net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status)
  59                 return;
  60
  61         clear_bit(HCI_INQUIRY, &hdev->flags);
  62
  63         mgmt_discovering(hdev->id, 0);
  64
  65         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  66
  67         hci_conn_check_pending(hdev);
  68 }
  69
  70 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  71 {
  72         __u8 status = *((__u8 *) skb->data);
  73
  74         BT_DBG("%s status 0x%x", hdev->name, status);
  75
  76         if (status)
  77                 return;
  78
  79         hci_conn_check_pending(hdev);
  80 }
  81
  82 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  83 {
  84         BT_DBG("%s", hdev->name);
  85 }
  86
  87 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  88 {
  89         struct hci_rp_role_discovery *rp = (void *) skb->data;
  90         struct hci_conn *conn;
  91
  92         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  93
  94         if (rp->status)
  95                 return;
  96
  97         hci_dev_lock(hdev);
  98
  99         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 100         if (conn) {
 101                 if (rp->role)
 102                         conn->link_mode &= ~HCI_LM_MASTER;
 103                 else
 104                         conn->link_mode |= HCI_LM_MASTER;
 105         }
 106
 107         hci_dev_unlock(hdev);
 108 }
 109
 110 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 111 {
 112         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 113         struct hci_conn *conn;
 114
 115         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 116
 117         if (rp->status)
 118                 return;
 119
 120         hci_dev_lock(hdev);
 121
 122         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 123         if (conn)
 124                 conn->link_policy = __le16_to_cpu(rp->policy);
 125
 126         hci_dev_unlock(hdev);
 127 }
 128
 129 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 130 {
 131         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 132         struct hci_conn *conn;
 133         void *sent;
 134
 135         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 136
 137         if (rp->status)
 138                 return;
 139
 140         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 141         if (!sent)
 142                 return;
 143
 144         hci_dev_lock(hdev);
 145
 146         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 147         if (conn)
 148                 conn->link_policy = get_unaligned_le16(sent + 2);
 149
 150         hci_dev_unlock(hdev);
 151 }
 152
 153 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 154 {
 155         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 156
 157         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 158
 159         if (rp->status)
 160                 return;
 161
 162         hdev->link_policy = __le16_to_cpu(rp->policy);
 163 }
 164
 165 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 166 {
 167         __u8 status = *((__u8 *) skb->data);
 168         void *sent;
 169
 170         BT_DBG("%s status 0x%x", hdev->name, status);
 171
 172         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 173         if (!sent)
 174                 return;
 175
 176         if (!status)
 177                 hdev->link_policy = get_unaligned_le16(sent);
 178
 179         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 180 }
 181
 182 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 183 {
 184         __u8 status = *((__u8 *) skb->data);
 185
 186         BT_DBG("%s status 0x%x", hdev->name, status);
 187
 188         clear_bit(HCI_RESET, &hdev->flags);
 189
 190         hci_req_complete(hdev, HCI_OP_RESET, status);
 191 }
 192
 193 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 194 {
 195         __u8 status = *((__u8 *) skb->data);
 196         void *sent;
 197
 198         BT_DBG("%s status 0x%x", hdev->name, status);
 199
 200         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 201         if (!sent)
 202                 return;
 203
 204         if (test_bit(HCI_MGMT, &hdev->flags))
 205                 mgmt_set_local_name_complete(hdev->id, sent, status);
 206
 207         if (status)
 208                 return;
 209
 210         memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 211 }
 212
 213 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 214 {
 215         struct hci_rp_read_local_name *rp = (void *) skb->data;
 216
 217         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 218
 219         if (rp->status)
 220                 return;
 221
 222         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 223 }
 224
 225 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 226 {
 227         __u8 status = *((__u8 *) skb->data);
 228         void *sent;
 229
 230         BT_DBG("%s status 0x%x", hdev->name, status);
 231
 232         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 233         if (!sent)
 234                 return;
 235
 236         if (!status) {
 237                 __u8 param = *((__u8 *) sent);
 238
 239                 if (param == AUTH_ENABLED)
 240                         set_bit(HCI_AUTH, &hdev->flags);
 241                 else
 242                         clear_bit(HCI_AUTH, &hdev->flags);
 243         }
 244
 245         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 246 }
 247
 248 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 249 {
 250         __u8 status = *((__u8 *) skb->data);
 251         void *sent;
 252
 253         BT_DBG("%s status 0x%x", hdev->name, status);
 254
 255         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 256         if (!sent)
 257                 return;
 258
 259         if (!status) {
 260                 __u8 param = *((__u8 *) sent);
 261
 262                 if (param)
 263                         set_bit(HCI_ENCRYPT, &hdev->flags);
 264                 else
 265                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 266         }
 267
 268         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 269 }
