net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38 #include "msft.h"
  39
  40 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  41                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  42
  43 #define secs_to_jiffies(_secs) msecs_to_jiffies((_secs) * 1000)
  44
  45 /* Handle HCI Event packets */
  46
  47 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
  48                                   u8 *new_status)
  49 {
  50         __u8 status = *((__u8 *) skb->data);
  51
  52         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  53
  54         /* It is possible that we receive Inquiry Complete event right
  55          * before we receive Inquiry Cancel Command Complete event, in
  56          * which case the latter event should have status of Command
  57          * Disallowed (0x0c). This should not be treated as error, since
  58          * we actually achieve what Inquiry Cancel wants to achieve,
  59          * which is to end the last Inquiry session.
  60          */
  61         if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
  62                 bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
  63                 status = 0x00;
  64         }
  65
  66         *new_status = status;
  67
  68         if (status)
  69                 return;
  70
  71         clear_bit(HCI_INQUIRY, &hdev->flags);
  72         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  73         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  74
  75         hci_dev_lock(hdev);
  76         /* Set discovery state to stopped if we're not doing LE active
  77          * scanning.
  78          */
  79         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
  80             hdev->le_scan_type != LE_SCAN_ACTIVE)
  81                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  82         hci_dev_unlock(hdev);
  83
  84         hci_conn_check_pending(hdev);
  85 }
  86
  87 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         __u8 status = *((__u8 *) skb->data);
  90
  91         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  92
  93         if (status)
  94                 return;
  95
  96         hci_dev_set_flag(hdev, HCI_PERIODIC_INQ);
  97 }
  98
  99 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
 100 {
 101         __u8 status = *((__u8 *) skb->data);
 102
 103         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 104
 105         if (status)
 106                 return;
 107
 108         hci_dev_clear_flag(hdev, HCI_PERIODIC_INQ);
 109
 110         hci_conn_check_pending(hdev);
 111 }
 112
 113 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
 114                                           struct sk_buff *skb)
 115 {
 116         BT_DBG("%s", hdev->name);
 117 }
 118
 119 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 120 {
 121         struct hci_rp_role_discovery *rp = (void *) skb->data;
 122         struct hci_conn *conn;
 123
 124         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 125
 126         if (rp->status)
 127                 return;
 128
 129         hci_dev_lock(hdev);
 130
 131         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 132         if (conn)
 133                 conn->role = rp->role;
 134
 135         hci_dev_unlock(hdev);
 136 }
 137
 138 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 139 {
 140         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 141         struct hci_conn *conn;
 142
 143         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 144
 145         if (rp->status)
 146                 return;
 147
 148         hci_dev_lock(hdev);
 149
 150         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 151         if (conn)
 152                 conn->link_policy = __le16_to_cpu(rp->policy);
 153
 154         hci_dev_unlock(hdev);
 155 }
 156
 157 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 158 {
 159         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 160         struct hci_conn *conn;
 161         void *sent;
 162
 163         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 169         if (!sent)
 170                 return;
 171
 172         hci_dev_lock(hdev);
 173
 174         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 175         if (conn)
 176                 conn->link_policy = get_unaligned_le16(sent + 2);
 177
 178         hci_dev_unlock(hdev);
 179 }
 180
 181 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 182                                         struct sk_buff *skb)
 183 {
 184         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 185
 186         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 187
 188         if (rp->status)
 189                 return;
 190
 191         hdev->link_policy = __le16_to_cpu(rp->policy);
 192 }
 193
 194 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 195                                          struct sk_buff *skb)
 196 {
 197         __u8 status = *((__u8 *) skb->data);
 198         void *sent;
 199
 200         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 201
 202         if (status)
 203                 return;
 204
 205         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 206         if (!sent)
 207                 return;
 208
 209         hdev->link_policy = get_unaligned_le16(sent);
 210 }
 211
 212 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 213 {
 214         __u8 status = *((__u8 *) skb->data);
 215
 216         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 217
 218         clear_bit(HCI_RESET, &hdev->flags);
 219
 220         if (status)
 221                 return;
 222
 223         /* Reset all non-persistent flags */
 224         hci_dev_clear_volatile_flags(hdev);
 225
 226         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
 227
 228         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 229         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 230
 231         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 232         hdev->adv_data_len = 0;
 233
 234         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 235         hdev->scan_rsp_data_len = 0;
 236
 237         hdev->le_scan_type = LE_SCAN_PASSIVE;
 238
 239         hdev->ssp_debug_mode = 0;
 240
 241         hci_bdaddr_list_clear(&hdev->le_accept_list);
 242         hci_bdaddr_list_clear(&hdev->le_resolv_list);
 243 }
 244
 245 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 246                                         struct sk_buff *skb)
 247 {
 248         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 249         struct hci_cp_read_stored_link_key *sent;
 250
 251         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 252
 253         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 254         if (!sent)
 255                 return;
 256
 257         if (!rp->status && sent->read_all == 0x01) {
 258                 hdev->stored_max_keys = rp->max_keys;
 259                 hdev->stored_num_keys = rp->num_keys;
 260         }
 261 }
 262
 263 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 264                                           struct sk_buff *skb)
 265 {
 266         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 267
 268         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 269
 270         if (rp->status)
 271                 return;
 272
 273         if (rp->num_keys <= hdev->stored_num_keys)
 274                 hdev->stored_num_keys -= rp->num_keys;
 275         else
 276                 hdev->stored_num_keys = 0;
 277 }
 278
 279 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 280 {
 281         __u8 status = *((__u8 *) skb->data);
 282         void *sent;
 283
 284         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 285
 286         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 287         if (!sent)
 288                 return;
 289
 290         hci_dev_lock(hdev);
 291
 292         if (hci_dev_test_flag(hdev, HCI_MGMT))
 293                 mgmt_set_local_name_complete(hdev, sent, status);
 294         else if (!status)
 295                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 296
 297         hci_dev_unlock(hdev);
 298 }
 299
 300 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 301 {
 302         struct hci_rp_read_local_name *rp = (void *) skb->data;
 303
 304         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 305
 306         if (rp->status)
 307                 return;
 308
 309         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 310             hci_dev_test_flag(hdev, HCI_CONFIG))
 311                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 312 }
 313
 314 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 315 {
 316         __u8 status = *((__u8 *) skb->data);
 317         void *sent;
 318
 319         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 320
 321         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 322         if (!sent)
 323                 return;
 324
 325         hci_dev_lock(hdev);
 326
 327         if (!status) {
 328                 __u8 param = *((__u8 *) sent);
 329
 330                 if (param == AUTH_ENABLED)
 331                         set_bit(HCI_AUTH, &hdev->flags);
 332                 else
 333                         clear_bit(HCI_AUTH, &hdev->flags);
 334         }
 335
 336         if (hci_dev_test_flag(hdev, HCI_MGMT))
 337                 mgmt_auth_enable_complete(hdev, status);
 338
 339         hci_dev_unlock(hdev);
 340 }
 341
 342 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 343 {
 344         __u8 status = *((__u8 *) skb->data);
 345         __u8 param;
 346         void *sent;
 347
 348         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 349
 350         if (status)
 351                 return;
 352
 353         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 354         if (!sent)
 355                 return;
 356
 357         param = *((__u8 *) sent);
 358
 359         if (param)
 360                 set_bit(HCI_ENCRYPT, &hdev->flags);
 361         else
 362                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 363 }
 364
 365 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 366 {
 367         __u8 status = *((__u8 *) skb->data);
 368         __u8 param;
 369         void *sent;
 370
 371         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 372
 373         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 374         if (!sent)
 375                 return;
 376
 377         param = *((__u8 *) sent);
 378
 379         hci_dev_lock(hdev);
 380
 381         if (status) {
 382                 hdev->discov_timeout = 0;
 383                 goto done;
 384         }
 385
 386         if (param & SCAN_INQUIRY)
 387                 set_bit(HCI_ISCAN, &hdev->flags);
 388         else
 389                 clear_bit(HCI_ISCAN, &hdev->flags);
 390
 391         if (param & SCAN_PAGE)
 392                 set_bit(HCI_PSCAN, &hdev->flags);
 393         else
 394                 clear_bit(HCI_PSCAN, &hdev->flags);
 395
 396 done:
 397         hci_dev_unlock(hdev);
 398 }
 399
 400 static void hci_cc_set_event_filter(struct hci_dev *hdev, struct sk_buff *skb)
 401 {
 402         __u8 status = *((__u8 *)skb->data);
 403         struct hci_cp_set_event_filter *cp;
 404         void *sent;
 405
 406         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 407
 408         if (status)
 409                 return;
 410
 411         sent = hci_sent_cmd_data(hdev, HCI_OP_SET_EVENT_FLT);
 412         if (!sent)
 413                 return;
 414
 415         cp = (struct hci_cp_set_event_filter *)sent;
 416
 417         if (cp->flt_type == HCI_FLT_CLEAR_ALL)
 418                 hci_dev_clear_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 419         else
 420                 hci_dev_set_flag(hdev, HCI_EVENT_FILTER_CONFIGURED);
 421 }
 422
 423 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 424 {
 425         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 426
 427         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 428
 429         if (rp->status)
 430                 return;
 431
 432         memcpy(hdev->dev_class, rp->dev_class, 3);
 433
 434         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 435                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 436 }
 437
 438 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 439 {
 440         __u8 status = *((__u8 *) skb->data);
 441         void *sent;
 442
 443         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 444
 445         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 446         if (!sent)
 447                 return;
 448
 449         hci_dev_lock(hdev);
 450
 451         if (status == 0)
 452                 memcpy(hdev->dev_class, sent, 3);
 453
 454         if (hci_dev_test_flag(hdev, HCI_MGMT))
 455                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 456
 457         hci_dev_unlock(hdev);
 458 }
 459
 460 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 461 {
 462         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 463         __u16 setting;
 464
 465         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 466
 467         if (rp->status)
 468                 return;
 469
 470         setting = __le16_to_cpu(rp->voice_setting);
 471
 472         if (hdev->voice_setting == setting)
 473                 return;
 474
 475         hdev->voice_setting = setting;
 476
 477         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 478
 479         if (hdev->notify)
 480                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 481 }
 482
 483 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 484                                        struct sk_buff *skb)
 485 {
 486         __u8 status = *((__u8 *) skb->data);
 487         __u16 setting;
 488         void *sent;
 489
 490         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 491
 492         if (status)
 493                 return;
 494
 495         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 496         if (!sent)
 497                 return;
 498
 499         setting = get_unaligned_le16(sent);
 500
 501         if (hdev->voice_setting == setting)
 502                 return;
 503
 504         hdev->voice_setting = setting;
 505
 506         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 507
 508         if (hdev->notify)
 509                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 510 }
 511
 512 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 513                                           struct sk_buff *skb)
 514 {
 515         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 516
 517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 518
 519         if (rp->status)
 520                 return;
 521
 522         hdev->num_iac = rp->num_iac;
 523
 524         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 525 }
 526
 527 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 528 {
 529         __u8 status = *((__u8 *) skb->data);
 530         struct hci_cp_write_ssp_mode *sent;
 531
 532         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 533
 534         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 535         if (!sent)
 536                 return;
 537
 538         hci_dev_lock(hdev);
 539
 540         if (!status) {
 541                 if (sent->mode)
 542                         hdev->features[1][0] |= LMP_HOST_SSP;
 543                 else
 544                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 545         }
 546
 547         if (hci_dev_test_flag(hdev, HCI_MGMT))
 548                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 549         else if (!status) {
 550                 if (sent->mode)
 551                         hci_dev_set_flag(hdev, HCI_SSP_ENABLED);
 552                 else
 553                         hci_dev_clear_flag(hdev, HCI_SSP_ENABLED);
 554         }
 555
 556         hci_dev_unlock(hdev);
 557 }
 558
 559 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 560 {
 561         u8 status = *((u8 *) skb->data);
 562         struct hci_cp_write_sc_support *sent;
 563
 564         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 565
 566         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 567         if (!sent)
 568                 return;
 569
 570         hci_dev_lock(hdev);
 571
 572         if (!status) {
 573                 if (sent->support)
 574                         hdev->features[1][0] |= LMP_HOST_SC;
 575                 else
 576                         hdev->features[1][0] &= ~LMP_HOST_SC;
 577         }
 578
 579         if (!hci_dev_test_flag(hdev, HCI_MGMT) && !status) {
 580                 if (sent->support)
 581                         hci_dev_set_flag(hdev, HCI_SC_ENABLED);
 582                 else
 583                         hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
 584         }
 585
 586         hci_dev_unlock(hdev);
 587 }
 588
 589 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 590 {
 591         struct hci_rp_read_local_version *rp = (void *) skb->data;
 592
 593         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 594
 595         if (rp->status)
 596                 return;
 597
 598         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 599             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 600                 hdev->hci_ver = rp->hci_ver;
 601                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 602                 hdev->lmp_ver = rp->lmp_ver;
 603                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 604                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 605         }
 606 }
 607
 608 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 609                                        struct sk_buff *skb)
 610 {
 611         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 612
 613         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 614
 615         if (rp->status)
 616                 return;
 617
 618         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 619             hci_dev_test_flag(hdev, HCI_CONFIG))
 620                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 621 }
 622
 623 static void hci_cc_read_auth_payload_timeout(struct hci_dev *hdev,
 624                                              struct sk_buff *skb)
 625 {
 626         struct hci_rp_read_auth_payload_to *rp = (void *)skb->data;
 627         struct hci_conn *conn;
 628
 629         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 630
 631         if (rp->status)
 632                 return;
 633
 634         hci_dev_lock(hdev);
 635
 636         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 637         if (conn)
 638                 conn->auth_payload_timeout = __le16_to_cpu(rp->timeout);
 639
 640         hci_dev_unlock(hdev);
 641 }
 642
 643 static void hci_cc_write_auth_payload_timeout(struct hci_dev *hdev,
 644                                               struct sk_buff *skb)
 645 {
 646         struct hci_rp_write_auth_payload_to *rp = (void *)skb->data;
 647         struct hci_conn *conn;
 648         void *sent;
 649
 650         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 651
 652         if (rp->status)
 653                 return;
 654
 655         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO);
 656         if (!sent)
 657                 return;
 658
 659         hci_dev_lock(hdev);
 660
 661         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 662         if (conn)
 663                 conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
 664
 665         hci_dev_unlock(hdev);
 666 }
 667
 668 static void hci_cc_read_local_features(struct hci_dev *hdev,
 669                                        struct sk_buff *skb)
 670 {
 671         struct hci_rp_read_local_features *rp = (void *) skb->data;
 672
 673         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 674
 675         if (rp->status)
 676                 return;
 677
 678         memcpy(hdev->features, rp->features, 8);
 679
 680         /* Adjust default settings according to features
 681          * supported by device. */
 682
 683         if (hdev->features[0][0] & LMP_3SLOT)
 684                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 685
 686         if (hdev->features[0][0] & LMP_5SLOT)
 687                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 688
 689         if (hdev->features[0][1] & LMP_HV2) {
 690                 hdev->pkt_type  |= (HCI_HV2);
 691                 hdev->esco_type |= (ESCO_HV2);
 692         }
 693
 694         if (hdev->features[0][1] & LMP_HV3) {
 695                 hdev->pkt_type  |= (HCI_HV3);
 696                 hdev->esco_type |= (ESCO_HV3);
 697         }
 698
 699         if (lmp_esco_capable(hdev))
 700                 hdev->esco_type |= (ESCO_EV3);
 701
 702         if (hdev->features[0][4] & LMP_EV4)
 703                 hdev->esco_type |= (ESCO_EV4);
 704
 705         if (hdev->features[0][4] & LMP_EV5)
 706                 hdev->esco_type |= (ESCO_EV5);
 707
 708         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 709                 hdev->esco_type |= (ESCO_2EV3);
 710
 711         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 712                 hdev->esco_type |= (ESCO_3EV3);
 713
 714         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 715                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 716 }
 717
 718 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 719                                            struct sk_buff *skb)
 720 {
 721         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 722
 723         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 724
 725         if (rp->status)
 726                 return;
 727
 728         if (hdev->max_page < rp->max_page)
 729                 hdev->max_page = rp->max_page;
 730
 731         if (rp->page < HCI_MAX_PAGES)
 732                 memcpy(hdev->features[rp->page], rp->features, 8);
 733 }
 734
 735 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 736                                           struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 741
 742         if (rp->status)
 743                 return;
 744
 745         hdev->flow_ctl_mode = rp->mode;
 746 }
 747
 748 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 751
 752         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 753
 754         if (rp->status)
 755                 return;
 756
 757         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 758         hdev->sco_mtu  = rp->sco_mtu;
 759         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 760         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 761
 762         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 763                 hdev->sco_mtu  = 64;
 764                 hdev->sco_pkts = 8;
 765         }
 766
 767         hdev->acl_cnt = hdev->acl_pkts;
 768         hdev->sco_cnt = hdev->sco_pkts;
 769
 770         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 771                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 772 }
 773
 774 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 775 {
 776         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 777
 778         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 779
 780         if (rp->status)
 781                 return;
 782
 783         if (test_bit(HCI_INIT, &hdev->flags))
 784                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 785
 786         if (hci_dev_test_flag(hdev, HCI_SETUP))
 787                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 788 }
 789
 790 static void hci_cc_read_local_pairing_opts(struct hci_dev *hdev,
 791                                            struct sk_buff *skb)
 792 {
 793         struct hci_rp_read_local_pairing_opts *rp = (void *) skb->data;
 794
 795         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 796
 797         if (rp->status)
 798                 return;
 799
 800         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
 801             hci_dev_test_flag(hdev, HCI_CONFIG)) {
 802                 hdev->pairing_opts = rp->pairing_opts;
 803                 hdev->max_enc_key_size = rp->max_key_size;
 804         }
 805 }
 806
 807 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 808                                            struct sk_buff *skb)
 809 {
 810         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 811
 812         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 813
 814         if (rp->status)
 815                 return;
 816
 817         if (test_bit(HCI_INIT, &hdev->flags)) {
 818                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 819                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 820         }
 821 }
 822
 823 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 824                                             struct sk_buff *skb)
 825 {
 826         u8 status = *((u8 *) skb->data);
 827         struct hci_cp_write_page_scan_activity *sent;
 828
 829         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 830
 831         if (status)
 832                 return;
 833
 834         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 835         if (!sent)
 836                 return;
 837
 838         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 839         hdev->page_scan_window = __le16_to_cpu(sent->window);
 840 }
 841
 842 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 843                                            struct sk_buff *skb)
 844 {
 845         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 846
 847         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 848
 849         if (rp->status)
 850                 return;
 851
 852         if (test_bit(HCI_INIT, &hdev->flags))
 853                 hdev->page_scan_type = rp->type;
 854 }
 855
 856 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 857                                         struct sk_buff *skb)
 858 {
 859         u8 status = *((u8 *) skb->data);
 860         u8 *type;
 861
 862         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 863
 864         if (status)
 865                 return;
 866
 867         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 868         if (type)
 869                 hdev->page_scan_type = *type;
 870 }
 871
 872 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 873                                         struct sk_buff *skb)
 874 {
 875         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 876
 877         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 878
 879         if (rp->status)
 880                 return;
 881
 882         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 883         hdev->block_len = __le16_to_cpu(rp->block_len);
 884         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 885
 886         hdev->block_cnt = hdev->num_blocks;
 887
 888         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 889                hdev->block_cnt, hdev->block_len);
 890 }
 891
 892 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 893 {
 894         struct hci_rp_read_clock *rp = (void *) skb->data;
 895         struct hci_cp_read_clock *cp;
 896         struct hci_conn *conn;
 897
 898         BT_DBG("%s", hdev->name);
 899
 900         if (skb->len < sizeof(*rp))
 901                 return;
 902
 903         if (rp->status)
 904                 return;
 905
 906         hci_dev_lock(hdev);
 907
 908         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 909         if (!cp)
 910                 goto unlock;
 911
 912         if (cp->which == 0x00) {
 913                 hdev->clock = le32_to_cpu(rp->clock);
 914                 goto unlock;
 915         }
 916
 917         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 918         if (conn) {
 919                 conn->clock = le32_to_cpu(rp->clock);
 920                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 921         }
 922
 923 unlock:
 924         hci_dev_unlock(hdev);
 925 }
 926
 927 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 928                                        struct sk_buff *skb)
 929 {
 930         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 931
 932         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 933
 934         if (rp->status)
 935                 return;
 936
 937         hdev->amp_status = rp->amp_status;
 938         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 939         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 940         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 941         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 942         hdev->amp_type = rp->amp_type;
 943         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 944         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 945         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 946         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 947 }
 948
 949 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 950                                          struct sk_buff *skb)
 951 {
 952         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 953
 954         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 955
 956         if (rp->status)
 957                 return;
 958
 959         hdev->inq_tx_power = rp->tx_power;
 960 }
 961
 962 static void hci_cc_read_def_err_data_reporting(struct hci_dev *hdev,
 963                                                struct sk_buff *skb)
 964 {
 965         struct hci_rp_read_def_err_data_reporting *rp = (void *)skb->data;
 966
 967         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 968
 969         if (rp->status)
 970                 return;
 971
 972         hdev->err_data_reporting = rp->err_data_reporting;
 973 }
 974
 975 static void hci_cc_write_def_err_data_reporting(struct hci_dev *hdev,
 976                                                 struct sk_buff *skb)
 977 {
 978         __u8 status = *((__u8 *)skb->data);
 979         struct hci_cp_write_def_err_data_reporting *cp;
 980
 981         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 982
 983         if (status)
 984                 return;
 985
 986         cp = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING);
 987         if (!cp)
 988                 return;
 989
 990         hdev->err_data_reporting = cp->err_data_reporting;
 991 }
 992
 993 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 994 {
 995         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 996         struct hci_cp_pin_code_reply *cp;
 997         struct hci_conn *conn;
 998
 999         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1000
1001         hci_dev_lock(hdev);
1002
1003         if (hci_dev_test_flag(hdev, HCI_MGMT))
1004                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
1005
1006         if (rp->status)
1007                 goto unlock;
1008
1009         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
1010         if (!cp)
1011                 goto unlock;
1012
1013         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1014         if (conn)
1015                 conn->pin_length = cp->pin_len;
1016
1017 unlock:
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
1024
1025         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1026
1027         hci_dev_lock(hdev);
1028
1029         if (hci_dev_test_flag(hdev, HCI_MGMT))
1030                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
1031                                                  rp->status);
1032
1033         hci_dev_unlock(hdev);
1034 }
1035
1036 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
1037                                        struct sk_buff *skb)
1038 {
1039         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
1040
1041         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1042
1043         if (rp->status)
1044                 return;
1045
1046         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
1047         hdev->le_pkts = rp->le_max_pkt;
1048
1049         hdev->le_cnt = hdev->le_pkts;
1050
1051         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
1052 }
1053
1054 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
1055                                           struct sk_buff *skb)
1056 {
1057         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
1058
1059         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1060
1061         if (rp->status)
1062                 return;
1063
1064         memcpy(hdev->le_features, rp->features, 8);
1065 }
1066
1067 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
1068                                         struct sk_buff *skb)
1069 {
1070         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1073
1074         if (rp->status)
1075                 return;
1076
1077         hdev->adv_tx_power = rp->tx_power;
1078 }
1079
1080 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1081 {
1082         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1083
1084         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1085
1086         hci_dev_lock(hdev);
1087
1088         if (hci_dev_test_flag(hdev, HCI_MGMT))
1089                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1090                                                  rp->status);
1091
1092         hci_dev_unlock(hdev);
1093 }
1094
1095 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1096                                           struct sk_buff *skb)
1097 {
1098         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1099
1100         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1101
1102         hci_dev_lock(hdev);
1103
1104         if (hci_dev_test_flag(hdev, HCI_MGMT))
1105                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1106                                                      ACL_LINK, 0, rp->status);
1107
1108         hci_dev_unlock(hdev);
1109 }
1110
1111 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1112 {
1113         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1114
1115         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1116
1117         hci_dev_lock(hdev);
1118
1119         if (hci_dev_test_flag(hdev, HCI_MGMT))
1120                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1121                                                  0, rp->status);
1122
1123         hci_dev_unlock(hdev);
1124 }
1125
1126 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1127                                           struct sk_buff *skb)
1128 {
1129         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1130
1131         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1132
1133         hci_dev_lock(hdev);
1134
1135         if (hci_dev_test_flag(hdev, HCI_MGMT))
1136                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1137                                                      ACL_LINK, 0, rp->status);
1138
1139         hci_dev_unlock(hdev);
1140 }
1141
1142 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1143                                        struct sk_buff *skb)
1144 {
1145         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1146
1147         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1148 }
1149
1150 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1151                                            struct sk_buff *skb)
1152 {
1153         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1154
1155         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1156 }
1157
1158 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1159 {
1160         __u8 status = *((__u8 *) skb->data);
1161         bdaddr_t *sent;
1162
1163         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1164
1165         if (status)
1166                 return;
1167
1168         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1169         if (!sent)
1170                 return;
1171
1172         hci_dev_lock(hdev);
1173
1174         bacpy(&hdev->random_addr, sent);
1175
1176         if (!bacmp(&hdev->rpa, sent)) {
1177                 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED);
1178                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired,
1179                                    secs_to_jiffies(hdev->rpa_timeout));
1180         }
1181
1182         hci_dev_unlock(hdev);
1183 }
1184
1185 static void hci_cc_le_set_default_phy(struct hci_dev *hdev, struct sk_buff *skb)
1186 {
1187         __u8 status = *((__u8 *) skb->data);
1188         struct hci_cp_le_set_default_phy *cp;
1189
1190         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1191
1192         if (status)
1193                 return;
1194
1195         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_DEFAULT_PHY);
1196         if (!cp)
1197                 return;
1198
1199         hci_dev_lock(hdev);
1200
1201         hdev->le_tx_def_phys = cp->tx_phys;
1202         hdev->le_rx_def_phys = cp->rx_phys;
1203
1204         hci_dev_unlock(hdev);
1205 }
1206
1207 static void hci_cc_le_set_adv_set_random_addr(struct hci_dev *hdev,
1208                                               struct sk_buff *skb)
1209 {
1210         __u8 status = *((__u8 *) skb->data);
1211         struct hci_cp_le_set_adv_set_rand_addr *cp;
1212         struct adv_info *adv;
1213
1214         if (status)
1215                 return;
1216
1217         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR);
1218         /* Update only in case the adv instance since handle 0x00 shall be using
1219          * HCI_OP_LE_SET_RANDOM_ADDR since that allows both extended and
1220          * non-extended adverting.
