net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54 #ifdef CONFIG_TIZEN_WIP
  55         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  56 #else
  57         /* In latest kernel, smp_mb__after_clear_bit is replaced with
  58           * smp_mb__after_atomic. So, if kernel is migrated to latest,
  59           * then below code should be enabled
  60           */
  61         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  62 #endif
  63         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  64
  65         hci_dev_lock(hdev);
  66         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  67         hci_dev_unlock(hdev);
  68
  69         hci_conn_check_pending(hdev);
  70 }
  71
  72 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         __u8 status = *((__u8 *) skb->data);
  75
  76         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  77
  78         if (status)
  79                 return;
  80
  81         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  82 }
  83
  84 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  85 {
  86         __u8 status = *((__u8 *) skb->data);
  87
  88         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  89
  90         if (status)
  91                 return;
  92
  93         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  94
  95         hci_conn_check_pending(hdev);
  96 }
  97
  98 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  99                                           struct sk_buff *skb)
 100 {
 101         BT_DBG("%s", hdev->name);
 102 }
 103
 104 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 105 {
 106         struct hci_rp_role_discovery *rp = (void *) skb->data;
 107         struct hci_conn *conn;
 108
 109         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 110
 111         if (rp->status)
 112                 return;
 113
 114         hci_dev_lock(hdev);
 115
 116         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 117         if (conn)
 118                 conn->role = rp->role;
 119
 120         hci_dev_unlock(hdev);
 121 }
 122
 123 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 124 {
 125         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 126         struct hci_conn *conn;
 127
 128         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 129
 130         if (rp->status)
 131                 return;
 132
 133         hci_dev_lock(hdev);
 134
 135         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 136         if (conn)
 137                 conn->link_policy = __le16_to_cpu(rp->policy);
 138
 139         hci_dev_unlock(hdev);
 140 }
 141
 142 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 143 {
 144         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 145 #ifdef CONFIG_TIZEN_WIP
 146         struct hci_cp_write_link_policy cp;
 147         struct hci_conn *sco_conn;
 148 #endif
 149         struct hci_conn *conn;
 150         void *sent;
 151
 152         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 153
 154         if (rp->status)
 155                 return;
 156
 157         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 158         if (!sent)
 159                 return;
 160
 161         hci_dev_lock(hdev);
 162
 163         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 164         if (conn)
 165                 conn->link_policy = get_unaligned_le16(sent + 2);
 166 #ifdef CONFIG_TIZEN_WIP
 167         sco_conn = hci_conn_hash_lookup_sco(hdev);
 168         if (sco_conn && conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 169                         conn->link_policy & HCI_LP_SNIFF) {
 170                 BT_ERR("SNIFF is not allowed during sco connection");
 171                 cp.handle = __cpu_to_le16(conn->handle);
 172                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 173                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 174         }
 175 #endif
 176
 177         hci_dev_unlock(hdev);
 178 }
 179
 180 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 181                                         struct sk_buff *skb)
 182 {
 183         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 186
 187         if (rp->status)
 188                 return;
 189
 190         hdev->link_policy = __le16_to_cpu(rp->policy);
 191 }
 192
 193 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 194                                          struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197         void *sent;
 198
 199         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 200
 201         if (status)
 202                 return;
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 205         if (!sent)
 206                 return;
 207
 208         hdev->link_policy = get_unaligned_le16(sent);
 209 }
 210
 211 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 212 {
 213         __u8 status = *((__u8 *) skb->data);
 214
 215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 216
 217         clear_bit(HCI_RESET, &hdev->flags);
 218
 219         if (status)
 220                 return;
 221
 222         /* Reset all non-persistent flags */
 223         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 224
 225         hdev->discovery.state = DISCOVERY_STOPPED;
 226         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230         hdev->adv_data_len = 0;
 231
 232         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233         hdev->scan_rsp_data_len = 0;
 234
 235         hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237         hdev->ssp_debug_mode = 0;
 238
 239         hci_bdaddr_list_clear(&hdev->le_white_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 307             test_bit(HCI_CONFIG, &hdev->dev_flags))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 526                 else
 527                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!test_bit(HCI_MGMT, &hdev->dev_flags) && !status) {
 554                 if (sent->support)
 555                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 556                 else
 557                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 573             test_bit(HCI_CONFIG, &hdev->dev_flags)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 593             test_bit(HCI_CONFIG, &hdev->dev_flags))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 goto a2mp_rsp;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859
 860 a2mp_rsp:
 861         a2mp_send_getinfo_rsp(hdev);
 862 }
 863
 864 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 865                                         struct sk_buff *skb)
 866 {
 867         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 868         struct amp_assoc *assoc = &hdev->loc_assoc;
 869         size_t rem_len, frag_len;
 870
 871         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 872
 873         if (rp->status)
 874                 goto a2mp_rsp;
 875
 876         frag_len = skb->len - sizeof(*rp);
 877         rem_len = __le16_to_cpu(rp->rem_len);
 878
 879         if (rem_len > frag_len) {
 880                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 881
 882                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 883                 assoc->offset += frag_len;
 884
 885                 /* Read other fragments */
 886                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 887
 888                 return;
 889         }
 890
 891         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 892         assoc->len = assoc->offset + rem_len;
 893         assoc->offset = 0;
 894
 895 a2mp_rsp:
 896         /* Send A2MP Rsp when all fragments are received */
 897         a2mp_send_getampassoc_rsp(hdev, rp->status);
 898         a2mp_send_create_phy_link_req(hdev, rp->status);
 899 }
 900
 901 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 902                                          struct sk_buff *skb)
 903 {
 904         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         if (rp->status)
 909                 return;
 910
 911         hdev->inq_tx_power = rp->tx_power;
 912 }
 913
 914 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 915 {
 916         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 917         struct hci_cp_pin_code_reply *cp;
 918         struct hci_conn *conn;
 919
 920         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 921
 922         hci_dev_lock(hdev);
 923
 924         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 925                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 926
 927         if (rp->status)
 928                 goto unlock;
 929
 930         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 931         if (!cp)
 932                 goto unlock;
 933
 934         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 935         if (conn)
 936                 conn->pin_length = cp->pin_len;
 937
 938 unlock:
 939         hci_dev_unlock(hdev);
 940 }
 941
 942 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 945
 946         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 947
 948         hci_dev_lock(hdev);
 949
 950         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 951                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 952                                                  rp->status);
 953
 954         hci_dev_unlock(hdev);
 955 }
 956
 957 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 958                                        struct sk_buff *skb)
 959 {
 960         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 961
 962         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 963
 964         if (rp->status)
 965                 return;
 966
 967         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 968         hdev->le_pkts = rp->le_max_pkt;
 969
 970         hdev->le_cnt = hdev->le_pkts;
 971
 972         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 973 }
 974
 975 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 976                                           struct sk_buff *skb)
 977 {
 978         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 979
 980         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 981
 982         if (rp->status)
 983                 return;
 984
 985         memcpy(hdev->le_features, rp->features, 8);
 986 }
 987
 988 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 989                                         struct sk_buff *skb)
 990 {
 991         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 992
 993         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 994
 995         if (rp->status)
 996                 return;
 997
 998         hdev->adv_tx_power = rp->tx_power;
 999 }
1000
1001 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1002 {
1003         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1004
1005         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1006
1007         hci_dev_lock(hdev);
1008
1009         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1010                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1011                                                  rp->status);
1012
1013         hci_dev_unlock(hdev);
1014 }
1015
1016 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1017                                           struct sk_buff *skb)
1018 {
1019         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022
1023         hci_dev_lock(hdev);
1024
1025         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1026                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1027                                                      ACL_LINK, 0, rp->status);
1028
1029         hci_dev_unlock(hdev);
1030 }
1031
1032 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1033 {
1034         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037
1038         hci_dev_lock(hdev);
1039
1040         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1041                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1042                                                  0, rp->status);
1043
1044         hci_dev_unlock(hdev);
1045 }
1046
1047 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1048                                           struct sk_buff *skb)
1049 {
1050         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1051
1052         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1053
1054         hci_dev_lock(hdev);
1055
1056         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1057                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1058                                                      ACL_LINK, 0, rp->status);
1059
1060         hci_dev_unlock(hdev);
1061 }
1062
1063 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1064                                        struct sk_buff *skb)
1065 {
1066         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1067
1068         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1069
1070         hci_dev_lock(hdev);
1071         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
1072                                           rp->status);
1073         hci_dev_unlock(hdev);
1074 }
1075
1076 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1077                                            struct sk_buff *skb)
1078 {
1079         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1080
1081         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1082
1083         hci_dev_lock(hdev);
1084         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1085                                           rp->hash256, rp->rand256,
1086                                           rp->status);
1087         hci_dev_unlock(hdev);
1088 }
1089
1090
1091 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1092 {
1093         __u8 status = *((__u8 *) skb->data);
1094         bdaddr_t *sent;
1095
1096         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1097
1098         if (status)
1099                 return;
1100
1101         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1102         if (!sent)
1103                 return;
1104
1105         hci_dev_lock(hdev);
1106
1107         bacpy(&hdev->random_addr, sent);
1108
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1113 {
1114         __u8 *sent, status = *((__u8 *) skb->data);
1115
1116         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1117
1118         if (status)
1119                 return;
1120
1121         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1122         if (!sent)
1123                 return;
1124
1125         hci_dev_lock(hdev);
1126
1127         /* If we're doing connection initiation as peripheral. Set a
1128          * timeout in case something goes wrong.
1129          */
1130         if (*sent) {
1131                 struct hci_conn *conn;
1132
1133                 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1134
1135                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1136                 if (conn)
1137                         queue_delayed_work(hdev->workqueue,
1138                                            &conn->le_conn_timeout,
1139                                            conn->conn_timeout);
1140         } else {
1141                 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1142         }
1143
1144         hci_dev_unlock(hdev);
1145 }
1146
1147 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_scan_param *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         hdev->le_scan_type = cp->type;
1164
1165         hci_dev_unlock(hdev);
1166 }
1167
1168 static bool has_pending_adv_report(struct hci_dev *hdev)
1169 {
1170         struct discovery_state *d = &hdev->discovery;
1171
1172         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1173 }
1174
1175 static void clear_pending_adv_report(struct hci_dev *hdev)
1176 {
1177         struct discovery_state *d = &hdev->discovery;
1178
1179         bacpy(&d->last_adv_addr, BDADDR_ANY);
1180         d->last_adv_data_len = 0;
1181 }
1182
1183 #ifndef CONFIG_TIZEN_WIP
1184 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1185                                      u8 bdaddr_type, s8 rssi, u32 flags,
1186                                      u8 *data, u8 len)
1187 {
1188         struct discovery_state *d = &hdev->discovery;
1189
1190         bacpy(&d->last_adv_addr, bdaddr);
1191         d->last_adv_addr_type = bdaddr_type;
1192         d->last_adv_rssi = rssi;
1193         d->last_adv_flags = flags;
1194         memcpy(d->last_adv_data, data, len);
1195         d->last_adv_data_len = len;
1196 }
1197 #endif
1198
1199 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1200                                       struct sk_buff *skb)
1201 {
1202         struct hci_cp_le_set_scan_enable *cp;
1203         __u8 status = *((__u8 *) skb->data);
1204
1205         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1206
1207         if (status)
1208                 return;
1209
1210         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1211         if (!cp)
1212                 return;
1213
1214         hci_dev_lock(hdev);
1215
1216         switch (cp->enable) {
1217         case LE_SCAN_ENABLE:
1218                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1219                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1220                         clear_pending_adv_report(hdev);
1221                 break;
1222
1223         case LE_SCAN_DISABLE:
1224                 /* We do this here instead of when setting DISCOVERY_STOPPED
1225                  * since the latter would potentially require waiting for
1226                  * inquiry to stop too.
1227                  */
1228                 if (has_pending_adv_report(hdev)) {
1229                         struct discovery_state *d = &hdev->discovery;
1230
1231                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1232                                           d->last_adv_addr_type, NULL,
1233                                           d->last_adv_rssi, d->last_adv_flags,
1234                                           d->last_adv_data,
1235                                           d->last_adv_data_len, NULL, 0);
1236                 }
1237
1238                 /* Cancel this timer so that we don't try to disable scanning
1239                  * when it's already disabled.
1240                  */
1241                 cancel_delayed_work(&hdev->le_scan_disable);
1242
1243                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1244
1245                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1246                  * interrupted scanning due to a connect request. Mark
1247                  * therefore discovery as stopped. If this was not
1248                  * because of a connect request advertising might have
1249                  * been disabled because of active scanning, so
1250                  * re-enable it again if necessary.
