net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54 #ifdef CONFIG_TIZEN_WIP
  55         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  56 #else
  57         /* In latest kernel, smp_mb__after_clear_bit is replaced with
  58           * smp_mb__after_atomic. So, if kernel is migrated to latest,
  59           * then below code should be enabled
  60           */
  61         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  62 #endif
  63         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  64
  65         hci_dev_lock(hdev);
  66         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  67         hci_dev_unlock(hdev);
  68
  69         hci_conn_check_pending(hdev);
  70 }
  71
  72 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         __u8 status = *((__u8 *) skb->data);
  75
  76         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  77
  78         if (status)
  79                 return;
  80
  81         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  82 }
  83
  84 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  85 {
  86         __u8 status = *((__u8 *) skb->data);
  87
  88         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  89
  90         if (status)
  91                 return;
  92
  93         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  94
  95         hci_conn_check_pending(hdev);
  96 }
  97
  98 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  99                                           struct sk_buff *skb)
 100 {
 101         BT_DBG("%s", hdev->name);
 102 }
 103
 104 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 105 {
 106         struct hci_rp_role_discovery *rp = (void *) skb->data;
 107         struct hci_conn *conn;
 108
 109         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 110
 111         if (rp->status)
 112                 return;
 113
 114         hci_dev_lock(hdev);
 115
 116         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 117         if (conn)
 118                 conn->role = rp->role;
 119
 120         hci_dev_unlock(hdev);
 121 }
 122
 123 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 124 {
 125         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 126         struct hci_conn *conn;
 127
 128         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 129
 130         if (rp->status)
 131                 return;
 132
 133         hci_dev_lock(hdev);
 134
 135         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 136         if (conn)
 137                 conn->link_policy = __le16_to_cpu(rp->policy);
 138
 139         hci_dev_unlock(hdev);
 140 }
 141
 142 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 143 {
 144         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 145 #ifdef CONFIG_TIZEN_WIP
 146         struct hci_cp_write_link_policy cp;
 147         struct hci_conn *sco_conn;
 148 #endif
 149         struct hci_conn *conn;
 150         void *sent;
 151
 152         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 153
 154         if (rp->status)
 155                 return;
 156
 157         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 158         if (!sent)
 159                 return;
 160
 161         hci_dev_lock(hdev);
 162
 163         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 164         if (conn)
 165                 conn->link_policy = get_unaligned_le16(sent + 2);
 166 #ifdef CONFIG_TIZEN_WIP
 167         sco_conn = hci_conn_hash_lookup_sco(hdev);
 168         if (sco_conn && conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 169                         conn->link_policy & HCI_LP_SNIFF) {
 170                 BT_ERR("SNIFF is not allowed during sco connection");
 171                 cp.handle = __cpu_to_le16(conn->handle);
 172                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 173                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 174         }
 175 #endif
 176
 177         hci_dev_unlock(hdev);
 178 }
 179
 180 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 181                                         struct sk_buff *skb)
 182 {
 183         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 186
 187         if (rp->status)
 188                 return;
 189
 190         hdev->link_policy = __le16_to_cpu(rp->policy);
 191 }
 192
 193 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 194                                          struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197         void *sent;
 198
 199         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 200
 201         if (status)
 202                 return;
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 205         if (!sent)
 206                 return;
 207
 208         hdev->link_policy = get_unaligned_le16(sent);
 209 }
 210
 211 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 212 {
 213         __u8 status = *((__u8 *) skb->data);
 214
 215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 216
 217         clear_bit(HCI_RESET, &hdev->flags);
 218
 219         if (status)
 220                 return;
 221
 222         /* Reset all non-persistent flags */
 223         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 224
 225         hdev->discovery.state = DISCOVERY_STOPPED;
 226         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230         hdev->adv_data_len = 0;
 231
 232         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233         hdev->scan_rsp_data_len = 0;
 234
 235         hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237         hdev->ssp_debug_mode = 0;
 238
 239         hci_bdaddr_list_clear(&hdev->le_white_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 307             test_bit(HCI_CONFIG, &hdev->dev_flags))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 526                 else
 527                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!test_bit(HCI_MGMT, &hdev->dev_flags) && !status) {
 554                 if (sent->support)
 555                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 556                 else
 557                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 573             test_bit(HCI_CONFIG, &hdev->dev_flags)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 593             test_bit(HCI_CONFIG, &hdev->dev_flags))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 goto a2mp_rsp;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859
 860 a2mp_rsp:
 861         a2mp_send_getinfo_rsp(hdev);
 862 }
 863
 864 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 865                                         struct sk_buff *skb)
 866 {
 867         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 868         struct amp_assoc *assoc = &hdev->loc_assoc;
 869         size_t rem_len, frag_len;
 870
 871         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 872
 873         if (rp->status)
 874                 goto a2mp_rsp;
 875
 876         frag_len = skb->len - sizeof(*rp);
 877         rem_len = __le16_to_cpu(rp->rem_len);
 878
 879         if (rem_len > frag_len) {
 880                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 881
 882                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 883                 assoc->offset += frag_len;
 884
 885                 /* Read other fragments */
 886                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 887
 888                 return;
 889         }
 890
 891         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 892         assoc->len = assoc->offset + rem_len;
 893         assoc->offset = 0;
 894
 895 a2mp_rsp:
 896         /* Send A2MP Rsp when all fragments are received */
 897         a2mp_send_getampassoc_rsp(hdev, rp->status);
 898         a2mp_send_create_phy_link_req(hdev, rp->status);
 899 }
 900
 901 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 902                                          struct sk_buff *skb)
 903 {
 904         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         if (rp->status)
 909                 return;
 910
 911         hdev->inq_tx_power = rp->tx_power;
 912 }
 913
 914 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 915 {
 916         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 917         struct hci_cp_pin_code_reply *cp;
 918         struct hci_conn *conn;
 919
 920         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 921
 922         hci_dev_lock(hdev);
 923
 924         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 925                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 926
 927         if (rp->status)
 928                 goto unlock;
 929
 930         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 931         if (!cp)
 932                 goto unlock;
 933
 934         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 935         if (conn)
 936                 conn->pin_length = cp->pin_len;
 937
 938 unlock:
 939         hci_dev_unlock(hdev);
 940 }
 941
 942 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 945
 946         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 947
 948         hci_dev_lock(hdev);
 949
 950         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 951                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 952                                                  rp->status);
 953
 954         hci_dev_unlock(hdev);
 955 }
 956
 957 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 958                                        struct sk_buff *skb)
 959 {
 960         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 961
 962         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 963
 964         if (rp->status)
 965                 return;
 966
 967         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 968         hdev->le_pkts = rp->le_max_pkt;
 969
 970         hdev->le_cnt = hdev->le_pkts;
 971
 972         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 973 }
 974
 975 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 976                                           struct sk_buff *skb)
 977 {
 978         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 979
 980         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 981
 982         if (rp->status)
 983                 return;
 984
 985         memcpy(hdev->le_features, rp->features, 8);
 986 }
 987
 988 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 989                                         struct sk_buff *skb)
 990 {
 991         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 992
 993         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 994
 995         if (rp->status)
 996                 return;
 997
 998         hdev->adv_tx_power = rp->tx_power;
 999 }
1000
1001 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1002 {
1003         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1004
1005         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1006
1007         hci_dev_lock(hdev);
1008
1009         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1010                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1011                                                  rp->status);
1012
1013         hci_dev_unlock(hdev);
1014 }
1015
1016 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1017                                           struct sk_buff *skb)
1018 {
1019         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022
1023         hci_dev_lock(hdev);
1024
1025         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1026                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1027                                                      ACL_LINK, 0, rp->status);
1028
1029         hci_dev_unlock(hdev);
1030 }
1031
1032 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1033 {
1034         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037
1038         hci_dev_lock(hdev);
1039
1040         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1041                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1042                                                  0, rp->status);
1043
1044         hci_dev_unlock(hdev);
1045 }
1046
1047 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1048                                           struct sk_buff *skb)
1049 {
1050         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1051
1052         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1053
1054         hci_dev_lock(hdev);
1055
1056         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1057                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1058                                                      ACL_LINK, 0, rp->status);
1059
1060         hci_dev_unlock(hdev);
1061 }
1062
1063 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1064                                        struct sk_buff *skb)
1065 {
1066         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1067
1068         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1069
1070         hci_dev_lock(hdev);
1071         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
1072                                           rp->status);
1073         hci_dev_unlock(hdev);
1074 }
1075
1076 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1077                                            struct sk_buff *skb)
1078 {
1079         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1080
1081         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1082
1083         hci_dev_lock(hdev);
1084         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1085                                           rp->hash256, rp->rand256,
1086                                           rp->status);
1087         hci_dev_unlock(hdev);
1088 }
1089
1090
1091 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1092 {
1093         __u8 status = *((__u8 *) skb->data);
1094         bdaddr_t *sent;
1095
1096         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1097
1098         if (status)
1099                 return;
1100
1101         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1102         if (!sent)
1103                 return;
1104
1105         hci_dev_lock(hdev);
1106
1107         bacpy(&hdev->random_addr, sent);
1108
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1113 {
1114         __u8 *sent, status = *((__u8 *) skb->data);
1115
1116         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1117
1118         if (status)
1119                 return;
1120
1121         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1122         if (!sent)
1123                 return;
1124
1125         hci_dev_lock(hdev);
1126
1127         /* If we're doing connection initiation as peripheral. Set a
1128          * timeout in case something goes wrong.
1129          */
1130         if (*sent) {
1131                 struct hci_conn *conn;
1132
1133                 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1134
1135                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1136                 if (conn)
1137                         queue_delayed_work(hdev->workqueue,
1138                                            &conn->le_conn_timeout,
1139                                            conn->conn_timeout);
1140         } else {
1141                 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1142         }
1143
1144         hci_dev_unlock(hdev);
1145 }
1146
1147 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_scan_param *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         hdev->le_scan_type = cp->type;
1164
1165         hci_dev_unlock(hdev);
1166 }
1167
1168 static bool has_pending_adv_report(struct hci_dev *hdev)
1169 {
1170         struct discovery_state *d = &hdev->discovery;
1171
1172         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1173 }
1174
1175 static void clear_pending_adv_report(struct hci_dev *hdev)
1176 {
1177         struct discovery_state *d = &hdev->discovery;
1178
1179         bacpy(&d->last_adv_addr, BDADDR_ANY);
1180         d->last_adv_data_len = 0;
1181 }
1182
1183 #ifndef CONFIG_TIZEN_WIP
1184 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1185                                      u8 bdaddr_type, s8 rssi, u32 flags,
1186                                      u8 *data, u8 len)
1187 {
1188         struct discovery_state *d = &hdev->discovery;
1189
1190         bacpy(&d->last_adv_addr, bdaddr);
1191         d->last_adv_addr_type = bdaddr_type;
1192         d->last_adv_rssi = rssi;
1193         d->last_adv_flags = flags;
1194         memcpy(d->last_adv_data, data, len);
1195         d->last_adv_data_len = len;
1196 }
1197 #endif
1198
1199 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1200                                       struct sk_buff *skb)
1201 {
1202         struct hci_cp_le_set_scan_enable *cp;
1203         __u8 status = *((__u8 *) skb->data);
1204
1205         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1206
1207         if (status)
1208                 return;
1209
1210         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1211         if (!cp)
1212                 return;
1213
1214         hci_dev_lock(hdev);
1215
1216         switch (cp->enable) {
1217         case LE_SCAN_ENABLE:
1218                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1219                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1220                         clear_pending_adv_report(hdev);
1221                 break;
1222
1223         case LE_SCAN_DISABLE:
1224                 /* We do this here instead of when setting DISCOVERY_STOPPED
1225                  * since the latter would potentially require waiting for
1226                  * inquiry to stop too.
1227                  */
1228                 if (has_pending_adv_report(hdev)) {
1229                         struct discovery_state *d = &hdev->discovery;
1230
1231                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1232                                           d->last_adv_addr_type, NULL,
1233                                           d->last_adv_rssi, d->last_adv_flags,
1234                                           d->last_adv_data,
1235                                           d->last_adv_data_len, NULL, 0);
1236                 }
1237
1238                 /* Cancel this timer so that we don't try to disable scanning
1239                  * when it's already disabled.
1240                  */
1241                 cancel_delayed_work(&hdev->le_scan_disable);
1242
1243                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1244
1245                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1246                  * interrupted scanning due to a connect request. Mark
1247                  * therefore discovery as stopped. If this was not
1248                  * because of a connect request advertising might have
1249                  * been disabled because of active scanning, so
1250                  * re-enable it again if necessary.