1221          */
1222         if (!cp || !cp->handle)
1223                 return;
1224
1225         hci_dev_lock(hdev);
1226
1227         adv = hci_find_adv_instance(hdev, cp->handle);
1228         if (adv) {
1229                 bacpy(&adv->random_addr, &cp->bdaddr);
1230                 if (!bacmp(&hdev->rpa, &cp->bdaddr)) {
1231                         adv->rpa_expired = false;
1232                         queue_delayed_work(hdev->workqueue,
1233                                            &adv->rpa_expired_cb,
1234                                            secs_to_jiffies(hdev->rpa_timeout));
1235                 }
1236         }
1237
1238         hci_dev_unlock(hdev);
1239 }
1240
1241 static void hci_cc_le_read_transmit_power(struct hci_dev *hdev,
1242                                           struct sk_buff *skb)
1243 {
1244         struct hci_rp_le_read_transmit_power *rp = (void *)skb->data;
1245
1246         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1247
1248         if (rp->status)
1249                 return;
1250
1251         hdev->min_le_tx_power = rp->min_le_tx_power;
1252         hdev->max_le_tx_power = rp->max_le_tx_power;
1253 }
1254
1255 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1256 {
1257         __u8 *sent, status = *((__u8 *) skb->data);
1258
1259         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1260
1261         if (status)
1262                 return;
1263
1264         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1265         if (!sent)
1266                 return;
1267
1268         hci_dev_lock(hdev);
1269
1270         /* If we're doing connection initiation as peripheral. Set a
1271          * timeout in case something goes wrong.
1272          */
1273         if (*sent) {
1274                 struct hci_conn *conn;
1275
1276                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1277
1278                 conn = hci_lookup_le_connect(hdev);
1279                 if (conn)
1280                         queue_delayed_work(hdev->workqueue,
1281                                            &conn->le_conn_timeout,
1282                                            conn->conn_timeout);
1283         } else {
1284                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1285         }
1286
1287         hci_dev_unlock(hdev);
1288 }
1289
1290 static void hci_cc_le_set_ext_adv_enable(struct hci_dev *hdev,
1291                                          struct sk_buff *skb)
1292 {
1293         struct hci_cp_le_set_ext_adv_enable *cp;
1294         struct hci_cp_ext_adv_set *set;
1295         __u8 status = *((__u8 *) skb->data);
1296         struct adv_info *adv = NULL, *n;
1297
1298         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1299
1300         if (status)
1301                 return;
1302
1303         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE);
1304         if (!cp)
1305                 return;
1306
1307         set = (void *)cp->data;
1308
1309         hci_dev_lock(hdev);
1310
1311         if (cp->num_of_sets)
1312                 adv = hci_find_adv_instance(hdev, set->handle);
1313
1314         if (cp->enable) {
1315                 struct hci_conn *conn;
1316
1317                 hci_dev_set_flag(hdev, HCI_LE_ADV);
1318
1319                 if (adv)
1320                         adv->enabled = true;
1321
1322                 conn = hci_lookup_le_connect(hdev);
1323                 if (conn)
1324                         queue_delayed_work(hdev->workqueue,
1325                                            &conn->le_conn_timeout,
1326                                            conn->conn_timeout);
1327         } else {
1328                 if (adv) {
1329                         adv->enabled = false;
1330                         /* If just one instance was disabled check if there are
1331                          * any other instance enabled before clearing HCI_LE_ADV
1332                          */
1333                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1334                                                  list) {
1335                                 if (adv->enabled)
1336                                         goto unlock;
1337                         }
1338                 } else {
1339                         /* All instances shall be considered disabled */
1340                         list_for_each_entry_safe(adv, n, &hdev->adv_instances,
1341                                                  list)
1342                                 adv->enabled = false;
1343                 }
1344
1345                 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1346         }
1347
1348 unlock:
1349         hci_dev_unlock(hdev);
1350 }
1351
1352 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1353 {
1354         struct hci_cp_le_set_scan_param *cp;
1355         __u8 status = *((__u8 *) skb->data);
1356
1357         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1358
1359         if (status)
1360                 return;
1361
1362         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1363         if (!cp)
1364                 return;
1365
1366         hci_dev_lock(hdev);
1367
1368         hdev->le_scan_type = cp->type;
1369
1370         hci_dev_unlock(hdev);
1371 }
1372
1373 static void hci_cc_le_set_ext_scan_param(struct hci_dev *hdev,
1374                                          struct sk_buff *skb)
1375 {
1376         struct hci_cp_le_set_ext_scan_params *cp;
1377         __u8 status = *((__u8 *) skb->data);
1378         struct hci_cp_le_scan_phy_params *phy_param;
1379
1380         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1381
1382         if (status)
1383                 return;
1384
1385         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS);
1386         if (!cp)
1387                 return;
1388
1389         phy_param = (void *)cp->data;
1390
1391         hci_dev_lock(hdev);
1392
1393         hdev->le_scan_type = phy_param->type;
1394
1395         hci_dev_unlock(hdev);
1396 }
1397
1398 static bool has_pending_adv_report(struct hci_dev *hdev)
1399 {
1400         struct discovery_state *d = &hdev->discovery;
1401
1402         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1403 }
1404
1405 static void clear_pending_adv_report(struct hci_dev *hdev)
1406 {
1407         struct discovery_state *d = &hdev->discovery;
1408
1409         bacpy(&d->last_adv_addr, BDADDR_ANY);
1410         d->last_adv_data_len = 0;
1411 }
1412
1413 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1414                                      u8 bdaddr_type, s8 rssi, u32 flags,
1415                                      u8 *data, u8 len)
1416 {
1417         struct discovery_state *d = &hdev->discovery;
1418
1419         if (len > HCI_MAX_AD_LENGTH)
1420                 return;
1421
1422         bacpy(&d->last_adv_addr, bdaddr);
1423         d->last_adv_addr_type = bdaddr_type;
1424         d->last_adv_rssi = rssi;
1425         d->last_adv_flags = flags;
1426         memcpy(d->last_adv_data, data, len);
1427         d->last_adv_data_len = len;
1428 }
1429
1430 static void le_set_scan_enable_complete(struct hci_dev *hdev, u8 enable)
1431 {
1432         hci_dev_lock(hdev);
1433
1434         switch (enable) {
1435         case LE_SCAN_ENABLE:
1436                 hci_dev_set_flag(hdev, HCI_LE_SCAN);
1437                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1438                         clear_pending_adv_report(hdev);
1439                 break;
1440
1441         case LE_SCAN_DISABLE:
1442                 /* We do this here instead of when setting DISCOVERY_STOPPED
1443                  * since the latter would potentially require waiting for
1444                  * inquiry to stop too.
1445                  */
1446                 if (has_pending_adv_report(hdev)) {
1447                         struct discovery_state *d = &hdev->discovery;
1448
1449                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1450                                           d->last_adv_addr_type, NULL,
1451                                           d->last_adv_rssi, d->last_adv_flags,
1452                                           d->last_adv_data,
1453                                           d->last_adv_data_len, NULL, 0);
1454                 }
1455
1456                 /* Cancel this timer so that we don't try to disable scanning
1457                  * when it's already disabled.
1458                  */
1459                 cancel_delayed_work(&hdev->le_scan_disable);
1460
1461                 hci_dev_clear_flag(hdev, HCI_LE_SCAN);
1462
1463                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1464                  * interrupted scanning due to a connect request. Mark
1465                  * therefore discovery as stopped. If this was not
1466                  * because of a connect request advertising might have
1467                  * been disabled because of active scanning, so
1468                  * re-enable it again if necessary.
1469                  */
1470                 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_SCAN_INTERRUPTED))
1471 #ifndef TIZEN_BT /* The below line is kernel bug. */
1472                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1473 #else
1474                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1475 #endif
1476                 else if (!hci_dev_test_flag(hdev, HCI_LE_ADV) &&
1477                          hdev->discovery.state == DISCOVERY_FINDING)
1478                         hci_req_reenable_advertising(hdev);
1479
1480                 break;
1481
1482         default:
1483                 bt_dev_err(hdev, "use of reserved LE_Scan_Enable param %d",
1484                            enable);
1485                 break;
1486         }
1487
1488         hci_dev_unlock(hdev);
1489 }
1490
1491 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1492                                       struct sk_buff *skb)
1493 {
1494         struct hci_cp_le_set_scan_enable *cp;
1495         __u8 status = *((__u8 *) skb->data);
1496
1497         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1498
1499         if (status)
1500                 return;
1501
1502         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1503         if (!cp)
1504                 return;
1505
1506         le_set_scan_enable_complete(hdev, cp->enable);
1507 }
1508
1509 static void hci_cc_le_set_ext_scan_enable(struct hci_dev *hdev,
1510                                       struct sk_buff *skb)
1511 {
1512         struct hci_cp_le_set_ext_scan_enable *cp;
1513         __u8 status = *((__u8 *) skb->data);
1514
1515         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1516
1517         if (status)
1518                 return;
1519
1520         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE);
1521         if (!cp)
1522                 return;
1523
1524         le_set_scan_enable_complete(hdev, cp->enable);
1525 }
1526
1527 static void hci_cc_le_read_num_adv_sets(struct hci_dev *hdev,
1528                                       struct sk_buff *skb)
1529 {
1530         struct hci_rp_le_read_num_supported_adv_sets *rp = (void *) skb->data;
1531
1532         BT_DBG("%s status 0x%2.2x No of Adv sets %u", hdev->name, rp->status,
1533                rp->num_of_sets);
1534
1535         if (rp->status)
1536                 return;
1537
1538         hdev->le_num_of_adv_sets = rp->num_of_sets;
1539 }
1540
1541 static void hci_cc_le_read_accept_list_size(struct hci_dev *hdev,
1542                                             struct sk_buff *skb)
1543 {
1544         struct hci_rp_le_read_accept_list_size *rp = (void *)skb->data;
1545
1546         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1547
1548         if (rp->status)
1549                 return;
1550
1551         hdev->le_accept_list_size = rp->size;
1552 }
1553
1554 static void hci_cc_le_clear_accept_list(struct hci_dev *hdev,
1555                                         struct sk_buff *skb)
1556 {
1557         __u8 status = *((__u8 *) skb->data);
1558
1559         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1560
1561         if (status)
1562                 return;
1563
1564         hci_bdaddr_list_clear(&hdev->le_accept_list);
1565 }
1566
1567 static void hci_cc_le_add_to_accept_list(struct hci_dev *hdev,
1568                                          struct sk_buff *skb)
1569 {
1570         struct hci_cp_le_add_to_accept_list *sent;
1571         __u8 status = *((__u8 *) skb->data);
1572
1573         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1574
1575         if (status)
1576                 return;
1577
1578         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
1579         if (!sent)
1580                 return;
1581
1582         hci_bdaddr_list_add(&hdev->le_accept_list, &sent->bdaddr,
1583                             sent->bdaddr_type);
1584 }
1585
1586 static void hci_cc_le_del_from_accept_list(struct hci_dev *hdev,
1587                                            struct sk_buff *skb)
1588 {
1589         struct hci_cp_le_del_from_accept_list *sent;
1590         __u8 status = *((__u8 *) skb->data);
1591
1592         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594         if (status)
1595                 return;
1596
1597         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST);
1598         if (!sent)
1599                 return;
1600
1601         hci_bdaddr_list_del(&hdev->le_accept_list, &sent->bdaddr,
1602                             sent->bdaddr_type);
1603 }
1604
1605 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1606                                             struct sk_buff *skb)
1607 {
1608         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1609
1610         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1611
1612         if (rp->status)
1613                 return;
1614
1615         memcpy(hdev->le_states, rp->le_states, 8);
1616 }
1617
1618 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1619                                         struct sk_buff *skb)
1620 {
1621         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1622
1623         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1624
1625         if (rp->status)
1626                 return;
1627
1628         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1629         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1630 }
1631
1632 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1633                                          struct sk_buff *skb)
1634 {
1635         struct hci_cp_le_write_def_data_len *sent;
1636         __u8 status = *((__u8 *) skb->data);
1637
1638         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1639
1640         if (status)
1641                 return;
1642
1643         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1644         if (!sent)
1645                 return;
1646
1647         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1648         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1649 }
1650
1651 static void hci_cc_le_add_to_resolv_list(struct hci_dev *hdev,
1652                                          struct sk_buff *skb)
1653 {
1654         struct hci_cp_le_add_to_resolv_list *sent;
1655         __u8 status = *((__u8 *) skb->data);
1656
1657         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1658
1659         if (status)
1660                 return;
1661
1662         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST);
1663         if (!sent)
1664                 return;
1665
1666         hci_bdaddr_list_add_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1667                                 sent->bdaddr_type, sent->peer_irk,
1668                                 sent->local_irk);
1669 }
1670
1671 static void hci_cc_le_del_from_resolv_list(struct hci_dev *hdev,
1672                                           struct sk_buff *skb)
1673 {
1674         struct hci_cp_le_del_from_resolv_list *sent;
1675         __u8 status = *((__u8 *) skb->data);
1676
1677         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1678
1679         if (status)
1680                 return;
1681
1682         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST);
1683         if (!sent)
1684                 return;
1685
1686         hci_bdaddr_list_del_with_irk(&hdev->le_resolv_list, &sent->bdaddr,
1687                             sent->bdaddr_type);
1688 }
1689
1690 static void hci_cc_le_clear_resolv_list(struct hci_dev *hdev,
1691                                        struct sk_buff *skb)
1692 {
1693         __u8 status = *((__u8 *) skb->data);
1694
1695         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1696
1697         if (status)
1698                 return;
1699
1700         hci_bdaddr_list_clear(&hdev->le_resolv_list);
1701 }
1702
1703 static void hci_cc_le_read_resolv_list_size(struct hci_dev *hdev,
1704                                            struct sk_buff *skb)
1705 {
1706         struct hci_rp_le_read_resolv_list_size *rp = (void *) skb->data;
1707
1708         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1709
1710         if (rp->status)
1711                 return;
1712
1713         hdev->le_resolv_list_size = rp->size;
1714 }
1715
1716 static void hci_cc_le_set_addr_resolution_enable(struct hci_dev *hdev,
1717                                                 struct sk_buff *skb)
1718 {
1719         __u8 *sent, status = *((__u8 *) skb->data);
1720
1721         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1722
1723         if (status)
1724                 return;
1725
1726         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE);
1727         if (!sent)
1728                 return;
1729
1730         hci_dev_lock(hdev);
1731
1732         if (*sent)
1733                 hci_dev_set_flag(hdev, HCI_LL_RPA_RESOLUTION);
1734         else
1735                 hci_dev_clear_flag(hdev, HCI_LL_RPA_RESOLUTION);
1736
1737         hci_dev_unlock(hdev);
1738 }
1739
1740 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1741                                         struct sk_buff *skb)
1742 {
1743         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1744
1745         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1746
1747         if (rp->status)
1748                 return;
1749
1750         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1751         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1752         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1753         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1754 }
1755
1756 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1757                                            struct sk_buff *skb)
1758 {
1759         struct hci_cp_write_le_host_supported *sent;
1760         __u8 status = *((__u8 *) skb->data);
1761
1762         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1763
1764         if (status)
1765                 return;
1766
1767         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1768         if (!sent)
1769                 return;
1770
1771         hci_dev_lock(hdev);
1772
1773         if (sent->le) {
1774                 hdev->features[1][0] |= LMP_HOST_LE;
1775                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
1776         } else {
1777                 hdev->features[1][0] &= ~LMP_HOST_LE;
1778                 hci_dev_clear_flag(hdev, HCI_LE_ENABLED);
1779                 hci_dev_clear_flag(hdev, HCI_ADVERTISING);
1780         }
1781
1782         if (sent->simul)
1783                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1784         else
1785                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1786
1787         hci_dev_unlock(hdev);
1788 }
1789
1790 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1791 {
1792         struct hci_cp_le_set_adv_param *cp;
1793         u8 status = *((u8 *) skb->data);
1794
1795         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1796
1797         if (status)
1798                 return;
1799
1800         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1801         if (!cp)
1802                 return;
1803
1804         hci_dev_lock(hdev);
1805         hdev->adv_addr_type = cp->own_address_type;
1806         hci_dev_unlock(hdev);
1807 }
1808
1809 static void hci_cc_set_ext_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1810 {
1811         struct hci_rp_le_set_ext_adv_params *rp = (void *) skb->data;
1812         struct hci_cp_le_set_ext_adv_params *cp;
1813         struct adv_info *adv_instance;
1814
1815         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1816
1817         if (rp->status)
1818                 return;
1819
1820         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS);
1821         if (!cp)
1822                 return;
1823
1824         hci_dev_lock(hdev);
1825         hdev->adv_addr_type = cp->own_addr_type;
1826         if (!cp->handle) {
1827                 /* Store in hdev for instance 0 */
1828                 hdev->adv_tx_power = rp->tx_power;
1829         } else {
1830                 adv_instance = hci_find_adv_instance(hdev, cp->handle);
1831                 if (adv_instance)
1832                         adv_instance->tx_power = rp->tx_power;
1833         }
1834         /* Update adv data as tx power is known now */
1835         hci_req_update_adv_data(hdev, cp->handle);
1836
1837         hci_dev_unlock(hdev);
1838 }
1839
1840 #ifdef TIZEN_BT
1841 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1842                                           struct sk_buff *skb)
1843 {
1844         struct hci_cc_rsp_enable_rssi *rp = (void *)skb->data;
1845
1846         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1847                hdev->name, rp->status, rp->le_ext_opcode);
1848
1849         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1850 }
1851
1852 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1853                                           struct sk_buff *skb)
1854 {
1855         struct hci_cc_rp_get_raw_rssi *rp = (void *)skb->data;
1856
1857         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1858                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1859
1860         mgmt_raw_rssi_response(hdev, rp, rp->status);
1861 }
1862 #endif
1863
1864 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1865 {
1866         struct hci_rp_read_rssi *rp = (void *) skb->data;
1867         struct hci_conn *conn;
1868
1869         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1870
1871         if (rp->status)
1872                 return;
1873
1874         hci_dev_lock(hdev);
1875
1876         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1877         if (conn)
1878                 conn->rssi = rp->rssi;
1879
1880         hci_dev_unlock(hdev);
1881 }
1882
1883 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1884 {
1885         struct hci_cp_read_tx_power *sent;
1886         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1887         struct hci_conn *conn;
1888
1889         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1890
1891         if (rp->status)
1892                 return;
1893
1894         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1895         if (!sent)
1896                 return;
1897
1898         hci_dev_lock(hdev);
1899
1900         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1901         if (!conn)
1902                 goto unlock;
1903
1904         switch (sent->type) {
1905         case 0x00:
1906                 conn->tx_power = rp->tx_power;
1907                 break;
1908         case 0x01:
1909                 conn->max_tx_power = rp->tx_power;
1910                 break;
1911         }
1912
1913 unlock:
1914         hci_dev_unlock(hdev);
1915 }
1916
1917 static void hci_cc_write_ssp_debug_mode(struct hci_dev *hdev, struct sk_buff *skb)
1918 {
1919         u8 status = *((u8 *) skb->data);
1920         u8 *mode;
1921
1922         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1923
1924         if (status)
1925                 return;
1926
1927         mode = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE);
1928         if (mode)
1929                 hdev->ssp_debug_mode = *mode;
1930 }
1931
1932 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1933 {
1934         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1935
1936         if (status) {
1937                 hci_conn_check_pending(hdev);
1938                 return;
1939         }
1940
1941         set_bit(HCI_INQUIRY, &hdev->flags);
1942 }
1943
1944 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1945 {
1946         struct hci_cp_create_conn *cp;
1947         struct hci_conn *conn;
1948
1949         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1950
1951         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1952         if (!cp)
1953                 return;
1954
1955         hci_dev_lock(hdev);
1956
1957         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1958
1959         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1960
1961         if (status) {
1962                 if (conn && conn->state == BT_CONNECT) {
1963                         if (status != 0x0c || conn->attempt > 2) {
1964                                 conn->state = BT_CLOSED;
1965                                 hci_connect_cfm(conn, status);
1966                                 hci_conn_del(conn);
1967                         } else
1968                                 conn->state = BT_CONNECT2;
1969                 }
1970         } else {
1971                 if (!conn) {
1972                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1973                                             HCI_ROLE_MASTER);
1974                         if (!conn)
1975                                 bt_dev_err(hdev, "no memory for new connection");
1976                 }
1977         }
1978
1979         hci_dev_unlock(hdev);
1980 }
1981
1982 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1983 {
1984         struct hci_cp_add_sco *cp;
1985         struct hci_conn *acl, *sco;
1986         __u16 handle;
1987
1988         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1989
1990         if (!status)
1991                 return;
1992
1993         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1994         if (!cp)
1995                 return;
1996
1997         handle = __le16_to_cpu(cp->handle);
1998
1999         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2000
2001         hci_dev_lock(hdev);
2002
2003         acl = hci_conn_hash_lookup_handle(hdev, handle);
2004         if (acl) {
2005                 sco = acl->link;
2006                 if (sco) {
2007                         sco->state = BT_CLOSED;
2008
2009                         hci_connect_cfm(sco, status);
2010                         hci_conn_del(sco);
2011                 }
2012         }
2013
2014         hci_dev_unlock(hdev);
2015 }
2016
2017 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
2018 {
2019         struct hci_cp_auth_requested *cp;
2020         struct hci_conn *conn;
2021
2022         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2023
2024         if (!status)
2025                 return;
2026
2027         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
2028         if (!cp)
2029                 return;
2030
2031         hci_dev_lock(hdev);
2032
2033         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2034         if (conn) {
2035                 if (conn->state == BT_CONFIG) {
2036                         hci_connect_cfm(conn, status);
2037                         hci_conn_drop(conn);
2038                 }
2039         }
2040
2041         hci_dev_unlock(hdev);
2042 }
2043
2044 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
2045 {
2046         struct hci_cp_set_conn_encrypt *cp;
2047         struct hci_conn *conn;
2048
2049         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2050
2051         if (!status)
2052                 return;
2053
2054         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
2055         if (!cp)
2056                 return;
2057
2058         hci_dev_lock(hdev);
2059
2060         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2061         if (conn) {
2062                 if (conn->state == BT_CONFIG) {
2063                         hci_connect_cfm(conn, status);
2064                         hci_conn_drop(conn);
2065                 }
2066         }
2067
2068         hci_dev_unlock(hdev);
2069 }
2070
2071 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
2072                                     struct hci_conn *conn)
2073 {
2074         if (conn->state != BT_CONFIG || !conn->out)
2075                 return 0;
2076
2077         if (conn->pending_sec_level == BT_SECURITY_SDP)
2078                 return 0;
2079
2080         /* Only request authentication for SSP connections or non-SSP
2081          * devices with sec_level MEDIUM or HIGH or if MITM protection
2082          * is requested.
