net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <asm/unaligned.h>
  28
  29 #include <net/bluetooth/bluetooth.h>
  30 #include <net/bluetooth/hci_core.h>
  31 #include <net/bluetooth/mgmt.h>
  32
  33 #include "hci_request.h"
  34 #include "hci_debugfs.h"
  35 #include "a2mp.h"
  36 #include "amp.h"
  37 #include "smp.h"
  38
  39 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \
  40                  "\x00\x00\x00\x00\x00\x00\x00\x00"
  41
  42 /* Handle HCI Event packets */
  43
  44 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  45 {
  46         __u8 status = *((__u8 *) skb->data);
  47
  48         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  49
  50         if (status)
  51                 return;
  52
  53         clear_bit(HCI_INQUIRY, &hdev->flags);
  54 #ifdef CONFIG_TIZEN_WIP
  55         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
  56 #else
  57         /* In latest kernel, smp_mb__after_clear_bit is replaced with
  58           * smp_mb__after_atomic. So, if kernel is migrated to latest,
  59           * then below code should be enabled
  60           */
  61         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
  62 #endif
  63         wake_up_bit(&hdev->flags, HCI_INQUIRY);
  64
  65         hci_dev_lock(hdev);
  66         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
  67         hci_dev_unlock(hdev);
  68
  69         hci_conn_check_pending(hdev);
  70 }
  71
  72 static void hci_cc_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  73 {
  74         __u8 status = *((__u8 *) skb->data);
  75
  76         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  77
  78         if (status)
  79                 return;
  80
  81         set_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  82 }
  83
  84 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  85 {
  86         __u8 status = *((__u8 *) skb->data);
  87
  88         BT_DBG("%s status 0x%2.2x", hdev->name, status);
  89
  90         if (status)
  91                 return;
  92
  93         clear_bit(HCI_PERIODIC_INQ, &hdev->dev_flags);
  94
  95         hci_conn_check_pending(hdev);
  96 }
  97
  98 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev,
  99                                           struct sk_buff *skb)
 100 {
 101         BT_DBG("%s", hdev->name);
 102 }
 103
 104 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
 105 {
 106         struct hci_rp_role_discovery *rp = (void *) skb->data;
 107         struct hci_conn *conn;
 108
 109         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 110
 111         if (rp->status)
 112                 return;
 113
 114         hci_dev_lock(hdev);
 115
 116         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 117         if (conn)
 118                 conn->role = rp->role;
 119
 120         hci_dev_unlock(hdev);
 121 }
 122
 123 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 124 {
 125         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 126         struct hci_conn *conn;
 127
 128         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 129
 130         if (rp->status)
 131                 return;
 132
 133         hci_dev_lock(hdev);
 134
 135         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 136         if (conn)
 137                 conn->link_policy = __le16_to_cpu(rp->policy);
 138
 139         hci_dev_unlock(hdev);
 140 }
 141
 142 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 143 {
 144         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 145 #ifdef CONFIG_TIZEN_WIP
 146         struct hci_cp_write_link_policy cp;
 147         struct hci_conn *sco_conn;
 148 #endif
 149         struct hci_conn *conn;
 150         void *sent;
 151
 152         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 153
 154         if (rp->status)
 155                 return;
 156
 157         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 158         if (!sent)
 159                 return;
 160
 161         hci_dev_lock(hdev);
 162
 163         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 164         if (conn)
 165                 conn->link_policy = get_unaligned_le16(sent + 2);
 166 #ifdef CONFIG_TIZEN_WIP
 167         sco_conn = hci_conn_hash_lookup_sco(hdev);
 168         if (sco_conn && conn && bacmp(&sco_conn->dst, &conn->dst) == 0 &&
 169                         conn->link_policy & HCI_LP_SNIFF) {
 170                 BT_ERR("SNIFF is not allowed during sco connection");
 171                 cp.handle = __cpu_to_le16(conn->handle);
 172                 cp.policy = __cpu_to_le16(conn->link_policy & ~HCI_LP_SNIFF);
 173                 hci_send_cmd(hdev, HCI_OP_WRITE_LINK_POLICY, sizeof(cp), &cp);
 174         }
 175 #endif
 176
 177         hci_dev_unlock(hdev);
 178 }
 179
 180 static void hci_cc_read_def_link_policy(struct hci_dev *hdev,
 181                                         struct sk_buff *skb)
 182 {
 183         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 184
 185         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 186
 187         if (rp->status)
 188                 return;
 189
 190         hdev->link_policy = __le16_to_cpu(rp->policy);
 191 }
 192
 193 static void hci_cc_write_def_link_policy(struct hci_dev *hdev,
 194                                          struct sk_buff *skb)
 195 {
 196         __u8 status = *((__u8 *) skb->data);
 197         void *sent;
 198
 199         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 200
 201         if (status)
 202                 return;
 203
 204         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 205         if (!sent)
 206                 return;
 207
 208         hdev->link_policy = get_unaligned_le16(sent);
 209 }
 210
 211 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 212 {
 213         __u8 status = *((__u8 *) skb->data);
 214
 215         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 216
 217         clear_bit(HCI_RESET, &hdev->flags);
 218
 219         if (status)
 220                 return;
 221
 222         /* Reset all non-persistent flags */
 223         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 224
 225         hdev->discovery.state = DISCOVERY_STOPPED;
 226         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
 227         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 228
 229         memset(hdev->adv_data, 0, sizeof(hdev->adv_data));
 230         hdev->adv_data_len = 0;
 231
 232         memset(hdev->scan_rsp_data, 0, sizeof(hdev->scan_rsp_data));
 233         hdev->scan_rsp_data_len = 0;
 234
 235         hdev->le_scan_type = LE_SCAN_PASSIVE;
 236
 237         hdev->ssp_debug_mode = 0;
 238
 239         hci_bdaddr_list_clear(&hdev->le_white_list);
 240 }
 241
 242 static void hci_cc_read_stored_link_key(struct hci_dev *hdev,
 243                                         struct sk_buff *skb)
 244 {
 245         struct hci_rp_read_stored_link_key *rp = (void *)skb->data;
 246         struct hci_cp_read_stored_link_key *sent;
 247
 248         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 249
 250         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_STORED_LINK_KEY);
 251         if (!sent)
 252                 return;
 253
 254         if (!rp->status && sent->read_all == 0x01) {
 255                 hdev->stored_max_keys = rp->max_keys;
 256                 hdev->stored_num_keys = rp->num_keys;
 257         }
 258 }
 259
 260 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 261                                           struct sk_buff *skb)
 262 {
 263         struct hci_rp_delete_stored_link_key *rp = (void *)skb->data;
 264
 265         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 266
 267         if (rp->status)
 268                 return;
 269
 270         if (rp->num_keys <= hdev->stored_num_keys)
 271                 hdev->stored_num_keys -= rp->num_keys;
 272         else
 273                 hdev->stored_num_keys = 0;
 274 }
 275
 276 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 277 {
 278         __u8 status = *((__u8 *) skb->data);
 279         void *sent;
 280
 281         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 282
 283         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 284         if (!sent)
 285                 return;
 286
 287         hci_dev_lock(hdev);
 288
 289         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 290                 mgmt_set_local_name_complete(hdev, sent, status);
 291         else if (!status)
 292                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 293
 294         hci_dev_unlock(hdev);
 295 }
 296
 297 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 298 {
 299         struct hci_rp_read_local_name *rp = (void *) skb->data;
 300
 301         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 302
 303         if (rp->status)
 304                 return;
 305
 306         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 307             test_bit(HCI_CONFIG, &hdev->dev_flags))
 308                 memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 309 }
 310
 311 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 312 {
 313         __u8 status = *((__u8 *) skb->data);
 314         void *sent;
 315
 316         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 317
 318         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 319         if (!sent)
 320                 return;
 321
 322         hci_dev_lock(hdev);
 323
 324         if (!status) {
 325                 __u8 param = *((__u8 *) sent);
 326
 327                 if (param == AUTH_ENABLED)
 328                         set_bit(HCI_AUTH, &hdev->flags);
 329                 else
 330                         clear_bit(HCI_AUTH, &hdev->flags);
 331         }
 332
 333         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 334                 mgmt_auth_enable_complete(hdev, status);
 335
 336         hci_dev_unlock(hdev);
 337 }
 338
 339 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 340 {
 341         __u8 status = *((__u8 *) skb->data);
 342         __u8 param;
 343         void *sent;
 344
 345         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 346
 347         if (status)
 348                 return;
 349
 350         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 351         if (!sent)
 352                 return;
 353
 354         param = *((__u8 *) sent);
 355
 356         if (param)
 357                 set_bit(HCI_ENCRYPT, &hdev->flags);
 358         else
 359                 clear_bit(HCI_ENCRYPT, &hdev->flags);
 360 }
 361
 362 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         __u8 status = *((__u8 *) skb->data);
 365         __u8 param;
 366         void *sent;
 367
 368         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 369
 370         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 371         if (!sent)
 372                 return;
 373
 374         param = *((__u8 *) sent);
 375
 376         hci_dev_lock(hdev);
 377
 378         if (status) {
 379                 hdev->discov_timeout = 0;
 380                 goto done;
 381         }
 382
 383         if (param & SCAN_INQUIRY)
 384                 set_bit(HCI_ISCAN, &hdev->flags);
 385         else
 386                 clear_bit(HCI_ISCAN, &hdev->flags);
 387
 388         if (param & SCAN_PAGE)
 389                 set_bit(HCI_PSCAN, &hdev->flags);
 390         else
 391                 clear_bit(HCI_PSCAN, &hdev->flags);
 392
 393 done:
 394         hci_dev_unlock(hdev);
 395 }
 396
 397 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 398 {
 399         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 400
 401         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 402
 403         if (rp->status)
 404                 return;
 405
 406         memcpy(hdev->dev_class, rp->dev_class, 3);
 407
 408         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 409                hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 410 }
 411
 412 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 413 {
 414         __u8 status = *((__u8 *) skb->data);
 415         void *sent;
 416
 417         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 418
 419         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 420         if (!sent)
 421                 return;
 422
 423         hci_dev_lock(hdev);
 424
 425         if (status == 0)
 426                 memcpy(hdev->dev_class, sent, 3);
 427
 428         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 429                 mgmt_set_class_of_dev_complete(hdev, sent, status);
 430
 431         hci_dev_unlock(hdev);
 432 }
 433
 434 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 437         __u16 setting;
 438
 439         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 440
 441         if (rp->status)
 442                 return;
 443
 444         setting = __le16_to_cpu(rp->voice_setting);
 445
 446         if (hdev->voice_setting == setting)
 447                 return;
 448
 449         hdev->voice_setting = setting;
 450
 451         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 452
 453         if (hdev->notify)
 454                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 455 }
 456
 457 static void hci_cc_write_voice_setting(struct hci_dev *hdev,
 458                                        struct sk_buff *skb)
 459 {
 460         __u8 status = *((__u8 *) skb->data);
 461         __u16 setting;
 462         void *sent;
 463
 464         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 465
 466         if (status)
 467                 return;
 468
 469         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 470         if (!sent)
 471                 return;
 472
 473         setting = get_unaligned_le16(sent);
 474
 475         if (hdev->voice_setting == setting)
 476                 return;
 477
 478         hdev->voice_setting = setting;
 479
 480         BT_DBG("%s voice setting 0x%4.4x", hdev->name, setting);
 481
 482         if (hdev->notify)
 483                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 484 }
 485
 486 static void hci_cc_read_num_supported_iac(struct hci_dev *hdev,
 487                                           struct sk_buff *skb)
 488 {
 489         struct hci_rp_read_num_supported_iac *rp = (void *) skb->data;
 490
 491         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 492
 493         if (rp->status)
 494                 return;
 495
 496         hdev->num_iac = rp->num_iac;
 497
 498         BT_DBG("%s num iac %d", hdev->name, hdev->num_iac);
 499 }
 500
 501 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 502 {
 503         __u8 status = *((__u8 *) skb->data);
 504         struct hci_cp_write_ssp_mode *sent;
 505
 506         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 507
 508         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 509         if (!sent)
 510                 return;
 511
 512         hci_dev_lock(hdev);
 513
 514         if (!status) {
 515                 if (sent->mode)
 516                         hdev->features[1][0] |= LMP_HOST_SSP;
 517                 else
 518                         hdev->features[1][0] &= ~LMP_HOST_SSP;
 519         }
 520
 521         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 522                 mgmt_ssp_enable_complete(hdev, sent->mode, status);
 523         else if (!status) {
 524                 if (sent->mode)
 525                         set_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 526                 else
 527                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
 528         }
 529
 530         hci_dev_unlock(hdev);
 531 }
 532
 533 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
 534 {
 535         u8 status = *((u8 *) skb->data);
 536         struct hci_cp_write_sc_support *sent;
 537
 538         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 539
 540         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SC_SUPPORT);
 541         if (!sent)
 542                 return;
 543
 544         hci_dev_lock(hdev);
 545
 546         if (!status) {
 547                 if (sent->support)
 548                         hdev->features[1][0] |= LMP_HOST_SC;
 549                 else
 550                         hdev->features[1][0] &= ~LMP_HOST_SC;
 551         }
 552
 553         if (!test_bit(HCI_MGMT, &hdev->dev_flags) && !status) {
 554                 if (sent->support)
 555                         set_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 556                 else
 557                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
 558         }
 559
 560         hci_dev_unlock(hdev);
 561 }
 562
 563 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 564 {
 565         struct hci_rp_read_local_version *rp = (void *) skb->data;
 566
 567         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 568
 569         if (rp->status)
 570                 return;
 571
 572         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 573             test_bit(HCI_CONFIG, &hdev->dev_flags)) {
 574                 hdev->hci_ver = rp->hci_ver;
 575                 hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 576                 hdev->lmp_ver = rp->lmp_ver;
 577                 hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 578                 hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 579         }
 580 }
 581
 582 static void hci_cc_read_local_commands(struct hci_dev *hdev,
 583                                        struct sk_buff *skb)
 584 {
 585         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 586
 587         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 588
 589         if (rp->status)
 590                 return;
 591
 592         if (test_bit(HCI_SETUP, &hdev->dev_flags) ||
 593             test_bit(HCI_CONFIG, &hdev->dev_flags))
 594                 memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 595 }
 596
 597 static void hci_cc_read_local_features(struct hci_dev *hdev,
 598                                        struct sk_buff *skb)
 599 {
 600         struct hci_rp_read_local_features *rp = (void *) skb->data;
 601
 602         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 603
 604         if (rp->status)
 605                 return;
 606
 607         memcpy(hdev->features, rp->features, 8);
 608
 609         /* Adjust default settings according to features
 610          * supported by device. */
 611
 612         if (hdev->features[0][0] & LMP_3SLOT)
 613                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 614
 615         if (hdev->features[0][0] & LMP_5SLOT)
 616                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 617
 618         if (hdev->features[0][1] & LMP_HV2) {
 619                 hdev->pkt_type  |= (HCI_HV2);
 620                 hdev->esco_type |= (ESCO_HV2);
 621         }
 622
 623         if (hdev->features[0][1] & LMP_HV3) {
 624                 hdev->pkt_type  |= (HCI_HV3);
 625                 hdev->esco_type |= (ESCO_HV3);
 626         }
 627
 628         if (lmp_esco_capable(hdev))
 629                 hdev->esco_type |= (ESCO_EV3);
 630
 631         if (hdev->features[0][4] & LMP_EV4)
 632                 hdev->esco_type |= (ESCO_EV4);
 633
 634         if (hdev->features[0][4] & LMP_EV5)
 635                 hdev->esco_type |= (ESCO_EV5);
 636
 637         if (hdev->features[0][5] & LMP_EDR_ESCO_2M)
 638                 hdev->esco_type |= (ESCO_2EV3);
 639
 640         if (hdev->features[0][5] & LMP_EDR_ESCO_3M)
 641                 hdev->esco_type |= (ESCO_3EV3);
 642
 643         if (hdev->features[0][5] & LMP_EDR_3S_ESCO)
 644                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 645 }
 646
 647 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 648                                            struct sk_buff *skb)
 649 {
 650         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 651
 652         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 653
 654         if (rp->status)
 655                 return;
 656
 657         if (hdev->max_page < rp->max_page)
 658                 hdev->max_page = rp->max_page;
 659
 660         if (rp->page < HCI_MAX_PAGES)
 661                 memcpy(hdev->features[rp->page], rp->features, 8);
 662 }
 663
 664 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 665                                           struct sk_buff *skb)
 666 {
 667         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 668
 669         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 670
 671         if (rp->status)
 672                 return;
 673
 674         hdev->flow_ctl_mode = rp->mode;
 675 }
 676
 677 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 678 {
 679         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 680
 681         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 682
 683         if (rp->status)
 684                 return;
 685
 686         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 687         hdev->sco_mtu  = rp->sco_mtu;
 688         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 689         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 690
 691         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 692                 hdev->sco_mtu  = 64;
 693                 hdev->sco_pkts = 8;
 694         }
 695
 696         hdev->acl_cnt = hdev->acl_pkts;
 697         hdev->sco_cnt = hdev->sco_pkts;
 698
 699         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name, hdev->acl_mtu,
 700                hdev->acl_pkts, hdev->sco_mtu, hdev->sco_pkts);
 701 }
 702
 703 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 704 {
 705         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 706
 707         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 708
 709         if (rp->status)
 710                 return;
 711
 712         if (test_bit(HCI_INIT, &hdev->flags))
 713                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 714
 715         if (test_bit(HCI_SETUP, &hdev->dev_flags))
 716                 bacpy(&hdev->setup_addr, &rp->bdaddr);
 717 }
 718
 719 static void hci_cc_read_page_scan_activity(struct hci_dev *hdev,
 720                                            struct sk_buff *skb)
 721 {
 722         struct hci_rp_read_page_scan_activity *rp = (void *) skb->data;
 723
 724         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 725
 726         if (rp->status)
 727                 return;
 728
 729         if (test_bit(HCI_INIT, &hdev->flags)) {
 730                 hdev->page_scan_interval = __le16_to_cpu(rp->interval);
 731                 hdev->page_scan_window = __le16_to_cpu(rp->window);
 732         }
 733 }
 734
 735 static void hci_cc_write_page_scan_activity(struct hci_dev *hdev,
 736                                             struct sk_buff *skb)
 737 {
 738         u8 status = *((u8 *) skb->data);
 739         struct hci_cp_write_page_scan_activity *sent;
 740
 741         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 742
 743         if (status)
 744                 return;
 745
 746         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY);
 747         if (!sent)
 748                 return;
 749
 750         hdev->page_scan_interval = __le16_to_cpu(sent->interval);
 751         hdev->page_scan_window = __le16_to_cpu(sent->window);
 752 }
 753
 754 static void hci_cc_read_page_scan_type(struct hci_dev *hdev,
 755                                            struct sk_buff *skb)
 756 {
 757         struct hci_rp_read_page_scan_type *rp = (void *) skb->data;
 758
 759         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 760
 761         if (rp->status)
 762                 return;
 763
 764         if (test_bit(HCI_INIT, &hdev->flags))
 765                 hdev->page_scan_type = rp->type;
 766 }
 767
 768 static void hci_cc_write_page_scan_type(struct hci_dev *hdev,
 769                                         struct sk_buff *skb)
 770 {
 771         u8 status = *((u8 *) skb->data);
 772         u8 *type;
 773
 774         BT_DBG("%s status 0x%2.2x", hdev->name, status);
 775
 776         if (status)
 777                 return;
 778
 779         type = hci_sent_cmd_data(hdev, HCI_OP_WRITE_PAGE_SCAN_TYPE);
 780         if (type)
 781                 hdev->page_scan_type = *type;
 782 }
 783
 784 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 785                                         struct sk_buff *skb)
 786 {
 787         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 788
 789         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 790
 791         if (rp->status)
 792                 return;
 793
 794         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 795         hdev->block_len = __le16_to_cpu(rp->block_len);
 796         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 797
 798         hdev->block_cnt = hdev->num_blocks;
 799
 800         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 801                hdev->block_cnt, hdev->block_len);
 802 }
 803
 804 static void hci_cc_read_clock(struct hci_dev *hdev, struct sk_buff *skb)
 805 {
 806         struct hci_rp_read_clock *rp = (void *) skb->data;
 807         struct hci_cp_read_clock *cp;
 808         struct hci_conn *conn;
 809
 810         BT_DBG("%s", hdev->name);
 811
 812         if (skb->len < sizeof(*rp))
 813                 return;
 814
 815         if (rp->status)
 816                 return;
 817
 818         hci_dev_lock(hdev);
 819
 820         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK);
 821         if (!cp)
 822                 goto unlock;
 823
 824         if (cp->which == 0x00) {
 825                 hdev->clock = le32_to_cpu(rp->clock);
 826                 goto unlock;
 827         }
 828
 829         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 830         if (conn) {
 831                 conn->clock = le32_to_cpu(rp->clock);
 832                 conn->clock_accuracy = le16_to_cpu(rp->accuracy);
 833         }
 834
 835 unlock:
 836         hci_dev_unlock(hdev);
 837 }
 838
 839 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 840                                        struct sk_buff *skb)
 841 {
 842         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 843
 844         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 845
 846         if (rp->status)
 847                 goto a2mp_rsp;
 848
 849         hdev->amp_status = rp->amp_status;
 850         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 851         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 852         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 853         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 854         hdev->amp_type = rp->amp_type;
 855         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 856         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 857         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 858         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 859
 860 a2mp_rsp:
 861         a2mp_send_getinfo_rsp(hdev);
 862 }
 863
 864 static void hci_cc_read_local_amp_assoc(struct hci_dev *hdev,
 865                                         struct sk_buff *skb)
 866 {
 867         struct hci_rp_read_local_amp_assoc *rp = (void *) skb->data;
 868         struct amp_assoc *assoc = &hdev->loc_assoc;
 869         size_t rem_len, frag_len;
 870
 871         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 872
 873         if (rp->status)
 874                 goto a2mp_rsp;
 875
 876         frag_len = skb->len - sizeof(*rp);
 877         rem_len = __le16_to_cpu(rp->rem_len);
 878
 879         if (rem_len > frag_len) {