1251                  */
1252                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1253                                        &hdev->dev_flags))
1254 #ifndef CONFIG_TIZEN_WIP /* The below line is kernel bug. */
1255                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1256 #else
1257                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1258 #endif
1259                 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
1260                          hdev->discovery.state == DISCOVERY_FINDING)
1261                         mgmt_reenable_advertising(hdev);
1262
1263                 break;
1264
1265         default:
1266                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1267                 break;
1268         }
1269
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1274                                            struct sk_buff *skb)
1275 {
1276         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1277
1278         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1279
1280         if (rp->status)
1281                 return;
1282
1283         hdev->le_white_list_size = rp->size;
1284 }
1285
1286 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1287                                        struct sk_buff *skb)
1288 {
1289         __u8 status = *((__u8 *) skb->data);
1290
1291         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1292
1293         if (status)
1294                 return;
1295
1296         hci_bdaddr_list_clear(&hdev->le_white_list);
1297 }
1298
1299 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1300                                         struct sk_buff *skb)
1301 {
1302         struct hci_cp_le_add_to_white_list *sent;
1303         __u8 status = *((__u8 *) skb->data);
1304
1305         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1306
1307         if (status)
1308                 return;
1309
1310         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1311         if (!sent)
1312                 return;
1313
1314         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1315                            sent->bdaddr_type);
1316 }
1317
1318 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1319                                           struct sk_buff *skb)
1320 {
1321         struct hci_cp_le_del_from_white_list *sent;
1322         __u8 status = *((__u8 *) skb->data);
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (status)
1327                 return;
1328
1329         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1330         if (!sent)
1331                 return;
1332
1333         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1334                             sent->bdaddr_type);
1335 }
1336
1337 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1338                                             struct sk_buff *skb)
1339 {
1340         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1343
1344         if (rp->status)
1345                 return;
1346
1347         memcpy(hdev->le_states, rp->le_states, 8);
1348 }
1349
1350 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1351                                         struct sk_buff *skb)
1352 {
1353         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1354
1355         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1356
1357 #ifdef CONFIG_TIZEN_WIP
1358         hci_dev_lock(hdev);
1359 #else
1360         if (rp->status)
1361                 return;
1362 #endif
1363
1364         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1365         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1366
1367 #ifdef CONFIG_TIZEN_WIP
1368         mgmt_le_read_host_suggested_data_length_complete(hdev, rp->status);
1369
1370         hci_dev_unlock(hdev);
1371 #endif
1372 }
1373
1374 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1375                                          struct sk_buff *skb)
1376 {
1377         struct hci_cp_le_write_def_data_len *sent;
1378         __u8 status = *((__u8 *) skb->data);
1379
1380         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1381
1382         if (status)
1383 #ifndef CONFIG_TIZEN_WIP
1384                 return;
1385 #else
1386                 goto unblock;
1387 #endif
1388
1389         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1390         if (!sent)
1391 #ifndef CONFIG_TIZEN_WIP
1392                 return;
1393 #else
1394                 goto unblock;
1395 #endif
1396
1397         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1398         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1399
1400 #ifdef CONFIG_TIZEN_WIP
1401 unblock:
1402         mgmt_le_write_host_suggested_data_length_complete(hdev, status);
1403 #endif
1404 }
1405
1406 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1407                                         struct sk_buff *skb)
1408 {
1409         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1410
1411         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1412
1413 #ifndef CONFIG_TIZEN_WIP
1414         if (rp->status)
1415                 return;
1416 #else
1417         hci_dev_lock(hdev);
1418 #endif
1419
1420         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1421         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1422         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1423         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1424
1425 #ifdef CONFIG_TIZEN_WIP
1426         mgmt_le_read_maximum_data_length_complete(hdev, rp->status);
1427         hci_dev_unlock(hdev);
1428 #endif
1429 }
1430
1431 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1432                                            struct sk_buff *skb)
1433 {
1434         struct hci_cp_write_le_host_supported *sent;
1435         __u8 status = *((__u8 *) skb->data);
1436
1437         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1438
1439         if (status)
1440                 return;
1441
1442         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1443         if (!sent)
1444                 return;
1445
1446         hci_dev_lock(hdev);
1447
1448         if (sent->le) {
1449                 hdev->features[1][0] |= LMP_HOST_LE;
1450                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1451         } else {
1452                 hdev->features[1][0] &= ~LMP_HOST_LE;
1453                 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1454                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1455         }
1456
1457         if (sent->simul)
1458                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1459         else
1460                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1461
1462         hci_dev_unlock(hdev);
1463 }
1464
1465 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1466 {
1467         struct hci_cp_le_set_adv_param *cp;
1468         u8 status = *((u8 *) skb->data);
1469
1470         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1471
1472         if (status)
1473                 return;
1474
1475         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1476         if (!cp)
1477                 return;
1478
1479         hci_dev_lock(hdev);
1480         hdev->adv_addr_type = cp->own_address_type;
1481         hci_dev_unlock(hdev);
1482 }
1483
1484 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1485                                           struct sk_buff *skb)
1486 {
1487         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1488
1489         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1490                hdev->name, rp->status, rp->phy_handle);
1491
1492         if (rp->status)
1493                 return;
1494
1495         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1496 }
1497 #ifdef CONFIG_TIZEN_WIP
1498 /* BEGIN TIZEN_Bluetooth :: Handle RSSI monitoring */
1499 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1500                                           struct sk_buff *skb)
1501 {
1502         struct hci_cc_rsp_enable_rssi *rp = (void *) skb->data;
1503
1504         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1505                hdev->name, rp->status, rp->le_ext_opcode);
1506
1507         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1508 }
1509
1510 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1511                                           struct sk_buff *skb)
1512 {
1513         struct hci_cc_rp_get_raw_rssi *rp = (void *) skb->data;
1514
1515         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1516                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1517
1518         mgmt_raw_rssi_response(hdev, rp, rp->status);
1519 }
1520 /* END TIZEN_Bluetooth :: Handle RSSI monitoring */
1521 #endif
1522 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1523 {
1524         struct hci_rp_read_rssi *rp = (void *) skb->data;
1525         struct hci_conn *conn;
1526
1527         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1528
1529         if (rp->status)
1530                 return;
1531
1532         hci_dev_lock(hdev);
1533
1534         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1535         if (conn)
1536                 conn->rssi = rp->rssi;
1537
1538         hci_dev_unlock(hdev);
1539 }
1540
1541 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1542 {
1543         struct hci_cp_read_tx_power *sent;
1544         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1545         struct hci_conn *conn;
1546
1547         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1548
1549         if (rp->status)
1550                 return;
1551
1552         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1553         if (!sent)
1554                 return;
1555
1556         hci_dev_lock(hdev);
1557
1558         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1559         if (!conn)
1560                 goto unlock;
1561
1562         switch (sent->type) {
1563         case 0x00:
1564                 conn->tx_power = rp->tx_power;
1565                 break;
1566         case 0x01:
1567                 conn->max_tx_power = rp->tx_power;
1568                 break;
1569         }
1570
1571 unlock:
1572         hci_dev_unlock(hdev);
1573 }
1574
1575 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1576 {
1577         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1578
1579         if (status) {
1580                 hci_conn_check_pending(hdev);
1581                 return;
1582         }
1583
1584         set_bit(HCI_INQUIRY, &hdev->flags);
1585 }
1586
1587 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1588 {
1589         struct hci_cp_create_conn *cp;
1590         struct hci_conn *conn;
1591
1592         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1593
1594         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1595         if (!cp)
1596                 return;
1597
1598         hci_dev_lock(hdev);
1599
1600         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1601
1602         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1603
1604         if (status) {
1605 #ifdef CONFIG_TIZEN_WIP
1606                 if (status == 0x0b)
1607                         BT_ERR("ACL Connection Already Exists on cs_create_con");
1608
1609                 if (conn && conn->state == BT_CONNECT && status != 0x0b) {
1610 #else
1611                 if (conn && conn->state == BT_CONNECT) {
1612 #endif
1613                         if (status != 0x0c || conn->attempt > 2) {
1614                                 conn->state = BT_CLOSED;
1615                                 hci_proto_connect_cfm(conn, status);
1616                                 hci_conn_del(conn);
1617                         } else
1618                                 conn->state = BT_CONNECT2;
1619                 }
1620         } else {
1621                 if (!conn) {
1622                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1623                                             HCI_ROLE_MASTER);
1624                         if (!conn)
1625                                 BT_ERR("No memory for new connection");
1626                 }
1627         }
1628
1629         hci_dev_unlock(hdev);
1630 }
1631
1632 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1633 {
1634         struct hci_cp_add_sco *cp;
1635         struct hci_conn *acl, *sco;
1636         __u16 handle;
1637
1638         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1639
1640         if (!status)
1641                 return;
1642
1643         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1644         if (!cp)
1645                 return;
1646
1647         handle = __le16_to_cpu(cp->handle);
1648
1649         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1650
1651         hci_dev_lock(hdev);
1652
1653         acl = hci_conn_hash_lookup_handle(hdev, handle);
1654         if (acl) {
1655                 sco = acl->link;
1656                 if (sco) {
1657                         sco->state = BT_CLOSED;
1658
1659                         hci_proto_connect_cfm(sco, status);
1660                         hci_conn_del(sco);
1661                 }
1662         }
1663
1664         hci_dev_unlock(hdev);
1665 }
1666
1667 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1668 {
1669         struct hci_cp_auth_requested *cp;
1670         struct hci_conn *conn;
1671
1672         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1673
1674         if (!status)
1675                 return;
1676
1677         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1678         if (!cp)
1679                 return;
1680
1681         hci_dev_lock(hdev);
1682
1683         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1684         if (conn) {
1685                 if (conn->state == BT_CONFIG) {
1686                         hci_proto_connect_cfm(conn, status);
1687                         hci_conn_drop(conn);
1688                 }
1689         }
1690
1691         hci_dev_unlock(hdev);
1692 }
1693
1694 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1695 {
1696         struct hci_cp_set_conn_encrypt *cp;
1697         struct hci_conn *conn;
1698
1699         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1700
1701         if (!status)
1702                 return;
1703
1704         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1705         if (!cp)
1706                 return;
1707
1708         hci_dev_lock(hdev);
1709
1710         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1711         if (conn) {
1712                 if (conn->state == BT_CONFIG) {
1713                         hci_proto_connect_cfm(conn, status);
1714                         hci_conn_drop(conn);
1715                 }
1716         }
1717
1718         hci_dev_unlock(hdev);
1719 }
1720
1721 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1722                                     struct hci_conn *conn)
1723 {
1724         if (conn->state != BT_CONFIG || !conn->out)
1725                 return 0;
1726
1727         if (conn->pending_sec_level == BT_SECURITY_SDP)
1728                 return 0;
1729
1730         /* Only request authentication for SSP connections or non-SSP
1731          * devices with sec_level MEDIUM or HIGH or if MITM protection
1732          * is requested.
1733          */
1734         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1735             conn->pending_sec_level != BT_SECURITY_FIPS &&
1736             conn->pending_sec_level != BT_SECURITY_HIGH &&
1737             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1738                 return 0;
1739
1740         return 1;
1741 }
1742
1743 static int hci_resolve_name(struct hci_dev *hdev,
1744                                    struct inquiry_entry *e)
1745 {
1746         struct hci_cp_remote_name_req cp;
1747
1748         memset(&cp, 0, sizeof(cp));
1749
1750         bacpy(&cp.bdaddr, &e->data.bdaddr);
1751         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1752         cp.pscan_mode = e->data.pscan_mode;
1753         cp.clock_offset = e->data.clock_offset;
1754
1755         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1756 }
1757
1758 static bool hci_resolve_next_name(struct hci_dev *hdev)
1759 {
1760         struct discovery_state *discov = &hdev->discovery;
1761         struct inquiry_entry *e;
1762
1763         if (list_empty(&discov->resolve))
1764                 return false;
1765
1766         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1767         if (!e)
1768                 return false;
1769
1770         if (hci_resolve_name(hdev, e) == 0) {
1771                 e->name_state = NAME_PENDING;
1772                 return true;
1773         }
1774
1775         return false;
1776 }
1777
1778 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1779                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1780 {
1781         struct discovery_state *discov = &hdev->discovery;
1782         struct inquiry_entry *e;
1783
1784 /* BEGIN TIZEN_Bluetooth :: name update changes */
1785 #ifdef CONFIG_TIZEN_WIP
1786         /* Update the mgmt connected state if necessary. Be careful with
1787         * conn objects that exist but are not (yet) connected however.
1788         * Only those in BT_CONFIG or BT_CONNECTED states can be
1789         * considered connected.
1790         */
1791         if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1792                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1793                         mgmt_device_connected(hdev, conn, 0, name, name_len);
1794                 else
1795                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
1796         }
1797
1798 #else
1799         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1800                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1801 /* END TIZEN_Bluetooth :: name update changes */
1802 #endif
1803         if (discov->state == DISCOVERY_STOPPED)
1804                 return;
1805
1806         if (discov->state == DISCOVERY_STOPPING)
1807                 goto discov_complete;
1808
1809         if (discov->state != DISCOVERY_RESOLVING)
1810                 return;
1811
1812         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1813         /* If the device was not found in a list of found devices names of which
1814          * are pending. there is no need to continue resolving a next name as it
1815          * will be done upon receiving another Remote Name Request Complete
1816          * Event */
1817         if (!e)
1818                 return;
1819
1820         list_del(&e->list);
1821         if (name) {
1822                 e->name_state = NAME_KNOWN;
1823                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1824                                  e->data.rssi, name, name_len);
1825         } else {
1826                 e->name_state = NAME_NOT_KNOWN;
1827         }
1828
1829         if (hci_resolve_next_name(hdev))
1830                 return;
1831
1832 discov_complete:
1833         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1834 }
1835
1836 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1837 {
1838         struct hci_cp_remote_name_req *cp;
1839         struct hci_conn *conn;
1840
1841         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1842
1843         /* If successful wait for the name req complete event before
1844          * checking for the need to do authentication */
1845         if (!status)
1846                 return;
1847
1848         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1849         if (!cp)
1850                 return;
1851
1852         hci_dev_lock(hdev);
1853
1854         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1855
1856         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1857                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1858
1859         if (!conn)
1860                 goto unlock;
1861
1862         if (!hci_outgoing_auth_needed(hdev, conn))
1863                 goto unlock;
1864
1865         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1866                 struct hci_cp_auth_requested auth_cp;
1867
1868                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1869
1870                 auth_cp.handle = __cpu_to_le16(conn->handle);
1871                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1872                              sizeof(auth_cp), &auth_cp);
1873         }
1874
1875 unlock:
1876         hci_dev_unlock(hdev);
1877 }
1878
1879 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1880 {
1881         struct hci_cp_read_remote_features *cp;
1882         struct hci_conn *conn;
1883
1884         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1885
1886         if (!status)
1887                 return;
1888
1889         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1890         if (!cp)
1891                 return;
1892
1893         hci_dev_lock(hdev);
1894
1895         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1896         if (conn) {
1897                 if (conn->state == BT_CONFIG) {
1898                         hci_proto_connect_cfm(conn, status);
1899                         hci_conn_drop(conn);
1900                 }
1901         }
1902
1903         hci_dev_unlock(hdev);
1904 }
1905
1906 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1907 {
1908         struct hci_cp_read_remote_ext_features *cp;
1909         struct hci_conn *conn;
1910
1911         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1912
1913         if (!status)
1914                 return;
1915
1916         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1917         if (!cp)
1918                 return;
1919
1920         hci_dev_lock(hdev);
1921
1922         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1923         if (conn) {
1924                 if (conn->state == BT_CONFIG) {
1925                         hci_proto_connect_cfm(conn, status);
1926                         hci_conn_drop(conn);
1927                 }
1928         }
1929
1930         hci_dev_unlock(hdev);
1931 }
1932
1933 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1934 {
1935         struct hci_cp_setup_sync_conn *cp;
1936         struct hci_conn *acl, *sco;
1937         __u16 handle;
1938
1939         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1940
1941         if (!status)
1942                 return;
1943
1944         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1945         if (!cp)
1946                 return;
1947
1948         handle = __le16_to_cpu(cp->handle);
1949
1950         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1951
1952         hci_dev_lock(hdev);
1953
1954         acl = hci_conn_hash_lookup_handle(hdev, handle);
1955         if (acl) {
1956                 sco = acl->link;
1957                 if (sco) {
1958                         sco->state = BT_CLOSED;
1959
1960                         hci_proto_connect_cfm(sco, status);
1961                         hci_conn_del(sco);
1962                 }
1963         }
1964
1965         hci_dev_unlock(hdev);
1966 }
1967
1968 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1969 {
1970         struct hci_cp_sniff_mode *cp;
1971         struct hci_conn *conn;
1972
1973         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1974
1975         if (!status)
1976                 return;
1977
1978         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1979         if (!cp)
1980                 return;
1981
1982         hci_dev_lock(hdev);
1983
1984         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1985         if (conn) {
1986                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1987
1988                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1989                         hci_sco_setup(conn, status);
1990         }
1991
1992         hci_dev_unlock(hdev);
1993 }
1994
1995 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1996 {
1997         struct hci_cp_exit_sniff_mode *cp;
1998         struct hci_conn *conn;
1999
2000         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2001
2002         if (!status)
2003                 return;
2004
2005         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
2006         if (!cp)
2007                 return;
2008
2009         hci_dev_lock(hdev);
2010
2011         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2012         if (conn) {
2013                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2014
2015                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2016                         hci_sco_setup(conn, status);
2017         }
2018
2019         hci_dev_unlock(hdev);
2020 }
2021
2022 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2023 {
2024         struct hci_cp_disconnect *cp;
2025         struct hci_conn *conn;
2026
2027         if (!status)
2028                 return;
2029
2030         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2031         if (!cp)
2032                 return;
2033
2034         hci_dev_lock(hdev);
2035
2036         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2037         if (conn)
2038                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2039                                        conn->dst_type, status);
2040
2041         hci_dev_unlock(hdev);
2042 }
2043
2044 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
2045 {
2046         struct hci_cp_create_phy_link *cp;
2047
2048         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2049
2050         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
2051         if (!cp)
2052                 return;
2053
2054         hci_dev_lock(hdev);
2055
2056         if (status) {
2057                 struct hci_conn *hcon;
2058
2059                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
2060                 if (hcon)
2061                         hci_conn_del(hcon);
2062         } else {
2063                 amp_write_remote_assoc(hdev, cp->phy_handle);
2064         }
2065
2066         hci_dev_unlock(hdev);
2067 }
2068
2069 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
2070 {
2071         struct hci_cp_accept_phy_link *cp;
2072
2073         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2074
2075         if (status)
2076                 return;
2077
2078         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
2079         if (!cp)
2080                 return;
2081
2082         amp_write_remote_assoc(hdev, cp->phy_handle);
2083 }
2084
2085 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2086 {
2087         struct hci_cp_le_create_conn *cp;
2088         struct hci_conn *conn;
2089
2090         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2091
2092         /* All connection failure handling is taken care of by the
2093          * hci_le_conn_failed function which is triggered by the HCI
2094          * request completion callbacks used for connecting.
2095          */
2096         if (status)
2097                 return;
2098
2099         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2100         if (!cp)
2101                 return;
2102
2103         hci_dev_lock(hdev);
2104
2105         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2106         if (!conn)
2107                 goto unlock;
2108
2109         /* Store the initiator and responder address information which
2110          * is needed for SMP. These values will not change during the
2111          * lifetime of the connection.
2112          */
2113         conn->init_addr_type = cp->own_address_type;
2114         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2115                 bacpy(&conn->init_addr, &hdev->random_addr);
2116         else
2117                 bacpy(&conn->init_addr, &hdev->bdaddr);
2118
2119         conn->resp_addr_type = cp->peer_addr_type;
2120         bacpy(&conn->resp_addr, &cp->peer_addr);
2121
2122         /* We don't want the connection attempt to stick around
2123          * indefinitely since LE doesn't have a page timeout concept
2124          * like BR/EDR. Set a timer for any connection that doesn't use
2125          * the white list for connecting.