 270
 271 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 272 {
 273         __u8 param, status = *((__u8 *) skb->data);
 274         int old_pscan, old_iscan;
 275         void *sent;
 276
 277         BT_DBG("%s status 0x%x", hdev->name, status);
 278
 279         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 280         if (!sent)
 281                 return;
 282
 283         param = *((__u8 *) sent);
 284
 285         if (status != 0) {
 286                 mgmt_write_scan_failed(hdev->id, param, status);
 287                 hdev->discov_timeout = 0;
 288                 goto done;
 289         }
 290
 291         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 292         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 293
 294         if (param & SCAN_INQUIRY) {
 295                 set_bit(HCI_ISCAN, &hdev->flags);
 296                 if (!old_iscan)
 297                         mgmt_discoverable(hdev->id, 1);
 298                 if (hdev->discov_timeout > 0) {
 299                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 300                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 301                                                                         to);
 302                 }
 303         } else if (old_iscan)
 304                 mgmt_discoverable(hdev->id, 0);
 305
 306         if (param & SCAN_PAGE) {
 307                 set_bit(HCI_PSCAN, &hdev->flags);
 308                 if (!old_pscan)
 309                         mgmt_connectable(hdev->id, 1);
 310         } else if (old_pscan)
 311                 mgmt_connectable(hdev->id, 0);
 312
 313 done:
 314         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 315 }
 316
 317 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 318 {
 319         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 320
 321         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 322
 323         if (rp->status)
 324                 return;
 325
 326         memcpy(hdev->dev_class, rp->dev_class, 3);
 327
 328         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 329                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 330 }
 331
 332 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 333 {
 334         __u8 status = *((__u8 *) skb->data);
 335         void *sent;
 336
 337         BT_DBG("%s status 0x%x", hdev->name, status);
 338
 339         if (status)
 340                 return;
 341
 342         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 343         if (!sent)
 344                 return;
 345
 346         memcpy(hdev->dev_class, sent, 3);
 347 }
 348
 349 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 350 {
 351         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 352         __u16 setting;
 353
 354         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 355
 356         if (rp->status)
 357                 return;
 358
 359         setting = __le16_to_cpu(rp->voice_setting);
 360
 361         if (hdev->voice_setting == setting)
 362                 return;
 363
 364         hdev->voice_setting = setting;
 365
 366         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 367
 368         if (hdev->notify) {
 369                 tasklet_disable(&hdev->tx_task);
 370                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 371                 tasklet_enable(&hdev->tx_task);
 372         }
 373 }
 374
 375 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 376 {
 377         __u8 status = *((__u8 *) skb->data);
 378         __u16 setting;
 379         void *sent;
 380
 381         BT_DBG("%s status 0x%x", hdev->name, status);
 382
 383         if (status)
 384                 return;
 385
 386         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 387         if (!sent)
 388                 return;
 389
 390         setting = get_unaligned_le16(sent);
 391
 392         if (hdev->voice_setting == setting)
 393                 return;
 394
 395         hdev->voice_setting = setting;
 396
 397         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 398
 399         if (hdev->notify) {
 400                 tasklet_disable(&hdev->tx_task);
 401                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 402                 tasklet_enable(&hdev->tx_task);
 403         }
 404 }
 405
 406 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 407 {
 408         __u8 status = *((__u8 *) skb->data);
 409
 410         BT_DBG("%s status 0x%x", hdev->name, status);
 411
 412         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 413 }
 414
 415 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 416 {
 417         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 418
 419         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 420
 421         if (rp->status)
 422                 return;
 423
 424         hdev->ssp_mode = rp->mode;
 425 }
 426
 427 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 428 {
 429         __u8 status = *((__u8 *) skb->data);
 430         void *sent;
 431
 432         BT_DBG("%s status 0x%x", hdev->name, status);
 433
 434         if (status)
 435                 return;
 436
 437         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 438         if (!sent)
 439                 return;
 440
 441         hdev->ssp_mode = *((__u8 *) sent);
 442 }
 443
 444 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 445 {
 446         if (hdev->features[6] & LMP_EXT_INQ)
 447                 return 2;
 448
 449         if (hdev->features[3] & LMP_RSSI_INQ)
 450                 return 1;
 451
 452         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 453                                                 hdev->lmp_subver == 0x0757)
 454                 return 1;
 455
 456         if (hdev->manufacturer == 15) {
 457                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 458                         return 1;
 459                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 460                         return 1;
 461                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 462                         return 1;
 463         }