2083          */
2084         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
2085             conn->pending_sec_level != BT_SECURITY_FIPS &&
2086             conn->pending_sec_level != BT_SECURITY_HIGH &&
2087             conn->pending_sec_level != BT_SECURITY_MEDIUM)
2088                 return 0;
2089
2090         return 1;
2091 }
2092
2093 static int hci_resolve_name(struct hci_dev *hdev,
2094                                    struct inquiry_entry *e)
2095 {
2096         struct hci_cp_remote_name_req cp;
2097
2098         memset(&cp, 0, sizeof(cp));
2099
2100         bacpy(&cp.bdaddr, &e->data.bdaddr);
2101         cp.pscan_rep_mode = e->data.pscan_rep_mode;
2102         cp.pscan_mode = e->data.pscan_mode;
2103         cp.clock_offset = e->data.clock_offset;
2104
2105         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2106 }
2107
2108 static bool hci_resolve_next_name(struct hci_dev *hdev)
2109 {
2110         struct discovery_state *discov = &hdev->discovery;
2111         struct inquiry_entry *e;
2112
2113         if (list_empty(&discov->resolve))
2114                 return false;
2115
2116         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2117         if (!e)
2118                 return false;
2119
2120         if (hci_resolve_name(hdev, e) == 0) {
2121                 e->name_state = NAME_PENDING;
2122                 return true;
2123         }
2124
2125         return false;
2126 }
2127
2128 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
2129                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
2130 {
2131         struct discovery_state *discov = &hdev->discovery;
2132         struct inquiry_entry *e;
2133
2134 #ifdef TIZEN_BT
2135         /* Update the mgmt connected state if necessary. Be careful with
2136          * conn objects that exist but are not (yet) connected however.
2137          * Only those in BT_CONFIG or BT_CONNECTED states can be
2138          * considered connected.
2139          */
2140         if (conn &&
2141             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
2142                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2143                         mgmt_device_connected(hdev, conn, 0, name, name_len);
2144                 else
2145                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
2146         }
2147 #else
2148         if (conn &&
2149             (conn->state == BT_CONFIG || conn->state == BT_CONNECTED) &&
2150             !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2151                 mgmt_device_connected(hdev, conn, name, name_len);
2152 #endif
2153
2154         if (discov->state == DISCOVERY_STOPPED)
2155                 return;
2156
2157         if (discov->state == DISCOVERY_STOPPING)
2158                 goto discov_complete;
2159
2160         if (discov->state != DISCOVERY_RESOLVING)
2161                 return;
2162
2163         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
2164         /* If the device was not found in a list of found devices names of which
2165          * are pending. there is no need to continue resolving a next name as it
2166          * will be done upon receiving another Remote Name Request Complete
2167          * Event */
2168         if (!e)
2169                 return;
2170
2171         list_del(&e->list);
2172         if (name) {
2173                 e->name_state = NAME_KNOWN;
2174                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
2175                                  e->data.rssi, name, name_len);
2176         } else {
2177                 e->name_state = NAME_NOT_KNOWN;
2178         }
2179
2180         if (hci_resolve_next_name(hdev))
2181                 return;
2182
2183 discov_complete:
2184         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2185 }
2186
2187 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
2188 {
2189         struct hci_cp_remote_name_req *cp;
2190         struct hci_conn *conn;
2191
2192         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2193
2194         /* If successful wait for the name req complete event before
2195          * checking for the need to do authentication */
2196         if (!status)
2197                 return;
2198
2199         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
2200         if (!cp)
2201                 return;
2202
2203         hci_dev_lock(hdev);
2204
2205         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2206
2207         if (hci_dev_test_flag(hdev, HCI_MGMT))
2208                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
2209
2210         if (!conn)
2211                 goto unlock;
2212
2213         if (!hci_outgoing_auth_needed(hdev, conn))
2214                 goto unlock;
2215
2216         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2217                 struct hci_cp_auth_requested auth_cp;
2218
2219                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2220
2221                 auth_cp.handle = __cpu_to_le16(conn->handle);
2222                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
2223                              sizeof(auth_cp), &auth_cp);
2224         }
2225
2226 unlock:
2227         hci_dev_unlock(hdev);
2228 }
2229
2230 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
2231 {
2232         struct hci_cp_read_remote_features *cp;
2233         struct hci_conn *conn;
2234
2235         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2236
2237         if (!status)
2238                 return;
2239
2240         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
2241         if (!cp)
2242                 return;
2243
2244         hci_dev_lock(hdev);
2245
2246         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2247         if (conn) {
2248                 if (conn->state == BT_CONFIG) {
2249                         hci_connect_cfm(conn, status);
2250                         hci_conn_drop(conn);
2251                 }
2252         }
2253
2254         hci_dev_unlock(hdev);
2255 }
2256
2257 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
2258 {
2259         struct hci_cp_read_remote_ext_features *cp;
2260         struct hci_conn *conn;
2261
2262         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2263
2264         if (!status)
2265                 return;
2266
2267         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
2268         if (!cp)
2269                 return;
2270
2271         hci_dev_lock(hdev);
2272
2273         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2274         if (conn) {
2275                 if (conn->state == BT_CONFIG) {
2276                         hci_connect_cfm(conn, status);
2277                         hci_conn_drop(conn);
2278                 }
2279         }
2280
2281         hci_dev_unlock(hdev);
2282 }
2283
2284 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
2285 {
2286         struct hci_cp_setup_sync_conn *cp;
2287         struct hci_conn *acl, *sco;
2288         __u16 handle;
2289
2290         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2291
2292         if (!status)
2293                 return;
2294
2295         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
2296         if (!cp)
2297                 return;
2298
2299         handle = __le16_to_cpu(cp->handle);
2300
2301         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
2302
2303         hci_dev_lock(hdev);
2304
2305         acl = hci_conn_hash_lookup_handle(hdev, handle);
2306         if (acl) {
2307                 sco = acl->link;
2308                 if (sco) {
2309                         sco->state = BT_CLOSED;
2310
2311                         hci_connect_cfm(sco, status);
2312                         hci_conn_del(sco);
2313                 }
2314         }
2315
2316         hci_dev_unlock(hdev);
2317 }
2318
2319 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
2320 {
2321         struct hci_cp_sniff_mode *cp;
2322         struct hci_conn *conn;
2323
2324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2325
2326         if (!status)
2327                 return;
2328
2329         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
2330         if (!cp)
2331                 return;
2332
2333         hci_dev_lock(hdev);
2334
2335         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2336         if (conn) {
2337                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2338
2339                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2340                         hci_sco_setup(conn, status);
2341         }
2342
2343         hci_dev_unlock(hdev);
2344 }
2345
2346 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
2347 {
2348         struct hci_cp_exit_sniff_mode *cp;
2349         struct hci_conn *conn;
2350
2351         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2352
2353         if (!status)
2354                 return;
2355
2356         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2357         if (!cp)
2358                 return;
2359
2360         hci_dev_lock(hdev);
2361
2362         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2363         if (conn) {
2364                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2365
2366                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2367                         hci_sco_setup(conn, status);
2368         }
2369
2370         hci_dev_unlock(hdev);
2371 }
2372
2373 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2374 {
2375         struct hci_cp_disconnect *cp;
2376         struct hci_conn *conn;
2377
2378         if (!status)
2379                 return;
2380
2381         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2382         if (!cp)
2383                 return;
2384
2385         hci_dev_lock(hdev);
2386
2387         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2388         if (conn) {
2389                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2390                                        conn->dst_type, status);
2391
2392                 if (conn->type == LE_LINK) {
2393                         hdev->cur_adv_instance = conn->adv_instance;
2394                         hci_req_reenable_advertising(hdev);
2395                 }
2396
2397                 /* If the disconnection failed for any reason, the upper layer
2398                  * does not retry to disconnect in current implementation.
2399                  * Hence, we need to do some basic cleanup here and re-enable
2400                  * advertising if necessary.
2401                  */
2402                 hci_conn_del(conn);
2403         }
2404
2405         hci_dev_unlock(hdev);
2406 }
2407
2408 static void cs_le_create_conn(struct hci_dev *hdev, bdaddr_t *peer_addr,
2409                               u8 peer_addr_type, u8 own_address_type,
2410                               u8 filter_policy)
2411 {
2412         struct hci_conn *conn;
2413
2414         conn = hci_conn_hash_lookup_le(hdev, peer_addr,
2415                                        peer_addr_type);
2416         if (!conn)
2417                 return;
2418
2419         /* When using controller based address resolution, then the new
2420          * address types 0x02 and 0x03 are used. These types need to be
2421          * converted back into either public address or random address type
2422          */
2423         if (use_ll_privacy(hdev) &&
2424             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
2425                 switch (own_address_type) {
2426                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
2427                         own_address_type = ADDR_LE_DEV_PUBLIC;
2428                         break;
2429                 case ADDR_LE_DEV_RANDOM_RESOLVED:
2430                         own_address_type = ADDR_LE_DEV_RANDOM;
2431                         break;
2432                 }
2433         }
2434
2435         /* Store the initiator and responder address information which
2436          * is needed for SMP. These values will not change during the
2437          * lifetime of the connection.
2438          */
2439         conn->init_addr_type = own_address_type;
2440         if (own_address_type == ADDR_LE_DEV_RANDOM)
2441                 bacpy(&conn->init_addr, &hdev->random_addr);
2442         else
2443                 bacpy(&conn->init_addr, &hdev->bdaddr);
2444
2445         conn->resp_addr_type = peer_addr_type;
2446         bacpy(&conn->resp_addr, peer_addr);
2447
2448         /* We don't want the connection attempt to stick around
2449          * indefinitely since LE doesn't have a page timeout concept
2450          * like BR/EDR. Set a timer for any connection that doesn't use
2451          * the accept list for connecting.
2452          */
2453         if (filter_policy == HCI_LE_USE_PEER_ADDR)
2454                 queue_delayed_work(conn->hdev->workqueue,
2455                                    &conn->le_conn_timeout,
2456                                    conn->conn_timeout);
2457 }
2458
2459 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2460 {
2461         struct hci_cp_le_create_conn *cp;
2462
2463         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2464
2465         /* All connection failure handling is taken care of by the
2466          * hci_le_conn_failed function which is triggered by the HCI
2467          * request completion callbacks used for connecting.
2468          */
2469         if (status)
2470                 return;
2471
2472         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2473         if (!cp)
2474                 return;
2475
2476         hci_dev_lock(hdev);
2477
2478         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2479                           cp->own_address_type, cp->filter_policy);
2480
2481         hci_dev_unlock(hdev);
2482 }
2483
2484 static void hci_cs_le_ext_create_conn(struct hci_dev *hdev, u8 status)
2485 {
2486         struct hci_cp_le_ext_create_conn *cp;
2487
2488         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2489
2490         /* All connection failure handling is taken care of by the
2491          * hci_le_conn_failed function which is triggered by the HCI
2492          * request completion callbacks used for connecting.
2493          */
2494         if (status)
2495                 return;
2496
2497         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_EXT_CREATE_CONN);
2498         if (!cp)
2499                 return;
2500
2501         hci_dev_lock(hdev);
2502
2503         cs_le_create_conn(hdev, &cp->peer_addr, cp->peer_addr_type,
2504                           cp->own_addr_type, cp->filter_policy);
2505
2506         hci_dev_unlock(hdev);
2507 }
2508
2509 static void hci_cs_le_read_remote_features(struct hci_dev *hdev, u8 status)
2510 {
2511         struct hci_cp_le_read_remote_features *cp;
2512         struct hci_conn *conn;
2513
2514         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2515
2516         if (!status)
2517                 return;
2518
2519         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_READ_REMOTE_FEATURES);
2520         if (!cp)
2521                 return;
2522
2523         hci_dev_lock(hdev);
2524
2525         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2526         if (conn) {
2527                 if (conn->state == BT_CONFIG) {
2528                         hci_connect_cfm(conn, status);
2529                         hci_conn_drop(conn);
2530                 }
2531         }
2532
2533         hci_dev_unlock(hdev);
2534 }
2535
2536 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2537 {
2538         struct hci_cp_le_start_enc *cp;
2539         struct hci_conn *conn;
2540
2541         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2542
2543         if (!status)
2544                 return;
2545
2546         hci_dev_lock(hdev);
2547
2548         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2549         if (!cp)
2550                 goto unlock;
2551
2552         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2553         if (!conn)
2554                 goto unlock;
2555
2556         if (conn->state != BT_CONNECTED)
2557                 goto unlock;
2558
2559         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2560         hci_conn_drop(conn);
2561
2562 unlock:
2563         hci_dev_unlock(hdev);
2564 }
2565
2566 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2567 {
2568         struct hci_cp_switch_role *cp;
2569         struct hci_conn *conn;
2570
2571         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2572
2573         if (!status)
2574                 return;
2575
2576         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2577         if (!cp)
2578                 return;
2579
2580         hci_dev_lock(hdev);
2581
2582         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2583         if (conn)
2584                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2585
2586         hci_dev_unlock(hdev);
2587 }
2588
2589 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2590 {
2591         __u8 status = *((__u8 *) skb->data);
2592         struct discovery_state *discov = &hdev->discovery;
2593         struct inquiry_entry *e;
2594
2595         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2596
2597         hci_conn_check_pending(hdev);
2598
2599         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2600                 return;
2601
2602         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2603         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2604
2605         if (!hci_dev_test_flag(hdev, HCI_MGMT))
2606                 return;
2607
2608         hci_dev_lock(hdev);
2609
2610         if (discov->state != DISCOVERY_FINDING)
2611                 goto unlock;
2612
2613         if (list_empty(&discov->resolve)) {
2614                 /* When BR/EDR inquiry is active and no LE scanning is in
2615                  * progress, then change discovery state to indicate completion.
2616                  *
2617                  * When running LE scanning and BR/EDR inquiry simultaneously
2618                  * and the LE scan already finished, then change the discovery
2619                  * state to indicate completion.
2620                  */
2621                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2622                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2623                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2624                 goto unlock;
2625         }
2626
2627         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2628         if (e && hci_resolve_name(hdev, e) == 0) {
2629                 e->name_state = NAME_PENDING;
2630                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2631         } else {
2632                 /* When BR/EDR inquiry is active and no LE scanning is in
2633                  * progress, then change discovery state to indicate completion.
2634                  *
2635                  * When running LE scanning and BR/EDR inquiry simultaneously
2636                  * and the LE scan already finished, then change the discovery
2637                  * state to indicate completion.
2638                  */
2639                 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2640                     !test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks))
2641                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2642         }
2643
2644 unlock:
2645         hci_dev_unlock(hdev);
2646 }
2647
2648 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2649 {
2650         struct inquiry_data data;
2651         struct inquiry_info *info = (void *) (skb->data + 1);
2652         int num_rsp = *((__u8 *) skb->data);
2653
2654         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2655
2656         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
2657                 return;
2658
2659         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
2660                 return;
2661
2662         hci_dev_lock(hdev);
2663
2664         for (; num_rsp; num_rsp--, info++) {
2665                 u32 flags;
2666
2667                 bacpy(&data.bdaddr, &info->bdaddr);
2668                 data.pscan_rep_mode     = info->pscan_rep_mode;
2669                 data.pscan_period_mode  = info->pscan_period_mode;
2670                 data.pscan_mode         = info->pscan_mode;
2671                 memcpy(data.dev_class, info->dev_class, 3);
2672                 data.clock_offset       = info->clock_offset;
2673                 data.rssi               = HCI_RSSI_INVALID;
2674                 data.ssp_mode           = 0x00;
2675
2676                 flags = hci_inquiry_cache_update(hdev, &data, false);
2677
2678                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2679                                   info->dev_class, HCI_RSSI_INVALID,
2680                                   flags, NULL, 0, NULL, 0);
2681         }
2682
2683         hci_dev_unlock(hdev);
2684 }
2685
2686 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2687 {
2688         struct hci_ev_conn_complete *ev = (void *) skb->data;
2689         struct hci_conn *conn;
2690
2691         BT_DBG("%s", hdev->name);
2692
2693         hci_dev_lock(hdev);
2694
2695         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2696         if (!conn) {
2697                 /* Connection may not exist if auto-connected. Check the bredr
2698                  * allowlist to see if this device is allowed to auto connect.
2699                  * If link is an ACL type, create a connection class
2700                  * automatically.
2701                  *
2702                  * Auto-connect will only occur if the event filter is
2703                  * programmed with a given address. Right now, event filter is
2704                  * only used during suspend.
2705                  */
2706                 if (ev->link_type == ACL_LINK &&
2707                     hci_bdaddr_list_lookup_with_flags(&hdev->accept_list,
2708                                                       &ev->bdaddr,
2709                                                       BDADDR_BREDR)) {
2710                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2711                                             HCI_ROLE_SLAVE);
2712                         if (!conn) {
2713                                 bt_dev_err(hdev, "no memory for new conn");
2714                                 goto unlock;
2715                         }
2716                 } else {
2717                         if (ev->link_type != SCO_LINK)
2718                                 goto unlock;
2719
2720                         conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK,
2721                                                        &ev->bdaddr);
2722                         if (!conn)
2723                                 goto unlock;
2724
2725                         conn->type = SCO_LINK;
2726                 }
2727         }
2728
2729         if (!ev->status) {
2730                 conn->handle = __le16_to_cpu(ev->handle);
2731
2732                 if (conn->type == ACL_LINK) {
2733                         conn->state = BT_CONFIG;
2734                         hci_conn_hold(conn);
2735
2736                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2737                             !hci_find_link_key(hdev, &ev->bdaddr))
2738                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2739                         else
2740                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2741                 } else
2742                         conn->state = BT_CONNECTED;
2743
2744                 hci_debugfs_create_conn(conn);
2745                 hci_conn_add_sysfs(conn);
2746
2747                 if (test_bit(HCI_AUTH, &hdev->flags))
2748                         set_bit(HCI_CONN_AUTH, &conn->flags);
2749
2750                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2751                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2752
2753                 /* Get remote features */
2754                 if (conn->type == ACL_LINK) {
2755                         struct hci_cp_read_remote_features cp;
2756                         cp.handle = ev->handle;
2757                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2758                                      sizeof(cp), &cp);
2759
2760                         hci_req_update_scan(hdev);
2761                 }
2762
2763                 /* Set packet type for incoming connection */
2764                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2765                         struct hci_cp_change_conn_ptype cp;
2766                         cp.handle = ev->handle;
2767                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2768                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2769                                      &cp);
2770                 }
2771         } else {
2772                 conn->state = BT_CLOSED;
2773                 if (conn->type == ACL_LINK)
2774                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2775                                             conn->dst_type, ev->status);
2776         }
2777
2778         if (conn->type == ACL_LINK)
2779                 hci_sco_setup(conn, ev->status);
2780
2781         if (ev->status) {
2782                 hci_connect_cfm(conn, ev->status);
2783                 hci_conn_del(conn);
2784         } else if (ev->link_type == SCO_LINK) {
2785                 switch (conn->setting & SCO_AIRMODE_MASK) {
2786                 case SCO_AIRMODE_CVSD:
2787                         if (hdev->notify)
2788                                 hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
2789                         break;
2790                 }
2791
2792                 hci_connect_cfm(conn, ev->status);
2793         }
2794
2795 unlock:
2796         hci_dev_unlock(hdev);
2797
2798         hci_conn_check_pending(hdev);
2799 }
2800
2801 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2802 {
2803         struct hci_cp_reject_conn_req cp;
2804
2805         bacpy(&cp.bdaddr, bdaddr);
2806         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2807         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2808 }
2809
2810 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2811 {
2812         struct hci_ev_conn_request *ev = (void *) skb->data;
2813         int mask = hdev->link_mode;
2814         struct inquiry_entry *ie;
2815         struct hci_conn *conn;
2816         __u8 flags = 0;
2817
2818         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2819                ev->link_type);
2820
2821         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2822                                       &flags);
2823
2824         if (!(mask & HCI_LM_ACCEPT)) {
2825                 hci_reject_conn(hdev, &ev->bdaddr);
2826                 return;
2827         }
2828
2829         if (hci_bdaddr_list_lookup(&hdev->reject_list, &ev->bdaddr,
2830                                    BDADDR_BREDR)) {
2831                 hci_reject_conn(hdev, &ev->bdaddr);
2832                 return;
2833         }
2834
2835         /* Require HCI_CONNECTABLE or an accept list entry to accept the
2836          * connection. These features are only touched through mgmt so
2837          * only do the checks if HCI_MGMT is set.