2126          */
2127         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2128                 queue_delayed_work(conn->hdev->workqueue,
2129                                    &conn->le_conn_timeout,
2130                                    conn->conn_timeout);
2131
2132 unlock:
2133         hci_dev_unlock(hdev);
2134 }
2135
2136 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2137 {
2138         struct hci_cp_le_start_enc *cp;
2139         struct hci_conn *conn;
2140
2141         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2142
2143         if (!status)
2144                 return;
2145
2146         hci_dev_lock(hdev);
2147
2148         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2149         if (!cp)
2150                 goto unlock;
2151
2152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2153         if (!conn)
2154                 goto unlock;
2155
2156         if (conn->state != BT_CONNECTED)
2157                 goto unlock;
2158
2159         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2160         hci_conn_drop(conn);
2161
2162 unlock:
2163         hci_dev_unlock(hdev);
2164 }
2165
2166 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2167 {
2168         struct hci_cp_switch_role *cp;
2169         struct hci_conn *conn;
2170
2171         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2172
2173         if (!status)
2174                 return;
2175
2176         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2177         if (!cp)
2178                 return;
2179
2180         hci_dev_lock(hdev);
2181
2182         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2183         if (conn)
2184                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2185
2186         hci_dev_unlock(hdev);
2187 }
2188
2189 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2190 {
2191         __u8 status = *((__u8 *) skb->data);
2192         struct discovery_state *discov = &hdev->discovery;
2193         struct inquiry_entry *e;
2194
2195         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2196
2197         hci_conn_check_pending(hdev);
2198
2199         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2200                 return;
2201
2202 #ifdef CONFIG_TIZEN_WIP
2203         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
2204 #else
2205         /* In latest kernel, smp_mb__after_clear_bit is replaced with
2206           * smp_mb__after_atomic. So, if kernel is migrated to latest,
2207           * then below code should be enabled
2208           */
2209         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2210 #endif
2211         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2212
2213         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2214                 return;
2215
2216         hci_dev_lock(hdev);
2217
2218         if (discov->state != DISCOVERY_FINDING)
2219                 goto unlock;
2220
2221         if (list_empty(&discov->resolve)) {
2222                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2223                 goto unlock;
2224         }
2225
2226         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2227         if (e && hci_resolve_name(hdev, e) == 0) {
2228                 e->name_state = NAME_PENDING;
2229                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2230         } else {
2231                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2232         }
2233
2234 unlock:
2235         hci_dev_unlock(hdev);
2236 }
2237
2238 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2239 {
2240         struct inquiry_data data;
2241         struct inquiry_info *info = (void *) (skb->data + 1);
2242         int num_rsp = *((__u8 *) skb->data);
2243
2244         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2245
2246         if (!num_rsp)
2247                 return;
2248
2249         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2250                 return;
2251
2252         hci_dev_lock(hdev);
2253
2254         for (; num_rsp; num_rsp--, info++) {
2255                 u32 flags;
2256
2257                 bacpy(&data.bdaddr, &info->bdaddr);
2258                 data.pscan_rep_mode     = info->pscan_rep_mode;
2259                 data.pscan_period_mode  = info->pscan_period_mode;
2260                 data.pscan_mode         = info->pscan_mode;
2261                 memcpy(data.dev_class, info->dev_class, 3);
2262                 data.clock_offset       = info->clock_offset;
2263                 data.rssi               = HCI_RSSI_INVALID;
2264                 data.ssp_mode           = 0x00;
2265
2266                 flags = hci_inquiry_cache_update(hdev, &data, false);
2267
2268                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2269                                   info->dev_class, HCI_RSSI_INVALID,
2270                                   flags, NULL, 0, NULL, 0);
2271         }
2272
2273         hci_dev_unlock(hdev);
2274 }
2275
2276 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2277 {
2278         struct hci_ev_conn_complete *ev = (void *) skb->data;
2279         struct hci_conn *conn;
2280
2281         BT_DBG("%s", hdev->name);
2282
2283         hci_dev_lock(hdev);
2284
2285         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2286         if (!conn) {
2287                 if (ev->link_type != SCO_LINK)
2288                         goto unlock;
2289
2290                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2291                 if (!conn)
2292                         goto unlock;
2293
2294                 conn->type = SCO_LINK;
2295         }
2296
2297         if (!ev->status) {
2298                 conn->handle = __le16_to_cpu(ev->handle);
2299
2300                 if (conn->type == ACL_LINK) {
2301                         conn->state = BT_CONFIG;
2302                         hci_conn_hold(conn);
2303
2304                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2305                             !hci_find_link_key(hdev, &ev->bdaddr))
2306                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2307                         else
2308                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2309                 } else
2310                         conn->state = BT_CONNECTED;
2311
2312                 hci_debugfs_create_conn(conn);
2313                 hci_conn_add_sysfs(conn);
2314
2315                 if (test_bit(HCI_AUTH, &hdev->flags))
2316                         set_bit(HCI_CONN_AUTH, &conn->flags);
2317
2318                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2319                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2320
2321                 /* Get remote features */
2322                 if (conn->type == ACL_LINK) {
2323                         struct hci_cp_read_remote_features cp;
2324                         cp.handle = ev->handle;
2325                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2326                                      sizeof(cp), &cp);
2327
2328                         hci_update_page_scan(hdev);
2329                 }
2330
2331                 /* Set packet type for incoming connection */
2332                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2333                         struct hci_cp_change_conn_ptype cp;
2334                         cp.handle = ev->handle;
2335                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2336                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2337                                      &cp);
2338                 }
2339
2340 #ifdef CONFIG_TIZEN_WIP
2341                 if ((get_link_mode(conn)) & HCI_LM_MASTER)
2342                         hci_conn_change_supervision_timeout(conn,
2343                                                 LINK_SUPERVISION_TIMEOUT);
2344         } else if (ev->status == 0x0b) {
2345                 BT_ERR("ACL connection already exists, this evt is ignored");
2346 #endif
2347         } else {
2348                 conn->state = BT_CLOSED;
2349                 if (conn->type == ACL_LINK)
2350                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2351                                             conn->dst_type, ev->status);
2352         }
2353
2354         if (conn->type == ACL_LINK)
2355                 hci_sco_setup(conn, ev->status);
2356
2357 #ifdef CONFIG_TIZEN_WIP
2358         if (ev->status && ev->status != 0x0b) {
2359 #else
2360         if (ev->status) {
2361 #endif
2362                 hci_proto_connect_cfm(conn, ev->status);
2363                 hci_conn_del(conn);
2364         } else if (ev->link_type != ACL_LINK)
2365                 hci_proto_connect_cfm(conn, ev->status);
2366
2367 unlock:
2368         hci_dev_unlock(hdev);
2369
2370         hci_conn_check_pending(hdev);
2371 }
2372
2373 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2374 {
2375         struct hci_cp_reject_conn_req cp;
2376
2377         bacpy(&cp.bdaddr, bdaddr);
2378         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2379         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2380 }
2381
2382 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2383 {
2384         struct hci_ev_conn_request *ev = (void *) skb->data;
2385         int mask = hdev->link_mode;
2386         struct inquiry_entry *ie;
2387         struct hci_conn *conn;
2388         __u8 flags = 0;
2389
2390         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2391                ev->link_type);
2392
2393         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2394                                       &flags);
2395
2396         if (!(mask & HCI_LM_ACCEPT)) {
2397                 hci_reject_conn(hdev, &ev->bdaddr);
2398                 return;
2399         }
2400
2401         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2402                                    BDADDR_BREDR)) {
2403                 hci_reject_conn(hdev, &ev->bdaddr);
2404                 return;
2405         }
2406
2407         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2408          * connection. These features are only touched through mgmt so
2409          * only do the checks if HCI_MGMT is set.
2410          */
2411         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2412             !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2413             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2414                                     BDADDR_BREDR)) {
2415                     hci_reject_conn(hdev, &ev->bdaddr);
2416                     return;
2417         }
2418
2419         /* Connection accepted */
2420
2421         hci_dev_lock(hdev);
2422
2423         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2424         if (ie)
2425                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2426
2427 #ifdef CONFIG_TIZEN_WIP
2428                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2429                      hci_conn_hash_lookup_sco(hdev)) {
2430                         struct hci_cp_reject_conn_req cp;
2431
2432                         bacpy(&cp.bdaddr, &ev->bdaddr);
2433                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2434                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2435                                      sizeof(cp), &cp);
2436                         hci_dev_unlock(hdev);
2437                         return;
2438                 }
2439 #endif
2440         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2441                         &ev->bdaddr);
2442         if (!conn) {
2443                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2444                                     HCI_ROLE_SLAVE);
2445                 if (!conn) {
2446                         BT_ERR("No memory for new connection");
2447                         hci_dev_unlock(hdev);
2448                         return;
2449                 }
2450         }
2451
2452         memcpy(conn->dev_class, ev->dev_class, 3);
2453
2454         hci_dev_unlock(hdev);
2455
2456         if (ev->link_type == ACL_LINK ||
2457             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2458                 struct hci_cp_accept_conn_req cp;
2459                 conn->state = BT_CONNECT;
2460
2461                 bacpy(&cp.bdaddr, &ev->bdaddr);
2462
2463                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2464                         cp.role = 0x00; /* Become master */
2465                 else
2466                         cp.role = 0x01; /* Remain slave */
2467
2468                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2469         } else if (!(flags & HCI_PROTO_DEFER)) {
2470                 struct hci_cp_accept_sync_conn_req cp;
2471                 conn->state = BT_CONNECT;
2472
2473                 bacpy(&cp.bdaddr, &ev->bdaddr);
2474                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2475
2476                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2477                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2478                 cp.max_latency    = cpu_to_le16(0xffff);
2479                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2480                 cp.retrans_effort = 0xff;
2481
2482                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2483                              &cp);
2484         } else {
2485                 conn->state = BT_CONNECT2;
2486                 hci_proto_connect_cfm(conn, 0);
2487         }
2488 }
2489
2490 static u8 hci_to_mgmt_reason(u8 err)
2491 {
2492         switch (err) {
2493         case HCI_ERROR_CONNECTION_TIMEOUT:
2494                 return MGMT_DEV_DISCONN_TIMEOUT;
2495         case HCI_ERROR_REMOTE_USER_TERM:
2496         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2497         case HCI_ERROR_REMOTE_POWER_OFF:
2498                 return MGMT_DEV_DISCONN_REMOTE;
2499         case HCI_ERROR_LOCAL_HOST_TERM:
2500                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2501         default:
2502                 return MGMT_DEV_DISCONN_UNKNOWN;
2503         }
2504 }
2505
2506 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2507 {
2508         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2509         u8 reason = hci_to_mgmt_reason(ev->reason);
2510         struct hci_conn_params *params;
2511         struct hci_conn *conn;
2512         bool mgmt_connected;
2513         u8 type;
2514
2515         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2516
2517         hci_dev_lock(hdev);
2518
2519         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2520         if (!conn)
2521                 goto unlock;
2522
2523         if (ev->status) {
2524                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2525                                        conn->dst_type, ev->status);
2526                 goto unlock;
2527         }
2528
2529         conn->state = BT_CLOSED;
2530
2531         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2532         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2533                                 reason, mgmt_connected);
2534
2535         if (conn->type == ACL_LINK) {
2536                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2537                         hci_remove_link_key(hdev, &conn->dst);
2538
2539                 hci_update_page_scan(hdev);
2540         }
2541
2542         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2543         if (params) {
2544                 switch (params->auto_connect) {
2545                 case HCI_AUTO_CONN_LINK_LOSS:
2546                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2547                                 break;
2548                         /* Fall through */
2549
2550                 case HCI_AUTO_CONN_DIRECT:
2551                 case HCI_AUTO_CONN_ALWAYS:
2552                         list_del_init(&params->action);
2553                         list_add(&params->action, &hdev->pend_le_conns);
2554                         hci_update_background_scan(hdev);
2555                         break;
2556
2557                 default:
2558                         break;
2559                 }
2560         }
2561
2562         type = conn->type;
2563
2564         hci_proto_disconn_cfm(conn, ev->reason);
2565         hci_conn_del(conn);
2566
2567         /* Re-enable advertising if necessary, since it might
2568          * have been disabled by the connection. From the
2569          * HCI_LE_Set_Advertise_Enable command description in
2570          * the core specification (v4.0):
2571          * "The Controller shall continue advertising until the Host
2572          * issues an LE_Set_Advertise_Enable command with
2573          * Advertising_Enable set to 0x00 (Advertising is disabled)
2574          * or until a connection is created or until the Advertising
2575          * is timed out due to Directed Advertising."
2576          */
2577         if (type == LE_LINK)
2578                 mgmt_reenable_advertising(hdev);
2579
2580 #ifdef CONFIG_TIZEN_WIP
2581         if (type == ACL_LINK && !hci_conn_num(hdev, ACL_LINK)) {
2582                 int iscan;
2583                 int pscan;
2584
2585                 iscan = test_bit(HCI_ISCAN, &hdev->flags);
2586                 pscan = test_bit(HCI_PSCAN, &hdev->flags);
2587                 if (!iscan && !pscan) {
2588                         u8 scan_enable = SCAN_PAGE;
2589
2590                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE,
2591                                         sizeof(scan_enable), &scan_enable);
2592                 }
2593         }
2594 #endif
2595
2596 unlock:
2597         hci_dev_unlock(hdev);
2598 }
2599
2600 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2601 {
2602         struct hci_ev_auth_complete *ev = (void *) skb->data;
2603         struct hci_conn *conn;
2604
2605         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2606
2607         hci_dev_lock(hdev);
2608
2609         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2610         if (!conn)
2611                 goto unlock;
2612
2613 #ifdef CONFIG_TIZEN_WIP /*  PIN or Key Missing patch */
2614         BT_DBG("remote_auth %x, remote_cap %x, auth_type %x, io_capability %x",
2615                conn->remote_auth, conn->remote_cap,
2616                conn->auth_type, conn->io_capability);
2617
2618         if (ev->status == 0x06) {
2619                 struct hci_cp_auth_requested cp;
2620                 BT_DBG("Pin or key missing");
2621                 hci_remove_link_key(hdev, &conn->dst);
2622                 cp.handle = cpu_to_le16(conn->handle);
2623                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp),
2624                                                          &cp);
2625                 goto unlock;
2626         }
2627 #endif
2628         if (!ev->status) {
2629                 if (!hci_conn_ssp_enabled(conn) &&
2630                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2631                         BT_INFO("re-auth of legacy device is not possible.");
2632                 } else {
2633                         set_bit(HCI_CONN_AUTH, &conn->flags);
2634                         conn->sec_level = conn->pending_sec_level;
2635                 }
2636         } else {
2637                 mgmt_auth_failed(conn, ev->status);
2638         }
2639
2640         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2641         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2642
2643         if (conn->state == BT_CONFIG) {
2644                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2645                         struct hci_cp_set_conn_encrypt cp;
2646                         cp.handle  = ev->handle;
2647                         cp.encrypt = 0x01;
2648                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2649                                      &cp);
2650                 } else {
2651                         conn->state = BT_CONNECTED;
2652                         hci_proto_connect_cfm(conn, ev->status);
2653                         hci_conn_drop(conn);
2654                 }
2655         } else {
2656                 hci_auth_cfm(conn, ev->status);
2657
2658                 hci_conn_hold(conn);
2659                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2660                 hci_conn_drop(conn);
2661         }
2662
2663         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2664                 if (!ev->status) {
2665                         struct hci_cp_set_conn_encrypt cp;
2666                         cp.handle  = ev->handle;
2667                         cp.encrypt = 0x01;
2668                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2669                                      &cp);
2670                 } else {
2671                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2672                         hci_encrypt_cfm(conn, ev->status, 0x00);
2673                 }
2674         }
2675
2676 unlock:
2677         hci_dev_unlock(hdev);
2678 }
2679
2680 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2681 {
2682         struct hci_ev_remote_name *ev = (void *) skb->data;
2683         struct hci_conn *conn;
2684
2685         BT_DBG("%s", hdev->name);
2686
2687         hci_conn_check_pending(hdev);
2688
2689         hci_dev_lock(hdev);
2690
2691         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2692
2693         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2694                 goto check_auth;
2695
2696         if (ev->status == 0)
2697                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2698                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2699         else
2700                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2701
2702 check_auth:
2703         if (!conn)
2704                 goto unlock;
2705
2706         if (!hci_outgoing_auth_needed(hdev, conn))
2707                 goto unlock;
2708
2709         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2710                 struct hci_cp_auth_requested cp;
2711
2712                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2713
2714                 cp.handle = __cpu_to_le16(conn->handle);
2715                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2716         }
2717
2718 unlock:
2719         hci_dev_unlock(hdev);
2720 }
2721
2722 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2723 {
2724         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2725         struct hci_conn *conn;
2726
2727         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2728
2729         hci_dev_lock(hdev);
2730
2731         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2732         if (!conn)
2733                 goto unlock;
2734
2735         if (!ev->status) {
2736                 if (ev->encrypt) {
2737                         /* Encryption implies authentication */
2738                         set_bit(HCI_CONN_AUTH, &conn->flags);
2739                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2740                         conn->sec_level = conn->pending_sec_level;
2741
2742 /* Disable Secure connection implementation now */
2743 #ifdef CONFIG_TIZEN_WIP
2744                         /* P-256 authentication key implies FIPS */
2745                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2746                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2747
2748                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2749                             conn->type == LE_LINK)
2750                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2751 #endif
2752                 } else {
2753                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2754 /* Disable Secure connection implementation now */
2755 #ifdef CONFIG_TIZEN_WIP
2756                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2757 #endif
2758                 }
2759         }
2760
2761         /* We should disregard the current RPA and generate a new one
2762          * whenever the encryption procedure fails.
