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1047         hdev->le_pkts = rp->le_max_pkt;
1048
1049         hdev->le_cnt = hdev->le_pkts;
1050
1051         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1052 }
1053
1054 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1055                                           struct sk_buff *skb)
1056 {
1057         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         if (rp->status)
1062                 return;
1063
1064         memcpy(hdev->le_features, rp->features, 8);
1065 }
1066
1067 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1068                                         struct sk_buff *skb)
1069 {
1070         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1073
1074         if (rp->status)
1075                 return;
1076
1077         hdev->adv_tx_power = rp->tx_power;
1078 }
1079
1080 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1081 {
1082         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1083
1084         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1085
1086         hci_dev_lock(hdev);
1087
1088         if (hci_dev_test_flag(hdev, HCI_MGMT))
1089                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1090                                                  rp->status);
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1096                                           struct sk_buff *skb)
1097 {
1098         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1101
1102         hci_dev_lock(hdev);
1103
1104         if (hci_dev_test_flag(hdev, HCI_MGMT))
1105                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1106                                                      ACL_LINK, 0, rp->status);
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (hci_dev_test_flag(hdev, HCI_MGMT))
1120                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1121                                                  0, rp->status);
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1127                                           struct sk_buff *skb)
1128 {
1129         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1132
1133         hci_dev_lock(hdev);
1134
1135         if (hci_dev_test_flag(hdev, HCI_MGMT))
1136                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1137                                                      ACL_LINK, 0, rp->status);
1138
1139         hci_dev_unlock(hdev);
1140 }
1141
1142 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1143                                        struct sk_buff *skb)
1144 {
1145         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1146
1147         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1148 }
1149
1150 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1151                                            struct sk_buff *skb)
1152 {
1153         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1154
1155         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1156 }
1157
1158 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1159 {
1160         __u8 status = *((__u8 *) skb->data);
1161         bdaddr_t *sent;
1162
1163         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1164
1165         if (status)
1166                 return;
1167
1168         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1169         if (!sent)
1170                 return;
1171
1172         hci_dev_lock(hdev);
1173
1174         bacpy(&hdev->random_addr, sent);
1175
1176         if (!bacmp(&hdev->rpa, sent)) {
1177                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1178                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1179                                    secs_to_jiffies(hdev->rpa_timeout));
1180         }
1181
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1186 {
1187         __u8 status = *((__u8 *) skb->data);
1188         struct hci_cp_le_set_default_phy *cp;
1189
1190         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1191
1192         if (status)
1193                 return;
1194
1195         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1196         if (!cp)
1197                 return;
1198
1199         hci_dev_lock(hdev);
1200
1201         hdev->le_tx_def_phys = cp->tx_phys;
1202         hdev->le_rx_def_phys = cp->rx_phys;
1203
1204         hci_dev_unlock(hdev);
1205 }
1206
1207 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1208                                               struct sk_buff *skb)
1209 {
1210         __u8 status = *((__u8 *) skb->data);
1211         struct hci_cp_le_set_adv_set_rand_addr *cp;
1212         struct adv_info *adv;
1213
1214         if (status)
1215                 return;
1216
1217         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1218         /* Update only in case the adv instance since handle 0x00 shall be using
1219          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1220          * non-extended adverting.
1221          */
1222         if (!cp || !cp->handle)
1223                 return;
1224
1225         hci_dev_lock(hdev);
1226
1227         adv = hci_find_adv_instance(hdev, cp->handle);
1228         if (adv) {
1229                 bacpy(&adv->random_addr, &cp->bdaddr);
1230                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1231                         adv->rpa_expired = false;
1232                         queue_delayed_work(hdev->workqueue,
1233                                            &adv->rpa_expired_cb,
1234                                            secs_to_jiffies(hdev->rpa_timeout));
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1242                                           struct sk_buff *skb)
1243 {
1244         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1245
1246         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1247
1248         if (rp->status)
1249                 return;
1250
1251         hdev->min_le_tx_power = rp->min_le_tx_power;
1252         hdev->max_le_tx_power = rp->max_le_tx_power;
1253 }
1254
1255 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1256 {
1257         __u8 *sent, status = *((__u8 *) skb->data);
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1260
1261         if (status)
1262                 return;
1263
1264         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1265         if (!sent)
1266                 return;
1267
1268         hci_dev_lock(hdev);
1269
1270         /* If we're doing connection initiation as peripheral. Set a
1271          * timeout in case something goes wrong.
1272          */
1273         if (*sent) {
1274                 struct hci_conn *conn;
1275
1276                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1277
1278                 conn = hci_lookup_le_connect(hdev);
1279                 if (conn)
1280                         queue_delayed_work(hdev->workqueue,
1281                                            &conn->le_conn_timeout,
1282                                            conn->conn_timeout);
1283         } else {
1284                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1285         }
1286
1287         hci_dev_unlock(hdev);
1288 }
1289
1290 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1291                                          struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_set_ext_adv_enable *cp;
1294         struct hci_cp_ext_adv_set *set;
1295         __u8 status = *((__u8 *) skb->data);
1296         struct adv_info *adv = NULL, *n;
1297
1298         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1299
1300         if (status)
1301                 return;
1302
1303         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1304         if (!cp)
1305                 return;
1306
1307         set = (void *)cp->data;
1308
1309         hci_dev_lock(hdev);
1310
1311         if (cp->num_of_sets)
1312                 adv = hci_find_adv_instance(hdev, set->handle);
1313
1314         if (cp->enable) {
1315                 struct hci_conn *conn;
1316
1317                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1318
1319                 if (adv)
1320                         adv->enabled = true;
1321
1322                 conn = hci_lookup_le_connect(hdev);
1323                 if (conn)
1324                         queue_delayed_work(hdev->workqueue,
1325                                            &conn->le_conn_timeout,
1326                                            conn->conn_timeout);
1327         } else {
1328                 if (adv) {
1329                         adv->enabled = false;
1330                         /* If just one instance was disabled check if there are
1331                          * any other instance enabled before clearing HCI_LE_ADV
1332                          */
1333                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1334                                                  list) {
1335                                 if (adv->enabled)
1336                                         goto unlock;
1337                         }
1338                 } else {
1339                         /* All instances shall be considered disabled */
1340                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1341                                                  list)
1342                                 adv->enabled = false;
1343                 }
1344
1345                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1346         }
1347
1348 unlock:
1349         hci_dev_unlock(hdev);
1350 }
1351
1352 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1353 {
1354         struct hci_cp_le_set_scan_param *cp;
1355         __u8 status = *((__u8 *) skb->data);
1356
1357         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1358
1359         if (status)
1360                 return;
1361
1362         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1363         if (!cp)
1364                 return;
1365
1366         hci_dev_lock(hdev);
1367
1368         hdev->le_scan_type = cp->type;
1369
1370         hci_dev_unlock(hdev);
1371 }
1372
1373 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1374                                          struct sk_buff *skb)
1375 {
1376         struct hci_cp_le_set_ext_scan_params *cp;
1377         __u8 status = *((__u8 *) skb->data);
1378         struct hci_cp_le_scan_phy_params *phy_param;
1379
1380         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1381
1382         if (status)
1383                 return;
1384
1385         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1386         if (!cp)
1387                 return;
1388
1389         phy_param = (void *)cp->data;
1390
1391         hci_dev_lock(hdev);
1392
1393         hdev->le_scan_type = phy_param->type;
1394
1395         hci_dev_unlock(hdev);
1396 }
1397
1398 static bool has_pending_adv_report(struct hci_dev *hdev)
1399 {
1400         struct discovery_state *d = &hdev->discovery;
1401
1402         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1403 }
1404
1405 static void clear_pending_adv_report(struct hci_dev *hdev)
1406 {
1407         struct discovery_state *d = &hdev->discovery;
1408
1409         bacpy(&d->last_adv_addr, BDADDR_ANY);
1410         d->last_adv_data_len = 0;
1411 }
1412
1413 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1414                                      u8 bdaddr_type, s8 rssi, u32 flags,
1415                                      u8 *data, u8 len)
1416 {
1417         struct discovery_state *d = &hdev->discovery;
1418
1419         if (len > HCI_MAX_AD_LENGTH)
1420                 return;
1421
1422         bacpy(&d->last_adv_addr, bdaddr);
1423         d->last_adv_addr_type = bdaddr_type;
1424         d->last_adv_rssi = rssi;
1425         d->last_adv_flags = flags;
1426         memcpy(d->last_adv_data, data, len);
1427         d->last_adv_data_len = len;
1428 }
1429
1430 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1431 {
1432         hci_dev_lock(hdev);
1433
1434         switch (enable) {
1435         case LE_SCAN_ENABLE:
1436                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1437                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1438                         clear_pending_adv_report(hdev);
1439                 break;
1440
1441         case LE_SCAN_DISABLE:
1442                 /* We do this here instead of when setting DISCOVERY_STOPPED
1443                  * since the latter would potentially require waiting for
1444                  * inquiry to stop too.
1445                  */
1446                 if (has_pending_adv_report(hdev)) {
1447                         struct discovery_state *d = &hdev->discovery;
1448
1449                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1450                                           d->last_adv_addr_type, NULL,
1451                                           d->last_adv_rssi, d->last_adv_flags,
1452                                           d->last_adv_data,
1453                                           d->last_adv_data_len, NULL, 0);
1454                 }
1455
1456                 /* Cancel this timer so that we don't try to disable scanning
1457                  * when it's already disabled.
1458                  */
1459                 cancel_delayed_work(&hdev->le_scan_disable);
1460
1461                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1462
1463                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1464                  * interrupted scanning due to a connect request. Mark
1465                  * therefore discovery as stopped. If this was not
1466                  * because of a connect request advertising might have
1467                  * been disabled because of active scanning, so
1468                  * re-enable it again if necessary.
1469                  */
1470                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1471 #ifndef TIZEN_BT /* The below line is kernel bug. */
1472                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1473 #else
1474                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1475 #endif
1476                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1477                          hdev->discovery.state == DISCOVERY_FINDING)
1478                         hci_req_reenable_advertising(hdev);
1479
1480                 break;
1481
1482         default:
1483                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1484                            enable);
1485                 break;
1486         }
1487
1488         hci_dev_unlock(hdev);
1489 }
1490
1491 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1492                                       struct sk_buff *skb)
1493 {
1494         struct hci_cp_le_set_scan_enable *cp;
1495         __u8 status = *((__u8 *) skb->data);
1496
1497         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1498
1499         if (status)
1500                 return;
1501
1502         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1503         if (!cp)
1504                 return;
1505
1506         le_set_scan_enable_complete(hdev, cp->enable);
1507 }
1508
1509 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1510                                       struct sk_buff *skb)
1511 {
1512         struct hci_cp_le_set_ext_scan_enable *cp;
1513         __u8 status = *((__u8 *) skb->data);
1514
1515         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1516
1517         if (status)
1518                 return;
1519
1520         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1521         if (!cp)
1522                 return;
1523
1524         le_set_scan_enable_complete(hdev, cp->enable);
1525 }
1526
1527 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1528                                       struct sk_buff *skb)
1529 {
1530         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1531
1532         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1533                rp->num_of_sets);
1534
1535         if (rp->status)
1536                 return;
1537
1538         hdev->le_num_of_adv_sets = rp->num_of_sets;
1539 }
1540
1541 static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1542                                             struct sk_buff *skb)
1543 {
1544         struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1545
1546         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1547
1548         if (rp->status)
1549                 return;
1550
1551         hdev->le_accept_list_size = rp->size;
1552 }
1553
1554 static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1555                                         struct sk_buff *skb)
1556 {
1557         __u8 status = *((__u8 *) skb->data);
1558
1559         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1560
1561         if (status)
1562                 return;
1563
1564         hci_bdaddr_list_clear(&hdev->le_accept_list);
1565 }
1566
1567 static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1568                                          struct sk_buff *skb)
1569 {
1570         struct hci_cp_le_add_to_accept_list *sent;
1571         __u8 status = *((__u8 *) skb->data);
1572
1573         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1574
1575         if (status)
1576                 return;
1577
1578         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1579         if (!sent)
1580                 return;
1581
1582         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1583                             sent->bdaddr_type);
1584 }
1585
1586 static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1587                                            struct sk_buff *skb)
1588 {
1589         struct hci_cp_le_del_from_accept_list *sent;
1590         __u8 status = *((__u8 *) skb->data);
1591
1592         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594         if (status)
1595                 return;
1596
1597         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1598         if (!sent)
1599                 return;
1600
1601         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1602                             sent->bdaddr_type);
1603 }
1604
1605 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1606                                             struct sk_buff *skb)
1607 {
1608         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1609
1610         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1611
1612         if (rp->status)
1613                 return;
1614
1615         memcpy(hdev->le_states, rp->le_states, 8);
1616 }
1617
1618 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1619                                         struct sk_buff *skb)
1620 {
1621         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1622
1623         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1624
1625         if (rp->status)
1626                 return;
1627
1628         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1629         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1630 }
1631
1632 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1633                                          struct sk_buff *skb)
1634 {
1635         struct hci_cp_le_write_def_data_len *sent;
1636         __u8 status = *((__u8 *) skb->data);
1637
1638         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1639
1640         if (status)
1641                 return;
1642
1643         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1644         if (!sent)
1645                 return;
1646
1647         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1648         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1649 }
1650
1651 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1652                                          struct sk_buff *skb)
1653 {
1654         struct hci_cp_le_add_to_resolv_list *sent;
1655         __u8 status = *((__u8 *) skb->data);
1656
1657         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1658
1659         if (status)
1660                 return;
1661
1662         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1663         if (!sent)
1664                 return;
1665
1666         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1667                                 sent->bdaddr_type, sent->peer_irk,
1668                                 sent->local_irk);
1669 }
1670
1671 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1672                                           struct sk_buff *skb)
1673 {
1674         struct hci_cp_le_del_from_resolv_list *sent;
1675         __u8 status = *((__u8 *) skb->data);
1676
1677         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1678
1679         if (status)
1680                 return;
1681
1682         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1683         if (!sent)
1684                 return;
1685
1686         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1687                             sent->bdaddr_type);
1688 }
1689
1690 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1691                                        struct sk_buff *skb)
1692 {
1693         __u8 status = *((__u8 *) skb->data);
1694
1695         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1696
1697         if (status)
1698                 return;
1699
1700         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1701 }
1702
1703 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1704                                            struct sk_buff *skb)
1705 {
1706         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1707
1708         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1709
1710         if (rp->status)
1711                 return;
1712
1713         hdev->le_resolv_list_size = rp->size;
1714 }
1715
1716 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1717                                                 struct sk_buff *skb)
1718 {
1719         __u8 *sent, status = *((__u8 *) skb->data);
1720
1721         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1722
1723         if (status)
1724                 return;
1725
1726         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1727         if (!sent)
1728                 return;
1729
1730         hci_dev_lock(hdev);
1731
1732         if (*sent)
1733                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1734         else
1735                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1736
1737         hci_dev_unlock(hdev);
1738 }
1739
1740 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1741                                         struct sk_buff *skb)
1742 {
1743         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1744
1745         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1746
1747         if (rp->status)
1748                 return;
1749
1750         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1751         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1752         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1753         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1754 }
1755
1756 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1757                                            struct sk_buff *skb)
1758 {
1759         struct hci_cp_write_le_host_supported *sent;
1760         __u8 status = *((__u8 *) skb->data);
1761
1762         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1763
1764         if (status)
1765                 return;
1766
1767         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1768         if (!sent)
1769                 return;
1770
1771         hci_dev_lock(hdev);
1772
1773         if (sent->le) {
1774                 hdev->features[1][0] |= LMP_HOST_LE;
1775                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1776         } else {
1777                 hdev->features[1][0] &= ~LMP_HOST_LE;
1778                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1779                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1780         }
1781
1782         if (sent->simul)
1783                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1784         else
1785                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1786
1787         hci_dev_unlock(hdev);
1788 }
1789
1790 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1791 {
1792         struct hci_cp_le_set_adv_param *cp;
1793         u8 status = *((u8 *) skb->data);
1794
1795         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1796
1797         if (status)
1798                 return;
1799
1800         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1801         if (!cp)
1802                 return;
1803
1804         hci_dev_lock(hdev);
1805         hdev->adv_addr_type = cp->own_address_type;
1806         hci_dev_unlock(hdev);
1807 }
1808
1809 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1810 {
1811         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1812         struct hci_cp_le_set_ext_adv_params *cp;
1813         struct adv_info *adv_instance;
1814
1815         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1816
1817         if (rp->status)
1818                 return;
1819
1820         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1821         if (!cp)
1822                 return;
1823
1824         hci_dev_lock(hdev);
1825         hdev->adv_addr_type = cp->own_addr_type;
1826         if (!cp->handle) {
1827                 /* Store in hdev for instance 0 */
1828                 hdev->adv_tx_power = rp->tx_power;
1829         } else {
1830                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
1831                 if (adv_instance)
1832                         adv_instance->tx_power = rp->tx_power;
1833         }
1834         /* Update adv data as tx power is known now */
1835         hci_req_update_adv_data(hdev, cp->handle);
1836
1837         hci_dev_unlock(hdev);
1838 }
1839
1840 #ifdef TIZEN_BT
1841 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1842                                           struct sk_buff *skb)
1843 {
1844         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1845
1846         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1847                hdev->name, rp->status, rp->le_ext_opcode);
1848
1849         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1850 }
1851
1852 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1853                                           struct sk_buff *skb)
1854 {
1855         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1856
1857         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1858                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1859
1860         mgmt_raw_rssi_response(hdev, rp, rp->status);
1861 }
1862
1863 static void hci_vendor_specific_group_ext_evt(struct hci_dev *hdev,
1864                                               struct sk_buff *skb)
1865 {
1866         struct hci_ev_ext_vendor_specific *ev = (void *)skb->data;
1867         __u8 event_le_ext_sub_code;
1868
1869         BT_DBG("RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
1870                LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
1871
1872         skb_pull(skb, sizeof(*ev));
1873         event_le_ext_sub_code = ev->event_le_ext_sub_code;
1874
1875         switch (event_le_ext_sub_code) {
1876         case LE_RSSI_LINK_ALERT:
1877                 BT_DBG("RSSI event LE_RSSI_LINK_ALERT %X",
1878                        LE_RSSI_LINK_ALERT);
1879                 mgmt_rssi_alert_evt(hdev, skb);
1880                 break;
1881
1882         default:
1883                 break;
1884         }
1885 }
1886
1887 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
1888 {
1889         struct hci_ev_vendor_specific *ev = (void *)skb->data;
1890         __u8 event_sub_code;
1891
1892         BT_DBG("hci_vendor_specific_evt");
1893
1894         skb_pull(skb, sizeof(*ev));
1895         event_sub_code = ev->event_sub_code;
1896
1897         switch (event_sub_code) {
1898         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT:
1899                 hci_vendor_specific_group_ext_evt(hdev, skb);
1900                 break;
1901
1902         default:
1903                 break;
1904         }
1905 }
1906 #endif
1907
1908 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1909 {
1910         struct hci_rp_read_rssi *rp = (void *) skb->data;
1911         struct hci_conn *conn;
1912
1913         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1914
1915         if (rp->status)
1916                 return;
1917
1918         hci_dev_lock(hdev);
1919
1920         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1921         if (conn)
1922                 conn->rssi = rp->rssi;
1923
1924         hci_dev_unlock(hdev);
1925 }
1926
1927 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1928 {
1929         struct hci_cp_read_tx_power *sent;
1930         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1931         struct hci_conn *conn;
1932
1933         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1934
1935         if (rp->status)
1936                 return;
1937
1938         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1939         if (!sent)
1940                 return;
1941
1942         hci_dev_lock(hdev);
1943
1944         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1945         if (!conn)
1946                 goto unlock;
1947
1948         switch (sent->type) {
1949         case 0x00:
1950                 conn->tx_power = rp->tx_power;
1951                 break;
1952         case 0x01:
1953                 conn->max_tx_power = rp->tx_power;
1954                 break;
1955         }
1956
1957 unlock:
1958         hci_dev_unlock(hdev);
1959 }
1960
1961 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1962 {
1963         u8 status = *((u8 *) skb->data);
1964         u8 *mode;
1965
1966         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1967
1968         if (status)
1969                 return;
1970
1971         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1972         if (mode)
1973                 hdev->ssp_debug_mode = *mode;
1974 }
1975
1976 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1977 {
1978         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1979
1980         if (status) {
1981                 hci_conn_check_pending(hdev);
1982                 return;
1983         }
1984
1985         set_bit(HCI_INQUIRY, &hdev->flags);
1986 }
1987
1988 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1989 {
1990         struct hci_cp_create_conn *cp;
1991         struct hci_conn *conn;
1992
1993         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1994
1995         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1996         if (!cp)
1997                 return;
1998
1999         hci_dev_lock(hdev);
2000
2001         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2002
2003         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
2004
2005         if (status) {
2006                 if (conn && conn->state == BT_CONNECT) {
2007                         if (status != 0x0c || conn->attempt > 2) {
2008                                 conn->state = BT_CLOSED;
2009                                 hci_connect_cfm(conn, status);
2010                                 hci_conn_del(conn);
2011                         } else
2012                                 conn->state = BT_CONNECT2;
2013                 }
2014         } else {
2015                 if (!conn) {
2016                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
2017                                             HCI_ROLE_MASTER);
2018                         if (!conn)
2019                                 bt_dev_err(hdev, "no memory for new connection");
2020                 }
2021         }
2022
2023         hci_dev_unlock(hdev);
2024 }
2025
2026 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
2027 {
2028         struct hci_cp_add_sco *cp;
2029         struct hci_conn *acl, *sco;
2030         __u16 handle;
2031
2032         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2033
2034         if (!status)
2035                 return;
2036
2037         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
2038         if (!cp)
2039                 return;
2040
2041         handle = __le16_to_cpu(cp->handle);
2042
2043         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2044
2045         hci_dev_lock(hdev);
2046
2047         acl = hci_conn_hash_lookup_handle(hdev, handle);
2048         if (acl) {
2049                 sco = acl->link;
2050                 if (sco) {
2051                         sco->state = BT_CLOSED;
2052
2053                         hci_connect_cfm(sco, status);
2054                         hci_conn_del(sco);
2055                 }
2056         }
2057
2058         hci_dev_unlock(hdev);
2059 }
2060
2061 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2062 {
2063         struct hci_cp_auth_requested *cp;
2064         struct hci_conn *conn;
2065
2066         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2067
2068         if (!status)
2069                 return;
2070
2071         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2072         if (!cp)
2073                 return;
2074
2075         hci_dev_lock(hdev);
2076
2077         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2078         if (conn) {
2079                 if (conn->state == BT_CONFIG) {
2080                         hci_connect_cfm(conn, status);
2081                         hci_conn_drop(conn);
2082                 }
2083         }
2084
2085         hci_dev_unlock(hdev);
2086 }
2087
2088 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2089 {
2090         struct hci_cp_set_conn_encrypt *cp;
2091         struct hci_conn *conn;
2092
2093         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2094
2095         if (!status)
2096                 return;
2097
2098         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2099         if (!cp)
2100                 return;
2101
2102         hci_dev_lock(hdev);
2103
2104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2105         if (conn) {
2106                 if (conn->state == BT_CONFIG) {
2107                         hci_connect_cfm(conn, status);
2108                         hci_conn_drop(conn);
2109                 }
2110         }
2111
2112         hci_dev_unlock(hdev);
2113 }
2114
2115 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2116                                     struct hci_conn *conn)
2117 {
2118         if (conn->state != BT_CONFIG || !conn->out)
2119                 return 0;
2120
2121         if (conn->pending_sec_level == BT_SECURITY_SDP)
2122                 return 0;
2123
2124         /* Only request authentication for SSP connections or non-SSP
2125          * devices with sec_level MEDIUM or HIGH or if MITM protection
2126          * is requested.