1251                  */
1252                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1253                                        &hdev->dev_flags))
1254 #ifndef CONFIG_TIZEN_WIP /* The below line is kernel bug. */
1255                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1256 #else
1257                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1258 #endif
1259                 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
1260                          hdev->discovery.state == DISCOVERY_FINDING)
1261                         mgmt_reenable_advertising(hdev);
1262
1263                 break;
1264
1265         default:
1266                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1267                 break;
1268         }
1269
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1274                                            struct sk_buff *skb)
1275 {
1276         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1277
1278         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1279
1280         if (rp->status)
1281                 return;
1282
1283         hdev->le_white_list_size = rp->size;
1284 }
1285
1286 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1287                                        struct sk_buff *skb)
1288 {
1289         __u8 status = *((__u8 *) skb->data);
1290
1291         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1292
1293         if (status)
1294                 return;
1295
1296         hci_bdaddr_list_clear(&hdev->le_white_list);
1297 }
1298
1299 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1300                                         struct sk_buff *skb)
1301 {
1302         struct hci_cp_le_add_to_white_list *sent;
1303         __u8 status = *((__u8 *) skb->data);
1304
1305         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1306
1307         if (status)
1308                 return;
1309
1310         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1311         if (!sent)
1312                 return;
1313
1314         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1315                            sent->bdaddr_type);
1316 }
1317
1318 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1319                                           struct sk_buff *skb)
1320 {
1321         struct hci_cp_le_del_from_white_list *sent;
1322         __u8 status = *((__u8 *) skb->data);
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (status)
1327                 return;
1328
1329         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1330         if (!sent)
1331                 return;
1332
1333         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1334                             sent->bdaddr_type);
1335 }
1336
1337 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1338                                             struct sk_buff *skb)
1339 {
1340         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1343
1344         if (rp->status)
1345                 return;
1346
1347         memcpy(hdev->le_states, rp->le_states, 8);
1348 }
1349
1350 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1351                                         struct sk_buff *skb)
1352 {
1353         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1354
1355         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1356
1357         if (rp->status)
1358                 return;
1359
1360         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1361         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1362 }
1363
1364 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1365                                          struct sk_buff *skb)
1366 {
1367         struct hci_cp_le_write_def_data_len *sent;
1368         __u8 status = *((__u8 *) skb->data);
1369
1370         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1371
1372         if (status)
1373 #ifndef CONFIG_TIZEN_WIP
1374                 return;
1375 #else
1376                 goto unblock;
1377 #endif
1378
1379         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1380         if (!sent)
1381 #ifndef CONFIG_TIZEN_WIP
1382                 return;
1383 #else
1384                 goto unblock;
1385 #endif
1386
1387         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1388         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1389
1390 #ifdef CONFIG_TIZEN_WIP
1391 unblock:
1392         mgmt_le_write_host_suggested_data_length_complete(hdev, status);
1393 #endif
1394 }
1395
1396 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1397                                         struct sk_buff *skb)
1398 {
1399         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1400
1401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1402
1403 #ifndef CONFIG_TIZEN_WIP
1404         if (rp->status)
1405                 return;
1406 #else
1407         hci_dev_lock(hdev);
1408 #endif
1409
1410         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1411         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1412         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1413         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1414
1415 #ifdef CONFIG_TIZEN_WIP
1416         mgmt_le_read_maximum_data_length_complete(hdev, rp->status);
1417         hci_dev_unlock(hdev);
1418 #endif
1419 }
1420
1421 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1422                                            struct sk_buff *skb)
1423 {
1424         struct hci_cp_write_le_host_supported *sent;
1425         __u8 status = *((__u8 *) skb->data);
1426
1427         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1428
1429         if (status)
1430                 return;
1431
1432         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1433         if (!sent)
1434                 return;
1435
1436         hci_dev_lock(hdev);
1437
1438         if (sent->le) {
1439                 hdev->features[1][0] |= LMP_HOST_LE;
1440                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1441         } else {
1442                 hdev->features[1][0] &= ~LMP_HOST_LE;
1443                 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1444                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1445         }
1446
1447         if (sent->simul)
1448                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1449         else
1450                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1451
1452         hci_dev_unlock(hdev);
1453 }
1454
1455 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1456 {
1457         struct hci_cp_le_set_adv_param *cp;
1458         u8 status = *((u8 *) skb->data);
1459
1460         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1461
1462         if (status)
1463                 return;
1464
1465         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1466         if (!cp)
1467                 return;
1468
1469         hci_dev_lock(hdev);
1470         hdev->adv_addr_type = cp->own_address_type;
1471         hci_dev_unlock(hdev);
1472 }
1473
1474 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1475                                           struct sk_buff *skb)
1476 {
1477         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1478
1479         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1480                hdev->name, rp->status, rp->phy_handle);
1481
1482         if (rp->status)
1483                 return;
1484
1485         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1486 }
1487 #ifdef CONFIG_TIZEN_WIP
1488 /* BEGIN TIZEN_Bluetooth :: Handle RSSI monitoring */
1489 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1490                                           struct sk_buff *skb)
1491 {
1492         struct hci_cc_rsp_enable_rssi *rp = (void *) skb->data;
1493
1494         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1495                hdev->name, rp->status, rp->le_ext_opcode);
1496
1497         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1498 }
1499
1500 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1501                                           struct sk_buff *skb)
1502 {
1503         struct hci_cc_rp_get_raw_rssi *rp = (void *) skb->data;
1504
1505         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1506                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1507
1508         mgmt_raw_rssi_response(hdev, rp, rp->status);
1509 }
1510 /* END TIZEN_Bluetooth :: Handle RSSI monitoring */
1511 #endif
1512 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1513 {
1514         struct hci_rp_read_rssi *rp = (void *) skb->data;
1515         struct hci_conn *conn;
1516
1517         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1518
1519         if (rp->status)
1520                 return;
1521
1522         hci_dev_lock(hdev);
1523
1524         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1525         if (conn)
1526                 conn->rssi = rp->rssi;
1527
1528         hci_dev_unlock(hdev);
1529 }
1530
1531 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1532 {
1533         struct hci_cp_read_tx_power *sent;
1534         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1535         struct hci_conn *conn;
1536
1537         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1538
1539         if (rp->status)
1540                 return;
1541
1542         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1543         if (!sent)
1544                 return;
1545
1546         hci_dev_lock(hdev);
1547
1548         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1549         if (!conn)
1550                 goto unlock;
1551
1552         switch (sent->type) {
1553         case 0x00:
1554                 conn->tx_power = rp->tx_power;
1555                 break;
1556         case 0x01:
1557                 conn->max_tx_power = rp->tx_power;
1558                 break;
1559         }
1560
1561 unlock:
1562         hci_dev_unlock(hdev);
1563 }
1564
1565 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1566 {
1567         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1568
1569         if (status) {
1570                 hci_conn_check_pending(hdev);
1571                 return;
1572         }
1573
1574         set_bit(HCI_INQUIRY, &hdev->flags);
1575 }
1576
1577 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1578 {
1579         struct hci_cp_create_conn *cp;
1580         struct hci_conn *conn;
1581
1582         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1583
1584         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1585         if (!cp)
1586                 return;
1587
1588         hci_dev_lock(hdev);
1589
1590         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1591
1592         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1593
1594         if (status) {
1595 #ifdef CONFIG_TIZEN_WIP
1596                 if (status == 0x0b)
1597                         BT_ERR("ACL Connection Already Exists on cs_create_con");
1598
1599                 if (conn && conn->state == BT_CONNECT && status != 0x0b) {
1600 #else
1601                 if (conn && conn->state == BT_CONNECT) {
1602 #endif
1603                         if (status != 0x0c || conn->attempt > 2) {
1604                                 conn->state = BT_CLOSED;
1605                                 hci_proto_connect_cfm(conn, status);
1606                                 hci_conn_del(conn);
1607                         } else
1608                                 conn->state = BT_CONNECT2;
1609                 }
1610         } else {
1611                 if (!conn) {
1612                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1613                                             HCI_ROLE_MASTER);
1614                         if (!conn)
1615                                 BT_ERR("No memory for new connection");
1616                 }
1617         }
1618
1619         hci_dev_unlock(hdev);
1620 }
1621
1622 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1623 {
1624         struct hci_cp_add_sco *cp;
1625         struct hci_conn *acl, *sco;
1626         __u16 handle;
1627
1628         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1629
1630         if (!status)
1631                 return;
1632
1633         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1634         if (!cp)
1635                 return;
1636
1637         handle = __le16_to_cpu(cp->handle);
1638
1639         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1640
1641         hci_dev_lock(hdev);
1642
1643         acl = hci_conn_hash_lookup_handle(hdev, handle);
1644         if (acl) {
1645                 sco = acl->link;
1646                 if (sco) {
1647                         sco->state = BT_CLOSED;
1648
1649                         hci_proto_connect_cfm(sco, status);
1650                         hci_conn_del(sco);
1651                 }
1652         }
1653
1654         hci_dev_unlock(hdev);
1655 }
1656
1657 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1658 {
1659         struct hci_cp_auth_requested *cp;
1660         struct hci_conn *conn;
1661
1662         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1663
1664         if (!status)
1665                 return;
1666
1667         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1668         if (!cp)
1669                 return;
1670
1671         hci_dev_lock(hdev);
1672
1673         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1674         if (conn) {
1675                 if (conn->state == BT_CONFIG) {
1676                         hci_proto_connect_cfm(conn, status);
1677                         hci_conn_drop(conn);
1678                 }
1679         }
1680
1681         hci_dev_unlock(hdev);
1682 }
1683
1684 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1685 {
1686         struct hci_cp_set_conn_encrypt *cp;
1687         struct hci_conn *conn;
1688
1689         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1690
1691         if (!status)
1692                 return;
1693
1694         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1695         if (!cp)
1696                 return;
1697
1698         hci_dev_lock(hdev);
1699
1700         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1701         if (conn) {
1702                 if (conn->state == BT_CONFIG) {
1703                         hci_proto_connect_cfm(conn, status);
1704                         hci_conn_drop(conn);
1705                 }
1706         }
1707
1708         hci_dev_unlock(hdev);
1709 }
1710
1711 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1712                                     struct hci_conn *conn)
1713 {
1714         if (conn->state != BT_CONFIG || !conn->out)
1715                 return 0;
1716
1717         if (conn->pending_sec_level == BT_SECURITY_SDP)
1718                 return 0;
1719
1720         /* Only request authentication for SSP connections or non-SSP
1721          * devices with sec_level MEDIUM or HIGH or if MITM protection
1722          * is requested.
1723          */
1724         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1725             conn->pending_sec_level != BT_SECURITY_FIPS &&
1726             conn->pending_sec_level != BT_SECURITY_HIGH &&
1727             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1728                 return 0;
1729
1730         return 1;
1731 }
1732
1733 static int hci_resolve_name(struct hci_dev *hdev,
1734                                    struct inquiry_entry *e)
1735 {
1736         struct hci_cp_remote_name_req cp;
1737
1738         memset(&cp, 0, sizeof(cp));
1739
1740         bacpy(&cp.bdaddr, &e->data.bdaddr);
1741         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1742         cp.pscan_mode = e->data.pscan_mode;
1743         cp.clock_offset = e->data.clock_offset;
1744
1745         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1746 }
1747
1748 static bool hci_resolve_next_name(struct hci_dev *hdev)
1749 {
1750         struct discovery_state *discov = &hdev->discovery;
1751         struct inquiry_entry *e;
1752
1753         if (list_empty(&discov->resolve))
1754                 return false;
1755
1756         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1757         if (!e)
1758                 return false;
1759
1760         if (hci_resolve_name(hdev, e) == 0) {
1761                 e->name_state = NAME_PENDING;
1762                 return true;
1763         }
1764
1765         return false;
1766 }
1767
1768 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1769                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1770 {
1771         struct discovery_state *discov = &hdev->discovery;
1772         struct inquiry_entry *e;
1773
1774 /* BEGIN TIZEN_Bluetooth :: name update changes */
1775 #ifdef CONFIG_TIZEN_WIP
1776         /* Update the mgmt connected state if necessary. Be careful with
1777         * conn objects that exist but are not (yet) connected however.
1778         * Only those in BT_CONFIG or BT_CONNECTED states can be
1779         * considered connected.
1780         */
1781         if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1782                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1783                         mgmt_device_connected(hdev, conn, 0, name, name_len);
1784                 else
1785                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
1786         }
1787
1788 #else
1789         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1790                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1791 /* END TIZEN_Bluetooth :: name update changes */
1792 #endif
1793         if (discov->state == DISCOVERY_STOPPED)
1794                 return;
1795
1796         if (discov->state == DISCOVERY_STOPPING)
1797                 goto discov_complete;
1798
1799         if (discov->state != DISCOVERY_RESOLVING)
1800                 return;
1801
1802         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1803         /* If the device was not found in a list of found devices names of which
1804          * are pending. there is no need to continue resolving a next name as it
1805          * will be done upon receiving another Remote Name Request Complete
1806          * Event */
1807         if (!e)
1808                 return;
1809
1810         list_del(&e->list);
1811         if (name) {
1812                 e->name_state = NAME_KNOWN;
1813                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1814                                  e->data.rssi, name, name_len);
1815         } else {
1816                 e->name_state = NAME_NOT_KNOWN;
1817         }
1818
1819         if (hci_resolve_next_name(hdev))
1820                 return;
1821
1822 discov_complete:
1823         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1824 }
1825
1826 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1827 {
1828         struct hci_cp_remote_name_req *cp;
1829         struct hci_conn *conn;
1830
1831         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1832
1833         /* If successful wait for the name req complete event before
1834          * checking for the need to do authentication */
1835         if (!status)
1836                 return;
1837
1838         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1839         if (!cp)
1840                 return;
1841
1842         hci_dev_lock(hdev);
1843
1844         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1845
1846         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1847                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1848
1849         if (!conn)
1850                 goto unlock;
1851
1852         if (!hci_outgoing_auth_needed(hdev, conn))
1853                 goto unlock;
1854
1855         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1856                 struct hci_cp_auth_requested auth_cp;
1857
1858                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1859
1860                 auth_cp.handle = __cpu_to_le16(conn->handle);
1861                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1862                              sizeof(auth_cp), &auth_cp);
1863         }
1864
1865 unlock:
1866         hci_dev_unlock(hdev);
1867 }
1868
1869 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1870 {
1871         struct hci_cp_read_remote_features *cp;
1872         struct hci_conn *conn;
1873
1874         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1875
1876         if (!status)
1877                 return;
1878
1879         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1880         if (!cp)
1881                 return;
1882
1883         hci_dev_lock(hdev);
1884
1885         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1886         if (conn) {
1887                 if (conn->state == BT_CONFIG) {
1888                         hci_proto_connect_cfm(conn, status);
1889                         hci_conn_drop(conn);
1890                 }
1891         }
1892
1893         hci_dev_unlock(hdev);
1894 }
1895
1896 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1897 {
1898         struct hci_cp_read_remote_ext_features *cp;
1899         struct hci_conn *conn;
1900
1901         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1902
1903         if (!status)
1904                 return;
1905
1906         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1907         if (!cp)
1908                 return;
1909
1910         hci_dev_lock(hdev);
1911
1912         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1913         if (conn) {
1914                 if (conn->state == BT_CONFIG) {
1915                         hci_proto_connect_cfm(conn, status);
1916                         hci_conn_drop(conn);
1917                 }
1918         }
1919
1920         hci_dev_unlock(hdev);
1921 }
1922
1923 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1924 {
1925         struct hci_cp_setup_sync_conn *cp;
1926         struct hci_conn *acl, *sco;
1927         __u16 handle;
1928
1929         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1930
1931         if (!status)
1932                 return;
1933
1934         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1935         if (!cp)
1936                 return;
1937
1938         handle = __le16_to_cpu(cp->handle);
1939
1940         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1941
1942         hci_dev_lock(hdev);
1943
1944         acl = hci_conn_hash_lookup_handle(hdev, handle);
1945         if (acl) {
1946                 sco = acl->link;
1947                 if (sco) {
1948                         sco->state = BT_CLOSED;
1949
1950                         hci_proto_connect_cfm(sco, status);
1951                         hci_conn_del(sco);
1952                 }
1953         }
1954
1955         hci_dev_unlock(hdev);
1956 }
1957
1958 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1959 {
1960         struct hci_cp_sniff_mode *cp;
1961         struct hci_conn *conn;
1962
1963         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1964
1965         if (!status)
1966                 return;
1967
1968         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1969         if (!cp)
1970                 return;
1971
1972         hci_dev_lock(hdev);
1973
1974         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1975         if (conn) {
1976                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1977
1978                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1979                         hci_sco_setup(conn, status);
1980         }
1981
1982         hci_dev_unlock(hdev);
1983 }
1984
1985 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1986 {
1987         struct hci_cp_exit_sniff_mode *cp;
1988         struct hci_conn *conn;
1989
1990         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1991
1992         if (!status)
1993                 return;
1994
1995         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1996         if (!cp)
1997                 return;
1998
1999         hci_dev_lock(hdev);
2000
2001         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2002         if (conn) {
2003                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
2004
2005                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
2006                         hci_sco_setup(conn, status);
2007         }
2008
2009         hci_dev_unlock(hdev);
2010 }
2011
2012 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
2013 {
2014         struct hci_cp_disconnect *cp;
2015         struct hci_conn *conn;
2016
2017         if (!status)
2018                 return;
2019
2020         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
2021         if (!cp)
2022                 return;
2023
2024         hci_dev_lock(hdev);
2025
2026         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2027         if (conn)
2028                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2029                                        conn->dst_type, status);
2030
2031         hci_dev_unlock(hdev);
2032 }
2033
2034 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
2035 {
2036         struct hci_cp_create_phy_link *cp;
2037
2038         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2039
2040         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
2041         if (!cp)
2042                 return;
2043
2044         hci_dev_lock(hdev);
2045
2046         if (status) {
2047                 struct hci_conn *hcon;
2048
2049                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
2050                 if (hcon)
2051                         hci_conn_del(hcon);
2052         } else {
2053                 amp_write_remote_assoc(hdev, cp->phy_handle);
2054         }
2055
2056         hci_dev_unlock(hdev);
2057 }
2058
2059 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
2060 {
2061         struct hci_cp_accept_phy_link *cp;
2062
2063         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2064
2065         if (status)
2066                 return;
2067
2068         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
2069         if (!cp)
2070                 return;
2071
2072         amp_write_remote_assoc(hdev, cp->phy_handle);
2073 }
2074
2075 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2076 {
2077         struct hci_cp_le_create_conn *cp;
2078         struct hci_conn *conn;
2079
2080         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2081
2082         /* All connection failure handling is taken care of by the
2083          * hci_le_conn_failed function which is triggered by the HCI
2084          * request completion callbacks used for connecting.
2085          */
2086         if (status)
2087                 return;
2088
2089         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2090         if (!cp)
2091                 return;
2092
2093         hci_dev_lock(hdev);
2094
2095         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2096         if (!conn)
2097                 goto unlock;
2098
2099         /* Store the initiator and responder address information which
2100          * is needed for SMP. These values will not change during the
2101          * lifetime of the connection.
2102          */
2103         conn->init_addr_type = cp->own_address_type;
2104         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2105                 bacpy(&conn->init_addr, &hdev->random_addr);
2106         else
2107                 bacpy(&conn->init_addr, &hdev->bdaddr);
2108
2109         conn->resp_addr_type = cp->peer_addr_type;
2110         bacpy(&conn->resp_addr, &cp->peer_addr);
2111
2112         /* We don't want the connection attempt to stick around
2113          * indefinitely since LE doesn't have a page timeout concept
2114          * like BR/EDR. Set a timer for any connection that doesn't use
2115          * the white list for connecting.