2838          */
2839         if (hci_dev_test_flag(hdev, HCI_MGMT) &&
2840             !hci_dev_test_flag(hdev, HCI_CONNECTABLE) &&
2841             !hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, &ev->bdaddr,
2842                                                BDADDR_BREDR)) {
2843                 hci_reject_conn(hdev, &ev->bdaddr);
2844                 return;
2845         }
2846
2847         /* Connection accepted */
2848
2849         hci_dev_lock(hdev);
2850
2851         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2852         if (ie)
2853                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2854
2855         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2856                         &ev->bdaddr);
2857         if (!conn) {
2858                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2859                                     HCI_ROLE_SLAVE);
2860                 if (!conn) {
2861                         bt_dev_err(hdev, "no memory for new connection");
2862                         hci_dev_unlock(hdev);
2863                         return;
2864                 }
2865         }
2866
2867         memcpy(conn->dev_class, ev->dev_class, 3);
2868
2869         hci_dev_unlock(hdev);
2870
2871         if (ev->link_type == ACL_LINK ||
2872             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2873                 struct hci_cp_accept_conn_req cp;
2874                 conn->state = BT_CONNECT;
2875
2876                 bacpy(&cp.bdaddr, &ev->bdaddr);
2877
2878                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2879                         cp.role = 0x00; /* Become central */
2880                 else
2881                         cp.role = 0x01; /* Remain peripheral */
2882
2883                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2884         } else if (!(flags & HCI_PROTO_DEFER)) {
2885                 struct hci_cp_accept_sync_conn_req cp;
2886                 conn->state = BT_CONNECT;
2887
2888                 bacpy(&cp.bdaddr, &ev->bdaddr);
2889                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2890
2891                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2892                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2893                 cp.max_latency    = cpu_to_le16(0xffff);
2894                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2895                 cp.retrans_effort = 0xff;
2896
2897                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2898                              &cp);
2899         } else {
2900                 conn->state = BT_CONNECT2;
2901                 hci_connect_cfm(conn, 0);
2902         }
2903 }
2904
2905 static u8 hci_to_mgmt_reason(u8 err)
2906 {
2907         switch (err) {
2908         case HCI_ERROR_CONNECTION_TIMEOUT:
2909                 return MGMT_DEV_DISCONN_TIMEOUT;
2910         case HCI_ERROR_REMOTE_USER_TERM:
2911         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2912         case HCI_ERROR_REMOTE_POWER_OFF:
2913                 return MGMT_DEV_DISCONN_REMOTE;
2914         case HCI_ERROR_LOCAL_HOST_TERM:
2915                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2916         default:
2917                 return MGMT_DEV_DISCONN_UNKNOWN;
2918         }
2919 }
2920
2921 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2922 {
2923         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2924         u8 reason;
2925         struct hci_conn_params *params;
2926         struct hci_conn *conn;
2927         bool mgmt_connected;
2928
2929         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2930
2931         hci_dev_lock(hdev);
2932
2933         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2934         if (!conn)
2935                 goto unlock;
2936
2937         if (ev->status) {
2938                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2939                                        conn->dst_type, ev->status);
2940                 goto unlock;
2941         }
2942
2943         conn->state = BT_CLOSED;
2944
2945         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2946
2947         if (test_bit(HCI_CONN_AUTH_FAILURE, &conn->flags))
2948                 reason = MGMT_DEV_DISCONN_AUTH_FAILURE;
2949         else
2950                 reason = hci_to_mgmt_reason(ev->reason);
2951
2952         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2953                                 reason, mgmt_connected);
2954
2955         if (conn->type == ACL_LINK) {
2956                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2957                         hci_remove_link_key(hdev, &conn->dst);
2958
2959                 hci_req_update_scan(hdev);
2960         }
2961
2962         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2963         if (params) {
2964                 switch (params->auto_connect) {
2965                 case HCI_AUTO_CONN_LINK_LOSS:
2966                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2967                                 break;
2968                         fallthrough;
2969
2970                 case HCI_AUTO_CONN_DIRECT:
2971                 case HCI_AUTO_CONN_ALWAYS:
2972                         list_del_init(&params->action);
2973                         list_add(&params->action, &hdev->pend_le_conns);
2974                         hci_update_background_scan(hdev);
2975                         break;
2976
2977                 default:
2978                         break;
2979                 }
2980         }
2981
2982         hci_disconn_cfm(conn, ev->reason);
2983
2984         /* The suspend notifier is waiting for all devices to disconnect so
2985          * clear the bit from pending tasks and inform the wait queue.
2986          */
2987         if (list_empty(&hdev->conn_hash.list) &&
2988             test_and_clear_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks)) {
2989                 wake_up(&hdev->suspend_wait_q);
2990         }
2991
2992         /* Re-enable advertising if necessary, since it might
2993          * have been disabled by the connection. From the
2994          * HCI_LE_Set_Advertise_Enable command description in
2995          * the core specification (v4.0):
2996          * "The Controller shall continue advertising until the Host
2997          * issues an LE_Set_Advertise_Enable command with
2998          * Advertising_Enable set to 0x00 (Advertising is disabled)
2999          * or until a connection is created or until the Advertising
3000          * is timed out due to Directed Advertising."
3001          */
3002         if (conn->type == LE_LINK) {
3003                 hdev->cur_adv_instance = conn->adv_instance;
3004                 hci_req_reenable_advertising(hdev);
3005         }
3006
3007         hci_conn_del(conn);
3008
3009 unlock:
3010         hci_dev_unlock(hdev);
3011 }
3012
3013 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
3014 {
3015         struct hci_ev_auth_complete *ev = (void *) skb->data;
3016         struct hci_conn *conn;
3017
3018         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3019
3020         hci_dev_lock(hdev);
3021
3022         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3023         if (!conn)
3024                 goto unlock;
3025
3026         if (!ev->status) {
3027                 clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3028
3029                 if (!hci_conn_ssp_enabled(conn) &&
3030                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
3031                         bt_dev_info(hdev, "re-auth of legacy device is not possible.");
3032                 } else {
3033                         set_bit(HCI_CONN_AUTH, &conn->flags);
3034                         conn->sec_level = conn->pending_sec_level;
3035                 }
3036         } else {
3037                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3038                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3039
3040                 mgmt_auth_failed(conn, ev->status);
3041         }
3042
3043         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3044         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
3045
3046         if (conn->state == BT_CONFIG) {
3047                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
3048                         struct hci_cp_set_conn_encrypt cp;
3049                         cp.handle  = ev->handle;
3050                         cp.encrypt = 0x01;
3051                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3052                                      &cp);
3053                 } else {
3054                         conn->state = BT_CONNECTED;
3055                         hci_connect_cfm(conn, ev->status);
3056                         hci_conn_drop(conn);
3057                 }
3058         } else {
3059                 hci_auth_cfm(conn, ev->status);
3060
3061                 hci_conn_hold(conn);
3062                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3063                 hci_conn_drop(conn);
3064         }
3065
3066         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
3067                 if (!ev->status) {
3068                         struct hci_cp_set_conn_encrypt cp;
3069                         cp.handle  = ev->handle;
3070                         cp.encrypt = 0x01;
3071                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
3072                                      &cp);
3073                 } else {
3074                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3075                         hci_encrypt_cfm(conn, ev->status);
3076                 }
3077         }
3078
3079 unlock:
3080         hci_dev_unlock(hdev);
3081 }
3082
3083 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
3084 {
3085         struct hci_ev_remote_name *ev = (void *) skb->data;
3086         struct hci_conn *conn;
3087
3088         BT_DBG("%s", hdev->name);
3089
3090         hci_conn_check_pending(hdev);
3091
3092         hci_dev_lock(hdev);
3093
3094         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3095
3096         if (!hci_dev_test_flag(hdev, HCI_MGMT))
3097                 goto check_auth;
3098
3099         if (ev->status == 0)
3100                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
3101                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
3102         else
3103                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
3104
3105 check_auth:
3106         if (!conn)
3107                 goto unlock;
3108
3109         if (!hci_outgoing_auth_needed(hdev, conn))
3110                 goto unlock;
3111
3112         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
3113                 struct hci_cp_auth_requested cp;
3114
3115                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
3116
3117                 cp.handle = __cpu_to_le16(conn->handle);
3118                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
3119         }
3120
3121 unlock:
3122         hci_dev_unlock(hdev);
3123 }
3124
3125 static void read_enc_key_size_complete(struct hci_dev *hdev, u8 status,
3126                                        u16 opcode, struct sk_buff *skb)
3127 {
3128         const struct hci_rp_read_enc_key_size *rp;
3129         struct hci_conn *conn;
3130         u16 handle;
3131
3132         BT_DBG("%s status 0x%02x", hdev->name, status);
3133
3134         if (!skb || skb->len < sizeof(*rp)) {
3135                 bt_dev_err(hdev, "invalid read key size response");
3136                 return;
3137         }
3138
3139         rp = (void *)skb->data;
3140         handle = le16_to_cpu(rp->handle);
3141
3142         hci_dev_lock(hdev);
3143
3144         conn = hci_conn_hash_lookup_handle(hdev, handle);
3145         if (!conn)
3146                 goto unlock;
3147
3148         /* While unexpected, the read_enc_key_size command may fail. The most
3149          * secure approach is to then assume the key size is 0 to force a
3150          * disconnection.
3151          */
3152         if (rp->status) {
3153                 bt_dev_err(hdev, "failed to read key size for handle %u",
3154                            handle);
3155                 conn->enc_key_size = 0;
3156         } else {
3157                 conn->enc_key_size = rp->key_size;
3158         }
3159
3160         hci_encrypt_cfm(conn, 0);
3161
3162 unlock:
3163         hci_dev_unlock(hdev);
3164 }
3165
3166 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3167 {
3168         struct hci_ev_encrypt_change *ev = (void *) skb->data;
3169         struct hci_conn *conn;
3170
3171         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3172
3173         hci_dev_lock(hdev);
3174
3175         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3176         if (!conn)
3177                 goto unlock;
3178
3179         if (!ev->status) {
3180                 if (ev->encrypt) {
3181                         /* Encryption implies authentication */
3182                         set_bit(HCI_CONN_AUTH, &conn->flags);
3183                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
3184                         conn->sec_level = conn->pending_sec_level;
3185
3186                         /* P-256 authentication key implies FIPS */
3187                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
3188                                 set_bit(HCI_CONN_FIPS, &conn->flags);
3189
3190                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
3191                             conn->type == LE_LINK)
3192                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
3193                 } else {
3194                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
3195                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
3196                 }
3197         }
3198
3199         /* We should disregard the current RPA and generate a new one
3200          * whenever the encryption procedure fails.
3201          */
3202         if (ev->status && conn->type == LE_LINK) {
3203                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
3204                 hci_adv_instances_set_rpa_expired(hdev, true);
3205         }
3206
3207         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3208
3209         /* Check link security requirements are met */
3210         if (!hci_conn_check_link_mode(conn))
3211                 ev->status = HCI_ERROR_AUTH_FAILURE;
3212
3213         if (ev->status && conn->state == BT_CONNECTED) {
3214                 if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
3215                         set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
3216
3217                 /* Notify upper layers so they can cleanup before
3218                  * disconnecting.
3219                  */
3220                 hci_encrypt_cfm(conn, ev->status);
3221                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
3222                 hci_conn_drop(conn);
3223                 goto unlock;
3224         }
3225
3226         /* Try reading the encryption key size for encrypted ACL links */
3227         if (!ev->status && ev->encrypt && conn->type == ACL_LINK) {
3228                 struct hci_cp_read_enc_key_size cp;
3229                 struct hci_request req;
3230
3231                 /* Only send HCI_Read_Encryption_Key_Size if the
3232                  * controller really supports it. If it doesn't, assume
3233                  * the default size (16).
3234                  */
3235                 if (!(hdev->commands[20] & 0x10)) {
3236                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3237                         goto notify;
3238                 }
3239
3240                 hci_req_init(&req, hdev);
3241
3242                 cp.handle = cpu_to_le16(conn->handle);
3243                 hci_req_add(&req, HCI_OP_READ_ENC_KEY_SIZE, sizeof(cp), &cp);
3244
3245                 if (hci_req_run_skb(&req, read_enc_key_size_complete)) {
3246                         bt_dev_err(hdev, "sending read key size failed");
3247                         conn->enc_key_size = HCI_LINK_KEY_SIZE;
3248                         goto notify;
3249                 }
3250
3251                 goto unlock;
3252         }
3253
3254         /* Set the default Authenticated Payload Timeout after
3255          * an LE Link is established. As per Core Spec v5.0, Vol 2, Part B
3256          * Section 3.3, the HCI command WRITE_AUTH_PAYLOAD_TIMEOUT should be
3257          * sent when the link is active and Encryption is enabled, the conn
3258          * type can be either LE or ACL and controller must support LMP Ping.
3259          * Ensure for AES-CCM encryption as well.
3260          */
3261         if (test_bit(HCI_CONN_ENCRYPT, &conn->flags) &&
3262             test_bit(HCI_CONN_AES_CCM, &conn->flags) &&
3263             ((conn->type == ACL_LINK && lmp_ping_capable(hdev)) ||
3264              (conn->type == LE_LINK && (hdev->le_features[0] & HCI_LE_PING)))) {
3265                 struct hci_cp_write_auth_payload_to cp;
3266
3267                 cp.handle = cpu_to_le16(conn->handle);
3268                 cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
3269                 hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
3270                              sizeof(cp), &cp);
3271         }
3272
3273 notify:
3274         hci_encrypt_cfm(conn, ev->status);
3275
3276 unlock:
3277         hci_dev_unlock(hdev);
3278 }
3279
3280 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
3281                                              struct sk_buff *skb)
3282 {
3283         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
3284         struct hci_conn *conn;
3285
3286         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3287
3288         hci_dev_lock(hdev);
3289
3290         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3291         if (conn) {
3292                 if (!ev->status)
3293                         set_bit(HCI_CONN_SECURE, &conn->flags);
3294
3295                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
3296
3297                 hci_key_change_cfm(conn, ev->status);
3298         }
3299
3300         hci_dev_unlock(hdev);
3301 }
3302
3303 static void hci_remote_features_evt(struct hci_dev *hdev,
3304                                     struct sk_buff *skb)
3305 {
3306         struct hci_ev_remote_features *ev = (void *) skb->data;
3307         struct hci_conn *conn;
3308
3309         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3310
3311         hci_dev_lock(hdev);
3312
3313         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3314         if (!conn)
3315                 goto unlock;
3316
3317         if (!ev->status)
3318                 memcpy(conn->features[0], ev->features, 8);
3319
3320         if (conn->state != BT_CONFIG)
3321                 goto unlock;
3322
3323         if (!ev->status && lmp_ext_feat_capable(hdev) &&
3324             lmp_ext_feat_capable(conn)) {
3325                 struct hci_cp_read_remote_ext_features cp;
3326                 cp.handle = ev->handle;
3327                 cp.page = 0x01;
3328                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
3329                              sizeof(cp), &cp);
3330                 goto unlock;
3331         }
3332
3333         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3334                 struct hci_cp_remote_name_req cp;
3335                 memset(&cp, 0, sizeof(cp));
3336                 bacpy(&cp.bdaddr, &conn->dst);
3337                 cp.pscan_rep_mode = 0x02;
3338                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3339         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3340                 mgmt_device_connected(hdev, conn, NULL, 0);
3341
3342         if (!hci_outgoing_auth_needed(hdev, conn)) {
3343                 conn->state = BT_CONNECTED;
3344                 hci_connect_cfm(conn, ev->status);
3345                 hci_conn_drop(conn);
3346         }
3347
3348 unlock:
3349         hci_dev_unlock(hdev);
3350 }
3351
3352 static inline void handle_cmd_cnt_and_timer(struct hci_dev *hdev, u8 ncmd)
3353 {
3354         cancel_delayed_work(&hdev->cmd_timer);
3355
3356         if (!test_bit(HCI_RESET, &hdev->flags)) {
3357                 if (ncmd) {
3358                         cancel_delayed_work(&hdev->ncmd_timer);
3359                         atomic_set(&hdev->cmd_cnt, 1);
3360                 } else {
3361                         schedule_delayed_work(&hdev->ncmd_timer,
3362                                               HCI_NCMD_TIMEOUT);
3363                 }
3364         }
3365 }
3366
3367 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
3368                                  u16 *opcode, u8 *status,
3369                                  hci_req_complete_t *req_complete,
3370                                  hci_req_complete_skb_t *req_complete_skb)
3371 {
3372         struct hci_ev_cmd_complete *ev = (void *) skb->data;
3373
3374         *opcode = __le16_to_cpu(ev->opcode);
3375         *status = skb->data[sizeof(*ev)];
3376
3377         skb_pull(skb, sizeof(*ev));
3378
3379         switch (*opcode) {
3380         case HCI_OP_INQUIRY_CANCEL:
3381                 hci_cc_inquiry_cancel(hdev, skb, status);
3382                 break;
3383
3384         case HCI_OP_PERIODIC_INQ:
3385                 hci_cc_periodic_inq(hdev, skb);
3386                 break;
3387
3388         case HCI_OP_EXIT_PERIODIC_INQ:
3389                 hci_cc_exit_periodic_inq(hdev, skb);
3390                 break;
3391
3392         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
3393                 hci_cc_remote_name_req_cancel(hdev, skb);
3394                 break;
3395
3396         case HCI_OP_ROLE_DISCOVERY:
3397                 hci_cc_role_discovery(hdev, skb);
3398                 break;
3399
3400         case HCI_OP_READ_LINK_POLICY:
3401                 hci_cc_read_link_policy(hdev, skb);
3402                 break;
3403
3404         case HCI_OP_WRITE_LINK_POLICY:
3405                 hci_cc_write_link_policy(hdev, skb);
3406                 break;
3407
3408         case HCI_OP_READ_DEF_LINK_POLICY:
3409                 hci_cc_read_def_link_policy(hdev, skb);
3410                 break;
3411
3412         case HCI_OP_WRITE_DEF_LINK_POLICY:
3413                 hci_cc_write_def_link_policy(hdev, skb);
3414                 break;
3415
3416         case HCI_OP_RESET:
3417                 hci_cc_reset(hdev, skb);
3418                 break;
3419
3420         case HCI_OP_READ_STORED_LINK_KEY:
3421                 hci_cc_read_stored_link_key(hdev, skb);
3422                 break;
3423
3424         case HCI_OP_DELETE_STORED_LINK_KEY:
3425                 hci_cc_delete_stored_link_key(hdev, skb);
3426                 break;
3427
3428         case HCI_OP_WRITE_LOCAL_NAME:
3429                 hci_cc_write_local_name(hdev, skb);
3430                 break;
3431
3432         case HCI_OP_READ_LOCAL_NAME:
3433                 hci_cc_read_local_name(hdev, skb);
3434                 break;
3435
3436         case HCI_OP_WRITE_AUTH_ENABLE:
3437                 hci_cc_write_auth_enable(hdev, skb);
3438                 break;
3439
3440         case HCI_OP_WRITE_ENCRYPT_MODE:
3441                 hci_cc_write_encrypt_mode(hdev, skb);
3442                 break;
3443
3444         case HCI_OP_WRITE_SCAN_ENABLE:
3445                 hci_cc_write_scan_enable(hdev, skb);
3446                 break;
3447
3448         case HCI_OP_SET_EVENT_FLT:
3449                 hci_cc_set_event_filter(hdev, skb);
3450                 break;
3451
3452         case HCI_OP_READ_CLASS_OF_DEV:
3453                 hci_cc_read_class_of_dev(hdev, skb);
3454                 break;
3455
3456         case HCI_OP_WRITE_CLASS_OF_DEV:
3457                 hci_cc_write_class_of_dev(hdev, skb);
3458                 break;
3459
3460         case HCI_OP_READ_VOICE_SETTING:
3461                 hci_cc_read_voice_setting(hdev, skb);
3462                 break;
3463
3464         case HCI_OP_WRITE_VOICE_SETTING:
3465                 hci_cc_write_voice_setting(hdev, skb);
3466                 break;
3467
3468         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3469                 hci_cc_read_num_supported_iac(hdev, skb);
3470                 break;
3471
3472         case HCI_OP_WRITE_SSP_MODE:
3473                 hci_cc_write_ssp_mode(hdev, skb);
3474                 break;
3475
3476         case HCI_OP_WRITE_SC_SUPPORT:
3477                 hci_cc_write_sc_support(hdev, skb);
3478                 break;
3479
3480         case HCI_OP_READ_AUTH_PAYLOAD_TO:
3481                 hci_cc_read_auth_payload_timeout(hdev, skb);
3482                 break;
3483
3484         case HCI_OP_WRITE_AUTH_PAYLOAD_TO:
3485                 hci_cc_write_auth_payload_timeout(hdev, skb);
3486                 break;
3487
3488         case HCI_OP_READ_LOCAL_VERSION:
3489                 hci_cc_read_local_version(hdev, skb);
3490                 break;
3491
3492         case HCI_OP_READ_LOCAL_COMMANDS:
3493                 hci_cc_read_local_commands(hdev, skb);
3494                 break;
3495
3496         case HCI_OP_READ_LOCAL_FEATURES:
3497                 hci_cc_read_local_features(hdev, skb);
3498                 break;
3499
3500         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3501                 hci_cc_read_local_ext_features(hdev, skb);
3502                 break;
3503
3504         case HCI_OP_READ_BUFFER_SIZE:
3505                 hci_cc_read_buffer_size(hdev, skb);
3506                 break;
3507
3508         case HCI_OP_READ_BD_ADDR:
3509                 hci_cc_read_bd_addr(hdev, skb);
3510                 break;
3511
3512         case HCI_OP_READ_LOCAL_PAIRING_OPTS:
3513                 hci_cc_read_local_pairing_opts(hdev, skb);
3514                 break;
3515
3516         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3517                 hci_cc_read_page_scan_activity(hdev, skb);
3518                 break;
3519
3520         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3521                 hci_cc_write_page_scan_activity(hdev, skb);
3522                 break;
3523
3524         case HCI_OP_READ_PAGE_SCAN_TYPE:
3525                 hci_cc_read_page_scan_type(hdev, skb);
3526                 break;
3527
3528         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3529                 hci_cc_write_page_scan_type(hdev, skb);
3530                 break;
3531
3532         case HCI_OP_READ_DATA_BLOCK_SIZE:
3533                 hci_cc_read_data_block_size(hdev, skb);
3534                 break;
3535
3536         case HCI_OP_READ_FLOW_CONTROL_MODE:
3537                 hci_cc_read_flow_control_mode(hdev, skb);
3538                 break;
3539
3540         case HCI_OP_READ_LOCAL_AMP_INFO:
3541                 hci_cc_read_local_amp_info(hdev, skb);
3542                 break;
3543
3544         case HCI_OP_READ_CLOCK:
3545                 hci_cc_read_clock(hdev, skb);
3546                 break;
3547
3548         case HCI_OP_READ_INQ_RSP_TX_POWER:
3549                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3550                 break;
3551
3552         case HCI_OP_READ_DEF_ERR_DATA_REPORTING:
3553                 hci_cc_read_def_err_data_reporting(hdev, skb);
3554                 break;
3555
3556         case HCI_OP_WRITE_DEF_ERR_DATA_REPORTING:
3557                 hci_cc_write_def_err_data_reporting(hdev, skb);
3558                 break;
3559
3560         case HCI_OP_PIN_CODE_REPLY:
3561                 hci_cc_pin_code_reply(hdev, skb);
3562                 break;
3563
3564         case HCI_OP_PIN_CODE_NEG_REPLY:
3565                 hci_cc_pin_code_neg_reply(hdev, skb);
3566                 break;
3567
3568         case HCI_OP_READ_LOCAL_OOB_DATA:
3569                 hci_cc_read_local_oob_data(hdev, skb);
3570                 break;
3571
3572         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3573                 hci_cc_read_local_oob_ext_data(hdev, skb);
3574                 break;
3575
3576         case HCI_OP_LE_READ_BUFFER_SIZE:
3577                 hci_cc_le_read_buffer_size(hdev, skb);
3578                 break;
3579
3580         case HCI_OP_LE_READ_LOCAL_FEATURES:
3581                 hci_cc_le_read_local_features(hdev, skb);
3582                 break;
3583
3584         case HCI_OP_LE_READ_ADV_TX_POWER:
3585                 hci_cc_le_read_adv_tx_power(hdev, skb);
3586                 break;
3587
3588         case HCI_OP_USER_CONFIRM_REPLY:
3589                 hci_cc_user_confirm_reply(hdev, skb);
3590                 break;
3591
3592         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3593                 hci_cc_user_confirm_neg_reply(hdev, skb);
3594                 break;
3595
3596         case HCI_OP_USER_PASSKEY_REPLY:
3597                 hci_cc_user_passkey_reply(hdev, skb);
3598                 break;
3599
3600         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3601                 hci_cc_user_passkey_neg_reply(hdev, skb);
3602                 break;
3603
3604         case HCI_OP_LE_SET_RANDOM_ADDR:
3605                 hci_cc_le_set_random_addr(hdev, skb);
3606                 break;
3607
3608         case HCI_OP_LE_SET_ADV_ENABLE:
3609                 hci_cc_le_set_adv_enable(hdev, skb);
3610                 break;
3611