2127          */
2128         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2129             conn->pending_sec_level != BT_SECURITY_FIPS &&
2130             conn->pending_sec_level != BT_SECURITY_HIGH &&
2131             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2132                 return 0;
2133
2134         return 1;
2135 }
2136
2137 static int hci_resolve_name(struct hci_dev *hdev,
2138                                    struct inquiry_entry *e)
2139 {
2140         struct hci_cp_remote_name_req cp;
2141
2142         memset(&cp, 0, sizeof(cp));
2143
2144         bacpy(&cp.bdaddr, &e->data.bdaddr);
2145         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2146         cp.pscan_mode = e->data.pscan_mode;
2147         cp.clock_offset = e->data.clock_offset;
2148
2149         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2150 }
2151
2152 static bool hci_resolve_next_name(struct hci_dev *hdev)
2153 {
2154         struct discovery_state *discov = &hdev->discovery;
2155         struct inquiry_entry *e;
2156
2157         if (list_empty(&discov->resolve))
2158                 return false;
2159
2160         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2161         if (!e)
2162                 return false;
2163
2164         if (hci_resolve_name(hdev, e) == 0) {
2165                 e->name_state = NAME_PENDING;
2166                 return true;
2167         }
2168
2169         return false;
2170 }
2171
2172 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2173                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2174 {
2175         struct discovery_state *discov = &hdev->discovery;
2176         struct inquiry_entry *e;
2177
2178 #ifdef TIZEN_BT
2179         /* Update the mgmt connected state if necessary. Be careful with
2180          * conn objects that exist but are not (yet) connected however.
2181          * Only those in BT_CONFIG or BT_CONNECTED states can be
2182          * considered connected.
2183          */
2184         if (conn &&
2185             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2186                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2187                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2188                 else
2189                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2190         }
2191 #else
2192         if (conn &&
2193             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2194             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2195                 mgmt_device_connected(hdev, conn, name, name_len);
2196 #endif
2197
2198         if (discov->state == DISCOVERY_STOPPED)
2199                 return;
2200
2201         if (discov->state == DISCOVERY_STOPPING)
2202                 goto discov_complete;
2203
2204         if (discov->state != DISCOVERY_RESOLVING)
2205                 return;
2206
2207         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2208         /* If the device was not found in a list of found devices names of which
2209          * are pending. there is no need to continue resolving a next name as it
2210          * will be done upon receiving another Remote Name Request Complete
2211          * Event */
2212         if (!e)
2213                 return;
2214
2215         list_del(&e->list);
2216         if (name) {
2217                 e->name_state = NAME_KNOWN;
2218                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2219                                  e->data.rssi, name, name_len);
2220         } else {
2221                 e->name_state = NAME_NOT_KNOWN;
2222         }
2223
2224         if (hci_resolve_next_name(hdev))
2225                 return;
2226
2227 discov_complete:
2228         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2229 }
2230
2231 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2232 {
2233         struct hci_cp_remote_name_req *cp;
2234         struct hci_conn *conn;
2235
2236         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2237
2238         /* If successful wait for the name req complete event before
2239          * checking for the need to do authentication */
2240         if (!status)
2241                 return;
2242
2243         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2244         if (!cp)
2245                 return;
2246
2247         hci_dev_lock(hdev);
2248
2249         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2250
2251         if (hci_dev_test_flag(hdev, HCI_MGMT))
2252                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2253
2254         if (!conn)
2255                 goto unlock;
2256
2257         if (!hci_outgoing_auth_needed(hdev, conn))
2258                 goto unlock;
2259
2260         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2261                 struct hci_cp_auth_requested auth_cp;
2262
2263                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2264
2265                 auth_cp.handle = __cpu_to_le16(conn->handle);
2266                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2267                              sizeof(auth_cp), &auth_cp);
2268         }
2269
2270 unlock:
2271         hci_dev_unlock(hdev);
2272 }
2273
2274 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2275 {
2276         struct hci_cp_read_remote_features *cp;
2277         struct hci_conn *conn;
2278
2279         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2280
2281         if (!status)
2282                 return;
2283
2284         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2285         if (!cp)
2286                 return;
2287
2288         hci_dev_lock(hdev);
2289
2290         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2291         if (conn) {
2292                 if (conn->state == BT_CONFIG) {
2293                         hci_connect_cfm(conn, status);
2294                         hci_conn_drop(conn);
2295                 }
2296         }
2297
2298         hci_dev_unlock(hdev);
2299 }
2300
2301 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2302 {
2303         struct hci_cp_read_remote_ext_features *cp;
2304         struct hci_conn *conn;
2305
2306         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2307
2308         if (!status)
2309                 return;
2310
2311         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2312         if (!cp)
2313                 return;
2314
2315         hci_dev_lock(hdev);
2316
2317         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2318         if (conn) {
2319                 if (conn->state == BT_CONFIG) {
2320                         hci_connect_cfm(conn, status);
2321                         hci_conn_drop(conn);
2322                 }
2323         }
2324
2325         hci_dev_unlock(hdev);
2326 }
2327
2328 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2329 {
2330         struct hci_cp_setup_sync_conn *cp;
2331         struct hci_conn *acl, *sco;
2332         __u16 handle;
2333
2334         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2335
2336         if (!status)
2337                 return;
2338
2339         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2340         if (!cp)
2341                 return;
2342
2343         handle = __le16_to_cpu(cp->handle);
2344
2345         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2346
2347         hci_dev_lock(hdev);
2348
2349         acl = hci_conn_hash_lookup_handle(hdev, handle);
2350         if (acl) {
2351                 sco = acl->link;
2352                 if (sco) {
2353                         sco->state = BT_CLOSED;
2354
2355                         hci_connect_cfm(sco, status);
2356                         hci_conn_del(sco);
2357                 }
2358         }
2359
2360         hci_dev_unlock(hdev);
2361 }
2362
2363 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2364 {
2365         struct hci_cp_sniff_mode *cp;
2366         struct hci_conn *conn;
2367
2368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2369
2370         if (!status)
2371                 return;
2372
2373         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2374         if (!cp)
2375                 return;
2376
2377         hci_dev_lock(hdev);
2378
2379         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2380         if (conn) {
2381                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2382
2383                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2384                         hci_sco_setup(conn, status);
2385         }
2386
2387         hci_dev_unlock(hdev);
2388 }
2389
2390 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2391 {
2392         struct hci_cp_exit_sniff_mode *cp;
2393         struct hci_conn *conn;
2394
2395         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2396
2397         if (!status)
2398                 return;
2399
2400         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2401         if (!cp)
2402                 return;
2403
2404         hci_dev_lock(hdev);
2405
2406         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2407         if (conn) {
2408                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2409
2410                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2411                         hci_sco_setup(conn, status);
2412         }
2413
2414         hci_dev_unlock(hdev);
2415 }
2416
2417 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2418 {
2419         struct hci_cp_disconnect *cp;
2420         struct hci_conn *conn;
2421
2422         if (!status)
2423                 return;
2424
2425         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2426         if (!cp)
2427                 return;
2428
2429         hci_dev_lock(hdev);
2430
2431         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2432         if (conn) {
2433                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2434                                        conn->dst_type, status);
2435
2436                 if (conn->type == LE_LINK) {
2437                         hdev->cur_adv_instance = conn->adv_instance;
2438                         hci_req_reenable_advertising(hdev);
2439                 }
2440
2441                 /* If the disconnection failed for any reason, the upper layer
2442                  * does not retry to disconnect in current implementation.
2443                  * Hence, we need to do some basic cleanup here and re-enable
2444                  * advertising if necessary.
2445                  */
2446                 hci_conn_del(conn);
2447         }
2448
2449         hci_dev_unlock(hdev);
2450 }
2451
2452 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2453                               u8 peer_addr_type, u8 own_address_type,
2454                               u8 filter_policy)
2455 {
2456         struct hci_conn *conn;
2457
2458         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2459                                        peer_addr_type);
2460         if (!conn)
2461                 return;
2462
2463         /* When using controller based address resolution, then the new
2464          * address types 0x02 and 0x03 are used. These types need to be
2465          * converted back into either public address or random address type
2466          */
2467         if (use_ll_privacy(hdev) &&
2468             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2469                 switch (own_address_type) {
2470                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2471                         own_address_type = ADDR_LE_DEV_PUBLIC;
2472                         break;
2473                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2474                         own_address_type = ADDR_LE_DEV_RANDOM;
2475                         break;
2476                 }
2477         }
2478
2479         /* Store the initiator and responder address information which
2480          * is needed for SMP. These values will not change during the
2481          * lifetime of the connection.
2482          */
2483         conn->init_addr_type = own_address_type;
2484         if (own_address_type == ADDR_LE_DEV_RANDOM)
2485                 bacpy(&conn->init_addr, &hdev->random_addr);
2486         else
2487                 bacpy(&conn->init_addr, &hdev->bdaddr);
2488
2489         conn->resp_addr_type = peer_addr_type;
2490         bacpy(&conn->resp_addr, peer_addr);
2491
2492         /* We don't want the connection attempt to stick around
2493          * indefinitely since LE doesn't have a page timeout concept
2494          * like BR/EDR. Set a timer for any connection that doesn't use
2495          * the accept list for connecting.
2496          */
2497         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2498                 queue_delayed_work(conn->hdev->workqueue,
2499                                    &conn->le_conn_timeout,
2500                                    conn->conn_timeout);
2501 }
2502
2503 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2504 {
2505         struct hci_cp_le_create_conn *cp;
2506
2507         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2508
2509         /* All connection failure handling is taken care of by the
2510          * hci_le_conn_failed function which is triggered by the HCI
2511          * request completion callbacks used for connecting.
2512          */
2513         if (status)
2514                 return;
2515
2516         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2517         if (!cp)
2518                 return;
2519
2520         hci_dev_lock(hdev);
2521
2522         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2523                           cp->own_address_type, cp->filter_policy);
2524
2525         hci_dev_unlock(hdev);
2526 }
2527
2528 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2529 {
2530         struct hci_cp_le_ext_create_conn *cp;
2531
2532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2533
2534         /* All connection failure handling is taken care of by the
2535          * hci_le_conn_failed function which is triggered by the HCI
2536          * request completion callbacks used for connecting.
2537          */
2538         if (status)
2539                 return;
2540
2541         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2542         if (!cp)
2543                 return;
2544
2545         hci_dev_lock(hdev);
2546
2547         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2548                           cp->own_addr_type, cp->filter_policy);
2549
2550         hci_dev_unlock(hdev);
2551 }
2552
2553 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2554 {
2555         struct hci_cp_le_read_remote_features *cp;
2556         struct hci_conn *conn;
2557
2558         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2559
2560         if (!status)
2561                 return;
2562
2563         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2564         if (!cp)
2565                 return;
2566
2567         hci_dev_lock(hdev);
2568
2569         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2570         if (conn) {
2571                 if (conn->state == BT_CONFIG) {
2572                         hci_connect_cfm(conn, status);
2573                         hci_conn_drop(conn);
2574                 }
2575         }
2576
2577         hci_dev_unlock(hdev);
2578 }
2579
2580 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2581 {
2582         struct hci_cp_le_start_enc *cp;
2583         struct hci_conn *conn;
2584
2585         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2586
2587         if (!status)
2588                 return;
2589
2590         hci_dev_lock(hdev);
2591
2592         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2593         if (!cp)
2594                 goto unlock;
2595
2596         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2597         if (!conn)
2598                 goto unlock;
2599
2600         if (conn->state != BT_CONNECTED)
2601                 goto unlock;
2602
2603         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2604         hci_conn_drop(conn);
2605
2606 unlock:
2607         hci_dev_unlock(hdev);
2608 }
2609
2610 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2611 {
2612         struct hci_cp_switch_role *cp;
2613         struct hci_conn *conn;
2614
2615         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2616
2617         if (!status)
2618                 return;
2619
2620         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2621         if (!cp)
2622                 return;
2623
2624         hci_dev_lock(hdev);
2625
2626         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2627         if (conn)
2628                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2629
2630         hci_dev_unlock(hdev);
2631 }
2632
2633 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2634 {
2635         __u8 status = *((__u8 *) skb->data);
2636         struct discovery_state *discov = &hdev->discovery;
2637         struct inquiry_entry *e;
2638
2639         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2640
2641         hci_conn_check_pending(hdev);
2642
2643         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2644                 return;
2645
2646         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2647         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2648
2649         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2650                 return;
2651
2652         hci_dev_lock(hdev);
2653
2654         if (discov->state != DISCOVERY_FINDING)
2655                 goto unlock;
2656
2657         if (list_empty(&discov->resolve)) {
2658                 /* When BR/EDR inquiry is active and no LE scanning is in
2659                  * progress, then change discovery state to indicate completion.
2660                  *
2661                  * When running LE scanning and BR/EDR inquiry simultaneously
2662                  * and the LE scan already finished, then change the discovery
2663                  * state to indicate completion.
2664                  */
2665                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2666                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2667                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2668                 goto unlock;
2669         }
2670
2671         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2672         if (e && hci_resolve_name(hdev, e) == 0) {
2673                 e->name_state = NAME_PENDING;
2674                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2675         } else {
2676                 /* When BR/EDR inquiry is active and no LE scanning is in
2677                  * progress, then change discovery state to indicate completion.
2678                  *
2679                  * When running LE scanning and BR/EDR inquiry simultaneously
2680                  * and the LE scan already finished, then change the discovery
2681                  * state to indicate completion.