2116          */
2117         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2118                 queue_delayed_work(conn->hdev->workqueue,
2119                                    &conn->le_conn_timeout,
2120                                    conn->conn_timeout);
2121
2122 unlock:
2123         hci_dev_unlock(hdev);
2124 }
2125
2126 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2127 {
2128         struct hci_cp_le_start_enc *cp;
2129         struct hci_conn *conn;
2130
2131         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2132
2133         if (!status)
2134                 return;
2135
2136         hci_dev_lock(hdev);
2137
2138         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2139         if (!cp)
2140                 goto unlock;
2141
2142         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2143         if (!conn)
2144                 goto unlock;
2145
2146         if (conn->state != BT_CONNECTED)
2147                 goto unlock;
2148
2149         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2150         hci_conn_drop(conn);
2151
2152 unlock:
2153         hci_dev_unlock(hdev);
2154 }
2155
2156 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2157 {
2158         struct hci_cp_switch_role *cp;
2159         struct hci_conn *conn;
2160
2161         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2162
2163         if (!status)
2164                 return;
2165
2166         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2167         if (!cp)
2168                 return;
2169
2170         hci_dev_lock(hdev);
2171
2172         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2173         if (conn)
2174                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2175
2176         hci_dev_unlock(hdev);
2177 }
2178
2179 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2180 {
2181         __u8 status = *((__u8 *) skb->data);
2182         struct discovery_state *discov = &hdev->discovery;
2183         struct inquiry_entry *e;
2184
2185         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2186
2187         hci_conn_check_pending(hdev);
2188
2189         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2190                 return;
2191
2192 #ifdef CONFIG_TIZEN_WIP
2193         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
2194 #else
2195         /* In latest kernel, smp_mb__after_clear_bit is replaced with
2196           * smp_mb__after_atomic. So, if kernel is migrated to latest,
2197           * then below code should be enabled
2198           */
2199         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2200 #endif
2201         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2202
2203         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2204                 return;
2205
2206         hci_dev_lock(hdev);
2207
2208         if (discov->state != DISCOVERY_FINDING)
2209                 goto unlock;
2210
2211         if (list_empty(&discov->resolve)) {
2212                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2213                 goto unlock;
2214         }
2215
2216         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2217         if (e && hci_resolve_name(hdev, e) == 0) {
2218                 e->name_state = NAME_PENDING;
2219                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2220         } else {
2221                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2222         }
2223
2224 unlock:
2225         hci_dev_unlock(hdev);
2226 }
2227
2228 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2229 {
2230         struct inquiry_data data;
2231         struct inquiry_info *info = (void *) (skb->data + 1);
2232         int num_rsp = *((__u8 *) skb->data);
2233
2234         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2235
2236         if (!num_rsp)
2237                 return;
2238
2239         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2240                 return;
2241
2242         hci_dev_lock(hdev);
2243
2244         for (; num_rsp; num_rsp--, info++) {
2245                 u32 flags;
2246
2247                 bacpy(&data.bdaddr, &info->bdaddr);
2248                 data.pscan_rep_mode     = info->pscan_rep_mode;
2249                 data.pscan_period_mode  = info->pscan_period_mode;
2250                 data.pscan_mode         = info->pscan_mode;
2251                 memcpy(data.dev_class, info->dev_class, 3);
2252                 data.clock_offset       = info->clock_offset;
2253                 data.rssi               = HCI_RSSI_INVALID;
2254                 data.ssp_mode           = 0x00;
2255
2256                 flags = hci_inquiry_cache_update(hdev, &data, false);
2257
2258                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2259                                   info->dev_class, HCI_RSSI_INVALID,
2260                                   flags, NULL, 0, NULL, 0);
2261         }
2262
2263         hci_dev_unlock(hdev);
2264 }
2265
2266 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2267 {
2268         struct hci_ev_conn_complete *ev = (void *) skb->data;
2269         struct hci_conn *conn;
2270
2271         BT_DBG("%s", hdev->name);
2272
2273         hci_dev_lock(hdev);
2274
2275         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2276         if (!conn) {
2277                 if (ev->link_type != SCO_LINK)
2278                         goto unlock;
2279
2280                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2281                 if (!conn)
2282                         goto unlock;
2283
2284                 conn->type = SCO_LINK;
2285         }
2286
2287         if (!ev->status) {
2288                 conn->handle = __le16_to_cpu(ev->handle);
2289
2290                 if (conn->type == ACL_LINK) {
2291                         conn->state = BT_CONFIG;
2292                         hci_conn_hold(conn);
2293
2294                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2295                             !hci_find_link_key(hdev, &ev->bdaddr))
2296                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2297                         else
2298                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2299                 } else
2300                         conn->state = BT_CONNECTED;
2301
2302                 hci_debugfs_create_conn(conn);
2303                 hci_conn_add_sysfs(conn);
2304
2305                 if (test_bit(HCI_AUTH, &hdev->flags))
2306                         set_bit(HCI_CONN_AUTH, &conn->flags);
2307
2308                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2309                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2310
2311                 /* Get remote features */
2312                 if (conn->type == ACL_LINK) {
2313                         struct hci_cp_read_remote_features cp;
2314                         cp.handle = ev->handle;
2315                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2316                                      sizeof(cp), &cp);
2317
2318                         hci_update_page_scan(hdev);
2319                 }
2320
2321                 /* Set packet type for incoming connection */
2322                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2323                         struct hci_cp_change_conn_ptype cp;
2324                         cp.handle = ev->handle;
2325                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2326                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2327                                      &cp);
2328                 }
2329
2330 #ifdef CONFIG_TIZEN_WIP
2331                 if ((get_link_mode(conn)) & HCI_LM_MASTER)
2332                         hci_conn_change_supervision_timeout(conn,
2333                                                 LINK_SUPERVISION_TIMEOUT);
2334         } else if (ev->status == 0x0b) {
2335                 BT_ERR("ACL connection already exists, this evt is ignored");
2336 #endif
2337         } else {
2338                 conn->state = BT_CLOSED;
2339                 if (conn->type == ACL_LINK)
2340                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2341                                             conn->dst_type, ev->status);
2342         }
2343
2344         if (conn->type == ACL_LINK)
2345                 hci_sco_setup(conn, ev->status);
2346
2347 #ifdef CONFIG_TIZEN_WIP
2348         if (ev->status && ev->status != 0x0b) {
2349 #else
2350         if (ev->status) {
2351 #endif
2352                 hci_proto_connect_cfm(conn, ev->status);
2353                 hci_conn_del(conn);
2354         } else if (ev->link_type != ACL_LINK)
2355                 hci_proto_connect_cfm(conn, ev->status);
2356
2357 unlock:
2358         hci_dev_unlock(hdev);
2359
2360         hci_conn_check_pending(hdev);
2361 }
2362
2363 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2364 {
2365         struct hci_cp_reject_conn_req cp;
2366
2367         bacpy(&cp.bdaddr, bdaddr);
2368         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2369         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2370 }
2371
2372 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2373 {
2374         struct hci_ev_conn_request *ev = (void *) skb->data;
2375         int mask = hdev->link_mode;
2376         struct inquiry_entry *ie;
2377         struct hci_conn *conn;
2378         __u8 flags = 0;
2379
2380         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2381                ev->link_type);
2382
2383         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2384                                       &flags);
2385
2386         if (!(mask & HCI_LM_ACCEPT)) {
2387                 hci_reject_conn(hdev, &ev->bdaddr);
2388                 return;
2389         }
2390
2391         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2392                                    BDADDR_BREDR)) {
2393                 hci_reject_conn(hdev, &ev->bdaddr);
2394                 return;
2395         }
2396
2397         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2398          * connection. These features are only touched through mgmt so
2399          * only do the checks if HCI_MGMT is set.
2400          */
2401         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2402             !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2403             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2404                                     BDADDR_BREDR)) {
2405                     hci_reject_conn(hdev, &ev->bdaddr);
2406                     return;
2407         }
2408
2409         /* Connection accepted */
2410
2411         hci_dev_lock(hdev);
2412
2413         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2414         if (ie)
2415                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2416
2417 #ifdef CONFIG_TIZEN_WIP
2418                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2419                      hci_conn_hash_lookup_sco(hdev)) {
2420                         struct hci_cp_reject_conn_req cp;
2421
2422                         bacpy(&cp.bdaddr, &ev->bdaddr);
2423                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2424                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2425                                      sizeof(cp), &cp);
2426                         hci_dev_unlock(hdev);
2427                         return;
2428                 }
2429 #endif
2430         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2431                         &ev->bdaddr);
2432         if (!conn) {
2433                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2434                                     HCI_ROLE_SLAVE);
2435                 if (!conn) {
2436                         BT_ERR("No memory for new connection");
2437                         hci_dev_unlock(hdev);
2438                         return;
2439                 }
2440         }
2441
2442         memcpy(conn->dev_class, ev->dev_class, 3);
2443
2444         hci_dev_unlock(hdev);
2445
2446         if (ev->link_type == ACL_LINK ||
2447             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2448                 struct hci_cp_accept_conn_req cp;
2449                 conn->state = BT_CONNECT;
2450
2451                 bacpy(&cp.bdaddr, &ev->bdaddr);
2452
2453                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2454                         cp.role = 0x00; /* Become master */
2455                 else
2456                         cp.role = 0x01; /* Remain slave */
2457
2458                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2459         } else if (!(flags & HCI_PROTO_DEFER)) {
2460                 struct hci_cp_accept_sync_conn_req cp;
2461                 conn->state = BT_CONNECT;
2462
2463                 bacpy(&cp.bdaddr, &ev->bdaddr);
2464                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2465
2466                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2467                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2468                 cp.max_latency    = cpu_to_le16(0xffff);
2469                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2470                 cp.retrans_effort = 0xff;
2471
2472                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2473                              &cp);
2474         } else {
2475                 conn->state = BT_CONNECT2;
2476                 hci_proto_connect_cfm(conn, 0);
2477         }
2478 }
2479
2480 static u8 hci_to_mgmt_reason(u8 err)
2481 {
2482         switch (err) {
2483         case HCI_ERROR_CONNECTION_TIMEOUT:
2484                 return MGMT_DEV_DISCONN_TIMEOUT;
2485         case HCI_ERROR_REMOTE_USER_TERM:
2486         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2487         case HCI_ERROR_REMOTE_POWER_OFF:
2488                 return MGMT_DEV_DISCONN_REMOTE;
2489         case HCI_ERROR_LOCAL_HOST_TERM:
2490                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2491         default:
2492                 return MGMT_DEV_DISCONN_UNKNOWN;
2493         }
2494 }
2495
2496 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2497 {
2498         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2499         u8 reason = hci_to_mgmt_reason(ev->reason);
2500         struct hci_conn_params *params;
2501         struct hci_conn *conn;
2502         bool mgmt_connected;
2503         u8 type;
2504
2505         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2506
2507         hci_dev_lock(hdev);
2508
2509         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2510         if (!conn)
2511                 goto unlock;
2512
2513         if (ev->status) {
2514                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2515                                        conn->dst_type, ev->status);
2516                 goto unlock;
2517         }
2518
2519         conn->state = BT_CLOSED;
2520
2521         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2522         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2523                                 reason, mgmt_connected);
2524
2525         if (conn->type == ACL_LINK) {
2526                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2527                         hci_remove_link_key(hdev, &conn->dst);
2528
2529                 hci_update_page_scan(hdev);
2530         }
2531
2532         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2533         if (params) {
2534                 switch (params->auto_connect) {
2535                 case HCI_AUTO_CONN_LINK_LOSS:
2536                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2537                                 break;
2538                         /* Fall through */
2539
2540                 case HCI_AUTO_CONN_DIRECT:
2541                 case HCI_AUTO_CONN_ALWAYS:
2542                         list_del_init(&params->action);
2543                         list_add(&params->action, &hdev->pend_le_conns);
2544                         hci_update_background_scan(hdev);
2545                         break;
2546
2547                 default:
2548                         break;
2549                 }
2550         }
2551
2552         type = conn->type;
2553
2554         hci_proto_disconn_cfm(conn, ev->reason);
2555         hci_conn_del(conn);
2556
2557         /* Re-enable advertising if necessary, since it might
2558          * have been disabled by the connection. From the
2559          * HCI_LE_Set_Advertise_Enable command description in
2560          * the core specification (v4.0):
2561          * "The Controller shall continue advertising until the Host
2562          * issues an LE_Set_Advertise_Enable command with
2563          * Advertising_Enable set to 0x00 (Advertising is disabled)
2564          * or until a connection is created or until the Advertising
2565          * is timed out due to Directed Advertising."
2566          */
2567         if (type == LE_LINK)
2568                 mgmt_reenable_advertising(hdev);
2569
2570 #ifdef CONFIG_TIZEN_WIP
2571         if (type == ACL_LINK && !hci_conn_num(hdev, ACL_LINK)) {
2572                 int iscan;
2573                 int pscan;
2574
2575                 iscan = test_bit(HCI_ISCAN, &hdev->flags);
2576                 pscan = test_bit(HCI_PSCAN, &hdev->flags);
2577                 if (!iscan && !pscan) {
2578                         u8 scan_enable = SCAN_PAGE;
2579
2580                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE,
2581                                         sizeof(scan_enable), &scan_enable);
2582                 }
2583         }
2584 #endif
2585
2586 unlock:
2587         hci_dev_unlock(hdev);
2588 }
2589
2590 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2591 {
2592         struct hci_ev_auth_complete *ev = (void *) skb->data;
2593         struct hci_conn *conn;
2594
2595         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2596
2597         hci_dev_lock(hdev);
2598
2599         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2600         if (!conn)
2601                 goto unlock;
2602
2603 #ifdef CONFIG_TIZEN_WIP /*  PIN or Key Missing patch */
2604         BT_DBG("remote_auth %x, remote_cap %x, auth_type %x, io_capability %x",
2605                conn->remote_auth, conn->remote_cap,
2606                conn->auth_type, conn->io_capability);
2607
2608         if (ev->status == 0x06) {
2609                 struct hci_cp_auth_requested cp;
2610                 BT_DBG("Pin or key missing");
2611                 hci_remove_link_key(hdev, &conn->dst);
2612                 cp.handle = cpu_to_le16(conn->handle);
2613                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp),
2614                                                          &cp);
2615                 goto unlock;
2616         }
2617 #endif
2618         if (!ev->status) {
2619                 if (!hci_conn_ssp_enabled(conn) &&
2620                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2621                         BT_INFO("re-auth of legacy device is not possible.");
2622                 } else {
2623                         set_bit(HCI_CONN_AUTH, &conn->flags);
2624                         conn->sec_level = conn->pending_sec_level;
2625                 }
2626         } else {
2627                 mgmt_auth_failed(conn, ev->status);
2628         }
2629
2630         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2631         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2632
2633         if (conn->state == BT_CONFIG) {
2634                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2635                         struct hci_cp_set_conn_encrypt cp;
2636                         cp.handle  = ev->handle;
2637                         cp.encrypt = 0x01;
2638                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2639                                      &cp);
2640                 } else {
2641                         conn->state = BT_CONNECTED;
2642                         hci_proto_connect_cfm(conn, ev->status);
2643                         hci_conn_drop(conn);
2644                 }
2645         } else {
2646                 hci_auth_cfm(conn, ev->status);
2647
2648                 hci_conn_hold(conn);
2649                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2650                 hci_conn_drop(conn);
2651         }
2652
2653         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2654                 if (!ev->status) {
2655                         struct hci_cp_set_conn_encrypt cp;
2656                         cp.handle  = ev->handle;
2657                         cp.encrypt = 0x01;
2658                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2659                                      &cp);
2660                 } else {
2661                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2662                         hci_encrypt_cfm(conn, ev->status, 0x00);
2663                 }
2664         }
2665
2666 unlock:
2667         hci_dev_unlock(hdev);
2668 }
2669
2670 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2671 {
2672         struct hci_ev_remote_name *ev = (void *) skb->data;
2673         struct hci_conn *conn;
2674
2675         BT_DBG("%s", hdev->name);
2676
2677         hci_conn_check_pending(hdev);
2678
2679         hci_dev_lock(hdev);
2680
2681         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2682
2683         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2684                 goto check_auth;
2685
2686         if (ev->status == 0)
2687                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2688                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2689         else
2690                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2691
2692 check_auth:
2693         if (!conn)
2694                 goto unlock;
2695
2696         if (!hci_outgoing_auth_needed(hdev, conn))
2697                 goto unlock;
2698
2699         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2700                 struct hci_cp_auth_requested cp;
2701
2702                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2703
2704                 cp.handle = __cpu_to_le16(conn->handle);
2705                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2706         }
2707
2708 unlock:
2709         hci_dev_unlock(hdev);
2710 }
2711
2712 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2713 {
2714         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2715         struct hci_conn *conn;
2716
2717         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2718
2719         hci_dev_lock(hdev);
2720
2721         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2722         if (!conn)
2723                 goto unlock;
2724
2725         if (!ev->status) {
2726                 if (ev->encrypt) {
2727                         /* Encryption implies authentication */
2728                         set_bit(HCI_CONN_AUTH, &conn->flags);
2729                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2730                         conn->sec_level = conn->pending_sec_level;
2731
2732 /* Disable Secure connection implementation now */
2733 #ifdef CONFIG_TIZEN_WIP
2734                         /* P-256 authentication key implies FIPS */
2735                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2736                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2737
2738                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2739                             conn->type == LE_LINK)
2740                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2741 #endif
2742                 } else {
2743                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2744 /* Disable Secure connection implementation now */
2745 #ifdef CONFIG_TIZEN_WIP
2746                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2747 #endif
2748                 }
2749         }
2750
2751         /* We should disregard the current RPA and generate a new one
2752          * whenever the encryption procedure fails.