 880                 BT_DBG("frag_len %zu rem_len %zu", frag_len, rem_len);
 881
 882                 memcpy(assoc->data + assoc->offset, rp->frag, frag_len);
 883                 assoc->offset += frag_len;
 884
 885                 /* Read other fragments */
 886                 amp_read_loc_assoc_frag(hdev, rp->phy_handle);
 887
 888                 return;
 889         }
 890
 891         memcpy(assoc->data + assoc->offset, rp->frag, rem_len);
 892         assoc->len = assoc->offset + rem_len;
 893         assoc->offset = 0;
 894
 895 a2mp_rsp:
 896         /* Send A2MP Rsp when all fragments are received */
 897         a2mp_send_getampassoc_rsp(hdev, rp->status);
 898         a2mp_send_create_phy_link_req(hdev, rp->status);
 899 }
 900
 901 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 902                                          struct sk_buff *skb)
 903 {
 904         struct hci_rp_read_inq_rsp_tx_power *rp = (void *) skb->data;
 905
 906         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 907
 908         if (rp->status)
 909                 return;
 910
 911         hdev->inq_tx_power = rp->tx_power;
 912 }
 913
 914 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 915 {
 916         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 917         struct hci_cp_pin_code_reply *cp;
 918         struct hci_conn *conn;
 919
 920         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 921
 922         hci_dev_lock(hdev);
 923
 924         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 925                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 926
 927         if (rp->status)
 928                 goto unlock;
 929
 930         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 931         if (!cp)
 932                 goto unlock;
 933
 934         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 935         if (conn)
 936                 conn->pin_length = cp->pin_len;
 937
 938 unlock:
 939         hci_dev_unlock(hdev);
 940 }
 941
 942 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 945
 946         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 947
 948         hci_dev_lock(hdev);
 949
 950         if (test_bit(HCI_MGMT, &hdev->dev_flags))
 951                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 952                                                  rp->status);
 953
 954         hci_dev_unlock(hdev);
 955 }
 956
 957 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 958                                        struct sk_buff *skb)
 959 {
 960         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 961
 962         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 963
 964         if (rp->status)
 965                 return;
 966
 967         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 968         hdev->le_pkts = rp->le_max_pkt;
 969
 970         hdev->le_cnt = hdev->le_pkts;
 971
 972         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 973 }
 974
 975 static void hci_cc_le_read_local_features(struct hci_dev *hdev,
 976                                           struct sk_buff *skb)
 977 {
 978         struct hci_rp_le_read_local_features *rp = (void *) skb->data;
 979
 980         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 981
 982         if (rp->status)
 983                 return;
 984
 985         memcpy(hdev->le_features, rp->features, 8);
 986 }
 987
 988 static void hci_cc_le_read_adv_tx_power(struct hci_dev *hdev,
 989                                         struct sk_buff *skb)
 990 {
 991         struct hci_rp_le_read_adv_tx_power *rp = (void *) skb->data;
 992
 993         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
 994
 995         if (rp->status)
 996                 return;
 997
 998         hdev->adv_tx_power = rp->tx_power;
 999 }
1000
1001 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
1002 {
1003         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1004
1005         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1006
1007         hci_dev_lock(hdev);
1008
1009         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1010                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr, ACL_LINK, 0,
1011                                                  rp->status);
1012
1013         hci_dev_unlock(hdev);
1014 }
1015
1016 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
1017                                           struct sk_buff *skb)
1018 {
1019         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1020
1021         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1022
1023         hci_dev_lock(hdev);
1024
1025         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1026                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
1027                                                      ACL_LINK, 0, rp->status);
1028
1029         hci_dev_unlock(hdev);
1030 }
1031
1032 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
1033 {
1034         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1035
1036         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1037
1038         hci_dev_lock(hdev);
1039
1040         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1041                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr, ACL_LINK,
1042                                                  0, rp->status);
1043
1044         hci_dev_unlock(hdev);
1045 }
1046
1047 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
1048                                           struct sk_buff *skb)
1049 {
1050         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
1051
1052         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1053
1054         hci_dev_lock(hdev);
1055
1056         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1057                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1058                                                      ACL_LINK, 0, rp->status);
1059
1060         hci_dev_unlock(hdev);
1061 }
1062
1063 static void hci_cc_read_local_oob_data(struct hci_dev *hdev,
1064                                        struct sk_buff *skb)
1065 {
1066         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1067
1068         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1069
1070         hci_dev_lock(hdev);
1071         mgmt_read_local_oob_data_complete(hdev, rp->hash, rp->rand, NULL, NULL,
1072                                           rp->status);
1073         hci_dev_unlock(hdev);
1074 }
1075
1076 static void hci_cc_read_local_oob_ext_data(struct hci_dev *hdev,
1077                                            struct sk_buff *skb)
1078 {
1079         struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data;
1080
1081         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1082
1083         hci_dev_lock(hdev);
1084         mgmt_read_local_oob_data_complete(hdev, rp->hash192, rp->rand192,
1085                                           rp->hash256, rp->rand256,
1086                                           rp->status);
1087         hci_dev_unlock(hdev);
1088 }
1089
1090
1091 static void hci_cc_le_set_random_addr(struct hci_dev *hdev, struct sk_buff *skb)
1092 {
1093         __u8 status = *((__u8 *) skb->data);
1094         bdaddr_t *sent;
1095
1096         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1097
1098         if (status)
1099                 return;
1100
1101         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_RANDOM_ADDR);
1102         if (!sent)
1103                 return;
1104
1105         hci_dev_lock(hdev);
1106
1107         bacpy(&hdev->random_addr, sent);
1108
1109         hci_dev_unlock(hdev);
1110 }
1111
1112 static void hci_cc_le_set_adv_enable(struct hci_dev *hdev, struct sk_buff *skb)
1113 {
1114         __u8 *sent, status = *((__u8 *) skb->data);
1115
1116         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1117
1118         if (status)
1119                 return;
1120
1121         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_ENABLE);
1122         if (!sent)
1123                 return;
1124
1125         hci_dev_lock(hdev);
1126
1127         /* If we're doing connection initiation as peripheral. Set a
1128          * timeout in case something goes wrong.
1129          */
1130         if (*sent) {
1131                 struct hci_conn *conn;
1132
1133                 set_bit(HCI_LE_ADV, &hdev->dev_flags);
1134
1135                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1136                 if (conn)
1137                         queue_delayed_work(hdev->workqueue,
1138                                            &conn->le_conn_timeout,
1139                                            conn->conn_timeout);
1140         } else {
1141                 clear_bit(HCI_LE_ADV, &hdev->dev_flags);
1142         }
1143
1144         hci_dev_unlock(hdev);
1145 }
1146
1147 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1148 {
1149         struct hci_cp_le_set_scan_param *cp;
1150         __u8 status = *((__u8 *) skb->data);
1151
1152         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1153
1154         if (status)
1155                 return;
1156
1157         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_PARAM);
1158         if (!cp)
1159                 return;
1160
1161         hci_dev_lock(hdev);
1162
1163         hdev->le_scan_type = cp->type;
1164
1165         hci_dev_unlock(hdev);
1166 }
1167
1168 static bool has_pending_adv_report(struct hci_dev *hdev)
1169 {
1170         struct discovery_state *d = &hdev->discovery;
1171
1172         return bacmp(&d->last_adv_addr, BDADDR_ANY);
1173 }
1174
1175 static void clear_pending_adv_report(struct hci_dev *hdev)
1176 {
1177         struct discovery_state *d = &hdev->discovery;
1178
1179         bacpy(&d->last_adv_addr, BDADDR_ANY);
1180         d->last_adv_data_len = 0;
1181 }
1182
1183 #ifndef CONFIG_TIZEN_WIP
1184 static void store_pending_adv_report(struct hci_dev *hdev, bdaddr_t *bdaddr,
1185                                      u8 bdaddr_type, s8 rssi, u32 flags,
1186                                      u8 *data, u8 len)
1187 {
1188         struct discovery_state *d = &hdev->discovery;
1189
1190         bacpy(&d->last_adv_addr, bdaddr);
1191         d->last_adv_addr_type = bdaddr_type;
1192         d->last_adv_rssi = rssi;
1193         d->last_adv_flags = flags;
1194         memcpy(d->last_adv_data, data, len);
1195         d->last_adv_data_len = len;
1196 }
1197 #endif
1198
1199 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1200                                       struct sk_buff *skb)
1201 {
1202         struct hci_cp_le_set_scan_enable *cp;
1203         __u8 status = *((__u8 *) skb->data);
1204
1205         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1206
1207         if (status)
1208                 return;
1209
1210         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1211         if (!cp)
1212                 return;
1213
1214         hci_dev_lock(hdev);
1215
1216         switch (cp->enable) {
1217         case LE_SCAN_ENABLE:
1218                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1219                 if (hdev->le_scan_type == LE_SCAN_ACTIVE)
1220                         clear_pending_adv_report(hdev);
1221                 break;
1222
1223         case LE_SCAN_DISABLE:
1224                 /* We do this here instead of when setting DISCOVERY_STOPPED
1225                  * since the latter would potentially require waiting for
1226                  * inquiry to stop too.
1227                  */
1228                 if (has_pending_adv_report(hdev)) {
1229                         struct discovery_state *d = &hdev->discovery;
1230
1231                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
1232                                           d->last_adv_addr_type, NULL,
1233                                           d->last_adv_rssi, d->last_adv_flags,
1234                                           d->last_adv_data,
1235                                           d->last_adv_data_len, NULL, 0);
1236                 }
1237
1238                 /* Cancel this timer so that we don't try to disable scanning
1239                  * when it's already disabled.
1240                  */
1241                 cancel_delayed_work(&hdev->le_scan_disable);
1242
1243                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1244
1245                 /* The HCI_LE_SCAN_INTERRUPTED flag indicates that we
1246                  * interrupted scanning due to a connect request. Mark
1247                  * therefore discovery as stopped. If this was not
1248                  * because of a connect request advertising might have
1249                  * been disabled because of active scanning, so
1250                  * re-enable it again if necessary.
1251                  */
1252                 if (test_and_clear_bit(HCI_LE_SCAN_INTERRUPTED,
1253                                        &hdev->dev_flags))
1254 #ifndef CONFIG_TIZEN_WIP /* The below line is kernel bug. */
1255                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1256 #else
1257                         hci_le_discovery_set_state(hdev, DISCOVERY_STOPPED);
1258 #endif
1259                 else if (!test_bit(HCI_LE_ADV, &hdev->dev_flags) &&
1260                          hdev->discovery.state == DISCOVERY_FINDING)
1261                         mgmt_reenable_advertising(hdev);
1262
1263                 break;
1264
1265         default:
1266                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1267                 break;
1268         }
1269
1270         hci_dev_unlock(hdev);
1271 }
1272
1273 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
1274                                            struct sk_buff *skb)
1275 {
1276         struct hci_rp_le_read_white_list_size *rp = (void *) skb->data;
1277
1278         BT_DBG("%s status 0x%2.2x size %u", hdev->name, rp->status, rp->size);
1279
1280         if (rp->status)
1281                 return;
1282
1283         hdev->le_white_list_size = rp->size;
1284 }
1285
1286 static void hci_cc_le_clear_white_list(struct hci_dev *hdev,
1287                                        struct sk_buff *skb)
1288 {
1289         __u8 status = *((__u8 *) skb->data);
1290
1291         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1292
1293         if (status)
1294                 return;
1295
1296         hci_bdaddr_list_clear(&hdev->le_white_list);
1297 }
1298
1299 static void hci_cc_le_add_to_white_list(struct hci_dev *hdev,
1300                                         struct sk_buff *skb)
1301 {
1302         struct hci_cp_le_add_to_white_list *sent;
1303         __u8 status = *((__u8 *) skb->data);
1304
1305         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1306
1307         if (status)
1308                 return;
1309
1310         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_WHITE_LIST);
1311         if (!sent)
1312                 return;
1313
1314         hci_bdaddr_list_add(&hdev->le_white_list, &sent->bdaddr,
1315                            sent->bdaddr_type);
1316 }
1317
1318 static void hci_cc_le_del_from_white_list(struct hci_dev *hdev,
1319                                           struct sk_buff *skb)
1320 {
1321         struct hci_cp_le_del_from_white_list *sent;
1322         __u8 status = *((__u8 *) skb->data);
1323
1324         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1325
1326         if (status)
1327                 return;
1328
1329         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_DEL_FROM_WHITE_LIST);
1330         if (!sent)
1331                 return;
1332
1333         hci_bdaddr_list_del(&hdev->le_white_list, &sent->bdaddr,
1334                             sent->bdaddr_type);
1335 }
1336
1337 static void hci_cc_le_read_supported_states(struct hci_dev *hdev,
1338                                             struct sk_buff *skb)
1339 {
1340         struct hci_rp_le_read_supported_states *rp = (void *) skb->data;
1341
1342         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1343
1344         if (rp->status)
1345                 return;
1346
1347         memcpy(hdev->le_states, rp->le_states, 8);
1348 }
1349
1350 static void hci_cc_le_read_def_data_len(struct hci_dev *hdev,
1351                                         struct sk_buff *skb)
1352 {
1353         struct hci_rp_le_read_def_data_len *rp = (void *) skb->data;
1354
1355         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1356
1357         if (rp->status)
1358                 return;
1359
1360         hdev->le_def_tx_len = le16_to_cpu(rp->tx_len);
1361         hdev->le_def_tx_time = le16_to_cpu(rp->tx_time);
1362 }
1363
1364 static void hci_cc_le_write_def_data_len(struct hci_dev *hdev,
1365                                          struct sk_buff *skb)
1366 {
1367         struct hci_cp_le_write_def_data_len *sent;
1368         __u8 status = *((__u8 *) skb->data);
1369
1370         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1371
1372         if (status)
1373                 return;
1374
1375         sent = hci_sent_cmd_data(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN);
1376         if (!sent)
1377                 return;
1378
1379         hdev->le_def_tx_len = le16_to_cpu(sent->tx_len);
1380         hdev->le_def_tx_time = le16_to_cpu(sent->tx_time);
1381 }
1382
1383 static void hci_cc_le_read_max_data_len(struct hci_dev *hdev,
1384                                         struct sk_buff *skb)
1385 {
1386         struct hci_rp_le_read_max_data_len *rp = (void *) skb->data;
1387
1388         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1389
1390         if (rp->status)
1391                 return;
1392
1393         hdev->le_max_tx_len = le16_to_cpu(rp->tx_len);
1394         hdev->le_max_tx_time = le16_to_cpu(rp->tx_time);
1395         hdev->le_max_rx_len = le16_to_cpu(rp->rx_len);
1396         hdev->le_max_rx_time = le16_to_cpu(rp->rx_time);
1397 }
1398
1399 static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1400                                            struct sk_buff *skb)
1401 {
1402         struct hci_cp_write_le_host_supported *sent;
1403         __u8 status = *((__u8 *) skb->data);
1404
1405         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1406
1407         if (status)
1408                 return;
1409
1410         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED);
1411         if (!sent)
1412                 return;
1413
1414         hci_dev_lock(hdev);
1415
1416         if (sent->le) {
1417                 hdev->features[1][0] |= LMP_HOST_LE;
1418                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1419         } else {
1420                 hdev->features[1][0] &= ~LMP_HOST_LE;
1421                 clear_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1422                 clear_bit(HCI_ADVERTISING, &hdev->dev_flags);
1423         }
1424
1425         if (sent->simul)
1426                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
1427         else
1428                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
1429
1430         hci_dev_unlock(hdev);
1431 }
1432
1433 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
1434 {
1435         struct hci_cp_le_set_adv_param *cp;
1436         u8 status = *((u8 *) skb->data);
1437
1438         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1439
1440         if (status)
1441                 return;
1442
1443         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_ADV_PARAM);
1444         if (!cp)
1445                 return;
1446
1447         hci_dev_lock(hdev);
1448         hdev->adv_addr_type = cp->own_address_type;
1449         hci_dev_unlock(hdev);
1450 }
1451
1452 static void hci_cc_write_remote_amp_assoc(struct hci_dev *hdev,
1453                                           struct sk_buff *skb)
1454 {
1455         struct hci_rp_write_remote_amp_assoc *rp = (void *) skb->data;
1456
1457         BT_DBG("%s status 0x%2.2x phy_handle 0x%2.2x",
1458                hdev->name, rp->status, rp->phy_handle);
1459
1460         if (rp->status)
1461                 return;
1462
1463         amp_write_rem_assoc_continue(hdev, rp->phy_handle);
1464 }
1465 #ifdef CONFIG_TIZEN_WIP
1466 /* BEGIN TIZEN_Bluetooth :: Handle RSSI monitoring */
1467 static void hci_cc_enable_rssi(struct hci_dev *hdev,
1468                                           struct sk_buff *skb)
1469 {
1470         struct hci_cc_rsp_enable_rssi *rp = (void *) skb->data;
1471
1472         BT_DBG("hci_cc_enable_rssi - %s status 0x%2.2x Event_LE_ext_Opcode 0x%2.2x",
1473                hdev->name, rp->status, rp->le_ext_opcode);
1474
1475         mgmt_enable_rssi_cc(hdev, rp, rp->status);
1476 }
1477
1478 static void hci_cc_get_raw_rssi(struct hci_dev *hdev,
1479                                           struct sk_buff *skb)
1480 {
1481         struct hci_cc_rp_get_raw_rssi *rp = (void *) skb->data;
1482
1483         BT_DBG("hci_cc_get_raw_rssi- %s Get Raw Rssi Response[%2.2x %4.4x %2.2X]",
1484                hdev->name, rp->status, rp->conn_handle, rp->rssi_dbm);
1485
1486         mgmt_raw_rssi_response(hdev, rp, rp->status);
1487 }
1488 /* END TIZEN_Bluetooth :: Handle RSSI monitoring */
1489 #endif
1490 static void hci_cc_read_rssi(struct hci_dev *hdev, struct sk_buff *skb)
1491 {
1492         struct hci_rp_read_rssi *rp = (void *) skb->data;
1493         struct hci_conn *conn;
1494
1495         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1496
1497         if (rp->status)
1498                 return;
1499
1500         hci_dev_lock(hdev);
1501
1502         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1503         if (conn)
1504                 conn->rssi = rp->rssi;
1505
1506         hci_dev_unlock(hdev);
1507 }
1508
1509 static void hci_cc_read_tx_power(struct hci_dev *hdev, struct sk_buff *skb)
1510 {
1511         struct hci_cp_read_tx_power *sent;
1512         struct hci_rp_read_tx_power *rp = (void *) skb->data;
1513         struct hci_conn *conn;
1514
1515         BT_DBG("%s status 0x%2.2x", hdev->name, rp->status);
1516
1517         if (rp->status)
1518                 return;
1519
1520         sent = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER);
1521         if (!sent)
1522                 return;
1523
1524         hci_dev_lock(hdev);
1525
1526         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
1527         if (!conn)
1528                 goto unlock;
1529
1530         switch (sent->type) {
1531         case 0x00:
1532                 conn->tx_power = rp->tx_power;
1533                 break;
1534         case 0x01:
1535                 conn->max_tx_power = rp->tx_power;
1536                 break;
1537         }
1538
1539 unlock:
1540         hci_dev_unlock(hdev);
1541 }
1542
1543 static void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1544 {
1545         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1546
1547         if (status) {
1548                 hci_conn_check_pending(hdev);
1549                 return;
1550         }
1551
1552         set_bit(HCI_INQUIRY, &hdev->flags);
1553 }
1554
1555 static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1556 {
1557         struct hci_cp_create_conn *cp;
1558         struct hci_conn *conn;
1559
1560         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1561
1562         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1563         if (!cp)
1564                 return;
1565
1566         hci_dev_lock(hdev);
1567
1568         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1569
1570         BT_DBG("%s bdaddr %pMR hcon %p", hdev->name, &cp->bdaddr, conn);
1571
1572         if (status) {
1573 #ifdef CONFIG_TIZEN_WIP
1574                 if (status == 0x0b)
1575                         BT_ERR("ACL Connection Already Exists on cs_create_con");
1576
1577                 if (conn && conn->state == BT_CONNECT && status != 0x0b) {
1578 #else
1579                 if (conn && conn->state == BT_CONNECT) {
1580 #endif
1581                         if (status != 0x0c || conn->attempt > 2) {
1582                                 conn->state = BT_CLOSED;
1583                                 hci_proto_connect_cfm(conn, status);
1584                                 hci_conn_del(conn);
1585                         } else
1586                                 conn->state = BT_CONNECT2;
1587                 }
1588         } else {
1589                 if (!conn) {
1590                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr,
1591                                             HCI_ROLE_MASTER);
1592                         if (!conn)
1593                                 BT_ERR("No memory for new connection");
1594                 }
1595         }
1596
1597         hci_dev_unlock(hdev);
1598 }
1599
1600 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1601 {
1602         struct hci_cp_add_sco *cp;
1603         struct hci_conn *acl, *sco;
1604         __u16 handle;
1605
1606         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1607
1608         if (!status)
1609                 return;
1610
1611         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1612         if (!cp)
1613                 return;
1614
1615         handle = __le16_to_cpu(cp->handle);
1616
1617         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1618
1619         hci_dev_lock(hdev);
1620
1621         acl = hci_conn_hash_lookup_handle(hdev, handle);
1622         if (acl) {
1623                 sco = acl->link;
1624                 if (sco) {
1625                         sco->state = BT_CLOSED;
1626
1627                         hci_proto_connect_cfm(sco, status);
1628                         hci_conn_del(sco);
1629                 }
1630         }
1631
1632         hci_dev_unlock(hdev);
1633 }
1634
1635 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1636 {
1637         struct hci_cp_auth_requested *cp;
1638         struct hci_conn *conn;
1639
1640         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1641
1642         if (!status)
1643                 return;
1644
1645         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1646         if (!cp)
1647                 return;
1648
1649         hci_dev_lock(hdev);
1650
1651         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1652         if (conn) {
1653                 if (conn->state == BT_CONFIG) {
1654                         hci_proto_connect_cfm(conn, status);
1655                         hci_conn_drop(conn);
1656                 }
1657         }
1658
1659         hci_dev_unlock(hdev);
1660 }
1661
1662 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1663 {
1664         struct hci_cp_set_conn_encrypt *cp;
1665         struct hci_conn *conn;
1666
1667         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1668
1669         if (!status)
1670                 return;
1671
1672         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1673         if (!cp)
1674                 return;
1675
1676         hci_dev_lock(hdev);
1677
1678         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1679         if (conn) {
1680                 if (conn->state == BT_CONFIG) {
1681                         hci_proto_connect_cfm(conn, status);
1682                         hci_conn_drop(conn);
1683                 }
1684         }
1685
1686         hci_dev_unlock(hdev);
1687 }
1688
1689 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1690                                     struct hci_conn *conn)
1691 {
1692         if (conn->state != BT_CONFIG || !conn->out)
1693                 return 0;
1694
1695         if (conn->pending_sec_level == BT_SECURITY_SDP)
1696                 return 0;
1697
1698         /* Only request authentication for SSP connections or non-SSP
1699          * devices with sec_level MEDIUM or HIGH or if MITM protection
1700          * is requested.