3612         case HCI_OP_LE_SET_SCAN_PARAM:
3613                 hci_cc_le_set_scan_param(hdev, skb);
3614                 break;
3615
3616         case HCI_OP_LE_SET_SCAN_ENABLE:
3617                 hci_cc_le_set_scan_enable(hdev, skb);
3618                 break;
3619
3620         case HCI_OP_LE_READ_ACCEPT_LIST_SIZE:
3621                 hci_cc_le_read_accept_list_size(hdev, skb);
3622                 break;
3623
3624         case HCI_OP_LE_CLEAR_ACCEPT_LIST:
3625                 hci_cc_le_clear_accept_list(hdev, skb);
3626                 break;
3627
3628         case HCI_OP_LE_ADD_TO_ACCEPT_LIST:
3629                 hci_cc_le_add_to_accept_list(hdev, skb);
3630                 break;
3631
3632         case HCI_OP_LE_DEL_FROM_ACCEPT_LIST:
3633                 hci_cc_le_del_from_accept_list(hdev, skb);
3634                 break;
3635
3636         case HCI_OP_LE_READ_SUPPORTED_STATES:
3637                 hci_cc_le_read_supported_states(hdev, skb);
3638                 break;
3639
3640         case HCI_OP_LE_READ_DEF_DATA_LEN:
3641                 hci_cc_le_read_def_data_len(hdev, skb);
3642                 break;
3643
3644         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3645                 hci_cc_le_write_def_data_len(hdev, skb);
3646                 break;
3647
3648         case HCI_OP_LE_ADD_TO_RESOLV_LIST:
3649                 hci_cc_le_add_to_resolv_list(hdev, skb);
3650                 break;
3651
3652         case HCI_OP_LE_DEL_FROM_RESOLV_LIST:
3653                 hci_cc_le_del_from_resolv_list(hdev, skb);
3654                 break;
3655
3656         case HCI_OP_LE_CLEAR_RESOLV_LIST:
3657                 hci_cc_le_clear_resolv_list(hdev, skb);
3658                 break;
3659
3660         case HCI_OP_LE_READ_RESOLV_LIST_SIZE:
3661                 hci_cc_le_read_resolv_list_size(hdev, skb);
3662                 break;
3663
3664         case HCI_OP_LE_SET_ADDR_RESOLV_ENABLE:
3665                 hci_cc_le_set_addr_resolution_enable(hdev, skb);
3666                 break;
3667
3668         case HCI_OP_LE_READ_MAX_DATA_LEN:
3669                 hci_cc_le_read_max_data_len(hdev, skb);
3670                 break;
3671
3672         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3673                 hci_cc_write_le_host_supported(hdev, skb);
3674                 break;
3675
3676         case HCI_OP_LE_SET_ADV_PARAM:
3677                 hci_cc_set_adv_param(hdev, skb);
3678                 break;
3679
3680         case HCI_OP_READ_RSSI:
3681                 hci_cc_read_rssi(hdev, skb);
3682                 break;
3683
3684         case HCI_OP_READ_TX_POWER:
3685                 hci_cc_read_tx_power(hdev, skb);
3686                 break;
3687
3688         case HCI_OP_WRITE_SSP_DEBUG_MODE:
3689                 hci_cc_write_ssp_debug_mode(hdev, skb);
3690                 break;
3691
3692         case HCI_OP_LE_SET_EXT_SCAN_PARAMS:
3693                 hci_cc_le_set_ext_scan_param(hdev, skb);
3694                 break;
3695
3696         case HCI_OP_LE_SET_EXT_SCAN_ENABLE:
3697                 hci_cc_le_set_ext_scan_enable(hdev, skb);
3698                 break;
3699
3700         case HCI_OP_LE_SET_DEFAULT_PHY:
3701                 hci_cc_le_set_default_phy(hdev, skb);
3702                 break;
3703
3704         case HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS:
3705                 hci_cc_le_read_num_adv_sets(hdev, skb);
3706                 break;
3707
3708         case HCI_OP_LE_SET_EXT_ADV_PARAMS:
3709                 hci_cc_set_ext_adv_param(hdev, skb);
3710                 break;
3711
3712         case HCI_OP_LE_SET_EXT_ADV_ENABLE:
3713                 hci_cc_le_set_ext_adv_enable(hdev, skb);
3714                 break;
3715
3716         case HCI_OP_LE_SET_ADV_SET_RAND_ADDR:
3717                 hci_cc_le_set_adv_set_random_addr(hdev, skb);
3718                 break;
3719
3720         case HCI_OP_LE_READ_TRANSMIT_POWER:
3721                 hci_cc_le_read_transmit_power(hdev, skb);
3722                 break;
3723 #ifdef TIZEN_BT
3724         case HCI_OP_ENABLE_RSSI:
3725                 hci_cc_enable_rssi(hdev, skb);
3726                 break;
3727
3728         case HCI_OP_GET_RAW_RSSI:
3729                 hci_cc_get_raw_rssi(hdev, skb);
3730                 break;
3731 #endif
3732         default:
3733                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3734                 break;
3735         }
3736
3737         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3738
3739         hci_req_cmd_complete(hdev, *opcode, *status, req_complete,
3740                              req_complete_skb);
3741
3742         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3743                 bt_dev_err(hdev,
3744                            "unexpected event for opcode 0x%4.4x", *opcode);
3745                 return;
3746         }
3747
3748         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3749                 queue_work(hdev->workqueue, &hdev->cmd_work);
3750 }
3751
3752 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb,
3753                                u16 *opcode, u8 *status,
3754                                hci_req_complete_t *req_complete,
3755                                hci_req_complete_skb_t *req_complete_skb)
3756 {
3757         struct hci_ev_cmd_status *ev = (void *) skb->data;
3758
3759         skb_pull(skb, sizeof(*ev));
3760
3761         *opcode = __le16_to_cpu(ev->opcode);
3762         *status = ev->status;
3763
3764         switch (*opcode) {
3765         case HCI_OP_INQUIRY:
3766                 hci_cs_inquiry(hdev, ev->status);
3767                 break;
3768
3769         case HCI_OP_CREATE_CONN:
3770                 hci_cs_create_conn(hdev, ev->status);
3771                 break;
3772
3773         case HCI_OP_DISCONNECT:
3774                 hci_cs_disconnect(hdev, ev->status);
3775                 break;
3776
3777         case HCI_OP_ADD_SCO:
3778                 hci_cs_add_sco(hdev, ev->status);
3779                 break;
3780
3781         case HCI_OP_AUTH_REQUESTED:
3782                 hci_cs_auth_requested(hdev, ev->status);
3783                 break;
3784
3785         case HCI_OP_SET_CONN_ENCRYPT:
3786                 hci_cs_set_conn_encrypt(hdev, ev->status);
3787                 break;
3788
3789         case HCI_OP_REMOTE_NAME_REQ:
3790                 hci_cs_remote_name_req(hdev, ev->status);
3791                 break;
3792
3793         case HCI_OP_READ_REMOTE_FEATURES:
3794                 hci_cs_read_remote_features(hdev, ev->status);
3795                 break;
3796
3797         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3798                 hci_cs_read_remote_ext_features(hdev, ev->status);
3799                 break;
3800
3801         case HCI_OP_SETUP_SYNC_CONN:
3802                 hci_cs_setup_sync_conn(hdev, ev->status);
3803                 break;
3804
3805         case HCI_OP_SNIFF_MODE:
3806                 hci_cs_sniff_mode(hdev, ev->status);
3807                 break;
3808
3809         case HCI_OP_EXIT_SNIFF_MODE:
3810                 hci_cs_exit_sniff_mode(hdev, ev->status);
3811                 break;
3812
3813         case HCI_OP_SWITCH_ROLE:
3814                 hci_cs_switch_role(hdev, ev->status);
3815                 break;
3816
3817         case HCI_OP_LE_CREATE_CONN:
3818                 hci_cs_le_create_conn(hdev, ev->status);
3819                 break;
3820
3821         case HCI_OP_LE_READ_REMOTE_FEATURES:
3822                 hci_cs_le_read_remote_features(hdev, ev->status);
3823                 break;
3824
3825         case HCI_OP_LE_START_ENC:
3826                 hci_cs_le_start_enc(hdev, ev->status);
3827                 break;
3828
3829         case HCI_OP_LE_EXT_CREATE_CONN:
3830                 hci_cs_le_ext_create_conn(hdev, ev->status);
3831                 break;
3832
3833         default:
3834                 BT_DBG("%s opcode 0x%4.4x", hdev->name, *opcode);
3835                 break;
3836         }
3837
3838         handle_cmd_cnt_and_timer(hdev, ev->ncmd);
3839
3840         /* Indicate request completion if the command failed. Also, if
3841          * we're not waiting for a special event and we get a success
3842          * command status we should try to flag the request as completed
3843          * (since for this kind of commands there will not be a command
3844          * complete event).
3845          */
3846         if (ev->status ||
3847             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->hci.req_event))
3848                 hci_req_cmd_complete(hdev, *opcode, ev->status, req_complete,
3849                                      req_complete_skb);
3850
3851         if (hci_dev_test_flag(hdev, HCI_CMD_PENDING)) {
3852                 bt_dev_err(hdev,
3853                            "unexpected event for opcode 0x%4.4x", *opcode);
3854                 return;
3855         }
3856
3857         if (atomic_read(&hdev->cmd_cnt) && !skb_queue_empty(&hdev->cmd_q))
3858                 queue_work(hdev->workqueue, &hdev->cmd_work);
3859 }
3860
3861 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3862 {
3863         struct hci_ev_hardware_error *ev = (void *) skb->data;
3864
3865         hdev->hw_error_code = ev->code;
3866
3867         queue_work(hdev->req_workqueue, &hdev->error_reset);
3868 }
3869
3870 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3871 {
3872         struct hci_ev_role_change *ev = (void *) skb->data;
3873         struct hci_conn *conn;
3874
3875         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3876
3877         hci_dev_lock(hdev);
3878
3879         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3880         if (conn) {
3881                 if (!ev->status)
3882                         conn->role = ev->role;
3883
3884                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3885
3886                 hci_role_switch_cfm(conn, ev->status, ev->role);
3887         }
3888
3889         hci_dev_unlock(hdev);
3890 }
3891
3892 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3893 {
3894         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3895         int i;
3896
3897         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3898                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3899                 return;
3900         }
3901
3902         if (skb->len < sizeof(*ev) ||
3903             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3904                 BT_DBG("%s bad parameters", hdev->name);
3905                 return;
3906         }
3907
3908         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3909
3910         for (i = 0; i < ev->num_hndl; i++) {
3911                 struct hci_comp_pkts_info *info = &ev->handles[i];
3912                 struct hci_conn *conn;
3913                 __u16  handle, count;
3914
3915                 handle = __le16_to_cpu(info->handle);
3916                 count  = __le16_to_cpu(info->count);
3917
3918                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3919                 if (!conn)
3920                         continue;
3921
3922                 conn->sent -= count;
3923
3924                 switch (conn->type) {
3925                 case ACL_LINK:
3926                         hdev->acl_cnt += count;
3927                         if (hdev->acl_cnt > hdev->acl_pkts)
3928                                 hdev->acl_cnt = hdev->acl_pkts;
3929                         break;
3930
3931                 case LE_LINK:
3932                         if (hdev->le_pkts) {
3933                                 hdev->le_cnt += count;
3934                                 if (hdev->le_cnt > hdev->le_pkts)
3935                                         hdev->le_cnt = hdev->le_pkts;
3936                         } else {
3937                                 hdev->acl_cnt += count;
3938                                 if (hdev->acl_cnt > hdev->acl_pkts)
3939                                         hdev->acl_cnt = hdev->acl_pkts;
3940                         }
3941                         break;
3942
3943                 case SCO_LINK:
3944                         hdev->sco_cnt += count;
3945                         if (hdev->sco_cnt > hdev->sco_pkts)
3946                                 hdev->sco_cnt = hdev->sco_pkts;
3947                         break;
3948
3949                 default:
3950                         bt_dev_err(hdev, "unknown type %d conn %p",
3951                                    conn->type, conn);
3952                         break;
3953                 }
3954         }
3955
3956         queue_work(hdev->workqueue, &hdev->tx_work);
3957 }
3958
3959 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3960                                                  __u16 handle)
3961 {
3962         struct hci_chan *chan;
3963
3964         switch (hdev->dev_type) {
3965         case HCI_PRIMARY:
3966                 return hci_conn_hash_lookup_handle(hdev, handle);
3967         case HCI_AMP:
3968                 chan = hci_chan_lookup_handle(hdev, handle);
3969                 if (chan)
3970                         return chan->conn;
3971                 break;
3972         default:
3973                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3974                 break;
3975         }
3976
3977         return NULL;
3978 }
3979
3980 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3981 {
3982         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3983         int i;
3984
3985         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3986                 bt_dev_err(hdev, "wrong event for mode %d", hdev->flow_ctl_mode);
3987                 return;
3988         }
3989
3990         if (skb->len < sizeof(*ev) ||
3991             skb->len < struct_size(ev, handles, ev->num_hndl)) {
3992                 BT_DBG("%s bad parameters", hdev->name);
3993                 return;
3994         }
3995
3996         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3997                ev->num_hndl);
3998
3999         for (i = 0; i < ev->num_hndl; i++) {
4000                 struct hci_comp_blocks_info *info = &ev->handles[i];
4001                 struct hci_conn *conn = NULL;
4002                 __u16  handle, block_count;
4003
4004                 handle = __le16_to_cpu(info->handle);
4005                 block_count = __le16_to_cpu(info->blocks);
4006
4007                 conn = __hci_conn_lookup_handle(hdev, handle);
4008                 if (!conn)
4009                         continue;
4010
4011                 conn->sent -= block_count;
4012
4013                 switch (conn->type) {
4014                 case ACL_LINK:
4015                 case AMP_LINK:
4016                         hdev->block_cnt += block_count;
4017                         if (hdev->block_cnt > hdev->num_blocks)
4018                                 hdev->block_cnt = hdev->num_blocks;
4019                         break;
4020
4021                 default:
4022                         bt_dev_err(hdev, "unknown type %d conn %p",
4023                                    conn->type, conn);
4024                         break;
4025                 }
4026         }
4027
4028         queue_work(hdev->workqueue, &hdev->tx_work);
4029 }
4030
4031 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4032 {
4033         struct hci_ev_mode_change *ev = (void *) skb->data;
4034         struct hci_conn *conn;
4035
4036         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4037
4038         hci_dev_lock(hdev);
4039
4040         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4041         if (conn) {
4042                 conn->mode = ev->mode;
4043
4044                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
4045                                         &conn->flags)) {
4046                         if (conn->mode == HCI_CM_ACTIVE)
4047                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4048                         else
4049                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
4050                 }
4051
4052                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
4053                         hci_sco_setup(conn, ev->status);
4054         }
4055
4056         hci_dev_unlock(hdev);
4057 }
4058
4059 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4060 {
4061         struct hci_ev_pin_code_req *ev = (void *) skb->data;
4062         struct hci_conn *conn;
4063
4064         BT_DBG("%s", hdev->name);
4065
4066         hci_dev_lock(hdev);
4067
4068         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4069         if (!conn)
4070                 goto unlock;
4071
4072         if (conn->state == BT_CONNECTED) {
4073                 hci_conn_hold(conn);
4074                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
4075                 hci_conn_drop(conn);
4076         }
4077
4078         if (!hci_dev_test_flag(hdev, HCI_BONDABLE) &&
4079             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
4080                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
4081                              sizeof(ev->bdaddr), &ev->bdaddr);
4082         } else if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4083                 u8 secure;
4084
4085                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
4086                         secure = 1;
4087                 else
4088                         secure = 0;
4089
4090                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
4091         }
4092
4093 unlock:
4094         hci_dev_unlock(hdev);
4095 }
4096
4097 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
4098 {
4099         if (key_type == HCI_LK_CHANGED_COMBINATION)
4100                 return;
4101
4102         conn->pin_length = pin_len;
4103         conn->key_type = key_type;
4104
4105         switch (key_type) {
4106         case HCI_LK_LOCAL_UNIT:
4107         case HCI_LK_REMOTE_UNIT:
4108         case HCI_LK_DEBUG_COMBINATION:
4109                 return;
4110         case HCI_LK_COMBINATION:
4111                 if (pin_len == 16)
4112                         conn->pending_sec_level = BT_SECURITY_HIGH;
4113                 else
4114                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
4115                 break;
4116         case HCI_LK_UNAUTH_COMBINATION_P192:
4117         case HCI_LK_UNAUTH_COMBINATION_P256:
4118                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
4119                 break;
4120         case HCI_LK_AUTH_COMBINATION_P192:
4121                 conn->pending_sec_level = BT_SECURITY_HIGH;
4122                 break;
4123         case HCI_LK_AUTH_COMBINATION_P256:
4124                 conn->pending_sec_level = BT_SECURITY_FIPS;
4125                 break;
4126         }
4127 }
4128
4129 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4130 {
4131         struct hci_ev_link_key_req *ev = (void *) skb->data;
4132         struct hci_cp_link_key_reply cp;
4133         struct hci_conn *conn;
4134         struct link_key *key;
4135
4136         BT_DBG("%s", hdev->name);
4137
4138         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4139                 return;
4140
4141         hci_dev_lock(hdev);
4142
4143         key = hci_find_link_key(hdev, &ev->bdaddr);
4144         if (!key) {
4145                 BT_DBG("%s link key not found for %pMR", hdev->name,
4146                        &ev->bdaddr);
4147                 goto not_found;
4148         }
4149
4150         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
4151                &ev->bdaddr);
4152
4153         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4154         if (conn) {
4155                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4156
4157                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
4158                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
4159                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
4160                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
4161                         goto not_found;
4162                 }
4163
4164                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
4165                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
4166                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
4167                         BT_DBG("%s ignoring key unauthenticated for high security",
4168                                hdev->name);
4169                         goto not_found;
4170                 }
4171
4172                 conn_set_key(conn, key->type, key->pin_len);
4173         }
4174
4175         bacpy(&cp.bdaddr, &ev->bdaddr);
4176         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
4177
4178         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
4179
4180         hci_dev_unlock(hdev);
4181
4182         return;
4183
4184 not_found:
4185         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
4186         hci_dev_unlock(hdev);
4187 }
4188
4189 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4190 {
4191         struct hci_ev_link_key_notify *ev = (void *) skb->data;
4192         struct hci_conn *conn;
4193         struct link_key *key;
4194         bool persistent;
4195         u8 pin_len = 0;
4196
4197         BT_DBG("%s", hdev->name);
4198
4199         hci_dev_lock(hdev);
4200
4201         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4202         if (!conn)
4203                 goto unlock;
4204
4205         hci_conn_hold(conn);
4206         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4207         hci_conn_drop(conn);
4208
4209         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
4210         conn_set_key(conn, ev->key_type, conn->pin_length);
4211
4212         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4213                 goto unlock;
4214
4215         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
4216                                 ev->key_type, pin_len, &persistent);
4217         if (!key)
4218                 goto unlock;
4219
4220         /* Update connection information since adding the key will have
4221          * fixed up the type in the case of changed combination keys.
4222          */
4223         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
4224                 conn_set_key(conn, key->type, key->pin_len);
4225
4226         mgmt_new_link_key(hdev, key, persistent);
4227
4228         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
4229          * is set. If it's not set simply remove the key from the kernel
4230          * list (we've still notified user space about it but with
4231          * store_hint being 0).
4232          */
4233         if (key->type == HCI_LK_DEBUG_COMBINATION &&
4234             !hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) {
4235                 list_del_rcu(&key->list);
4236                 kfree_rcu(key, rcu);
4237                 goto unlock;
4238         }
4239
4240         if (persistent)
4241                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4242         else
4243                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
4244
4245 unlock:
4246         hci_dev_unlock(hdev);
4247 }
4248
4249 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
4250 {
4251         struct hci_ev_clock_offset *ev = (void *) skb->data;
4252         struct hci_conn *conn;
4253
4254         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4255
4256         hci_dev_lock(hdev);
4257
4258         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4259         if (conn && !ev->status) {
4260                 struct inquiry_entry *ie;
4261
4262                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4263                 if (ie) {
4264                         ie->data.clock_offset = ev->clock_offset;
4265                         ie->timestamp = jiffies;
4266                 }
4267         }
4268
4269         hci_dev_unlock(hdev);
4270 }
4271
4272 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
4273 {
4274         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
4275         struct hci_conn *conn;
4276
4277         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4278
4279         hci_dev_lock(hdev);
4280
4281         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4282         if (conn && !ev->status)
4283                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
4284
4285         hci_dev_unlock(hdev);
4286 }
4287
4288 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
4289 {
4290         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
4291         struct inquiry_entry *ie;
4292
4293         BT_DBG("%s", hdev->name);
4294
4295         hci_dev_lock(hdev);
4296
4297         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4298         if (ie) {
4299                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
4300                 ie->timestamp = jiffies;
4301         }
4302
4303         hci_dev_unlock(hdev);
4304 }
4305
4306 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
4307                                              struct sk_buff *skb)
4308 {
4309         struct inquiry_data data;
4310         int num_rsp = *((__u8 *) skb->data);
4311
4312         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4313
4314         if (!num_rsp)
4315                 return;
4316
4317         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4318                 return;
4319
4320         hci_dev_lock(hdev);
4321
4322         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
4323                 struct inquiry_info_with_rssi_and_pscan_mode *info;
4324                 info = (void *) (skb->data + 1);
4325
4326                 if (skb->len < num_rsp * sizeof(*info) + 1)
4327                         goto unlock;
4328
4329                 for (; num_rsp; num_rsp--, info++) {
4330                         u32 flags;
4331
4332                         bacpy(&data.bdaddr, &info->bdaddr);
4333                         data.pscan_rep_mode     = info->pscan_rep_mode;
4334                         data.pscan_period_mode  = info->pscan_period_mode;
4335                         data.pscan_mode         = info->pscan_mode;
4336                         memcpy(data.dev_class, info->dev_class, 3);
4337                         data.clock_offset       = info->clock_offset;
4338                         data.rssi               = info->rssi;
4339                         data.ssp_mode           = 0x00;
4340
4341                         flags = hci_inquiry_cache_update(hdev, &data, false);
4342
4343                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4344                                           info->dev_class, info->rssi,
4345                                           flags, NULL, 0, NULL, 0);
4346                 }
4347         } else {
4348                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
4349
4350                 if (skb->len < num_rsp * sizeof(*info) + 1)
4351                         goto unlock;
4352
4353                 for (; num_rsp; num_rsp--, info++) {
4354                         u32 flags;
4355
4356                         bacpy(&data.bdaddr, &info->bdaddr);
4357                         data.pscan_rep_mode     = info->pscan_rep_mode;
4358                         data.pscan_period_mode  = info->pscan_period_mode;
4359                         data.pscan_mode         = 0x00;
4360                         memcpy(data.dev_class, info->dev_class, 3);
4361                         data.clock_offset       = info->clock_offset;
4362                         data.rssi               = info->rssi;
4363                         data.ssp_mode           = 0x00;
4364
4365                         flags = hci_inquiry_cache_update(hdev, &data, false);
4366
4367                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4368                                           info->dev_class, info->rssi,
4369                                           flags, NULL, 0, NULL, 0);
4370                 }
4371         }
4372
4373 unlock:
4374         hci_dev_unlock(hdev);
4375 }
4376
4377 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
4378                                         struct sk_buff *skb)
4379 {
4380         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
4381         struct hci_conn *conn;
4382
4383         BT_DBG("%s", hdev->name);
4384
4385         hci_dev_lock(hdev);
4386
4387         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4388         if (!conn)
4389                 goto unlock;
4390
4391         if (ev->page < HCI_MAX_PAGES)
4392                 memcpy(conn->features[ev->page], ev->features, 8);
4393
4394         if (!ev->status && ev->page == 0x01) {
4395                 struct inquiry_entry *ie;
4396
4397                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
4398                 if (ie)
4399                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4400
4401                 if (ev->features[0] & LMP_HOST_SSP) {
4402                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4403                 } else {
4404                         /* It is mandatory by the Bluetooth specification that
4405                          * Extended Inquiry Results are only used when Secure
4406                          * Simple Pairing is enabled, but some devices violate
4407                          * this.