2753          */
2754         if (ev->status && conn->type == LE_LINK)
2755                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2756
2757         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2758
2759         if (ev->status && conn->state == BT_CONNECTED) {
2760                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2761                 hci_conn_drop(conn);
2762                 goto unlock;
2763         }
2764
2765         if (conn->state == BT_CONFIG) {
2766                 if (!ev->status)
2767                         conn->state = BT_CONNECTED;
2768
2769 /* Disable Secure connection implementation now */
2770 #ifdef CONFIG_TIZEN_WIP
2771                 /* In Secure Connections Only mode, do not allow any
2772                  * connections that are not encrypted with AES-CCM
2773                  * using a P-256 authenticated combination key.
2774                  */
2775                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2776                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2777                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2778                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2779                         hci_conn_drop(conn);
2780                         goto unlock;
2781                 }
2782 #endif
2783                 hci_proto_connect_cfm(conn, ev->status);
2784                 hci_conn_drop(conn);
2785         } else
2786                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2787
2788 unlock:
2789         hci_dev_unlock(hdev);
2790 }
2791
2792 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2793                                              struct sk_buff *skb)
2794 {
2795         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2796         struct hci_conn *conn;
2797
2798         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2799
2800         hci_dev_lock(hdev);
2801
2802         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2803         if (conn) {
2804                 if (!ev->status)
2805                         set_bit(HCI_CONN_SECURE, &conn->flags);
2806
2807                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2808
2809                 hci_key_change_cfm(conn, ev->status);
2810         }
2811
2812         hci_dev_unlock(hdev);
2813 }
2814
2815 static void hci_remote_features_evt(struct hci_dev *hdev,
2816                                     struct sk_buff *skb)
2817 {
2818         struct hci_ev_remote_features *ev = (void *) skb->data;
2819         struct hci_conn *conn;
2820
2821         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2822
2823         hci_dev_lock(hdev);
2824
2825         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2826         if (!conn)
2827                 goto unlock;
2828
2829         if (!ev->status)
2830                 memcpy(conn->features[0], ev->features, 8);
2831
2832         if (conn->state != BT_CONFIG)
2833                 goto unlock;
2834
2835         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2836                 struct hci_cp_read_remote_ext_features cp;
2837                 cp.handle = ev->handle;
2838                 cp.page = 0x01;
2839                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2840                              sizeof(cp), &cp);
2841                 goto unlock;
2842         }
2843
2844 #ifdef CONFIG_SPRD_2331
2845         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2846                 struct hci_cp_change_conn_ptype cp;
2847                 memset(&cp, 0, sizeof(cp));
2848                 cp.pkt_type = (HCI_DM1|HCI_DH1);
2849                 if (conn->features[0][0] & LMP_3SLOT)
2850                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
2851
2852                 if (conn->features[0][0] & LMP_5SLOT)
2853                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
2854
2855                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
2856                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
2857                 } else {
2858                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2859                                 cp.pkt_type |= HCI_2DH3;
2860
2861                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2862                                 cp.pkt_type |= HCI_2DH5;
2863                 }
2864
2865                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
2866                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
2867                 } else {
2868                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2869                                 cp.pkt_type |= HCI_3DH3;
2870
2871                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2872                                 cp.pkt_type |= HCI_3DH5;
2873                 }
2874
2875                 cp.handle = ev->handle;
2876                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
2877         }
2878 #endif
2879
2880         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2881                 struct hci_cp_remote_name_req cp;
2882                 memset(&cp, 0, sizeof(cp));
2883                 bacpy(&cp.bdaddr, &conn->dst);
2884                 cp.pscan_rep_mode = 0x02;
2885                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2886         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2887                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2888
2889         if (!hci_outgoing_auth_needed(hdev, conn)) {
2890                 conn->state = BT_CONNECTED;
2891                 hci_proto_connect_cfm(conn, ev->status);
2892                 hci_conn_drop(conn);
2893         }
2894
2895 unlock:
2896         hci_dev_unlock(hdev);
2897 }
2898
2899 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2900 {
2901         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2902         u8 status = skb->data[sizeof(*ev)];
2903         __u16 opcode;
2904
2905         skb_pull(skb, sizeof(*ev));
2906
2907         opcode = __le16_to_cpu(ev->opcode);
2908
2909         switch (opcode) {
2910         case HCI_OP_INQUIRY_CANCEL:
2911                 hci_cc_inquiry_cancel(hdev, skb);
2912                 break;
2913
2914         case HCI_OP_PERIODIC_INQ:
2915                 hci_cc_periodic_inq(hdev, skb);
2916                 break;
2917
2918         case HCI_OP_EXIT_PERIODIC_INQ:
2919                 hci_cc_exit_periodic_inq(hdev, skb);
2920                 break;
2921
2922         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2923                 hci_cc_remote_name_req_cancel(hdev, skb);
2924                 break;
2925
2926         case HCI_OP_ROLE_DISCOVERY:
2927                 hci_cc_role_discovery(hdev, skb);
2928                 break;
2929
2930         case HCI_OP_READ_LINK_POLICY:
2931                 hci_cc_read_link_policy(hdev, skb);
2932                 break;
2933
2934         case HCI_OP_WRITE_LINK_POLICY:
2935                 hci_cc_write_link_policy(hdev, skb);
2936                 break;
2937
2938         case HCI_OP_READ_DEF_LINK_POLICY:
2939                 hci_cc_read_def_link_policy(hdev, skb);
2940                 break;
2941
2942         case HCI_OP_WRITE_DEF_LINK_POLICY:
2943                 hci_cc_write_def_link_policy(hdev, skb);
2944                 break;
2945
2946         case HCI_OP_RESET:
2947                 hci_cc_reset(hdev, skb);
2948                 break;
2949
2950         case HCI_OP_READ_STORED_LINK_KEY:
2951                 hci_cc_read_stored_link_key(hdev, skb);
2952                 break;
2953
2954         case HCI_OP_DELETE_STORED_LINK_KEY:
2955                 hci_cc_delete_stored_link_key(hdev, skb);
2956                 break;
2957
2958         case HCI_OP_WRITE_LOCAL_NAME:
2959                 hci_cc_write_local_name(hdev, skb);
2960                 break;
2961
2962         case HCI_OP_READ_LOCAL_NAME:
2963                 hci_cc_read_local_name(hdev, skb);
2964                 break;
2965
2966         case HCI_OP_WRITE_AUTH_ENABLE:
2967                 hci_cc_write_auth_enable(hdev, skb);
2968                 break;
2969
2970         case HCI_OP_WRITE_ENCRYPT_MODE:
2971                 hci_cc_write_encrypt_mode(hdev, skb);
2972                 break;
2973
2974         case HCI_OP_WRITE_SCAN_ENABLE:
2975                 hci_cc_write_scan_enable(hdev, skb);
2976                 break;
2977
2978         case HCI_OP_READ_CLASS_OF_DEV:
2979                 hci_cc_read_class_of_dev(hdev, skb);
2980                 break;
2981
2982         case HCI_OP_WRITE_CLASS_OF_DEV:
2983                 hci_cc_write_class_of_dev(hdev, skb);
2984                 break;
2985
2986         case HCI_OP_READ_VOICE_SETTING:
2987                 hci_cc_read_voice_setting(hdev, skb);
2988                 break;
2989
2990         case HCI_OP_WRITE_VOICE_SETTING:
2991                 hci_cc_write_voice_setting(hdev, skb);
2992                 break;
2993
2994         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2995                 hci_cc_read_num_supported_iac(hdev, skb);
2996                 break;
2997
2998         case HCI_OP_WRITE_SSP_MODE:
2999                 hci_cc_write_ssp_mode(hdev, skb);
3000                 break;
3001
3002         case HCI_OP_WRITE_SC_SUPPORT:
3003                 hci_cc_write_sc_support(hdev, skb);
3004                 break;
3005
3006         case HCI_OP_READ_LOCAL_VERSION:
3007                 hci_cc_read_local_version(hdev, skb);
3008                 break;
3009
3010         case HCI_OP_READ_LOCAL_COMMANDS:
3011                 hci_cc_read_local_commands(hdev, skb);
3012                 break;
3013
3014         case HCI_OP_READ_LOCAL_FEATURES:
3015                 hci_cc_read_local_features(hdev, skb);
3016                 break;
3017
3018         case HCI_OP_READ_LOCAL_EXT_FEATURES:
3019                 hci_cc_read_local_ext_features(hdev, skb);
3020                 break;
3021
3022         case HCI_OP_READ_BUFFER_SIZE:
3023                 hci_cc_read_buffer_size(hdev, skb);
3024                 break;
3025
3026         case HCI_OP_READ_BD_ADDR:
3027                 hci_cc_read_bd_addr(hdev, skb);
3028                 break;
3029
3030         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3031                 hci_cc_read_page_scan_activity(hdev, skb);
3032                 break;
3033
3034         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3035                 hci_cc_write_page_scan_activity(hdev, skb);
3036                 break;
3037
3038         case HCI_OP_READ_PAGE_SCAN_TYPE:
3039                 hci_cc_read_page_scan_type(hdev, skb);
3040                 break;
3041
3042         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3043                 hci_cc_write_page_scan_type(hdev, skb);
3044                 break;
3045
3046         case HCI_OP_READ_DATA_BLOCK_SIZE:
3047                 hci_cc_read_data_block_size(hdev, skb);
3048                 break;
3049
3050         case HCI_OP_READ_FLOW_CONTROL_MODE:
3051                 hci_cc_read_flow_control_mode(hdev, skb);
3052                 break;
3053
3054         case HCI_OP_READ_LOCAL_AMP_INFO:
3055                 hci_cc_read_local_amp_info(hdev, skb);
3056                 break;
3057
3058         case HCI_OP_READ_CLOCK:
3059                 hci_cc_read_clock(hdev, skb);
3060                 break;
3061
3062         case HCI_OP_READ_LOCAL_AMP_ASSOC:
3063                 hci_cc_read_local_amp_assoc(hdev, skb);
3064                 break;
3065
3066         case HCI_OP_READ_INQ_RSP_TX_POWER:
3067                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3068                 break;
3069
3070         case HCI_OP_PIN_CODE_REPLY:
3071                 hci_cc_pin_code_reply(hdev, skb);
3072                 break;
3073
3074         case HCI_OP_PIN_CODE_NEG_REPLY:
3075                 hci_cc_pin_code_neg_reply(hdev, skb);
3076                 break;
3077
3078         case HCI_OP_READ_LOCAL_OOB_DATA:
3079                 hci_cc_read_local_oob_data(hdev, skb);
3080                 break;
3081
3082         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3083                 hci_cc_read_local_oob_ext_data(hdev, skb);
3084                 break;
3085
3086         case HCI_OP_LE_READ_BUFFER_SIZE:
3087                 hci_cc_le_read_buffer_size(hdev, skb);
3088                 break;
3089
3090         case HCI_OP_LE_READ_LOCAL_FEATURES:
3091                 hci_cc_le_read_local_features(hdev, skb);
3092                 break;
3093
3094         case HCI_OP_LE_READ_ADV_TX_POWER:
3095                 hci_cc_le_read_adv_tx_power(hdev, skb);
3096                 break;
3097
3098         case HCI_OP_USER_CONFIRM_REPLY:
3099                 hci_cc_user_confirm_reply(hdev, skb);
3100                 break;
3101
3102         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3103                 hci_cc_user_confirm_neg_reply(hdev, skb);
3104                 break;
3105
3106         case HCI_OP_USER_PASSKEY_REPLY:
3107                 hci_cc_user_passkey_reply(hdev, skb);
3108                 break;
3109
3110         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3111                 hci_cc_user_passkey_neg_reply(hdev, skb);
3112                 break;
3113
3114         case HCI_OP_LE_SET_RANDOM_ADDR:
3115                 hci_cc_le_set_random_addr(hdev, skb);
3116                 break;
3117
3118         case HCI_OP_LE_SET_ADV_ENABLE:
3119                 hci_cc_le_set_adv_enable(hdev, skb);
3120                 break;
3121
3122         case HCI_OP_LE_SET_SCAN_PARAM:
3123                 hci_cc_le_set_scan_param(hdev, skb);
3124                 break;
3125
3126         case HCI_OP_LE_SET_SCAN_ENABLE:
3127                 hci_cc_le_set_scan_enable(hdev, skb);
3128                 break;
3129
3130         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3131                 hci_cc_le_read_white_list_size(hdev, skb);
3132                 break;
3133
3134         case HCI_OP_LE_CLEAR_WHITE_LIST:
3135                 hci_cc_le_clear_white_list(hdev, skb);
3136                 break;
3137
3138         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3139                 hci_cc_le_add_to_white_list(hdev, skb);
3140                 break;
3141
3142         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3143                 hci_cc_le_del_from_white_list(hdev, skb);
3144                 break;
3145
3146         case HCI_OP_LE_READ_SUPPORTED_STATES:
3147                 hci_cc_le_read_supported_states(hdev, skb);
3148                 break;
3149
3150         case HCI_OP_LE_READ_DEF_DATA_LEN:
3151                 hci_cc_le_read_def_data_len(hdev, skb);
3152                 break;
3153
3154         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3155                 hci_cc_le_write_def_data_len(hdev, skb);
3156                 break;
3157
3158         case HCI_OP_LE_READ_MAX_DATA_LEN:
3159                 hci_cc_le_read_max_data_len(hdev, skb);
3160                 break;
3161
3162         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3163                 hci_cc_write_le_host_supported(hdev, skb);
3164                 break;
3165
3166         case HCI_OP_LE_SET_ADV_PARAM:
3167                 hci_cc_set_adv_param(hdev, skb);
3168                 break;
3169
3170         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
3171                 hci_cc_write_remote_amp_assoc(hdev, skb);
3172                 break;
3173
3174         case HCI_OP_READ_RSSI:
3175                 hci_cc_read_rssi(hdev, skb);
3176                 break;
3177
3178         case HCI_OP_READ_TX_POWER:
3179                 hci_cc_read_tx_power(hdev, skb);
3180                 break;
3181 #ifdef CONFIG_TIZEN_WIP
3182         case HCI_OP_ENABLE_RSSI:
3183                 hci_cc_enable_rssi(hdev, skb);
3184                 break;
3185
3186         case HCI_OP_GET_RAW_RSSI:
3187                 hci_cc_get_raw_rssi(hdev, skb);
3188                 break;
3189 #endif
3190         default:
3191                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3192                 break;
3193         }
3194
3195         if (opcode != HCI_OP_NOP)
3196                 cancel_delayed_work(&hdev->cmd_timer);
3197
3198         hci_req_cmd_complete(hdev, opcode, status);
3199
3200         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3201                 atomic_set(&hdev->cmd_cnt, 1);
3202                 if (!skb_queue_empty(&hdev->cmd_q))
3203                         queue_work(hdev->workqueue, &hdev->cmd_work);
3204         }
3205 }
3206
3207 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
3208 {
3209         struct hci_ev_cmd_status *ev = (void *) skb->data;
3210         __u16 opcode;
3211
3212         skb_pull(skb, sizeof(*ev));
3213
3214         opcode = __le16_to_cpu(ev->opcode);
3215
3216         switch (opcode) {
3217         case HCI_OP_INQUIRY:
3218                 hci_cs_inquiry(hdev, ev->status);
3219                 break;
3220
3221         case HCI_OP_CREATE_CONN:
3222                 hci_cs_create_conn(hdev, ev->status);
3223                 break;
3224
3225         case HCI_OP_DISCONNECT:
3226                 hci_cs_disconnect(hdev, ev->status);
3227                 break;
3228
3229         case HCI_OP_ADD_SCO:
3230                 hci_cs_add_sco(hdev, ev->status);
3231                 break;
3232
3233         case HCI_OP_AUTH_REQUESTED:
3234                 hci_cs_auth_requested(hdev, ev->status);
3235                 break;
3236
3237         case HCI_OP_SET_CONN_ENCRYPT:
3238                 hci_cs_set_conn_encrypt(hdev, ev->status);
3239                 break;
3240
3241         case HCI_OP_REMOTE_NAME_REQ:
3242                 hci_cs_remote_name_req(hdev, ev->status);
3243                 break;