2682                  */
2683                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2684                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2685                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2686         }
2687
2688 unlock:
2689         hci_dev_unlock(hdev);
2690 }
2691
2692 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2693 {
2694         struct inquiry_data data;
2695         struct inquiry_info *info = (void *) (skb->data + 1);
2696         int num_rsp = *((__u8 *) skb->data);
2697
2698         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2699
2700         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2701                 return;
2702
2703         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2704                 return;
2705
2706         hci_dev_lock(hdev);
2707
2708         for (; num_rsp; num_rsp--, info++) {
2709                 u32 flags;
2710
2711                 bacpy(&data.bdaddr, &info->bdaddr);
2712                 data.pscan_rep_mode     = info->pscan_rep_mode;
2713                 data.pscan_period_mode  = info->pscan_period_mode;
2714                 data.pscan_mode         = info->pscan_mode;
2715                 memcpy(data.dev_class, info->dev_class, 3);
2716                 data.clock_offset       = info->clock_offset;
2717                 data.rssi               = HCI_RSSI_INVALID;
2718                 data.ssp_mode           = 0x00;
2719
2720                 flags = hci_inquiry_cache_update(hdev, &data, false);
2721
2722                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2723                                   info->dev_class, HCI_RSSI_INVALID,
2724                                   flags, NULL, 0, NULL, 0);
2725         }
2726
2727         hci_dev_unlock(hdev);
2728 }
2729
2730 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2731 {
2732         struct hci_ev_conn_complete *ev = (void *) skb->data;
2733         struct hci_conn *conn;
2734
2735         BT_DBG("%s", hdev->name);
2736
2737         hci_dev_lock(hdev);
2738
2739         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2740         if (!conn) {
2741                 /* Connection may not exist if auto-connected. Check the bredr
2742                  * allowlist to see if this device is allowed to auto connect.
2743                  * If link is an ACL type, create a connection class
2744                  * automatically.
2745                  *
2746                  * Auto-connect will only occur if the event filter is
2747                  * programmed with a given address. Right now, event filter is
2748                  * only used during suspend.
2749                  */
2750                 if (ev->link_type == ACL_LINK &&
2751                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2752                                                       &ev->bdaddr,
2753                                                       BDADDR_BREDR)) {
2754                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2755                                             HCI_ROLE_SLAVE);
2756                         if (!conn) {
2757                                 bt_dev_err(hdev, "no memory for new conn");
2758                                 goto unlock;
2759                         }
2760                 } else {
2761                         if (ev->link_type != SCO_LINK)
2762                                 goto unlock;
2763
2764                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2765                                                        &ev->bdaddr);
2766                         if (!conn)
2767                                 goto unlock;
2768
2769                         conn->type = SCO_LINK;
2770                 }
2771         }
2772
2773         if (!ev->status) {
2774                 conn->handle = __le16_to_cpu(ev->handle);
2775
2776                 if (conn->type == ACL_LINK) {
2777                         conn->state = BT_CONFIG;
2778                         hci_conn_hold(conn);
2779
2780                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2781                             !hci_find_link_key(hdev, &ev->bdaddr))
2782                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2783                         else
2784                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2785                 } else
2786                         conn->state = BT_CONNECTED;
2787
2788                 hci_debugfs_create_conn(conn);
2789                 hci_conn_add_sysfs(conn);
2790
2791                 if (test_bit(HCI_AUTH, &hdev->flags))
2792                         set_bit(HCI_CONN_AUTH, &conn->flags);
2793
2794                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2795                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2796
2797                 /* Get remote features */
2798                 if (conn->type == ACL_LINK) {
2799                         struct hci_cp_read_remote_features cp;
2800                         cp.handle = ev->handle;
2801                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2802                                      sizeof(cp), &cp);
2803
2804                         hci_req_update_scan(hdev);
2805                 }
2806
2807                 /* Set packet type for incoming connection */
2808                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2809                         struct hci_cp_change_conn_ptype cp;
2810                         cp.handle = ev->handle;
2811                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2812                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2813                                      &cp);
2814                 }
2815         } else {
2816                 conn->state = BT_CLOSED;
2817                 if (conn->type == ACL_LINK)
2818                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2819                                             conn->dst_type, ev->status);
2820         }
2821
2822         if (conn->type == ACL_LINK)
2823                 hci_sco_setup(conn, ev->status);
2824
2825         if (ev->status) {
2826                 hci_connect_cfm(conn, ev->status);
2827                 hci_conn_del(conn);
2828         } else if (ev->link_type == SCO_LINK) {
2829                 switch (conn->setting & SCO_AIRMODE_MASK) {
2830                 case SCO_AIRMODE_CVSD:
2831                         if (hdev->notify)
2832                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2833                         break;
2834                 }
2835
2836                 hci_connect_cfm(conn, ev->status);
2837         }
2838
2839 unlock:
2840         hci_dev_unlock(hdev);
2841
2842         hci_conn_check_pending(hdev);
2843 }
2844
2845 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2846 {
2847         struct hci_cp_reject_conn_req cp;
2848
2849         bacpy(&cp.bdaddr, bdaddr);
2850         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2851         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2852 }
2853
2854 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2855 {
2856         struct hci_ev_conn_request *ev = (void *) skb->data;
2857         int mask = hdev->link_mode;
2858         struct inquiry_entry *ie;
2859         struct hci_conn *conn;
2860         __u8 flags = 0;
2861
2862         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2863                ev->link_type);
2864
2865         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2866                                       &flags);
2867
2868         if (!(mask & HCI_LM_ACCEPT)) {
2869                 hci_reject_conn(hdev, &ev->bdaddr);
2870                 return;
2871         }
2872
2873         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2874                                    BDADDR_BREDR)) {
2875                 hci_reject_conn(hdev, &ev->bdaddr);
2876                 return;
2877         }
2878
2879         /* Require HCI_CONNECTABLE or an accept list entry to accept the
2880          * connection. These features are only touched through mgmt so
2881          * only do the checks if HCI_MGMT is set.
2882          */
2883         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2884             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2885             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2886                                                BDADDR_BREDR)) {
2887                 hci_reject_conn(hdev, &ev->bdaddr);
2888                 return;
2889         }
2890
2891         /* Connection accepted */
2892
2893         hci_dev_lock(hdev);
2894
2895         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2896         if (ie)
2897                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2898
2899         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2900                         &ev->bdaddr);
2901         if (!conn) {
2902                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2903                                     HCI_ROLE_SLAVE);
2904                 if (!conn) {
2905                         bt_dev_err(hdev, "no memory for new connection");
2906                         hci_dev_unlock(hdev);
2907                         return;
2908                 }
2909         }
2910
2911         memcpy(conn->dev_class, ev->dev_class, 3);
2912
2913         hci_dev_unlock(hdev);
2914
2915         if (ev->link_type == ACL_LINK ||
2916             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2917                 struct hci_cp_accept_conn_req cp;
2918                 conn->state = BT_CONNECT;
2919
2920                 bacpy(&cp.bdaddr, &ev->bdaddr);
2921
2922                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2923                         cp.role = 0x00; /* Become central */
2924                 else
2925                         cp.role = 0x01; /* Remain peripheral */
2926
2927                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2928         } else if (!(flags & HCI_PROTO_DEFER)) {
2929                 struct hci_cp_accept_sync_conn_req cp;
2930                 conn->state = BT_CONNECT;
2931
2932                 bacpy(&cp.bdaddr, &ev->bdaddr);
2933                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2934
2935                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2936                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2937                 cp.max_latency    = cpu_to_le16(0xffff);
2938                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2939                 cp.retrans_effort = 0xff;
2940
2941                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2942                              &cp);
2943         } else {
2944                 conn->state = BT_CONNECT2;
2945                 hci_connect_cfm(conn, 0);
2946         }
2947 }
2948
2949 static u8 hci_to_mgmt_reason(u8 err)
2950 {
2951         switch (err) {
2952         case HCI_ERROR_CONNECTION_TIMEOUT:
2953                 return MGMT_DEV_DISCONN_TIMEOUT;
2954         case HCI_ERROR_REMOTE_USER_TERM:
2955         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2956         case HCI_ERROR_REMOTE_POWER_OFF:
2957                 return MGMT_DEV_DISCONN_REMOTE;
2958         case HCI_ERROR_LOCAL_HOST_TERM:
2959                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2960         default:
2961                 return MGMT_DEV_DISCONN_UNKNOWN;
2962         }
2963 }
2964
2965 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2966 {
2967         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2968         u8 reason;
2969         struct hci_conn_params *params;
2970         struct hci_conn *conn;
2971         bool mgmt_connected;
2972
2973         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2974
2975         hci_dev_lock(hdev);
2976
2977         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2978         if (!conn)
2979                 goto unlock;
2980
2981         if (ev->status) {
2982                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2983                                        conn->dst_type, ev->status);
2984                 goto unlock;
2985         }
2986
2987         conn->state = BT_CLOSED;
2988
2989         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2990
2991         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2992                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2993         else
2994                 reason = hci_to_mgmt_reason(ev->reason);
2995
2996         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2997                                 reason, mgmt_connected);
2998
2999         if (conn->type == ACL_LINK) {
3000                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
3001                         hci_remove_link_key(hdev, &conn->dst);
3002
3003                 hci_req_update_scan(hdev);
3004         }
3005
3006         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
3007         if (params) {
3008                 switch (params->auto_connect) {
3009                 case HCI_AUTO_CONN_LINK_LOSS:
3010                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
3011                                 break;
3012                         fallthrough;
3013
3014                 case HCI_AUTO_CONN_DIRECT:
3015                 case HCI_AUTO_CONN_ALWAYS:
3016                         list_del_init(&params->action);
3017                         list_add(&params->action, &hdev->pend_le_conns);
3018                         hci_update_background_scan(hdev);
3019                         break;
3020
3021                 default:
3022                         break;
3023                 }
3024         }
3025
3026         hci_disconn_cfm(conn, ev->reason);
3027
3028         /* The suspend notifier is waiting for all devices to disconnect so
3029          * clear the bit from pending tasks and inform the wait queue.
3030          */
3031         if (list_empty(&hdev->conn_hash.list) &&
3032             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
3033                 wake_up(&hdev->suspend_wait_q);
3034         }
3035
3036         /* Re-enable advertising if necessary, since it might
3037          * have been disabled by the connection. From the
3038          * HCI_LE_Set_Advertise_Enable command description in
3039          * the core specification (v4.0):
3040          * "The Controller shall continue advertising until the Host
3041          * issues an LE_Set_Advertise_Enable command with
3042          * Advertising_Enable set to 0x00 (Advertising is disabled)
3043          * or until a connection is created or until the Advertising
3044          * is timed out due to Directed Advertising."
3045          */
3046         if (conn->type == LE_LINK) {
3047                 hdev->cur_adv_instance = conn->adv_instance;
3048                 hci_req_reenable_advertising(hdev);
3049         }
3050
3051         hci_conn_del(conn);
3052
3053 unlock:
3054         hci_dev_unlock(hdev);
3055 }
3056
3057 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3058 {
3059         struct hci_ev_auth_complete *ev = (void *) skb->data;
3060         struct hci_conn *conn;
3061
3062         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3063
3064         hci_dev_lock(hdev);
3065
3066         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3067         if (!conn)
3068                 goto unlock;
3069
3070         if (!ev->status) {
3071                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3072
3073                 if (!hci_conn_ssp_enabled(conn) &&
3074                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3075                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3076                 } else {
3077                         set_bit(HCI_CONN_AUTH, &conn->flags);
3078                         conn->sec_level = conn->pending_sec_level;
3079                 }
3080         } else {
3081                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3082                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3083
3084                 mgmt_auth_failed(conn, ev->status);
3085         }
3086
3087         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3088         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3089
3090         if (conn->state == BT_CONFIG) {
3091                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3092                         struct hci_cp_set_conn_encrypt cp;
3093                         cp.handle  = ev->handle;
3094                         cp.encrypt = 0x01;
3095                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3096                                      &cp);
3097                 } else {
3098                         conn->state = BT_CONNECTED;
3099                         hci_connect_cfm(conn, ev->status);
3100                         hci_conn_drop(conn);
3101                 }
3102         } else {
3103                 hci_auth_cfm(conn, ev->status);
3104
3105                 hci_conn_hold(conn);
3106                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3107                 hci_conn_drop(conn);
3108         }
3109
3110         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3111                 if (!ev->status) {
3112                         struct hci_cp_set_conn_encrypt cp;
3113                         cp.handle  = ev->handle;
3114                         cp.encrypt = 0x01;
3115                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3116                                      &cp);
3117                 } else {
3118                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3119                         hci_encrypt_cfm(conn, ev->status);
3120                 }
3121         }
3122
3123 unlock:
3124         hci_dev_unlock(hdev);
3125 }
3126
3127 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3128 {
3129         struct hci_ev_remote_name *ev = (void *) skb->data;
3130         struct hci_conn *conn;
3131
3132         BT_DBG("%s", hdev->name);
3133
3134         hci_conn_check_pending(hdev);
3135
3136         hci_dev_lock(hdev);
3137
3138         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3139
3140         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3141                 goto check_auth;
3142
3143         if (ev->status == 0)
3144                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3145                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3146         else
3147                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3148
3149 check_auth:
3150         if (!conn)
3151                 goto unlock;
3152
3153         if (!hci_outgoing_auth_needed(hdev, conn))
3154                 goto unlock;
3155
3156         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3157                 struct hci_cp_auth_requested cp;
3158
3159                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3160
3161                 cp.handle = __cpu_to_le16(conn->handle);
3162                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3163         }
3164
3165 unlock:
3166         hci_dev_unlock(hdev);
3167 }
3168
3169 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3170                                        u16 opcode, struct sk_buff *skb)
3171 {
3172         const struct hci_rp_read_enc_key_size *rp;
3173         struct hci_conn *conn;
3174         u16 handle;
3175
3176         BT_DBG("%s status 0x%02x", hdev->name, status);
3177
3178         if (!skb || skb->len < sizeof(*rp)) {
3179                 bt_dev_err(hdev, "invalid read key size response");
3180                 return;
3181         }
3182
3183         rp = (void *)skb->data;
3184         handle = le16_to_cpu(rp->handle);
3185
3186         hci_dev_lock(hdev);
3187
3188         conn = hci_conn_hash_lookup_handle(hdev, handle);
3189         if (!conn)
3190                 goto unlock;
3191
3192         /* While unexpected, the read_enc_key_size command may fail. The most
3193          * secure approach is to then assume the key size is 0 to force a
3194          * disconnection.
3195          */
3196         if (rp->status) {
3197                 bt_dev_err(hdev, "failed to read key size for handle %u",
3198                            handle);
3199                 conn->enc_key_size = 0;
3200         } else {
3201                 conn->enc_key_size = rp->key_size;
3202         }
3203
3204         hci_encrypt_cfm(conn, 0);
3205
3206 unlock:
3207         hci_dev_unlock(hdev);
3208 }
3209
3210 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3211 {
3212         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3213         struct hci_conn *conn;
3214
3215         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3216
3217         hci_dev_lock(hdev);
3218
3219         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3220         if (!conn)
3221                 goto unlock;
3222
3223         if (!ev->status) {
3224                 if (ev->encrypt) {
3225                         /* Encryption implies authentication */
3226                         set_bit(HCI_CONN_AUTH, &conn->flags);
3227                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3228                         conn->sec_level = conn->pending_sec_level;
3229
3230                         /* P-256 authentication key implies FIPS */
3231                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3232                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3233
3234                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3235                             conn->type == LE_LINK)
3236                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3237                 } else {
3238                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3239                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3240                 }
3241         }
3242
3243         /* We should disregard the current RPA and generate a new one
3244          * whenever the encryption procedure fails.
3245          */
3246         if (ev->status && conn->type == LE_LINK) {
3247                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3248                 hci_adv_instances_set_rpa_expired(hdev, true);
3249         }
3250
3251         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3252
3253         /* Check link security requirements are met */
3254         if (!hci_conn_check_link_mode(conn))
3255                 ev->status = HCI_ERROR_AUTH_FAILURE;
3256
3257         if (ev->status && conn->state == BT_CONNECTED) {
3258                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3259                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3260
3261                 /* Notify upper layers so they can cleanup before
3262                  * disconnecting.
3263                  */
3264                 hci_encrypt_cfm(conn, ev->status);
3265                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3266                 hci_conn_drop(conn);
3267                 goto unlock;
3268         }
3269
3270         /* Try reading the encryption key size for encrypted ACL links */
3271         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3272                 struct hci_cp_read_enc_key_size cp;
3273                 struct hci_request req;
3274
3275                 /* Only send HCI_Read_Encryption_Key_Size if the
3276                  * controller really supports it. If it doesn't, assume
3277                  * the default size (16).
3278                  */
3279                 if (!(hdev->commands[20] & 0x10)) {
3280                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3281                         goto notify;
3282                 }
3283
3284                 hci_req_init(&req, hdev);
3285
3286                 cp.handle = cpu_to_le16(conn->handle);
3287                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3288
3289                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3290                         bt_dev_err(hdev, "sending read key size failed");
3291                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3292                         goto notify;
3293                 }
3294
3295                 goto unlock;
3296         }
3297
3298         /* Set the default Authenticated Payload Timeout after
3299          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3300          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3301          * sent when the link is active and Encryption is enabled, the conn
3302          * type can be either LE or ACL and controller must support LMP Ping.
3303          * Ensure for AES-CCM encryption as well.