4408                          *
4409                          * To make these devices work, the internal SSP
4410                          * enabled flag needs to be cleared if the remote host
4411                          * features do not indicate SSP support */
4412                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
4413                 }
4414
4415                 if (ev->features[0] & LMP_HOST_SC)
4416                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
4417         }
4418
4419         if (conn->state != BT_CONFIG)
4420                 goto unlock;
4421
4422         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
4423                 struct hci_cp_remote_name_req cp;
4424                 memset(&cp, 0, sizeof(cp));
4425                 bacpy(&cp.bdaddr, &conn->dst);
4426                 cp.pscan_rep_mode = 0x02;
4427                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
4428         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4429                 mgmt_device_connected(hdev, conn, NULL, 0);
4430
4431         if (!hci_outgoing_auth_needed(hdev, conn)) {
4432                 conn->state = BT_CONNECTED;
4433                 hci_connect_cfm(conn, ev->status);
4434                 hci_conn_drop(conn);
4435         }
4436
4437 unlock:
4438         hci_dev_unlock(hdev);
4439 }
4440
4441 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
4442                                        struct sk_buff *skb)
4443 {
4444         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
4445         struct hci_conn *conn;
4446
4447         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4448
4449         hci_dev_lock(hdev);
4450
4451         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
4452         if (!conn) {
4453                 if (ev->link_type == ESCO_LINK)
4454                         goto unlock;
4455
4456                 /* When the link type in the event indicates SCO connection
4457                  * and lookup of the connection object fails, then check
4458                  * if an eSCO connection object exists.
4459                  *
4460                  * The core limits the synchronous connections to either
4461                  * SCO or eSCO. The eSCO connection is preferred and tried
4462                  * to be setup first and until successfully established,
4463                  * the link type will be hinted as eSCO.
4464                  */
4465                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
4466                 if (!conn)
4467                         goto unlock;
4468         }
4469
4470         switch (ev->status) {
4471         case 0x00:
4472                 /* The synchronous connection complete event should only be
4473                  * sent once per new connection. Receiving a successful
4474                  * complete event when the connection status is already
4475                  * BT_CONNECTED means that the device is misbehaving and sent
4476                  * multiple complete event packets for the same new connection.
4477                  *
4478                  * Registering the device more than once can corrupt kernel
4479                  * memory, hence upon detecting this invalid event, we report
4480                  * an error and ignore the packet.
4481                  */
4482                 if (conn->state == BT_CONNECTED) {
4483                         bt_dev_err(hdev, "Ignoring connect complete event for existing connection");
4484                         goto unlock;
4485                 }
4486
4487                 conn->handle = __le16_to_cpu(ev->handle);
4488                 conn->state  = BT_CONNECTED;
4489                 conn->type   = ev->link_type;
4490
4491                 hci_debugfs_create_conn(conn);
4492                 hci_conn_add_sysfs(conn);
4493                 break;
4494
4495         case 0x10:      /* Connection Accept Timeout */
4496         case 0x0d:      /* Connection Rejected due to Limited Resources */
4497         case 0x11:      /* Unsupported Feature or Parameter Value */
4498         case 0x1c:      /* SCO interval rejected */
4499         case 0x1a:      /* Unsupported Remote Feature */
4500         case 0x1e:      /* Invalid LMP Parameters */
4501         case 0x1f:      /* Unspecified error */
4502         case 0x20:      /* Unsupported LMP Parameter value */
4503                 if (conn->out) {
4504                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4505                                         (hdev->esco_type & EDR_ESCO_MASK);
4506                         if (hci_setup_sync(conn, conn->link->handle))
4507                                 goto unlock;
4508                 }
4509                 fallthrough;
4510
4511         default:
4512                 conn->state = BT_CLOSED;
4513                 break;
4514         }
4515
4516         bt_dev_dbg(hdev, "SCO connected with air mode: %02x", ev->air_mode);
4517
4518         switch (ev->air_mode) {
4519         case 0x02:
4520                 if (hdev->notify)
4521                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_CVSD);
4522                 break;
4523         case 0x03:
4524                 if (hdev->notify)
4525                         hdev->notify(hdev, HCI_NOTIFY_ENABLE_SCO_TRANSP);
4526                 break;
4527         }
4528
4529         hci_connect_cfm(conn, ev->status);
4530         if (ev->status)
4531                 hci_conn_del(conn);
4532
4533 unlock:
4534         hci_dev_unlock(hdev);
4535 }
4536
4537 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4538 {
4539         size_t parsed = 0;
4540
4541         while (parsed < eir_len) {
4542                 u8 field_len = eir[0];
4543
4544                 if (field_len == 0)
4545                         return parsed;
4546
4547                 parsed += field_len + 1;
4548                 eir += field_len + 1;
4549         }
4550
4551         return eir_len;
4552 }
4553
4554 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4555                                             struct sk_buff *skb)
4556 {
4557         struct inquiry_data data;
4558         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4559         int num_rsp = *((__u8 *) skb->data);
4560         size_t eir_len;
4561
4562         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4563
4564         if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
4565                 return;
4566
4567         if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
4568                 return;
4569
4570         hci_dev_lock(hdev);
4571
4572         for (; num_rsp; num_rsp--, info++) {
4573                 u32 flags;
4574                 bool name_known;
4575
4576                 bacpy(&data.bdaddr, &info->bdaddr);
4577                 data.pscan_rep_mode     = info->pscan_rep_mode;
4578                 data.pscan_period_mode  = info->pscan_period_mode;
4579                 data.pscan_mode         = 0x00;
4580                 memcpy(data.dev_class, info->dev_class, 3);
4581                 data.clock_offset       = info->clock_offset;
4582                 data.rssi               = info->rssi;
4583                 data.ssp_mode           = 0x01;
4584
4585                 if (hci_dev_test_flag(hdev, HCI_MGMT))
4586                         name_known = eir_get_data(info->data,
4587                                                   sizeof(info->data),
4588                                                   EIR_NAME_COMPLETE, NULL);
4589                 else
4590                         name_known = true;
4591
4592                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4593
4594                 eir_len = eir_get_length(info->data, sizeof(info->data));
4595
4596                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4597                                   info->dev_class, info->rssi,
4598                                   flags, info->data, eir_len, NULL, 0);
4599         }
4600
4601         hci_dev_unlock(hdev);
4602 }
4603
4604 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4605                                          struct sk_buff *skb)
4606 {
4607         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4608         struct hci_conn *conn;
4609
4610         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4611                __le16_to_cpu(ev->handle));
4612
4613         hci_dev_lock(hdev);
4614
4615         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4616         if (!conn)
4617                 goto unlock;
4618
4619         /* For BR/EDR the necessary steps are taken through the
4620          * auth_complete event.
4621          */
4622         if (conn->type != LE_LINK)
4623                 goto unlock;
4624
4625         if (!ev->status)
4626                 conn->sec_level = conn->pending_sec_level;
4627
4628         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4629
4630         if (ev->status && conn->state == BT_CONNECTED) {
4631                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4632                 hci_conn_drop(conn);
4633                 goto unlock;
4634         }
4635
4636         if (conn->state == BT_CONFIG) {
4637                 if (!ev->status)
4638                         conn->state = BT_CONNECTED;
4639
4640                 hci_connect_cfm(conn, ev->status);
4641                 hci_conn_drop(conn);
4642         } else {
4643                 hci_auth_cfm(conn, ev->status);
4644
4645                 hci_conn_hold(conn);
4646                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4647                 hci_conn_drop(conn);
4648         }
4649
4650 unlock:
4651         hci_dev_unlock(hdev);
4652 }
4653
4654 static u8 hci_get_auth_req(struct hci_conn *conn)
4655 {
4656         /* If remote requests no-bonding follow that lead */
4657         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4658             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4659                 return conn->remote_auth | (conn->auth_type & 0x01);
4660
4661         /* If both remote and local have enough IO capabilities, require
4662          * MITM protection
4663          */
4664         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4665             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4666                 return conn->remote_auth | 0x01;
4667
4668         /* No MITM protection possible so ignore remote requirement */
4669         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4670 }
4671
4672 static u8 bredr_oob_data_present(struct hci_conn *conn)
4673 {
4674         struct hci_dev *hdev = conn->hdev;
4675         struct oob_data *data;
4676
4677         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4678         if (!data)
4679                 return 0x00;
4680
4681         if (bredr_sc_enabled(hdev)) {
4682                 /* When Secure Connections is enabled, then just
4683                  * return the present value stored with the OOB
4684                  * data. The stored value contains the right present
4685                  * information. However it can only be trusted when
4686                  * not in Secure Connection Only mode.
4687                  */
4688                 if (!hci_dev_test_flag(hdev, HCI_SC_ONLY))
4689                         return data->present;
4690
4691                 /* When Secure Connections Only mode is enabled, then
4692                  * the P-256 values are required. If they are not
4693                  * available, then do not declare that OOB data is
4694                  * present.
4695                  */
4696                 if (!memcmp(data->rand256, ZERO_KEY, 16) ||
4697                     !memcmp(data->hash256, ZERO_KEY, 16))
4698                         return 0x00;
4699
4700                 return 0x02;
4701         }
4702
4703         /* When Secure Connections is not enabled or actually
4704          * not supported by the hardware, then check that if
4705          * P-192 data values are present.
4706          */
4707         if (!memcmp(data->rand192, ZERO_KEY, 16) ||
4708             !memcmp(data->hash192, ZERO_KEY, 16))
4709                 return 0x00;
4710
4711         return 0x01;
4712 }
4713
4714 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4715 {
4716         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4717         struct hci_conn *conn;
4718
4719         BT_DBG("%s", hdev->name);
4720
4721         hci_dev_lock(hdev);
4722
4723         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4724         if (!conn)
4725                 goto unlock;
4726
4727         hci_conn_hold(conn);
4728
4729         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4730                 goto unlock;
4731
4732         /* Allow pairing if we're pairable, the initiators of the
4733          * pairing or if the remote is not requesting bonding.
4734          */
4735         if (hci_dev_test_flag(hdev, HCI_BONDABLE) ||
4736             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4737             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4738                 struct hci_cp_io_capability_reply cp;
4739
4740                 bacpy(&cp.bdaddr, &ev->bdaddr);
4741                 /* Change the IO capability from KeyboardDisplay
4742                  * to DisplayYesNo as it is not supported by BT spec. */
4743                 cp.capability = (conn->io_capability == 0x04) ?
4744                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4745
4746                 /* If we are initiators, there is no remote information yet */
4747                 if (conn->remote_auth == 0xff) {
4748                         /* Request MITM protection if our IO caps allow it
4749                          * except for the no-bonding case.
4750                          */
4751                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4752                             conn->auth_type != HCI_AT_NO_BONDING)
4753                                 conn->auth_type |= 0x01;
4754                 } else {
4755                         conn->auth_type = hci_get_auth_req(conn);
4756                 }
4757
4758                 /* If we're not bondable, force one of the non-bondable
4759                  * authentication requirement values.
4760                  */
4761                 if (!hci_dev_test_flag(hdev, HCI_BONDABLE))
4762                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4763
4764                 cp.authentication = conn->auth_type;
4765                 cp.oob_data = bredr_oob_data_present(conn);
4766
4767                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4768                              sizeof(cp), &cp);
4769         } else {
4770                 struct hci_cp_io_capability_neg_reply cp;
4771
4772                 bacpy(&cp.bdaddr, &ev->bdaddr);
4773                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4774
4775                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4776                              sizeof(cp), &cp);
4777         }
4778
4779 unlock:
4780         hci_dev_unlock(hdev);
4781 }
4782
4783 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4784 {
4785         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4786         struct hci_conn *conn;
4787
4788         BT_DBG("%s", hdev->name);
4789
4790         hci_dev_lock(hdev);
4791
4792         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4793         if (!conn)
4794                 goto unlock;
4795
4796         conn->remote_cap = ev->capability;
4797         conn->remote_auth = ev->authentication;
4798
4799 unlock:
4800         hci_dev_unlock(hdev);
4801 }
4802
4803 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4804                                          struct sk_buff *skb)
4805 {
4806         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4807         int loc_mitm, rem_mitm, confirm_hint = 0;
4808         struct hci_conn *conn;
4809
4810         BT_DBG("%s", hdev->name);
4811
4812         hci_dev_lock(hdev);
4813
4814         if (!hci_dev_test_flag(hdev, HCI_MGMT))
4815                 goto unlock;
4816
4817         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4818         if (!conn)
4819                 goto unlock;
4820
4821         loc_mitm = (conn->auth_type & 0x01);
4822         rem_mitm = (conn->remote_auth & 0x01);
4823
4824         /* If we require MITM but the remote device can't provide that
4825          * (it has NoInputNoOutput) then reject the confirmation
4826          * request. We check the security level here since it doesn't
4827          * necessarily match conn->auth_type.
4828          */
4829         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4830             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4831                 BT_DBG("Rejecting request: remote device can't provide MITM");
4832                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4833                              sizeof(ev->bdaddr), &ev->bdaddr);
4834                 goto unlock;
4835         }
4836
4837         /* If no side requires MITM protection; auto-accept */
4838         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4839             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4840
4841                 /* If we're not the initiators request authorization to
4842                  * proceed from user space (mgmt_user_confirm with
4843                  * confirm_hint set to 1). The exception is if neither
4844                  * side had MITM or if the local IO capability is
4845                  * NoInputNoOutput, in which case we do auto-accept
4846                  */
4847                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4848                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4849                     (loc_mitm || rem_mitm)) {
4850                         BT_DBG("Confirming auto-accept as acceptor");
4851                         confirm_hint = 1;
4852                         goto confirm;
4853                 }
4854
4855                 /* If there already exists link key in local host, leave the
4856                  * decision to user space since the remote device could be
4857                  * legitimate or malicious.
4858                  */
4859                 if (hci_find_link_key(hdev, &ev->bdaddr)) {
4860                         bt_dev_dbg(hdev, "Local host already has link key");
4861                         confirm_hint = 1;
4862                         goto confirm;
4863                 }
4864
4865                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4866                        hdev->auto_accept_delay);
4867
4868                 if (hdev->auto_accept_delay > 0) {
4869                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4870                         queue_delayed_work(conn->hdev->workqueue,
4871                                            &conn->auto_accept_work, delay);
4872                         goto unlock;
4873                 }
4874
4875                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4876                              sizeof(ev->bdaddr), &ev->bdaddr);
4877                 goto unlock;
4878         }
4879
4880 confirm:
4881         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4882                                   le32_to_cpu(ev->passkey), confirm_hint);
4883
4884 unlock:
4885         hci_dev_unlock(hdev);
4886 }
4887
4888 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4889                                          struct sk_buff *skb)
4890 {
4891         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4892
4893         BT_DBG("%s", hdev->name);
4894
4895         if (hci_dev_test_flag(hdev, HCI_MGMT))
4896                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4897 }
4898
4899 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4900                                         struct sk_buff *skb)
4901 {
4902         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4903         struct hci_conn *conn;
4904
4905         BT_DBG("%s", hdev->name);
4906
4907         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4908         if (!conn)
4909                 return;
4910
4911         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4912         conn->passkey_entered = 0;
4913
4914         if (hci_dev_test_flag(hdev, HCI_MGMT))
4915                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4916                                          conn->dst_type, conn->passkey_notify,
4917                                          conn->passkey_entered);
4918 }
4919
4920 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4921 {
4922         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4923         struct hci_conn *conn;
4924
4925         BT_DBG("%s", hdev->name);
4926
4927         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4928         if (!conn)
4929                 return;
4930
4931         switch (ev->type) {
4932         case HCI_KEYPRESS_STARTED:
4933                 conn->passkey_entered = 0;
4934                 return;
4935
4936         case HCI_KEYPRESS_ENTERED:
4937                 conn->passkey_entered++;
4938                 break;
4939
4940         case HCI_KEYPRESS_ERASED:
4941                 conn->passkey_entered--;
4942                 break;
4943
4944         case HCI_KEYPRESS_CLEARED:
4945                 conn->passkey_entered = 0;
4946                 break;
4947
4948         case HCI_KEYPRESS_COMPLETED:
4949                 return;
4950         }
4951
4952         if (hci_dev_test_flag(hdev, HCI_MGMT))
4953                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4954                                          conn->dst_type, conn->passkey_notify,
4955                                          conn->passkey_entered);
4956 }
4957
4958 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4959                                          struct sk_buff *skb)
4960 {
4961         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4962         struct hci_conn *conn;
4963
4964         BT_DBG("%s", hdev->name);
4965
4966         hci_dev_lock(hdev);
4967
4968         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4969         if (!conn)
4970                 goto unlock;
4971
4972         /* Reset the authentication requirement to unknown */
4973         conn->remote_auth = 0xff;
4974
4975         /* To avoid duplicate auth_failed events to user space we check
4976          * the HCI_CONN_AUTH_PEND flag which will be set if we
4977          * initiated the authentication. A traditional auth_complete
4978          * event gets always produced as initiator and is also mapped to
4979          * the mgmt_auth_failed event */
4980         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4981                 mgmt_auth_failed(conn, ev->status);
4982
4983         hci_conn_drop(conn);
4984
4985 unlock:
4986         hci_dev_unlock(hdev);
4987 }
4988
4989 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4990                                          struct sk_buff *skb)
4991 {
4992         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4993         struct inquiry_entry *ie;
4994         struct hci_conn *conn;
4995
4996         BT_DBG("%s", hdev->name);
4997
4998         hci_dev_lock(hdev);
4999
5000         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
5001         if (conn)
5002                 memcpy(conn->features[1], ev->features, 8);
5003
5004         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
5005         if (ie)
5006                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
5007
5008         hci_dev_unlock(hdev);
5009 }
5010
5011 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
5012                                             struct sk_buff *skb)
5013 {
5014         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
5015         struct oob_data *data;
5016
5017         BT_DBG("%s", hdev->name);
5018
5019         hci_dev_lock(hdev);
5020
5021         if (!hci_dev_test_flag(hdev, HCI_MGMT))
5022                 goto unlock;
5023
5024         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
5025         if (!data) {
5026                 struct hci_cp_remote_oob_data_neg_reply cp;
5027
5028                 bacpy(&cp.bdaddr, &ev->bdaddr);
5029                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
5030                              sizeof(cp), &cp);
5031                 goto unlock;
5032         }
5033
5034         if (bredr_sc_enabled(hdev)) {
5035                 struct hci_cp_remote_oob_ext_data_reply cp;
5036
5037                 bacpy(&cp.bdaddr, &ev->bdaddr);
5038                 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) {
5039                         memset(cp.hash192, 0, sizeof(cp.hash192));
5040                         memset(cp.rand192, 0, sizeof(cp.rand192));
5041                 } else {
5042                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
5043                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
5044                 }
5045                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
5046                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
5047
5048                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
5049                              sizeof(cp), &cp);
5050         } else {
5051                 struct hci_cp_remote_oob_data_reply cp;
5052
5053                 bacpy(&cp.bdaddr, &ev->bdaddr);
5054                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
5055                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
5056
5057                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
5058                              sizeof(cp), &cp);
5059         }
5060
5061 unlock:
5062         hci_dev_unlock(hdev);
5063 }
5064
5065 #if IS_ENABLED(CONFIG_BT_HS)
5066 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5067 {
5068         struct hci_ev_channel_selected *ev = (void *)skb->data;
5069         struct hci_conn *hcon;
5070
5071         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5072
5073         skb_pull(skb, sizeof(*ev));
5074
5075         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5076         if (!hcon)
5077                 return;
5078
5079         amp_read_loc_assoc_final_data(hdev, hcon);
5080 }
5081
5082 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
5083                                       struct sk_buff *skb)
5084 {
5085         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
5086         struct hci_conn *hcon, *bredr_hcon;
5087
5088         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
5089                ev->status);
5090
5091         hci_dev_lock(hdev);
5092
5093         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5094         if (!hcon)
5095                 goto unlock;
5096
5097         if (!hcon->amp_mgr)
5098                 goto unlock;
5099
5100         if (ev->status) {
5101                 hci_conn_del(hcon);
5102                 goto unlock;
5103         }
5104
5105         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
5106
5107         hcon->state = BT_CONNECTED;
5108         bacpy(&hcon->dst, &bredr_hcon->dst);
5109
5110         hci_conn_hold(hcon);
5111         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
5112         hci_conn_drop(hcon);
5113
5114         hci_debugfs_create_conn(hcon);
5115         hci_conn_add_sysfs(hcon);
5116
5117         amp_physical_cfm(bredr_hcon, hcon);
5118
5119 unlock:
5120         hci_dev_unlock(hdev);
5121 }
5122
5123 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5124 {
5125         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
5126         struct hci_conn *hcon;
5127         struct hci_chan *hchan;
5128         struct amp_mgr *mgr;
5129
5130         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
5131                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
5132                ev->status);
5133
5134         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5135         if (!hcon)
5136                 return;
5137
5138         /* Create AMP hchan */
5139         hchan = hci_chan_create(hcon);
5140         if (!hchan)
5141                 return;
5142
5143         hchan->handle = le16_to_cpu(ev->handle);
5144         hchan->amp = true;
5145
5146         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
5147
5148         mgr = hcon->amp_mgr;
5149         if (mgr && mgr->bredr_chan) {
5150                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
5151
5152                 l2cap_chan_lock(bredr_chan);
5153
5154                 bredr_chan->conn->mtu = hdev->block_mtu;
5155                 l2cap_logical_cfm(bredr_chan, hchan, 0);
5156                 hci_conn_hold(hcon);
5157
5158                 l2cap_chan_unlock(bredr_chan);
5159         }
5160 }
5161
5162 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
5163                                              struct sk_buff *skb)
5164 {
5165         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
5166         struct hci_chan *hchan;
5167
5168         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
5169                le16_to_cpu(ev->handle), ev->status);
5170
5171         if (ev->status)
5172                 return;
5173
5174         hci_dev_lock(hdev);
5175
5176         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
5177         if (!hchan || !hchan->amp)
5178                 goto unlock;
5179
5180         amp_destroy_logical_link(hchan, ev->reason);
5181
5182 unlock:
5183         hci_dev_unlock(hdev);
5184 }
5185
5186 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
5187                                              struct sk_buff *skb)
5188 {
5189         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
5190         struct hci_conn *hcon;
5191
5192         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5193
5194         if (ev->status)
5195                 return;
5196
5197         hci_dev_lock(hdev);
5198
5199         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5200         if (hcon) {
5201                 hcon->state = BT_CLOSED;
5202                 hci_conn_del(hcon);
5203         }
5204
5205         hci_dev_unlock(hdev);
5206 }
5207 #endif
5208
5209 static void le_conn_update_addr(struct hci_conn *conn, bdaddr_t *bdaddr,
5210                                 u8 bdaddr_type, bdaddr_t *local_rpa)
5211 {
5212         if (conn->out) {
5213                 conn->dst_type = bdaddr_type;
5214                 conn->resp_addr_type = bdaddr_type;
5215                 bacpy(&conn->resp_addr, bdaddr);
5216
5217                 /* Check if the controller has set a Local RPA then it must be
5218                  * used instead or hdev->rpa.