1701          */
1702         if (!hci_conn_ssp_enabled(conn) && !(conn->auth_type & 0x01) &&
1703             conn->pending_sec_level != BT_SECURITY_FIPS &&
1704             conn->pending_sec_level != BT_SECURITY_HIGH &&
1705             conn->pending_sec_level != BT_SECURITY_MEDIUM)
1706                 return 0;
1707
1708         return 1;
1709 }
1710
1711 static int hci_resolve_name(struct hci_dev *hdev,
1712                                    struct inquiry_entry *e)
1713 {
1714         struct hci_cp_remote_name_req cp;
1715
1716         memset(&cp, 0, sizeof(cp));
1717
1718         bacpy(&cp.bdaddr, &e->data.bdaddr);
1719         cp.pscan_rep_mode = e->data.pscan_rep_mode;
1720         cp.pscan_mode = e->data.pscan_mode;
1721         cp.clock_offset = e->data.clock_offset;
1722
1723         return hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1724 }
1725
1726 static bool hci_resolve_next_name(struct hci_dev *hdev)
1727 {
1728         struct discovery_state *discov = &hdev->discovery;
1729         struct inquiry_entry *e;
1730
1731         if (list_empty(&discov->resolve))
1732                 return false;
1733
1734         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
1735         if (!e)
1736                 return false;
1737
1738         if (hci_resolve_name(hdev, e) == 0) {
1739                 e->name_state = NAME_PENDING;
1740                 return true;
1741         }
1742
1743         return false;
1744 }
1745
1746 static void hci_check_pending_name(struct hci_dev *hdev, struct hci_conn *conn,
1747                                    bdaddr_t *bdaddr, u8 *name, u8 name_len)
1748 {
1749         struct discovery_state *discov = &hdev->discovery;
1750         struct inquiry_entry *e;
1751
1752 /* BEGIN TIZEN_Bluetooth :: name update changes */
1753 #ifdef CONFIG_TIZEN_WIP
1754         /* Update the mgmt connected state if necessary. Be careful with
1755         * conn objects that exist but are not (yet) connected however.
1756         * Only those in BT_CONFIG or BT_CONNECTED states can be
1757         * considered connected.
1758         */
1759         if (conn && (conn->state == BT_CONFIG || conn->state == BT_CONNECTED)) {
1760                 if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1761                         mgmt_device_connected(hdev, conn, 0, name, name_len);
1762                 else
1763                         mgmt_device_name_update(hdev, bdaddr, name, name_len);
1764         }
1765
1766 #else
1767         if (conn && !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
1768                 mgmt_device_connected(hdev, conn, 0, name, name_len);
1769 /* END TIZEN_Bluetooth :: name update changes */
1770 #endif
1771         if (discov->state == DISCOVERY_STOPPED)
1772                 return;
1773
1774         if (discov->state == DISCOVERY_STOPPING)
1775                 goto discov_complete;
1776
1777         if (discov->state != DISCOVERY_RESOLVING)
1778                 return;
1779
1780         e = hci_inquiry_cache_lookup_resolve(hdev, bdaddr, NAME_PENDING);
1781         /* If the device was not found in a list of found devices names of which
1782          * are pending. there is no need to continue resolving a next name as it
1783          * will be done upon receiving another Remote Name Request Complete
1784          * Event */
1785         if (!e)
1786                 return;
1787
1788         list_del(&e->list);
1789         if (name) {
1790                 e->name_state = NAME_KNOWN;
1791                 mgmt_remote_name(hdev, bdaddr, ACL_LINK, 0x00,
1792                                  e->data.rssi, name, name_len);
1793         } else {
1794                 e->name_state = NAME_NOT_KNOWN;
1795         }
1796
1797         if (hci_resolve_next_name(hdev))
1798                 return;
1799
1800 discov_complete:
1801         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1802 }
1803
1804 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1805 {
1806         struct hci_cp_remote_name_req *cp;
1807         struct hci_conn *conn;
1808
1809         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1810
1811         /* If successful wait for the name req complete event before
1812          * checking for the need to do authentication */
1813         if (!status)
1814                 return;
1815
1816         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1817         if (!cp)
1818                 return;
1819
1820         hci_dev_lock(hdev);
1821
1822         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1823
1824         if (test_bit(HCI_MGMT, &hdev->dev_flags))
1825                 hci_check_pending_name(hdev, conn, &cp->bdaddr, NULL, 0);
1826
1827         if (!conn)
1828                 goto unlock;
1829
1830         if (!hci_outgoing_auth_needed(hdev, conn))
1831                 goto unlock;
1832
1833         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
1834                 struct hci_cp_auth_requested auth_cp;
1835
1836                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
1837
1838                 auth_cp.handle = __cpu_to_le16(conn->handle);
1839                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED,
1840                              sizeof(auth_cp), &auth_cp);
1841         }
1842
1843 unlock:
1844         hci_dev_unlock(hdev);
1845 }
1846
1847 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1848 {
1849         struct hci_cp_read_remote_features *cp;
1850         struct hci_conn *conn;
1851
1852         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1853
1854         if (!status)
1855                 return;
1856
1857         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1858         if (!cp)
1859                 return;
1860
1861         hci_dev_lock(hdev);
1862
1863         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1864         if (conn) {
1865                 if (conn->state == BT_CONFIG) {
1866                         hci_proto_connect_cfm(conn, status);
1867                         hci_conn_drop(conn);
1868                 }
1869         }
1870
1871         hci_dev_unlock(hdev);
1872 }
1873
1874 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1875 {
1876         struct hci_cp_read_remote_ext_features *cp;
1877         struct hci_conn *conn;
1878
1879         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1880
1881         if (!status)
1882                 return;
1883
1884         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1885         if (!cp)
1886                 return;
1887
1888         hci_dev_lock(hdev);
1889
1890         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1891         if (conn) {
1892                 if (conn->state == BT_CONFIG) {
1893                         hci_proto_connect_cfm(conn, status);
1894                         hci_conn_drop(conn);
1895                 }
1896         }
1897
1898         hci_dev_unlock(hdev);
1899 }
1900
1901 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1902 {
1903         struct hci_cp_setup_sync_conn *cp;
1904         struct hci_conn *acl, *sco;
1905         __u16 handle;
1906
1907         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1908
1909         if (!status)
1910                 return;
1911
1912         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1913         if (!cp)
1914                 return;
1915
1916         handle = __le16_to_cpu(cp->handle);
1917
1918         BT_DBG("%s handle 0x%4.4x", hdev->name, handle);
1919
1920         hci_dev_lock(hdev);
1921
1922         acl = hci_conn_hash_lookup_handle(hdev, handle);
1923         if (acl) {
1924                 sco = acl->link;
1925                 if (sco) {
1926                         sco->state = BT_CLOSED;
1927
1928                         hci_proto_connect_cfm(sco, status);
1929                         hci_conn_del(sco);
1930                 }
1931         }
1932
1933         hci_dev_unlock(hdev);
1934 }
1935
1936 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1937 {
1938         struct hci_cp_sniff_mode *cp;
1939         struct hci_conn *conn;
1940
1941         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1942
1943         if (!status)
1944                 return;
1945
1946         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1947         if (!cp)
1948                 return;
1949
1950         hci_dev_lock(hdev);
1951
1952         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1953         if (conn) {
1954                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1955
1956                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1957                         hci_sco_setup(conn, status);
1958         }
1959
1960         hci_dev_unlock(hdev);
1961 }
1962
1963 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1964 {
1965         struct hci_cp_exit_sniff_mode *cp;
1966         struct hci_conn *conn;
1967
1968         BT_DBG("%s status 0x%2.2x", hdev->name, status);
1969
1970         if (!status)
1971                 return;
1972
1973         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1974         if (!cp)
1975                 return;
1976
1977         hci_dev_lock(hdev);
1978
1979         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1980         if (conn) {
1981                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->flags);
1982
1983                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
1984                         hci_sco_setup(conn, status);
1985         }
1986
1987         hci_dev_unlock(hdev);
1988 }
1989
1990 static void hci_cs_disconnect(struct hci_dev *hdev, u8 status)
1991 {
1992         struct hci_cp_disconnect *cp;
1993         struct hci_conn *conn;
1994
1995         if (!status)
1996                 return;
1997
1998         cp = hci_sent_cmd_data(hdev, HCI_OP_DISCONNECT);
1999         if (!cp)
2000                 return;
2001
2002         hci_dev_lock(hdev);
2003
2004         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2005         if (conn)
2006                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2007                                        conn->dst_type, status);
2008
2009         hci_dev_unlock(hdev);
2010 }
2011
2012 static void hci_cs_create_phylink(struct hci_dev *hdev, u8 status)
2013 {
2014         struct hci_cp_create_phy_link *cp;
2015
2016         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2017
2018         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_PHY_LINK);
2019         if (!cp)
2020                 return;
2021
2022         hci_dev_lock(hdev);
2023
2024         if (status) {
2025                 struct hci_conn *hcon;
2026
2027                 hcon = hci_conn_hash_lookup_handle(hdev, cp->phy_handle);
2028                 if (hcon)
2029                         hci_conn_del(hcon);
2030         } else {
2031                 amp_write_remote_assoc(hdev, cp->phy_handle);
2032         }
2033
2034         hci_dev_unlock(hdev);
2035 }
2036
2037 static void hci_cs_accept_phylink(struct hci_dev *hdev, u8 status)
2038 {
2039         struct hci_cp_accept_phy_link *cp;
2040
2041         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2042
2043         if (status)
2044                 return;
2045
2046         cp = hci_sent_cmd_data(hdev, HCI_OP_ACCEPT_PHY_LINK);
2047         if (!cp)
2048                 return;
2049
2050         amp_write_remote_assoc(hdev, cp->phy_handle);
2051 }
2052
2053 static void hci_cs_le_create_conn(struct hci_dev *hdev, u8 status)
2054 {
2055         struct hci_cp_le_create_conn *cp;
2056         struct hci_conn *conn;
2057
2058         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2059
2060         /* All connection failure handling is taken care of by the
2061          * hci_le_conn_failed function which is triggered by the HCI
2062          * request completion callbacks used for connecting.
2063          */
2064         if (status)
2065                 return;
2066
2067         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
2068         if (!cp)
2069                 return;
2070
2071         hci_dev_lock(hdev);
2072
2073         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
2074         if (!conn)
2075                 goto unlock;
2076
2077         /* Store the initiator and responder address information which
2078          * is needed for SMP. These values will not change during the
2079          * lifetime of the connection.
2080          */
2081         conn->init_addr_type = cp->own_address_type;
2082         if (cp->own_address_type == ADDR_LE_DEV_RANDOM)
2083                 bacpy(&conn->init_addr, &hdev->random_addr);
2084         else
2085                 bacpy(&conn->init_addr, &hdev->bdaddr);
2086
2087         conn->resp_addr_type = cp->peer_addr_type;
2088         bacpy(&conn->resp_addr, &cp->peer_addr);
2089
2090         /* We don't want the connection attempt to stick around
2091          * indefinitely since LE doesn't have a page timeout concept
2092          * like BR/EDR. Set a timer for any connection that doesn't use
2093          * the white list for connecting.
2094          */
2095         if (cp->filter_policy == HCI_LE_USE_PEER_ADDR)
2096                 queue_delayed_work(conn->hdev->workqueue,
2097                                    &conn->le_conn_timeout,
2098                                    conn->conn_timeout);
2099
2100 unlock:
2101         hci_dev_unlock(hdev);
2102 }
2103
2104 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
2105 {
2106         struct hci_cp_le_start_enc *cp;
2107         struct hci_conn *conn;
2108
2109         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2110
2111         if (!status)
2112                 return;
2113
2114         hci_dev_lock(hdev);
2115
2116         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_START_ENC);
2117         if (!cp)
2118                 goto unlock;
2119
2120         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
2121         if (!conn)
2122                 goto unlock;
2123
2124         if (conn->state != BT_CONNECTED)
2125                 goto unlock;
2126
2127         hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2128         hci_conn_drop(conn);
2129
2130 unlock:
2131         hci_dev_unlock(hdev);
2132 }
2133
2134 static void hci_cs_switch_role(struct hci_dev *hdev, u8 status)
2135 {
2136         struct hci_cp_switch_role *cp;
2137         struct hci_conn *conn;
2138
2139         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2140
2141         if (!status)
2142                 return;
2143
2144         cp = hci_sent_cmd_data(hdev, HCI_OP_SWITCH_ROLE);
2145         if (!cp)
2146                 return;
2147
2148         hci_dev_lock(hdev);
2149
2150         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
2151         if (conn)
2152                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
2153
2154         hci_dev_unlock(hdev);
2155 }
2156
2157 static void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2158 {
2159         __u8 status = *((__u8 *) skb->data);
2160         struct discovery_state *discov = &hdev->discovery;
2161         struct inquiry_entry *e;
2162
2163         BT_DBG("%s status 0x%2.2x", hdev->name, status);
2164
2165         hci_conn_check_pending(hdev);
2166
2167         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
2168                 return;
2169
2170 #ifdef CONFIG_TIZEN_WIP
2171         smp_mb__after_clear_bit(); /* wake_up_bit advises about this barrier */
2172 #else
2173         /* In latest kernel, smp_mb__after_clear_bit is replaced with
2174           * smp_mb__after_atomic. So, if kernel is migrated to latest,
2175           * then below code should be enabled
2176           */
2177         smp_mb__after_atomic(); /* wake_up_bit advises about this barrier */
2178 #endif
2179         wake_up_bit(&hdev->flags, HCI_INQUIRY);
2180
2181         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2182                 return;
2183
2184         hci_dev_lock(hdev);
2185
2186         if (discov->state != DISCOVERY_FINDING)
2187                 goto unlock;
2188
2189         if (list_empty(&discov->resolve)) {
2190                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2191                 goto unlock;
2192         }
2193
2194         e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, NAME_NEEDED);
2195         if (e && hci_resolve_name(hdev, e) == 0) {
2196                 e->name_state = NAME_PENDING;
2197                 hci_discovery_set_state(hdev, DISCOVERY_RESOLVING);
2198         } else {
2199                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2200         }
2201
2202 unlock:
2203         hci_dev_unlock(hdev);
2204 }
2205
2206 static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2207 {
2208         struct inquiry_data data;
2209         struct inquiry_info *info = (void *) (skb->data + 1);
2210         int num_rsp = *((__u8 *) skb->data);
2211
2212         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2213
2214         if (!num_rsp)
2215                 return;
2216
2217         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
2218                 return;
2219
2220         hci_dev_lock(hdev);
2221
2222         for (; num_rsp; num_rsp--, info++) {
2223                 u32 flags;
2224
2225                 bacpy(&data.bdaddr, &info->bdaddr);
2226                 data.pscan_rep_mode     = info->pscan_rep_mode;
2227                 data.pscan_period_mode  = info->pscan_period_mode;
2228                 data.pscan_mode         = info->pscan_mode;
2229                 memcpy(data.dev_class, info->dev_class, 3);
2230                 data.clock_offset       = info->clock_offset;
2231                 data.rssi               = HCI_RSSI_INVALID;
2232                 data.ssp_mode           = 0x00;
2233
2234                 flags = hci_inquiry_cache_update(hdev, &data, false);
2235
2236                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2237                                   info->dev_class, HCI_RSSI_INVALID,
2238                                   flags, NULL, 0, NULL, 0);
2239         }
2240
2241         hci_dev_unlock(hdev);
2242 }
2243
2244 static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2245 {
2246         struct hci_ev_conn_complete *ev = (void *) skb->data;
2247         struct hci_conn *conn;
2248
2249         BT_DBG("%s", hdev->name);
2250
2251         hci_dev_lock(hdev);
2252
2253         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2254         if (!conn) {
2255                 if (ev->link_type != SCO_LINK)
2256                         goto unlock;
2257
2258                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2259                 if (!conn)
2260                         goto unlock;
2261
2262                 conn->type = SCO_LINK;
2263         }
2264
2265         if (!ev->status) {
2266                 conn->handle = __le16_to_cpu(ev->handle);
2267
2268                 if (conn->type == ACL_LINK) {
2269                         conn->state = BT_CONFIG;
2270                         hci_conn_hold(conn);
2271
2272                         if (!conn->out && !hci_conn_ssp_enabled(conn) &&
2273                             !hci_find_link_key(hdev, &ev->bdaddr))
2274                                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2275                         else
2276                                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2277                 } else
2278                         conn->state = BT_CONNECTED;
2279
2280                 hci_debugfs_create_conn(conn);
2281                 hci_conn_add_sysfs(conn);
2282
2283                 if (test_bit(HCI_AUTH, &hdev->flags))
2284                         set_bit(HCI_CONN_AUTH, &conn->flags);
2285
2286                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
2287                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2288
2289                 /* Get remote features */
2290                 if (conn->type == ACL_LINK) {
2291                         struct hci_cp_read_remote_features cp;
2292                         cp.handle = ev->handle;
2293                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
2294                                      sizeof(cp), &cp);
2295
2296                         hci_update_page_scan(hdev);
2297                 }
2298
2299                 /* Set packet type for incoming connection */
2300                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
2301                         struct hci_cp_change_conn_ptype cp;
2302                         cp.handle = ev->handle;
2303                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
2304                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp),
2305                                      &cp);
2306                 }
2307
2308 #ifdef CONFIG_TIZEN_WIP
2309                 if ((get_link_mode(conn)) & HCI_LM_MASTER)
2310                         hci_conn_change_supervision_timeout(conn,
2311                                                 LINK_SUPERVISION_TIMEOUT);
2312         } else if (ev->status == 0x0b) {
2313                 BT_ERR("ACL connection already exists, this evt is ignored");
2314 #endif
2315         } else {
2316                 conn->state = BT_CLOSED;
2317                 if (conn->type == ACL_LINK)
2318                         mgmt_connect_failed(hdev, &conn->dst, conn->type,
2319                                             conn->dst_type, ev->status);
2320         }
2321
2322         if (conn->type == ACL_LINK)
2323                 hci_sco_setup(conn, ev->status);
2324
2325 #ifdef CONFIG_TIZEN_WIP
2326         if (ev->status && ev->status != 0x0b) {
2327 #else
2328         if (ev->status) {
2329 #endif
2330                 hci_proto_connect_cfm(conn, ev->status);
2331                 hci_conn_del(conn);
2332         } else if (ev->link_type != ACL_LINK)
2333                 hci_proto_connect_cfm(conn, ev->status);
2334
2335 unlock:
2336         hci_dev_unlock(hdev);
2337
2338         hci_conn_check_pending(hdev);
2339 }
2340
2341 static void hci_reject_conn(struct hci_dev *hdev, bdaddr_t *bdaddr)
2342 {
2343         struct hci_cp_reject_conn_req cp;
2344
2345         bacpy(&cp.bdaddr, bdaddr);
2346         cp.reason = HCI_ERROR_REJ_BAD_ADDR;
2347         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
2348 }
2349
2350 static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2351 {
2352         struct hci_ev_conn_request *ev = (void *) skb->data;
2353         int mask = hdev->link_mode;
2354         struct inquiry_entry *ie;
2355         struct hci_conn *conn;
2356         __u8 flags = 0;
2357
2358         BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
2359                ev->link_type);
2360
2361         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
2362                                       &flags);
2363
2364         if (!(mask & HCI_LM_ACCEPT)) {
2365                 hci_reject_conn(hdev, &ev->bdaddr);
2366                 return;
2367         }
2368
2369         if (hci_bdaddr_list_lookup(&hdev->blacklist, &ev->bdaddr,
2370                                    BDADDR_BREDR)) {
2371                 hci_reject_conn(hdev, &ev->bdaddr);
2372                 return;
2373         }
2374
2375         /* Require HCI_CONNECTABLE or a whitelist entry to accept the
2376          * connection. These features are only touched through mgmt so
2377          * only do the checks if HCI_MGMT is set.