2763          */
2764         if (ev->status && conn->type == LE_LINK)
2765                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2766
2767         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2768
2769         if (ev->status && conn->state == BT_CONNECTED) {
2770                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2771                 hci_conn_drop(conn);
2772                 goto unlock;
2773         }
2774
2775         if (conn->state == BT_CONFIG) {
2776                 if (!ev->status)
2777                         conn->state = BT_CONNECTED;
2778
2779 /* Disable Secure connection implementation now */
2780 #ifdef CONFIG_TIZEN_WIP
2781                 /* In Secure Connections Only mode, do not allow any
2782                  * connections that are not encrypted with AES-CCM
2783                  * using a P-256 authenticated combination key.
2784                  */
2785                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2786                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2787                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2788                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2789                         hci_conn_drop(conn);
2790                         goto unlock;
2791                 }
2792 #endif
2793                 hci_proto_connect_cfm(conn, ev->status);
2794                 hci_conn_drop(conn);
2795         } else
2796                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2797
2798 unlock:
2799         hci_dev_unlock(hdev);
2800 }
2801
2802 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2803                                              struct sk_buff *skb)
2804 {
2805         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2806         struct hci_conn *conn;
2807
2808         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2809
2810         hci_dev_lock(hdev);
2811
2812         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2813         if (conn) {
2814                 if (!ev->status)
2815                         set_bit(HCI_CONN_SECURE, &conn->flags);
2816
2817                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2818
2819                 hci_key_change_cfm(conn, ev->status);
2820         }
2821
2822         hci_dev_unlock(hdev);
2823 }
2824
2825 static void hci_remote_features_evt(struct hci_dev *hdev,
2826                                     struct sk_buff *skb)
2827 {
2828         struct hci_ev_remote_features *ev = (void *) skb->data;
2829         struct hci_conn *conn;
2830
2831         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2832
2833         hci_dev_lock(hdev);
2834
2835         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2836         if (!conn)
2837                 goto unlock;
2838
2839         if (!ev->status)
2840                 memcpy(conn->features[0], ev->features, 8);
2841
2842         if (conn->state != BT_CONFIG)
2843                 goto unlock;
2844
2845         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2846                 struct hci_cp_read_remote_ext_features cp;
2847                 cp.handle = ev->handle;
2848                 cp.page = 0x01;
2849                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2850                              sizeof(cp), &cp);
2851                 goto unlock;
2852         }
2853
2854 #ifdef CONFIG_SPRD_2331
2855         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2856                 struct hci_cp_change_conn_ptype cp;
2857                 memset(&cp, 0, sizeof(cp));
2858                 cp.pkt_type = (HCI_DM1|HCI_DH1);
2859                 if (conn->features[0][0] & LMP_3SLOT)
2860                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
2861
2862                 if (conn->features[0][0] & LMP_5SLOT)
2863                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
2864
2865                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
2866                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
2867                 } else {
2868                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2869                                 cp.pkt_type |= HCI_2DH3;
2870
2871                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2872                                 cp.pkt_type |= HCI_2DH5;
2873                 }
2874
2875                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
2876                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
2877                 } else {
2878                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2879                                 cp.pkt_type |= HCI_3DH3;
2880
2881                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2882                                 cp.pkt_type |= HCI_3DH5;
2883                 }
2884
2885                 cp.handle = ev->handle;
2886                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
2887         }
2888 #endif
2889
2890         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2891                 struct hci_cp_remote_name_req cp;
2892                 memset(&cp, 0, sizeof(cp));
2893                 bacpy(&cp.bdaddr, &conn->dst);
2894                 cp.pscan_rep_mode = 0x02;
2895                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2896         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2897                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2898
2899         if (!hci_outgoing_auth_needed(hdev, conn)) {
2900                 conn->state = BT_CONNECTED;
2901                 hci_proto_connect_cfm(conn, ev->status);
2902                 hci_conn_drop(conn);
2903         }
2904
2905 unlock:
2906         hci_dev_unlock(hdev);
2907 }
2908
2909 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2910 {
2911         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2912         u8 status = skb->data[sizeof(*ev)];
2913         __u16 opcode;
2914
2915         skb_pull(skb, sizeof(*ev));
2916
2917         opcode = __le16_to_cpu(ev->opcode);
2918
2919         switch (opcode) {
2920         case HCI_OP_INQUIRY_CANCEL:
2921                 hci_cc_inquiry_cancel(hdev, skb);
2922                 break;
2923
2924         case HCI_OP_PERIODIC_INQ:
2925                 hci_cc_periodic_inq(hdev, skb);
2926                 break;
2927
2928         case HCI_OP_EXIT_PERIODIC_INQ:
2929                 hci_cc_exit_periodic_inq(hdev, skb);
2930                 break;
2931
2932         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2933                 hci_cc_remote_name_req_cancel(hdev, skb);
2934                 break;
2935
2936         case HCI_OP_ROLE_DISCOVERY:
2937                 hci_cc_role_discovery(hdev, skb);
2938                 break;
2939
2940         case HCI_OP_READ_LINK_POLICY:
2941                 hci_cc_read_link_policy(hdev, skb);
2942                 break;
2943
2944         case HCI_OP_WRITE_LINK_POLICY:
2945                 hci_cc_write_link_policy(hdev, skb);
2946                 break;
2947
2948         case HCI_OP_READ_DEF_LINK_POLICY:
2949                 hci_cc_read_def_link_policy(hdev, skb);
2950                 break;
2951
2952         case HCI_OP_WRITE_DEF_LINK_POLICY:
2953                 hci_cc_write_def_link_policy(hdev, skb);
2954                 break;
2955
2956         case HCI_OP_RESET:
2957                 hci_cc_reset(hdev, skb);
2958                 break;
2959
2960         case HCI_OP_READ_STORED_LINK_KEY:
2961                 hci_cc_read_stored_link_key(hdev, skb);
2962                 break;
2963
2964         case HCI_OP_DELETE_STORED_LINK_KEY:
2965                 hci_cc_delete_stored_link_key(hdev, skb);
2966                 break;
2967
2968         case HCI_OP_WRITE_LOCAL_NAME:
2969                 hci_cc_write_local_name(hdev, skb);
2970                 break;
2971
2972         case HCI_OP_READ_LOCAL_NAME:
2973                 hci_cc_read_local_name(hdev, skb);
2974                 break;
2975
2976         case HCI_OP_WRITE_AUTH_ENABLE:
2977                 hci_cc_write_auth_enable(hdev, skb);
2978                 break;
2979
2980         case HCI_OP_WRITE_ENCRYPT_MODE:
2981                 hci_cc_write_encrypt_mode(hdev, skb);
2982                 break;
2983
2984         case HCI_OP_WRITE_SCAN_ENABLE:
2985                 hci_cc_write_scan_enable(hdev, skb);
2986                 break;
2987
2988         case HCI_OP_READ_CLASS_OF_DEV:
2989                 hci_cc_read_class_of_dev(hdev, skb);
2990                 break;
2991
2992         case HCI_OP_WRITE_CLASS_OF_DEV:
2993                 hci_cc_write_class_of_dev(hdev, skb);
2994                 break;
2995
2996         case HCI_OP_READ_VOICE_SETTING:
2997                 hci_cc_read_voice_setting(hdev, skb);
2998                 break;
2999
3000         case HCI_OP_WRITE_VOICE_SETTING:
3001                 hci_cc_write_voice_setting(hdev, skb);
3002                 break;
3003
3004         case HCI_OP_READ_NUM_SUPPORTED_IAC:
3005                 hci_cc_read_num_supported_iac(hdev, skb);
3006                 break;
3007
3008         case HCI_OP_WRITE_SSP_MODE:
3009                 hci_cc_write_ssp_mode(hdev, skb);
3010                 break;
3011
3012         case HCI_OP_WRITE_SC_SUPPORT:
3013                 hci_cc_write_sc_support(hdev, skb);
3014                 break;
3015
3016         case HCI_OP_READ_LOCAL_VERSION:
3017                 hci_cc_read_local_version(hdev, skb);
3018                 break;
3019
3020         case HCI_OP_READ_LOCAL_COMMANDS:
3021                 hci_cc_read_local_commands(hdev, skb);
3022                 break;
3023
3024         case HCI_OP_READ_LOCAL_FEATURES:
3025                 hci_cc_read_local_features(hdev, skb);
3026                 break;
3027
3028         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3029                 hci_cc_read_local_ext_features(hdev, skb);
3030                 break;
3031
3032         case HCI_OP_READ_BUFFER_SIZE:
3033                 hci_cc_read_buffer_size(hdev, skb);
3034                 break;
3035
3036         case HCI_OP_READ_BD_ADDR:
3037                 hci_cc_read_bd_addr(hdev, skb);
3038                 break;
3039
3040         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3041                 hci_cc_read_page_scan_activity(hdev, skb);
3042                 break;
3043
3044         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3045                 hci_cc_write_page_scan_activity(hdev, skb);
3046                 break;
3047
3048         case HCI_OP_READ_PAGE_SCAN_TYPE:
3049                 hci_cc_read_page_scan_type(hdev, skb);
3050                 break;
3051
3052         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3053                 hci_cc_write_page_scan_type(hdev, skb);
3054                 break;
3055
3056         case HCI_OP_READ_DATA_BLOCK_SIZE:
3057                 hci_cc_read_data_block_size(hdev, skb);
3058                 break;
3059
3060         case HCI_OP_READ_FLOW_CONTROL_MODE:
3061                 hci_cc_read_flow_control_mode(hdev, skb);
3062                 break;
3063
3064         case HCI_OP_READ_LOCAL_AMP_INFO:
3065                 hci_cc_read_local_amp_info(hdev, skb);
3066                 break;
3067
3068         case HCI_OP_READ_CLOCK:
3069                 hci_cc_read_clock(hdev, skb);
3070                 break;
3071
3072         case HCI_OP_READ_LOCAL_AMP_ASSOC:
3073                 hci_cc_read_local_amp_assoc(hdev, skb);
3074                 break;
3075
3076         case HCI_OP_READ_INQ_RSP_TX_POWER:
3077                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3078                 break;
3079
3080         case HCI_OP_PIN_CODE_REPLY:
3081                 hci_cc_pin_code_reply(hdev, skb);
3082                 break;
3083
3084         case HCI_OP_PIN_CODE_NEG_REPLY:
3085                 hci_cc_pin_code_neg_reply(hdev, skb);
3086                 break;
3087
3088         case HCI_OP_READ_LOCAL_OOB_DATA:
3089                 hci_cc_read_local_oob_data(hdev, skb);
3090                 break;
3091
3092         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3093                 hci_cc_read_local_oob_ext_data(hdev, skb);
3094                 break;
3095
3096         case HCI_OP_LE_READ_BUFFER_SIZE:
3097                 hci_cc_le_read_buffer_size(hdev, skb);
3098                 break;
3099
3100         case HCI_OP_LE_READ_LOCAL_FEATURES:
3101                 hci_cc_le_read_local_features(hdev, skb);
3102                 break;
3103
3104         case HCI_OP_LE_READ_ADV_TX_POWER:
3105                 hci_cc_le_read_adv_tx_power(hdev, skb);
3106                 break;
3107
3108         case HCI_OP_USER_CONFIRM_REPLY:
3109                 hci_cc_user_confirm_reply(hdev, skb);
3110                 break;
3111
3112         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3113                 hci_cc_user_confirm_neg_reply(hdev, skb);
3114                 break;
3115
3116         case HCI_OP_USER_PASSKEY_REPLY:
3117                 hci_cc_user_passkey_reply(hdev, skb);
3118                 break;
3119
3120         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3121                 hci_cc_user_passkey_neg_reply(hdev, skb);
3122                 break;
3123
3124         case HCI_OP_LE_SET_RANDOM_ADDR:
3125                 hci_cc_le_set_random_addr(hdev, skb);
3126                 break;
3127
3128         case HCI_OP_LE_SET_ADV_ENABLE:
3129                 hci_cc_le_set_adv_enable(hdev, skb);
3130                 break;
3131
3132         case HCI_OP_LE_SET_SCAN_PARAM:
3133                 hci_cc_le_set_scan_param(hdev, skb);
3134                 break;
3135
3136         case HCI_OP_LE_SET_SCAN_ENABLE:
3137                 hci_cc_le_set_scan_enable(hdev, skb);
3138                 break;
3139
3140         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3141                 hci_cc_le_read_white_list_size(hdev, skb);
3142                 break;
3143
3144         case HCI_OP_LE_CLEAR_WHITE_LIST:
3145                 hci_cc_le_clear_white_list(hdev, skb);
3146                 break;
3147
3148         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3149                 hci_cc_le_add_to_white_list(hdev, skb);
3150                 break;
3151
3152         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3153                 hci_cc_le_del_from_white_list(hdev, skb);
3154                 break;
3155
3156         case HCI_OP_LE_READ_SUPPORTED_STATES:
3157                 hci_cc_le_read_supported_states(hdev, skb);
3158                 break;
3159
3160         case HCI_OP_LE_READ_DEF_DATA_LEN:
3161                 hci_cc_le_read_def_data_len(hdev, skb);
3162                 break;
3163
3164         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3165                 hci_cc_le_write_def_data_len(hdev, skb);
3166                 break;
3167
3168         case HCI_OP_LE_READ_MAX_DATA_LEN:
3169                 hci_cc_le_read_max_data_len(hdev, skb);
3170                 break;
3171
3172         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3173                 hci_cc_write_le_host_supported(hdev, skb);
3174                 break;
3175
3176         case HCI_OP_LE_SET_ADV_PARAM:
3177                 hci_cc_set_adv_param(hdev, skb);
3178                 break;
3179
3180         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
3181                 hci_cc_write_remote_amp_assoc(hdev, skb);
3182                 break;
3183
3184         case HCI_OP_READ_RSSI:
3185                 hci_cc_read_rssi(hdev, skb);
3186                 break;
3187
3188         case HCI_OP_READ_TX_POWER:
3189                 hci_cc_read_tx_power(hdev, skb);
3190                 break;
3191 #ifdef CONFIG_TIZEN_WIP
3192         case HCI_OP_ENABLE_RSSI:
3193                 hci_cc_enable_rssi(hdev, skb);
3194                 break;
3195
3196         case HCI_OP_GET_RAW_RSSI:
3197                 hci_cc_get_raw_rssi(hdev, skb);
3198                 break;
3199 #endif
3200         default:
3201                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3202                 break;
3203         }
3204
3205         if (opcode != HCI_OP_NOP)
3206                 cancel_delayed_work(&hdev->cmd_timer);
3207
3208         hci_req_cmd_complete(hdev, opcode, status);
3209
3210         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3211                 atomic_set(&hdev->cmd_cnt, 1);
3212                 if (!skb_queue_empty(&hdev->cmd_q))
3213                         queue_work(hdev->workqueue, &hdev->cmd_work);
3214         }
3215 }
3216
3217 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
3218 {
3219         struct hci_ev_cmd_status *ev = (void *) skb->data;
3220         __u16 opcode;
3221
3222         skb_pull(skb, sizeof(*ev));
3223
3224         opcode = __le16_to_cpu(ev->opcode);
3225
3226         switch (opcode) {
3227         case HCI_OP_INQUIRY:
3228                 hci_cs_inquiry(hdev, ev->status);
3229                 break;
3230
3231         case HCI_OP_CREATE_CONN:
3232                 hci_cs_create_conn(hdev, ev->status);
3233                 break;
3234
3235         case HCI_OP_DISCONNECT:
3236                 hci_cs_disconnect(hdev, ev->status);
3237                 break;
3238
3239         case HCI_OP_ADD_SCO:
3240                 hci_cs_add_sco(hdev, ev->status);
3241                 break;
3242
3243         case HCI_OP_AUTH_REQUESTED:
3244                 hci_cs_auth_requested(hdev, ev->status);
3245                 break;
3246
3247         case HCI_OP_SET_CONN_ENCRYPT:
3248                 hci_cs_set_conn_encrypt(hdev, ev->status);
3249                 break;
3250
3251         case HCI_OP_REMOTE_NAME_REQ:
3252                 hci_cs_remote_name_req(hdev, ev->status);
3253                 break;