3304          */
3305         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3306             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3307             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3308              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3309                 struct hci_cp_write_auth_payload_to cp;
3310
3311                 cp.handle = cpu_to_le16(conn->handle);
3312                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3313                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3314                              sizeof(cp), &cp);
3315         }
3316
3317 notify:
3318         hci_encrypt_cfm(conn, ev->status);
3319
3320 unlock:
3321         hci_dev_unlock(hdev);
3322 }
3323
3324 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3325                                              struct sk_buff *skb)
3326 {
3327         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3328         struct hci_conn *conn;
3329
3330         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3331
3332         hci_dev_lock(hdev);
3333
3334         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3335         if (conn) {
3336                 if (!ev->status)
3337                         set_bit(HCI_CONN_SECURE, &conn->flags);
3338
3339                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3340
3341                 hci_key_change_cfm(conn, ev->status);
3342         }
3343
3344         hci_dev_unlock(hdev);
3345 }
3346
3347 static void hci_remote_features_evt(struct hci_dev *hdev,
3348                                     struct sk_buff *skb)
3349 {
3350         struct hci_ev_remote_features *ev = (void *) skb->data;
3351         struct hci_conn *conn;
3352
3353         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3354
3355         hci_dev_lock(hdev);
3356
3357         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3358         if (!conn)
3359                 goto unlock;
3360
3361         if (!ev->status)
3362                 memcpy(conn->features[0], ev->features, 8);
3363
3364         if (conn->state != BT_CONFIG)
3365                 goto unlock;
3366
3367         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3368             lmp_ext_feat_capable(conn)) {
3369                 struct hci_cp_read_remote_ext_features cp;
3370                 cp.handle = ev->handle;
3371                 cp.page = 0x01;
3372                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3373                              sizeof(cp), &cp);
3374                 goto unlock;
3375         }
3376
3377         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3378                 struct hci_cp_remote_name_req cp;
3379                 memset(&cp, 0, sizeof(cp));
3380                 bacpy(&cp.bdaddr, &conn->dst);
3381                 cp.pscan_rep_mode = 0x02;
3382                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3383         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3384                 mgmt_device_connected(hdev, conn, NULL, 0);
3385
3386         if (!hci_outgoing_auth_needed(hdev, conn)) {
3387                 conn->state = BT_CONNECTED;
3388                 hci_connect_cfm(conn, ev->status);
3389                 hci_conn_drop(conn);
3390         }
3391
3392 unlock:
3393         hci_dev_unlock(hdev);
3394 }
3395
3396 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3397 {
3398         cancel_delayed_work(&hdev->cmd_timer);
3399
3400         if (!test_bit(HCI_RESET, &hdev->flags)) {
3401                 if (ncmd) {
3402                         cancel_delayed_work(&hdev->ncmd_timer);
3403                         atomic_set(&hdev->cmd_cnt, 1);
3404                 } else {
3405                         schedule_delayed_work(&hdev->ncmd_timer,
3406                                               HCI_NCMD_TIMEOUT);
3407                 }
3408         }
3409 }
3410
3411 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3412                                  u16 *opcode, u8 *status,
3413                                  hci_req_complete_t *req_complete,
3414                                  hci_req_complete_skb_t *req_complete_skb)
3415 {
3416         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3417
3418         *opcode = __le16_to_cpu(ev->opcode);
3419         *status = skb->data[sizeof(*ev)];
3420
3421         skb_pull(skb, sizeof(*ev));
3422
3423         switch (*opcode) {
3424         case HCI_OP_INQUIRY_CANCEL:
3425                 hci_cc_inquiry_cancel(hdev, skb, status);
3426                 break;
3427
3428         case HCI_OP_PERIODIC_INQ:
3429                 hci_cc_periodic_inq(hdev, skb);
3430                 break;
3431
3432         case HCI_OP_EXIT_PERIODIC_INQ:
3433                 hci_cc_exit_periodic_inq(hdev, skb);
3434                 break;
3435
3436         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3437                 hci_cc_remote_name_req_cancel(hdev, skb);
3438                 break;
3439
3440         case HCI_OP_ROLE_DISCOVERY:
3441                 hci_cc_role_discovery(hdev, skb);
3442                 break;
3443
3444         case HCI_OP_READ_LINK_POLICY:
3445                 hci_cc_read_link_policy(hdev, skb);
3446                 break;
3447
3448         case HCI_OP_WRITE_LINK_POLICY:
3449                 hci_cc_write_link_policy(hdev, skb);
3450                 break;
3451
3452         case HCI_OP_READ_DEF_LINK_POLICY:
3453                 hci_cc_read_def_link_policy(hdev, skb);
3454                 break;
3455
3456         case HCI_OP_WRITE_DEF_LINK_POLICY:
3457                 hci_cc_write_def_link_policy(hdev, skb);
3458                 break;
3459
3460         case HCI_OP_RESET:
3461                 hci_cc_reset(hdev, skb);
3462                 break;
3463
3464         case HCI_OP_READ_STORED_LINK_KEY:
3465                 hci_cc_read_stored_link_key(hdev, skb);
3466                 break;
3467
3468         case HCI_OP_DELETE_STORED_LINK_KEY:
3469                 hci_cc_delete_stored_link_key(hdev, skb);
3470                 break;
3471
3472         case HCI_OP_WRITE_LOCAL_NAME:
3473                 hci_cc_write_local_name(hdev, skb);
3474                 break;
3475
3476         case HCI_OP_READ_LOCAL_NAME:
3477                 hci_cc_read_local_name(hdev, skb);
3478                 break;
3479
3480         case HCI_OP_WRITE_AUTH_ENABLE:
3481                 hci_cc_write_auth_enable(hdev, skb);
3482                 break;
3483
3484         case HCI_OP_WRITE_ENCRYPT_MODE:
3485                 hci_cc_write_encrypt_mode(hdev, skb);
3486                 break;
3487
3488         case HCI_OP_WRITE_SCAN_ENABLE:
3489                 hci_cc_write_scan_enable(hdev, skb);
3490                 break;
3491
3492         case HCI_OP_SET_EVENT_FLT:
3493                 hci_cc_set_event_filter(hdev, skb);
3494                 break;
3495
3496         case HCI_OP_READ_CLASS_OF_DEV:
3497                 hci_cc_read_class_of_dev(hdev, skb);
3498                 break;
3499
3500         case HCI_OP_WRITE_CLASS_OF_DEV:
3501                 hci_cc_write_class_of_dev(hdev, skb);
3502                 break;
3503
3504         case HCI_OP_READ_VOICE_SETTING:
3505                 hci_cc_read_voice_setting(hdev, skb);
3506                 break;
3507
3508         case HCI_OP_WRITE_VOICE_SETTING:
3509                 hci_cc_write_voice_setting(hdev, skb);
3510                 break;
3511
3512         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3513                 hci_cc_read_num_supported_iac(hdev, skb);
3514                 break;
3515
3516         case HCI_OP_WRITE_SSP_MODE:
3517                 hci_cc_write_ssp_mode(hdev, skb);
3518                 break;
3519
3520         case HCI_OP_WRITE_SC_SUPPORT:
3521                 hci_cc_write_sc_support(hdev, skb);
3522                 break;
3523
3524         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3525                 hci_cc_read_auth_payload_timeout(hdev, skb);
3526                 break;
3527
3528         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3529                 hci_cc_write_auth_payload_timeout(hdev, skb);
3530                 break;
3531
3532         case HCI_OP_READ_LOCAL_VERSION:
3533                 hci_cc_read_local_version(hdev, skb);
3534                 break;
3535
3536         case HCI_OP_READ_LOCAL_COMMANDS:
3537                 hci_cc_read_local_commands(hdev, skb);
3538                 break;
3539
3540         case HCI_OP_READ_LOCAL_FEATURES:
3541                 hci_cc_read_local_features(hdev, skb);
3542                 break;
3543
3544         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3545                 hci_cc_read_local_ext_features(hdev, skb);
3546                 break;
3547
3548         case HCI_OP_READ_BUFFER_SIZE:
3549                 hci_cc_read_buffer_size(hdev, skb);
3550                 break;
3551
3552         case HCI_OP_READ_BD_ADDR:
3553                 hci_cc_read_bd_addr(hdev, skb);
3554                 break;
3555
3556         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3557                 hci_cc_read_local_pairing_opts(hdev, skb);
3558                 break;
3559
3560         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3561                 hci_cc_read_page_scan_activity(hdev, skb);
3562                 break;
3563
3564         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3565                 hci_cc_write_page_scan_activity(hdev, skb);
3566                 break;
3567
3568         case HCI_OP_READ_PAGE_SCAN_TYPE:
3569                 hci_cc_read_page_scan_type(hdev, skb);
3570                 break;
3571
3572         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3573                 hci_cc_write_page_scan_type(hdev, skb);
3574                 break;
3575
3576         case HCI_OP_READ_DATA_BLOCK_SIZE:
3577                 hci_cc_read_data_block_size(hdev, skb);
3578                 break;
3579
3580         case HCI_OP_READ_FLOW_CONTROL_MODE:
3581                 hci_cc_read_flow_control_mode(hdev, skb);
3582                 break;
3583
3584         case HCI_OP_READ_LOCAL_AMP_INFO:
3585                 hci_cc_read_local_amp_info(hdev, skb);
3586                 break;
3587
3588         case HCI_OP_READ_CLOCK:
3589                 hci_cc_read_clock(hdev, skb);
3590                 break;
3591
3592         case HCI_OP_READ_INQ_RSP_TX_POWER:
3593                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3594                 break;
3595
3596         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3597                 hci_cc_read_def_err_data_reporting(hdev, skb);
3598                 break;
3599
3600         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3601                 hci_cc_write_def_err_data_reporting(hdev, skb);
3602                 break;
3603
3604         case HCI_OP_PIN_CODE_REPLY:
3605                 hci_cc_pin_code_reply(hdev, skb);
3606                 break;
3607
3608         case HCI_OP_PIN_CODE_NEG_REPLY:
3609                 hci_cc_pin_code_neg_reply(hdev, skb);
3610                 break;
3611
3612         case HCI_OP_READ_LOCAL_OOB_DATA:
3613                 hci_cc_read_local_oob_data(hdev, skb);
3614                 break;
3615
3616         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3617                 hci_cc_read_local_oob_ext_data(hdev, skb);
3618                 break;
3619
3620         case HCI_OP_LE_READ_BUFFER_SIZE:
3621                 hci_cc_le_read_buffer_size(hdev, skb);
3622                 break;
3623
3624         case HCI_OP_LE_READ_LOCAL_FEATURES:
3625                 hci_cc_le_read_local_features(hdev, skb);
3626                 break;
3627
3628         case HCI_OP_LE_READ_ADV_TX_POWER:
3629                 hci_cc_le_read_adv_tx_power(hdev, skb);
3630                 break;
3631
3632         case HCI_OP_USER_CONFIRM_REPLY:
3633                 hci_cc_user_confirm_reply(hdev, skb);
3634                 break;
3635
3636         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3637                 hci_cc_user_confirm_neg_reply(hdev, skb);
3638                 break;
3639
3640         case HCI_OP_USER_PASSKEY_REPLY:
3641                 hci_cc_user_passkey_reply(hdev, skb);
3642                 break;
3643
3644         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3645                 hci_cc_user_passkey_neg_reply(hdev, skb);
3646                 break;
3647
3648         case HCI_OP_LE_SET_RANDOM_ADDR:
3649                 hci_cc_le_set_random_addr(hdev, skb);
3650                 break;
3651
3652         case HCI_OP_LE_SET_ADV_ENABLE:
3653                 hci_cc_le_set_adv_enable(hdev, skb);
3654                 break;
3655
3656         case HCI_OP_LE_SET_SCAN_PARAM:
3657                 hci_cc_le_set_scan_param(hdev, skb);
3658                 break;
3659
3660         case HCI_OP_LE_SET_SCAN_ENABLE:
3661                 hci_cc_le_set_scan_enable(hdev, skb);
3662                 break;
3663
3664         case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3665                 hci_cc_le_read_accept_list_size(hdev, skb);
3666                 break;
3667
3668         case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3669                 hci_cc_le_clear_accept_list(hdev, skb);
3670                 break;
3671
3672         case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3673                 hci_cc_le_add_to_accept_list(hdev, skb);
3674                 break;
3675
3676         case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3677                 hci_cc_le_del_from_accept_list(hdev, skb);
3678                 break;
3679
3680         case HCI_OP_LE_READ_SUPPORTED_STATES:
3681                 hci_cc_le_read_supported_states(hdev, skb);
3682                 break;
3683
3684         case HCI_OP_LE_READ_DEF_DATA_LEN:
3685                 hci_cc_le_read_def_data_len(hdev, skb);
3686                 break;
3687
3688         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3689                 hci_cc_le_write_def_data_len(hdev, skb);
3690                 break;
3691
3692         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3693                 hci_cc_le_add_to_resolv_list(hdev, skb);
3694                 break;
3695
3696         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3697                 hci_cc_le_del_from_resolv_list(hdev, skb);
3698                 break;
3699
3700         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3701                 hci_cc_le_clear_resolv_list(hdev, skb);
3702                 break;
3703
3704         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3705                 hci_cc_le_read_resolv_list_size(hdev, skb);
3706                 break;
3707
3708         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3709                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3710                 break;
3711
3712         case HCI_OP_LE_READ_MAX_DATA_LEN:
3713                 hci_cc_le_read_max_data_len(hdev, skb);
3714                 break;
3715
3716         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3717                 hci_cc_write_le_host_supported(hdev, skb);
3718                 break;
3719
3720         case HCI_OP_LE_SET_ADV_PARAM:
3721                 hci_cc_set_adv_param(hdev, skb);
3722                 break;
3723
3724         case HCI_OP_READ_RSSI:
3725                 hci_cc_read_rssi(hdev, skb);
3726                 break;
3727
3728         case HCI_OP_READ_TX_POWER:
3729                 hci_cc_read_tx_power(hdev, skb);
3730                 break;
3731
3732         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3733                 hci_cc_write_ssp_debug_mode(hdev, skb);
3734                 break;
3735
3736         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3737                 hci_cc_le_set_ext_scan_param(hdev, skb);
3738                 break;
3739
3740         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3741                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3742                 break;
3743
3744         case HCI_OP_LE_SET_DEFAULT_PHY:
3745                 hci_cc_le_set_default_phy(hdev, skb);
3746                 break;
3747
3748         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3749                 hci_cc_le_read_num_adv_sets(hdev, skb);
3750                 break;
3751
3752         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3753                 hci_cc_set_ext_adv_param(hdev, skb);
3754                 break;
3755
3756         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3757                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3758                 break;
3759
3760         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3761                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3762                 break;
3763
3764         case HCI_OP_LE_READ_TRANSMIT_POWER:
3765                 hci_cc_le_read_transmit_power(hdev, skb);
3766                 break;
3767 #ifdef TIZEN_BT
3768         case HCI_OP_ENABLE_RSSI:
3769                 hci_cc_enable_rssi(hdev, skb);
3770                 break;
3771
3772         case HCI_OP_GET_RAW_RSSI:
3773                 hci_cc_get_raw_rssi(hdev, skb);
3774                 break;
3775 #endif
3776         default:
3777                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3778                 break;
3779         }
3780
3781         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3782
3783         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3784                              req_complete_skb);
3785
3786         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3787                 bt_dev_err(hdev,
3788                            "unexpected event for opcode 0x%4.4x", *opcode);
3789                 return;
3790         }
3791
3792         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3793                 queue_work(hdev->workqueue, &hdev->cmd_work);
3794 }
3795
3796 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3797                                u16 *opcode, u8 *status,
3798                                hci_req_complete_t *req_complete,
3799                                hci_req_complete_skb_t *req_complete_skb)
3800 {
3801         struct hci_ev_cmd_status *ev = (void *) skb->data;
3802
3803         skb_pull(skb, sizeof(*ev));
3804
3805         *opcode = __le16_to_cpu(ev->opcode);
3806         *status = ev->status;
3807
3808         switch (*opcode) {
3809         case HCI_OP_INQUIRY:
3810                 hci_cs_inquiry(hdev, ev->status);
3811                 break;
3812
3813         case HCI_OP_CREATE_CONN:
3814                 hci_cs_create_conn(hdev, ev->status);
3815                 break;
3816
3817         case HCI_OP_DISCONNECT:
3818                 hci_cs_disconnect(hdev, ev->status);
3819                 break;
3820
3821         case HCI_OP_ADD_SCO:
3822                 hci_cs_add_sco(hdev, ev->status);
3823                 break;
3824
3825         case HCI_OP_AUTH_REQUESTED:
3826                 hci_cs_auth_requested(hdev, ev->status);
3827                 break;
3828
3829         case HCI_OP_SET_CONN_ENCRYPT:
3830                 hci_cs_set_conn_encrypt(hdev, ev->status);
3831                 break;
3832
3833         case HCI_OP_REMOTE_NAME_REQ:
3834                 hci_cs_remote_name_req(hdev, ev->status);
3835                 break;
3836
3837         case HCI_OP_READ_REMOTE_FEATURES:
3838                 hci_cs_read_remote_features(hdev, ev->status);
3839                 break;
3840
3841         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3842                 hci_cs_read_remote_ext_features(hdev, ev->status);
3843                 break;
3844
3845         case HCI_OP_SETUP_SYNC_CONN:
3846                 hci_cs_setup_sync_conn(hdev, ev->status);
3847                 break;
3848
3849         case HCI_OP_SNIFF_MODE:
3850                 hci_cs_sniff_mode(hdev, ev->status);
3851                 break;
3852
3853         case HCI_OP_EXIT_SNIFF_MODE:
3854                 hci_cs_exit_sniff_mode(hdev, ev->status);
3855                 break;
3856
3857         case HCI_OP_SWITCH_ROLE:
3858                 hci_cs_switch_role(hdev, ev->status);
3859                 break;
3860
3861         case HCI_OP_LE_CREATE_CONN:
3862                 hci_cs_le_create_conn(hdev, ev->status);
3863                 break;
3864
3865         case HCI_OP_LE_READ_REMOTE_FEATURES:
3866                 hci_cs_le_read_remote_features(hdev, ev->status);
3867                 break;
3868
3869         case HCI_OP_LE_START_ENC:
3870                 hci_cs_le_start_enc(hdev, ev->status);
3871                 break;
3872
3873         case HCI_OP_LE_EXT_CREATE_CONN:
3874                 hci_cs_le_ext_create_conn(hdev, ev->status);
3875                 break;
3876
3877         default:
3878                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3879                 break;
3880         }
3881
3882         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3883
3884         /* Indicate request completion if the command failed. Also, if
3885          * we're not waiting for a special event and we get a success
3886          * command status we should try to flag the request as completed
3887          * (since for this kind of commands there will not be a command
3888          * complete event).