2378          */
2379         if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2380             !test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
2381             !hci_bdaddr_list_lookup(&hdev->whitelist, &ev->bdaddr,
2382                                     BDADDR_BREDR)) {
2383                     hci_reject_conn(hdev, &ev->bdaddr);
2384                     return;
2385         }
2386
2387         /* Connection accepted */
2388
2389         hci_dev_lock(hdev);
2390
2391         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2392         if (ie)
2393                 memcpy(ie->data.dev_class, ev->dev_class, 3);
2394
2395 #ifdef CONFIG_TIZEN_WIP
2396                 if ((ev->link_type == SCO_LINK || ev->link_type == ESCO_LINK) &&
2397                      hci_conn_hash_lookup_sco(hdev)) {
2398                         struct hci_cp_reject_conn_req cp;
2399
2400                         bacpy(&cp.bdaddr, &ev->bdaddr);
2401                         cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2402                         hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ,
2403                                      sizeof(cp), &cp);
2404                         hci_dev_unlock(hdev);
2405                         return;
2406                 }
2407 #endif
2408         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type,
2409                         &ev->bdaddr);
2410         if (!conn) {
2411                 conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr,
2412                                     HCI_ROLE_SLAVE);
2413                 if (!conn) {
2414                         BT_ERR("No memory for new connection");
2415                         hci_dev_unlock(hdev);
2416                         return;
2417                 }
2418         }
2419
2420         memcpy(conn->dev_class, ev->dev_class, 3);
2421
2422         hci_dev_unlock(hdev);
2423
2424         if (ev->link_type == ACL_LINK ||
2425             (!(flags & HCI_PROTO_DEFER) && !lmp_esco_capable(hdev))) {
2426                 struct hci_cp_accept_conn_req cp;
2427                 conn->state = BT_CONNECT;
2428
2429                 bacpy(&cp.bdaddr, &ev->bdaddr);
2430
2431                 if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
2432                         cp.role = 0x00; /* Become master */
2433                 else
2434                         cp.role = 0x01; /* Remain slave */
2435
2436                 hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ, sizeof(cp), &cp);
2437         } else if (!(flags & HCI_PROTO_DEFER)) {
2438                 struct hci_cp_accept_sync_conn_req cp;
2439                 conn->state = BT_CONNECT;
2440
2441                 bacpy(&cp.bdaddr, &ev->bdaddr);
2442                 cp.pkt_type = cpu_to_le16(conn->pkt_type);
2443
2444                 cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
2445                 cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
2446                 cp.max_latency    = cpu_to_le16(0xffff);
2447                 cp.content_format = cpu_to_le16(hdev->voice_setting);
2448                 cp.retrans_effort = 0xff;
2449
2450                 hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ, sizeof(cp),
2451                              &cp);
2452         } else {
2453                 conn->state = BT_CONNECT2;
2454                 hci_proto_connect_cfm(conn, 0);
2455         }
2456 }
2457
2458 static u8 hci_to_mgmt_reason(u8 err)
2459 {
2460         switch (err) {
2461         case HCI_ERROR_CONNECTION_TIMEOUT:
2462                 return MGMT_DEV_DISCONN_TIMEOUT;
2463         case HCI_ERROR_REMOTE_USER_TERM:
2464         case HCI_ERROR_REMOTE_LOW_RESOURCES:
2465         case HCI_ERROR_REMOTE_POWER_OFF:
2466                 return MGMT_DEV_DISCONN_REMOTE;
2467         case HCI_ERROR_LOCAL_HOST_TERM:
2468                 return MGMT_DEV_DISCONN_LOCAL_HOST;
2469         default:
2470                 return MGMT_DEV_DISCONN_UNKNOWN;
2471         }
2472 }
2473
2474 static void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2475 {
2476         struct hci_ev_disconn_complete *ev = (void *) skb->data;
2477         u8 reason = hci_to_mgmt_reason(ev->reason);
2478         struct hci_conn_params *params;
2479         struct hci_conn *conn;
2480         bool mgmt_connected;
2481         u8 type;
2482
2483         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2484
2485         hci_dev_lock(hdev);
2486
2487         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2488         if (!conn)
2489                 goto unlock;
2490
2491         if (ev->status) {
2492                 mgmt_disconnect_failed(hdev, &conn->dst, conn->type,
2493                                        conn->dst_type, ev->status);
2494                 goto unlock;
2495         }
2496
2497         conn->state = BT_CLOSED;
2498
2499         mgmt_connected = test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags);
2500         mgmt_device_disconnected(hdev, &conn->dst, conn->type, conn->dst_type,
2501                                 reason, mgmt_connected);
2502
2503         if (conn->type == ACL_LINK) {
2504                 if (test_bit(HCI_CONN_FLUSH_KEY, &conn->flags))
2505                         hci_remove_link_key(hdev, &conn->dst);
2506
2507                 hci_update_page_scan(hdev);
2508         }
2509
2510         params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
2511         if (params) {
2512                 switch (params->auto_connect) {
2513                 case HCI_AUTO_CONN_LINK_LOSS:
2514                         if (ev->reason != HCI_ERROR_CONNECTION_TIMEOUT)
2515                                 break;
2516                         /* Fall through */
2517
2518                 case HCI_AUTO_CONN_DIRECT:
2519                 case HCI_AUTO_CONN_ALWAYS:
2520                         list_del_init(&params->action);
2521                         list_add(&params->action, &hdev->pend_le_conns);
2522                         hci_update_background_scan(hdev);
2523                         break;
2524
2525                 default:
2526                         break;
2527                 }
2528         }
2529
2530         type = conn->type;
2531
2532         hci_proto_disconn_cfm(conn, ev->reason);
2533         hci_conn_del(conn);
2534
2535         /* Re-enable advertising if necessary, since it might
2536          * have been disabled by the connection. From the
2537          * HCI_LE_Set_Advertise_Enable command description in
2538          * the core specification (v4.0):
2539          * "The Controller shall continue advertising until the Host
2540          * issues an LE_Set_Advertise_Enable command with
2541          * Advertising_Enable set to 0x00 (Advertising is disabled)
2542          * or until a connection is created or until the Advertising
2543          * is timed out due to Directed Advertising."
2544          */
2545         if (type == LE_LINK)
2546                 mgmt_reenable_advertising(hdev);
2547
2548 #ifdef CONFIG_TIZEN_WIP
2549         if (type == ACL_LINK && !hci_conn_num(hdev, ACL_LINK)) {
2550                 int iscan;
2551                 int pscan;
2552
2553                 iscan = test_bit(HCI_ISCAN, &hdev->flags);
2554                 pscan = test_bit(HCI_PSCAN, &hdev->flags);
2555                 if (!iscan && !pscan) {
2556                         u8 scan_enable = SCAN_PAGE;
2557
2558                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE,
2559                                         sizeof(scan_enable), &scan_enable);
2560                 }
2561         }
2562 #endif
2563
2564 unlock:
2565         hci_dev_unlock(hdev);
2566 }
2567
2568 static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2569 {
2570         struct hci_ev_auth_complete *ev = (void *) skb->data;
2571         struct hci_conn *conn;
2572
2573         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2574
2575         hci_dev_lock(hdev);
2576
2577         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2578         if (!conn)
2579                 goto unlock;
2580
2581 #ifdef CONFIG_TIZEN_WIP /*  PIN or Key Missing patch */
2582         BT_DBG("remote_auth %x, remote_cap %x, auth_type %x, io_capability %x",
2583                conn->remote_auth, conn->remote_cap,
2584                conn->auth_type, conn->io_capability);
2585
2586         if (ev->status == 0x06) {
2587                 struct hci_cp_auth_requested cp;
2588                 BT_DBG("Pin or key missing");
2589                 hci_remove_link_key(hdev, &conn->dst);
2590                 cp.handle = cpu_to_le16(conn->handle);
2591                 hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp),
2592                                                          &cp);
2593                 goto unlock;
2594         }
2595 #endif
2596         if (!ev->status) {
2597                 if (!hci_conn_ssp_enabled(conn) &&
2598                     test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
2599                         BT_INFO("re-auth of legacy device is not possible.");
2600                 } else {
2601                         set_bit(HCI_CONN_AUTH, &conn->flags);
2602                         conn->sec_level = conn->pending_sec_level;
2603                 }
2604         } else {
2605                 mgmt_auth_failed(conn, ev->status);
2606         }
2607
2608         clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2609         clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
2610
2611         if (conn->state == BT_CONFIG) {
2612                 if (!ev->status && hci_conn_ssp_enabled(conn)) {
2613                         struct hci_cp_set_conn_encrypt cp;
2614                         cp.handle  = ev->handle;
2615                         cp.encrypt = 0x01;
2616                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2617                                      &cp);
2618                 } else {
2619                         conn->state = BT_CONNECTED;
2620                         hci_proto_connect_cfm(conn, ev->status);
2621                         hci_conn_drop(conn);
2622                 }
2623         } else {
2624                 hci_auth_cfm(conn, ev->status);
2625
2626                 hci_conn_hold(conn);
2627                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2628                 hci_conn_drop(conn);
2629         }
2630
2631         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags)) {
2632                 if (!ev->status) {
2633                         struct hci_cp_set_conn_encrypt cp;
2634                         cp.handle  = ev->handle;
2635                         cp.encrypt = 0x01;
2636                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
2637                                      &cp);
2638                 } else {
2639                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2640                         hci_encrypt_cfm(conn, ev->status, 0x00);
2641                 }
2642         }
2643
2644 unlock:
2645         hci_dev_unlock(hdev);
2646 }
2647
2648 static void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
2649 {
2650         struct hci_ev_remote_name *ev = (void *) skb->data;
2651         struct hci_conn *conn;
2652
2653         BT_DBG("%s", hdev->name);
2654
2655         hci_conn_check_pending(hdev);
2656
2657         hci_dev_lock(hdev);
2658
2659         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2660
2661         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2662                 goto check_auth;
2663
2664         if (ev->status == 0)
2665                 hci_check_pending_name(hdev, conn, &ev->bdaddr, ev->name,
2666                                        strnlen(ev->name, HCI_MAX_NAME_LENGTH));
2667         else
2668                 hci_check_pending_name(hdev, conn, &ev->bdaddr, NULL, 0);
2669
2670 check_auth:
2671         if (!conn)
2672                 goto unlock;
2673
2674         if (!hci_outgoing_auth_needed(hdev, conn))
2675                 goto unlock;
2676
2677         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
2678                 struct hci_cp_auth_requested cp;
2679
2680                 set_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags);
2681
2682                 cp.handle = __cpu_to_le16(conn->handle);
2683                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
2684         }
2685
2686 unlock:
2687         hci_dev_unlock(hdev);
2688 }
2689
2690 static void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2691 {
2692         struct hci_ev_encrypt_change *ev = (void *) skb->data;
2693         struct hci_conn *conn;
2694
2695         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2696
2697         hci_dev_lock(hdev);
2698
2699         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2700         if (!conn)
2701                 goto unlock;
2702
2703         if (!ev->status) {
2704                 if (ev->encrypt) {
2705                         /* Encryption implies authentication */
2706                         set_bit(HCI_CONN_AUTH, &conn->flags);
2707                         set_bit(HCI_CONN_ENCRYPT, &conn->flags);
2708                         conn->sec_level = conn->pending_sec_level;
2709
2710 /* Disable Secure connection implementation now */
2711 #ifdef CONFIG_TIZEN_WIP
2712                         /* P-256 authentication key implies FIPS */
2713                         if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256)
2714                                 set_bit(HCI_CONN_FIPS, &conn->flags);
2715
2716                         if ((conn->type == ACL_LINK && ev->encrypt == 0x02) ||
2717                             conn->type == LE_LINK)
2718                                 set_bit(HCI_CONN_AES_CCM, &conn->flags);
2719 #endif
2720                 } else {
2721                         clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
2722 /* Disable Secure connection implementation now */
2723 #ifdef CONFIG_TIZEN_WIP
2724                         clear_bit(HCI_CONN_AES_CCM, &conn->flags);
2725 #endif
2726                 }
2727         }
2728
2729         /* We should disregard the current RPA and generate a new one
2730          * whenever the encryption procedure fails.
2731          */
2732         if (ev->status && conn->type == LE_LINK)
2733                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2734
2735         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
2736
2737         if (ev->status && conn->state == BT_CONNECTED) {
2738                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
2739                 hci_conn_drop(conn);
2740                 goto unlock;
2741         }
2742
2743         if (conn->state == BT_CONFIG) {
2744                 if (!ev->status)
2745                         conn->state = BT_CONNECTED;
2746
2747 /* Disable Secure connection implementation now */
2748 #ifdef CONFIG_TIZEN_WIP
2749                 /* In Secure Connections Only mode, do not allow any
2750                  * connections that are not encrypted with AES-CCM
2751                  * using a P-256 authenticated combination key.
2752                  */
2753                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
2754                     (!test_bit(HCI_CONN_AES_CCM, &conn->flags) ||
2755                      conn->key_type != HCI_LK_AUTH_COMBINATION_P256)) {
2756                         hci_proto_connect_cfm(conn, HCI_ERROR_AUTH_FAILURE);
2757                         hci_conn_drop(conn);
2758                         goto unlock;
2759                 }
2760 #endif
2761                 hci_proto_connect_cfm(conn, ev->status);
2762                 hci_conn_drop(conn);
2763         } else
2764                 hci_encrypt_cfm(conn, ev->status, ev->encrypt);
2765
2766 unlock:
2767         hci_dev_unlock(hdev);
2768 }
2769
2770 static void hci_change_link_key_complete_evt(struct hci_dev *hdev,
2771                                              struct sk_buff *skb)
2772 {
2773         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
2774         struct hci_conn *conn;
2775
2776         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2777
2778         hci_dev_lock(hdev);
2779
2780         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2781         if (conn) {
2782                 if (!ev->status)
2783                         set_bit(HCI_CONN_SECURE, &conn->flags);
2784
2785                 clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
2786
2787                 hci_key_change_cfm(conn, ev->status);
2788         }
2789
2790         hci_dev_unlock(hdev);
2791 }
2792
2793 static void hci_remote_features_evt(struct hci_dev *hdev,
2794                                     struct sk_buff *skb)
2795 {
2796         struct hci_ev_remote_features *ev = (void *) skb->data;
2797         struct hci_conn *conn;
2798
2799         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
2800
2801         hci_dev_lock(hdev);
2802
2803         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2804         if (!conn)
2805                 goto unlock;
2806
2807         if (!ev->status)
2808                 memcpy(conn->features[0], ev->features, 8);
2809
2810         if (conn->state != BT_CONFIG)
2811                 goto unlock;
2812
2813         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
2814                 struct hci_cp_read_remote_ext_features cp;
2815                 cp.handle = ev->handle;
2816                 cp.page = 0x01;
2817                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
2818                              sizeof(cp), &cp);
2819                 goto unlock;
2820         }
2821
2822 #ifdef CONFIG_SPRD_2331
2823         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2824                 struct hci_cp_change_conn_ptype cp;
2825                 memset(&cp, 0, sizeof(cp));
2826                 cp.pkt_type = (HCI_DM1|HCI_DH1);
2827                 if (conn->features[0][0] & LMP_3SLOT)
2828                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
2829
2830                 if (conn->features[0][0] & LMP_5SLOT)
2831                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
2832
2833                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
2834                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
2835                 } else {
2836                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2837                                 cp.pkt_type |= HCI_2DH3;
2838
2839                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2840                                 cp.pkt_type |= HCI_2DH5;
2841                 }
2842
2843                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
2844                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
2845                 } else {
2846                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
2847                                 cp.pkt_type |= HCI_3DH3;
2848
2849                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
2850                                 cp.pkt_type |= HCI_3DH5;
2851                 }
2852
2853                 cp.handle = ev->handle;
2854                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
2855         }
2856 #endif
2857
2858         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
2859                 struct hci_cp_remote_name_req cp;
2860                 memset(&cp, 0, sizeof(cp));
2861                 bacpy(&cp.bdaddr, &conn->dst);
2862                 cp.pscan_rep_mode = 0x02;
2863                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2864         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2865                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
2866
2867         if (!hci_outgoing_auth_needed(hdev, conn)) {
2868                 conn->state = BT_CONNECTED;
2869                 hci_proto_connect_cfm(conn, ev->status);
2870                 hci_conn_drop(conn);
2871         }
2872
2873 unlock:
2874         hci_dev_unlock(hdev);
2875 }
2876
2877 static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2878 {
2879         struct hci_ev_cmd_complete *ev = (void *) skb->data;
2880         u8 status = skb->data[sizeof(*ev)];
2881         __u16 opcode;
2882
2883         skb_pull(skb, sizeof(*ev));
2884
2885         opcode = __le16_to_cpu(ev->opcode);
2886
2887         switch (opcode) {
2888         case HCI_OP_INQUIRY_CANCEL:
2889                 hci_cc_inquiry_cancel(hdev, skb);
2890                 break;
2891
2892         case HCI_OP_PERIODIC_INQ:
2893                 hci_cc_periodic_inq(hdev, skb);
2894                 break;
2895
2896         case HCI_OP_EXIT_PERIODIC_INQ:
2897                 hci_cc_exit_periodic_inq(hdev, skb);
2898                 break;
2899
2900         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
2901                 hci_cc_remote_name_req_cancel(hdev, skb);
2902                 break;
2903
2904         case HCI_OP_ROLE_DISCOVERY:
2905                 hci_cc_role_discovery(hdev, skb);
2906                 break;
2907
2908         case HCI_OP_READ_LINK_POLICY:
2909                 hci_cc_read_link_policy(hdev, skb);
2910                 break;
2911
2912         case HCI_OP_WRITE_LINK_POLICY:
2913                 hci_cc_write_link_policy(hdev, skb);
2914                 break;
2915
2916         case HCI_OP_READ_DEF_LINK_POLICY:
2917                 hci_cc_read_def_link_policy(hdev, skb);
2918                 break;
2919
2920         case HCI_OP_WRITE_DEF_LINK_POLICY:
2921                 hci_cc_write_def_link_policy(hdev, skb);
2922                 break;
2923
2924         case HCI_OP_RESET:
2925                 hci_cc_reset(hdev, skb);
2926                 break;
2927
2928         case HCI_OP_READ_STORED_LINK_KEY:
2929                 hci_cc_read_stored_link_key(hdev, skb);
2930                 break;
2931
2932         case HCI_OP_DELETE_STORED_LINK_KEY:
2933                 hci_cc_delete_stored_link_key(hdev, skb);
2934                 break;
2935
2936         case HCI_OP_WRITE_LOCAL_NAME:
2937                 hci_cc_write_local_name(hdev, skb);
2938                 break;
2939
2940         case HCI_OP_READ_LOCAL_NAME:
2941                 hci_cc_read_local_name(hdev, skb);
2942                 break;
2943
2944         case HCI_OP_WRITE_AUTH_ENABLE:
2945                 hci_cc_write_auth_enable(hdev, skb);
2946                 break;
2947
2948         case HCI_OP_WRITE_ENCRYPT_MODE:
2949                 hci_cc_write_encrypt_mode(hdev, skb);
2950                 break;
2951
2952         case HCI_OP_WRITE_SCAN_ENABLE:
2953                 hci_cc_write_scan_enable(hdev, skb);
2954                 break;
2955
2956         case HCI_OP_READ_CLASS_OF_DEV:
2957                 hci_cc_read_class_of_dev(hdev, skb);
2958                 break;
2959
2960         case HCI_OP_WRITE_CLASS_OF_DEV:
2961                 hci_cc_write_class_of_dev(hdev, skb);
2962                 break;
2963
2964         case HCI_OP_READ_VOICE_SETTING:
2965                 hci_cc_read_voice_setting(hdev, skb);
2966                 break;
2967
2968         case HCI_OP_WRITE_VOICE_SETTING:
2969                 hci_cc_write_voice_setting(hdev, skb);
2970                 break;
2971
2972         case HCI_OP_READ_NUM_SUPPORTED_IAC:
2973                 hci_cc_read_num_supported_iac(hdev, skb);
2974                 break;
2975
2976         case HCI_OP_WRITE_SSP_MODE:
2977                 hci_cc_write_ssp_mode(hdev, skb);
2978                 break;
2979
2980         case HCI_OP_WRITE_SC_SUPPORT:
2981                 hci_cc_write_sc_support(hdev, skb);
2982                 break;
2983
2984         case HCI_OP_READ_LOCAL_VERSION:
2985                 hci_cc_read_local_version(hdev, skb);
2986                 break;
2987
2988         case HCI_OP_READ_LOCAL_COMMANDS:
2989                 hci_cc_read_local_commands(hdev, skb);
2990                 break;
2991
2992         case HCI_OP_READ_LOCAL_FEATURES:
2993                 hci_cc_read_local_features(hdev, skb);
2994                 break;
2995
2996         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2997                 hci_cc_read_local_ext_features(hdev, skb);
2998                 break;
2999
3000         case HCI_OP_READ_BUFFER_SIZE:
3001                 hci_cc_read_buffer_size(hdev, skb);
3002                 break;
3003
3004         case HCI_OP_READ_BD_ADDR:
3005                 hci_cc_read_bd_addr(hdev, skb);
3006                 break;
3007
3008         case HCI_OP_READ_PAGE_SCAN_ACTIVITY:
3009                 hci_cc_read_page_scan_activity(hdev, skb);
3010                 break;
3011
3012         case HCI_OP_WRITE_PAGE_SCAN_ACTIVITY:
3013                 hci_cc_write_page_scan_activity(hdev, skb);
3014                 break;
3015
3016         case HCI_OP_READ_PAGE_SCAN_TYPE:
3017                 hci_cc_read_page_scan_type(hdev, skb);
3018                 break;
3019
3020         case HCI_OP_WRITE_PAGE_SCAN_TYPE:
3021                 hci_cc_write_page_scan_type(hdev, skb);
3022                 break;
3023
3024         case HCI_OP_READ_DATA_BLOCK_SIZE:
3025                 hci_cc_read_data_block_size(hdev, skb);
3026                 break;
3027
3028         case HCI_OP_READ_FLOW_CONTROL_MODE:
3029                 hci_cc_read_flow_control_mode(hdev, skb);
3030                 break;
3031
3032         case HCI_OP_READ_LOCAL_AMP_INFO:
3033                 hci_cc_read_local_amp_info(hdev, skb);
3034                 break;
3035
3036         case HCI_OP_READ_CLOCK:
3037                 hci_cc_read_clock(hdev, skb);
3038                 break;
3039
3040         case HCI_OP_READ_LOCAL_AMP_ASSOC:
3041                 hci_cc_read_local_amp_assoc(hdev, skb);
3042                 break;
3043
3044         case HCI_OP_READ_INQ_RSP_TX_POWER:
3045                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
3046                 break;
3047
3048         case HCI_OP_PIN_CODE_REPLY:
3049                 hci_cc_pin_code_reply(hdev, skb);
3050                 break;
3051
3052         case HCI_OP_PIN_CODE_NEG_REPLY:
3053                 hci_cc_pin_code_neg_reply(hdev, skb);
3054                 break;
3055
3056         case HCI_OP_READ_LOCAL_OOB_DATA:
3057                 hci_cc_read_local_oob_data(hdev, skb);
3058                 break;
3059
3060         case HCI_OP_READ_LOCAL_OOB_EXT_DATA:
3061                 hci_cc_read_local_oob_ext_data(hdev, skb);
3062                 break;
3063
3064         case HCI_OP_LE_READ_BUFFER_SIZE:
3065                 hci_cc_le_read_buffer_size(hdev, skb);
3066                 break;
3067
3068         case HCI_OP_LE_READ_LOCAL_FEATURES:
3069                 hci_cc_le_read_local_features(hdev, skb);
3070                 break;
3071
3072         case HCI_OP_LE_READ_ADV_TX_POWER:
3073                 hci_cc_le_read_adv_tx_power(hdev, skb);
3074                 break;
3075
3076         case HCI_OP_USER_CONFIRM_REPLY:
3077                 hci_cc_user_confirm_reply(hdev, skb);
3078                 break;
3079
3080         case HCI_OP_USER_CONFIRM_NEG_REPLY:
3081                 hci_cc_user_confirm_neg_reply(hdev, skb);
3082                 break;
3083
3084         case HCI_OP_USER_PASSKEY_REPLY:
3085                 hci_cc_user_passkey_reply(hdev, skb);
3086                 break;
3087
3088         case HCI_OP_USER_PASSKEY_NEG_REPLY:
3089                 hci_cc_user_passkey_neg_reply(hdev, skb);
3090                 break;
3091
3092         case HCI_OP_LE_SET_RANDOM_ADDR:
3093                 hci_cc_le_set_random_addr(hdev, skb);
3094                 break;
3095
3096         case HCI_OP_LE_SET_ADV_ENABLE:
3097                 hci_cc_le_set_adv_enable(hdev, skb);
3098                 break;
3099
3100         case HCI_OP_LE_SET_SCAN_PARAM:
3101                 hci_cc_le_set_scan_param(hdev, skb);
3102                 break;
3103
3104         case HCI_OP_LE_SET_SCAN_ENABLE:
3105                 hci_cc_le_set_scan_enable(hdev, skb);
3106                 break;
3107
3108         case HCI_OP_LE_READ_WHITE_LIST_SIZE:
3109                 hci_cc_le_read_white_list_size(hdev, skb);
3110                 break;
3111
3112         case HCI_OP_LE_CLEAR_WHITE_LIST:
3113                 hci_cc_le_clear_white_list(hdev, skb);
3114                 break;
3115
3116         case HCI_OP_LE_ADD_TO_WHITE_LIST:
3117                 hci_cc_le_add_to_white_list(hdev, skb);
3118                 break;
3119
3120         case HCI_OP_LE_DEL_FROM_WHITE_LIST:
3121                 hci_cc_le_del_from_white_list(hdev, skb);
3122                 break;
3123
3124         case HCI_OP_LE_READ_SUPPORTED_STATES:
3125                 hci_cc_le_read_supported_states(hdev, skb);
3126                 break;
3127
3128         case HCI_OP_LE_READ_DEF_DATA_LEN:
3129                 hci_cc_le_read_def_data_len(hdev, skb);
3130                 break;
3131
3132         case HCI_OP_LE_WRITE_DEF_DATA_LEN:
3133                 hci_cc_le_write_def_data_len(hdev, skb);
3134                 break;
3135
3136         case HCI_OP_LE_READ_MAX_DATA_LEN:
3137                 hci_cc_le_read_max_data_len(hdev, skb);
3138                 break;
3139
3140         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
3141                 hci_cc_write_le_host_supported(hdev, skb);
3142                 break;
3143
3144         case HCI_OP_LE_SET_ADV_PARAM:
3145                 hci_cc_set_adv_param(hdev, skb);
3146                 break;
3147
3148         case HCI_OP_WRITE_REMOTE_AMP_ASSOC:
3149                 hci_cc_write_remote_amp_assoc(hdev, skb);
3150                 break;
3151
3152         case HCI_OP_READ_RSSI:
3153                 hci_cc_read_rssi(hdev, skb);
3154                 break;
3155
3156         case HCI_OP_READ_TX_POWER:
3157                 hci_cc_read_tx_power(hdev, skb);
3158                 break;
3159 #ifdef CONFIG_TIZEN_WIP
3160         case HCI_OP_ENABLE_RSSI:
3161                 hci_cc_enable_rssi(hdev, skb);
3162                 break;
3163
3164         case HCI_OP_GET_RAW_RSSI:
3165                 hci_cc_get_raw_rssi(hdev, skb);
3166                 break;
3167 #endif
3168         default:
3169                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3170                 break;
3171         }
3172
3173         if (opcode != HCI_OP_NOP)
3174                 cancel_delayed_work(&hdev->cmd_timer);
3175
3176         hci_req_cmd_complete(hdev, opcode, status);
3177
3178         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3179                 atomic_set(&hdev->cmd_cnt, 1);
3180                 if (!skb_queue_empty(&hdev->cmd_q))
3181                         queue_work(hdev->workqueue, &hdev->cmd_work);
3182         }
3183 }
3184
3185 static void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
3186 {
3187         struct hci_ev_cmd_status *ev = (void *) skb->data;
3188         __u16 opcode;
3189
3190         skb_pull(skb, sizeof(*ev));
3191
3192         opcode = __le16_to_cpu(ev->opcode);
3193
3194         switch (opcode) {
3195         case HCI_OP_INQUIRY:
3196                 hci_cs_inquiry(hdev, ev->status);
3197                 break;
3198
3199         case HCI_OP_CREATE_CONN:
3200                 hci_cs_create_conn(hdev, ev->status);
3201                 break;
3202
3203         case HCI_OP_DISCONNECT:
3204                 hci_cs_disconnect(hdev, ev->status);
3205                 break;
3206
3207         case HCI_OP_ADD_SCO:
3208                 hci_cs_add_sco(hdev, ev->status);
3209                 break;
3210
3211         case HCI_OP_AUTH_REQUESTED:
3212                 hci_cs_auth_requested(hdev, ev->status);
3213                 break;
3214
3215         case HCI_OP_SET_CONN_ENCRYPT:
3216                 hci_cs_set_conn_encrypt(hdev, ev->status);
3217                 break;
3218
3219         case HCI_OP_REMOTE_NAME_REQ:
3220                 hci_cs_remote_name_req(hdev, ev->status);
3221                 break;
3222
3223         case HCI_OP_READ_REMOTE_FEATURES:
3224                 hci_cs_read_remote_features(hdev, ev->status);
3225                 break;
3226
3227         case HCI_OP_READ_REMOTE_EXT_FEATURES:
3228                 hci_cs_read_remote_ext_features(hdev, ev->status);
3229                 break;
3230
3231         case HCI_OP_SETUP_SYNC_CONN:
3232                 hci_cs_setup_sync_conn(hdev, ev->status);
3233                 break;
3234
3235         case HCI_OP_CREATE_PHY_LINK:
3236                 hci_cs_create_phylink(hdev, ev->status);
3237                 break;
3238
3239         case HCI_OP_ACCEPT_PHY_LINK:
3240                 hci_cs_accept_phylink(hdev, ev->status);
3241                 break;
3242
3243         case HCI_OP_SNIFF_MODE:
3244                 hci_cs_sniff_mode(hdev, ev->status);
3245                 break;
3246
3247         case HCI_OP_EXIT_SNIFF_MODE:
3248                 hci_cs_exit_sniff_mode(hdev, ev->status);
3249                 break;
3250
3251         case HCI_OP_SWITCH_ROLE:
3252                 hci_cs_switch_role(hdev, ev->status);
3253                 break;
3254
3255         case HCI_OP_LE_CREATE_CONN:
3256                 hci_cs_le_create_conn(hdev, ev->status);
3257                 break;
3258
3259         case HCI_OP_LE_START_ENC:
3260                 hci_cs_le_start_enc(hdev, ev->status);
3261                 break;
3262
3263         default:
3264                 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3265                 break;
3266         }
3267
3268         if (opcode != HCI_OP_NOP)
3269                 cancel_delayed_work(&hdev->cmd_timer);
3270
3271         if (ev->status ||
3272             (hdev->sent_cmd && !bt_cb(hdev->sent_cmd)->req.event))
3273                 hci_req_cmd_complete(hdev, opcode, ev->status);
3274
3275         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
3276                 atomic_set(&hdev->cmd_cnt, 1);
3277                 if (!skb_queue_empty(&hdev->cmd_q))
3278                         queue_work(hdev->workqueue, &hdev->cmd_work);
3279         }
3280 }
3281
3282 static void hci_hardware_error_evt(struct hci_dev *hdev, struct sk_buff *skb)
3283 {
3284         struct hci_ev_hardware_error *ev = (void *) skb->data;
3285
3286         BT_ERR("%s hardware error 0x%2.2x", hdev->name, ev->code);
3287 #ifdef CONFIG_TIZEN_WIP
3288         hci_dev_lock(hdev);
3289         mgmt_hardware_error(hdev, ev->code);
3290         hci_dev_unlock(hdev);
3291 #endif
3292 }
3293
3294 static void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3295 {
3296         struct hci_ev_role_change *ev = (void *) skb->data;
3297         struct hci_conn *conn;
3298
3299         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3300
3301         hci_dev_lock(hdev);
3302
3303         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3304         if (conn) {
3305                 if (!ev->status)
3306                         conn->role = ev->role;
3307
3308                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->flags);
3309
3310                 hci_role_switch_cfm(conn, ev->status, ev->role);
3311
3312 #ifdef CONFIG_TIZEN_WIP
3313                 if (!ev->status && (get_link_mode(conn)) & HCI_LM_MASTER)
3314                         hci_conn_change_supervision_timeout(conn,
3315                                                 LINK_SUPERVISION_TIMEOUT);
3316 #endif
3317         }
3318
3319         hci_dev_unlock(hdev);
3320 }
3321
3322 static void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
3323 {
3324         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
3325         int i;
3326
3327         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
3328                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3329                 return;
3330         }
3331
3332         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3333             ev->num_hndl * sizeof(struct hci_comp_pkts_info)) {
3334                 BT_DBG("%s bad parameters", hdev->name);
3335                 return;
3336         }
3337
3338         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
3339
3340         for (i = 0; i < ev->num_hndl; i++) {
3341                 struct hci_comp_pkts_info *info = &ev->handles[i];
3342                 struct hci_conn *conn;
3343                 __u16  handle, count;
3344
3345                 handle = __le16_to_cpu(info->handle);
3346                 count  = __le16_to_cpu(info->count);
3347
3348                 conn = hci_conn_hash_lookup_handle(hdev, handle);
3349                 if (!conn)
3350                         continue;
3351
3352                 conn->sent -= count;
3353
3354                 switch (conn->type) {
3355                 case ACL_LINK:
3356                         hdev->acl_cnt += count;
3357                         if (hdev->acl_cnt > hdev->acl_pkts)
3358                                 hdev->acl_cnt = hdev->acl_pkts;
3359                         break;
3360
3361                 case LE_LINK:
3362                         if (hdev->le_pkts) {
3363                                 hdev->le_cnt += count;
3364                                 if (hdev->le_cnt > hdev->le_pkts)
3365                                         hdev->le_cnt = hdev->le_pkts;
3366                         } else {
3367                                 hdev->acl_cnt += count;
3368                                 if (hdev->acl_cnt > hdev->acl_pkts)
3369                                         hdev->acl_cnt = hdev->acl_pkts;
3370                         }
3371                         break;
3372
3373                 case SCO_LINK:
3374                         hdev->sco_cnt += count;
3375                         if (hdev->sco_cnt > hdev->sco_pkts)
3376                                 hdev->sco_cnt = hdev->sco_pkts;
3377                         break;
3378
3379                 default:
3380                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3381                         break;
3382                 }
3383         }
3384
3385         queue_work(hdev->workqueue, &hdev->tx_work);
3386 }
3387
3388 static struct hci_conn *__hci_conn_lookup_handle(struct hci_dev *hdev,
3389                                                  __u16 handle)
3390 {
3391         struct hci_chan *chan;
3392
3393         switch (hdev->dev_type) {
3394         case HCI_BREDR:
3395                 return hci_conn_hash_lookup_handle(hdev, handle);
3396         case HCI_AMP:
3397                 chan = hci_chan_lookup_handle(hdev, handle);
3398                 if (chan)
3399                         return chan->conn;
3400                 break;
3401         default:
3402                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3403                 break;
3404         }
3405
3406         return NULL;
3407 }
3408
3409 static void hci_num_comp_blocks_evt(struct hci_dev *hdev, struct sk_buff *skb)
3410 {
3411         struct hci_ev_num_comp_blocks *ev = (void *) skb->data;
3412         int i;
3413
3414         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_BLOCK_BASED) {
3415                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
3416                 return;
3417         }
3418
3419         if (skb->len < sizeof(*ev) || skb->len < sizeof(*ev) +
3420             ev->num_hndl * sizeof(struct hci_comp_blocks_info)) {
3421                 BT_DBG("%s bad parameters", hdev->name);
3422                 return;
3423         }
3424
3425         BT_DBG("%s num_blocks %d num_hndl %d", hdev->name, ev->num_blocks,
3426                ev->num_hndl);
3427
3428         for (i = 0; i < ev->num_hndl; i++) {
3429                 struct hci_comp_blocks_info *info = &ev->handles[i];
3430                 struct hci_conn *conn = NULL;
3431                 __u16  handle, block_count;
3432
3433                 handle = __le16_to_cpu(info->handle);
3434                 block_count = __le16_to_cpu(info->blocks);
3435
3436                 conn = __hci_conn_lookup_handle(hdev, handle);
3437                 if (!conn)
3438                         continue;
3439
3440                 conn->sent -= block_count;
3441
3442                 switch (conn->type) {
3443                 case ACL_LINK:
3444                 case AMP_LINK:
3445                         hdev->block_cnt += block_count;
3446                         if (hdev->block_cnt > hdev->num_blocks)
3447                                 hdev->block_cnt = hdev->num_blocks;
3448                         break;
3449
3450                 default:
3451                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
3452                         break;
3453                 }
3454         }
3455
3456         queue_work(hdev->workqueue, &hdev->tx_work);
3457 }
3458
3459 static void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3460 {
3461         struct hci_ev_mode_change *ev = (void *) skb->data;
3462         struct hci_conn *conn;
3463
3464         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3465
3466         hci_dev_lock(hdev);
3467
3468         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3469         if (conn) {
3470                 conn->mode = ev->mode;
3471
3472                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND,
3473                                         &conn->flags)) {
3474                         if (conn->mode == HCI_CM_ACTIVE)
3475                                 set_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3476                         else
3477                                 clear_bit(HCI_CONN_POWER_SAVE, &conn->flags);
3478                 }
3479
3480                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->flags))
3481                         hci_sco_setup(conn, ev->status);
3482         }
3483
3484         hci_dev_unlock(hdev);
3485 }
3486
3487 #ifdef CONFIG_TIZEN_WIP
3488 static void hci_vendor_specific_evt(struct hci_dev *hdev, struct sk_buff *skb)
3489 {
3490         struct hci_ev_vendor_specific *ev = (void *) skb->data;
3491         __u8 event_sub_code;
3492         skb_pull(skb, sizeof(*ev));
3493
3494         BT_DBG("hci_vendor_specific_evt");
3495         event_sub_code = ev->event_sub_code;
3496
3497         switch (event_sub_code) {
3498         case LE_META_VENDOR_SPECIFIC_GROUP_EVENT: {
3499                 struct hci_ev_ext_vendor_specific *ev = (void *) skb->data;
3500                 __u8 event_le_ext_sub_code;
3501                 skb_pull(skb, sizeof(*ev));
3502                 event_le_ext_sub_code = ev->event_le_ext_sub_code;
3503
3504                 BT_DBG("Func: %s RSSI event LE_META_VENDOR_SPECIFIC_GROUP_EVENT: %X",
3505                                 __func__, LE_META_VENDOR_SPECIFIC_GROUP_EVENT);
3506
3507                 switch (event_le_ext_sub_code) {
3508                 case LE_RSSI_LINK_ALERT:
3509                         BT_DBG("Func: %s RSSI event LE_RSSI_LINK_ALERT %X",
3510                                         __func__, LE_RSSI_LINK_ALERT);
3511                         mgmt_rssi_alert_evt(hdev, skb);
3512                         break;
3513
3514                 default:
3515                         break;
3516                 }
3517         }
3518         break;
3519
3520         case LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT:
3521                 BT_DBG("Func: %s LE_MULTI_ADV_STATE_CHANGE_SUB_EVENT", __func__);
3522                 mgmt_multi_adv_state_change_evt(hdev, skb);
3523                 break;
3524
3525         default:
3526                 break;
3527         }
3528 }
3529 #endif
3530 static void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3531 {
3532         struct hci_ev_pin_code_req *ev = (void *) skb->data;
3533         struct hci_conn *conn;
3534
3535         BT_DBG("%s", hdev->name);
3536
3537         hci_dev_lock(hdev);
3538
3539         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3540         if (!conn)
3541                 goto unlock;
3542
3543         if (conn->state == BT_CONNECTED) {
3544                 hci_conn_hold(conn);
3545                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
3546                 hci_conn_drop(conn);
3547         }
3548
3549         if (!test_bit(HCI_BONDABLE, &hdev->dev_flags) &&
3550             !test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags)) {
3551                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
3552                              sizeof(ev->bdaddr), &ev->bdaddr);
3553         } else if (test_bit(HCI_MGMT, &hdev->dev_flags)) {
3554                 u8 secure;
3555
3556                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
3557                         secure = 1;
3558                 else
3559                         secure = 0;
3560
3561                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
3562         }
3563
3564 unlock:
3565         hci_dev_unlock(hdev);
3566 }
3567
3568 static void conn_set_key(struct hci_conn *conn, u8 key_type, u8 pin_len)
3569 {
3570         if (key_type == HCI_LK_CHANGED_COMBINATION)
3571                 return;
3572
3573         conn->pin_length = pin_len;
3574         conn->key_type = key_type;
3575
3576         switch (key_type) {
3577         case HCI_LK_LOCAL_UNIT:
3578         case HCI_LK_REMOTE_UNIT:
3579         case HCI_LK_DEBUG_COMBINATION:
3580                 return;
3581         case HCI_LK_COMBINATION:
3582                 if (pin_len == 16)
3583                         conn->pending_sec_level = BT_SECURITY_HIGH;
3584                 else
3585                         conn->pending_sec_level = BT_SECURITY_MEDIUM;
3586                 break;
3587         case HCI_LK_UNAUTH_COMBINATION_P192:
3588         case HCI_LK_UNAUTH_COMBINATION_P256:
3589                 conn->pending_sec_level = BT_SECURITY_MEDIUM;
3590                 break;
3591         case HCI_LK_AUTH_COMBINATION_P192:
3592                 conn->pending_sec_level = BT_SECURITY_HIGH;
3593                 break;
3594         case HCI_LK_AUTH_COMBINATION_P256:
3595                 conn->pending_sec_level = BT_SECURITY_FIPS;
3596                 break;
3597         }
3598 }
3599
3600 static void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
3601 {
3602         struct hci_ev_link_key_req *ev = (void *) skb->data;
3603         struct hci_cp_link_key_reply cp;
3604         struct hci_conn *conn;
3605         struct link_key *key;
3606
3607         BT_DBG("%s", hdev->name);
3608
3609         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3610                 return;
3611
3612         hci_dev_lock(hdev);
3613
3614         key = hci_find_link_key(hdev, &ev->bdaddr);
3615         if (!key) {
3616                 BT_DBG("%s link key not found for %pMR", hdev->name,
3617                        &ev->bdaddr);
3618                 goto not_found;
3619         }
3620
3621         BT_DBG("%s found key type %u for %pMR", hdev->name, key->type,
3622                &ev->bdaddr);
3623
3624         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3625         if (conn) {
3626                 clear_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3627
3628                 if ((key->type == HCI_LK_UNAUTH_COMBINATION_P192 ||
3629                      key->type == HCI_LK_UNAUTH_COMBINATION_P256) &&
3630                     conn->auth_type != 0xff && (conn->auth_type & 0x01)) {
3631                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
3632                         goto not_found;
3633                 }
3634
3635                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
3636                     (conn->pending_sec_level == BT_SECURITY_HIGH ||
3637                      conn->pending_sec_level == BT_SECURITY_FIPS)) {
3638                         BT_DBG("%s ignoring key unauthenticated for high security",
3639                                hdev->name);
3640                         goto not_found;
3641                 }
3642
3643                 conn_set_key(conn, key->type, key->pin_len);
3644         }
3645
3646         bacpy(&cp.bdaddr, &ev->bdaddr);
3647         memcpy(cp.link_key, key->val, HCI_LINK_KEY_SIZE);
3648
3649         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
3650
3651         hci_dev_unlock(hdev);
3652
3653         return;
3654
3655 not_found:
3656         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
3657         hci_dev_unlock(hdev);
3658 }
3659
3660 static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
3661 {
3662         struct hci_ev_link_key_notify *ev = (void *) skb->data;
3663         struct hci_conn *conn;
3664         struct link_key *key;
3665         bool persistent;
3666         u8 pin_len = 0;
3667
3668         BT_DBG("%s", hdev->name);
3669
3670         hci_dev_lock(hdev);
3671
3672         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
3673         if (!conn)
3674                 goto unlock;
3675
3676         hci_conn_hold(conn);
3677         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3678         hci_conn_drop(conn);
3679
3680         set_bit(HCI_CONN_NEW_LINK_KEY, &conn->flags);
3681         conn_set_key(conn, ev->key_type, conn->pin_length);
3682
3683         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
3684                 goto unlock;
3685
3686         key = hci_add_link_key(hdev, conn, &ev->bdaddr, ev->link_key,
3687                                 ev->key_type, pin_len, &persistent);
3688         if (!key)
3689                 goto unlock;
3690
3691         /* Update connection information since adding the key will have
3692          * fixed up the type in the case of changed combination keys.