3254
3255         case HCI_OP_READ_REMOTE_FEATURES:
3256                 hci_cs_read_remote_features(hdev, ev->status);
3257                 break;
3258
3259         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3260                 hci_cs_read_remote_ext_features(hdev, ev->status);
3261                 break;
3262
3263         case HCI_OP_SETUP_SYNC_CONN:
3264                 hci_cs_setup_sync_conn(hdev, ev->status);
3265                 break;
3266
3267         case HCI_OP_CREATE_PHY_LINK:
3268                 hci_cs_create_phylink(hdev, ev->status);
3269                 break;
3270
3271         case HCI_OP_ACCEPT_PHY_LINK:
3272                 hci_cs_accept_phylink(hdev, ev->status);
3273                 break;
3274
3275         case HCI_OP_SNIFF_MODE:
3276                 hci_cs_sniff_mode(hdev, ev->status);
3277                 break;
3278
3279         case HCI_OP_EXIT_SNIFF_MODE:
3280                 hci_cs_exit_sniff_mode(hdev, ev->status);
3281                 break;
3282
3283         case HCI_OP_SWITCH_ROLE:
3284                 hci_cs_switch_role(hdev, ev->status);
3285                 break;
3286
3287         case HCI_OP_LE_CREATE_CONN:
3288                 hci_cs_le_create_conn(hdev, ev->status);
3289                 break;
3290
3291         case HCI_OP_LE_START_ENC:
3292                 hci_cs_le_start_enc(hdev, ev->status);
3293                 break;
3294
3295         default:
3296                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3297                 break;
3298         }
3299
3300         if (opcode != HCI_OP_NOP)
3301                 cancel_delayed_work(&hdev->cmd_timer);
3302
3303         if (ev->status ||
3304             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3305                 hci_req_cmd_complete(hdev, opcode, ev->status);
3306
3307         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3308                 atomic_set(&hdev->cmd_cnt, 1);
3309                 if (!skb_queue_empty(&hdev->cmd_q))
3310                         queue_work(hdev->workqueue, &hdev->cmd_work);
3311         }
3312 }
3313
3314 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3315 {
3316         struct hci_ev_hardware_error *ev = (void *) skb->data;
3317
3318         BT_ERR("%s hardware error 0x%2.2x", hdev->name, ev->code);
3319 #ifdef CONFIG_TIZEN_WIP
3320         hci_dev_lock(hdev);
3321         mgmt_hardware_error(hdev, ev->code);
3322         hci_dev_unlock(hdev);
3323 #endif
3324 }
3325
3326 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3327 {
3328         struct hci_ev_role_change *ev = (void *) skb->data;
3329         struct hci_conn *conn;
3330
3331         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3332
3333         hci_dev_lock(hdev);
3334
3335         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3336         if (conn) {
3337                 if (!ev->status)
3338                         conn->role = ev->role;
3339
3340                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3341
3342                 hci_role_switch_cfm(conn, ev->status, ev->role);
3343
3344 #ifdef CONFIG_TIZEN_WIP
3345                 if (!ev->status && (get_link_mode(conn)) & HCI_LM_MASTER)
3346                         hci_conn_change_supervision_timeout(conn,
3347                                                 LINK_SUPERVISION_TIMEOUT);
3348 #endif
3349         }
3350
3351         hci_dev_unlock(hdev);
3352 }
3353
3354 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3355 {
3356         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3357         int i;
3358
3359         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3360                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3361                 return;
3362         }
3363
3364         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3365             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3366                 BT_DBG("%s bad parameters", hdev->name);
3367                 return;
3368         }
3369
3370         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3371
3372         for (i = 0; i < ev->num_hndl; i++) {
3373                 struct hci_comp_pkts_info *info = &ev->handles[i];
3374                 struct hci_conn *conn;
3375                 __u16  handle, count;
3376
3377                 handle = __le16_to_cpu(info->handle);
3378                 count  = __le16_to_cpu(info->count);
3379
3380                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3381                 if (!conn)
3382                         continue;
3383
3384                 conn->sent -= count;
3385
3386                 switch (conn->type) {
3387                 case ACL_LINK:
3388                         hdev->acl_cnt += count;
3389                         if (hdev->acl_cnt > hdev->acl_pkts)
3390                                 hdev->acl_cnt = hdev->acl_pkts;
3391                         break;
3392
3393                 case LE_LINK:
3394                         if (hdev->le_pkts) {
3395                                 hdev->le_cnt += count;
3396                                 if (hdev->le_cnt > hdev->le_pkts)
3397                                         hdev->le_cnt = hdev->le_pkts;
3398                         } else {
3399                                 hdev->acl_cnt += count;
3400                                 if (hdev->acl_cnt > hdev->acl_pkts)
3401                                         hdev->acl_cnt = hdev->acl_pkts;
3402                         }
3403                         break;
3404
3405                 case SCO_LINK:
3406                         hdev->sco_cnt += count;
3407                         if (hdev->sco_cnt > hdev->sco_pkts)
3408                                 hdev->sco_cnt = hdev->sco_pkts;
3409                         break;
3410
3411                 default:
3412                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3413                         break;
3414                 }
3415         }
3416
3417         queue_work(hdev->workqueue, &hdev->tx_work);
3418 }
3419
3420 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3421                                                  __u16 handle)
3422 {
3423         struct hci_chan *chan;
3424
3425         switch (hdev->dev_type) {
3426         case HCI_BREDR:
3427                 return hci_conn_hash_lookup_handle(hdev, handle);
3428         case HCI_AMP:
3429                 chan = hci_chan_lookup_handle(hdev, handle);
3430                 if (chan)
3431                         return chan->conn;
3432                 break;
3433         default:
3434                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3435                 break;
3436         }
3437
3438         return NULL;
3439 }
3440
3441 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3442 {
3443         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3444         int i;
3445
3446         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3447                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3448                 return;
3449         }
3450
3451         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3452             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3453                 BT_DBG("%s bad parameters", hdev->name);
3454                 return;
3455         }
3456
3457         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3458                ev->num_hndl);
3459
3460         for (i = 0; i < ev->num_hndl; i++) {
3461                 struct hci_comp_blocks_info *info = &ev->handles[i];
3462                 struct hci_conn *conn = NULL;
3463                 __u16  handle, block_count;
3464
3465                 handle = __le16_to_cpu(info->handle);
3466                 block_count = __le16_to_cpu(info->blocks);
3467
3468                 conn = __hci_conn_lookup_handle(hdev, handle);
3469                 if (!conn)
3470                         continue;
3471
3472                 conn->sent -= block_count;
3473
3474                 switch (conn->type) {
3475                 case ACL_LINK:
3476                 case AMP_LINK:
3477                         hdev->block_cnt += block_count;
3478                         if (hdev->block_cnt > hdev->num_blocks)
3479                                 hdev->block_cnt = hdev->num_blocks;
3480                         break;
3481
3482                 default:
3483                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3484                         break;
3485                 }
3486         }
3487
3488         queue_work(hdev->workqueue, &hdev->tx_work);
3489 }
3490
3491 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3492 {
3493         struct hci_ev_mode_change *ev = (void *) skb->data;
3494         struct hci_conn *conn;
3495
3496         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3497
3498         hci_dev_lock(hdev);
3499
3500         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3501         if (conn) {
3502                 conn->mode = ev->mode;
3503
3504                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3505                                         &conn->flags)) {
3506                         if (conn->mode == HCI_CM_ACTIVE)
3507                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3508                         else
3509                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3510                 }
3511
3512                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3513                         hci_sco_setup(conn, ev->status);
3514         }
3515
3516         hci_dev_unlock(hdev);
3517 }
3518
3519 #ifdef CONFIG_TIZEN_WIP
3520 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
3521 {
3522         struct hci_ev_vendor_specific *ev = (void *) skb->data;
3523         __u8 event_sub_code;
3524         skb_pull(skb, sizeof(*ev));
3525
3526         BT_DBG("hci_vendor_specific_evt");
3527         event_sub_code = ev->event_sub_code;
3528
3529         switch (event_sub_code) {
3530         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT: {
3531                 struct hci_ev_ext_vendor_specific *ev = (void *) skb->data;
3532                 __u8 event_le_ext_sub_code;
3533                 skb_pull(skb, sizeof(*ev));
3534                 event_le_ext_sub_code = ev->event_le_ext_sub_code;
3535
3536                 BT_DBG("Func: %s RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
3537                                 __func__, LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
3538
3539                 switch (event_le_ext_sub_code) {
3540                 case LE_RSSI_LINK_ALERT:
3541                         BT_DBG("Func: %s RSSI event LE_RSSI_LINK_ALERT %X",
3542                                         __func__, LE_RSSI_LINK_ALERT);
3543                         mgmt_rssi_alert_evt(hdev, skb);
3544                         break;
3545
3546                 default:
3547                         break;
3548                 }
3549         }
3550         break;
3551
3552         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
3553                 BT_DBG("Func: %s LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT", __func__);
3554                 mgmt_multi_adv_state_change_evt(hdev, skb);
3555                 break;
3556
3557         default:
3558                 break;
3559         }
3560 }
3561 #endif
3562 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3563 {
3564         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3565         struct hci_conn *conn;
3566
3567         BT_DBG("%s", hdev->name);
3568
3569         hci_dev_lock(hdev);
3570
3571         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3572         if (!conn)
3573                 goto unlock;
3574
3575         if (conn->state == BT_CONNECTED) {
3576                 hci_conn_hold(conn);
3577                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3578                 hci_conn_drop(conn);
3579         }
3580
3581         if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
3582             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3583                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3584                              sizeof(ev->bdaddr), &ev->bdaddr);
3585         } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3586                 u8 secure;
3587
3588                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3589                         secure = 1;
3590                 else
3591                         secure = 0;
3592
3593                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3594         }
3595
3596 unlock:
3597         hci_dev_unlock(hdev);
3598 }
3599
3600 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3601 {
3602         if (key_type == HCI_LK_CHANGED_COMBINATION)
3603                 return;
3604
3605         conn->pin_length = pin_len;
3606         conn->key_type = key_type;
3607
3608         switch (key_type) {
3609         case HCI_LK_LOCAL_UNIT:
3610         case HCI_LK_REMOTE_UNIT:
3611         case HCI_LK_DEBUG_COMBINATION:
3612                 return;
3613         case HCI_LK_COMBINATION:
3614                 if (pin_len == 16)
3615                         conn->pending_sec_level = BT_SECURITY_HIGH;
3616                 else
3617                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3618                 break;
3619         case HCI_LK_UNAUTH_COMBINATION_P192:
3620         case HCI_LK_UNAUTH_COMBINATION_P256:
3621                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3622                 break;
3623         case HCI_LK_AUTH_COMBINATION_P192:
3624                 conn->pending_sec_level = BT_SECURITY_HIGH;
3625                 break;
3626         case HCI_LK_AUTH_COMBINATION_P256:
3627                 conn->pending_sec_level = BT_SECURITY_FIPS;
3628                 break;
3629         }
3630 }
3631
3632 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3633 {
3634         struct hci_ev_link_key_req *ev = (void *) skb->data;
3635         struct hci_cp_link_key_reply cp;
3636         struct hci_conn *conn;
3637         struct link_key *key;
3638
3639         BT_DBG("%s", hdev->name);
3640
3641         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3642                 return;
3643
3644         hci_dev_lock(hdev);
3645
3646         key = hci_find_link_key(hdev, &ev->bdaddr);
3647         if (!key) {
3648                 BT_DBG("%s link key not found for %pMR", hdev->name,
3649                        &ev->bdaddr);
3650                 goto not_found;
3651         }
3652
3653         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3654                &ev->bdaddr);
3655
3656         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3657         if (conn) {
3658                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3659
3660                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3661                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3662                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3663                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3664                         goto not_found;
3665                 }
3666
3667                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3668                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3669                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3670                         BT_DBG("%s ignoring key unauthenticated for high security",
3671                                hdev->name);
3672                         goto not_found;
3673                 }
3674
3675                 conn_set_key(conn, key->type, key->pin_len);
3676         }
3677
3678         bacpy(&cp.bdaddr, &ev->bdaddr);
3679         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3680
3681         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3682
3683         hci_dev_unlock(hdev);
3684
3685         return;
3686
3687 not_found:
3688         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3689         hci_dev_unlock(hdev);
3690 }
3691
3692 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3693 {
3694         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3695         struct hci_conn *conn;
3696         struct link_key *key;
3697         bool persistent;
3698         u8 pin_len = 0;
3699
3700         BT_DBG("%s", hdev->name);
3701
3702         hci_dev_lock(hdev);
3703
3704         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3705         if (!conn)
3706                 goto unlock;
3707
3708         hci_conn_hold(conn);
3709         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3710         hci_conn_drop(conn);
3711
3712         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3713         conn_set_key(conn, ev->key_type, conn->pin_length);
3714
3715         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3716                 goto unlock;
3717
3718         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3719                                 ev->key_type, pin_len, &persistent);
3720         if (!key)
3721                 goto unlock;
3722
3723         /* Update connection information since adding the key will have
3724          * fixed up the type in the case of changed combination keys.
3725          */
3726         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3727                 conn_set_key(conn, key->type, key->pin_len);
3728
3729         mgmt_new_link_key(hdev, key, persistent);
3730
3731         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3732          * is set. If it's not set simply remove the key from the kernel
3733          * list (we've still notified user space about it but with
3734          * store_hint being 0).