3889          */
3890         if (ev->status ||
3891             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3892                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3893                                      req_complete_skb);
3894
3895         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3896                 bt_dev_err(hdev,
3897                            "unexpected event for opcode 0x%4.4x", *opcode);
3898                 return;
3899         }
3900
3901         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3902                 queue_work(hdev->workqueue, &hdev->cmd_work);
3903 }
3904
3905 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3906 {
3907         struct hci_ev_hardware_error *ev = (void *) skb->data;
3908
3909 #ifdef TIZEN_BT
3910         hci_dev_lock(hdev);
3911         mgmt_hardware_error(hdev, ev->code);
3912         hci_dev_unlock(hdev);
3913 #endif
3914         hdev->hw_error_code = ev->code;
3915
3916         queue_work(hdev->req_workqueue, &hdev->error_reset);
3917 }
3918
3919 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3920 {
3921         struct hci_ev_role_change *ev = (void *) skb->data;
3922         struct hci_conn *conn;
3923
3924         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3925
3926         hci_dev_lock(hdev);
3927
3928         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3929         if (conn) {
3930                 if (!ev->status)
3931                         conn->role = ev->role;
3932
3933                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3934
3935                 hci_role_switch_cfm(conn, ev->status, ev->role);
3936         }
3937
3938         hci_dev_unlock(hdev);
3939 }
3940
3941 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3942 {
3943         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3944         int i;
3945
3946         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3947                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3948                 return;
3949         }
3950
3951         if (skb->len < sizeof(*ev) ||
3952             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3953                 BT_DBG("%s bad parameters", hdev->name);
3954                 return;
3955         }
3956
3957         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3958
3959         for (i = 0; i < ev->num_hndl; i++) {
3960                 struct hci_comp_pkts_info *info = &ev->handles[i];
3961                 struct hci_conn *conn;
3962                 __u16  handle, count;
3963
3964                 handle = __le16_to_cpu(info->handle);
3965                 count  = __le16_to_cpu(info->count);
3966
3967                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3968                 if (!conn)
3969                         continue;
3970
3971                 conn->sent -= count;
3972
3973                 switch (conn->type) {
3974                 case ACL_LINK:
3975                         hdev->acl_cnt += count;
3976                         if (hdev->acl_cnt > hdev->acl_pkts)
3977                                 hdev->acl_cnt = hdev->acl_pkts;
3978                         break;
3979
3980                 case LE_LINK:
3981                         if (hdev->le_pkts) {
3982                                 hdev->le_cnt += count;
3983                                 if (hdev->le_cnt > hdev->le_pkts)
3984                                         hdev->le_cnt = hdev->le_pkts;
3985                         } else {
3986                                 hdev->acl_cnt += count;
3987                                 if (hdev->acl_cnt > hdev->acl_pkts)
3988                                         hdev->acl_cnt = hdev->acl_pkts;
3989                         }
3990                         break;
3991
3992                 case SCO_LINK:
3993                         hdev->sco_cnt += count;
3994                         if (hdev->sco_cnt > hdev->sco_pkts)
3995                                 hdev->sco_cnt = hdev->sco_pkts;
3996                         break;
3997
3998                 default:
3999                         bt_dev_err(hdev, "unknown type %d conn %p",
4000                                    conn->type, conn);
4001                         break;
4002                 }
4003         }
4004
4005         queue_work(hdev->workqueue, &hdev->tx_work);
4006 }
4007
4008 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
4009                                                  __u16 handle)
4010 {
4011         struct hci_chan *chan;
4012
4013         switch (hdev->dev_type) {
4014         case HCI_PRIMARY:
4015                 return hci_conn_hash_lookup_handle(hdev, handle);
4016         case HCI_AMP:
4017                 chan = hci_chan_lookup_handle(hdev, handle);
4018                 if (chan)
4019                         return chan->conn;
4020                 break;
4021         default:
4022                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4023                 break;
4024         }
4025
4026         return NULL;
4027 }
4028
4029 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
4030 {
4031         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
4032         int i;
4033
4034         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
4035                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
4036                 return;
4037         }
4038
4039         if (skb->len < sizeof(*ev) ||
4040             skb->len < struct_size(ev, handles, ev->num_hndl)) {
4041                 BT_DBG("%s bad parameters", hdev->name);
4042                 return;
4043         }
4044
4045         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
4046                ev->num_hndl);
4047
4048         for (i = 0; i < ev->num_hndl; i++) {
4049                 struct hci_comp_blocks_info *info = &ev->handles[i];
4050                 struct hci_conn *conn = NULL;
4051                 __u16  handle, block_count;
4052
4053                 handle = __le16_to_cpu(info->handle);
4054                 block_count = __le16_to_cpu(info->blocks);
4055
4056                 conn = __hci_conn_lookup_handle(hdev, handle);
4057                 if (!conn)
4058                         continue;
4059
4060                 conn->sent -= block_count;
4061
4062                 switch (conn->type) {
4063                 case ACL_LINK:
4064                 case AMP_LINK:
4065                         hdev->block_cnt += block_count;
4066                         if (hdev->block_cnt > hdev->num_blocks)
4067                                 hdev->block_cnt = hdev->num_blocks;
4068                         break;
4069
4070                 default:
4071                         bt_dev_err(hdev, "unknown type %d conn %p",
4072                                    conn->type, conn);
4073                         break;
4074                 }
4075         }
4076
4077         queue_work(hdev->workqueue, &hdev->tx_work);
4078 }
4079
4080 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4081 {
4082         struct hci_ev_mode_change *ev = (void *) skb->data;
4083         struct hci_conn *conn;
4084
4085         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4086
4087         hci_dev_lock(hdev);
4088
4089         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4090         if (conn) {
4091                 conn->mode = ev->mode;
4092
4093                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4094                                         &conn->flags)) {
4095                         if (conn->mode == HCI_CM_ACTIVE)
4096                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4097                         else
4098                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4099                 }
4100
4101                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4102                         hci_sco_setup(conn, ev->status);
4103         }
4104
4105         hci_dev_unlock(hdev);
4106 }
4107
4108 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4109 {
4110         struct hci_ev_pin_code_req *ev = (void *) skb->data;
4111         struct hci_conn *conn;
4112
4113         BT_DBG("%s", hdev->name);
4114
4115         hci_dev_lock(hdev);
4116
4117         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4118         if (!conn)
4119                 goto unlock;
4120
4121         if (conn->state == BT_CONNECTED) {
4122                 hci_conn_hold(conn);
4123                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4124                 hci_conn_drop(conn);
4125         }
4126
4127         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4128             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4129                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4130                              sizeof(ev->bdaddr), &ev->bdaddr);
4131         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4132                 u8 secure;
4133
4134                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4135                         secure = 1;
4136                 else
4137                         secure = 0;
4138
4139                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4140         }
4141
4142 unlock:
4143         hci_dev_unlock(hdev);
4144 }
4145
4146 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4147 {
4148         if (key_type == HCI_LK_CHANGED_COMBINATION)
4149                 return;
4150
4151         conn->pin_length = pin_len;
4152         conn->key_type = key_type;
4153
4154         switch (key_type) {
4155         case HCI_LK_LOCAL_UNIT:
4156         case HCI_LK_REMOTE_UNIT:
4157         case HCI_LK_DEBUG_COMBINATION:
4158                 return;
4159         case HCI_LK_COMBINATION:
4160                 if (pin_len == 16)
4161                         conn->pending_sec_level = BT_SECURITY_HIGH;
4162                 else
4163                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4164                 break;
4165         case HCI_LK_UNAUTH_COMBINATION_P192:
4166         case HCI_LK_UNAUTH_COMBINATION_P256:
4167                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4168                 break;
4169         case HCI_LK_AUTH_COMBINATION_P192:
4170                 conn->pending_sec_level = BT_SECURITY_HIGH;
4171                 break;
4172         case HCI_LK_AUTH_COMBINATION_P256:
4173                 conn->pending_sec_level = BT_SECURITY_FIPS;
4174                 break;
4175         }
4176 }
4177
4178 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4179 {
4180         struct hci_ev_link_key_req *ev = (void *) skb->data;
4181         struct hci_cp_link_key_reply cp;
4182         struct hci_conn *conn;
4183         struct link_key *key;
4184
4185         BT_DBG("%s", hdev->name);
4186
4187         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4188                 return;
4189
4190         hci_dev_lock(hdev);
4191
4192         key = hci_find_link_key(hdev, &ev->bdaddr);
4193         if (!key) {
4194                 BT_DBG("%s link key not found for %pMR", hdev->name,
4195                        &ev->bdaddr);
4196                 goto not_found;
4197         }
4198
4199         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4200                &ev->bdaddr);
4201
4202         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4203         if (conn) {
4204                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4205
4206                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4207                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4208                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4209                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4210                         goto not_found;
4211                 }
4212
4213                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4214                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4215                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4216                         BT_DBG("%s ignoring key unauthenticated for high security",
4217                                hdev->name);
4218                         goto not_found;
4219                 }
4220
4221                 conn_set_key(conn, key->type, key->pin_len);
4222         }
4223
4224         bacpy(&cp.bdaddr, &ev->bdaddr);
4225         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4226
4227         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4228
4229         hci_dev_unlock(hdev);
4230
4231         return;
4232
4233 not_found:
4234         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4235         hci_dev_unlock(hdev);
4236 }
4237
4238 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4239 {
4240         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4241         struct hci_conn *conn;
4242         struct link_key *key;
4243         bool persistent;
4244         u8 pin_len = 0;
4245
4246         BT_DBG("%s", hdev->name);
4247
4248         hci_dev_lock(hdev);
4249
4250         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4251         if (!conn)
4252                 goto unlock;
4253
4254         hci_conn_hold(conn);
4255         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4256         hci_conn_drop(conn);
4257
4258         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4259         conn_set_key(conn, ev->key_type, conn->pin_length);
4260
4261         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4262                 goto unlock;
4263
4264         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4265                                 ev->key_type, pin_len, &persistent);
4266         if (!key)
4267                 goto unlock;
4268
4269         /* Update connection information since adding the key will have
4270          * fixed up the type in the case of changed combination keys.
4271          */
4272         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4273                 conn_set_key(conn, key->type, key->pin_len);
4274
4275         mgmt_new_link_key(hdev, key, persistent);
4276
4277         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4278          * is set. If it's not set simply remove the key from the kernel
4279          * list (we've still notified user space about it but with
4280          * store_hint being 0).
4281          */
4282         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4283             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4284                 list_del_rcu(&key->list);
4285                 kfree_rcu(key, rcu);
4286                 goto unlock;
4287         }
4288
4289         if (persistent)
4290                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4291         else
4292                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4293
4294 unlock:
4295         hci_dev_unlock(hdev);
4296 }
4297
4298 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4299 {
4300         struct hci_ev_clock_offset *ev = (void *) skb->data;
4301         struct hci_conn *conn;
4302
4303         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4304
4305         hci_dev_lock(hdev);
4306
4307         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4308         if (conn && !ev->status) {
4309                 struct inquiry_entry *ie;
4310
4311                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4312                 if (ie) {
4313                         ie->data.clock_offset = ev->clock_offset;
4314                         ie->timestamp = jiffies;
4315                 }
4316         }
4317
4318         hci_dev_unlock(hdev);
4319 }
4320
4321 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4322 {
4323         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4324         struct hci_conn *conn;
4325
4326         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4327
4328         hci_dev_lock(hdev);
4329
4330         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4331         if (conn && !ev->status)
4332                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4333
4334         hci_dev_unlock(hdev);
4335 }
4336
4337 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4338 {
4339         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4340         struct inquiry_entry *ie;
4341
4342         BT_DBG("%s", hdev->name);
4343
4344         hci_dev_lock(hdev);
4345
4346         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4347         if (ie) {
4348                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4349                 ie->timestamp = jiffies;
4350         }
4351
4352         hci_dev_unlock(hdev);
4353 }
4354
4355 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4356                                              struct sk_buff *skb)
4357 {
4358         struct inquiry_data data;
4359         int num_rsp = *((__u8 *) skb->data);
4360
4361         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4362
4363         if (!num_rsp)
4364                 return;
4365
4366         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4367                 return;
4368
4369         hci_dev_lock(hdev);
4370
4371         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4372                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4373                 info = (void *) (skb->data + 1);
4374
4375                 if (skb->len < num_rsp * sizeof(*info) + 1)
4376                         goto unlock;
4377
4378                 for (; num_rsp; num_rsp--, info++) {
4379                         u32 flags;
4380
4381                         bacpy(&data.bdaddr, &info->bdaddr);
4382                         data.pscan_rep_mode     = info->pscan_rep_mode;
4383                         data.pscan_period_mode  = info->pscan_period_mode;
4384                         data.pscan_mode         = info->pscan_mode;
4385                         memcpy(data.dev_class, info->dev_class, 3);
4386                         data.clock_offset       = info->clock_offset;
4387                         data.rssi               = info->rssi;
4388                         data.ssp_mode           = 0x00;
4389
4390                         flags = hci_inquiry_cache_update(hdev, &data, false);
4391
4392                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4393                                           info->dev_class, info->rssi,
4394                                           flags, NULL, 0, NULL, 0);
4395                 }
4396         } else {
4397                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4398
4399                 if (skb->len < num_rsp * sizeof(*info) + 1)
4400                         goto unlock;
4401
4402                 for (; num_rsp; num_rsp--, info++) {
4403                         u32 flags;
4404
4405                         bacpy(&data.bdaddr, &info->bdaddr);
4406                         data.pscan_rep_mode     = info->pscan_rep_mode;
4407                         data.pscan_period_mode  = info->pscan_period_mode;
4408                         data.pscan_mode         = 0x00;
4409                         memcpy(data.dev_class, info->dev_class, 3);
4410                         data.clock_offset       = info->clock_offset;
4411                         data.rssi               = info->rssi;
4412                         data.ssp_mode           = 0x00;
4413
4414                         flags = hci_inquiry_cache_update(hdev, &data, false);
4415
4416                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4417                                           info->dev_class, info->rssi,
4418                                           flags, NULL, 0, NULL, 0);
4419                 }
4420         }
4421
4422 unlock:
4423         hci_dev_unlock(hdev);
4424 }
4425
4426 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4427                                         struct sk_buff *skb)
4428 {
4429         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4430         struct hci_conn *conn;
4431
4432         BT_DBG("%s", hdev->name);
4433
4434         hci_dev_lock(hdev);
4435
4436         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4437         if (!conn)
4438                 goto unlock;
4439
4440         if (ev->page < HCI_MAX_PAGES)
4441                 memcpy(conn->features[ev->page], ev->features, 8);
4442
4443         if (!ev->status && ev->page == 0x01) {
4444                 struct inquiry_entry *ie;
4445
4446                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4447                 if (ie)
4448                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4449
4450                 if (ev->features[0] & LMP_HOST_SSP) {
4451                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4452                 } else {
4453                         /* It is mandatory by the Bluetooth specification that
4454                          * Extended Inquiry Results are only used when Secure
4455                          * Simple Pairing is enabled, but some devices violate
4456                          * this.
4457                          *
4458                          * To make these devices work, the internal SSP
4459                          * enabled flag needs to be cleared if the remote host
4460                          * features do not indicate SSP support */
4461                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4462                 }
4463
4464                 if (ev->features[0] & LMP_HOST_SC)
4465                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4466         }
4467
4468         if (conn->state != BT_CONFIG)
4469                 goto unlock;
4470
4471         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4472                 struct hci_cp_remote_name_req cp;
4473                 memset(&cp, 0, sizeof(cp));
4474                 bacpy(&cp.bdaddr, &conn->dst);
4475                 cp.pscan_rep_mode = 0x02;
4476                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4477         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4478                 mgmt_device_connected(hdev, conn, NULL, 0);
4479
4480         if (!hci_outgoing_auth_needed(hdev, conn)) {
4481                 conn->state = BT_CONNECTED;
4482                 hci_connect_cfm(conn, ev->status);
4483                 hci_conn_drop(conn);
4484         }
4485
4486 unlock:
4487         hci_dev_unlock(hdev);
4488 }
4489
4490 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4491                                        struct sk_buff *skb)
4492 {
4493         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4494         struct hci_conn *conn;
4495
4496         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4497
4498         hci_dev_lock(hdev);
4499
4500         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4501         if (!conn) {
4502                 if (ev->link_type == ESCO_LINK)
4503                         goto unlock;
4504
4505                 /* When the link type in the event indicates SCO connection
4506                  * and lookup of the connection object fails, then check
4507                  * if an eSCO connection object exists.
4508                  *
4509                  * The core limits the synchronous connections to either
4510                  * SCO or eSCO. The eSCO connection is preferred and tried
4511                  * to be setup first and until successfully established,
4512                  * the link type will be hinted as eSCO.
4513                  */
4514                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4515                 if (!conn)
4516                         goto unlock;
4517         }
4518
4519         switch (ev->status) {
4520         case 0x00:
4521                 /* The synchronous connection complete event should only be
4522                  * sent once per new connection. Receiving a successful
4523                  * complete event when the connection status is already
4524                  * BT_CONNECTED means that the device is misbehaving and sent
4525                  * multiple complete event packets for the same new connection.
4526                  *
4527                  * Registering the device more than once can corrupt kernel
4528                  * memory, hence upon detecting this invalid event, we report
4529                  * an error and ignore the packet.
4530                  */
4531                 if (conn->state == BT_CONNECTED) {
4532                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4533                         goto unlock;
4534                 }
4535
4536                 conn->handle = __le16_to_cpu(ev->handle);
4537                 conn->state  = BT_CONNECTED;
4538                 conn->type   = ev->link_type;
4539
4540                 hci_debugfs_create_conn(conn);
4541                 hci_conn_add_sysfs(conn);
4542                 break;
4543
4544         case 0x10:      /* Connection Accept Timeout */
4545         case 0x0d:      /* Connection Rejected due to Limited Resources */
4546         case 0x11:      /* Unsupported Feature or Parameter Value */
4547         case 0x1c:      /* SCO interval rejected */
4548         case 0x1a:      /* Unsupported Remote Feature */
4549         case 0x1e:      /* Invalid LMP Parameters */
4550         case 0x1f:      /* Unspecified error */
4551         case 0x20:      /* Unsupported LMP Parameter value */
4552                 if (conn->out) {
4553                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4554                                         (hdev->esco_type & EDR_ESCO_MASK);
4555                         if (hci_setup_sync(conn, conn->link->handle))
4556                                 goto unlock;
4557                 }
4558                 fallthrough;
4559
4560         default:
4561                 conn->state = BT_CLOSED;
4562                 break;
4563         }
4564
4565         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4566
4567         switch (ev->air_mode) {
4568         case 0x02:
4569                 if (hdev->notify)
4570                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4571                 break;
4572         case 0x03:
4573                 if (hdev->notify)
4574                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4575                 break;
4576         }
4577
4578         hci_connect_cfm(conn, ev->status);
4579         if (ev->status)
4580                 hci_conn_del(conn);
4581
4582 unlock:
4583         hci_dev_unlock(hdev);
4584 }
4585
4586 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4587 {
4588         size_t parsed = 0;
4589
4590         while (parsed < eir_len) {
4591                 u8 field_len = eir[0];
4592
4593                 if (field_len == 0)
4594                         return parsed;
4595
4596                 parsed += field_len + 1;
4597                 eir += field_len + 1;
4598         }
4599
4600         return eir_len;
4601 }
4602
4603 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4604                                             struct sk_buff *skb)
4605 {
4606         struct inquiry_data data;
4607         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4608         int num_rsp = *((__u8 *) skb->data);
4609         size_t eir_len;
4610
4611         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4612
4613         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4614                 return;
4615
4616         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4617                 return;
4618
4619         hci_dev_lock(hdev);
4620
4621         for (; num_rsp; num_rsp--, info++) {
4622                 u32 flags;
4623                 bool name_known;
4624
4625                 bacpy(&data.bdaddr, &info->bdaddr);
4626                 data.pscan_rep_mode     = info->pscan_rep_mode;
4627                 data.pscan_period_mode  = info->pscan_period_mode;
4628                 data.pscan_mode         = 0x00;
4629                 memcpy(data.dev_class, info->dev_class, 3);
4630                 data.clock_offset       = info->clock_offset;
4631                 data.rssi               = info->rssi;
4632                 data.ssp_mode           = 0x01;
4633
4634                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4635                         name_known = eir_get_data(info->data,
4636                                                   sizeof(info->data),
4637                                                   EIR_NAME_COMPLETE, NULL);
4638                 else
4639                         name_known = true;
4640
4641                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4642
4643                 eir_len = eir_get_length(info->data, sizeof(info->data));
4644
4645                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4646                                   info->dev_class, info->rssi,
4647                                   flags, info->data, eir_len, NULL, 0);
4648         }
4649
4650         hci_dev_unlock(hdev);
4651 }
4652
4653 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4654                                          struct sk_buff *skb)
4655 {
4656         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4657         struct hci_conn *conn;
4658
4659         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4660                __le16_to_cpu(ev->handle));
4661
4662         hci_dev_lock(hdev);
4663
4664         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4665         if (!conn)
4666                 goto unlock;
4667
4668         /* For BR/EDR the necessary steps are taken through the
4669          * auth_complete event.