 464
 465         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 466                                                 hdev->lmp_subver == 0x1805)
 467                 return 1;
 468
 469         return 0;
 470 }
 471
 472 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 473 {
 474         u8 mode;
 475
 476         mode = hci_get_inquiry_mode(hdev);
 477
 478         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 479 }
 480
 481 static void hci_setup_event_mask(struct hci_dev *hdev)
 482 {
 483         /* The second byte is 0xff instead of 0x9f (two reserved bits
 484          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 485          * command otherwise */
 486         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 487
 488         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 489          * any event mask for pre 1.2 devices */
 490         if (hdev->lmp_ver <= 1)
 491                 return;
 492
 493         events[4] |= 0x01; /* Flow Specification Complete */
 494         events[4] |= 0x02; /* Inquiry Result with RSSI */
 495         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 496         events[5] |= 0x08; /* Synchronous Connection Complete */
 497         events[5] |= 0x10; /* Synchronous Connection Changed */
 498
 499         if (hdev->features[3] & LMP_RSSI_INQ)
 500                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 501
 502         if (hdev->features[5] & LMP_SNIFF_SUBR)
 503                 events[5] |= 0x20; /* Sniff Subrating */
 504
 505         if (hdev->features[5] & LMP_PAUSE_ENC)
 506                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 507
 508         if (hdev->features[6] & LMP_EXT_INQ)
 509                 events[5] |= 0x40; /* Extended Inquiry Result */
 510
 511         if (hdev->features[6] & LMP_NO_FLUSH)
 512                 events[7] |= 0x01; /* Enhanced Flush Complete */
 513
 514         if (hdev->features[7] & LMP_LSTO)
 515                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 516
 517         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 518                 events[6] |= 0x01;      /* IO Capability Request */
 519                 events[6] |= 0x02;      /* IO Capability Response */
 520                 events[6] |= 0x04;      /* User Confirmation Request */
 521                 events[6] |= 0x08;      /* User Passkey Request */
 522                 events[6] |= 0x10;      /* Remote OOB Data Request */
 523                 events[6] |= 0x20;      /* Simple Pairing Complete */
 524                 events[7] |= 0x04;      /* User Passkey Notification */
 525                 events[7] |= 0x08;      /* Keypress Notification */
 526                 events[7] |= 0x10;      /* Remote Host Supported
 527                                          * Features Notification */
 528         }
 529
 530         if (hdev->features[4] & LMP_LE)
 531                 events[7] |= 0x20;      /* LE Meta-Event */
 532
 533         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 534 }
 535
 536 static void hci_set_le_support(struct hci_dev *hdev)
 537 {
 538         struct hci_cp_write_le_host_supported cp;
 539
 540         memset(&cp, 0, sizeof(cp));
 541
 542         if (enable_le) {
 543                 cp.le = 1;
 544                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 545         }
 546
 547         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 548 }
 549
 550 static void hci_setup(struct hci_dev *hdev)
 551 {
 552         hci_setup_event_mask(hdev);
 553
 554         if (hdev->lmp_ver > 1)
 555                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 556
 557         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 558                 u8 mode = 0x01;
 559                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 560         }
 561
 562         if (hdev->features[3] & LMP_RSSI_INQ)
 563                 hci_setup_inquiry_mode(hdev);
 564
 565         if (hdev->features[7] & LMP_INQ_TX_PWR)
 566                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 567
 568         if (hdev->features[7] & LMP_EXTFEATURES) {
 569                 struct hci_cp_read_local_ext_features cp;
 570
 571                 cp.page = 0x01;
 572                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 573                                                         sizeof(cp), &cp);
 574         }
 575
 576         if (hdev->features[4] & LMP_LE)
 577                 hci_set_le_support(hdev);
 578 }
 579
 580 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 581 {
 582         struct hci_rp_read_local_version *rp = (void *) skb->data;
 583
 584         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 585
 586         if (rp->status)
 587                 return;
 588
 589         hdev->hci_ver = rp->hci_ver;
 590         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 591         hdev->lmp_ver = rp->lmp_ver;
 592         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 593         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 594
 595         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 596                                         hdev->manufacturer,
 597                                         hdev->hci_ver, hdev->hci_rev);
 598
 599         if (test_bit(HCI_INIT, &hdev->flags))
 600                 hci_setup(hdev);
 601 }
 602
 603 static void hci_setup_link_policy(struct hci_dev *hdev)
 604 {
 605         u16 link_policy = 0;
 606
 607         if (hdev->features[0] & LMP_RSWITCH)
 608                 link_policy |= HCI_LP_RSWITCH;
 609         if (hdev->features[0] & LMP_HOLD)
 610                 link_policy |= HCI_LP_HOLD;
 611         if (hdev->features[0] & LMP_SNIFF)
 612                 link_policy |= HCI_LP_SNIFF;
 613         if (hdev->features[1] & LMP_PARK)
 614                 link_policy |= HCI_LP_PARK;
 615
 616         link_policy = cpu_to_le16(link_policy);
 617         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 618                                         sizeof(link_policy), &link_policy);
 619 }
 620
 621 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 622 {