3693          */
3694         if (ev->key_type == HCI_LK_CHANGED_COMBINATION)
3695                 conn_set_key(conn, key->type, key->pin_len);
3696
3697         mgmt_new_link_key(hdev, key, persistent);
3698
3699         /* Keep debug keys around only if the HCI_KEEP_DEBUG_KEYS flag
3700          * is set. If it's not set simply remove the key from the kernel
3701          * list (we've still notified user space about it but with
3702          * store_hint being 0).
3703          */
3704         if (key->type == HCI_LK_DEBUG_COMBINATION &&
3705             !test_bit(HCI_KEEP_DEBUG_KEYS, &hdev->dev_flags)) {
3706                 list_del_rcu(&key->list);
3707                 kfree_rcu(key, rcu);
3708                 goto unlock;
3709         }
3710
3711         if (persistent)
3712                 clear_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3713         else
3714                 set_bit(HCI_CONN_FLUSH_KEY, &conn->flags);
3715
3716 unlock:
3717         hci_dev_unlock(hdev);
3718 }
3719
3720 static void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
3721 {
3722         struct hci_ev_clock_offset *ev = (void *) skb->data;
3723         struct hci_conn *conn;
3724
3725         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3726
3727         hci_dev_lock(hdev);
3728
3729         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3730         if (conn && !ev->status) {
3731                 struct inquiry_entry *ie;
3732
3733                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3734                 if (ie) {
3735                         ie->data.clock_offset = ev->clock_offset;
3736                         ie->timestamp = jiffies;
3737                 }
3738         }
3739
3740         hci_dev_unlock(hdev);
3741 }
3742
3743 static void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
3744 {
3745         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
3746         struct hci_conn *conn;
3747
3748         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3749
3750         hci_dev_lock(hdev);
3751
3752         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3753         if (conn && !ev->status)
3754                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
3755
3756         hci_dev_unlock(hdev);
3757 }
3758
3759 static void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
3760 {
3761         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
3762         struct inquiry_entry *ie;
3763
3764         BT_DBG("%s", hdev->name);
3765
3766         hci_dev_lock(hdev);
3767
3768         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
3769         if (ie) {
3770                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
3771                 ie->timestamp = jiffies;
3772         }
3773
3774         hci_dev_unlock(hdev);
3775 }
3776
3777 static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
3778                                              struct sk_buff *skb)
3779 {
3780         struct inquiry_data data;
3781         int num_rsp = *((__u8 *) skb->data);
3782
3783         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
3784
3785         if (!num_rsp)
3786                 return;
3787
3788         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
3789                 return;
3790
3791         hci_dev_lock(hdev);
3792
3793         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
3794                 struct inquiry_info_with_rssi_and_pscan_mode *info;
3795                 info = (void *) (skb->data + 1);
3796
3797                 for (; num_rsp; num_rsp--, info++) {
3798                         u32 flags;
3799
3800                         bacpy(&data.bdaddr, &info->bdaddr);
3801                         data.pscan_rep_mode     = info->pscan_rep_mode;
3802                         data.pscan_period_mode  = info->pscan_period_mode;
3803                         data.pscan_mode         = info->pscan_mode;
3804                         memcpy(data.dev_class, info->dev_class, 3);
3805                         data.clock_offset       = info->clock_offset;
3806                         data.rssi               = info->rssi;
3807                         data.ssp_mode           = 0x00;
3808
3809                         flags = hci_inquiry_cache_update(hdev, &data, false);
3810
3811                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3812                                           info->dev_class, info->rssi,
3813                                           flags, NULL, 0, NULL, 0);
3814                 }
3815         } else {
3816                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
3817
3818                 for (; num_rsp; num_rsp--, info++) {
3819                         u32 flags;
3820
3821                         bacpy(&data.bdaddr, &info->bdaddr);
3822                         data.pscan_rep_mode     = info->pscan_rep_mode;
3823                         data.pscan_period_mode  = info->pscan_period_mode;
3824                         data.pscan_mode         = 0x00;
3825                         memcpy(data.dev_class, info->dev_class, 3);
3826                         data.clock_offset       = info->clock_offset;
3827                         data.rssi               = info->rssi;
3828                         data.ssp_mode           = 0x00;
3829
3830                         flags = hci_inquiry_cache_update(hdev, &data, false);
3831
3832                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
3833                                           info->dev_class, info->rssi,
3834                                           flags, NULL, 0, NULL, 0);
3835                 }
3836         }
3837
3838         hci_dev_unlock(hdev);
3839 }
3840
3841 static void hci_remote_ext_features_evt(struct hci_dev *hdev,
3842                                         struct sk_buff *skb)
3843 {
3844         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
3845         struct hci_conn *conn;
3846
3847         BT_DBG("%s", hdev->name);
3848
3849         hci_dev_lock(hdev);
3850
3851         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3852         if (!conn)
3853                 goto unlock;
3854
3855         if (ev->page < HCI_MAX_PAGES)
3856                 memcpy(conn->features[ev->page], ev->features, 8);
3857
3858         if (!ev->status && ev->page == 0x01) {
3859                 struct inquiry_entry *ie;
3860
3861                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
3862                 if (ie)
3863                         ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
3864
3865                 if (ev->features[0] & LMP_HOST_SSP) {
3866                         set_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3867                 } else {
3868                         /* It is mandatory by the Bluetooth specification that
3869                          * Extended Inquiry Results are only used when Secure
3870                          * Simple Pairing is enabled, but some devices violate
3871                          * this.
3872                          *
3873                          * To make these devices work, the internal SSP
3874                          * enabled flag needs to be cleared if the remote host
3875                          * features do not indicate SSP support */
3876                         clear_bit(HCI_CONN_SSP_ENABLED, &conn->flags);
3877                 }
3878
3879 /* Disable Secure connection implementation now */
3880 #ifdef CONFIG_TIZEN_WIP
3881                 if (ev->features[0] & LMP_HOST_SC)
3882                         set_bit(HCI_CONN_SC_ENABLED, &conn->flags);
3883 #endif
3884         }
3885
3886         if (conn->state != BT_CONFIG)
3887                 goto unlock;
3888
3889 #ifdef CONFIG_SPRD_2331
3890         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3891                 struct hci_cp_change_conn_ptype cp;
3892                 memset(&cp, 0, sizeof(cp));
3893                 cp.pkt_type = (HCI_DM1|HCI_DH1);
3894
3895                 if (conn->features[0][0] & LMP_3SLOT)
3896                         cp.pkt_type |= (HCI_DM3|HCI_DH3);
3897
3898                 if (conn->features[0][0] & LMP_5SLOT)
3899                         cp.pkt_type |= (HCI_DM5|HCI_DH5);
3900
3901                 if (!(conn->features[0][3] & LMP_EDR_ACL_2M)) {
3902                         cp.pkt_type |= (HCI_2DH1|HCI_2DH3|HCI_2DH5);
3903                 } else {
3904                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3905                                 cp.pkt_type |= HCI_2DH3;
3906
3907                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3908                                 cp.pkt_type |= HCI_2DH5;
3909                 }
3910
3911                 if (!(conn->features[0][3] & LMP_EDR_ACL_3M)) {
3912                         cp.pkt_type |= (HCI_3DH1|HCI_3DH3|HCI_3DH5);
3913                 } else {
3914                         if (!(conn->features[0][4] & LMP_EDR_3SLOT))
3915                                 cp.pkt_type |= HCI_3DH3;
3916
3917                         if (!(conn->features[0][5] & LMP_EDR_5SLOT))
3918                                 cp.pkt_type |= HCI_3DH5;
3919                 }
3920
3921                 cp.handle = ev->handle;
3922                 hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE, sizeof(cp), &cp);
3923         }
3924 #endif
3925
3926         if (!ev->status && !test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) {
3927                 struct hci_cp_remote_name_req cp;
3928                 memset(&cp, 0, sizeof(cp));
3929                 bacpy(&cp.bdaddr, &conn->dst);
3930                 cp.pscan_rep_mode = 0x02;
3931                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
3932         } else if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
3933                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
3934
3935         if (!hci_outgoing_auth_needed(hdev, conn)) {
3936                 conn->state = BT_CONNECTED;
3937                 hci_proto_connect_cfm(conn, ev->status);
3938                 hci_conn_drop(conn);
3939         }
3940
3941 unlock:
3942         hci_dev_unlock(hdev);
3943 }
3944
3945 static void hci_sync_conn_complete_evt(struct hci_dev *hdev,
3946                                        struct sk_buff *skb)
3947 {
3948         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
3949         struct hci_conn *conn;
3950
3951         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
3952
3953         hci_dev_lock(hdev);
3954
3955         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
3956         if (!conn) {
3957                 if (ev->link_type == ESCO_LINK)
3958                         goto unlock;
3959
3960                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
3961                 if (!conn)
3962                         goto unlock;
3963
3964                 conn->type = SCO_LINK;
3965         }
3966
3967         switch (ev->status) {
3968         case 0x00:
3969                 conn->handle = __le16_to_cpu(ev->handle);
3970                 conn->state  = BT_CONNECTED;
3971
3972                 hci_debugfs_create_conn(conn);
3973                 hci_conn_add_sysfs(conn);
3974                 break;
3975
3976         case 0x10:      /* Connection Accept Timeout */
3977         case 0x0d:      /* Connection Rejected due to Limited Resources */
3978         case 0x11:      /* Unsupported Feature or Parameter Value */
3979         case 0x1c:      /* SCO interval rejected */
3980         case 0x1a:      /* Unsupported Remote Feature */
3981         case 0x1f:      /* Unspecified error */
3982         case 0x20:      /* Unsupported LMP Parameter value */
3983                 if (conn->out) {
3984                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
3985                                         (hdev->esco_type & EDR_ESCO_MASK);
3986                         if (hci_setup_sync(conn, conn->link->handle))
3987                                 goto unlock;
3988                 }
3989                 /* fall through */
3990
3991         default:
3992                 conn->state = BT_CLOSED;
3993                 break;
3994         }
3995
3996         hci_proto_connect_cfm(conn, ev->status);
3997         if (ev->status)
3998                 hci_conn_del(conn);
3999
4000 unlock:
4001         hci_dev_unlock(hdev);
4002 }
4003
4004 static inline size_t eir_get_length(u8 *eir, size_t eir_len)
4005 {
4006         size_t parsed = 0;
4007
4008         while (parsed < eir_len) {
4009                 u8 field_len = eir[0];
4010
4011                 if (field_len == 0)
4012                         return parsed;
4013
4014                 parsed += field_len + 1;
4015                 eir += field_len + 1;
4016         }
4017
4018         return eir_len;
4019 }
4020
4021 static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
4022                                             struct sk_buff *skb)
4023 {
4024         struct inquiry_data data;
4025         struct extended_inquiry_info *info = (void *) (skb->data + 1);
4026         int num_rsp = *((__u8 *) skb->data);
4027         size_t eir_len;
4028
4029         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
4030
4031         if (!num_rsp)
4032                 return;
4033
4034         if (test_bit(HCI_PERIODIC_INQ, &hdev->dev_flags))
4035                 return;
4036
4037         hci_dev_lock(hdev);
4038
4039         for (; num_rsp; num_rsp--, info++) {
4040                 u32 flags;
4041                 bool name_known;
4042
4043                 bacpy(&data.bdaddr, &info->bdaddr);
4044                 data.pscan_rep_mode     = info->pscan_rep_mode;
4045                 data.pscan_period_mode  = info->pscan_period_mode;
4046                 data.pscan_mode         = 0x00;
4047                 memcpy(data.dev_class, info->dev_class, 3);
4048                 data.clock_offset       = info->clock_offset;
4049                 data.rssi               = info->rssi;
4050                 data.ssp_mode           = 0x01;
4051
4052                 if (test_bit(HCI_MGMT, &hdev->dev_flags))
4053                         name_known = eir_has_data_type(info->data,
4054                                                        sizeof(info->data),
4055                                                        EIR_NAME_COMPLETE);
4056                 else
4057                         name_known = true;
4058
4059                 flags = hci_inquiry_cache_update(hdev, &data, name_known);
4060
4061                 eir_len = eir_get_length(info->data, sizeof(info->data));
4062
4063                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
4064                                   info->dev_class, info->rssi,
4065                                   flags, info->data, eir_len, NULL, 0);
4066         }
4067
4068         hci_dev_unlock(hdev);
4069 }
4070
4071 static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
4072                                          struct sk_buff *skb)
4073 {
4074         struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
4075         struct hci_conn *conn;
4076
4077         BT_DBG("%s status 0x%2.2x handle 0x%4.4x", hdev->name, ev->status,
4078                __le16_to_cpu(ev->handle));
4079
4080         hci_dev_lock(hdev);
4081
4082         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4083         if (!conn)
4084                 goto unlock;
4085
4086         /* For BR/EDR the necessary steps are taken through the
4087          * auth_complete event.
4088          */
4089         if (conn->type != LE_LINK)
4090                 goto unlock;
4091
4092         if (!ev->status)
4093                 conn->sec_level = conn->pending_sec_level;
4094
4095         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
4096
4097         if (ev->status && conn->state == BT_CONNECTED) {
4098                 hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
4099                 hci_conn_drop(conn);
4100                 goto unlock;
4101         }
4102
4103         if (conn->state == BT_CONFIG) {
4104                 if (!ev->status)
4105                         conn->state = BT_CONNECTED;
4106
4107                 hci_proto_connect_cfm(conn, ev->status);
4108                 hci_conn_drop(conn);
4109         } else {
4110                 hci_auth_cfm(conn, ev->status);
4111
4112                 hci_conn_hold(conn);
4113                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
4114                 hci_conn_drop(conn);
4115         }
4116
4117 unlock:
4118         hci_dev_unlock(hdev);
4119 }
4120
4121 static u8 hci_get_auth_req(struct hci_conn *conn)
4122 {
4123 #ifdef CONFIG_TIZEN_WIP
4124         if (conn->remote_auth == HCI_AT_GENERAL_BONDING_MITM) {
4125                 if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4126                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4127                         return HCI_AT_GENERAL_BONDING_MITM;
4128         }
4129 #endif
4130
4131         /* If remote requests no-bonding follow that lead */
4132         if (conn->remote_auth == HCI_AT_NO_BONDING ||
4133             conn->remote_auth == HCI_AT_NO_BONDING_MITM)
4134                 return conn->remote_auth | (conn->auth_type & 0x01);
4135
4136         /* If both remote and local have enough IO capabilities, require
4137          * MITM protection
4138          */
4139         if (conn->remote_cap != HCI_IO_NO_INPUT_OUTPUT &&
4140             conn->io_capability != HCI_IO_NO_INPUT_OUTPUT)
4141                 return conn->remote_auth | 0x01;
4142
4143         /* No MITM protection possible so ignore remote requirement */
4144         return (conn->remote_auth & ~0x01) | (conn->auth_type & 0x01);
4145 }
4146
4147 static u8 bredr_oob_data_present(struct hci_conn *conn)
4148 {
4149         struct hci_dev *hdev = conn->hdev;
4150         struct oob_data *data;
4151
4152         data = hci_find_remote_oob_data(hdev, &conn->dst, BDADDR_BREDR);
4153         if (!data)
4154                 return 0x00;
4155
4156         /* When Secure Connections Only mode is enabled, then the P-256
4157          * values are required. If they are not available, then do not
4158          * declare that OOB data is present.
4159          */
4160         if (bredr_sc_enabled(hdev) &&
4161             test_bit(HCI_SC_ONLY, &hdev->dev_flags) &&
4162             (!memcmp(data->rand256, ZERO_KEY, 16) ||
4163              !memcmp(data->hash256, ZERO_KEY, 16)))
4164                 return 0x00;
4165
4166         if (conn->out || test_bit(HCI_CONN_REMOTE_OOB, &conn->flags))
4167                 return 0x01;
4168
4169         return 0x00;
4170 }
4171
4172 static void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
4173 {
4174         struct hci_ev_io_capa_request *ev = (void *) skb->data;
4175         struct hci_conn *conn;
4176
4177         BT_DBG("%s", hdev->name);
4178
4179         hci_dev_lock(hdev);
4180
4181         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4182         if (!conn)
4183                 goto unlock;
4184
4185         hci_conn_hold(conn);
4186
4187         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4188                 goto unlock;
4189
4190         /* Allow pairing if we're pairable, the initiators of the
4191          * pairing or if the remote is not requesting bonding.
4192          */
4193         if (test_bit(HCI_BONDABLE, &hdev->dev_flags) ||
4194             test_bit(HCI_CONN_AUTH_INITIATOR, &conn->flags) ||
4195             (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
4196                 struct hci_cp_io_capability_reply cp;
4197
4198                 bacpy(&cp.bdaddr, &ev->bdaddr);
4199                 /* Change the IO capability from KeyboardDisplay
4200                  * to DisplayYesNo as it is not supported by BT spec. */
4201                 cp.capability = (conn->io_capability == 0x04) ?
4202                                 HCI_IO_DISPLAY_YESNO : conn->io_capability;
4203
4204                 /* If we are initiators, there is no remote information yet */
4205                 if (conn->remote_auth == 0xff) {
4206                         /* Request MITM protection if our IO caps allow it
4207                          * except for the no-bonding case.
4208                          */
4209                         if (conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4210                             conn->auth_type != HCI_AT_NO_BONDING)
4211                                 conn->auth_type |= 0x01;
4212                 } else {
4213                         conn->auth_type = hci_get_auth_req(conn);
4214                 }
4215
4216                 /* If we're not bondable, force one of the non-bondable
4217                  * authentication requirement values.
4218                  */
4219                 if (!test_bit(HCI_BONDABLE, &hdev->dev_flags))
4220                         conn->auth_type &= HCI_AT_NO_BONDING_MITM;
4221
4222                 cp.authentication = conn->auth_type;
4223                 cp.oob_data = bredr_oob_data_present(conn);
4224
4225                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
4226                              sizeof(cp), &cp);
4227         } else {
4228                 struct hci_cp_io_capability_neg_reply cp;
4229
4230                 bacpy(&cp.bdaddr, &ev->bdaddr);
4231                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
4232
4233                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
4234                              sizeof(cp), &cp);
4235         }
4236
4237 unlock:
4238         hci_dev_unlock(hdev);
4239 }
4240
4241 static void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
4242 {
4243         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
4244         struct hci_conn *conn;
4245
4246         BT_DBG("%s", hdev->name);
4247
4248         hci_dev_lock(hdev);
4249
4250         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4251         if (!conn)
4252                 goto unlock;
4253
4254         conn->remote_cap = ev->capability;
4255         conn->remote_auth = ev->authentication;
4256         if (ev->oob_data)
4257                 set_bit(HCI_CONN_REMOTE_OOB, &conn->flags);
4258
4259 unlock:
4260         hci_dev_unlock(hdev);
4261 }
4262
4263 static void hci_user_confirm_request_evt(struct hci_dev *hdev,
4264                                          struct sk_buff *skb)
4265 {
4266         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
4267         int loc_mitm, rem_mitm, confirm_hint = 0;
4268         struct hci_conn *conn;
4269
4270         BT_DBG("%s", hdev->name);
4271
4272         hci_dev_lock(hdev);
4273
4274         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4275                 goto unlock;
4276
4277         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4278         if (!conn)
4279                 goto unlock;
4280
4281         loc_mitm = (conn->auth_type & 0x01);
4282         rem_mitm = (conn->remote_auth & 0x01);
4283
4284         /* If we require MITM but the remote device can't provide that
4285          * (it has NoInputNoOutput) then reject the confirmation
4286          * request. We check the security level here since it doesn't
4287          * necessarily match conn->auth_type.