3735          */
3736         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3737             !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3738                 list_del_rcu(&key->list);
3739                 kfree_rcu(key, rcu);
3740                 goto unlock;
3741         }
3742
3743         if (persistent)
3744                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3745         else
3746                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3747
3748 unlock:
3749         hci_dev_unlock(hdev);
3750 }
3751
3752 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3753 {
3754         struct hci_ev_clock_offset *ev = (void *) skb->data;
3755         struct hci_conn *conn;
3756
3757         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3758
3759         hci_dev_lock(hdev);
3760
3761         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3762         if (conn && !ev->status) {
3763                 struct inquiry_entry *ie;
3764
3765                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3766                 if (ie) {
3767                         ie->data.clock_offset = ev->clock_offset;
3768                         ie->timestamp = jiffies;
3769                 }
3770         }
3771
3772         hci_dev_unlock(hdev);
3773 }
3774
3775 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3776 {
3777         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3778         struct hci_conn *conn;
3779
3780         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3781
3782         hci_dev_lock(hdev);
3783
3784         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3785         if (conn && !ev->status)
3786                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3787
3788         hci_dev_unlock(hdev);
3789 }
3790
3791 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3792 {
3793         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3794         struct inquiry_entry *ie;
3795
3796         BT_DBG("%s", hdev->name);
3797
3798         hci_dev_lock(hdev);
3799
3800         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3801         if (ie) {
3802                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3803                 ie->timestamp = jiffies;
3804         }
3805
3806         hci_dev_unlock(hdev);
3807 }
3808
3809 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3810                                              struct sk_buff *skb)
3811 {
3812         struct inquiry_data data;
3813         int num_rsp = *((__u8 *) skb->data);
3814
3815         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3816
3817         if (!num_rsp)
3818                 return;
3819
3820         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3821                 return;
3822
3823         hci_dev_lock(hdev);
3824
3825         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3826                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3827                 info = (void *) (skb->data + 1);
3828
3829                 for (; num_rsp; num_rsp--, info++) {
3830                         u32 flags;
3831
3832                         bacpy(&data.bdaddr, &info->bdaddr);
3833                         data.pscan_rep_mode     = info->pscan_rep_mode;
3834                         data.pscan_period_mode  = info->pscan_period_mode;
3835                         data.pscan_mode         = info->pscan_mode;
3836                         memcpy(data.dev_class, info->dev_class, 3);
3837                         data.clock_offset       = info->clock_offset;
3838                         data.rssi               = info->rssi;
3839                         data.ssp_mode           = 0x00;
3840
3841                         flags = hci_inquiry_cache_update(hdev, &data, false);
3842
3843                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3844                                           info->dev_class, info->rssi,
3845                                           flags, NULL, 0, NULL, 0);
3846                 }
3847         } else {
3848                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3849
3850                 for (; num_rsp; num_rsp--, info++) {
3851                         u32 flags;
3852
3853                         bacpy(&data.bdaddr, &info->bdaddr);
3854                         data.pscan_rep_mode     = info->pscan_rep_mode;
3855                         data.pscan_period_mode  = info->pscan_period_mode;
3856                         data.pscan_mode         = 0x00;
3857                         memcpy(data.dev_class, info->dev_class, 3);
3858                         data.clock_offset       = info->clock_offset;
3859                         data.rssi               = info->rssi;
3860                         data.ssp_mode           = 0x00;
3861
3862                         flags = hci_inquiry_cache_update(hdev, &data, false);
3863
3864                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3865                                           info->dev_class, info->rssi,
3866                                           flags, NULL, 0, NULL, 0);
3867                 }
3868         }
3869
3870         hci_dev_unlock(hdev);
3871 }
3872
3873 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3874                                         struct sk_buff *skb)
3875 {
3876         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3877         struct hci_conn *conn;
3878
3879         BT_DBG("%s", hdev->name);
3880
3881         hci_dev_lock(hdev);
3882
3883         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3884         if (!conn)
3885                 goto unlock;
3886
3887         if (ev->page < HCI_MAX_PAGES)
3888                 memcpy(conn->features[ev->page], ev->features, 8);
3889
3890         if (!ev->status && ev->page == 0x01) {
3891                 struct inquiry_entry *ie;
3892
3893                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3894                 if (ie)
3895                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3896
3897                 if (ev->features[0] & LMP_HOST_SSP) {
3898                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3899                 } else {
3900                         /* It is mandatory by the Bluetooth specification that
3901                          * Extended Inquiry Results are only used when Secure
3902                          * Simple Pairing is enabled, but some devices violate
3903                          * this.
3904                          *
3905                          * To make these devices work, the internal SSP
3906                          * enabled flag needs to be cleared if the remote host
3907                          * features do not indicate SSP support */
3908                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3909                 }
3910
3911 /* Disable Secure connection implementation now */
3912 #ifdef CONFIG_TIZEN_WIP
3913                 if (ev->features[0] & LMP_HOST_SC)
3914                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3915 #endif
3916         }
3917
3918         if (conn->state != BT_CONFIG)
3919                 goto unlock;
3920
3921 #ifdef CONFIG_SPRD_2331
3922         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3923                 struct hci_cp_change_conn_ptype cp;
3924                 memset(&cp, 0, sizeof(cp));
3925                 cp.pkt_type = (HCI_DM1|HCI_DH1);
3926
3927                 if (conn->features[0][0] & LMP_3SLOT)
3928                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
3929
3930                 if (conn->features[0][0] & LMP_5SLOT)
3931                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
3932
3933                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
3934                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
3935                 } else {
3936                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3937                                 cp.pkt_type |= HCI_2DH3;
3938
3939                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3940                                 cp.pkt_type |= HCI_2DH5;
3941                 }
3942
3943                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
3944                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
3945                 } else {
3946                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3947                                 cp.pkt_type |= HCI_3DH3;
3948
3949                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3950                                 cp.pkt_type |= HCI_3DH5;
3951                 }
3952
3953                 cp.handle = ev->handle;
3954                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
3955         }
3956 #endif
3957
3958         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3959                 struct hci_cp_remote_name_req cp;
3960                 memset(&cp, 0, sizeof(cp));
3961                 bacpy(&cp.bdaddr, &conn->dst);
3962                 cp.pscan_rep_mode = 0x02;
3963                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3964         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3965                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3966
3967         if (!hci_outgoing_auth_needed(hdev, conn)) {
3968                 conn->state = BT_CONNECTED;
3969                 hci_proto_connect_cfm(conn, ev->status);
3970                 hci_conn_drop(conn);
3971         }
3972
3973 unlock:
3974         hci_dev_unlock(hdev);
3975 }
3976
3977 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3978                                        struct sk_buff *skb)
3979 {
3980         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3981         struct hci_conn *conn;
3982
3983         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3984
3985         hci_dev_lock(hdev);
3986
3987         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3988         if (!conn) {
3989                 if (ev->link_type == ESCO_LINK)
3990                         goto unlock;
3991
3992                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3993                 if (!conn)
3994                         goto unlock;
3995
3996                 conn->type = SCO_LINK;
3997         }
3998
3999         switch (ev->status) {
4000         case 0x00:
4001                 conn->handle = __le16_to_cpu(ev->handle);
4002                 conn->state  = BT_CONNECTED;
4003
4004                 hci_debugfs_create_conn(conn);
4005                 hci_conn_add_sysfs(conn);
4006                 break;
4007
4008         case 0x10:      /* Connection Accept Timeout */
4009         case 0x0d:      /* Connection Rejected due to Limited Resources */
4010         case 0x11:      /* Unsupported Feature or Parameter Value */
4011         case 0x1c:      /* SCO interval rejected */
4012         case 0x1a:      /* Unsupported Remote Feature */
4013         case 0x1f:      /* Unspecified error */
4014         case 0x20:      /* Unsupported LMP Parameter value */
4015                 if (conn->out) {
4016                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4017                                         (hdev->esco_type & EDR_ESCO_MASK);
4018                         if (hci_setup_sync(conn, conn->link->handle))
4019                                 goto unlock;
4020                 }
4021                 /* fall through */
4022
4023         default:
4024                 conn->state = BT_CLOSED;
4025                 break;
4026         }
4027
4028         hci_proto_connect_cfm(conn, ev->status);
4029         if (ev->status)
4030                 hci_conn_del(conn);
4031
4032 unlock:
4033         hci_dev_unlock(hdev);
4034 }
4035
4036 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4037 {
4038         size_t parsed = 0;
4039
4040         while (parsed < eir_len) {
4041                 u8 field_len = eir[0];
4042
4043                 if (field_len == 0)
4044                         return parsed;
4045
4046                 parsed += field_len + 1;
4047                 eir += field_len + 1;
4048         }
4049
4050         return eir_len;
4051 }
4052
4053 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4054                                             struct sk_buff *skb)
4055 {
4056         struct inquiry_data data;
4057         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4058         int num_rsp = *((__u8 *) skb->data);
4059         size_t eir_len;
4060
4061         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4062
4063         if (!num_rsp)
4064                 return;
4065
4066         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
4067                 return;
4068
4069         hci_dev_lock(hdev);
4070
4071         for (; num_rsp; num_rsp--, info++) {
4072                 u32 flags;
4073                 bool name_known;
4074
4075                 bacpy(&data.bdaddr, &info->bdaddr);
4076                 data.pscan_rep_mode     = info->pscan_rep_mode;
4077                 data.pscan_period_mode  = info->pscan_period_mode;
4078                 data.pscan_mode         = 0x00;
4079                 memcpy(data.dev_class, info->dev_class, 3);
4080                 data.clock_offset       = info->clock_offset;
4081                 data.rssi               = info->rssi;
4082                 data.ssp_mode           = 0x01;
4083
4084                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
4085                         name_known = eir_has_data_type(info->data,
4086                                                        sizeof(info->data),
4087                                                        EIR_NAME_COMPLETE);
4088                 else
4089                         name_known = true;
4090
4091                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4092
4093                 eir_len = eir_get_length(info->data, sizeof(info->data));
4094
4095                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4096                                   info->dev_class, info->rssi,
4097                                   flags, info->data, eir_len, NULL, 0);
4098         }
4099
4100         hci_dev_unlock(hdev);
4101 }
4102
4103 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4104                                          struct sk_buff *skb)
4105 {
4106         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4107         struct hci_conn *conn;
4108
4109         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4110                __le16_to_cpu(ev->handle));
4111
4112         hci_dev_lock(hdev);
4113
4114         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4115         if (!conn)
4116                 goto unlock;
4117
4118         /* For BR/EDR the necessary steps are taken through the
4119          * auth_complete event.
4120          */
4121         if (conn->type != LE_LINK)
4122                 goto unlock;
4123
4124         if (!ev->status)
4125                 conn->sec_level = conn->pending_sec_level;
4126
4127         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4128
4129         if (ev->status && conn->state == BT_CONNECTED) {
4130                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4131                 hci_conn_drop(conn);
4132                 goto unlock;
4133         }
4134
4135         if (conn->state == BT_CONFIG) {
4136                 if (!ev->status)
4137                         conn->state = BT_CONNECTED;
4138
4139                 hci_proto_connect_cfm(conn, ev->status);
4140                 hci_conn_drop(conn);
4141         } else {
4142                 hci_auth_cfm(conn, ev->status);
4143
4144                 hci_conn_hold(conn);
4145                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4146                 hci_conn_drop(conn);
4147         }
4148
4149 unlock:
4150         hci_dev_unlock(hdev);
4151 }
4152
4153 static u8 hci_get_auth_req(struct hci_conn *conn)
4154 {
4155 #ifdef CONFIG_TIZEN_WIP
4156         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4157                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4158                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4159                         return HCI_AT_GENERAL_BONDING_MITM;
4160         }
4161 #endif
4162
4163         /* If remote requests no-bonding follow that lead */
4164         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4165             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4166                 return conn->remote_auth | (conn->auth_type & 0x01);
4167
4168         /* If both remote and local have enough IO capabilities, require
4169          * MITM protection
4170          */
4171         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4172             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4173                 return conn->remote_auth | 0x01;
4174
4175         /* No MITM protection possible so ignore remote requirement */
4176         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4177 }
4178
4179 static u8 bredr_oob_data_present(struct hci_conn *conn)
4180 {
4181         struct hci_dev *hdev = conn->hdev;
4182         struct oob_data *data;
4183
4184         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4185         if (!data)
4186                 return 0x00;
4187
4188         /* When Secure Connections Only mode is enabled, then the P-256
4189          * values are required. If they are not available, then do not
4190          * declare that OOB data is present.
4191          */
4192         if (bredr_sc_enabled(hdev) &&
4193             test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
4194             (!memcmp(data->rand256, ZERO_KEY, 16) ||
4195              !memcmp(data->hash256, ZERO_KEY, 16)))
4196                 return 0x00;
4197
4198         if (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags))
4199                 return 0x01;
4200
4201         return 0x00;
4202 }
4203
4204 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4205 {
4206         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4207         struct hci_conn *conn;
4208
4209         BT_DBG("%s", hdev->name);
4210
4211         hci_dev_lock(hdev);
4212
4213         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4214         if (!conn)
4215                 goto unlock;
4216
4217         hci_conn_hold(conn);
4218
4219         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4220                 goto unlock;
4221
4222         /* Allow pairing if we're pairable, the initiators of the
4223          * pairing or if the remote is not requesting bonding.
4224          */
4225         if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
4226             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4227             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4228                 struct hci_cp_io_capability_reply cp;
4229
4230                 bacpy(&cp.bdaddr, &ev->bdaddr);
4231                 /* Change the IO capability from KeyboardDisplay
4232                  * to DisplayYesNo as it is not supported by BT spec. */
4233                 cp.capability = (conn->io_capability == 0x04) ?
4234                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4235
4236                 /* If we are initiators, there is no remote information yet */
4237                 if (conn->remote_auth == 0xff) {
4238                         /* Request MITM protection if our IO caps allow it
4239                          * except for the no-bonding case.
4240                          */
4241                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4242                             conn->auth_type != HCI_AT_NO_BONDING)
4243                                 conn->auth_type |= 0x01;
4244                 } else {
4245                         conn->auth_type = hci_get_auth_req(conn);
4246                 }
4247
4248                 /* If we're not bondable, force one of the non-bondable
4249                  * authentication requirement values.
4250                  */
4251                 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
4252                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4253
4254                 cp.authentication = conn->auth_type;
4255                 cp.oob_data = bredr_oob_data_present(conn);
4256
4257                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4258                              sizeof(cp), &cp);
4259         } else {
4260                 struct hci_cp_io_capability_neg_reply cp;
4261
4262                 bacpy(&cp.bdaddr, &ev->bdaddr);
4263                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4264
4265                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4266                              sizeof(cp), &cp);
4267         }
4268
4269 unlock:
4270         hci_dev_unlock(hdev);
4271 }
4272
4273 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4274 {
4275         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4276         struct hci_conn *conn;
4277
4278         BT_DBG("%s", hdev->name);
4279
4280         hci_dev_lock(hdev);
4281
4282         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4283         if (!conn)
4284                 goto unlock;
4285
4286         conn->remote_cap = ev->capability;
4287         conn->remote_auth = ev->authentication;
4288         if (ev->oob_data)
4289                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
4290
4291 unlock:
4292         hci_dev_unlock(hdev);
4293 }
4294
4295 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4296                                          struct sk_buff *skb)
4297 {
4298         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4299         int loc_mitm, rem_mitm, confirm_hint = 0;
4300         struct hci_conn *conn;
4301
4302         BT_DBG("%s", hdev->name);
4303
4304         hci_dev_lock(hdev);
4305
4306         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4307                 goto unlock;
4308
4309         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4310         if (!conn)
4311                 goto unlock;
4312
4313         loc_mitm = (conn->auth_type & 0x01);
4314         rem_mitm = (conn->remote_auth & 0x01);
4315
4316         /* If we require MITM but the remote device can't provide that
4317          * (it has NoInputNoOutput) then reject the confirmation
4318          * request. We check the security level here since it doesn't
4319          * necessarily match conn->auth_type.