3244
3245         case HCI_OP_READ_REMOTE_FEATURES:
3246                 hci_cs_read_remote_features(hdev, ev->status);
3247                 break;
3248
3249         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3250                 hci_cs_read_remote_ext_features(hdev, ev->status);
3251                 break;
3252
3253         case HCI_OP_SETUP_SYNC_CONN:
3254                 hci_cs_setup_sync_conn(hdev, ev->status);
3255                 break;
3256
3257         case HCI_OP_CREATE_PHY_LINK:
3258                 hci_cs_create_phylink(hdev, ev->status);
3259                 break;
3260
3261         case HCI_OP_ACCEPT_PHY_LINK:
3262                 hci_cs_accept_phylink(hdev, ev->status);
3263                 break;
3264
3265         case HCI_OP_SNIFF_MODE:
3266                 hci_cs_sniff_mode(hdev, ev->status);
3267                 break;
3268
3269         case HCI_OP_EXIT_SNIFF_MODE:
3270                 hci_cs_exit_sniff_mode(hdev, ev->status);
3271                 break;
3272
3273         case HCI_OP_SWITCH_ROLE:
3274                 hci_cs_switch_role(hdev, ev->status);
3275                 break;
3276
3277         case HCI_OP_LE_CREATE_CONN:
3278                 hci_cs_le_create_conn(hdev, ev->status);
3279                 break;
3280
3281         case HCI_OP_LE_START_ENC:
3282                 hci_cs_le_start_enc(hdev, ev->status);
3283                 break;
3284
3285         default:
3286                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3287                 break;
3288         }
3289
3290         if (opcode != HCI_OP_NOP)
3291                 cancel_delayed_work(&hdev->cmd_timer);
3292
3293         if (ev->status ||
3294             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3295                 hci_req_cmd_complete(hdev, opcode, ev->status);
3296
3297         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3298                 atomic_set(&hdev->cmd_cnt, 1);
3299                 if (!skb_queue_empty(&hdev->cmd_q))
3300                         queue_work(hdev->workqueue, &hdev->cmd_work);
3301         }
3302 }
3303
3304 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3305 {
3306         struct hci_ev_hardware_error *ev = (void *) skb->data;
3307
3308         BT_ERR("%s hardware error 0x%2.2x", hdev->name, ev->code);
3309 #ifdef CONFIG_TIZEN_WIP
3310         hci_dev_lock(hdev);
3311         mgmt_hardware_error(hdev, ev->code);
3312         hci_dev_unlock(hdev);
3313 #endif
3314 }
3315
3316 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3317 {
3318         struct hci_ev_role_change *ev = (void *) skb->data;
3319         struct hci_conn *conn;
3320
3321         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3322
3323         hci_dev_lock(hdev);
3324
3325         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3326         if (conn) {
3327                 if (!ev->status)
3328                         conn->role = ev->role;
3329
3330                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3331
3332                 hci_role_switch_cfm(conn, ev->status, ev->role);
3333
3334 #ifdef CONFIG_TIZEN_WIP
3335                 if (!ev->status && (get_link_mode(conn)) & HCI_LM_MASTER)
3336                         hci_conn_change_supervision_timeout(conn,
3337                                                 LINK_SUPERVISION_TIMEOUT);
3338 #endif
3339         }
3340
3341         hci_dev_unlock(hdev);
3342 }
3343
3344 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3345 {
3346         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3347         int i;
3348
3349         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3350                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3351                 return;
3352         }
3353
3354         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3355             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3356                 BT_DBG("%s bad parameters", hdev->name);
3357                 return;
3358         }
3359
3360         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3361
3362         for (i = 0; i < ev->num_hndl; i++) {
3363                 struct hci_comp_pkts_info *info = &ev->handles[i];
3364                 struct hci_conn *conn;
3365                 __u16  handle, count;
3366
3367                 handle = __le16_to_cpu(info->handle);
3368                 count  = __le16_to_cpu(info->count);
3369
3370                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3371                 if (!conn)
3372                         continue;
3373
3374                 conn->sent -= count;
3375
3376                 switch (conn->type) {
3377                 case ACL_LINK:
3378                         hdev->acl_cnt += count;
3379                         if (hdev->acl_cnt > hdev->acl_pkts)
3380                                 hdev->acl_cnt = hdev->acl_pkts;
3381                         break;
3382
3383                 case LE_LINK:
3384                         if (hdev->le_pkts) {
3385                                 hdev->le_cnt += count;
3386                                 if (hdev->le_cnt > hdev->le_pkts)
3387                                         hdev->le_cnt = hdev->le_pkts;
3388                         } else {
3389                                 hdev->acl_cnt += count;
3390                                 if (hdev->acl_cnt > hdev->acl_pkts)
3391                                         hdev->acl_cnt = hdev->acl_pkts;
3392                         }
3393                         break;
3394
3395                 case SCO_LINK:
3396                         hdev->sco_cnt += count;
3397                         if (hdev->sco_cnt > hdev->sco_pkts)
3398                                 hdev->sco_cnt = hdev->sco_pkts;
3399                         break;
3400
3401                 default:
3402                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3403                         break;
3404                 }
3405         }
3406
3407         queue_work(hdev->workqueue, &hdev->tx_work);
3408 }
3409
3410 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3411                                                  __u16 handle)
3412 {
3413         struct hci_chan *chan;
3414
3415         switch (hdev->dev_type) {
3416         case HCI_BREDR:
3417                 return hci_conn_hash_lookup_handle(hdev, handle);
3418         case HCI_AMP:
3419                 chan = hci_chan_lookup_handle(hdev, handle);
3420                 if (chan)
3421                         return chan->conn;
3422                 break;
3423         default:
3424                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3425                 break;
3426         }
3427
3428         return NULL;
3429 }
3430
3431 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3432 {
3433         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3434         int i;
3435
3436         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3437                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3438                 return;
3439         }
3440
3441         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3442             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3443                 BT_DBG("%s bad parameters", hdev->name);
3444                 return;
3445         }
3446
3447         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3448                ev->num_hndl);
3449
3450         for (i = 0; i < ev->num_hndl; i++) {
3451                 struct hci_comp_blocks_info *info = &ev->handles[i];
3452                 struct hci_conn *conn = NULL;
3453                 __u16  handle, block_count;
3454
3455                 handle = __le16_to_cpu(info->handle);
3456                 block_count = __le16_to_cpu(info->blocks);
3457
3458                 conn = __hci_conn_lookup_handle(hdev, handle);
3459                 if (!conn)
3460                         continue;
3461
3462                 conn->sent -= block_count;
3463
3464                 switch (conn->type) {
3465                 case ACL_LINK:
3466                 case AMP_LINK:
3467                         hdev->block_cnt += block_count;
3468                         if (hdev->block_cnt > hdev->num_blocks)
3469                                 hdev->block_cnt = hdev->num_blocks;
3470                         break;
3471
3472                 default:
3473                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3474                         break;
3475                 }
3476         }
3477
3478         queue_work(hdev->workqueue, &hdev->tx_work);
3479 }
3480
3481 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3482 {
3483         struct hci_ev_mode_change *ev = (void *) skb->data;
3484         struct hci_conn *conn;
3485
3486         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3487
3488         hci_dev_lock(hdev);
3489
3490         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3491         if (conn) {
3492                 conn->mode = ev->mode;
3493
3494                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3495                                         &conn->flags)) {
3496                         if (conn->mode == HCI_CM_ACTIVE)
3497                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3498                         else
3499                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3500                 }
3501
3502                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3503                         hci_sco_setup(conn, ev->status);
3504         }
3505
3506         hci_dev_unlock(hdev);
3507 }
3508
3509 #ifdef CONFIG_TIZEN_WIP
3510 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
3511 {
3512         struct hci_ev_vendor_specific *ev = (void *) skb->data;
3513         __u8 event_sub_code;
3514         skb_pull(skb, sizeof(*ev));
3515
3516         BT_DBG("hci_vendor_specific_evt");
3517         event_sub_code = ev->event_sub_code;
3518
3519         switch (event_sub_code) {
3520         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT: {
3521                 struct hci_ev_ext_vendor_specific *ev = (void *) skb->data;
3522                 __u8 event_le_ext_sub_code;
3523                 skb_pull(skb, sizeof(*ev));
3524                 event_le_ext_sub_code = ev->event_le_ext_sub_code;
3525
3526                 BT_DBG("Func: %s RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
3527                                 __func__, LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
3528
3529                 switch (event_le_ext_sub_code) {
3530                 case LE_RSSI_LINK_ALERT:
3531                         BT_DBG("Func: %s RSSI event LE_RSSI_LINK_ALERT %X",
3532                                         __func__, LE_RSSI_LINK_ALERT);
3533                         mgmt_rssi_alert_evt(hdev, skb);
3534                         break;
3535
3536                 default:
3537                         break;
3538                 }
3539         }
3540         break;
3541
3542         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
3543                 BT_DBG("Func: %s LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT", __func__);
3544                 mgmt_multi_adv_state_change_evt(hdev, skb);
3545                 break;
3546
3547         default:
3548                 break;
3549         }
3550 }
3551 #endif
3552 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3553 {
3554         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3555         struct hci_conn *conn;
3556
3557         BT_DBG("%s", hdev->name);
3558
3559         hci_dev_lock(hdev);
3560
3561         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3562         if (!conn)
3563                 goto unlock;
3564
3565         if (conn->state == BT_CONNECTED) {
3566                 hci_conn_hold(conn);
3567                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3568                 hci_conn_drop(conn);
3569         }
3570
3571         if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
3572             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3573                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3574                              sizeof(ev->bdaddr), &ev->bdaddr);
3575         } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3576                 u8 secure;
3577
3578                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3579                         secure = 1;
3580                 else
3581                         secure = 0;
3582
3583                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3584         }
3585
3586 unlock:
3587         hci_dev_unlock(hdev);
3588 }
3589
3590 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3591 {
3592         if (key_type == HCI_LK_CHANGED_COMBINATION)
3593                 return;
3594
3595         conn->pin_length = pin_len;
3596         conn->key_type = key_type;
3597
3598         switch (key_type) {
3599         case HCI_LK_LOCAL_UNIT:
3600         case HCI_LK_REMOTE_UNIT:
3601         case HCI_LK_DEBUG_COMBINATION:
3602                 return;
3603         case HCI_LK_COMBINATION:
3604                 if (pin_len == 16)
3605                         conn->pending_sec_level = BT_SECURITY_HIGH;
3606                 else
3607                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3608                 break;
3609         case HCI_LK_UNAUTH_COMBINATION_P192:
3610         case HCI_LK_UNAUTH_COMBINATION_P256:
3611                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3612                 break;
3613         case HCI_LK_AUTH_COMBINATION_P192:
3614                 conn->pending_sec_level = BT_SECURITY_HIGH;
3615                 break;
3616         case HCI_LK_AUTH_COMBINATION_P256:
3617                 conn->pending_sec_level = BT_SECURITY_FIPS;
3618                 break;
3619         }
3620 }
3621
3622 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3623 {
3624         struct hci_ev_link_key_req *ev = (void *) skb->data;
3625         struct hci_cp_link_key_reply cp;
3626         struct hci_conn *conn;
3627         struct link_key *key;
3628
3629         BT_DBG("%s", hdev->name);
3630
3631         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3632                 return;
3633
3634         hci_dev_lock(hdev);
3635
3636         key = hci_find_link_key(hdev, &ev->bdaddr);
3637         if (!key) {
3638                 BT_DBG("%s link key not found for %pMR", hdev->name,
3639                        &ev->bdaddr);
3640                 goto not_found;
3641         }
3642
3643         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3644                &ev->bdaddr);
3645
3646         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3647         if (conn) {
3648                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3649
3650                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3651                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3652                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3653                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3654                         goto not_found;
3655                 }
3656
3657                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3658                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3659                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3660                         BT_DBG("%s ignoring key unauthenticated for high security",
3661                                hdev->name);
3662                         goto not_found;
3663                 }
3664
3665                 conn_set_key(conn, key->type, key->pin_len);
3666         }
3667
3668         bacpy(&cp.bdaddr, &ev->bdaddr);
3669         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3670
3671         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3672
3673         hci_dev_unlock(hdev);
3674
3675         return;
3676
3677 not_found:
3678         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3679         hci_dev_unlock(hdev);
3680 }
3681
3682 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3683 {
3684         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3685         struct hci_conn *conn;
3686         struct link_key *key;
3687         bool persistent;
3688         u8 pin_len = 0;
3689
3690         BT_DBG("%s", hdev->name);
3691
3692         hci_dev_lock(hdev);
3693
3694         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3695         if (!conn)
3696                 goto unlock;
3697
3698         hci_conn_hold(conn);
3699         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3700         hci_conn_drop(conn);
3701
3702         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3703         conn_set_key(conn, ev->key_type, conn->pin_length);
3704
3705         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3706                 goto unlock;
3707
3708         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3709                                 ev->key_type, pin_len, &persistent);
3710         if (!key)
3711                 goto unlock;
3712
3713         /* Update connection information since adding the key will have
3714          * fixed up the type in the case of changed combination keys.
3715          */
3716         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3717                 conn_set_key(conn, key->type, key->pin_len);
3718
3719         mgmt_new_link_key(hdev, key, persistent);
3720
3721         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3722          * is set. If it's not set simply remove the key from the kernel
3723          * list (we've still notified user space about it but with
3724          * store_hint being 0).