4670          */
4671         if (conn->type != LE_LINK)
4672                 goto unlock;
4673
4674         if (!ev->status)
4675                 conn->sec_level = conn->pending_sec_level;
4676
4677         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4678
4679         if (ev->status && conn->state == BT_CONNECTED) {
4680                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4681                 hci_conn_drop(conn);
4682                 goto unlock;
4683         }
4684
4685         if (conn->state == BT_CONFIG) {
4686                 if (!ev->status)
4687                         conn->state = BT_CONNECTED;
4688
4689                 hci_connect_cfm(conn, ev->status);
4690                 hci_conn_drop(conn);
4691         } else {
4692                 hci_auth_cfm(conn, ev->status);
4693
4694                 hci_conn_hold(conn);
4695                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4696                 hci_conn_drop(conn);
4697         }
4698
4699 unlock:
4700         hci_dev_unlock(hdev);
4701 }
4702
4703 static u8 hci_get_auth_req(struct hci_conn *conn)
4704 {
4705         /* If remote requests no-bonding follow that lead */
4706         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4707             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4708                 return conn->remote_auth | (conn->auth_type & 0x01);
4709
4710         /* If both remote and local have enough IO capabilities, require
4711          * MITM protection
4712          */
4713         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4714             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4715                 return conn->remote_auth | 0x01;
4716
4717         /* No MITM protection possible so ignore remote requirement */
4718         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4719 }
4720
4721 static u8 bredr_oob_data_present(struct hci_conn *conn)
4722 {
4723         struct hci_dev *hdev = conn->hdev;
4724         struct oob_data *data;
4725
4726         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4727         if (!data)
4728                 return 0x00;
4729
4730         if (bredr_sc_enabled(hdev)) {
4731                 /* When Secure Connections is enabled, then just
4732                  * return the present value stored with the OOB
4733                  * data. The stored value contains the right present
4734                  * information. However it can only be trusted when
4735                  * not in Secure Connection Only mode.
4736                  */
4737                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4738                         return data->present;
4739
4740                 /* When Secure Connections Only mode is enabled, then
4741                  * the P-256 values are required. If they are not
4742                  * available, then do not declare that OOB data is
4743                  * present.
4744                  */
4745                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4746                     !memcmp(data->hash256, ZERO_KEY, 16))
4747                         return 0x00;
4748
4749                 return 0x02;
4750         }
4751
4752         /* When Secure Connections is not enabled or actually
4753          * not supported by the hardware, then check that if
4754          * P-192 data values are present.
4755          */
4756         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4757             !memcmp(data->hash192, ZERO_KEY, 16))
4758                 return 0x00;
4759
4760         return 0x01;
4761 }
4762
4763 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4764 {
4765         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4766         struct hci_conn *conn;
4767
4768         BT_DBG("%s", hdev->name);
4769
4770         hci_dev_lock(hdev);
4771
4772         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4773         if (!conn)
4774                 goto unlock;
4775
4776         hci_conn_hold(conn);
4777
4778         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4779                 goto unlock;
4780
4781         /* Allow pairing if we're pairable, the initiators of the
4782          * pairing or if the remote is not requesting bonding.
4783          */
4784         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4785             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4786             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4787                 struct hci_cp_io_capability_reply cp;
4788
4789                 bacpy(&cp.bdaddr, &ev->bdaddr);
4790                 /* Change the IO capability from KeyboardDisplay
4791                  * to DisplayYesNo as it is not supported by BT spec. */
4792                 cp.capability = (conn->io_capability == 0x04) ?
4793                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4794
4795                 /* If we are initiators, there is no remote information yet */
4796                 if (conn->remote_auth == 0xff) {
4797                         /* Request MITM protection if our IO caps allow it
4798                          * except for the no-bonding case.
4799                          */
4800                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4801                             conn->auth_type != HCI_AT_NO_BONDING)
4802                                 conn->auth_type |= 0x01;
4803                 } else {
4804                         conn->auth_type = hci_get_auth_req(conn);
4805                 }
4806
4807                 /* If we're not bondable, force one of the non-bondable
4808                  * authentication requirement values.
4809                  */
4810                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4811                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4812
4813                 cp.authentication = conn->auth_type;
4814                 cp.oob_data = bredr_oob_data_present(conn);
4815
4816                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4817                              sizeof(cp), &cp);
4818         } else {
4819                 struct hci_cp_io_capability_neg_reply cp;
4820
4821                 bacpy(&cp.bdaddr, &ev->bdaddr);
4822                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4823
4824                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4825                              sizeof(cp), &cp);
4826         }
4827
4828 unlock:
4829         hci_dev_unlock(hdev);
4830 }
4831
4832 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4833 {
4834         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4835         struct hci_conn *conn;
4836
4837         BT_DBG("%s", hdev->name);
4838
4839         hci_dev_lock(hdev);
4840
4841         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4842         if (!conn)
4843                 goto unlock;
4844
4845         conn->remote_cap = ev->capability;
4846         conn->remote_auth = ev->authentication;
4847
4848 unlock:
4849         hci_dev_unlock(hdev);
4850 }
4851
4852 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4853                                          struct sk_buff *skb)
4854 {
4855         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4856         int loc_mitm, rem_mitm, confirm_hint = 0;
4857         struct hci_conn *conn;
4858
4859         BT_DBG("%s", hdev->name);
4860
4861         hci_dev_lock(hdev);
4862
4863         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4864                 goto unlock;
4865
4866         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4867         if (!conn)
4868                 goto unlock;
4869
4870         loc_mitm = (conn->auth_type & 0x01);
4871         rem_mitm = (conn->remote_auth & 0x01);
4872
4873         /* If we require MITM but the remote device can't provide that
4874          * (it has NoInputNoOutput) then reject the confirmation
4875          * request. We check the security level here since it doesn't
4876          * necessarily match conn->auth_type.
4877          */
4878         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4879             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4880                 BT_DBG("Rejecting request: remote device can't provide MITM");
4881                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4882                              sizeof(ev->bdaddr), &ev->bdaddr);
4883                 goto unlock;
4884         }
4885
4886         /* If no side requires MITM protection; auto-accept */
4887         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4888             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4889
4890                 /* If we're not the initiators request authorization to
4891                  * proceed from user space (mgmt_user_confirm with
4892                  * confirm_hint set to 1). The exception is if neither
4893                  * side had MITM or if the local IO capability is
4894                  * NoInputNoOutput, in which case we do auto-accept
4895                  */
4896                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4897                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4898                     (loc_mitm || rem_mitm)) {
4899                         BT_DBG("Confirming auto-accept as acceptor");
4900                         confirm_hint = 1;
4901                         goto confirm;
4902                 }
4903
4904                 /* If there already exists link key in local host, leave the
4905                  * decision to user space since the remote device could be
4906                  * legitimate or malicious.
4907                  */
4908                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4909                         bt_dev_dbg(hdev, "Local host already has link key");
4910                         confirm_hint = 1;
4911                         goto confirm;
4912                 }
4913
4914                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4915                        hdev->auto_accept_delay);
4916
4917                 if (hdev->auto_accept_delay > 0) {
4918                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4919                         queue_delayed_work(conn->hdev->workqueue,
4920                                            &conn->auto_accept_work, delay);
4921                         goto unlock;
4922                 }
4923
4924                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4925                              sizeof(ev->bdaddr), &ev->bdaddr);
4926                 goto unlock;
4927         }
4928
4929 confirm:
4930         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4931                                   le32_to_cpu(ev->passkey), confirm_hint);
4932
4933 unlock:
4934         hci_dev_unlock(hdev);
4935 }
4936
4937 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4938                                          struct sk_buff *skb)
4939 {
4940         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4941
4942         BT_DBG("%s", hdev->name);
4943
4944         if (hci_dev_test_flag(hdev, HCI_MGMT))
4945                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4946 }
4947
4948 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4949                                         struct sk_buff *skb)
4950 {
4951         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4952         struct hci_conn *conn;
4953
4954         BT_DBG("%s", hdev->name);
4955
4956         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4957         if (!conn)
4958                 return;
4959
4960         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4961         conn->passkey_entered = 0;
4962
4963         if (hci_dev_test_flag(hdev, HCI_MGMT))
4964                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4965                                          conn->dst_type, conn->passkey_notify,
4966                                          conn->passkey_entered);
4967 }
4968
4969 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4970 {
4971         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4972         struct hci_conn *conn;
4973
4974         BT_DBG("%s", hdev->name);
4975
4976         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4977         if (!conn)
4978                 return;
4979
4980         switch (ev->type) {
4981         case HCI_KEYPRESS_STARTED:
4982                 conn->passkey_entered = 0;
4983                 return;
4984
4985         case HCI_KEYPRESS_ENTERED:
4986                 conn->passkey_entered++;
4987                 break;
4988
4989         case HCI_KEYPRESS_ERASED:
4990                 conn->passkey_entered--;
4991                 break;
4992
4993         case HCI_KEYPRESS_CLEARED:
4994                 conn->passkey_entered = 0;
4995                 break;
4996
4997         case HCI_KEYPRESS_COMPLETED:
4998                 return;
4999         }
5000
5001         if (hci_dev_test_flag(hdev, HCI_MGMT))
5002                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
5003                                          conn->dst_type, conn->passkey_notify,
5004                                          conn->passkey_entered);
5005 }
5006
5007 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
5008                                          struct sk_buff *skb)
5009 {
5010         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
5011         struct hci_conn *conn;
5012
5013         BT_DBG("%s", hdev->name);
5014
5015         hci_dev_lock(hdev);
5016
5017         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5018         if (!conn)
5019                 goto unlock;
5020
5021         /* Reset the authentication requirement to unknown */
5022         conn->remote_auth = 0xff;
5023
5024         /* To avoid duplicate auth_failed events to user space we check
5025          * the HCI_CONN_AUTH_PEND flag which will be set if we
5026          * initiated the authentication. A traditional auth_complete
5027          * event gets always produced as initiator and is also mapped to
5028          * the mgmt_auth_failed event */
5029         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
5030                 mgmt_auth_failed(conn, ev->status);
5031
5032         hci_conn_drop(conn);
5033
5034 unlock:
5035         hci_dev_unlock(hdev);
5036 }
5037
5038 static void hci_remote_host_features_evt(struct hci_dev *hdev,
5039                                          struct sk_buff *skb)
5040 {
5041         struct hci_ev_remote_host_features *ev = (void *) skb->data;
5042         struct inquiry_entry *ie;
5043         struct hci_conn *conn;
5044
5045         BT_DBG("%s", hdev->name);
5046
5047         hci_dev_lock(hdev);
5048
5049         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5050         if (conn)
5051                 memcpy(conn->features[1], ev->features, 8);
5052
5053         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5054         if (ie)
5055                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5056
5057         hci_dev_unlock(hdev);
5058 }
5059
5060 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
5061                                             struct sk_buff *skb)
5062 {
5063         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
5064         struct oob_data *data;
5065
5066         BT_DBG("%s", hdev->name);
5067
5068         hci_dev_lock(hdev);
5069
5070         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5071                 goto unlock;
5072
5073         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5074         if (!data) {
5075                 struct hci_cp_remote_oob_data_neg_reply cp;
5076
5077                 bacpy(&cp.bdaddr, &ev->bdaddr);
5078                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5079                              sizeof(cp), &cp);
5080                 goto unlock;
5081         }
5082
5083         if (bredr_sc_enabled(hdev)) {
5084                 struct hci_cp_remote_oob_ext_data_reply cp;
5085
5086                 bacpy(&cp.bdaddr, &ev->bdaddr);
5087                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5088                         memset(cp.hash192, 0, sizeof(cp.hash192));
5089                         memset(cp.rand192, 0, sizeof(cp.rand192));
5090                 } else {
5091                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5092                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5093                 }
5094                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5095                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5096
5097                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5098                              sizeof(cp), &cp);
5099         } else {
5100                 struct hci_cp_remote_oob_data_reply cp;
5101
5102                 bacpy(&cp.bdaddr, &ev->bdaddr);
5103                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5104                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5105
5106                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5107                              sizeof(cp), &cp);
5108         }
5109
5110 unlock:
5111         hci_dev_unlock(hdev);
5112 }
5113
5114 #if IS_ENABLED(CONFIG_BT_HS)
5115 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5116 {
5117         struct hci_ev_channel_selected *ev = (void *)skb->data;
5118         struct hci_conn *hcon;
5119
5120         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5121
5122         skb_pull(skb, sizeof(*ev));
5123
5124         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5125         if (!hcon)
5126                 return;
5127
5128         amp_read_loc_assoc_final_data(hdev, hcon);
5129 }
5130
5131 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
5132                                       struct sk_buff *skb)
5133 {
5134         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
5135         struct hci_conn *hcon, *bredr_hcon;
5136
5137         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
5138                ev->status);
5139
5140         hci_dev_lock(hdev);
5141
5142         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5143         if (!hcon)
5144                 goto unlock;
5145
5146         if (!hcon->amp_mgr)
5147                 goto unlock;
5148
5149         if (ev->status) {
5150                 hci_conn_del(hcon);
5151                 goto unlock;
5152         }
5153
5154         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5155
5156         hcon->state = BT_CONNECTED;
5157         bacpy(&hcon->dst, &bredr_hcon->dst);
5158
5159         hci_conn_hold(hcon);
5160         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5161         hci_conn_drop(hcon);
5162
5163         hci_debugfs_create_conn(hcon);
5164         hci_conn_add_sysfs(hcon);
5165
5166         amp_physical_cfm(bredr_hcon, hcon);
5167
5168 unlock:
5169         hci_dev_unlock(hdev);
5170 }
5171
5172 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5173 {
5174         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
5175         struct hci_conn *hcon;
5176         struct hci_chan *hchan;
5177         struct amp_mgr *mgr;
5178
5179         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5180                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
5181                ev->status);
5182
5183         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5184         if (!hcon)
5185                 return;
5186
5187         /* Create AMP hchan */
5188         hchan = hci_chan_create(hcon);
5189         if (!hchan)
5190                 return;
5191
5192         hchan->handle = le16_to_cpu(ev->handle);
5193         hchan->amp = true;
5194
5195         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5196
5197         mgr = hcon->amp_mgr;
5198         if (mgr && mgr->bredr_chan) {
5199                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5200
5201                 l2cap_chan_lock(bredr_chan);
5202
5203                 bredr_chan->conn->mtu = hdev->block_mtu;
5204                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5205                 hci_conn_hold(hcon);
5206
5207                 l2cap_chan_unlock(bredr_chan);
5208         }
5209 }
5210
5211 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5212                                              struct sk_buff *skb)
5213 {
5214         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5215         struct hci_chan *hchan;
5216
5217         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5218                le16_to_cpu(ev->handle), ev->status);
5219
5220         if (ev->status)
5221                 return;
5222
5223         hci_dev_lock(hdev);
5224
5225         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5226         if (!hchan || !hchan->amp)
5227                 goto unlock;
5228
5229         amp_destroy_logical_link(hchan, ev->reason);
5230
5231 unlock:
5232         hci_dev_unlock(hdev);
5233 }
5234
5235 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5236                                              struct sk_buff *skb)
5237 {
5238         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5239         struct hci_conn *hcon;
5240
5241         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5242
5243         if (ev->status)
5244                 return;
5245
5246         hci_dev_lock(hdev);
5247
5248         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5249         if (hcon) {
5250                 hcon->state = BT_CLOSED;
5251                 hci_conn_del(hcon);
5252         }
5253
5254         hci_dev_unlock(hdev);
5255 }
5256 #endif
5257
5258 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5259                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5260 {
5261         if (conn->out) {
5262                 conn->dst_type = bdaddr_type;
5263                 conn->resp_addr_type = bdaddr_type;
5264                 bacpy(&conn->resp_addr, bdaddr);
5265
5266                 /* Check if the controller has set a Local RPA then it must be
5267                  * used instead or hdev->rpa.
5268                  */
5269                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5270                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5271                         bacpy(&conn->init_addr, local_rpa);
5272                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5273                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5274                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5275                 } else {
5276                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5277                                                   &conn->init_addr_type);
5278                 }
5279         } else {
5280                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5281                 /* Check if the controller has set a Local RPA then it must be
5282                  * used instead or hdev->rpa.
5283                  */
5284                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5285                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5286                         bacpy(&conn->resp_addr, local_rpa);
5287                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5288                         /* In case of ext adv, resp_addr will be updated in
5289                          * Adv Terminated event.
5290                          */
5291                         if (!ext_adv_capable(conn->hdev))
5292                                 bacpy(&conn->resp_addr,
5293                                       &conn->hdev->random_addr);
5294                 } else {
5295                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5296                 }
5297
5298                 conn->init_addr_type = bdaddr_type;
5299                 bacpy(&conn->init_addr, bdaddr);
5300
5301                 /* For incoming connections, set the default minimum
5302                  * and maximum connection interval. They will be used
5303                  * to check if the parameters are in range and if not
5304                  * trigger the connection update procedure.
5305                  */
5306                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5307                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5308         }
5309 }
5310
5311 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5312                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5313                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5314                                  u16 interval, u16 latency,
5315                                  u16 supervision_timeout)
5316 {
5317         struct hci_conn_params *params;
5318         struct hci_conn *conn;
5319         struct smp_irk *irk;
5320         u8 addr_type;
5321
5322         hci_dev_lock(hdev);
5323
5324         /* All controllers implicitly stop advertising in the event of a
5325          * connection, so ensure that the state bit is cleared.
5326          */
5327         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5328
5329         conn = hci_lookup_le_connect(hdev);
5330         if (!conn) {
5331                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5332                 if (!conn) {
5333                         bt_dev_err(hdev, "no memory for new connection");
5334                         goto unlock;
5335                 }
5336
5337                 conn->dst_type = bdaddr_type;
5338
5339                 /* If we didn't have a hci_conn object previously
5340                  * but we're in central role this must be something
5341                  * initiated using an accept list. Since accept list based
5342                  * connections are not "first class citizens" we don't
5343                  * have full tracking of them. Therefore, we go ahead
5344                  * with a "best effort" approach of determining the
5345                  * initiator address based on the HCI_PRIVACY flag.