4320          */
4321         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4322             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4323                 BT_DBG("Rejecting request: remote device can't provide MITM");
4324                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4325                              sizeof(ev->bdaddr), &ev->bdaddr);
4326                 goto unlock;
4327         }
4328
4329         /* If no side requires MITM protection; auto-accept */
4330         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4331             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4332
4333                 /* If we're not the initiators request authorization to
4334                  * proceed from user space (mgmt_user_confirm with
4335                  * confirm_hint set to 1). The exception is if neither
4336                  * side had MITM or if the local IO capability is
4337                  * NoInputNoOutput, in which case we do auto-accept
4338                  */
4339                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4340                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4341                     (loc_mitm || rem_mitm)) {
4342                         BT_DBG("Confirming auto-accept as acceptor");
4343                         confirm_hint = 1;
4344                         goto confirm;
4345                 }
4346
4347                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4348                        hdev->auto_accept_delay);
4349
4350                 if (hdev->auto_accept_delay > 0) {
4351                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4352                         queue_delayed_work(conn->hdev->workqueue,
4353                                            &conn->auto_accept_work, delay);
4354                         goto unlock;
4355                 }
4356
4357                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4358                              sizeof(ev->bdaddr), &ev->bdaddr);
4359                 goto unlock;
4360         }
4361
4362 confirm:
4363         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4364                                   le32_to_cpu(ev->passkey), confirm_hint);
4365
4366 unlock:
4367         hci_dev_unlock(hdev);
4368 }
4369
4370 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4371                                          struct sk_buff *skb)
4372 {
4373         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4374
4375         BT_DBG("%s", hdev->name);
4376
4377         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4378                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4379 }
4380
4381 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4382                                         struct sk_buff *skb)
4383 {
4384         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4385         struct hci_conn *conn;
4386
4387         BT_DBG("%s", hdev->name);
4388
4389         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4390         if (!conn)
4391                 return;
4392
4393         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4394         conn->passkey_entered = 0;
4395
4396         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4397                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4398                                          conn->dst_type, conn->passkey_notify,
4399                                          conn->passkey_entered);
4400 }
4401
4402 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4403 {
4404         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4405         struct hci_conn *conn;
4406
4407         BT_DBG("%s", hdev->name);
4408
4409         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4410         if (!conn)
4411                 return;
4412
4413         switch (ev->type) {
4414         case HCI_KEYPRESS_STARTED:
4415                 conn->passkey_entered = 0;
4416                 return;
4417
4418         case HCI_KEYPRESS_ENTERED:
4419                 conn->passkey_entered++;
4420                 break;
4421
4422         case HCI_KEYPRESS_ERASED:
4423                 conn->passkey_entered--;
4424                 break;
4425
4426         case HCI_KEYPRESS_CLEARED:
4427                 conn->passkey_entered = 0;
4428                 break;
4429
4430         case HCI_KEYPRESS_COMPLETED:
4431                 return;
4432         }
4433
4434         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4435                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4436                                          conn->dst_type, conn->passkey_notify,
4437                                          conn->passkey_entered);
4438 }
4439
4440 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4441                                          struct sk_buff *skb)
4442 {
4443         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4444         struct hci_conn *conn;
4445
4446         BT_DBG("%s", hdev->name);
4447
4448         hci_dev_lock(hdev);
4449
4450         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4451         if (!conn)
4452                 goto unlock;
4453
4454         /* Reset the authentication requirement to unknown */
4455         conn->remote_auth = 0xff;
4456
4457         /* To avoid duplicate auth_failed events to user space we check
4458          * the HCI_CONN_AUTH_PEND flag which will be set if we
4459          * initiated the authentication. A traditional auth_complete
4460          * event gets always produced as initiator and is also mapped to
4461          * the mgmt_auth_failed event */
4462         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4463                 mgmt_auth_failed(conn, ev->status);
4464
4465         hci_conn_drop(conn);
4466
4467 unlock:
4468         hci_dev_unlock(hdev);
4469 }
4470
4471 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4472                                          struct sk_buff *skb)
4473 {
4474         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4475         struct inquiry_entry *ie;
4476         struct hci_conn *conn;
4477
4478         BT_DBG("%s", hdev->name);
4479
4480         hci_dev_lock(hdev);
4481
4482         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4483         if (conn)
4484                 memcpy(conn->features[1], ev->features, 8);
4485
4486         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4487         if (ie)
4488                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4489
4490         hci_dev_unlock(hdev);
4491 }
4492
4493 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4494                                             struct sk_buff *skb)
4495 {
4496         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4497         struct oob_data *data;
4498
4499         BT_DBG("%s", hdev->name);
4500
4501         hci_dev_lock(hdev);
4502
4503         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4504                 goto unlock;
4505
4506         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4507         if (!data) {
4508                 struct hci_cp_remote_oob_data_neg_reply cp;
4509
4510                 bacpy(&cp.bdaddr, &ev->bdaddr);
4511                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4512                              sizeof(cp), &cp);
4513                 goto unlock;
4514         }
4515
4516         if (bredr_sc_enabled(hdev)) {
4517                 struct hci_cp_remote_oob_ext_data_reply cp;
4518
4519                 bacpy(&cp.bdaddr, &ev->bdaddr);
4520                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4521                         memset(cp.hash192, 0, sizeof(cp.hash192));
4522                         memset(cp.rand192, 0, sizeof(cp.rand192));
4523                 } else {
4524                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4525                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4526                 }
4527                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4528                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4529
4530                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4531                              sizeof(cp), &cp);
4532         } else {
4533                 struct hci_cp_remote_oob_data_reply cp;
4534
4535                 bacpy(&cp.bdaddr, &ev->bdaddr);
4536                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4537                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4538
4539                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4540                              sizeof(cp), &cp);
4541         }
4542
4543 unlock:
4544         hci_dev_unlock(hdev);
4545 }
4546
4547 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4548                                       struct sk_buff *skb)
4549 {
4550         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4551         struct hci_conn *hcon, *bredr_hcon;
4552
4553         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4554                ev->status);
4555
4556         hci_dev_lock(hdev);
4557
4558         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4559         if (!hcon) {
4560                 hci_dev_unlock(hdev);
4561                 return;
4562         }
4563
4564         if (ev->status) {
4565                 hci_conn_del(hcon);
4566                 hci_dev_unlock(hdev);
4567                 return;
4568         }
4569
4570         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4571
4572         hcon->state = BT_CONNECTED;
4573         bacpy(&hcon->dst, &bredr_hcon->dst);
4574
4575         hci_conn_hold(hcon);
4576         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4577         hci_conn_drop(hcon);
4578
4579         hci_debugfs_create_conn(hcon);
4580         hci_conn_add_sysfs(hcon);
4581
4582         amp_physical_cfm(bredr_hcon, hcon);
4583
4584         hci_dev_unlock(hdev);
4585 }
4586
4587 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4588 {
4589         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4590         struct hci_conn *hcon;
4591         struct hci_chan *hchan;
4592         struct amp_mgr *mgr;
4593
4594         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4595                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4596                ev->status);
4597
4598         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4599         if (!hcon)
4600                 return;
4601
4602         /* Create AMP hchan */
4603         hchan = hci_chan_create(hcon);
4604         if (!hchan)
4605                 return;
4606
4607         hchan->handle = le16_to_cpu(ev->handle);
4608
4609         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4610
4611         mgr = hcon->amp_mgr;
4612         if (mgr && mgr->bredr_chan) {
4613                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4614
4615                 l2cap_chan_lock(bredr_chan);
4616
4617                 bredr_chan->conn->mtu = hdev->block_mtu;
4618                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4619                 hci_conn_hold(hcon);
4620
4621                 l2cap_chan_unlock(bredr_chan);
4622         }
4623 }
4624
4625 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4626                                              struct sk_buff *skb)
4627 {
4628         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4629         struct hci_chan *hchan;
4630
4631         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4632                le16_to_cpu(ev->handle), ev->status);
4633
4634         if (ev->status)
4635                 return;
4636
4637         hci_dev_lock(hdev);
4638
4639         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4640         if (!hchan)
4641                 goto unlock;
4642
4643         amp_destroy_logical_link(hchan, ev->reason);
4644
4645 unlock:
4646         hci_dev_unlock(hdev);
4647 }
4648
4649 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4650                                              struct sk_buff *skb)
4651 {
4652         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4653         struct hci_conn *hcon;
4654
4655         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4656
4657         if (ev->status)
4658                 return;
4659
4660         hci_dev_lock(hdev);
4661
4662         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4663         if (hcon) {
4664                 hcon->state = BT_CLOSED;
4665                 hci_conn_del(hcon);
4666         }
4667
4668         hci_dev_unlock(hdev);
4669 }
4670
4671 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4672 {
4673         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4674         struct hci_conn_params *params;
4675         struct hci_conn *conn;
4676         struct smp_irk *irk;
4677         u8 addr_type;
4678
4679         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4680
4681         hci_dev_lock(hdev);
4682
4683         /* All controllers implicitly stop advertising in the event of a
4684          * connection, so ensure that the state bit is cleared.
4685          */
4686         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4687
4688         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4689         if (!conn) {
4690                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4691                 if (!conn) {
4692                         BT_ERR("No memory for new connection");
4693                         goto unlock;
4694                 }
4695
4696                 conn->dst_type = ev->bdaddr_type;
4697
4698                 /* If we didn't have a hci_conn object previously
4699                  * but we're in master role this must be something
4700                  * initiated using a white list. Since white list based
4701                  * connections are not "first class citizens" we don't
4702                  * have full tracking of them. Therefore, we go ahead
4703                  * with a "best effort" approach of determining the
4704                  * initiator address based on the HCI_PRIVACY flag.
4705                  */
4706                 if (conn->out) {
4707                         conn->resp_addr_type = ev->bdaddr_type;
4708                         bacpy(&conn->resp_addr, &ev->bdaddr);
4709                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4710                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4711                                 bacpy(&conn->init_addr, &hdev->rpa);
4712                         } else {
4713                                 hci_copy_identity_address(hdev,
4714                                                           &conn->init_addr,
4715                                                           &conn->init_addr_type);
4716                         }
4717                 }
4718         } else {
4719 #ifdef CONFIG_TIZEN_WIP
4720                 /* LE auto connect */
4721                 bacpy(&conn->dst, &ev->bdaddr);
4722 #endif
4723                 cancel_delayed_work(&conn->le_conn_timeout);
4724         }
4725
4726         if (!conn->out) {
4727                 /* Set the responder (our side) address type based on
4728                  * the advertising address type.
4729                  */
4730                 conn->resp_addr_type = hdev->adv_addr_type;
4731                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4732                         bacpy(&conn->resp_addr, &hdev->random_addr);
4733                 else
4734                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4735
4736                 conn->init_addr_type = ev->bdaddr_type;
4737                 bacpy(&conn->init_addr, &ev->bdaddr);
4738
4739                 /* For incoming connections, set the default minimum
4740                  * and maximum connection interval. They will be used
4741                  * to check if the parameters are in range and if not
4742                  * trigger the connection update procedure.
4743                  */
4744                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4745                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4746         }
4747
4748         /* Lookup the identity address from the stored connection
4749          * address and address type.
4750          *
4751          * When establishing connections to an identity address, the
4752          * connection procedure will store the resolvable random
4753          * address first. Now if it can be converted back into the
4754          * identity address, start using the identity address from
4755          * now on.
4756          */
4757         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4758         if (irk) {
4759 #ifdef __TIZEN_PATCH__
4760                 /* Update rpa. So that, if irk is refreshed, it can be saved */
4761                 bacpy(&irk->rpa, &conn->dst);
4762 #endif
4763                 bacpy(&conn->dst, &irk->bdaddr);
4764                 conn->dst_type = irk->addr_type;
4765         }
4766
4767         if (ev->status) {
4768                 hci_le_conn_failed(conn, ev->status);
4769                 goto unlock;
4770         }
4771
4772         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4773                 addr_type = BDADDR_LE_PUBLIC;
4774         else
4775                 addr_type = BDADDR_LE_RANDOM;
4776
4777         /* Drop the connection if the device is blocked */
4778         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4779                 hci_conn_drop(conn);
4780                 goto unlock;
4781         }
4782
4783         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4784                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4785
4786         conn->sec_level = BT_SECURITY_LOW;
4787         conn->handle = __le16_to_cpu(ev->handle);
4788         conn->state = BT_CONNECTED;
4789
4790         conn->le_conn_interval = le16_to_cpu(ev->interval);
4791         conn->le_conn_latency = le16_to_cpu(ev->latency);
4792         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4793
4794         hci_debugfs_create_conn(conn);
4795         hci_conn_add_sysfs(conn);
4796
4797         hci_proto_connect_cfm(conn, ev->status);
4798
4799         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4800                                            conn->dst_type);
4801         if (params) {
4802                 list_del_init(&params->action);
4803                 if (params->conn) {
4804                         hci_conn_drop(params->conn);
4805                         hci_conn_put(params->conn);
4806                         params->conn = NULL;
4807                 }
4808         }
4809
4810 unlock:
4811         hci_update_background_scan(hdev);
4812         hci_dev_unlock(hdev);
4813 }
4814
4815 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4816                                             struct sk_buff *skb)
4817 {
4818         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4819         struct hci_conn *conn;
4820
4821         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4822
4823         if (ev->status)
4824                 return;
4825
4826         hci_dev_lock(hdev);
4827
4828         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4829         if (conn) {
4830                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4831                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4832                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4833         }
4834
4835         hci_dev_unlock(hdev);
4836 }
4837
4838 /* This function requires the caller holds hdev->lock */
4839 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4840                                               bdaddr_t *addr,
4841                                               u8 addr_type, u8 adv_type)
4842 {
4843         struct hci_conn *conn;
4844         struct hci_conn_params *params;
4845
4846         /* If the event is not connectable don't proceed further */
4847         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4848                 return NULL;
4849
4850         /* Ignore if the device is blocked */
4851         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4852                 return NULL;
4853
4854         /* Most controller will fail if we try to create new connections
4855          * while we have an existing one in slave role.
4856          */
4857         if (hdev->conn_hash.le_num_slave > 0)
4858                 return NULL;
4859
4860         /* If we're not connectable only connect devices that we have in
4861          * our pend_le_conns list.
4862          */
4863         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4864                                            addr, addr_type);
4865         if (!params)
4866                 return NULL;
4867
4868         switch (params->auto_connect) {
4869         case HCI_AUTO_CONN_DIRECT:
4870                 /* Only devices advertising with ADV_DIRECT_IND are
4871                  * triggering a connection attempt. This is allowing
4872                  * incoming connections from slave devices.
4873                  */
4874                 if (adv_type != LE_ADV_DIRECT_IND)
4875                         return NULL;
4876                 break;
4877         case HCI_AUTO_CONN_ALWAYS:
4878                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4879                  * are triggering a connection attempt. This means
4880                  * that incoming connectioms from slave device are
4881                  * accepted and also outgoing connections to slave
4882                  * devices are established when found.
4883                  */
4884                 break;
4885         default:
4886                 return NULL;
4887         }
4888
4889         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4890                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4891         if (!IS_ERR(conn)) {
4892                 /* Store the pointer since we don't really have any
4893                  * other owner of the object besides the params that
4894                  * triggered it. This way we can abort the connection if
4895                  * the parameters get removed and keep the reference
4896                  * count consistent once the connection is established.
4897                  */
4898                 params->conn = hci_conn_get(conn);
4899                 return conn;
4900         }
4901
4902         switch (PTR_ERR(conn)) {
4903         case -EBUSY:
4904                 /* If hci_connect() returns -EBUSY it means there is already
4905                  * an LE connection attempt going on. Since controllers don't
4906                  * support more than one connection attempt at the time, we
4907                  * don't consider this an error case.
4908                  */
4909                 break;
4910         default:
4911                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4912                 return NULL;
4913         }
4914
4915         return NULL;
4916 }
4917
4918 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4919                                u8 bdaddr_type, bdaddr_t *direct_addr,
4920                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4921 {
4922 #ifndef CONFIG_TIZEN_WIP
4923         struct discovery_state *d = &hdev->discovery;
4924 #endif
4925         struct smp_irk *irk;
4926         struct hci_conn *conn;
4927 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
4928         bool match;
4929 #endif
4930         u32 flags;
4931
4932         /* If the direct address is present, then this report is from
4933          * a LE Direct Advertising Report event. In that case it is
4934          * important to see if the address is matching the local
4935          * controller address.
4936          */
4937         if (direct_addr) {
4938                 /* Only resolvable random addresses are valid for these
4939                  * kind of reports and others can be ignored.
4940                  */
4941                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4942                         return;
4943
4944                 /* If the controller is not using resolvable random
4945                  * addresses, then this report can be ignored.
4946                  */
4947                 if (!test_bit(HCI_PRIVACY, &hdev->dev_flags))
4948                         return;
4949
4950                 /* If the local IRK of the controller does not match
4951                  * with the resolvable random address provided, then
4952                  * this report can be ignored.
4953                  */
4954                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4955                         return;
4956         }
4957
4958         /* Check if we need to convert to identity address */
4959         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4960         if (irk) {
4961                 bdaddr = &irk->bdaddr;
4962                 bdaddr_type = irk->addr_type;
4963         }
4964
4965         /* Check if we have been requested to connect to this device */
4966         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4967         if (conn && type == LE_ADV_IND) {
4968                 /* Store report for later inclusion by
4969                  * mgmt_device_connected
4970                  */
4971                 memcpy(conn->le_adv_data, data, len);
4972                 conn->le_adv_data_len = len;
4973         }
4974
4975         /* Passive scanning shouldn't trigger any device found events,
4976          * except for devices marked as CONN_REPORT for which we do send
4977          * device found events.
4978          */
4979         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4980                 if (type == LE_ADV_DIRECT_IND)
4981                         return;
4982
4983 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Handle all adv packet in platform */
4984                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4985                                                bdaddr, bdaddr_type))
4986                         return;
4987 #endif
4988
4989                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4990                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4991                 else
4992                         flags = 0;
4993
4994 #ifdef CONFIG_TIZEN_WIP
4995                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4996                                   rssi, flags, data, len, NULL, 0, type);
4997 #else
4998                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4999                                   rssi, flags, data, len, NULL, 0);
5000 #endif
5001                 return;
5002         }
5003
5004         /* When receiving non-connectable or scannable undirected
5005          * advertising reports, this means that the remote device is
5006          * not connectable and then clearly indicate this in the
5007          * device found event.