4288          */
4289         if (conn->pending_sec_level > BT_SECURITY_MEDIUM &&
4290             conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) {
4291                 BT_DBG("Rejecting request: remote device can't provide MITM");
4292                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
4293                              sizeof(ev->bdaddr), &ev->bdaddr);
4294                 goto unlock;
4295         }
4296
4297         /* If no side requires MITM protection; auto-accept */
4298         if ((!loc_mitm || conn->remote_cap == HCI_IO_NO_INPUT_OUTPUT) &&
4299             (!rem_mitm || conn->io_capability == HCI_IO_NO_INPUT_OUTPUT)) {
4300
4301                 /* If we're not the initiators request authorization to
4302                  * proceed from user space (mgmt_user_confirm with
4303                  * confirm_hint set to 1). The exception is if neither
4304                  * side had MITM or if the local IO capability is
4305                  * NoInputNoOutput, in which case we do auto-accept
4306                  */
4307                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
4308                     conn->io_capability != HCI_IO_NO_INPUT_OUTPUT &&
4309                     (loc_mitm || rem_mitm)) {
4310                         BT_DBG("Confirming auto-accept as acceptor");
4311                         confirm_hint = 1;
4312                         goto confirm;
4313                 }
4314
4315                 BT_DBG("Auto-accept of user confirmation with %ums delay",
4316                        hdev->auto_accept_delay);
4317
4318                 if (hdev->auto_accept_delay > 0) {
4319                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
4320                         queue_delayed_work(conn->hdev->workqueue,
4321                                            &conn->auto_accept_work, delay);
4322                         goto unlock;
4323                 }
4324
4325                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
4326                              sizeof(ev->bdaddr), &ev->bdaddr);
4327                 goto unlock;
4328         }
4329
4330 confirm:
4331         mgmt_user_confirm_request(hdev, &ev->bdaddr, ACL_LINK, 0,
4332                                   le32_to_cpu(ev->passkey), confirm_hint);
4333
4334 unlock:
4335         hci_dev_unlock(hdev);
4336 }
4337
4338 static void hci_user_passkey_request_evt(struct hci_dev *hdev,
4339                                          struct sk_buff *skb)
4340 {
4341         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
4342
4343         BT_DBG("%s", hdev->name);
4344
4345         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4346                 mgmt_user_passkey_request(hdev, &ev->bdaddr, ACL_LINK, 0);
4347 }
4348
4349 static void hci_user_passkey_notify_evt(struct hci_dev *hdev,
4350                                         struct sk_buff *skb)
4351 {
4352         struct hci_ev_user_passkey_notify *ev = (void *) skb->data;
4353         struct hci_conn *conn;
4354
4355         BT_DBG("%s", hdev->name);
4356
4357         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4358         if (!conn)
4359                 return;
4360
4361         conn->passkey_notify = __le32_to_cpu(ev->passkey);
4362         conn->passkey_entered = 0;
4363
4364         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4365                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4366                                          conn->dst_type, conn->passkey_notify,
4367                                          conn->passkey_entered);
4368 }
4369
4370 static void hci_keypress_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
4371 {
4372         struct hci_ev_keypress_notify *ev = (void *) skb->data;
4373         struct hci_conn *conn;
4374
4375         BT_DBG("%s", hdev->name);
4376
4377         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4378         if (!conn)
4379                 return;
4380
4381         switch (ev->type) {
4382         case HCI_KEYPRESS_STARTED:
4383                 conn->passkey_entered = 0;
4384                 return;
4385
4386         case HCI_KEYPRESS_ENTERED:
4387                 conn->passkey_entered++;
4388                 break;
4389
4390         case HCI_KEYPRESS_ERASED:
4391                 conn->passkey_entered--;
4392                 break;
4393
4394         case HCI_KEYPRESS_CLEARED:
4395                 conn->passkey_entered = 0;
4396                 break;
4397
4398         case HCI_KEYPRESS_COMPLETED:
4399                 return;
4400         }
4401
4402         if (test_bit(HCI_MGMT, &hdev->dev_flags))
4403                 mgmt_user_passkey_notify(hdev, &conn->dst, conn->type,
4404                                          conn->dst_type, conn->passkey_notify,
4405                                          conn->passkey_entered);
4406 }
4407
4408 static void hci_simple_pair_complete_evt(struct hci_dev *hdev,
4409                                          struct sk_buff *skb)
4410 {
4411         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
4412         struct hci_conn *conn;
4413
4414         BT_DBG("%s", hdev->name);
4415
4416         hci_dev_lock(hdev);
4417
4418         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4419         if (!conn)
4420                 goto unlock;
4421
4422         /* Reset the authentication requirement to unknown */
4423         conn->remote_auth = 0xff;
4424
4425         /* To avoid duplicate auth_failed events to user space we check
4426          * the HCI_CONN_AUTH_PEND flag which will be set if we
4427          * initiated the authentication. A traditional auth_complete
4428          * event gets always produced as initiator and is also mapped to
4429          * the mgmt_auth_failed event */
4430         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) && ev->status)
4431                 mgmt_auth_failed(conn, ev->status);
4432
4433         hci_conn_drop(conn);
4434
4435 unlock:
4436         hci_dev_unlock(hdev);
4437 }
4438
4439 static void hci_remote_host_features_evt(struct hci_dev *hdev,
4440                                          struct sk_buff *skb)
4441 {
4442         struct hci_ev_remote_host_features *ev = (void *) skb->data;
4443         struct inquiry_entry *ie;
4444         struct hci_conn *conn;
4445
4446         BT_DBG("%s", hdev->name);
4447
4448         hci_dev_lock(hdev);
4449
4450         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
4451         if (conn)
4452                 memcpy(conn->features[1], ev->features, 8);
4453
4454         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
4455         if (ie)
4456                 ie->data.ssp_mode = (ev->features[0] & LMP_HOST_SSP);
4457
4458         hci_dev_unlock(hdev);
4459 }
4460
4461 static void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
4462                                             struct sk_buff *skb)
4463 {
4464         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
4465         struct oob_data *data;
4466
4467         BT_DBG("%s", hdev->name);
4468
4469         hci_dev_lock(hdev);
4470
4471         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
4472                 goto unlock;
4473
4474         data = hci_find_remote_oob_data(hdev, &ev->bdaddr, BDADDR_BREDR);
4475         if (!data) {
4476                 struct hci_cp_remote_oob_data_neg_reply cp;
4477
4478                 bacpy(&cp.bdaddr, &ev->bdaddr);
4479                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY,
4480                              sizeof(cp), &cp);
4481                 goto unlock;
4482         }
4483
4484         if (bredr_sc_enabled(hdev)) {
4485                 struct hci_cp_remote_oob_ext_data_reply cp;
4486
4487                 bacpy(&cp.bdaddr, &ev->bdaddr);
4488                 if (test_bit(HCI_SC_ONLY, &hdev->dev_flags)) {
4489                         memset(cp.hash192, 0, sizeof(cp.hash192));
4490                         memset(cp.rand192, 0, sizeof(cp.rand192));
4491                 } else {
4492                         memcpy(cp.hash192, data->hash192, sizeof(cp.hash192));
4493                         memcpy(cp.rand192, data->rand192, sizeof(cp.rand192));
4494                 }
4495                 memcpy(cp.hash256, data->hash256, sizeof(cp.hash256));
4496                 memcpy(cp.rand256, data->rand256, sizeof(cp.rand256));
4497
4498                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_EXT_DATA_REPLY,
4499                              sizeof(cp), &cp);
4500         } else {
4501                 struct hci_cp_remote_oob_data_reply cp;
4502
4503                 bacpy(&cp.bdaddr, &ev->bdaddr);
4504                 memcpy(cp.hash, data->hash192, sizeof(cp.hash));
4505                 memcpy(cp.rand, data->rand192, sizeof(cp.rand));
4506
4507                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY,
4508                              sizeof(cp), &cp);
4509         }
4510
4511 unlock:
4512         hci_dev_unlock(hdev);
4513 }
4514
4515 static void hci_phy_link_complete_evt(struct hci_dev *hdev,
4516                                       struct sk_buff *skb)
4517 {
4518         struct hci_ev_phy_link_complete *ev = (void *) skb->data;
4519         struct hci_conn *hcon, *bredr_hcon;
4520
4521         BT_DBG("%s handle 0x%2.2x status 0x%2.2x", hdev->name, ev->phy_handle,
4522                ev->status);
4523
4524         hci_dev_lock(hdev);
4525
4526         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4527         if (!hcon) {
4528                 hci_dev_unlock(hdev);
4529                 return;
4530         }
4531
4532         if (ev->status) {
4533                 hci_conn_del(hcon);
4534                 hci_dev_unlock(hdev);
4535                 return;
4536         }
4537
4538         bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon;
4539
4540         hcon->state = BT_CONNECTED;
4541         bacpy(&hcon->dst, &bredr_hcon->dst);
4542
4543         hci_conn_hold(hcon);
4544         hcon->disc_timeout = HCI_DISCONN_TIMEOUT;
4545         hci_conn_drop(hcon);
4546
4547         hci_debugfs_create_conn(hcon);
4548         hci_conn_add_sysfs(hcon);
4549
4550         amp_physical_cfm(bredr_hcon, hcon);
4551
4552         hci_dev_unlock(hdev);
4553 }
4554
4555 static void hci_loglink_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4556 {
4557         struct hci_ev_logical_link_complete *ev = (void *) skb->data;
4558         struct hci_conn *hcon;
4559         struct hci_chan *hchan;
4560         struct amp_mgr *mgr;
4561
4562         BT_DBG("%s log_handle 0x%4.4x phy_handle 0x%2.2x status 0x%2.2x",
4563                hdev->name, le16_to_cpu(ev->handle), ev->phy_handle,
4564                ev->status);
4565
4566         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4567         if (!hcon)
4568                 return;
4569
4570         /* Create AMP hchan */
4571         hchan = hci_chan_create(hcon);
4572         if (!hchan)
4573                 return;
4574
4575         hchan->handle = le16_to_cpu(ev->handle);
4576
4577         BT_DBG("hcon %p mgr %p hchan %p", hcon, hcon->amp_mgr, hchan);
4578
4579         mgr = hcon->amp_mgr;
4580         if (mgr && mgr->bredr_chan) {
4581                 struct l2cap_chan *bredr_chan = mgr->bredr_chan;
4582
4583                 l2cap_chan_lock(bredr_chan);
4584
4585                 bredr_chan->conn->mtu = hdev->block_mtu;
4586                 l2cap_logical_cfm(bredr_chan, hchan, 0);
4587                 hci_conn_hold(hcon);
4588
4589                 l2cap_chan_unlock(bredr_chan);
4590         }
4591 }
4592
4593 static void hci_disconn_loglink_complete_evt(struct hci_dev *hdev,
4594                                              struct sk_buff *skb)
4595 {
4596         struct hci_ev_disconn_logical_link_complete *ev = (void *) skb->data;
4597         struct hci_chan *hchan;
4598
4599         BT_DBG("%s log handle 0x%4.4x status 0x%2.2x", hdev->name,
4600                le16_to_cpu(ev->handle), ev->status);
4601
4602         if (ev->status)
4603                 return;
4604
4605         hci_dev_lock(hdev);
4606
4607         hchan = hci_chan_lookup_handle(hdev, le16_to_cpu(ev->handle));
4608         if (!hchan)
4609                 goto unlock;
4610
4611         amp_destroy_logical_link(hchan, ev->reason);
4612
4613 unlock:
4614         hci_dev_unlock(hdev);
4615 }
4616
4617 static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev,
4618                                              struct sk_buff *skb)
4619 {
4620         struct hci_ev_disconn_phy_link_complete *ev = (void *) skb->data;
4621         struct hci_conn *hcon;
4622
4623         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4624
4625         if (ev->status)
4626                 return;
4627
4628         hci_dev_lock(hdev);
4629
4630         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
4631         if (hcon) {
4632                 hcon->state = BT_CLOSED;
4633                 hci_conn_del(hcon);
4634         }
4635
4636         hci_dev_unlock(hdev);
4637 }
4638
4639 static void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
4640 {
4641         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
4642         struct hci_conn_params *params;
4643         struct hci_conn *conn;
4644         struct smp_irk *irk;
4645         u8 addr_type;
4646
4647         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4648
4649         hci_dev_lock(hdev);
4650
4651         /* All controllers implicitly stop advertising in the event of a
4652          * connection, so ensure that the state bit is cleared.
4653          */
4654         clear_bit(HCI_LE_ADV, &hdev->dev_flags);
4655
4656         conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
4657         if (!conn) {
4658                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr, ev->role);
4659                 if (!conn) {
4660                         BT_ERR("No memory for new connection");
4661                         goto unlock;
4662                 }
4663
4664                 conn->dst_type = ev->bdaddr_type;
4665
4666                 /* If we didn't have a hci_conn object previously
4667                  * but we're in master role this must be something
4668                  * initiated using a white list. Since white list based
4669                  * connections are not "first class citizens" we don't
4670                  * have full tracking of them. Therefore, we go ahead
4671                  * with a "best effort" approach of determining the
4672                  * initiator address based on the HCI_PRIVACY flag.
4673                  */
4674                 if (conn->out) {
4675                         conn->resp_addr_type = ev->bdaddr_type;
4676                         bacpy(&conn->resp_addr, &ev->bdaddr);
4677                         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
4678                                 conn->init_addr_type = ADDR_LE_DEV_RANDOM;
4679                                 bacpy(&conn->init_addr, &hdev->rpa);
4680                         } else {
4681                                 hci_copy_identity_address(hdev,
4682                                                           &conn->init_addr,
4683                                                           &conn->init_addr_type);
4684                         }
4685                 }
4686         } else {
4687 #ifdef CONFIG_TIZEN_WIP
4688                 /* LE auto connect */
4689                 bacpy(&conn->dst, &ev->bdaddr);
4690 #endif
4691                 cancel_delayed_work(&conn->le_conn_timeout);
4692         }
4693
4694         if (!conn->out) {
4695                 /* Set the responder (our side) address type based on
4696                  * the advertising address type.
4697                  */
4698                 conn->resp_addr_type = hdev->adv_addr_type;
4699                 if (hdev->adv_addr_type == ADDR_LE_DEV_RANDOM)
4700                         bacpy(&conn->resp_addr, &hdev->random_addr);
4701                 else
4702                         bacpy(&conn->resp_addr, &hdev->bdaddr);
4703
4704                 conn->init_addr_type = ev->bdaddr_type;
4705                 bacpy(&conn->init_addr, &ev->bdaddr);
4706
4707                 /* For incoming connections, set the default minimum
4708                  * and maximum connection interval. They will be used
4709                  * to check if the parameters are in range and if not
4710                  * trigger the connection update procedure.
4711                  */
4712                 conn->le_conn_min_interval = hdev->le_conn_min_interval;
4713                 conn->le_conn_max_interval = hdev->le_conn_max_interval;
4714         }
4715
4716         /* Lookup the identity address from the stored connection
4717          * address and address type.
4718          *
4719          * When establishing connections to an identity address, the
4720          * connection procedure will store the resolvable random
4721          * address first. Now if it can be converted back into the
4722          * identity address, start using the identity address from
4723          * now on.
4724          */
4725         irk = hci_get_irk(hdev, &conn->dst, conn->dst_type);
4726         if (irk) {
4727 #ifdef __TIZEN_PATCH__
4728                 /* Update rpa. So that, if irk is refreshed, it can be saved */
4729                 bacpy(&irk->rpa, &conn->dst);
4730 #endif
4731                 bacpy(&conn->dst, &irk->bdaddr);
4732                 conn->dst_type = irk->addr_type;
4733         }
4734
4735         if (ev->status) {
4736                 hci_le_conn_failed(conn, ev->status);
4737                 goto unlock;
4738         }
4739
4740         if (conn->dst_type == ADDR_LE_DEV_PUBLIC)
4741                 addr_type = BDADDR_LE_PUBLIC;
4742         else
4743                 addr_type = BDADDR_LE_RANDOM;
4744
4745         /* Drop the connection if the device is blocked */
4746         if (hci_bdaddr_list_lookup(&hdev->blacklist, &conn->dst, addr_type)) {
4747                 hci_conn_drop(conn);
4748                 goto unlock;
4749         }
4750
4751         if (!test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
4752                 mgmt_device_connected(hdev, conn, 0, NULL, 0);
4753
4754         conn->sec_level = BT_SECURITY_LOW;
4755         conn->handle = __le16_to_cpu(ev->handle);
4756         conn->state = BT_CONNECTED;
4757
4758         conn->le_conn_interval = le16_to_cpu(ev->interval);
4759         conn->le_conn_latency = le16_to_cpu(ev->latency);
4760         conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4761
4762         hci_debugfs_create_conn(conn);
4763         hci_conn_add_sysfs(conn);
4764
4765         hci_proto_connect_cfm(conn, ev->status);
4766
4767         params = hci_pend_le_action_lookup(&hdev->pend_le_conns, &conn->dst,
4768                                            conn->dst_type);
4769         if (params) {
4770                 list_del_init(&params->action);
4771                 if (params->conn) {
4772                         hci_conn_drop(params->conn);
4773                         hci_conn_put(params->conn);
4774                         params->conn = NULL;
4775                 }
4776         }
4777
4778 unlock:
4779         hci_update_background_scan(hdev);
4780         hci_dev_unlock(hdev);
4781 }
4782
4783 static void hci_le_conn_update_complete_evt(struct hci_dev *hdev,
4784                                             struct sk_buff *skb)
4785 {
4786         struct hci_ev_le_conn_update_complete *ev = (void *) skb->data;
4787         struct hci_conn *conn;
4788
4789         BT_DBG("%s status 0x%2.2x", hdev->name, ev->status);
4790
4791         if (ev->status)
4792                 return;
4793
4794         hci_dev_lock(hdev);
4795
4796         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
4797         if (conn) {
4798                 conn->le_conn_interval = le16_to_cpu(ev->interval);
4799                 conn->le_conn_latency = le16_to_cpu(ev->latency);
4800                 conn->le_supv_timeout = le16_to_cpu(ev->supervision_timeout);
4801         }
4802
4803         hci_dev_unlock(hdev);
4804 }
4805
4806 /* This function requires the caller holds hdev->lock */
4807 static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev,
4808                                               bdaddr_t *addr,
4809                                               u8 addr_type, u8 adv_type)
4810 {
4811         struct hci_conn *conn;
4812         struct hci_conn_params *params;
4813
4814         /* If the event is not connectable don't proceed further */
4815         if (adv_type != LE_ADV_IND && adv_type != LE_ADV_DIRECT_IND)
4816                 return NULL;
4817
4818         /* Ignore if the device is blocked */
4819         if (hci_bdaddr_list_lookup(&hdev->blacklist, addr, addr_type))
4820                 return NULL;
4821
4822         /* Most controller will fail if we try to create new connections
4823          * while we have an existing one in slave role.
4824          */
4825         if (hdev->conn_hash.le_num_slave > 0)
4826                 return NULL;
4827
4828         /* If we're not connectable only connect devices that we have in
4829          * our pend_le_conns list.
4830          */
4831         params = hci_pend_le_action_lookup(&hdev->pend_le_conns,
4832                                            addr, addr_type);
4833         if (!params)
4834                 return NULL;
4835
4836         switch (params->auto_connect) {
4837         case HCI_AUTO_CONN_DIRECT:
4838                 /* Only devices advertising with ADV_DIRECT_IND are
4839                  * triggering a connection attempt. This is allowing
4840                  * incoming connections from slave devices.
4841                  */
4842                 if (adv_type != LE_ADV_DIRECT_IND)
4843                         return NULL;
4844                 break;
4845         case HCI_AUTO_CONN_ALWAYS:
4846                 /* Devices advertising with ADV_IND or ADV_DIRECT_IND
4847                  * are triggering a connection attempt. This means
4848                  * that incoming connectioms from slave device are
4849                  * accepted and also outgoing connections to slave
4850                  * devices are established when found.
4851                  */
4852                 break;
4853         default:
4854                 return NULL;
4855         }
4856
4857         conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW,
4858                               HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER);
4859         if (!IS_ERR(conn)) {
4860                 /* Store the pointer since we don't really have any
4861                  * other owner of the object besides the params that
4862                  * triggered it. This way we can abort the connection if
4863                  * the parameters get removed and keep the reference
4864                  * count consistent once the connection is established.
4865                  */
4866                 params->conn = hci_conn_get(conn);
4867                 return conn;
4868         }
4869
4870         switch (PTR_ERR(conn)) {
4871         case -EBUSY:
4872                 /* If hci_connect() returns -EBUSY it means there is already
4873                  * an LE connection attempt going on. Since controllers don't
4874                  * support more than one connection attempt at the time, we
4875                  * don't consider this an error case.
4876                  */
4877                 break;
4878         default:
4879                 BT_DBG("Failed to connect: err %ld", PTR_ERR(conn));
4880                 return NULL;
4881         }
4882
4883         return NULL;
4884 }
4885
4886 static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr,
4887                                u8 bdaddr_type, bdaddr_t *direct_addr,
4888                                u8 direct_addr_type, s8 rssi, u8 *data, u8 len)
4889 {
4890 #ifndef CONFIG_TIZEN_WIP
4891         struct discovery_state *d = &hdev->discovery;
4892 #endif
4893         struct smp_irk *irk;
4894         struct hci_conn *conn;
4895 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
4896         bool match;
4897 #endif
4898         u32 flags;
4899
4900         /* If the direct address is present, then this report is from
4901          * a LE Direct Advertising Report event. In that case it is
4902          * important to see if the address is matching the local
4903          * controller address.
4904          */
4905         if (direct_addr) {
4906                 /* Only resolvable random addresses are valid for these
4907                  * kind of reports and others can be ignored.