3725          */
3726         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3727             !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3728                 list_del_rcu(&key->list);
3729                 kfree_rcu(key, rcu);
3730                 goto unlock;
3731         }
3732
3733         if (persistent)
3734                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3735         else
3736                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3737
3738 unlock:
3739         hci_dev_unlock(hdev);
3740 }
3741
3742 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3743 {
3744         struct hci_ev_clock_offset *ev = (void *) skb->data;
3745         struct hci_conn *conn;
3746
3747         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3748
3749         hci_dev_lock(hdev);
3750
3751         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3752         if (conn && !ev->status) {
3753                 struct inquiry_entry *ie;
3754
3755                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3756                 if (ie) {
3757                         ie->data.clock_offset = ev->clock_offset;
3758                         ie->timestamp = jiffies;
3759                 }
3760         }
3761
3762         hci_dev_unlock(hdev);
3763 }
3764
3765 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3766 {
3767         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3768         struct hci_conn *conn;
3769
3770         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3771
3772         hci_dev_lock(hdev);
3773
3774         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3775         if (conn && !ev->status)
3776                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3777
3778         hci_dev_unlock(hdev);
3779 }
3780
3781 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3782 {
3783         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3784         struct inquiry_entry *ie;
3785
3786         BT_DBG("%s", hdev->name);
3787
3788         hci_dev_lock(hdev);
3789
3790         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3791         if (ie) {
3792                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3793                 ie->timestamp = jiffies;
3794         }
3795
3796         hci_dev_unlock(hdev);
3797 }
3798
3799 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3800                                              struct sk_buff *skb)
3801 {
3802         struct inquiry_data data;
3803         int num_rsp = *((__u8 *) skb->data);
3804
3805         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3806
3807         if (!num_rsp)
3808                 return;
3809
3810         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3811                 return;
3812
3813         hci_dev_lock(hdev);
3814
3815         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3816                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3817                 info = (void *) (skb->data + 1);
3818
3819                 for (; num_rsp; num_rsp--, info++) {
3820                         u32 flags;
3821
3822                         bacpy(&data.bdaddr, &info->bdaddr);
3823                         data.pscan_rep_mode     = info->pscan_rep_mode;
3824                         data.pscan_period_mode  = info->pscan_period_mode;
3825                         data.pscan_mode         = info->pscan_mode;
3826                         memcpy(data.dev_class, info->dev_class, 3);
3827                         data.clock_offset       = info->clock_offset;
3828                         data.rssi               = info->rssi;
3829                         data.ssp_mode           = 0x00;
3830
3831                         flags = hci_inquiry_cache_update(hdev, &data, false);
3832
3833                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3834                                           info->dev_class, info->rssi,
3835                                           flags, NULL, 0, NULL, 0);
3836                 }
3837         } else {
3838                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3839
3840                 for (; num_rsp; num_rsp--, info++) {
3841                         u32 flags;
3842
3843                         bacpy(&data.bdaddr, &info->bdaddr);
3844                         data.pscan_rep_mode     = info->pscan_rep_mode;
3845                         data.pscan_period_mode  = info->pscan_period_mode;
3846                         data.pscan_mode         = 0x00;
3847                         memcpy(data.dev_class, info->dev_class, 3);
3848                         data.clock_offset       = info->clock_offset;
3849                         data.rssi               = info->rssi;
3850                         data.ssp_mode           = 0x00;
3851
3852                         flags = hci_inquiry_cache_update(hdev, &data, false);
3853
3854                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3855                                           info->dev_class, info->rssi,
3856                                           flags, NULL, 0, NULL, 0);
3857                 }
3858         }
3859
3860         hci_dev_unlock(hdev);
3861 }
3862
3863 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3864                                         struct sk_buff *skb)
3865 {
3866         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3867         struct hci_conn *conn;
3868
3869         BT_DBG("%s", hdev->name);
3870
3871         hci_dev_lock(hdev);
3872
3873         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3874         if (!conn)
3875                 goto unlock;
3876
3877         if (ev->page < HCI_MAX_PAGES)
3878                 memcpy(conn->features[ev->page], ev->features, 8);
3879
3880         if (!ev->status && ev->page == 0x01) {
3881                 struct inquiry_entry *ie;
3882
3883                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3884                 if (ie)
3885                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3886
3887                 if (ev->features[0] & LMP_HOST_SSP) {
3888                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3889                 } else {
3890                         /* It is mandatory by the Bluetooth specification that
3891                          * Extended Inquiry Results are only used when Secure
3892                          * Simple Pairing is enabled, but some devices violate
3893                          * this.
3894                          *
3895                          * To make these devices work, the internal SSP
3896                          * enabled flag needs to be cleared if the remote host
3897                          * features do not indicate SSP support */
3898                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3899                 }
3900
3901 /* Disable Secure connection implementation now */
3902 #ifdef CONFIG_TIZEN_WIP
3903                 if (ev->features[0] & LMP_HOST_SC)
3904                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3905 #endif
3906         }
3907
3908         if (conn->state != BT_CONFIG)
3909                 goto unlock;
3910
3911 #ifdef CONFIG_SPRD_2331
3912         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3913                 struct hci_cp_change_conn_ptype cp;
3914                 memset(&cp, 0, sizeof(cp));
3915                 cp.pkt_type = (HCI_DM1|HCI_DH1);
3916
3917                 if (conn->features[0][0] & LMP_3SLOT)
3918                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
3919
3920                 if (conn->features[0][0] & LMP_5SLOT)
3921                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
3922
3923                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
3924                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
3925                 } else {
3926                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3927                                 cp.pkt_type |= HCI_2DH3;
3928
3929                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3930                                 cp.pkt_type |= HCI_2DH5;
3931                 }
3932
3933                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
3934                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
3935                 } else {
3936                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3937                                 cp.pkt_type |= HCI_3DH3;
3938
3939                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3940                                 cp.pkt_type |= HCI_3DH5;
3941                 }
3942
3943                 cp.handle = ev->handle;
3944                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
3945         }
3946 #endif
3947
3948         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3949                 struct hci_cp_remote_name_req cp;
3950                 memset(&cp, 0, sizeof(cp));
3951                 bacpy(&cp.bdaddr, &conn->dst);
3952                 cp.pscan_rep_mode = 0x02;
3953                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3954         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3955                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3956
3957         if (!hci_outgoing_auth_needed(hdev, conn)) {
3958                 conn->state = BT_CONNECTED;
3959                 hci_proto_connect_cfm(conn, ev->status);
3960                 hci_conn_drop(conn);
3961         }
3962
3963 unlock:
3964         hci_dev_unlock(hdev);
3965 }
3966
3967 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3968                                        struct sk_buff *skb)
3969 {
3970         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3971         struct hci_conn *conn;
3972
3973         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3974
3975         hci_dev_lock(hdev);
3976
3977         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3978         if (!conn) {
3979                 if (ev->link_type == ESCO_LINK)
3980                         goto unlock;
3981
3982                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3983                 if (!conn)
3984                         goto unlock;
3985
3986                 conn->type = SCO_LINK;
3987         }
3988
3989         switch (ev->status) {
3990         case 0x00:
3991                 conn->handle = __le16_to_cpu(ev->handle);
3992                 conn->state  = BT_CONNECTED;
3993
3994                 hci_debugfs_create_conn(conn);
3995                 hci_conn_add_sysfs(conn);
3996                 break;
3997
3998         case 0x10:      /* Connection Accept Timeout */
3999         case 0x0d:      /* Connection Rejected due to Limited Resources */
4000         case 0x11:      /* Unsupported Feature or Parameter Value */
4001         case 0x1c:      /* SCO interval rejected */
4002         case 0x1a:      /* Unsupported Remote Feature */
4003         case 0x1f:      /* Unspecified error */
4004         case 0x20:      /* Unsupported LMP Parameter value */
4005                 if (conn->out) {
4006                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
4007                                         (hdev->esco_type & EDR_ESCO_MASK);
4008                         if (hci_setup_sync(conn, conn->link->handle))
4009                                 goto unlock;
4010                 }
4011                 /* fall through */
4012
4013         default:
4014                 conn->state = BT_CLOSED;
4015                 break;
4016         }
4017
4018         hci_proto_connect_cfm(conn, ev->status);
4019         if (ev->status)
4020                 hci_conn_del(conn);
4021
4022 unlock:
4023         hci_dev_unlock(hdev);
4024 }
4025
4026 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4027 {
4028         size_t parsed = 0;
4029
4030         while (parsed < eir_len) {
4031                 u8 field_len = eir[0];
4032
4033                 if (field_len == 0)
4034                         return parsed;
4035
4036                 parsed += field_len + 1;
4037                 eir += field_len + 1;
4038         }
4039
4040         return eir_len;
4041 }
4042
4043 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4044                                             struct sk_buff *skb)
4045 {
4046         struct inquiry_data data;
4047         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4048         int num_rsp = *((__u8 *) skb->data);
4049         size_t eir_len;
4050
4051         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4052
4053         if (!num_rsp)
4054                 return;
4055
4056         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
4057                 return;
4058
4059         hci_dev_lock(hdev);
4060
4061         for (; num_rsp; num_rsp--, info++) {
4062                 u32 flags;
4063                 bool name_known;
4064
4065                 bacpy(&data.bdaddr, &info->bdaddr);
4066                 data.pscan_rep_mode     = info->pscan_rep_mode;
4067                 data.pscan_period_mode  = info->pscan_period_mode;
4068                 data.pscan_mode         = 0x00;
4069                 memcpy(data.dev_class, info->dev_class, 3);
4070                 data.clock_offset       = info->clock_offset;
4071                 data.rssi               = info->rssi;
4072                 data.ssp_mode           = 0x01;
4073
4074                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
4075                         name_known = eir_has_data_type(info->data,
4076                                                        sizeof(info->data),
4077                                                        EIR_NAME_COMPLETE);
4078                 else
4079                         name_known = true;
4080
4081                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4082
4083                 eir_len = eir_get_length(info->data, sizeof(info->data));
4084
4085                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4086                                   info->dev_class, info->rssi,
4087                                   flags, info->data, eir_len, NULL, 0);
4088         }
4089
4090         hci_dev_unlock(hdev);
4091 }
4092
4093 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4094                                          struct sk_buff *skb)
4095 {
4096         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4097         struct hci_conn *conn;
4098
4099         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4100                __le16_to_cpu(ev->handle));
4101
4102         hci_dev_lock(hdev);
4103
4104         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4105         if (!conn)
4106                 goto unlock;
4107
4108         /* For BR/EDR the necessary steps are taken through the
4109          * auth_complete event.
4110          */
4111         if (conn->type != LE_LINK)
4112                 goto unlock;
4113
4114         if (!ev->status)
4115                 conn->sec_level = conn->pending_sec_level;
4116
4117         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4118
4119         if (ev->status && conn->state == BT_CONNECTED) {
4120                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4121                 hci_conn_drop(conn);
4122                 goto unlock;
4123         }
4124
4125         if (conn->state == BT_CONFIG) {
4126                 if (!ev->status)
4127                         conn->state = BT_CONNECTED;
4128
4129                 hci_proto_connect_cfm(conn, ev->status);
4130                 hci_conn_drop(conn);
4131         } else {
4132                 hci_auth_cfm(conn, ev->status);
4133
4134                 hci_conn_hold(conn);
4135                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4136                 hci_conn_drop(conn);
4137         }
4138
4139 unlock:
4140         hci_dev_unlock(hdev);
4141 }
4142
4143 static u8 hci_get_auth_req(struct hci_conn *conn)
4144 {
4145 #ifdef CONFIG_TIZEN_WIP
4146         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4147                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4148                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4149                         return HCI_AT_GENERAL_BONDING_MITM;
4150         }
4151 #endif
4152
4153         /* If remote requests no-bonding follow that lead */
4154         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4155             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4156                 return conn->remote_auth | (conn->auth_type & 0x01);
4157
4158         /* If both remote and local have enough IO capabilities, require
4159          * MITM protection
4160          */
4161         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4162             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4163                 return conn->remote_auth | 0x01;
4164
4165         /* No MITM protection possible so ignore remote requirement */
4166         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4167 }
4168
4169 static u8 bredr_oob_data_present(struct hci_conn *conn)
4170 {
4171         struct hci_dev *hdev = conn->hdev;
4172         struct oob_data *data;
4173
4174         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4175         if (!data)
4176                 return 0x00;
4177
4178         /* When Secure Connections Only mode is enabled, then the P-256
4179          * values are required. If they are not available, then do not
4180          * declare that OOB data is present.
4181          */
4182         if (bredr_sc_enabled(hdev) &&
4183             test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
4184             (!memcmp(data->rand256, ZERO_KEY, 16) ||
4185              !memcmp(data->hash256, ZERO_KEY, 16)))
4186                 return 0x00;
4187
4188         if (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags))
4189                 return 0x01;
4190
4191         return 0x00;
4192 }
4193
4194 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4195 {
4196         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4197         struct hci_conn *conn;
4198
4199         BT_DBG("%s", hdev->name);
4200
4201         hci_dev_lock(hdev);
4202
4203         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4204         if (!conn)
4205                 goto unlock;
4206
4207         hci_conn_hold(conn);
4208
4209         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4210                 goto unlock;
4211
4212         /* Allow pairing if we're pairable, the initiators of the
4213          * pairing or if the remote is not requesting bonding.
4214          */
4215         if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
4216             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4217             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4218                 struct hci_cp_io_capability_reply cp;
4219
4220                 bacpy(&cp.bdaddr, &ev->bdaddr);
4221                 /* Change the IO capability from KeyboardDisplay
4222                  * to DisplayYesNo as it is not supported by BT spec. */
4223                 cp.capability = (conn->io_capability == 0x04) ?
4224                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4225
4226                 /* If we are initiators, there is no remote information yet */
4227                 if (conn->remote_auth == 0xff) {
4228                         /* Request MITM protection if our IO caps allow it
4229                          * except for the no-bonding case.
4230                          */
4231                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4232                             conn->auth_type != HCI_AT_NO_BONDING)
4233                                 conn->auth_type |= 0x01;
4234                 } else {
4235                         conn->auth_type = hci_get_auth_req(conn);
4236                 }
4237
4238                 /* If we're not bondable, force one of the non-bondable
4239                  * authentication requirement values.
4240                  */
4241                 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
4242                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4243
4244                 cp.authentication = conn->auth_type;
4245                 cp.oob_data = bredr_oob_data_present(conn);
4246
4247                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4248                              sizeof(cp), &cp);
4249         } else {
4250                 struct hci_cp_io_capability_neg_reply cp;
4251
4252                 bacpy(&cp.bdaddr, &ev->bdaddr);
4253                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4254
4255                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4256                              sizeof(cp), &cp);
4257         }
4258
4259 unlock:
4260         hci_dev_unlock(hdev);
4261 }
4262
4263 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4264 {
4265         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4266         struct hci_conn *conn;
4267
4268         BT_DBG("%s", hdev->name);
4269
4270         hci_dev_lock(hdev);
4271
4272         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4273         if (!conn)
4274                 goto unlock;
4275
4276         conn->remote_cap = ev->capability;
4277         conn->remote_auth = ev->authentication;
4278         if (ev->oob_data)
4279                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
4280
4281 unlock:
4282         hci_dev_unlock(hdev);
4283 }
4284
4285 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4286                                          struct sk_buff *skb)
4287 {
4288         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4289         int loc_mitm, rem_mitm, confirm_hint = 0;
4290         struct hci_conn *conn;
4291
4292         BT_DBG("%s", hdev->name);
4293
4294         hci_dev_lock(hdev);
4295
4296         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4297                 goto unlock;
4298
4299         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4300         if (!conn)
4301                 goto unlock;
4302
4303         loc_mitm = (conn->auth_type & 0x01);
4304         rem_mitm = (conn->remote_auth & 0x01);
4305
4306         /* If we require MITM but the remote device can't provide that
4307          * (it has NoInputNoOutput) then reject the confirmation
4308          * request. We check the security level here since it doesn't
4309          * necessarily match conn->auth_type.