5346                  */
5347                 if (conn->out) {
5348                         conn->resp_addr_type = bdaddr_type;
5349                         bacpy(&conn->resp_addr, bdaddr);
5350                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5351                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5352                                 bacpy(&conn->init_addr, &hdev->rpa);
5353                         } else {
5354                                 hci_copy_identity_address(hdev,
5355                                                           &conn->init_addr,
5356                                                           &conn->init_addr_type);
5357                         }
5358                 }
5359         } else {
5360                 cancel_delayed_work(&conn->le_conn_timeout);
5361         }
5362
5363         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5364
5365         /* Lookup the identity address from the stored connection
5366          * address and address type.
5367          *
5368          * When establishing connections to an identity address, the
5369          * connection procedure will store the resolvable random
5370          * address first. Now if it can be converted back into the
5371          * identity address, start using the identity address from
5372          * now on.
5373          */
5374         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5375         if (irk) {
5376                 bacpy(&conn->dst, &irk->bdaddr);
5377                 conn->dst_type = irk->addr_type;
5378         }
5379
5380         /* When using controller based address resolution, then the new
5381          * address types 0x02 and 0x03 are used. These types need to be
5382          * converted back into either public address or random address type
5383          */
5384         if (use_ll_privacy(hdev) &&
5385             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5386             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
5387                 switch (conn->dst_type) {
5388                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
5389                         conn->dst_type = ADDR_LE_DEV_PUBLIC;
5390                         break;
5391                 case ADDR_LE_DEV_RANDOM_RESOLVED:
5392                         conn->dst_type = ADDR_LE_DEV_RANDOM;
5393                         break;
5394                 }
5395         }
5396
5397         if (status) {
5398                 hci_le_conn_failed(conn, status);
5399                 goto unlock;
5400         }
5401
5402         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5403                 addr_type = BDADDR_LE_PUBLIC;
5404         else
5405                 addr_type = BDADDR_LE_RANDOM;
5406
5407         /* Drop the connection if the device is blocked */
5408         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5409                 hci_conn_drop(conn);
5410                 goto unlock;
5411         }
5412
5413         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5414                 mgmt_device_connected(hdev, conn, NULL, 0);
5415
5416         conn->sec_level = BT_SECURITY_LOW;
5417         conn->handle = handle;
5418         conn->state = BT_CONFIG;
5419
5420         /* Store current advertising instance as connection advertising instance
5421          * when sotfware rotation is in use so it can be re-enabled when
5422          * disconnected.
5423          */
5424         if (!ext_adv_capable(hdev))
5425                 conn->adv_instance = hdev->cur_adv_instance;
5426
5427         conn->le_conn_interval = interval;
5428         conn->le_conn_latency = latency;
5429         conn->le_supv_timeout = supervision_timeout;
5430
5431         hci_debugfs_create_conn(conn);
5432         hci_conn_add_sysfs(conn);
5433
5434         /* The remote features procedure is defined for central
5435          * role only. So only in case of an initiated connection
5436          * request the remote features.
5437          *
5438          * If the local controller supports peripheral-initiated features
5439          * exchange, then requesting the remote features in peripheral
5440          * role is possible. Otherwise just transition into the
5441          * connected state without requesting the remote features.
5442          */
5443         if (conn->out ||
5444             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5445                 struct hci_cp_le_read_remote_features cp;
5446
5447                 cp.handle = __cpu_to_le16(conn->handle);
5448
5449                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5450                              sizeof(cp), &cp);
5451
5452                 hci_conn_hold(conn);
5453         } else {
5454                 conn->state = BT_CONNECTED;
5455                 hci_connect_cfm(conn, status);
5456         }
5457
5458         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5459                                            conn->dst_type);
5460         if (params) {
5461                 list_del_init(&params->action);
5462                 if (params->conn) {
5463                         hci_conn_drop(params->conn);
5464                         hci_conn_put(params->conn);
5465                         params->conn = NULL;
5466                 }
5467         }
5468
5469 unlock:
5470         hci_update_background_scan(hdev);
5471         hci_dev_unlock(hdev);
5472 }
5473
5474 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5475 {
5476         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5477
5478         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5479
5480         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5481                              NULL, ev->role, le16_to_cpu(ev->handle),
5482                              le16_to_cpu(ev->interval),
5483                              le16_to_cpu(ev->latency),
5484                              le16_to_cpu(ev->supervision_timeout));
5485 }
5486
5487 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5488                                          struct sk_buff *skb)
5489 {
5490         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5491
5492         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5493
5494         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5495                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5496                              le16_to_cpu(ev->interval),
5497                              le16_to_cpu(ev->latency),
5498                              le16_to_cpu(ev->supervision_timeout));
5499
5500         if (use_ll_privacy(hdev) &&
5501             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5502             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5503                 hci_req_disable_address_resolution(hdev);
5504 }
5505
5506 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5507 {
5508         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5509         struct hci_conn *conn;
5510         struct adv_info *adv;
5511
5512         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5513
5514         adv = hci_find_adv_instance(hdev, ev->handle);
5515
5516         if (ev->status) {
5517                 if (!adv)
5518                         return;
5519
5520                 /* Remove advertising as it has been terminated */
5521                 hci_remove_adv_instance(hdev, ev->handle);
5522                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5523
5524                 return;
5525         }
5526
5527         if (adv)
5528                 adv->enabled = false;
5529
5530         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5531         if (conn) {
5532                 /* Store handle in the connection so the correct advertising
5533                  * instance can be re-enabled when disconnected.
5534                  */
5535                 conn->adv_instance = ev->handle;
5536
5537                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5538                     bacmp(&conn->resp_addr, BDADDR_ANY))
5539                         return;
5540
5541                 if (!ev->handle) {
5542                         bacpy(&conn->resp_addr, &hdev->random_addr);
5543                         return;
5544                 }
5545
5546                 if (adv)
5547                         bacpy(&conn->resp_addr, &adv->random_addr);
5548         }
5549 }
5550
5551 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5552                                             struct sk_buff *skb)
5553 {
5554         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5555         struct hci_conn *conn;
5556
5557         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5558
5559         if (ev->status)
5560                 return;
5561
5562         hci_dev_lock(hdev);
5563
5564         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5565         if (conn) {
5566 #ifdef TIZEN_BT
5567                 if (ev->status) {
5568                         hci_dev_unlock(hdev);
5569                         mgmt_le_conn_update_failed(hdev, &conn->dst,
5570                                 conn->type, conn->dst_type, ev->status);
5571                         return;
5572                 }
5573 #endif
5574                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5575                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5576                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5577         }
5578
5579         hci_dev_unlock(hdev);
5580
5581 #ifdef TIZEN_BT
5582         mgmt_le_conn_updated(hdev, &conn->dst, conn->type,
5583                                 conn->dst_type, conn->le_conn_interval,
5584                                 conn->le_conn_latency, conn->le_supv_timeout);
5585 #endif
5586 }
5587
5588 /* This function requires the caller holds hdev->lock */
5589 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5590                                               bdaddr_t *addr,
5591                                               u8 addr_type, u8 adv_type,
5592                                               bdaddr_t *direct_rpa)
5593 {
5594         struct hci_conn *conn;
5595         struct hci_conn_params *params;
5596
5597         /* If the event is not connectable don't proceed further */
5598         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5599                 return NULL;
5600
5601         /* Ignore if the device is blocked */
5602         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type))
5603                 return NULL;
5604
5605         /* Most controller will fail if we try to create new connections
5606          * while we have an existing one in peripheral role.
5607          */
5608         if (hdev->conn_hash.le_num_peripheral > 0 &&
5609             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5610              !(hdev->le_states[3] & 0x10)))
5611                 return NULL;
5612
5613         /* If we're not connectable only connect devices that we have in
5614          * our pend_le_conns list.
5615          */
5616         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5617                                            addr_type);
5618         if (!params)
5619                 return NULL;
5620
5621         if (!params->explicit_connect) {
5622                 switch (params->auto_connect) {
5623                 case HCI_AUTO_CONN_DIRECT:
5624                         /* Only devices advertising with ADV_DIRECT_IND are
5625                          * triggering a connection attempt. This is allowing
5626                          * incoming connections from peripheral devices.
5627                          */
5628                         if (adv_type != LE_ADV_DIRECT_IND)
5629                                 return NULL;
5630                         break;
5631                 case HCI_AUTO_CONN_ALWAYS:
5632                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5633                          * are triggering a connection attempt. This means
5634                          * that incoming connections from peripheral device are
5635                          * accepted and also outgoing connections to peripheral
5636                          * devices are established when found.
5637                          */
5638                         break;
5639                 default:
5640                         return NULL;
5641                 }
5642         }
5643
5644         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5645                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5646                               direct_rpa);
5647         if (!IS_ERR(conn)) {
5648                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5649                  * by higher layer that tried to connect, if no then
5650                  * store the pointer since we don't really have any
5651                  * other owner of the object besides the params that
5652                  * triggered it. This way we can abort the connection if
5653                  * the parameters get removed and keep the reference
5654                  * count consistent once the connection is established.
5655                  */
5656
5657                 if (!params->explicit_connect)
5658                         params->conn = hci_conn_get(conn);
5659
5660                 return conn;
5661         }
5662
5663         switch (PTR_ERR(conn)) {
5664         case -EBUSY:
5665                 /* If hci_connect() returns -EBUSY it means there is already
5666                  * an LE connection attempt going on. Since controllers don't
5667                  * support more than one connection attempt at the time, we
5668                  * don't consider this an error case.
5669                  */
5670                 break;
5671         default:
5672                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5673                 return NULL;
5674         }
5675
5676         return NULL;
5677 }
5678
5679 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5680                                u8 bdaddr_type, bdaddr_t *direct_addr,
5681                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5682                                bool ext_adv)
5683 {
5684         struct discovery_state *d = &hdev->discovery;
5685         struct smp_irk *irk;
5686         struct hci_conn *conn;
5687         bool match;
5688         u32 flags;
5689         u8 *ptr;
5690
5691         switch (type) {
5692         case LE_ADV_IND:
5693         case LE_ADV_DIRECT_IND:
5694         case LE_ADV_SCAN_IND:
5695         case LE_ADV_NONCONN_IND:
5696         case LE_ADV_SCAN_RSP:
5697                 break;
5698         default:
5699                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5700                                        "type: 0x%02x", type);
5701                 return;
5702         }
5703
5704         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5705                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5706                 return;
5707         }
5708
5709         /* Find the end of the data in case the report contains padded zero
5710          * bytes at the end causing an invalid length value.
5711          *
5712          * When data is NULL, len is 0 so there is no need for extra ptr
5713          * check as 'ptr < data + 0' is already false in such case.
5714          */
5715         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5716                 if (ptr + 1 + *ptr > data + len)
5717                         break;
5718         }
5719
5720         /* Adjust for actual length. This handles the case when remote
5721          * device is advertising with incorrect data length.
5722          */
5723         len = ptr - data;
5724
5725         /* If the direct address is present, then this report is from
5726          * a LE Direct Advertising Report event. In that case it is
5727          * important to see if the address is matching the local
5728          * controller address.
5729          */
5730         if (direct_addr) {
5731                 /* Only resolvable random addresses are valid for these
5732                  * kind of reports and others can be ignored.
5733                  */
5734                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5735                         return;
5736
5737                 /* If the controller is not using resolvable random
5738                  * addresses, then this report can be ignored.
5739                  */
5740                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5741                         return;
5742
5743                 /* If the local IRK of the controller does not match
5744                  * with the resolvable random address provided, then
5745                  * this report can be ignored.
5746                  */
5747                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5748                         return;
5749         }
5750
5751         /* Check if we need to convert to identity address */
5752         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5753         if (irk) {
5754                 bdaddr = &irk->bdaddr;
5755                 bdaddr_type = irk->addr_type;
5756         }
5757
5758         /* Check if we have been requested to connect to this device.
5759          *
5760          * direct_addr is set only for directed advertising reports (it is NULL
5761          * for advertising reports) and is already verified to be RPA above.
5762          */
5763         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5764                                                                 direct_addr);
5765         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5766                 /* Store report for later inclusion by
5767                  * mgmt_device_connected
5768                  */
5769                 memcpy(conn->le_adv_data, data, len);
5770                 conn->le_adv_data_len = len;
5771         }
5772
5773         /* Passive scanning shouldn't trigger any device found events,
5774          * except for devices marked as CONN_REPORT for which we do send
5775          * device found events, or advertisement monitoring requested.
5776          */
5777         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5778                 if (type == LE_ADV_DIRECT_IND)
5779                         return;
5780
5781                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5782                                                bdaddr, bdaddr_type) &&
5783                     idr_is_empty(&hdev->adv_monitors_idr))
5784                         return;
5785
5786                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5787                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5788                 else
5789                         flags = 0;
5790                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5791                                   rssi, flags, data, len, NULL, 0);
5792                 return;
5793         }
5794
5795         /* When receiving non-connectable or scannable undirected
5796          * advertising reports, this means that the remote device is
5797          * not connectable and then clearly indicate this in the
5798          * device found event.
5799          *
5800          * When receiving a scan response, then there is no way to
5801          * know if the remote device is connectable or not. However
5802          * since scan responses are merged with a previously seen
5803          * advertising report, the flags field from that report
5804          * will be used.
5805          *
5806          * In the really unlikely case that a controller get confused
5807          * and just sends a scan response event, then it is marked as
5808          * not connectable as well.
5809          */
5810         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5811             type == LE_ADV_SCAN_RSP)
5812                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5813         else
5814                 flags = 0;
5815
5816         /* If there's nothing pending either store the data from this
5817          * event or send an immediate device found event if the data
5818          * should not be stored for later.
5819          */
5820         if (!ext_adv && !has_pending_adv_report(hdev)) {
5821                 /* If the report will trigger a SCAN_REQ store it for
5822                  * later merging.
5823                  */
5824                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5825                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5826                                                  rssi, flags, data, len);
5827                         return;
5828                 }
5829
5830                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5831                                   rssi, flags, data, len, NULL, 0);
5832                 return;
5833         }
5834
5835         /* Check if the pending report is for the same device as the new one */
5836         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5837                  bdaddr_type == d->last_adv_addr_type);
5838
5839         /* If the pending data doesn't match this report or this isn't a
5840          * scan response (e.g. we got a duplicate ADV_IND) then force
5841          * sending of the pending data.
5842          */
5843         if (type != LE_ADV_SCAN_RSP || !match) {
5844                 /* Send out whatever is in the cache, but skip duplicates */
5845                 if (!match)
5846                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5847                                           d->last_adv_addr_type, NULL,
5848                                           d->last_adv_rssi, d->last_adv_flags,
5849                                           d->last_adv_data,
5850                                           d->last_adv_data_len, NULL, 0);
5851
5852                 /* If the new report will trigger a SCAN_REQ store it for
5853                  * later merging.
5854                  */
5855                 if (!ext_adv && (type == LE_ADV_IND ||
5856                                  type == LE_ADV_SCAN_IND)) {
5857                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5858                                                  rssi, flags, data, len);
5859                         return;
5860                 }
5861
5862                 /* The advertising reports cannot be merged, so clear
5863                  * the pending report and send out a device found event.
5864                  */
5865                 clear_pending_adv_report(hdev);
5866                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5867                                   rssi, flags, data, len, NULL, 0);
5868                 return;
5869         }
5870
5871         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5872          * the new event is a SCAN_RSP. We can therefore proceed with
5873          * sending a merged device found event.
5874          */
5875         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5876                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5877                           d->last_adv_data, d->last_adv_data_len, data, len);
5878         clear_pending_adv_report(hdev);
5879 }
5880
5881 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5882 {
5883         u8 num_reports = skb->data[0];
5884         void *ptr = &skb->data[1];
5885
5886         hci_dev_lock(hdev);
5887
5888         while (num_reports--) {
5889                 struct hci_ev_le_advertising_info *ev = ptr;
5890                 s8 rssi;
5891
5892                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5893                         rssi = ev->data[ev->length];
5894                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5895                                            ev->bdaddr_type, NULL, 0, rssi,
5896                                            ev->data, ev->length, false);
5897                 } else {
5898                         bt_dev_err(hdev, "Dropping invalid advertising data");
5899                 }
5900
5901                 ptr += sizeof(*ev) + ev->length + 1;
5902         }
5903
5904         hci_dev_unlock(hdev);
5905 }
5906
5907 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5908 {
5909         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5910                 switch (evt_type) {
5911                 case LE_LEGACY_ADV_IND:
5912                         return LE_ADV_IND;
5913                 case LE_LEGACY_ADV_DIRECT_IND:
5914                         return LE_ADV_DIRECT_IND;
5915                 case LE_LEGACY_ADV_SCAN_IND:
5916                         return LE_ADV_SCAN_IND;
5917                 case LE_LEGACY_NONCONN_IND:
5918                         return LE_ADV_NONCONN_IND;
5919                 case LE_LEGACY_SCAN_RSP_ADV:
5920                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5921                         return LE_ADV_SCAN_RSP;
5922                 }
5923
5924                 goto invalid;
5925         }
5926
5927         if (evt_type & LE_EXT_ADV_CONN_IND) {
5928                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5929                         return LE_ADV_DIRECT_IND;
5930
5931                 return LE_ADV_IND;
5932         }
5933
5934         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5935                 return LE_ADV_SCAN_RSP;
5936
5937         if (evt_type & LE_EXT_ADV_SCAN_IND)
5938                 return LE_ADV_SCAN_IND;
5939
5940         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5941             evt_type & LE_EXT_ADV_DIRECT_IND)
5942                 return LE_ADV_NONCONN_IND;
5943
5944 invalid:
5945         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5946                                evt_type);
5947
5948         return LE_ADV_INVALID;
5949 }
5950
5951 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5952 {
5953         u8 num_reports = skb->data[0];
5954         void *ptr = &skb->data[1];
5955
5956         hci_dev_lock(hdev);
5957
5958         while (num_reports--) {
5959                 struct hci_ev_le_ext_adv_report *ev = ptr;
5960                 u8 legacy_evt_type;
5961                 u16 evt_type;
5962
5963                 evt_type = __le16_to_cpu(ev->evt_type);
5964                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5965                 if (legacy_evt_type != LE_ADV_INVALID) {
5966                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5967                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5968                                            ev->data, ev->length,
5969                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5970                 }
5971
5972                 ptr += sizeof(*ev) + ev->length;
5973         }
5974
5975         hci_dev_unlock(hdev);
5976 }
5977
5978 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5979                                             struct sk_buff *skb)
5980 {
5981         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5982         struct hci_conn *conn;
5983
5984         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5985
5986         hci_dev_lock(hdev);
5987
5988         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5989         if (conn) {
5990                 if (!ev->status)
5991                         memcpy(conn->features[0], ev->features, 8);
5992
5993                 if (conn->state == BT_CONFIG) {
5994                         __u8 status;
5995
5996                         /* If the local controller supports peripheral-initiated
5997                          * features exchange, but the remote controller does
5998                          * not, then it is possible that the error code 0x1a
5999                          * for unsupported remote feature gets returned.