5008          *
5009          * When receiving a scan response, then there is no way to
5010          * know if the remote device is connectable or not. However
5011          * since scan responses are merged with a previously seen
5012          * advertising report, the flags field from that report
5013          * will be used.
5014          *
5015          * In the really unlikely case that a controller get confused
5016          * and just sends a scan response event, then it is marked as
5017          * not connectable as well.
5018          */
5019         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5020             type == LE_ADV_SCAN_RSP)
5021                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5022         else
5023                 flags = 0;
5024
5025 #ifdef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
5026         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5027                   rssi, flags, data, len, NULL, 0, type);
5028 #else
5029         /* If there's nothing pending either store the data from this
5030          * event or send an immediate device found event if the data
5031          * should not be stored for later.
5032          */
5033         if (!has_pending_adv_report(hdev)) {
5034                 /* If the report will trigger a SCAN_REQ store it for
5035                  * later merging.
5036                  */
5037                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5038                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5039                                                  rssi, flags, data, len);
5040                         return;
5041                 }
5042
5043                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5044                                   rssi, flags, data, len, NULL, 0);
5045                 return;
5046         }
5047
5048         /* Check if the pending report is for the same device as the new one */
5049         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5050                  bdaddr_type == d->last_adv_addr_type);
5051
5052         /* If the pending data doesn't match this report or this isn't a
5053          * scan response (e.g. we got a duplicate ADV_IND) then force
5054          * sending of the pending data.
5055          */
5056         if (type != LE_ADV_SCAN_RSP || !match) {
5057                 /* Send out whatever is in the cache, but skip duplicates */
5058                 if (!match)
5059                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5060                                           d->last_adv_addr_type, NULL,
5061                                           d->last_adv_rssi, d->last_adv_flags,
5062                                           d->last_adv_data,
5063                                           d->last_adv_data_len, NULL, 0);
5064
5065                 /* If the new report will trigger a SCAN_REQ store it for
5066                  * later merging.
5067                  */
5068                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5069                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5070                                                  rssi, flags, data, len);
5071                         return;
5072                 }
5073
5074                 /* The advertising reports cannot be merged, so clear
5075                  * the pending report and send out a device found event.
5076                  */
5077                 clear_pending_adv_report(hdev);
5078                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5079                                   rssi, flags, data, len, NULL, 0);
5080                 return;
5081         }
5082
5083         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5084          * the new event is a SCAN_RSP. We can therefore proceed with
5085          * sending a merged device found event.
5086          */
5087         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5088                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5089                           d->last_adv_data, d->last_adv_data_len, data, len);
5090         clear_pending_adv_report(hdev);
5091 #endif
5092 }
5093
5094 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5095 {
5096         u8 num_reports = skb->data[0];
5097         void *ptr = &skb->data[1];
5098
5099         hci_dev_lock(hdev);
5100
5101         while (num_reports--) {
5102                 struct hci_ev_le_advertising_info *ev = ptr;
5103                 s8 rssi;
5104
5105                 rssi = ev->data[ev->length];
5106                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5107                                    ev->bdaddr_type, NULL, 0, rssi,
5108                                    ev->data, ev->length);
5109
5110                 ptr += sizeof(*ev) + ev->length + 1;
5111         }
5112
5113         hci_dev_unlock(hdev);
5114 }
5115
5116 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5117 {
5118         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5119         struct hci_cp_le_ltk_reply cp;
5120         struct hci_cp_le_ltk_neg_reply neg;
5121         struct hci_conn *conn;
5122         struct smp_ltk *ltk;
5123
5124         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5125
5126         hci_dev_lock(hdev);
5127
5128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5129         if (conn == NULL)
5130                 goto not_found;
5131
5132         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5133         if (!ltk)
5134                 goto not_found;
5135
5136         if (smp_ltk_is_sc(ltk)) {
5137                 /* With SC both EDiv and Rand are set to zero */
5138                 if (ev->ediv || ev->rand)
5139                         goto not_found;
5140         } else {
5141                 /* For non-SC keys check that EDiv and Rand match */
5142                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5143                         goto not_found;
5144         }
5145
5146         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
5147         cp.handle = cpu_to_le16(conn->handle);
5148
5149         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5150
5151         conn->enc_key_size = ltk->enc_size;
5152
5153         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5154
5155         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5156          * temporary key used to encrypt a connection following
5157          * pairing. It is used during the Encrypted Session Setup to
5158          * distribute the keys. Later, security can be re-established
5159          * using a distributed LTK.
5160          */
5161         if (ltk->type == SMP_STK) {
5162                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5163                 list_del_rcu(&ltk->list);
5164                 kfree_rcu(ltk, rcu);
5165         } else {
5166                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5167         }
5168
5169         hci_dev_unlock(hdev);
5170
5171         return;
5172
5173 not_found:
5174         neg.handle = ev->handle;
5175         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5176         hci_dev_unlock(hdev);
5177 }
5178
5179 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5180                                       u8 reason)
5181 {
5182         struct hci_cp_le_conn_param_req_neg_reply cp;
5183
5184         cp.handle = cpu_to_le16(handle);
5185         cp.reason = reason;
5186
5187         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5188                      &cp);
5189 }
5190
5191 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5192                                              struct sk_buff *skb)
5193 {
5194         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5195         struct hci_cp_le_conn_param_req_reply cp;
5196         struct hci_conn *hcon;
5197         u16 handle, min, max, latency, timeout;
5198
5199         handle = le16_to_cpu(ev->handle);
5200         min = le16_to_cpu(ev->interval_min);
5201         max = le16_to_cpu(ev->interval_max);
5202         latency = le16_to_cpu(ev->latency);
5203         timeout = le16_to_cpu(ev->timeout);
5204
5205         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5206         if (!hcon || hcon->state != BT_CONNECTED)
5207                 return send_conn_param_neg_reply(hdev, handle,
5208                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5209
5210         if (hci_check_conn_params(min, max, latency, timeout))
5211                 return send_conn_param_neg_reply(hdev, handle,
5212                                                  HCI_ERROR_INVALID_LL_PARAMS);
5213
5214         if (hcon->role == HCI_ROLE_MASTER) {
5215                 struct hci_conn_params *params;
5216                 u8 store_hint;
5217
5218                 hci_dev_lock(hdev);
5219
5220                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5221                                                 hcon->dst_type);
5222                 if (params) {
5223                         params->conn_min_interval = min;
5224                         params->conn_max_interval = max;
5225                         params->conn_latency = latency;
5226                         params->supervision_timeout = timeout;
5227                         store_hint = 0x01;
5228                 } else{
5229                         store_hint = 0x00;
5230                 }
5231
5232                 hci_dev_unlock(hdev);
5233
5234                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5235                                     store_hint, min, max, latency, timeout);
5236         }
5237
5238         cp.handle = ev->handle;
5239         cp.interval_min = ev->interval_min;
5240         cp.interval_max = ev->interval_max;
5241         cp.latency = ev->latency;
5242         cp.timeout = ev->timeout;
5243         cp.min_ce_len = 0;
5244         cp.max_ce_len = 0;
5245
5246         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5247 }
5248
5249 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5250                                          struct sk_buff *skb)
5251 {
5252         u8 num_reports = skb->data[0];
5253         void *ptr = &skb->data[1];
5254
5255         hci_dev_lock(hdev);
5256
5257         while (num_reports--) {
5258                 struct hci_ev_le_direct_adv_info *ev = ptr;
5259
5260                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5261                                    ev->bdaddr_type, &ev->direct_addr,
5262                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5263
5264                 ptr += sizeof(*ev);
5265         }
5266
5267         hci_dev_unlock(hdev);
5268 }
5269
5270 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5271 {
5272         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5273
5274         skb_pull(skb, sizeof(*le_ev));
5275
5276         switch (le_ev->subevent) {
5277         case HCI_EV_LE_CONN_COMPLETE:
5278                 hci_le_conn_complete_evt(hdev, skb);
5279                 break;
5280
5281         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5282                 hci_le_conn_update_complete_evt(hdev, skb);
5283                 break;
5284
5285         case HCI_EV_LE_ADVERTISING_REPORT:
5286                 hci_le_adv_report_evt(hdev, skb);
5287                 break;
5288
5289         case HCI_EV_LE_LTK_REQ:
5290                 hci_le_ltk_request_evt(hdev, skb);
5291                 break;
5292
5293         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5294                 hci_le_remote_conn_param_req_evt(hdev, skb);
5295                 break;
5296
5297         case HCI_EV_LE_DIRECT_ADV_REPORT:
5298                 hci_le_direct_adv_report_evt(hdev, skb);
5299                 break;
5300
5301         default:
5302                 break;
5303         }
5304 }
5305
5306 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5307 {
5308         struct hci_ev_channel_selected *ev = (void *) skb->data;
5309         struct hci_conn *hcon;
5310
5311         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5312
5313         skb_pull(skb, sizeof(*ev));
5314
5315         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5316         if (!hcon)
5317                 return;
5318
5319         amp_read_loc_assoc_final_data(hdev, hcon);
5320 }
5321
5322 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5323 {
5324         struct hci_event_hdr *hdr = (void *) skb->data;
5325         __u8 event = hdr->evt;
5326
5327         hci_dev_lock(hdev);
5328
5329         /* Received events are (currently) only needed when a request is
5330          * ongoing so avoid unnecessary memory allocation.
5331          */
5332         if (hci_req_pending(hdev)) {
5333                 kfree_skb(hdev->recv_evt);
5334                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
5335         }
5336
5337         hci_dev_unlock(hdev);
5338
5339         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5340
5341         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5342                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5343                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
5344
5345                 hci_req_cmd_complete(hdev, opcode, 0);
5346         }
5347
5348         switch (event) {
5349         case HCI_EV_INQUIRY_COMPLETE:
5350                 hci_inquiry_complete_evt(hdev, skb);
5351                 break;
5352
5353         case HCI_EV_INQUIRY_RESULT:
5354                 hci_inquiry_result_evt(hdev, skb);
5355                 break;
5356
5357         case HCI_EV_CONN_COMPLETE:
5358                 hci_conn_complete_evt(hdev, skb);
5359                 break;
5360
5361         case HCI_EV_CONN_REQUEST:
5362                 hci_conn_request_evt(hdev, skb);
5363                 break;
5364
5365         case HCI_EV_DISCONN_COMPLETE:
5366                 hci_disconn_complete_evt(hdev, skb);
5367                 break;
5368
5369         case HCI_EV_AUTH_COMPLETE:
5370                 hci_auth_complete_evt(hdev, skb);
5371                 break;
5372
5373         case HCI_EV_REMOTE_NAME:
5374                 hci_remote_name_evt(hdev, skb);
5375                 break;
5376
5377         case HCI_EV_ENCRYPT_CHANGE:
5378                 hci_encrypt_change_evt(hdev, skb);
5379                 break;
5380
5381         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5382                 hci_change_link_key_complete_evt(hdev, skb);
5383                 break;
5384
5385         case HCI_EV_REMOTE_FEATURES:
5386                 hci_remote_features_evt(hdev, skb);
5387                 break;
5388
5389         case HCI_EV_CMD_COMPLETE:
5390                 hci_cmd_complete_evt(hdev, skb);
5391                 break;
5392
5393         case HCI_EV_CMD_STATUS:
5394                 hci_cmd_status_evt(hdev, skb);
5395                 break;
5396
5397         case HCI_EV_HARDWARE_ERROR:
5398                 hci_hardware_error_evt(hdev, skb);
5399                 break;
5400
5401         case HCI_EV_ROLE_CHANGE:
5402                 hci_role_change_evt(hdev, skb);
5403                 break;
5404
5405         case HCI_EV_NUM_COMP_PKTS:
5406                 hci_num_comp_pkts_evt(hdev, skb);
5407                 break;
5408
5409         case HCI_EV_MODE_CHANGE:
5410                 hci_mode_change_evt(hdev, skb);
5411                 break;
5412
5413         case HCI_EV_PIN_CODE_REQ:
5414                 hci_pin_code_request_evt(hdev, skb);
5415                 break;
5416
5417         case HCI_EV_LINK_KEY_REQ:
5418                 hci_link_key_request_evt(hdev, skb);
5419                 break;
5420
5421         case HCI_EV_LINK_KEY_NOTIFY:
5422                 hci_link_key_notify_evt(hdev, skb);
5423                 break;
5424
5425         case HCI_EV_CLOCK_OFFSET:
5426                 hci_clock_offset_evt(hdev, skb);
5427                 break;
5428
5429         case HCI_EV_PKT_TYPE_CHANGE:
5430                 hci_pkt_type_change_evt(hdev, skb);
5431                 break;
5432
5433         case HCI_EV_PSCAN_REP_MODE:
5434                 hci_pscan_rep_mode_evt(hdev, skb);
5435                 break;
5436
5437         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5438                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5439                 break;
5440
5441         case HCI_EV_REMOTE_EXT_FEATURES:
5442                 hci_remote_ext_features_evt(hdev, skb);
5443                 break;
5444
5445         case HCI_EV_SYNC_CONN_COMPLETE:
5446                 hci_sync_conn_complete_evt(hdev, skb);
5447                 break;
5448
5449         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5450                 hci_extended_inquiry_result_evt(hdev, skb);
5451                 break;
5452
5453         case HCI_EV_KEY_REFRESH_COMPLETE:
5454                 hci_key_refresh_complete_evt(hdev, skb);
5455                 break;
5456
5457         case HCI_EV_IO_CAPA_REQUEST:
5458                 hci_io_capa_request_evt(hdev, skb);
5459                 break;
5460
5461         case HCI_EV_IO_CAPA_REPLY:
5462                 hci_io_capa_reply_evt(hdev, skb);
5463                 break;
5464
5465         case HCI_EV_USER_CONFIRM_REQUEST:
5466                 hci_user_confirm_request_evt(hdev, skb);
5467                 break;
5468
5469         case HCI_EV_USER_PASSKEY_REQUEST:
5470                 hci_user_passkey_request_evt(hdev, skb);
5471                 break;
5472
5473         case HCI_EV_USER_PASSKEY_NOTIFY:
5474                 hci_user_passkey_notify_evt(hdev, skb);
5475                 break;
5476
5477         case HCI_EV_KEYPRESS_NOTIFY:
5478                 hci_keypress_notify_evt(hdev, skb);
5479                 break;
5480
5481         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5482                 hci_simple_pair_complete_evt(hdev, skb);
5483                 break;
5484
5485         case HCI_EV_REMOTE_HOST_FEATURES:
5486                 hci_remote_host_features_evt(hdev, skb);
5487                 break;
5488
5489         case HCI_EV_LE_META:
5490                 hci_le_meta_evt(hdev, skb);
5491                 break;
5492
5493         case HCI_EV_CHANNEL_SELECTED:
5494                 hci_chan_selected_evt(hdev, skb);
5495                 break;
5496
5497         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5498                 hci_remote_oob_data_request_evt(hdev, skb);
5499                 break;
5500
5501         case HCI_EV_PHY_LINK_COMPLETE:
5502                 hci_phy_link_complete_evt(hdev, skb);
5503                 break;
5504
5505         case HCI_EV_LOGICAL_LINK_COMPLETE:
5506                 hci_loglink_complete_evt(hdev, skb);
5507                 break;
5508
5509         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5510                 hci_disconn_loglink_complete_evt(hdev, skb);
5511                 break;
5512
5513         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5514                 hci_disconn_phylink_complete_evt(hdev, skb);
5515                 break;
5516
5517         case HCI_EV_NUM_COMP_BLOCKS:
5518                 hci_num_comp_blocks_evt(hdev, skb);
5519                 break;
5520
5521 #ifdef CONFIG_TIZEN_WIP
5522         case HCI_EV_VENDOR_SPECIFIC:
5523                 hci_vendor_specific_evt(hdev, skb);
5524                 break;
5525 #endif
5526
5527         default:
5528                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5529                 break;
5530         }
5531
5532         kfree_skb(skb);
5533         hdev->stat.evt_rx++;
5534 }