5219                  */
5220                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5221                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5222                         bacpy(&conn->init_addr, local_rpa);
5223                 } else if (hci_dev_test_flag(conn->hdev, HCI_PRIVACY)) {
5224                         conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5225                         bacpy(&conn->init_addr, &conn->hdev->rpa);
5226                 } else {
5227                         hci_copy_identity_address(conn->hdev, &conn->init_addr,
5228                                                   &conn->init_addr_type);
5229                 }
5230         } else {
5231                 conn->resp_addr_type = conn->hdev->adv_addr_type;
5232                 /* Check if the controller has set a Local RPA then it must be
5233                  * used instead or hdev->rpa.
5234                  */
5235                 if (local_rpa && bacmp(local_rpa, BDADDR_ANY)) {
5236                         conn->resp_addr_type = ADDR_LE_DEV_RANDOM;
5237                         bacpy(&conn->resp_addr, local_rpa);
5238                 } else if (conn->hdev->adv_addr_type == ADDR_LE_DEV_RANDOM) {
5239                         /* In case of ext adv, resp_addr will be updated in
5240                          * Adv Terminated event.
5241                          */
5242                         if (!ext_adv_capable(conn->hdev))
5243                                 bacpy(&conn->resp_addr,
5244                                       &conn->hdev->random_addr);
5245                 } else {
5246                         bacpy(&conn->resp_addr, &conn->hdev->bdaddr);
5247                 }
5248
5249                 conn->init_addr_type = bdaddr_type;
5250                 bacpy(&conn->init_addr, bdaddr);
5251
5252                 /* For incoming connections, set the default minimum
5253                  * and maximum connection interval. They will be used
5254                  * to check if the parameters are in range and if not
5255                  * trigger the connection update procedure.
5256                  */
5257                 conn->le_conn_min_interval = conn->hdev->le_conn_min_interval;
5258                 conn->le_conn_max_interval = conn->hdev->le_conn_max_interval;
5259         }
5260 }
5261
5262 static void le_conn_complete_evt(struct hci_dev *hdev, u8 status,
5263                                  bdaddr_t *bdaddr, u8 bdaddr_type,
5264                                  bdaddr_t *local_rpa, u8 role, u16 handle,
5265                                  u16 interval, u16 latency,
5266                                  u16 supervision_timeout)
5267 {
5268         struct hci_conn_params *params;
5269         struct hci_conn *conn;
5270         struct smp_irk *irk;
5271         u8 addr_type;
5272
5273         hci_dev_lock(hdev);
5274
5275         /* All controllers implicitly stop advertising in the event of a
5276          * connection, so ensure that the state bit is cleared.
5277          */
5278         hci_dev_clear_flag(hdev, HCI_LE_ADV);
5279
5280         conn = hci_lookup_le_connect(hdev);
5281         if (!conn) {
5282                 conn = hci_conn_add(hdev, LE_LINK, bdaddr, role);
5283                 if (!conn) {
5284                         bt_dev_err(hdev, "no memory for new connection");
5285                         goto unlock;
5286                 }
5287
5288                 conn->dst_type = bdaddr_type;
5289
5290                 /* If we didn't have a hci_conn object previously
5291                  * but we're in central role this must be something
5292                  * initiated using an accept list. Since accept list based
5293                  * connections are not "first class citizens" we don't
5294                  * have full tracking of them. Therefore, we go ahead
5295                  * with a "best effort" approach of determining the
5296                  * initiator address based on the HCI_PRIVACY flag.
5297                  */
5298                 if (conn->out) {
5299                         conn->resp_addr_type = bdaddr_type;
5300                         bacpy(&conn->resp_addr, bdaddr);
5301                         if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
5302                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
5303                                 bacpy(&conn->init_addr, &hdev->rpa);
5304                         } else {
5305                                 hci_copy_identity_address(hdev,
5306                                                           &conn->init_addr,
5307                                                           &conn->init_addr_type);
5308                         }
5309                 }
5310         } else {
5311                 cancel_delayed_work(&conn->le_conn_timeout);
5312         }
5313
5314         le_conn_update_addr(conn, bdaddr, bdaddr_type, local_rpa);
5315
5316         /* Lookup the identity address from the stored connection
5317          * address and address type.
5318          *
5319          * When establishing connections to an identity address, the
5320          * connection procedure will store the resolvable random
5321          * address first. Now if it can be converted back into the
5322          * identity address, start using the identity address from
5323          * now on.
5324          */
5325         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
5326         if (irk) {
5327                 bacpy(&conn->dst, &irk->bdaddr);
5328                 conn->dst_type = irk->addr_type;
5329         }
5330
5331         /* When using controller based address resolution, then the new
5332          * address types 0x02 and 0x03 are used. These types need to be
5333          * converted back into either public address or random address type
5334          */
5335         if (use_ll_privacy(hdev) &&
5336             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5337             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
5338                 switch (conn->dst_type) {
5339                 case ADDR_LE_DEV_PUBLIC_RESOLVED:
5340                         conn->dst_type = ADDR_LE_DEV_PUBLIC;
5341                         break;
5342                 case ADDR_LE_DEV_RANDOM_RESOLVED:
5343                         conn->dst_type = ADDR_LE_DEV_RANDOM;
5344                         break;
5345                 }
5346         }
5347
5348         if (status) {
5349                 hci_le_conn_failed(conn, status);
5350                 goto unlock;
5351         }
5352
5353         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
5354                 addr_type = BDADDR_LE_PUBLIC;
5355         else
5356                 addr_type = BDADDR_LE_RANDOM;
5357
5358         /* Drop the connection if the device is blocked */
5359         if (hci_bdaddr_list_lookup(&hdev->reject_list, &conn->dst, addr_type)) {
5360                 hci_conn_drop(conn);
5361                 goto unlock;
5362         }
5363
5364         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
5365                 mgmt_device_connected(hdev, conn, NULL, 0);
5366
5367         conn->sec_level = BT_SECURITY_LOW;
5368         conn->handle = handle;
5369         conn->state = BT_CONFIG;
5370
5371         /* Store current advertising instance as connection advertising instance
5372          * when sotfware rotation is in use so it can be re-enabled when
5373          * disconnected.
5374          */
5375         if (!ext_adv_capable(hdev))
5376                 conn->adv_instance = hdev->cur_adv_instance;
5377
5378         conn->le_conn_interval = interval;
5379         conn->le_conn_latency = latency;
5380         conn->le_supv_timeout = supervision_timeout;
5381
5382         hci_debugfs_create_conn(conn);
5383         hci_conn_add_sysfs(conn);
5384
5385         /* The remote features procedure is defined for central
5386          * role only. So only in case of an initiated connection
5387          * request the remote features.
5388          *
5389          * If the local controller supports peripheral-initiated features
5390          * exchange, then requesting the remote features in peripheral
5391          * role is possible. Otherwise just transition into the
5392          * connected state without requesting the remote features.
5393          */
5394         if (conn->out ||
5395             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) {
5396                 struct hci_cp_le_read_remote_features cp;
5397
5398                 cp.handle = __cpu_to_le16(conn->handle);
5399
5400                 hci_send_cmd(hdev, HCI_OP_LE_READ_REMOTE_FEATURES,
5401                              sizeof(cp), &cp);
5402
5403                 hci_conn_hold(conn);
5404         } else {
5405                 conn->state = BT_CONNECTED;
5406                 hci_connect_cfm(conn, status);
5407         }
5408
5409         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
5410                                            conn->dst_type);
5411         if (params) {
5412                 list_del_init(&params->action);
5413                 if (params->conn) {
5414                         hci_conn_drop(params->conn);
5415                         hci_conn_put(params->conn);
5416                         params->conn = NULL;
5417                 }
5418         }
5419
5420 unlock:
5421         hci_update_background_scan(hdev);
5422         hci_dev_unlock(hdev);
5423 }
5424
5425 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
5426 {
5427         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
5428
5429         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5430
5431         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5432                              NULL, ev->role, le16_to_cpu(ev->handle),
5433                              le16_to_cpu(ev->interval),
5434                              le16_to_cpu(ev->latency),
5435                              le16_to_cpu(ev->supervision_timeout));
5436 }
5437
5438 static void hci_le_enh_conn_complete_evt(struct hci_dev *hdev,
5439                                          struct sk_buff *skb)
5440 {
5441         struct hci_ev_le_enh_conn_complete *ev = (void *) skb->data;
5442
5443         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5444
5445         le_conn_complete_evt(hdev, ev->status, &ev->bdaddr, ev->bdaddr_type,
5446                              &ev->local_rpa, ev->role, le16_to_cpu(ev->handle),
5447                              le16_to_cpu(ev->interval),
5448                              le16_to_cpu(ev->latency),
5449                              le16_to_cpu(ev->supervision_timeout));
5450
5451         if (use_ll_privacy(hdev) &&
5452             hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
5453             hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
5454                 hci_req_disable_address_resolution(hdev);
5455 }
5456
5457 static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb)
5458 {
5459         struct hci_evt_le_ext_adv_set_term *ev = (void *) skb->data;
5460         struct hci_conn *conn;
5461         struct adv_info *adv;
5462
5463         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5464
5465         adv = hci_find_adv_instance(hdev, ev->handle);
5466
5467         if (ev->status) {
5468                 if (!adv)
5469                         return;
5470
5471                 /* Remove advertising as it has been terminated */
5472                 hci_remove_adv_instance(hdev, ev->handle);
5473                 mgmt_advertising_removed(NULL, hdev, ev->handle);
5474
5475                 return;
5476         }
5477
5478         if (adv)
5479                 adv->enabled = false;
5480
5481         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle));
5482         if (conn) {
5483                 /* Store handle in the connection so the correct advertising
5484                  * instance can be re-enabled when disconnected.
5485                  */
5486                 conn->adv_instance = ev->handle;
5487
5488                 if (hdev->adv_addr_type != ADDR_LE_DEV_RANDOM ||
5489                     bacmp(&conn->resp_addr, BDADDR_ANY))
5490                         return;
5491
5492                 if (!ev->handle) {
5493                         bacpy(&conn->resp_addr, &hdev->random_addr);
5494                         return;
5495                 }
5496
5497                 if (adv)
5498                         bacpy(&conn->resp_addr, &adv->random_addr);
5499         }
5500 }
5501
5502 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
5503                                             struct sk_buff *skb)
5504 {
5505         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
5506         struct hci_conn *conn;
5507
5508         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5509
5510         if (ev->status)
5511                 return;
5512
5513         hci_dev_lock(hdev);
5514
5515         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5516         if (conn) {
5517                 conn->le_conn_interval = le16_to_cpu(ev->interval);
5518                 conn->le_conn_latency = le16_to_cpu(ev->latency);
5519                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
5520         }
5521
5522         hci_dev_unlock(hdev);
5523 }
5524
5525 /* This function requires the caller holds hdev->lock */
5526 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
5527                                               bdaddr_t *addr,
5528                                               u8 addr_type, u8 adv_type,
5529                                               bdaddr_t *direct_rpa)
5530 {
5531         struct hci_conn *conn;
5532         struct hci_conn_params *params;
5533
5534         /* If the event is not connectable don't proceed further */
5535         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
5536                 return NULL;
5537
5538         /* Ignore if the device is blocked */
5539         if (hci_bdaddr_list_lookup(&hdev->reject_list, addr, addr_type))
5540                 return NULL;
5541
5542         /* Most controller will fail if we try to create new connections
5543          * while we have an existing one in peripheral role.
5544          */
5545         if (hdev->conn_hash.le_num_peripheral > 0 &&
5546             (!test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) ||
5547              !(hdev->le_states[3] & 0x10)))
5548                 return NULL;
5549
5550         /* If we're not connectable only connect devices that we have in
5551          * our pend_le_conns list.
5552          */
5553         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, addr,
5554                                            addr_type);
5555         if (!params)
5556                 return NULL;
5557
5558         if (!params->explicit_connect) {
5559                 switch (params->auto_connect) {
5560                 case HCI_AUTO_CONN_DIRECT:
5561                         /* Only devices advertising with ADV_DIRECT_IND are
5562                          * triggering a connection attempt. This is allowing
5563                          * incoming connections from peripheral devices.
5564                          */
5565                         if (adv_type != LE_ADV_DIRECT_IND)
5566                                 return NULL;
5567                         break;
5568                 case HCI_AUTO_CONN_ALWAYS:
5569                         /* Devices advertising with ADV_IND or ADV_DIRECT_IND
5570                          * are triggering a connection attempt. This means
5571                          * that incoming connections from peripheral device are
5572                          * accepted and also outgoing connections to peripheral
5573                          * devices are established when found.
5574                          */
5575                         break;
5576                 default:
5577                         return NULL;
5578                 }
5579         }
5580
5581         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
5582                               hdev->def_le_autoconnect_timeout, HCI_ROLE_MASTER,
5583                               direct_rpa);
5584         if (!IS_ERR(conn)) {
5585                 /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned
5586                  * by higher layer that tried to connect, if no then
5587                  * store the pointer since we don't really have any
5588                  * other owner of the object besides the params that
5589                  * triggered it. This way we can abort the connection if
5590                  * the parameters get removed and keep the reference
5591                  * count consistent once the connection is established.
5592                  */
5593
5594                 if (!params->explicit_connect)
5595                         params->conn = hci_conn_get(conn);
5596
5597                 return conn;
5598         }
5599
5600         switch (PTR_ERR(conn)) {
5601         case -EBUSY:
5602                 /* If hci_connect() returns -EBUSY it means there is already
5603                  * an LE connection attempt going on. Since controllers don't
5604                  * support more than one connection attempt at the time, we
5605                  * don't consider this an error case.
5606                  */
5607                 break;
5608         default:
5609                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
5610                 return NULL;
5611         }
5612
5613         return NULL;
5614 }
5615
5616 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
5617                                u8 bdaddr_type, bdaddr_t *direct_addr,
5618                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len,
5619                                bool ext_adv)
5620 {
5621         struct discovery_state *d = &hdev->discovery;
5622         struct smp_irk *irk;
5623         struct hci_conn *conn;
5624         bool match;
5625         u32 flags;
5626         u8 *ptr;
5627
5628         switch (type) {
5629         case LE_ADV_IND:
5630         case LE_ADV_DIRECT_IND:
5631         case LE_ADV_SCAN_IND:
5632         case LE_ADV_NONCONN_IND:
5633         case LE_ADV_SCAN_RSP:
5634                 break;
5635         default:
5636                 bt_dev_err_ratelimited(hdev, "unknown advertising packet "
5637                                        "type: 0x%02x", type);
5638                 return;
5639         }
5640
5641         if (!ext_adv && len > HCI_MAX_AD_LENGTH) {
5642                 bt_dev_err_ratelimited(hdev, "legacy adv larger than 31 bytes");
5643                 return;
5644         }
5645
5646         /* Find the end of the data in case the report contains padded zero
5647          * bytes at the end causing an invalid length value.
5648          *
5649          * When data is NULL, len is 0 so there is no need for extra ptr
5650          * check as 'ptr < data + 0' is already false in such case.
5651          */
5652         for (ptr = data; ptr < data + len && *ptr; ptr += *ptr + 1) {
5653                 if (ptr + 1 + *ptr > data + len)
5654                         break;
5655         }
5656
5657         /* Adjust for actual length. This handles the case when remote
5658          * device is advertising with incorrect data length.
5659          */
5660         len = ptr - data;
5661
5662         /* If the direct address is present, then this report is from
5663          * a LE Direct Advertising Report event. In that case it is
5664          * important to see if the address is matching the local
5665          * controller address.
5666          */
5667         if (direct_addr) {
5668                 /* Only resolvable random addresses are valid for these
5669                  * kind of reports and others can be ignored.
5670                  */
5671                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
5672                         return;
5673
5674                 /* If the controller is not using resolvable random
5675                  * addresses, then this report can be ignored.
5676                  */
5677                 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
5678                         return;
5679
5680                 /* If the local IRK of the controller does not match
5681                  * with the resolvable random address provided, then
5682                  * this report can be ignored.
5683                  */
5684                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
5685                         return;
5686         }
5687
5688         /* Check if we need to convert to identity address */
5689         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
5690         if (irk) {
5691                 bdaddr = &irk->bdaddr;
5692                 bdaddr_type = irk->addr_type;
5693         }
5694
5695         /* Check if we have been requested to connect to this device.
5696          *
5697          * direct_addr is set only for directed advertising reports (it is NULL
5698          * for advertising reports) and is already verified to be RPA above.
5699          */
5700         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type,
5701                                                                 direct_addr);
5702         if (!ext_adv && conn && type == LE_ADV_IND && len <= HCI_MAX_AD_LENGTH) {
5703                 /* Store report for later inclusion by
5704                  * mgmt_device_connected
5705                  */
5706                 memcpy(conn->le_adv_data, data, len);
5707                 conn->le_adv_data_len = len;
5708         }
5709
5710         /* Passive scanning shouldn't trigger any device found events,
5711          * except for devices marked as CONN_REPORT for which we do send
5712          * device found events, or advertisement monitoring requested.
5713          */
5714         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
5715                 if (type == LE_ADV_DIRECT_IND)
5716                         return;
5717
5718                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
5719                                                bdaddr, bdaddr_type) &&
5720                     idr_is_empty(&hdev->adv_monitors_idr))
5721                         return;
5722
5723                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
5724                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5725                 else
5726                         flags = 0;
5727                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5728                                   rssi, flags, data, len, NULL, 0);
5729                 return;
5730         }
5731
5732         /* When receiving non-connectable or scannable undirected
5733          * advertising reports, this means that the remote device is
5734          * not connectable and then clearly indicate this in the
5735          * device found event.
5736          *
5737          * When receiving a scan response, then there is no way to
5738          * know if the remote device is connectable or not. However
5739          * since scan responses are merged with a previously seen
5740          * advertising report, the flags field from that report
5741          * will be used.
5742          *
5743          * In the really unlikely case that a controller get confused
5744          * and just sends a scan response event, then it is marked as
5745          * not connectable as well.
5746          */
5747         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5748             type == LE_ADV_SCAN_RSP)
5749                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5750         else
5751                 flags = 0;
5752
5753         /* If there's nothing pending either store the data from this
5754          * event or send an immediate device found event if the data
5755          * should not be stored for later.
5756          */
5757         if (!ext_adv && !has_pending_adv_report(hdev)) {
5758                 /* If the report will trigger a SCAN_REQ store it for
5759                  * later merging.
5760                  */
5761                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5762                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5763                                                  rssi, flags, data, len);
5764                         return;
5765                 }
5766
5767                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5768                                   rssi, flags, data, len, NULL, 0);
5769                 return;
5770         }
5771
5772         /* Check if the pending report is for the same device as the new one */
5773         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5774                  bdaddr_type == d->last_adv_addr_type);
5775
5776         /* If the pending data doesn't match this report or this isn't a
5777          * scan response (e.g. we got a duplicate ADV_IND) then force
5778          * sending of the pending data.
5779          */
5780         if (type != LE_ADV_SCAN_RSP || !match) {
5781                 /* Send out whatever is in the cache, but skip duplicates */
5782                 if (!match)
5783                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5784                                           d->last_adv_addr_type, NULL,
5785                                           d->last_adv_rssi, d->last_adv_flags,
5786                                           d->last_adv_data,
5787                                           d->last_adv_data_len, NULL, 0);
5788
5789                 /* If the new report will trigger a SCAN_REQ store it for
5790                  * later merging.
5791                  */
5792                 if (!ext_adv && (type == LE_ADV_IND ||
5793                                  type == LE_ADV_SCAN_IND)) {
5794                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5795                                                  rssi, flags, data, len);
5796                         return;
5797                 }
5798
5799                 /* The advertising reports cannot be merged, so clear
5800                  * the pending report and send out a device found event.
5801                  */
5802                 clear_pending_adv_report(hdev);
5803                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5804                                   rssi, flags, data, len, NULL, 0);
5805                 return;
5806         }
5807
5808         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5809          * the new event is a SCAN_RSP. We can therefore proceed with
5810          * sending a merged device found event.