6000                          *
6001                          * In this specific case, allow the connection to
6002                          * transition into connected state and mark it as
6003                          * successful.
6004                          */
6005                         if (!conn->out && ev->status == 0x1a &&
6006                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
6007                                 status = 0x00;
6008                         else
6009                                 status = ev->status;
6010
6011                         conn->state = BT_CONNECTED;
6012                         hci_connect_cfm(conn, status);
6013                         hci_conn_drop(conn);
6014                 }
6015         }
6016
6017         hci_dev_unlock(hdev);
6018 }
6019
6020 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
6021 {
6022         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
6023         struct hci_cp_le_ltk_reply cp;
6024         struct hci_cp_le_ltk_neg_reply neg;
6025         struct hci_conn *conn;
6026         struct smp_ltk *ltk;
6027
6028         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
6029
6030         hci_dev_lock(hdev);
6031
6032         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6033         if (conn == NULL)
6034                 goto not_found;
6035
6036         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
6037         if (!ltk)
6038                 goto not_found;
6039
6040         if (smp_ltk_is_sc(ltk)) {
6041                 /* With SC both EDiv and Rand are set to zero */
6042                 if (ev->ediv || ev->rand)
6043                         goto not_found;
6044         } else {
6045                 /* For non-SC keys check that EDiv and Rand match */
6046                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
6047                         goto not_found;
6048         }
6049
6050         memcpy(cp.ltk, ltk->val, ltk->enc_size);
6051         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
6052         cp.handle = cpu_to_le16(conn->handle);
6053
6054         conn->pending_sec_level = smp_ltk_sec_level(ltk);
6055
6056         conn->enc_key_size = ltk->enc_size;
6057
6058         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
6059
6060         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
6061          * temporary key used to encrypt a connection following
6062          * pairing. It is used during the Encrypted Session Setup to
6063          * distribute the keys. Later, security can be re-established
6064          * using a distributed LTK.
6065          */
6066         if (ltk->type == SMP_STK) {
6067                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6068                 list_del_rcu(&ltk->list);
6069                 kfree_rcu(ltk, rcu);
6070         } else {
6071                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6072         }
6073
6074         hci_dev_unlock(hdev);
6075
6076         return;
6077
6078 not_found:
6079         neg.handle = ev->handle;
6080         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6081         hci_dev_unlock(hdev);
6082 }
6083
6084 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6085                                       u8 reason)
6086 {
6087         struct hci_cp_le_conn_param_req_neg_reply cp;
6088
6089         cp.handle = cpu_to_le16(handle);
6090         cp.reason = reason;
6091
6092         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6093                      &cp);
6094 }
6095
6096 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
6097                                              struct sk_buff *skb)
6098 {
6099         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
6100         struct hci_cp_le_conn_param_req_reply cp;
6101         struct hci_conn *hcon;
6102         u16 handle, min, max, latency, timeout;
6103
6104         handle = le16_to_cpu(ev->handle);
6105         min = le16_to_cpu(ev->interval_min);
6106         max = le16_to_cpu(ev->interval_max);
6107         latency = le16_to_cpu(ev->latency);
6108         timeout = le16_to_cpu(ev->timeout);
6109
6110         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6111         if (!hcon || hcon->state != BT_CONNECTED)
6112                 return send_conn_param_neg_reply(hdev, handle,
6113                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6114
6115         if (hci_check_conn_params(min, max, latency, timeout))
6116                 return send_conn_param_neg_reply(hdev, handle,
6117                                                  HCI_ERROR_INVALID_LL_PARAMS);
6118
6119         if (hcon->role == HCI_ROLE_MASTER) {
6120                 struct hci_conn_params *params;
6121                 u8 store_hint;
6122
6123                 hci_dev_lock(hdev);
6124
6125                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6126                                                 hcon->dst_type);
6127                 if (params) {
6128                         params->conn_min_interval = min;
6129                         params->conn_max_interval = max;
6130                         params->conn_latency = latency;
6131                         params->supervision_timeout = timeout;
6132                         store_hint = 0x01;
6133                 } else {
6134                         store_hint = 0x00;
6135                 }
6136
6137                 hci_dev_unlock(hdev);
6138
6139                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6140                                     store_hint, min, max, latency, timeout);
6141         }
6142
6143         cp.handle = ev->handle;
6144         cp.interval_min = ev->interval_min;
6145         cp.interval_max = ev->interval_max;
6146         cp.latency = ev->latency;
6147         cp.timeout = ev->timeout;
6148         cp.min_ce_len = 0;
6149         cp.max_ce_len = 0;
6150
6151         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6152 }
6153
6154 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
6155                                          struct sk_buff *skb)
6156 {
6157         u8 num_reports = skb->data[0];
6158         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6159
6160         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
6161                 return;
6162
6163         hci_dev_lock(hdev);
6164
6165         for (; num_reports; num_reports--, ev++)
6166                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6167                                    ev->bdaddr_type, &ev->direct_addr,
6168                                    ev->direct_addr_type, ev->rssi, NULL, 0,
6169                                    false);
6170
6171         hci_dev_unlock(hdev);
6172 }
6173
6174 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
6175 {
6176         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
6177         struct hci_conn *conn;
6178
6179         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6180
6181         if (ev->status)
6182                 return;
6183
6184         hci_dev_lock(hdev);
6185
6186         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6187         if (!conn)
6188                 goto unlock;
6189
6190         conn->le_tx_phy = ev->tx_phy;
6191         conn->le_rx_phy = ev->rx_phy;
6192
6193 unlock:
6194         hci_dev_unlock(hdev);
6195 }
6196
6197 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
6198 {
6199         struct hci_ev_le_meta *le_ev = (void *) skb->data;
6200
6201         skb_pull(skb, sizeof(*le_ev));
6202
6203         switch (le_ev->subevent) {
6204         case HCI_EV_LE_CONN_COMPLETE:
6205                 hci_le_conn_complete_evt(hdev, skb);
6206                 break;
6207
6208         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
6209                 hci_le_conn_update_complete_evt(hdev, skb);
6210                 break;
6211
6212         case HCI_EV_LE_ADVERTISING_REPORT:
6213                 hci_le_adv_report_evt(hdev, skb);
6214                 break;
6215
6216         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
6217                 hci_le_remote_feat_complete_evt(hdev, skb);
6218                 break;
6219
6220         case HCI_EV_LE_LTK_REQ:
6221                 hci_le_ltk_request_evt(hdev, skb);
6222                 break;
6223
6224         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
6225                 hci_le_remote_conn_param_req_evt(hdev, skb);
6226                 break;
6227
6228         case HCI_EV_LE_DIRECT_ADV_REPORT:
6229                 hci_le_direct_adv_report_evt(hdev, skb);
6230                 break;
6231
6232         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6233                 hci_le_phy_update_evt(hdev, skb);
6234                 break;
6235
6236         case HCI_EV_LE_EXT_ADV_REPORT:
6237                 hci_le_ext_adv_report_evt(hdev, skb);
6238                 break;
6239
6240         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
6241                 hci_le_enh_conn_complete_evt(hdev, skb);
6242                 break;
6243
6244         case HCI_EV_LE_EXT_ADV_SET_TERM:
6245                 hci_le_ext_adv_term_evt(hdev, skb);
6246                 break;
6247
6248         default:
6249                 break;
6250         }
6251 }
6252
6253 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6254                                  u8 event, struct sk_buff *skb)
6255 {
6256         struct hci_ev_cmd_complete *ev;
6257         struct hci_event_hdr *hdr;
6258
6259         if (!skb)
6260                 return false;
6261
6262         if (skb->len < sizeof(*hdr)) {
6263                 bt_dev_err(hdev, "too short HCI event");
6264                 return false;
6265         }
6266
6267         hdr = (void *) skb->data;
6268         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6269
6270         if (event) {
6271                 if (hdr->evt != event)
6272                         return false;
6273                 return true;
6274         }
6275
6276         /* Check if request ended in Command Status - no way to retrieve
6277          * any extra parameters in this case.
6278          */
6279         if (hdr->evt == HCI_EV_CMD_STATUS)
6280                 return false;
6281
6282         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6283                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6284                            hdr->evt);
6285                 return false;
6286         }
6287
6288         if (skb->len < sizeof(*ev)) {
6289                 bt_dev_err(hdev, "too short cmd_complete event");
6290                 return false;
6291         }
6292
6293         ev = (void *) skb->data;
6294         skb_pull(skb, sizeof(*ev));
6295
6296         if (opcode != __le16_to_cpu(ev->opcode)) {
6297                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6298                        __le16_to_cpu(ev->opcode));
6299                 return false;
6300         }
6301
6302         return true;
6303 }
6304
6305 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6306                                   struct sk_buff *skb)
6307 {
6308         struct hci_ev_le_advertising_info *adv;
6309         struct hci_ev_le_direct_adv_info *direct_adv;
6310         struct hci_ev_le_ext_adv_report *ext_adv;
6311         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6312         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6313
6314         hci_dev_lock(hdev);
6315
6316         /* If we are currently suspended and this is the first BT event seen,
6317          * save the wake reason associated with the event.
6318          */
6319         if (!hdev->suspended || hdev->wake_reason)
6320                 goto unlock;
6321
6322         /* Default to remote wake. Values for wake_reason are documented in the
6323          * Bluez mgmt api docs.
6324          */
6325         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6326
6327         /* Once configured for remote wakeup, we should only wake up for
6328          * reconnections. It's useful to see which device is waking us up so
6329          * keep track of the bdaddr of the connection event that woke us up.
6330          */
6331         if (event == HCI_EV_CONN_REQUEST) {
6332                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6333                 hdev->wake_addr_type = BDADDR_BREDR;
6334         } else if (event == HCI_EV_CONN_COMPLETE) {
6335                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6336                 hdev->wake_addr_type = BDADDR_BREDR;
6337         } else if (event == HCI_EV_LE_META) {
6338                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6339                 u8 subevent = le_ev->subevent;
6340                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6341                 u8 num_reports = *ptr;
6342
6343                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6344                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6345                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6346                     num_reports) {
6347                         adv = (void *)(ptr + 1);
6348                         direct_adv = (void *)(ptr + 1);
6349                         ext_adv = (void *)(ptr + 1);
6350
6351                         switch (subevent) {
6352                         case HCI_EV_LE_ADVERTISING_REPORT:
6353                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6354                                 hdev->wake_addr_type = adv->bdaddr_type;
6355                                 break;
6356                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6357                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6358                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6359                                 break;
6360                         case HCI_EV_LE_EXT_ADV_REPORT:
6361                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6362                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6363                                 break;
6364                         }
6365                 }
6366         } else {
6367                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6368         }
6369
6370 unlock:
6371         hci_dev_unlock(hdev);
6372 }
6373
6374 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6375 {
6376         struct hci_event_hdr *hdr = (void *) skb->data;
6377         hci_req_complete_t req_complete = NULL;
6378         hci_req_complete_skb_t req_complete_skb = NULL;
6379         struct sk_buff *orig_skb = NULL;
6380         u8 status = 0, event = hdr->evt, req_evt = 0;
6381         u16 opcode = HCI_OP_NOP;
6382
6383         if (!event) {
6384                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6385                 goto done;
6386         }
6387
6388         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6389                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6390                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6391                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6392                                      &req_complete_skb);
6393                 req_evt = event;
6394         }
6395
6396         /* If it looks like we might end up having to call
6397          * req_complete_skb, store a pristine copy of the skb since the
6398          * various handlers may modify the original one through
6399          * skb_pull() calls, etc.
6400          */
6401         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6402             event == HCI_EV_CMD_COMPLETE)
6403                 orig_skb = skb_clone(skb, GFP_KERNEL);
6404
6405         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6406
6407         /* Store wake reason if we're suspended */
6408         hci_store_wake_reason(hdev, event, skb);
6409
6410         switch (event) {
6411         case HCI_EV_INQUIRY_COMPLETE:
6412                 hci_inquiry_complete_evt(hdev, skb);
6413                 break;
6414
6415         case HCI_EV_INQUIRY_RESULT:
6416                 hci_inquiry_result_evt(hdev, skb);
6417                 break;
6418
6419         case HCI_EV_CONN_COMPLETE:
6420                 hci_conn_complete_evt(hdev, skb);
6421                 break;
6422
6423         case HCI_EV_CONN_REQUEST:
6424                 hci_conn_request_evt(hdev, skb);
6425                 break;
6426
6427         case HCI_EV_DISCONN_COMPLETE:
6428                 hci_disconn_complete_evt(hdev, skb);
6429                 break;
6430
6431         case HCI_EV_AUTH_COMPLETE:
6432                 hci_auth_complete_evt(hdev, skb);
6433                 break;
6434
6435         case HCI_EV_REMOTE_NAME:
6436                 hci_remote_name_evt(hdev, skb);
6437                 break;
6438
6439         case HCI_EV_ENCRYPT_CHANGE:
6440                 hci_encrypt_change_evt(hdev, skb);
6441                 break;
6442
6443         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6444                 hci_change_link_key_complete_evt(hdev, skb);
6445                 break;
6446
6447         case HCI_EV_REMOTE_FEATURES:
6448                 hci_remote_features_evt(hdev, skb);
6449                 break;
6450
6451         case HCI_EV_CMD_COMPLETE:
6452                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6453                                      &req_complete, &req_complete_skb);
6454                 break;
6455
6456         case HCI_EV_CMD_STATUS:
6457                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6458                                    &req_complete_skb);
6459                 break;
6460
6461         case HCI_EV_HARDWARE_ERROR:
6462                 hci_hardware_error_evt(hdev, skb);
6463                 break;
6464
6465         case HCI_EV_ROLE_CHANGE:
6466                 hci_role_change_evt(hdev, skb);
6467                 break;
6468
6469         case HCI_EV_NUM_COMP_PKTS:
6470                 hci_num_comp_pkts_evt(hdev, skb);
6471                 break;
6472
6473         case HCI_EV_MODE_CHANGE:
6474                 hci_mode_change_evt(hdev, skb);
6475                 break;
6476
6477         case HCI_EV_PIN_CODE_REQ:
6478                 hci_pin_code_request_evt(hdev, skb);
6479                 break;
6480
6481         case HCI_EV_LINK_KEY_REQ:
6482                 hci_link_key_request_evt(hdev, skb);
6483                 break;
6484
6485         case HCI_EV_LINK_KEY_NOTIFY:
6486                 hci_link_key_notify_evt(hdev, skb);
6487                 break;
6488
6489         case HCI_EV_CLOCK_OFFSET:
6490                 hci_clock_offset_evt(hdev, skb);
6491                 break;
6492
6493         case HCI_EV_PKT_TYPE_CHANGE:
6494                 hci_pkt_type_change_evt(hdev, skb);
6495                 break;
6496
6497         case HCI_EV_PSCAN_REP_MODE:
6498                 hci_pscan_rep_mode_evt(hdev, skb);
6499                 break;
6500
6501         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6502                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6503                 break;
6504
6505         case HCI_EV_REMOTE_EXT_FEATURES:
6506                 hci_remote_ext_features_evt(hdev, skb);
6507                 break;
6508
6509         case HCI_EV_SYNC_CONN_COMPLETE:
6510                 hci_sync_conn_complete_evt(hdev, skb);
6511                 break;
6512
6513         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6514                 hci_extended_inquiry_result_evt(hdev, skb);
6515                 break;
6516
6517         case HCI_EV_KEY_REFRESH_COMPLETE:
6518                 hci_key_refresh_complete_evt(hdev, skb);
6519                 break;
6520
6521         case HCI_EV_IO_CAPA_REQUEST:
6522                 hci_io_capa_request_evt(hdev, skb);
6523                 break;
6524
6525         case HCI_EV_IO_CAPA_REPLY:
6526                 hci_io_capa_reply_evt(hdev, skb);
6527                 break;
6528
6529         case HCI_EV_USER_CONFIRM_REQUEST:
6530                 hci_user_confirm_request_evt(hdev, skb);
6531                 break;
6532
6533         case HCI_EV_USER_PASSKEY_REQUEST:
6534                 hci_user_passkey_request_evt(hdev, skb);
6535                 break;
6536
6537         case HCI_EV_USER_PASSKEY_NOTIFY:
6538                 hci_user_passkey_notify_evt(hdev, skb);
6539                 break;
6540
6541         case HCI_EV_KEYPRESS_NOTIFY:
6542                 hci_keypress_notify_evt(hdev, skb);
6543                 break;
6544
6545         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6546                 hci_simple_pair_complete_evt(hdev, skb);
6547                 break;
6548
6549         case HCI_EV_REMOTE_HOST_FEATURES:
6550                 hci_remote_host_features_evt(hdev, skb);
6551                 break;
6552
6553         case HCI_EV_LE_META:
6554                 hci_le_meta_evt(hdev, skb);
6555                 break;
6556
6557         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6558                 hci_remote_oob_data_request_evt(hdev, skb);
6559                 break;
6560
6561 #if IS_ENABLED(CONFIG_BT_HS)
6562         case HCI_EV_CHANNEL_SELECTED:
6563                 hci_chan_selected_evt(hdev, skb);
6564                 break;
6565
6566         case HCI_EV_PHY_LINK_COMPLETE:
6567                 hci_phy_link_complete_evt(hdev, skb);
6568                 break;
6569
6570         case HCI_EV_LOGICAL_LINK_COMPLETE:
6571                 hci_loglink_complete_evt(hdev, skb);
6572                 break;
6573
6574         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6575                 hci_disconn_loglink_complete_evt(hdev, skb);
6576                 break;
6577
6578         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6579                 hci_disconn_phylink_complete_evt(hdev, skb);
6580                 break;
6581 #endif
6582
6583         case HCI_EV_NUM_COMP_BLOCKS:
6584                 hci_num_comp_blocks_evt(hdev, skb);
6585                 break;
6586
6587 #ifdef TIZEN_BT
6588         case HCI_EV_VENDOR_SPECIFIC:
6589                 hci_vendor_specific_evt(hdev, skb);
6590                 break;
6591 #else
6592         case HCI_EV_VENDOR:
6593                 msft_vendor_evt(hdev, skb);
6594                 break;
6595 #endif
6596
6597         default:
6598                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6599                 break;
6600         }
6601
6602         if (req_complete) {
6603                 req_complete(hdev, status, opcode);
6604         } else if (req_complete_skb) {
6605                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6606                         kfree_skb(orig_skb);
6607                         orig_skb = NULL;
6608                 }
6609                 req_complete_skb(hdev, status, opcode, orig_skb);
6610         }
6611
6612 done:
6613         kfree_skb(orig_skb);
6614         kfree_skb(skb);
6615         hdev->stat.evt_rx++;
6616 }