4310          */
4311         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4312             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4313                 BT_DBG("Rejecting request: remote device can't provide MITM");
4314                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4315                              sizeof(ev->bdaddr), &ev->bdaddr);
4316                 goto unlock;
4317         }
4318
4319         /* If no side requires MITM protection; auto-accept */
4320         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4321             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4322
4323                 /* If we're not the initiators request authorization to
4324                  * proceed from user space (mgmt_user_confirm with
4325                  * confirm_hint set to 1). The exception is if neither
4326                  * side had MITM or if the local IO capability is
4327                  * NoInputNoOutput, in which case we do auto-accept
4328                  */
4329                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4330                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4331                     (loc_mitm || rem_mitm)) {
4332                         BT_DBG("Confirming auto-accept as acceptor");
4333                         confirm_hint = 1;
4334                         goto confirm;
4335                 }
4336
4337                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4338                        hdev->auto_accept_delay);
4339
4340                 if (hdev->auto_accept_delay > 0) {
4341                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4342                         queue_delayed_work(conn->hdev->workqueue,
4343                                            &conn->auto_accept_work, delay);
4344                         goto unlock;
4345                 }
4346
4347                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4348                              sizeof(ev->bdaddr), &ev->bdaddr);
4349                 goto unlock;
4350         }
4351
4352 confirm:
4353         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4354                                   le32_to_cpu(ev->passkey), confirm_hint);
4355
4356 unlock:
4357         hci_dev_unlock(hdev);
4358 }
4359
4360 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4361                                          struct sk_buff *skb)
4362 {
4363         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4364
4365         BT_DBG("%s", hdev->name);
4366
4367         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4368                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4369 }
4370
4371 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4372                                         struct sk_buff *skb)
4373 {
4374         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4375         struct hci_conn *conn;
4376
4377         BT_DBG("%s", hdev->name);
4378
4379         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4380         if (!conn)
4381                 return;
4382
4383         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4384         conn->passkey_entered = 0;
4385
4386         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4387                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4388                                          conn->dst_type, conn->passkey_notify,
4389                                          conn->passkey_entered);
4390 }
4391
4392 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4393 {
4394         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4395         struct hci_conn *conn;
4396
4397         BT_DBG("%s", hdev->name);
4398
4399         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4400         if (!conn)
4401                 return;
4402
4403         switch (ev->type) {
4404         case HCI_KEYPRESS_STARTED:
4405                 conn->passkey_entered = 0;
4406                 return;
4407
4408         case HCI_KEYPRESS_ENTERED:
4409                 conn->passkey_entered++;
4410                 break;
4411
4412         case HCI_KEYPRESS_ERASED:
4413                 conn->passkey_entered--;
4414                 break;
4415
4416         case HCI_KEYPRESS_CLEARED:
4417                 conn->passkey_entered = 0;
4418                 break;
4419
4420         case HCI_KEYPRESS_COMPLETED:
4421                 return;
4422         }
4423
4424         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4425                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4426                                          conn->dst_type, conn->passkey_notify,
4427                                          conn->passkey_entered);
4428 }
4429
4430 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4431                                          struct sk_buff *skb)
4432 {
4433         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4434         struct hci_conn *conn;
4435
4436         BT_DBG("%s", hdev->name);
4437
4438         hci_dev_lock(hdev);
4439
4440         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4441         if (!conn)
4442                 goto unlock;
4443
4444         /* Reset the authentication requirement to unknown */
4445         conn->remote_auth = 0xff;
4446
4447         /* To avoid duplicate auth_failed events to user space we check
4448          * the HCI_CONN_AUTH_PEND flag which will be set if we
4449          * initiated the authentication. A traditional auth_complete
4450          * event gets always produced as initiator and is also mapped to
4451          * the mgmt_auth_failed event */
4452         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4453                 mgmt_auth_failed(conn, ev->status);
4454
4455         hci_conn_drop(conn);
4456
4457 unlock:
4458         hci_dev_unlock(hdev);
4459 }
4460
4461 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4462                                          struct sk_buff *skb)
4463 {
4464         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4465         struct inquiry_entry *ie;
4466         struct hci_conn *conn;
4467
4468         BT_DBG("%s", hdev->name);
4469
4470         hci_dev_lock(hdev);
4471
4472         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4473         if (conn)
4474                 memcpy(conn->features[1], ev->features, 8);
4475
4476         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4477         if (ie)
4478                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4479
4480         hci_dev_unlock(hdev);
4481 }
4482
4483 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4484                                             struct sk_buff *skb)
4485 {
4486         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4487         struct oob_data *data;
4488
4489         BT_DBG("%s", hdev->name);
4490
4491         hci_dev_lock(hdev);
4492
4493         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4494                 goto unlock;
4495
4496         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4497         if (!data) {
4498                 struct hci_cp_remote_oob_data_neg_reply cp;
4499
4500                 bacpy(&cp.bdaddr, &ev->bdaddr);
4501                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4502                              sizeof(cp), &cp);
4503                 goto unlock;
4504         }
4505
4506         if (bredr_sc_enabled(hdev)) {
4507                 struct hci_cp_remote_oob_ext_data_reply cp;
4508
4509                 bacpy(&cp.bdaddr, &ev->bdaddr);
4510                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4511                         memset(cp.hash192, 0, sizeof(cp.hash192));
4512                         memset(cp.rand192, 0, sizeof(cp.rand192));
4513                 } else {
4514                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4515                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4516                 }
4517                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4518                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4519
4520                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4521                              sizeof(cp), &cp);
4522         } else {
4523                 struct hci_cp_remote_oob_data_reply cp;
4524
4525                 bacpy(&cp.bdaddr, &ev->bdaddr);
4526                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4527                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4528
4529                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4530                              sizeof(cp), &cp);
4531         }
4532
4533 unlock:
4534         hci_dev_unlock(hdev);
4535 }
4536
4537 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4538                                       struct sk_buff *skb)
4539 {
4540         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4541         struct hci_conn *hcon, *bredr_hcon;
4542
4543         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4544                ev->status);
4545
4546         hci_dev_lock(hdev);
4547
4548         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4549         if (!hcon) {
4550                 hci_dev_unlock(hdev);
4551                 return;
4552         }
4553
4554         if (ev->status) {
4555                 hci_conn_del(hcon);
4556                 hci_dev_unlock(hdev);
4557                 return;
4558         }
4559
4560         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4561
4562         hcon->state = BT_CONNECTED;
4563         bacpy(&hcon->dst, &bredr_hcon->dst);
4564
4565         hci_conn_hold(hcon);
4566         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4567         hci_conn_drop(hcon);
4568
4569         hci_debugfs_create_conn(hcon);
4570         hci_conn_add_sysfs(hcon);
4571
4572         amp_physical_cfm(bredr_hcon, hcon);
4573
4574         hci_dev_unlock(hdev);
4575 }
4576
4577 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4578 {
4579         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4580         struct hci_conn *hcon;
4581         struct hci_chan *hchan;
4582         struct amp_mgr *mgr;
4583
4584         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4585                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4586                ev->status);
4587
4588         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4589         if (!hcon)
4590                 return;
4591
4592         /* Create AMP hchan */
4593         hchan = hci_chan_create(hcon);
4594         if (!hchan)
4595                 return;
4596
4597         hchan->handle = le16_to_cpu(ev->handle);
4598
4599         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4600
4601         mgr = hcon->amp_mgr;
4602         if (mgr && mgr->bredr_chan) {
4603                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4604
4605                 l2cap_chan_lock(bredr_chan);
4606
4607                 bredr_chan->conn->mtu = hdev->block_mtu;
4608                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4609                 hci_conn_hold(hcon);
4610
4611                 l2cap_chan_unlock(bredr_chan);
4612         }
4613 }
4614
4615 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4616                                              struct sk_buff *skb)
4617 {
4618         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4619         struct hci_chan *hchan;
4620
4621         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4622                le16_to_cpu(ev->handle), ev->status);
4623
4624         if (ev->status)
4625                 return;
4626
4627         hci_dev_lock(hdev);
4628
4629         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4630         if (!hchan)
4631                 goto unlock;
4632
4633         amp_destroy_logical_link(hchan, ev->reason);
4634
4635 unlock:
4636         hci_dev_unlock(hdev);
4637 }
4638
4639 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4640                                              struct sk_buff *skb)
4641 {
4642         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4643         struct hci_conn *hcon;
4644
4645         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4646
4647         if (ev->status)
4648                 return;
4649
4650         hci_dev_lock(hdev);
4651
4652         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4653         if (hcon) {
4654                 hcon->state = BT_CLOSED;
4655                 hci_conn_del(hcon);
4656         }
4657
4658         hci_dev_unlock(hdev);
4659 }
4660
4661 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4662 {
4663         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4664         struct hci_conn_params *params;
4665         struct hci_conn *conn;
4666         struct smp_irk *irk;
4667         u8 addr_type;
4668
4669         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4670
4671         hci_dev_lock(hdev);
4672
4673         /* All controllers implicitly stop advertising in the event of a
4674          * connection, so ensure that the state bit is cleared.
4675          */
4676         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4677
4678         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4679         if (!conn) {
4680                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4681                 if (!conn) {
4682                         BT_ERR("No memory for new connection");
4683                         goto unlock;
4684                 }
4685
4686                 conn->dst_type = ev->bdaddr_type;
4687
4688                 /* If we didn't have a hci_conn object previously
4689                  * but we're in master role this must be something
4690                  * initiated using a white list. Since white list based
4691                  * connections are not "first class citizens" we don't
4692                  * have full tracking of them. Therefore, we go ahead
4693                  * with a "best effort" approach of determining the
4694                  * initiator address based on the HCI_PRIVACY flag.
4695                  */
4696                 if (conn->out) {
4697                         conn->resp_addr_type = ev->bdaddr_type;
4698                         bacpy(&conn->resp_addr, &ev->bdaddr);
4699                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4700                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4701                                 bacpy(&conn->init_addr, &hdev->rpa);
4702                         } else {
4703                                 hci_copy_identity_address(hdev,
4704                                                           &conn->init_addr,
4705                                                           &conn->init_addr_type);
4706                         }
4707                 }
4708         } else {
4709 #ifdef CONFIG_TIZEN_WIP
4710                 /* LE auto connect */
4711                 bacpy(&conn->dst, &ev->bdaddr);
4712 #endif
4713                 cancel_delayed_work(&conn->le_conn_timeout);
4714         }
4715
4716         if (!conn->out) {
4717                 /* Set the responder (our side) address type based on
4718                  * the advertising address type.
4719                  */
4720                 conn->resp_addr_type = hdev->adv_addr_type;
4721                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4722                         bacpy(&conn->resp_addr, &hdev->random_addr);
4723                 else
4724                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4725
4726                 conn->init_addr_type = ev->bdaddr_type;
4727                 bacpy(&conn->init_addr, &ev->bdaddr);
4728
4729                 /* For incoming connections, set the default minimum
4730                  * and maximum connection interval. They will be used
4731                  * to check if the parameters are in range and if not
4732                  * trigger the connection update procedure.
4733                  */
4734                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4735                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4736         }
4737
4738         /* Lookup the identity address from the stored connection
4739          * address and address type.
4740          *
4741          * When establishing connections to an identity address, the
4742          * connection procedure will store the resolvable random
4743          * address first. Now if it can be converted back into the
4744          * identity address, start using the identity address from
4745          * now on.
4746          */
4747         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4748         if (irk) {
4749 #ifdef __TIZEN_PATCH__
4750                 /* Update rpa. So that, if irk is refreshed, it can be saved */
4751                 bacpy(&irk->rpa, &conn->dst);
4752 #endif
4753                 bacpy(&conn->dst, &irk->bdaddr);
4754                 conn->dst_type = irk->addr_type;
4755         }
4756
4757         if (ev->status) {
4758                 hci_le_conn_failed(conn, ev->status);
4759                 goto unlock;
4760         }
4761
4762         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4763                 addr_type = BDADDR_LE_PUBLIC;
4764         else
4765                 addr_type = BDADDR_LE_RANDOM;
4766
4767         /* Drop the connection if the device is blocked */
4768         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4769                 hci_conn_drop(conn);
4770                 goto unlock;
4771         }
4772
4773         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4774                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4775
4776         conn->sec_level = BT_SECURITY_LOW;
4777         conn->handle = __le16_to_cpu(ev->handle);
4778         conn->state = BT_CONNECTED;
4779
4780         conn->le_conn_interval = le16_to_cpu(ev->interval);
4781         conn->le_conn_latency = le16_to_cpu(ev->latency);
4782         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4783
4784         hci_debugfs_create_conn(conn);
4785         hci_conn_add_sysfs(conn);
4786
4787         hci_proto_connect_cfm(conn, ev->status);
4788
4789         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4790                                            conn->dst_type);
4791         if (params) {
4792                 list_del_init(&params->action);
4793                 if (params->conn) {
4794                         hci_conn_drop(params->conn);
4795                         hci_conn_put(params->conn);
4796                         params->conn = NULL;
4797                 }
4798         }
4799
4800 unlock:
4801         hci_update_background_scan(hdev);
4802         hci_dev_unlock(hdev);
4803 }
4804
4805 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4806                                             struct sk_buff *skb)
4807 {
4808         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4809         struct hci_conn *conn;
4810
4811         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4812
4813         if (ev->status)
4814                 return;
4815
4816         hci_dev_lock(hdev);
4817
4818         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4819         if (conn) {
4820                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4821                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4822                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4823         }
4824
4825         hci_dev_unlock(hdev);
4826 }
4827
4828 /* This function requires the caller holds hdev->lock */
4829 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4830                                               bdaddr_t *addr,
4831                                               u8 addr_type, u8 adv_type)
4832 {
4833         struct hci_conn *conn;
4834         struct hci_conn_params *params;
4835
4836         /* If the event is not connectable don't proceed further */
4837         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4838                 return NULL;
4839
4840         /* Ignore if the device is blocked */
4841         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4842                 return NULL;
4843
4844         /* Most controller will fail if we try to create new connections
4845          * while we have an existing one in slave role.
4846          */
4847         if (hdev->conn_hash.le_num_slave > 0)
4848                 return NULL;
4849
4850         /* If we're not connectable only connect devices that we have in
4851          * our pend_le_conns list.
4852          */
4853         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4854                                            addr, addr_type);
4855         if (!params)
4856                 return NULL;
4857
4858         switch (params->auto_connect) {
4859         case HCI_AUTO_CONN_DIRECT:
4860                 /* Only devices advertising with ADV_DIRECT_IND are
4861                  * triggering a connection attempt. This is allowing
4862                  * incoming connections from slave devices.
4863                  */
4864                 if (adv_type != LE_ADV_DIRECT_IND)
4865                         return NULL;
4866                 break;
4867         case HCI_AUTO_CONN_ALWAYS:
4868                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4869                  * are triggering a connection attempt. This means
4870                  * that incoming connectioms from slave device are
4871                  * accepted and also outgoing connections to slave
4872                  * devices are established when found.
4873                  */
4874                 break;
4875         default:
4876                 return NULL;
4877         }
4878
4879         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4880                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4881         if (!IS_ERR(conn)) {
4882                 /* Store the pointer since we don't really have any
4883                  * other owner of the object besides the params that
4884                  * triggered it. This way we can abort the connection if
4885                  * the parameters get removed and keep the reference
4886                  * count consistent once the connection is established.
4887                  */
4888                 params->conn = hci_conn_get(conn);
4889                 return conn;
4890         }
4891
4892         switch (PTR_ERR(conn)) {
4893         case -EBUSY:
4894                 /* If hci_connect() returns -EBUSY it means there is already
4895                  * an LE connection attempt going on. Since controllers don't
4896                  * support more than one connection attempt at the time, we
4897                  * don't consider this an error case.
4898                  */
4899                 break;
4900         default:
4901                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4902                 return NULL;
4903         }
4904
4905         return NULL;
4906 }
4907
4908 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4909                                u8 bdaddr_type, bdaddr_t *direct_addr,
4910                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4911 {
4912 #ifndef CONFIG_TIZEN_WIP
4913         struct discovery_state *d = &hdev->discovery;
4914 #endif
4915         struct smp_irk *irk;
4916         struct hci_conn *conn;
4917 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
4918         bool match;
4919 #endif
4920         u32 flags;
4921
4922         /* If the direct address is present, then this report is from
4923          * a LE Direct Advertising Report event. In that case it is
4924          * important to see if the address is matching the local
4925          * controller address.
4926          */
4927         if (direct_addr) {
4928                 /* Only resolvable random addresses are valid for these
4929                  * kind of reports and others can be ignored.
4930                  */
4931                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4932                         return;
4933
4934                 /* If the controller is not using resolvable random
4935                  * addresses, then this report can be ignored.
4936                  */
4937                 if (!test_bit(HCI_PRIVACY, &hdev->dev_flags))
4938                         return;
4939
4940                 /* If the local IRK of the controller does not match
4941                  * with the resolvable random address provided, then
4942                  * this report can be ignored.
4943                  */
4944                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4945                         return;
4946         }
4947
4948         /* Check if we need to convert to identity address */
4949         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4950         if (irk) {
4951                 bdaddr = &irk->bdaddr;
4952                 bdaddr_type = irk->addr_type;
4953         }
4954
4955         /* Check if we have been requested to connect to this device */
4956         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4957         if (conn && type == LE_ADV_IND) {
4958                 /* Store report for later inclusion by
4959                  * mgmt_device_connected
4960                  */
4961                 memcpy(conn->le_adv_data, data, len);
4962                 conn->le_adv_data_len = len;
4963         }
4964
4965         /* Passive scanning shouldn't trigger any device found events,
4966          * except for devices marked as CONN_REPORT for which we do send
4967          * device found events.
4968          */
4969         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4970                 if (type == LE_ADV_DIRECT_IND)
4971                         return;
4972
4973 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Handle all adv packet in platform */
4974                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4975                                                bdaddr, bdaddr_type))
4976                         return;
4977 #endif
4978
4979                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4980                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4981                 else
4982                         flags = 0;
4983
4984 #ifdef CONFIG_TIZEN_WIP
4985                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4986                                   rssi, flags, data, len, NULL, 0, type);
4987 #else
4988                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4989                                   rssi, flags, data, len, NULL, 0);
4990 #endif
4991                 return;
4992         }
4993
4994         /* When receiving non-connectable or scannable undirected
4995          * advertising reports, this means that the remote device is
4996          * not connectable and then clearly indicate this in the
4997          * device found event.