4908                  */
4909                 if (!hci_bdaddr_is_rpa(direct_addr, direct_addr_type))
4910                         return;
4911
4912                 /* If the controller is not using resolvable random
4913                  * addresses, then this report can be ignored.
4914                  */
4915                 if (!test_bit(HCI_PRIVACY, &hdev->dev_flags))
4916                         return;
4917
4918                 /* If the local IRK of the controller does not match
4919                  * with the resolvable random address provided, then
4920                  * this report can be ignored.
4921                  */
4922                 if (!smp_irk_matches(hdev, hdev->irk, direct_addr))
4923                         return;
4924         }
4925
4926         /* Check if we need to convert to identity address */
4927         irk = hci_get_irk(hdev, bdaddr, bdaddr_type);
4928         if (irk) {
4929                 bdaddr = &irk->bdaddr;
4930                 bdaddr_type = irk->addr_type;
4931         }
4932
4933         /* Check if we have been requested to connect to this device */
4934         conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type);
4935         if (conn && type == LE_ADV_IND) {
4936                 /* Store report for later inclusion by
4937                  * mgmt_device_connected
4938                  */
4939                 memcpy(conn->le_adv_data, data, len);
4940                 conn->le_adv_data_len = len;
4941         }
4942
4943         /* Passive scanning shouldn't trigger any device found events,
4944          * except for devices marked as CONN_REPORT for which we do send
4945          * device found events.
4946          */
4947         if (hdev->le_scan_type == LE_SCAN_PASSIVE) {
4948                 if (type == LE_ADV_DIRECT_IND)
4949                         return;
4950
4951 #ifndef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Handle all adv packet in platform */
4952                 if (!hci_pend_le_action_lookup(&hdev->pend_le_reports,
4953                                                bdaddr, bdaddr_type))
4954                         return;
4955 #endif
4956
4957                 if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND)
4958                         flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4959                 else
4960                         flags = 0;
4961
4962 #ifdef CONFIG_TIZEN_WIP
4963                 mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4964                                   rssi, flags, data, len, NULL, 0, type);
4965 #else
4966                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4967                                   rssi, flags, data, len, NULL, 0);
4968 #endif
4969                 return;
4970         }
4971
4972         /* When receiving non-connectable or scannable undirected
4973          * advertising reports, this means that the remote device is
4974          * not connectable and then clearly indicate this in the
4975          * device found event.
4976          *
4977          * When receiving a scan response, then there is no way to
4978          * know if the remote device is connectable or not. However
4979          * since scan responses are merged with a previously seen
4980          * advertising report, the flags field from that report
4981          * will be used.
4982          *
4983          * In the really unlikely case that a controller get confused
4984          * and just sends a scan response event, then it is marked as
4985          * not connectable as well.
4986          */
4987         if (type == LE_ADV_NONCONN_IND || type == LE_ADV_SCAN_IND ||
4988             type == LE_ADV_SCAN_RSP)
4989                 flags = MGMT_DEV_FOUND_NOT_CONNECTABLE;
4990         else
4991                 flags = 0;
4992
4993 #ifdef CONFIG_TIZEN_WIP /* TIZEN_Bluetooth :: Disable adv ind and scan rsp merging */
4994         mgmt_le_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
4995                   rssi, flags, data, len, NULL, 0, type);
4996 #else
4997         /* If there's nothing pending either store the data from this
4998          * event or send an immediate device found event if the data
4999          * should not be stored for later.
5000          */
5001         if (!has_pending_adv_report(hdev)) {
5002                 /* If the report will trigger a SCAN_REQ store it for
5003                  * later merging.
5004                  */
5005                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5006                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5007                                                  rssi, flags, data, len);
5008                         return;
5009                 }
5010
5011                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5012                                   rssi, flags, data, len, NULL, 0);
5013                 return;
5014         }
5015
5016         /* Check if the pending report is for the same device as the new one */
5017         match = (!bacmp(bdaddr, &d->last_adv_addr) &&
5018                  bdaddr_type == d->last_adv_addr_type);
5019
5020         /* If the pending data doesn't match this report or this isn't a
5021          * scan response (e.g. we got a duplicate ADV_IND) then force
5022          * sending of the pending data.
5023          */
5024         if (type != LE_ADV_SCAN_RSP || !match) {
5025                 /* Send out whatever is in the cache, but skip duplicates */
5026                 if (!match)
5027                         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5028                                           d->last_adv_addr_type, NULL,
5029                                           d->last_adv_rssi, d->last_adv_flags,
5030                                           d->last_adv_data,
5031                                           d->last_adv_data_len, NULL, 0);
5032
5033                 /* If the new report will trigger a SCAN_REQ store it for
5034                  * later merging.
5035                  */
5036                 if (type == LE_ADV_IND || type == LE_ADV_SCAN_IND) {
5037                         store_pending_adv_report(hdev, bdaddr, bdaddr_type,
5038                                                  rssi, flags, data, len);
5039                         return;
5040                 }
5041
5042                 /* The advertising reports cannot be merged, so clear
5043                  * the pending report and send out a device found event.
5044                  */
5045                 clear_pending_adv_report(hdev);
5046                 mgmt_device_found(hdev, bdaddr, LE_LINK, bdaddr_type, NULL,
5047                                   rssi, flags, data, len, NULL, 0);
5048                 return;
5049         }
5050
5051         /* If we get here we've got a pending ADV_IND or ADV_SCAN_IND and
5052          * the new event is a SCAN_RSP. We can therefore proceed with
5053          * sending a merged device found event.
5054          */
5055         mgmt_device_found(hdev, &d->last_adv_addr, LE_LINK,
5056                           d->last_adv_addr_type, NULL, rssi, d->last_adv_flags,
5057                           d->last_adv_data, d->last_adv_data_len, data, len);
5058         clear_pending_adv_report(hdev);
5059 #endif
5060 }
5061
5062 static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb)
5063 {
5064         u8 num_reports = skb->data[0];
5065         void *ptr = &skb->data[1];
5066
5067         hci_dev_lock(hdev);
5068
5069         while (num_reports--) {
5070                 struct hci_ev_le_advertising_info *ev = ptr;
5071                 s8 rssi;
5072
5073                 rssi = ev->data[ev->length];
5074                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5075                                    ev->bdaddr_type, NULL, 0, rssi,
5076                                    ev->data, ev->length);
5077
5078                 ptr += sizeof(*ev) + ev->length + 1;
5079         }
5080
5081         hci_dev_unlock(hdev);
5082 }
5083
5084 static void hci_le_ltk_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
5085 {
5086         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
5087         struct hci_cp_le_ltk_reply cp;
5088         struct hci_cp_le_ltk_neg_reply neg;
5089         struct hci_conn *conn;
5090         struct smp_ltk *ltk;
5091
5092         BT_DBG("%s handle 0x%4.4x", hdev->name, __le16_to_cpu(ev->handle));
5093
5094         hci_dev_lock(hdev);
5095
5096         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
5097         if (conn == NULL)
5098                 goto not_found;
5099
5100         ltk = hci_find_ltk(hdev, &conn->dst, conn->dst_type, conn->role);
5101         if (!ltk)
5102                 goto not_found;
5103
5104         if (smp_ltk_is_sc(ltk)) {
5105                 /* With SC both EDiv and Rand are set to zero */
5106                 if (ev->ediv || ev->rand)
5107                         goto not_found;
5108         } else {
5109                 /* For non-SC keys check that EDiv and Rand match */
5110                 if (ev->ediv != ltk->ediv || ev->rand != ltk->rand)
5111                         goto not_found;
5112         }
5113
5114         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
5115         cp.handle = cpu_to_le16(conn->handle);
5116
5117         conn->pending_sec_level = smp_ltk_sec_level(ltk);
5118
5119         conn->enc_key_size = ltk->enc_size;
5120
5121         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
5122
5123         /* Ref. Bluetooth Core SPEC pages 1975 and 2004. STK is a
5124          * temporary key used to encrypt a connection following
5125          * pairing. It is used during the Encrypted Session Setup to
5126          * distribute the keys. Later, security can be re-established
5127          * using a distributed LTK.
5128          */
5129         if (ltk->type == SMP_STK) {
5130                 set_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5131                 list_del_rcu(&ltk->list);
5132                 kfree_rcu(ltk, rcu);
5133         } else {
5134                 clear_bit(HCI_CONN_STK_ENCRYPT, &conn->flags);
5135         }
5136
5137         hci_dev_unlock(hdev);
5138
5139         return;
5140
5141 not_found:
5142         neg.handle = ev->handle;
5143         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
5144         hci_dev_unlock(hdev);
5145 }
5146
5147 static void send_conn_param_neg_reply(struct hci_dev *hdev, u16 handle,
5148                                       u8 reason)
5149 {
5150         struct hci_cp_le_conn_param_req_neg_reply cp;
5151
5152         cp.handle = cpu_to_le16(handle);
5153         cp.reason = reason;
5154
5155         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_NEG_REPLY, sizeof(cp),
5156                      &cp);
5157 }
5158
5159 static void hci_le_remote_conn_param_req_evt(struct hci_dev *hdev,
5160                                              struct sk_buff *skb)
5161 {
5162         struct hci_ev_le_remote_conn_param_req *ev = (void *) skb->data;
5163         struct hci_cp_le_conn_param_req_reply cp;
5164         struct hci_conn *hcon;
5165         u16 handle, min, max, latency, timeout;
5166
5167         handle = le16_to_cpu(ev->handle);
5168         min = le16_to_cpu(ev->interval_min);
5169         max = le16_to_cpu(ev->interval_max);
5170         latency = le16_to_cpu(ev->latency);
5171         timeout = le16_to_cpu(ev->timeout);
5172
5173         hcon = hci_conn_hash_lookup_handle(hdev, handle);
5174         if (!hcon || hcon->state != BT_CONNECTED)
5175                 return send_conn_param_neg_reply(hdev, handle,
5176                                                  HCI_ERROR_UNKNOWN_CONN_ID);
5177
5178         if (hci_check_conn_params(min, max, latency, timeout))
5179                 return send_conn_param_neg_reply(hdev, handle,
5180                                                  HCI_ERROR_INVALID_LL_PARAMS);
5181
5182         if (hcon->role == HCI_ROLE_MASTER) {
5183                 struct hci_conn_params *params;
5184                 u8 store_hint;
5185
5186                 hci_dev_lock(hdev);
5187
5188                 params = hci_conn_params_lookup(hdev, &hcon->dst,
5189                                                 hcon->dst_type);
5190                 if (params) {
5191                         params->conn_min_interval = min;
5192                         params->conn_max_interval = max;
5193                         params->conn_latency = latency;
5194                         params->supervision_timeout = timeout;
5195                         store_hint = 0x01;
5196                 } else{
5197                         store_hint = 0x00;
5198                 }
5199
5200                 hci_dev_unlock(hdev);
5201
5202                 mgmt_new_conn_param(hdev, &hcon->dst, hcon->dst_type,
5203                                     store_hint, min, max, latency, timeout);
5204         }
5205
5206         cp.handle = ev->handle;
5207         cp.interval_min = ev->interval_min;
5208         cp.interval_max = ev->interval_max;
5209         cp.latency = ev->latency;
5210         cp.timeout = ev->timeout;
5211         cp.min_ce_len = 0;
5212         cp.max_ce_len = 0;
5213
5214         hci_send_cmd(hdev, HCI_OP_LE_CONN_PARAM_REQ_REPLY, sizeof(cp), &cp);
5215 }
5216
5217 static void hci_le_direct_adv_report_evt(struct hci_dev *hdev,
5218                                          struct sk_buff *skb)
5219 {
5220         u8 num_reports = skb->data[0];
5221         void *ptr = &skb->data[1];
5222
5223         hci_dev_lock(hdev);
5224
5225         while (num_reports--) {
5226                 struct hci_ev_le_direct_adv_info *ev = ptr;
5227
5228                 process_adv_report(hdev, ev->evt_type, &ev->bdaddr,
5229                                    ev->bdaddr_type, &ev->direct_addr,
5230                                    ev->direct_addr_type, ev->rssi, NULL, 0);
5231
5232                 ptr += sizeof(*ev);
5233         }
5234
5235         hci_dev_unlock(hdev);
5236 }
5237
5238 static void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
5239 {
5240         struct hci_ev_le_meta *le_ev = (void *) skb->data;
5241
5242         skb_pull(skb, sizeof(*le_ev));
5243
5244         switch (le_ev->subevent) {
5245         case HCI_EV_LE_CONN_COMPLETE:
5246                 hci_le_conn_complete_evt(hdev, skb);
5247                 break;
5248
5249         case HCI_EV_LE_CONN_UPDATE_COMPLETE:
5250                 hci_le_conn_update_complete_evt(hdev, skb);
5251                 break;
5252
5253         case HCI_EV_LE_ADVERTISING_REPORT:
5254                 hci_le_adv_report_evt(hdev, skb);
5255                 break;
5256
5257         case HCI_EV_LE_LTK_REQ:
5258                 hci_le_ltk_request_evt(hdev, skb);
5259                 break;
5260
5261         case HCI_EV_LE_REMOTE_CONN_PARAM_REQ:
5262                 hci_le_remote_conn_param_req_evt(hdev, skb);
5263                 break;
5264
5265         case HCI_EV_LE_DIRECT_ADV_REPORT:
5266                 hci_le_direct_adv_report_evt(hdev, skb);
5267                 break;
5268
5269         default:
5270                 break;
5271         }
5272 }
5273
5274 static void hci_chan_selected_evt(struct hci_dev *hdev, struct sk_buff *skb)
5275 {
5276         struct hci_ev_channel_selected *ev = (void *) skb->data;
5277         struct hci_conn *hcon;
5278
5279         BT_DBG("%s handle 0x%2.2x", hdev->name, ev->phy_handle);
5280
5281         skb_pull(skb, sizeof(*ev));
5282
5283         hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle);
5284         if (!hcon)
5285                 return;
5286
5287         amp_read_loc_assoc_final_data(hdev, hcon);
5288 }
5289
5290 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
5291 {
5292         struct hci_event_hdr *hdr = (void *) skb->data;
5293         __u8 event = hdr->evt;
5294
5295         hci_dev_lock(hdev);
5296
5297         /* Received events are (currently) only needed when a request is
5298          * ongoing so avoid unnecessary memory allocation.
5299          */
5300         if (hci_req_pending(hdev)) {
5301                 kfree_skb(hdev->recv_evt);
5302                 hdev->recv_evt = skb_clone(skb, GFP_KERNEL);
5303         }
5304
5305         hci_dev_unlock(hdev);
5306
5307         skb_pull(skb, HCI_EVENT_HDR_SIZE);
5308
5309         if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->req.event == event) {
5310                 struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
5311                 u16 opcode = __le16_to_cpu(cmd_hdr->opcode);
5312
5313                 hci_req_cmd_complete(hdev, opcode, 0);
5314         }
5315
5316         switch (event) {
5317         case HCI_EV_INQUIRY_COMPLETE:
5318                 hci_inquiry_complete_evt(hdev, skb);
5319                 break;
5320
5321         case HCI_EV_INQUIRY_RESULT:
5322                 hci_inquiry_result_evt(hdev, skb);
5323                 break;
5324
5325         case HCI_EV_CONN_COMPLETE:
5326                 hci_conn_complete_evt(hdev, skb);
5327                 break;
5328
5329         case HCI_EV_CONN_REQUEST:
5330                 hci_conn_request_evt(hdev, skb);
5331                 break;
5332
5333         case HCI_EV_DISCONN_COMPLETE:
5334                 hci_disconn_complete_evt(hdev, skb);
5335                 break;
5336
5337         case HCI_EV_AUTH_COMPLETE:
5338                 hci_auth_complete_evt(hdev, skb);
5339                 break;
5340
5341         case HCI_EV_REMOTE_NAME:
5342                 hci_remote_name_evt(hdev, skb);
5343                 break;
5344
5345         case HCI_EV_ENCRYPT_CHANGE:
5346                 hci_encrypt_change_evt(hdev, skb);
5347                 break;
5348
5349         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
5350                 hci_change_link_key_complete_evt(hdev, skb);
5351                 break;
5352
5353         case HCI_EV_REMOTE_FEATURES:
5354                 hci_remote_features_evt(hdev, skb);
5355                 break;
5356
5357         case HCI_EV_CMD_COMPLETE:
5358                 hci_cmd_complete_evt(hdev, skb);
5359                 break;
5360
5361         case HCI_EV_CMD_STATUS:
5362                 hci_cmd_status_evt(hdev, skb);
5363                 break;
5364
5365         case HCI_EV_HARDWARE_ERROR:
5366                 hci_hardware_error_evt(hdev, skb);
5367                 break;
5368
5369         case HCI_EV_ROLE_CHANGE:
5370                 hci_role_change_evt(hdev, skb);
5371                 break;
5372
5373         case HCI_EV_NUM_COMP_PKTS:
5374                 hci_num_comp_pkts_evt(hdev, skb);
5375                 break;
5376
5377         case HCI_EV_MODE_CHANGE:
5378                 hci_mode_change_evt(hdev, skb);
5379                 break;
5380
5381         case HCI_EV_PIN_CODE_REQ:
5382                 hci_pin_code_request_evt(hdev, skb);
5383                 break;
5384
5385         case HCI_EV_LINK_KEY_REQ:
5386                 hci_link_key_request_evt(hdev, skb);
5387                 break;
5388
5389         case HCI_EV_LINK_KEY_NOTIFY:
5390                 hci_link_key_notify_evt(hdev, skb);
5391                 break;
5392
5393         case HCI_EV_CLOCK_OFFSET:
5394                 hci_clock_offset_evt(hdev, skb);
5395                 break;
5396
5397         case HCI_EV_PKT_TYPE_CHANGE:
5398                 hci_pkt_type_change_evt(hdev, skb);
5399                 break;
5400
5401         case HCI_EV_PSCAN_REP_MODE:
5402                 hci_pscan_rep_mode_evt(hdev, skb);
5403                 break;
5404
5405         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
5406                 hci_inquiry_result_with_rssi_evt(hdev, skb);
5407                 break;
5408
5409         case HCI_EV_REMOTE_EXT_FEATURES:
5410                 hci_remote_ext_features_evt(hdev, skb);
5411                 break;
5412
5413         case HCI_EV_SYNC_CONN_COMPLETE:
5414                 hci_sync_conn_complete_evt(hdev, skb);
5415                 break;
5416
5417         case HCI_EV_EXTENDED_INQUIRY_RESULT:
5418                 hci_extended_inquiry_result_evt(hdev, skb);
5419                 break;
5420
5421         case HCI_EV_KEY_REFRESH_COMPLETE:
5422                 hci_key_refresh_complete_evt(hdev, skb);
5423                 break;
5424
5425         case HCI_EV_IO_CAPA_REQUEST:
5426                 hci_io_capa_request_evt(hdev, skb);
5427                 break;
5428
5429         case HCI_EV_IO_CAPA_REPLY:
5430                 hci_io_capa_reply_evt(hdev, skb);
5431                 break;
5432
5433         case HCI_EV_USER_CONFIRM_REQUEST:
5434                 hci_user_confirm_request_evt(hdev, skb);
5435                 break;
5436
5437         case HCI_EV_USER_PASSKEY_REQUEST:
5438                 hci_user_passkey_request_evt(hdev, skb);
5439                 break;
5440
5441         case HCI_EV_USER_PASSKEY_NOTIFY:
5442                 hci_user_passkey_notify_evt(hdev, skb);
5443                 break;
5444
5445         case HCI_EV_KEYPRESS_NOTIFY:
5446                 hci_keypress_notify_evt(hdev, skb);
5447                 break;
5448
5449         case HCI_EV_SIMPLE_PAIR_COMPLETE:
5450                 hci_simple_pair_complete_evt(hdev, skb);
5451                 break;
5452
5453         case HCI_EV_REMOTE_HOST_FEATURES:
5454                 hci_remote_host_features_evt(hdev, skb);
5455                 break;
5456
5457         case HCI_EV_LE_META:
5458                 hci_le_meta_evt(hdev, skb);
5459                 break;
5460
5461         case HCI_EV_CHANNEL_SELECTED:
5462                 hci_chan_selected_evt(hdev, skb);
5463                 break;
5464
5465         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
5466                 hci_remote_oob_data_request_evt(hdev, skb);
5467                 break;
5468
5469         case HCI_EV_PHY_LINK_COMPLETE:
5470                 hci_phy_link_complete_evt(hdev, skb);
5471                 break;
5472
5473         case HCI_EV_LOGICAL_LINK_COMPLETE:
5474                 hci_loglink_complete_evt(hdev, skb);
5475                 break;
5476
5477         case HCI_EV_DISCONN_LOGICAL_LINK_COMPLETE:
5478                 hci_disconn_loglink_complete_evt(hdev, skb);
5479                 break;
5480
5481         case HCI_EV_DISCONN_PHY_LINK_COMPLETE:
5482                 hci_disconn_phylink_complete_evt(hdev, skb);
5483                 break;
5484
5485         case HCI_EV_NUM_COMP_BLOCKS:
5486                 hci_num_comp_blocks_evt(hdev, skb);
5487                 break;
5488
5489 #ifdef CONFIG_TIZEN_WIP
5490         case HCI_EV_VENDOR_SPECIFIC:
5491                 hci_vendor_specific_evt(hdev, skb);
5492                 break;
5493 #endif
5494
5495         default:
5496                 BT_DBG("%s event 0x%2.2x", hdev->name, event);
5497                 break;
5498         }
5499
5500         kfree_skb(skb);
5501         hdev->stat.evt_rx++;
5502 }