 623         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 624
 625         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 626
 627         if (rp->status)
 628                 goto done;
 629
 630         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 631
 632         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 633                 hci_setup_link_policy(hdev);
 634
 635 done:
 636         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 637 }
 638
 639 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 640 {
 641         struct hci_rp_read_local_features *rp = (void *) skb->data;
 642
 643         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 644
 645         if (rp->status)
 646                 return;
 647
 648         memcpy(hdev->features, rp->features, 8);
 649
 650         /* Adjust default settings according to features
 651          * supported by device. */
 652
 653         if (hdev->features[0] & LMP_3SLOT)
 654                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 655
 656         if (hdev->features[0] & LMP_5SLOT)
 657                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 658
 659         if (hdev->features[1] & LMP_HV2) {
 660                 hdev->pkt_type  |= (HCI_HV2);
 661                 hdev->esco_type |= (ESCO_HV2);
 662         }
 663
 664         if (hdev->features[1] & LMP_HV3) {
 665                 hdev->pkt_type  |= (HCI_HV3);
 666                 hdev->esco_type |= (ESCO_HV3);
 667         }
 668
 669         if (hdev->features[3] & LMP_ESCO)
 670                 hdev->esco_type |= (ESCO_EV3);
 671
 672         if (hdev->features[4] & LMP_EV4)
 673                 hdev->esco_type |= (ESCO_EV4);
 674
 675         if (hdev->features[4] & LMP_EV5)
 676                 hdev->esco_type |= (ESCO_EV5);
 677
 678         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 679                 hdev->esco_type |= (ESCO_2EV3);
 680
 681         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 682                 hdev->esco_type |= (ESCO_3EV3);
 683
 684         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 685                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 686
 687         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 688                                         hdev->features[0], hdev->features[1],
 689                                         hdev->features[2], hdev->features[3],
 690                                         hdev->features[4], hdev->features[5],
 691                                         hdev->features[6], hdev->features[7]);
 692 }
 693
 694 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 695                                                         struct sk_buff *skb)
 696 {
 697         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 698
 699         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 700
 701         if (rp->status)
 702                 return;
 703
 704         memcpy(hdev->extfeatures, rp->features, 8);
 705
 706         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 707 }
 708
 709 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 710 {
 711         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 712
 713         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 714
 715         if (rp->status)
 716                 return;
 717
 718         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 719         hdev->sco_mtu  = rp->sco_mtu;
 720         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 721         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 722
 723         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 724                 hdev->sco_mtu  = 64;
 725                 hdev->sco_pkts = 8;
 726         }
 727
 728         hdev->acl_cnt = hdev->acl_pkts;
 729         hdev->sco_cnt = hdev->sco_pkts;
 730
 731         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 732                                         hdev->acl_mtu, hdev->acl_pkts,
 733                                         hdev->sco_mtu, hdev->sco_pkts);
 734 }
 735
 736 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 737 {
 738         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 739
 740         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 741
 742         if (!rp->status)
 743                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 744
 745         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 746 }
 747
 748 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 749 {
 750         __u8 status = *((__u8 *) skb->data);
 751
 752         BT_DBG("%s status 0x%x", hdev->name, status);
 753
 754         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 755 }
 756
 757 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 758                 struct sk_buff *skb)
 759 {
 760         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 761
 762         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 763
 764         if (rp->status)
 765                 return;
 766
 767         hdev->amp_status = rp->amp_status;
 768         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 769         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 770         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 771         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 772         hdev->amp_type = rp->amp_type;
 773         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 774         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 775         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 776         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 777
 778         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 779 }
 780
 781 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 782                                                         struct sk_buff *skb)
 783 {
 784         __u8 status = *((__u8 *) skb->data);
 785
 786         BT_DBG("%s status 0x%x", hdev->name, status);
 787
 788         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 789 }
 790
 791 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 792 {
 793         __u8 status = *((__u8 *) skb->data);