4998          *
4999          * When receiving a scan response, then there is no way to
5000          * know if the remote device is connectable or not. However
5001          * since scan responses are merged with a previously seen
5002          * advertising report, the flags field from that report
5003          * will be used.
5004          *
5005          * In the really unlikely case that a controller get confused
5006          * and just sends a scan response event, then it is marked as
5007          * not connectable as well.
5008          */
5009         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
5010             type == LE_ADV_SCAN_RSP)
5011                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
5012         else
5013                 flags = 0;
5014
5015 #ifdef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
5016         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5017                   rssi, flags, data, len, NULL, 0, type);
5018 #else
5019         /* If there's nothing pending either store the data from this
5020          * event or send an immediate device found event if the data
5021          * should not be stored for later.
5022          */
5023         if (!has_pending_adv_report(hdev)) {
5024                 /* If the report will trigger a SCAN_REQ store it for
5025                  * later merging.
5026                  */
5027                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5028                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5029                                                  rssi, flags, data, len);
5030                         return;
5031                 }
5032
5033                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5034                                   rssi, flags, data, len, NULL, 0);
5035                 return;
5036         }
5037
5038         /* Check if the pending report is for the same device as the new one */
5039         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5040                  bdaddr_type == d->last_adv_addr_type);
5041
5042         /* If the pending data doesn't match this report or this isn't a
5043          * scan response (e.g. we got a duplicate ADV_IND) then force
5044          * sending of the pending data.
5045          */
5046         if (type != LE_ADV_SCAN_RSP || !match) {
5047                 /* Send out whatever is in the cache, but skip duplicates */
5048                 if (!match)
5049                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5050                                           d->last_adv_addr_type, NULL,
5051                                           d->last_adv_rssi, d->last_adv_flags,
5052                                           d->last_adv_data,
5053                                           d->last_adv_data_len, NULL, 0);
5054
5055                 /* If the new report will trigger a SCAN_REQ store it for
5056                  * later merging.
5057                  */
5058                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5059                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5060                                                  rssi, flags, data, len);
5061                         return;
5062                 }
5063
5064                 /* The advertising reports cannot be merged, so clear
5065                  * the pending report and send out a device found event.
5066                  */
5067                 clear_pending_adv_report(hdev);
5068                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5069                                   rssi, flags, data, len, NULL, 0);
5070                 return;
5071         }
5072
5073         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5074          * the new event is a SCAN_RSP. We can therefore proceed with
5075          * sending a merged device found event.
5076          */
5077         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5078                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5079                           d->last_adv_data, d->last_adv_data_len, data, len);
5080         clear_pending_adv_report(hdev);
5081 #endif
5082 }
5083
5084 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5085 {
5086         u8 num_reports = skb->data[0];
5087         void *ptr = &skb->data[1];
5088
5089         hci_dev_lock(hdev);
5090
5091         while (num_reports--) {
5092                 struct hci_ev_le_advertising_info *ev = ptr;
5093                 s8 rssi;
5094
5095                 rssi = ev->data[ev->length];
5096                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5097                                    ev->bdaddr_type, NULL, 0, rssi,
5098                                    ev->data, ev->length);
5099
5100                 ptr += sizeof(*ev) + ev->length + 1;
5101         }
5102
5103         hci_dev_unlock(hdev);
5104 }
5105
5106 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5107 {
5108         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5109         struct hci_cp_le_ltk_reply cp;
5110         struct hci_cp_le_ltk_neg_reply neg;
5111         struct hci_conn *conn;
5112         struct smp_ltk *ltk;
5113
5114         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5115
5116         hci_dev_lock(hdev);
5117
5118         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5119         if (conn == NULL)
5120                 goto not_found;
5121
5122         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5123         if (!ltk)
5124                 goto not_found;
5125
5126         if (smp_ltk_is_sc(ltk)) {
5127                 /* With SC both EDiv and Rand are set to zero */
5128                 if (ev->ediv || ev->rand)
5129                         goto not_found;
5130         } else {
5131                 /* For non-SC keys check that EDiv and Rand match */
5132                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5133                         goto not_found;
5134         }
5135
5136         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
5137         cp.handle = cpu_to_le16(conn->handle);
5138
5139         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5140
5141         conn->enc_key_size = ltk->enc_size;
5142
5143         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5144
5145         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5146          * temporary key used to encrypt a connection following
5147          * pairing. It is used during the Encrypted Session Setup to
5148          * distribute the keys. Later, security can be re-established
5149          * using a distributed LTK.
5150          */
5151         if (ltk->type == SMP_STK) {
5152                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5153                 list_del_rcu(&ltk->list);
5154                 kfree_rcu(ltk, rcu);
5155         } else {
5156                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5157         }
5158
5159         hci_dev_unlock(hdev);
5160
5161         return;
5162
5163 not_found:
5164         neg.handle = ev->handle;
5165         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5166         hci_dev_unlock(hdev);
5167 }
5168
5169 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5170                                       u8 reason)
5171 {
5172         struct hci_cp_le_conn_param_req_neg_reply cp;
5173
5174         cp.handle = cpu_to_le16(handle);
5175         cp.reason = reason;
5176
5177         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5178                      &cp);
5179 }
5180
5181 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5182                                              struct sk_buff *skb)
5183 {
5184         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5185         struct hci_cp_le_conn_param_req_reply cp;
5186         struct hci_conn *hcon;
5187         u16 handle, min, max, latency, timeout;
5188
5189         handle = le16_to_cpu(ev->handle);
5190         min = le16_to_cpu(ev->interval_min);
5191         max = le16_to_cpu(ev->interval_max);
5192         latency = le16_to_cpu(ev->latency);
5193         timeout = le16_to_cpu(ev->timeout);
5194
5195         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5196         if (!hcon || hcon->state != BT_CONNECTED)
5197                 return send_conn_param_neg_reply(hdev, handle,
5198                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5199
5200         if (hci_check_conn_params(min, max, latency, timeout))
5201                 return send_conn_param_neg_reply(hdev, handle,
5202                                                  HCI_ERROR_INVALID_LL_PARAMS);
5203
5204         if (hcon->role == HCI_ROLE_MASTER) {
5205                 struct hci_conn_params *params;
5206                 u8 store_hint;
5207
5208                 hci_dev_lock(hdev);
5209
5210                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5211                                                 hcon->dst_type);
5212                 if (params) {
5213                         params->conn_min_interval = min;
5214                         params->conn_max_interval = max;
5215                         params->conn_latency = latency;
5216                         params->supervision_timeout = timeout;
5217                         store_hint = 0x01;
5218                 } else{
5219                         store_hint = 0x00;
5220                 }
5221
5222                 hci_dev_unlock(hdev);
5223
5224                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5225                                     store_hint, min, max, latency, timeout);
5226         }
5227
5228         cp.handle = ev->handle;
5229         cp.interval_min = ev->interval_min;
5230         cp.interval_max = ev->interval_max;
5231         cp.latency = ev->latency;
5232         cp.timeout = ev->timeout;
5233         cp.min_ce_len = 0;
5234         cp.max_ce_len = 0;
5235
5236         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5237 }
5238
5239 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5240                                          struct sk_buff *skb)
5241 {
5242         u8 num_reports = skb->data[0];
5243         void *ptr = &skb->data[1];
5244
5245         hci_dev_lock(hdev);
5246
5247         while (num_reports--) {
5248                 struct hci_ev_le_direct_adv_info *ev = ptr;
5249
5250                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5251                                    ev->bdaddr_type, &ev->direct_addr,
5252                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5253
5254                 ptr += sizeof(*ev);
5255         }
5256
5257         hci_dev_unlock(hdev);
5258 }
5259
5260 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5261 {
5262         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5263
5264         skb_pull(skb, sizeof(*le_ev));
5265
5266         switch (le_ev->subevent) {
5267         case HCI_EV_LE_CONN_COMPLETE:
5268                 hci_le_conn_complete_evt(hdev, skb);
5269                 break;
5270
5271         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5272                 hci_le_conn_update_complete_evt(hdev, skb);
5273                 break;
5274
5275         case HCI_EV_LE_ADVERTISING_REPORT:
5276                 hci_le_adv_report_evt(hdev, skb);
5277                 break;
5278
5279         case HCI_EV_LE_LTK_REQ:
5280                 hci_le_ltk_request_evt(hdev, skb);
5281                 break;
5282
5283         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5284                 hci_le_remote_conn_param_req_evt(hdev, skb);
5285                 break;
5286
5287         case HCI_EV_LE_DIRECT_ADV_REPORT:
5288                 hci_le_direct_adv_report_evt(hdev, skb);
5289                 break;
5290
5291         default:
5292                 break;
5293         }
5294 }
5295
5296 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5297 {
5298         struct hci_ev_channel_selected *ev = (void *) skb->data;
5299         struct hci_conn *hcon;
5300
5301         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5302
5303         skb_pull(skb, sizeof(*ev));
5304
5305         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5306         if (!hcon)
5307                 return;
5308
5309         amp_read_loc_assoc_final_data(hdev, hcon);
5310 }
5311
5312 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5313 {
5314         struct hci_event_hdr *hdr = (void *) skb->data;
5315         __u8 event = hdr->evt;
5316
5317         hci_dev_lock(hdev);
5318
5319         /* Received events are (currently) only needed when a request is
5320          * ongoing so avoid unnecessary memory allocation.
5321          */
5322         if (hci_req_pending(hdev)) {
5323                 kfree_skb(hdev->recv_evt);
5324                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
5325         }
5326
5327         hci_dev_unlock(hdev);
5328
5329         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5330
5331         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5332                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5333                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
5334
5335                 hci_req_cmd_complete(hdev, opcode, 0);
5336         }
5337
5338         switch (event) {
5339         case HCI_EV_INQUIRY_COMPLETE:
5340                 hci_inquiry_complete_evt(hdev, skb);
5341                 break;
5342
5343         case HCI_EV_INQUIRY_RESULT:
5344                 hci_inquiry_result_evt(hdev, skb);
5345                 break;
5346
5347         case HCI_EV_CONN_COMPLETE:
5348                 hci_conn_complete_evt(hdev, skb);
5349                 break;
5350
5351         case HCI_EV_CONN_REQUEST:
5352                 hci_conn_request_evt(hdev, skb);
5353                 break;
5354
5355         case HCI_EV_DISCONN_COMPLETE:
5356                 hci_disconn_complete_evt(hdev, skb);
5357                 break;
5358
5359         case HCI_EV_AUTH_COMPLETE:
5360                 hci_auth_complete_evt(hdev, skb);
5361                 break;
5362
5363         case HCI_EV_REMOTE_NAME:
5364                 hci_remote_name_evt(hdev, skb);
5365                 break;
5366
5367         case HCI_EV_ENCRYPT_CHANGE:
5368                 hci_encrypt_change_evt(hdev, skb);
5369                 break;
5370
5371         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5372                 hci_change_link_key_complete_evt(hdev, skb);
5373                 break;
5374
5375         case HCI_EV_REMOTE_FEATURES:
5376                 hci_remote_features_evt(hdev, skb);
5377                 break;
5378
5379         case HCI_EV_CMD_COMPLETE:
5380                 hci_cmd_complete_evt(hdev, skb);
5381                 break;
5382
5383         case HCI_EV_CMD_STATUS:
5384                 hci_cmd_status_evt(hdev, skb);
5385                 break;
5386
5387         case HCI_EV_HARDWARE_ERROR:
5388                 hci_hardware_error_evt(hdev, skb);
5389                 break;
5390
5391         case HCI_EV_ROLE_CHANGE:
5392                 hci_role_change_evt(hdev, skb);
5393                 break;
5394
5395         case HCI_EV_NUM_COMP_PKTS:
5396                 hci_num_comp_pkts_evt(hdev, skb);
5397                 break;
5398
5399         case HCI_EV_MODE_CHANGE:
5400                 hci_mode_change_evt(hdev, skb);
5401                 break;
5402
5403         case HCI_EV_PIN_CODE_REQ:
5404                 hci_pin_code_request_evt(hdev, skb);
5405                 break;
5406
5407         case HCI_EV_LINK_KEY_REQ:
5408                 hci_link_key_request_evt(hdev, skb);
5409                 break;
5410
5411         case HCI_EV_LINK_KEY_NOTIFY:
5412                 hci_link_key_notify_evt(hdev, skb);
5413                 break;
5414
5415         case HCI_EV_CLOCK_OFFSET:
5416                 hci_clock_offset_evt(hdev, skb);
5417                 break;
5418
5419         case HCI_EV_PKT_TYPE_CHANGE:
5420                 hci_pkt_type_change_evt(hdev, skb);
5421                 break;
5422
5423         case HCI_EV_PSCAN_REP_MODE:
5424                 hci_pscan_rep_mode_evt(hdev, skb);
5425                 break;
5426
5427         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5428                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5429                 break;
5430
5431         case HCI_EV_REMOTE_EXT_FEATURES:
5432                 hci_remote_ext_features_evt(hdev, skb);
5433                 break;
5434
5435         case HCI_EV_SYNC_CONN_COMPLETE:
5436                 hci_sync_conn_complete_evt(hdev, skb);
5437                 break;
5438
5439         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5440                 hci_extended_inquiry_result_evt(hdev, skb);
5441                 break;
5442
5443         case HCI_EV_KEY_REFRESH_COMPLETE:
5444                 hci_key_refresh_complete_evt(hdev, skb);
5445                 break;
5446
5447         case HCI_EV_IO_CAPA_REQUEST:
5448                 hci_io_capa_request_evt(hdev, skb);
5449                 break;
5450
5451         case HCI_EV_IO_CAPA_REPLY:
5452                 hci_io_capa_reply_evt(hdev, skb);
5453                 break;
5454
5455         case HCI_EV_USER_CONFIRM_REQUEST:
5456                 hci_user_confirm_request_evt(hdev, skb);
5457                 break;
5458
5459         case HCI_EV_USER_PASSKEY_REQUEST:
5460                 hci_user_passkey_request_evt(hdev, skb);
5461                 break;
5462
5463         case HCI_EV_USER_PASSKEY_NOTIFY:
5464                 hci_user_passkey_notify_evt(hdev, skb);
5465                 break;
5466
5467         case HCI_EV_KEYPRESS_NOTIFY:
5468                 hci_keypress_notify_evt(hdev, skb);
5469                 break;
5470
5471         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5472                 hci_simple_pair_complete_evt(hdev, skb);
5473                 break;
5474
5475         case HCI_EV_REMOTE_HOST_FEATURES:
5476                 hci_remote_host_features_evt(hdev, skb);
5477                 break;
5478
5479         case HCI_EV_LE_META:
5480                 hci_le_meta_evt(hdev, skb);
5481                 break;
5482
5483         case HCI_EV_CHANNEL_SELECTED:
5484                 hci_chan_selected_evt(hdev, skb);
5485                 break;
5486
5487         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5488                 hci_remote_oob_data_request_evt(hdev, skb);
5489                 break;
5490
5491         case HCI_EV_PHY_LINK_COMPLETE:
5492                 hci_phy_link_complete_evt(hdev, skb);
5493                 break;
5494
5495         case HCI_EV_LOGICAL_LINK_COMPLETE:
5496                 hci_loglink_complete_evt(hdev, skb);
5497                 break;
5498
5499         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5500                 hci_disconn_loglink_complete_evt(hdev, skb);
5501                 break;
5502
5503         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5504                 hci_disconn_phylink_complete_evt(hdev, skb);
5505                 break;
5506
5507         case HCI_EV_NUM_COMP_BLOCKS:
5508                 hci_num_comp_blocks_evt(hdev, skb);
5509                 break;
5510
5511 #ifdef CONFIG_TIZEN_WIP
5512         case HCI_EV_VENDOR_SPECIFIC:
5513                 hci_vendor_specific_evt(hdev, skb);
5514                 break;
5515 #endif
5516
5517         default:
5518                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5519                 break;
5520         }
5521
5522         kfree_skb(skb);
5523         hdev->stat.evt_rx++;
5524 }