5811          */
5812         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5813                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5814                           d->last_adv_data, d->last_adv_data_len, data, len);
5815         clear_pending_adv_report(hdev);
5816 }
5817
5818 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5819 {
5820         u8 num_reports = skb->data[0];
5821         void *ptr = &skb->data[1];
5822
5823         hci_dev_lock(hdev);
5824
5825         while (num_reports--) {
5826                 struct hci_ev_le_advertising_info *ev = ptr;
5827                 s8 rssi;
5828
5829                 if (ev->length <= HCI_MAX_AD_LENGTH) {
5830                         rssi = ev->data[ev->length];
5831                         process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5832                                            ev->bdaddr_type, NULL, 0, rssi,
5833                                            ev->data, ev->length, false);
5834                 } else {
5835                         bt_dev_err(hdev, "Dropping invalid advertising data");
5836                 }
5837
5838                 ptr += sizeof(*ev) + ev->length + 1;
5839         }
5840
5841         hci_dev_unlock(hdev);
5842 }
5843
5844 static u8 ext_evt_type_to_legacy(struct hci_dev *hdev, u16 evt_type)
5845 {
5846         if (evt_type & LE_EXT_ADV_LEGACY_PDU) {
5847                 switch (evt_type) {
5848                 case LE_LEGACY_ADV_IND:
5849                         return LE_ADV_IND;
5850                 case LE_LEGACY_ADV_DIRECT_IND:
5851                         return LE_ADV_DIRECT_IND;
5852                 case LE_LEGACY_ADV_SCAN_IND:
5853                         return LE_ADV_SCAN_IND;
5854                 case LE_LEGACY_NONCONN_IND:
5855                         return LE_ADV_NONCONN_IND;
5856                 case LE_LEGACY_SCAN_RSP_ADV:
5857                 case LE_LEGACY_SCAN_RSP_ADV_SCAN:
5858                         return LE_ADV_SCAN_RSP;
5859                 }
5860
5861                 goto invalid;
5862         }
5863
5864         if (evt_type & LE_EXT_ADV_CONN_IND) {
5865                 if (evt_type & LE_EXT_ADV_DIRECT_IND)
5866                         return LE_ADV_DIRECT_IND;
5867
5868                 return LE_ADV_IND;
5869         }
5870
5871         if (evt_type & LE_EXT_ADV_SCAN_RSP)
5872                 return LE_ADV_SCAN_RSP;
5873
5874         if (evt_type & LE_EXT_ADV_SCAN_IND)
5875                 return LE_ADV_SCAN_IND;
5876
5877         if (evt_type == LE_EXT_ADV_NON_CONN_IND ||
5878             evt_type & LE_EXT_ADV_DIRECT_IND)
5879                 return LE_ADV_NONCONN_IND;
5880
5881 invalid:
5882         bt_dev_err_ratelimited(hdev, "Unknown advertising packet type: 0x%02x",
5883                                evt_type);
5884
5885         return LE_ADV_INVALID;
5886 }
5887
5888 static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5889 {
5890         u8 num_reports = skb->data[0];
5891         void *ptr = &skb->data[1];
5892
5893         hci_dev_lock(hdev);
5894
5895         while (num_reports--) {
5896                 struct hci_ev_le_ext_adv_report *ev = ptr;
5897                 u8 legacy_evt_type;
5898                 u16 evt_type;
5899
5900                 evt_type = __le16_to_cpu(ev->evt_type);
5901                 legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type);
5902                 if (legacy_evt_type != LE_ADV_INVALID) {
5903                         process_adv_report(hdev, legacy_evt_type, &ev->bdaddr,
5904                                            ev->bdaddr_type, NULL, 0, ev->rssi,
5905                                            ev->data, ev->length,
5906                                            !(evt_type & LE_EXT_ADV_LEGACY_PDU));
5907                 }
5908
5909                 ptr += sizeof(*ev) + ev->length;
5910         }
5911
5912         hci_dev_unlock(hdev);
5913 }
5914
5915 static void hci_le_remote_feat_complete_evt(struct hci_dev *hdev,
5916                                             struct sk_buff *skb)
5917 {
5918         struct hci_ev_le_remote_feat_complete *ev = (void *)skb->data;
5919         struct hci_conn *conn;
5920
5921         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
5922
5923         hci_dev_lock(hdev);
5924
5925         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5926         if (conn) {
5927                 if (!ev->status)
5928                         memcpy(conn->features[0], ev->features, 8);
5929
5930                 if (conn->state == BT_CONFIG) {
5931                         __u8 status;
5932
5933                         /* If the local controller supports peripheral-initiated
5934                          * features exchange, but the remote controller does
5935                          * not, then it is possible that the error code 0x1a
5936                          * for unsupported remote feature gets returned.
5937                          *
5938                          * In this specific case, allow the connection to
5939                          * transition into connected state and mark it as
5940                          * successful.
5941                          */
5942                         if (!conn->out && ev->status == 0x1a &&
5943                             (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES))
5944                                 status = 0x00;
5945                         else
5946                                 status = ev->status;
5947
5948                         conn->state = BT_CONNECTED;
5949                         hci_connect_cfm(conn, status);
5950                         hci_conn_drop(conn);
5951                 }
5952         }
5953
5954         hci_dev_unlock(hdev);
5955 }
5956
5957 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5958 {
5959         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5960         struct hci_cp_le_ltk_reply cp;
5961         struct hci_cp_le_ltk_neg_reply neg;
5962         struct hci_conn *conn;
5963         struct smp_ltk *ltk;
5964
5965         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5966
5967         hci_dev_lock(hdev);
5968
5969         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5970         if (conn == NULL)
5971                 goto not_found;
5972
5973         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5974         if (!ltk)
5975                 goto not_found;
5976
5977         if (smp_ltk_is_sc(ltk)) {
5978                 /* With SC both EDiv and Rand are set to zero */
5979                 if (ev->ediv || ev->rand)
5980                         goto not_found;
5981         } else {
5982                 /* For non-SC keys check that EDiv and Rand match */
5983                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5984                         goto not_found;
5985         }
5986
5987         memcpy(cp.ltk, ltk->val, ltk->enc_size);
5988         memset(cp.ltk + ltk->enc_size, 0, sizeof(cp.ltk) - ltk->enc_size);
5989         cp.handle = cpu_to_le16(conn->handle);
5990
5991         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5992
5993         conn->enc_key_size = ltk->enc_size;
5994
5995         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5996
5997         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5998          * temporary key used to encrypt a connection following
5999          * pairing. It is used during the Encrypted Session Setup to
6000          * distribute the keys. Later, security can be re-established
6001          * using a distributed LTK.
6002          */
6003         if (ltk->type == SMP_STK) {
6004                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6005                 list_del_rcu(&ltk->list);
6006                 kfree_rcu(ltk, rcu);
6007         } else {
6008                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
6009         }
6010
6011         hci_dev_unlock(hdev);
6012
6013         return;
6014
6015 not_found:
6016         neg.handle = ev->handle;
6017         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
6018         hci_dev_unlock(hdev);
6019 }
6020
6021 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
6022                                       u8 reason)
6023 {
6024         struct hci_cp_le_conn_param_req_neg_reply cp;
6025
6026         cp.handle = cpu_to_le16(handle);
6027         cp.reason = reason;
6028
6029         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
6030                      &cp);
6031 }
6032
6033 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
6034                                              struct sk_buff *skb)
6035 {
6036         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
6037         struct hci_cp_le_conn_param_req_reply cp;
6038         struct hci_conn *hcon;
6039         u16 handle, min, max, latency, timeout;
6040
6041         handle = le16_to_cpu(ev->handle);
6042         min = le16_to_cpu(ev->interval_min);
6043         max = le16_to_cpu(ev->interval_max);
6044         latency = le16_to_cpu(ev->latency);
6045         timeout = le16_to_cpu(ev->timeout);
6046
6047         hcon = hci_conn_hash_lookup_handle(hdev, handle);
6048         if (!hcon || hcon->state != BT_CONNECTED)
6049                 return send_conn_param_neg_reply(hdev, handle,
6050                                                  HCI_ERROR_UNKNOWN_CONN_ID);
6051
6052         if (hci_check_conn_params(min, max, latency, timeout))
6053                 return send_conn_param_neg_reply(hdev, handle,
6054                                                  HCI_ERROR_INVALID_LL_PARAMS);
6055
6056         if (hcon->role == HCI_ROLE_MASTER) {
6057                 struct hci_conn_params *params;
6058                 u8 store_hint;
6059
6060                 hci_dev_lock(hdev);
6061
6062                 params = hci_conn_params_lookup(hdev, &hcon->dst,
6063                                                 hcon->dst_type);
6064                 if (params) {
6065                         params->conn_min_interval = min;
6066                         params->conn_max_interval = max;
6067                         params->conn_latency = latency;
6068                         params->supervision_timeout = timeout;
6069                         store_hint = 0x01;
6070                 } else {
6071                         store_hint = 0x00;
6072                 }
6073
6074                 hci_dev_unlock(hdev);
6075
6076                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
6077                                     store_hint, min, max, latency, timeout);
6078         }
6079
6080         cp.handle = ev->handle;
6081         cp.interval_min = ev->interval_min;
6082         cp.interval_max = ev->interval_max;
6083         cp.latency = ev->latency;
6084         cp.timeout = ev->timeout;
6085         cp.min_ce_len = 0;
6086         cp.max_ce_len = 0;
6087
6088         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
6089 }
6090
6091 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
6092                                          struct sk_buff *skb)
6093 {
6094         u8 num_reports = skb->data[0];
6095         struct hci_ev_le_direct_adv_info *ev = (void *)&skb->data[1];
6096
6097         if (!num_reports || skb->len < num_reports * sizeof(*ev) + 1)
6098                 return;
6099
6100         hci_dev_lock(hdev);
6101
6102         for (; num_reports; num_reports--, ev++)
6103                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
6104                                    ev->bdaddr_type, &ev->direct_addr,
6105                                    ev->direct_addr_type, ev->rssi, NULL, 0,
6106                                    false);
6107
6108         hci_dev_unlock(hdev);
6109 }
6110
6111 static void hci_le_phy_update_evt(struct hci_dev *hdev, struct sk_buff *skb)
6112 {
6113         struct hci_ev_le_phy_update_complete *ev = (void *) skb->data;
6114         struct hci_conn *conn;
6115
6116         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
6117
6118         if (ev->status)
6119                 return;
6120
6121         hci_dev_lock(hdev);
6122
6123         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
6124         if (!conn)
6125                 goto unlock;
6126
6127         conn->le_tx_phy = ev->tx_phy;
6128         conn->le_rx_phy = ev->rx_phy;
6129
6130 unlock:
6131         hci_dev_unlock(hdev);
6132 }
6133
6134 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
6135 {
6136         struct hci_ev_le_meta *le_ev = (void *) skb->data;
6137
6138         skb_pull(skb, sizeof(*le_ev));
6139
6140         switch (le_ev->subevent) {
6141         case HCI_EV_LE_CONN_COMPLETE:
6142                 hci_le_conn_complete_evt(hdev, skb);
6143                 break;
6144
6145         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
6146                 hci_le_conn_update_complete_evt(hdev, skb);
6147                 break;
6148
6149         case HCI_EV_LE_ADVERTISING_REPORT:
6150                 hci_le_adv_report_evt(hdev, skb);
6151                 break;
6152
6153         case HCI_EV_LE_REMOTE_FEAT_COMPLETE:
6154                 hci_le_remote_feat_complete_evt(hdev, skb);
6155                 break;
6156
6157         case HCI_EV_LE_LTK_REQ:
6158                 hci_le_ltk_request_evt(hdev, skb);
6159                 break;
6160
6161         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
6162                 hci_le_remote_conn_param_req_evt(hdev, skb);
6163                 break;
6164
6165         case HCI_EV_LE_DIRECT_ADV_REPORT:
6166                 hci_le_direct_adv_report_evt(hdev, skb);
6167                 break;
6168
6169         case HCI_EV_LE_PHY_UPDATE_COMPLETE:
6170                 hci_le_phy_update_evt(hdev, skb);
6171                 break;
6172
6173         case HCI_EV_LE_EXT_ADV_REPORT:
6174                 hci_le_ext_adv_report_evt(hdev, skb);
6175                 break;
6176
6177         case HCI_EV_LE_ENHANCED_CONN_COMPLETE:
6178                 hci_le_enh_conn_complete_evt(hdev, skb);
6179                 break;
6180
6181         case HCI_EV_LE_EXT_ADV_SET_TERM:
6182                 hci_le_ext_adv_term_evt(hdev, skb);
6183                 break;
6184
6185         default:
6186                 break;
6187         }
6188 }
6189
6190 static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
6191                                  u8 event, struct sk_buff *skb)
6192 {
6193         struct hci_ev_cmd_complete *ev;
6194         struct hci_event_hdr *hdr;
6195
6196         if (!skb)
6197                 return false;
6198
6199         if (skb->len < sizeof(*hdr)) {
6200                 bt_dev_err(hdev, "too short HCI event");
6201                 return false;
6202         }
6203
6204         hdr = (void *) skb->data;
6205         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6206
6207         if (event) {
6208                 if (hdr->evt != event)
6209                         return false;
6210                 return true;
6211         }
6212
6213         /* Check if request ended in Command Status - no way to retrieve
6214          * any extra parameters in this case.
6215          */
6216         if (hdr->evt == HCI_EV_CMD_STATUS)
6217                 return false;
6218
6219         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
6220                 bt_dev_err(hdev, "last event is not cmd complete (0x%2.2x)",
6221                            hdr->evt);
6222                 return false;
6223         }
6224
6225         if (skb->len < sizeof(*ev)) {
6226                 bt_dev_err(hdev, "too short cmd_complete event");
6227                 return false;
6228         }
6229
6230         ev = (void *) skb->data;
6231         skb_pull(skb, sizeof(*ev));
6232
6233         if (opcode != __le16_to_cpu(ev->opcode)) {
6234                 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
6235                        __le16_to_cpu(ev->opcode));
6236                 return false;
6237         }
6238
6239         return true;
6240 }
6241
6242 static void hci_store_wake_reason(struct hci_dev *hdev, u8 event,
6243                                   struct sk_buff *skb)
6244 {
6245         struct hci_ev_le_advertising_info *adv;
6246         struct hci_ev_le_direct_adv_info *direct_adv;
6247         struct hci_ev_le_ext_adv_report *ext_adv;
6248         const struct hci_ev_conn_complete *conn_complete = (void *)skb->data;
6249         const struct hci_ev_conn_request *conn_request = (void *)skb->data;
6250
6251         hci_dev_lock(hdev);
6252
6253         /* If we are currently suspended and this is the first BT event seen,
6254          * save the wake reason associated with the event.
6255          */
6256         if (!hdev->suspended || hdev->wake_reason)
6257                 goto unlock;
6258
6259         /* Default to remote wake. Values for wake_reason are documented in the
6260          * Bluez mgmt api docs.
6261          */
6262         hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE;
6263
6264         /* Once configured for remote wakeup, we should only wake up for
6265          * reconnections. It's useful to see which device is waking us up so
6266          * keep track of the bdaddr of the connection event that woke us up.
6267          */
6268         if (event == HCI_EV_CONN_REQUEST) {
6269                 bacpy(&hdev->wake_addr, &conn_complete->bdaddr);
6270                 hdev->wake_addr_type = BDADDR_BREDR;
6271         } else if (event == HCI_EV_CONN_COMPLETE) {
6272                 bacpy(&hdev->wake_addr, &conn_request->bdaddr);
6273                 hdev->wake_addr_type = BDADDR_BREDR;
6274         } else if (event == HCI_EV_LE_META) {
6275                 struct hci_ev_le_meta *le_ev = (void *)skb->data;
6276                 u8 subevent = le_ev->subevent;
6277                 u8 *ptr = &skb->data[sizeof(*le_ev)];
6278                 u8 num_reports = *ptr;
6279
6280                 if ((subevent == HCI_EV_LE_ADVERTISING_REPORT ||
6281                      subevent == HCI_EV_LE_DIRECT_ADV_REPORT ||
6282                      subevent == HCI_EV_LE_EXT_ADV_REPORT) &&
6283                     num_reports) {
6284                         adv = (void *)(ptr + 1);
6285                         direct_adv = (void *)(ptr + 1);
6286                         ext_adv = (void *)(ptr + 1);
6287
6288                         switch (subevent) {
6289                         case HCI_EV_LE_ADVERTISING_REPORT:
6290                                 bacpy(&hdev->wake_addr, &adv->bdaddr);
6291                                 hdev->wake_addr_type = adv->bdaddr_type;
6292                                 break;
6293                         case HCI_EV_LE_DIRECT_ADV_REPORT:
6294                                 bacpy(&hdev->wake_addr, &direct_adv->bdaddr);
6295                                 hdev->wake_addr_type = direct_adv->bdaddr_type;
6296                                 break;
6297                         case HCI_EV_LE_EXT_ADV_REPORT:
6298                                 bacpy(&hdev->wake_addr, &ext_adv->bdaddr);
6299                                 hdev->wake_addr_type = ext_adv->bdaddr_type;
6300                                 break;
6301                         }
6302                 }
6303         } else {
6304                 hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED;
6305         }
6306
6307 unlock:
6308         hci_dev_unlock(hdev);
6309 }
6310
6311 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
6312 {
6313         struct hci_event_hdr *hdr = (void *) skb->data;
6314         hci_req_complete_t req_complete = NULL;
6315         hci_req_complete_skb_t req_complete_skb = NULL;
6316         struct sk_buff *orig_skb = NULL;
6317         u8 status = 0, event = hdr->evt, req_evt = 0;
6318         u16 opcode = HCI_OP_NOP;
6319
6320         if (!event) {
6321                 bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
6322                 goto done;
6323         }
6324
6325         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
6326                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
6327                 opcode = __le16_to_cpu(cmd_hdr->opcode);
6328                 hci_req_cmd_complete(hdev, opcode, status, &req_complete,
6329                                      &req_complete_skb);
6330                 req_evt = event;
6331         }
6332
6333         /* If it looks like we might end up having to call
6334          * req_complete_skb, store a pristine copy of the skb since the
6335          * various handlers may modify the original one through
6336          * skb_pull() calls, etc.
6337          */
6338         if (req_complete_skb || event == HCI_EV_CMD_STATUS ||
6339             event == HCI_EV_CMD_COMPLETE)
6340                 orig_skb = skb_clone(skb, GFP_KERNEL);
6341
6342         skb_pull(skb, HCI_EVENT_HDR_SIZE);
6343
6344         /* Store wake reason if we're suspended */
6345         hci_store_wake_reason(hdev, event, skb);
6346
6347         switch (event) {
6348         case HCI_EV_INQUIRY_COMPLETE:
6349                 hci_inquiry_complete_evt(hdev, skb);
6350                 break;
6351
6352         case HCI_EV_INQUIRY_RESULT:
6353                 hci_inquiry_result_evt(hdev, skb);
6354                 break;
6355
6356         case HCI_EV_CONN_COMPLETE:
6357                 hci_conn_complete_evt(hdev, skb);
6358                 break;
6359
6360         case HCI_EV_CONN_REQUEST:
6361                 hci_conn_request_evt(hdev, skb);
6362                 break;
6363
6364         case HCI_EV_DISCONN_COMPLETE:
6365                 hci_disconn_complete_evt(hdev, skb);
6366                 break;
6367
6368         case HCI_EV_AUTH_COMPLETE:
6369                 hci_auth_complete_evt(hdev, skb);
6370                 break;
6371
6372         case HCI_EV_REMOTE_NAME:
6373                 hci_remote_name_evt(hdev, skb);
6374                 break;
6375
6376         case HCI_EV_ENCRYPT_CHANGE:
6377                 hci_encrypt_change_evt(hdev, skb);
6378                 break;
6379
6380         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
6381                 hci_change_link_key_complete_evt(hdev, skb);
6382                 break;
6383
6384         case HCI_EV_REMOTE_FEATURES:
6385                 hci_remote_features_evt(hdev, skb);
6386                 break;
6387
6388         case HCI_EV_CMD_COMPLETE:
6389                 hci_cmd_complete_evt(hdev, skb, &opcode, &status,
6390                                      &req_complete, &req_complete_skb);
6391                 break;
6392
6393         case HCI_EV_CMD_STATUS:
6394                 hci_cmd_status_evt(hdev, skb, &opcode, &status, &req_complete,
6395                                    &req_complete_skb);
6396                 break;
6397
6398         case HCI_EV_HARDWARE_ERROR:
6399                 hci_hardware_error_evt(hdev, skb);
6400                 break;
6401
6402         case HCI_EV_ROLE_CHANGE:
6403                 hci_role_change_evt(hdev, skb);
6404                 break;
6405
6406         case HCI_EV_NUM_COMP_PKTS:
6407                 hci_num_comp_pkts_evt(hdev, skb);
6408                 break;
6409
6410         case HCI_EV_MODE_CHANGE:
6411                 hci_mode_change_evt(hdev, skb);
6412                 break;
6413
6414         case HCI_EV_PIN_CODE_REQ:
6415                 hci_pin_code_request_evt(hdev, skb);
6416                 break;
6417
6418         case HCI_EV_LINK_KEY_REQ:
6419                 hci_link_key_request_evt(hdev, skb);
6420                 break;
6421
6422         case HCI_EV_LINK_KEY_NOTIFY:
6423                 hci_link_key_notify_evt(hdev, skb);
6424                 break;
6425
6426         case HCI_EV_CLOCK_OFFSET:
6427                 hci_clock_offset_evt(hdev, skb);
6428                 break;
6429
6430         case HCI_EV_PKT_TYPE_CHANGE:
6431                 hci_pkt_type_change_evt(hdev, skb);
6432                 break;
6433
6434         case HCI_EV_PSCAN_REP_MODE:
6435                 hci_pscan_rep_mode_evt(hdev, skb);
6436                 break;
6437
6438         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
6439                 hci_inquiry_result_with_rssi_evt(hdev, skb);
6440                 break;
6441
6442         case HCI_EV_REMOTE_EXT_FEATURES:
6443                 hci_remote_ext_features_evt(hdev, skb);
6444                 break;
6445
6446         case HCI_EV_SYNC_CONN_COMPLETE:
6447                 hci_sync_conn_complete_evt(hdev, skb);
6448                 break;
6449
6450         case HCI_EV_EXTENDED_INQUIRY_RESULT:
6451                 hci_extended_inquiry_result_evt(hdev, skb);
6452                 break;
6453
6454         case HCI_EV_KEY_REFRESH_COMPLETE:
6455                 hci_key_refresh_complete_evt(hdev, skb);
6456                 break;
6457
6458         case HCI_EV_IO_CAPA_REQUEST:
6459                 hci_io_capa_request_evt(hdev, skb);
6460                 break;
6461
6462         case HCI_EV_IO_CAPA_REPLY:
6463                 hci_io_capa_reply_evt(hdev, skb);
6464                 break;
6465
6466         case HCI_EV_USER_CONFIRM_REQUEST:
6467                 hci_user_confirm_request_evt(hdev, skb);
6468                 break;
6469
6470         case HCI_EV_USER_PASSKEY_REQUEST:
6471                 hci_user_passkey_request_evt(hdev, skb);
6472                 break;
6473
6474         case HCI_EV_USER_PASSKEY_NOTIFY:
6475                 hci_user_passkey_notify_evt(hdev, skb);
6476                 break;
6477
6478         case HCI_EV_KEYPRESS_NOTIFY:
6479                 hci_keypress_notify_evt(hdev, skb);
6480                 break;
6481
6482         case HCI_EV_SIMPLE_PAIR_COMPLETE:
6483                 hci_simple_pair_complete_evt(hdev, skb);
6484                 break;
6485
6486         case HCI_EV_REMOTE_HOST_FEATURES:
6487                 hci_remote_host_features_evt(hdev, skb);
6488                 break;
6489
6490         case HCI_EV_LE_META:
6491                 hci_le_meta_evt(hdev, skb);
6492                 break;
6493
6494         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
6495                 hci_remote_oob_data_request_evt(hdev, skb);
6496                 break;
6497
6498 #if IS_ENABLED(CONFIG_BT_HS)
6499         case HCI_EV_CHANNEL_SELECTED:
6500                 hci_chan_selected_evt(hdev, skb);
6501                 break;
6502
6503         case HCI_EV_PHY_LINK_COMPLETE:
6504                 hci_phy_link_complete_evt(hdev, skb);
6505                 break;
6506
6507         case HCI_EV_LOGICAL_LINK_COMPLETE:
6508                 hci_loglink_complete_evt(hdev, skb);
6509                 break;
6510
6511         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
6512                 hci_disconn_loglink_complete_evt(hdev, skb);
6513                 break;
6514
6515         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
6516                 hci_disconn_phylink_complete_evt(hdev, skb);
6517                 break;
6518 #endif
6519
6520         case HCI_EV_NUM_COMP_BLOCKS:
6521                 hci_num_comp_blocks_evt(hdev, skb);
6522                 break;
6523
6524         case HCI_EV_VENDOR:
6525                 msft_vendor_evt(hdev, skb);
6526                 break;
6527
6528         default:
6529                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
6530                 break;
6531         }
6532
6533         if (req_complete) {
6534                 req_complete(hdev, status, opcode);
6535         } else if (req_complete_skb) {
6536                 if (!hci_get_cmd_complete(hdev, opcode, req_evt, orig_skb)) {
6537                         kfree_skb(orig_skb);
6538                         orig_skb = NULL;
6539                 }
6540                 req_complete_skb(hdev, status, opcode, orig_skb);
6541         }
6542
6543 done:
6544         kfree_skb(orig_skb);
6545         kfree_skb(skb);
6546         hdev->stat.evt_rx++;
6547 }