 794
 795         BT_DBG("%s status 0x%x", hdev->name, status);
 796
 797         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 798 }
 799
 800 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 801                                                         struct sk_buff *skb)
 802 {
 803         __u8 status = *((__u8 *) skb->data);
 804
 805         BT_DBG("%s status 0x%x", hdev->name, status);
 806
 807         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 808 }
 809
 810 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 811                                                         struct sk_buff *skb)
 812 {
 813         __u8 status = *((__u8 *) skb->data);
 814
 815         BT_DBG("%s status 0x%x", hdev->name, status);
 816
 817         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 818 }
 819
 820 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 821 {
 822         __u8 status = *((__u8 *) skb->data);
 823
 824         BT_DBG("%s status 0x%x", hdev->name, status);
 825
 826         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 827 }
 828
 829 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 830 {
 831         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 832         struct hci_cp_pin_code_reply *cp;
 833         struct hci_conn *conn;
 834
 835         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 836
 837         if (test_bit(HCI_MGMT, &hdev->flags))
 838                 mgmt_pin_code_reply_complete(hdev->id, &rp->bdaddr, rp->status);
 839
 840         if (rp->status != 0)
 841                 return;
 842
 843         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 844         if (!cp)
 845                 return;
 846
 847         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 848         if (conn)
 849                 conn->pin_length = cp->pin_len;
 850 }
 851
 852 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 853 {
 854         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 855
 856         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 857
 858         if (test_bit(HCI_MGMT, &hdev->flags))
 859                 mgmt_pin_code_neg_reply_complete(hdev->id, &rp->bdaddr,
 860                                                                 rp->status);
 861 }
 862 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 863                                        struct sk_buff *skb)
 864 {
 865         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 866
 867         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 868
 869         if (rp->status)
 870                 return;
 871
 872         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 873         hdev->le_pkts = rp->le_max_pkt;
 874
 875         hdev->le_cnt = hdev->le_pkts;
 876
 877         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 878
 879         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 880 }
 881
 882 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 883 {
 884         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 885
 886         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 887
 888         if (test_bit(HCI_MGMT, &hdev->flags))
 889                 mgmt_user_confirm_reply_complete(hdev->id, &rp->bdaddr,
 890                                                                 rp->status);
 891 }
 892
 893 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 894                                                         struct sk_buff *skb)
 895 {
 896         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 897
 898         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 899
 900         if (test_bit(HCI_MGMT, &hdev->flags))
 901                 mgmt_user_confirm_neg_reply_complete(hdev->id, &rp->bdaddr,
 902                                                                 rp->status);
 903 }
 904
 905 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
 906                                                         struct sk_buff *skb)
 907 {
 908         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
 909
 910         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 911
 912         mgmt_read_local_oob_data_reply_complete(hdev->id, rp->hash,
 913                                                 rp->randomizer, rp->status);
 914 }
 915
 916 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
 917                                         struct sk_buff *skb)
 918 {
 919         struct hci_cp_le_set_scan_enable *cp;
 920         __u8 status = *((__u8 *) skb->data);
 921
 922         BT_DBG("%s status 0x%x", hdev->name, status);
 923
 924         if (status)
 925                 return;
 926
 927         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
 928         if (!cp)
 929                 return;
 930
 931         if (cp->enable == 0x01) {
 932                 del_timer(&hdev->adv_timer);
 933
 934                 hci_dev_lock(hdev);
 935                 hci_adv_entries_clear(hdev);
 936                 hci_dev_unlock(hdev);
 937         } else if (cp->enable == 0x00) {
 938                 mod_timer(&hdev->adv_timer, jiffies + ADV_CLEAR_TIMEOUT);
 939         }
 940 }
 941
 942 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
 943 {
 944         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
 945
 946         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 947
 948         if (rp->status)
 949                 return;
 950
 951         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
 952 }
 953
 954 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 955 {
 956         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
 957
 958         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 959
 960         if (rp->status)
 961                 return;
 962
 963         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
 964 }
 965
 966 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
 967                                                         struct sk_buff *skb)
 968 {
 969         struct hci_cp_read_local_ext_features cp;
 970         __u8 status = *((__u8 *) skb->data);
 971
 972         BT_DBG("%s status 0x%x", hdev->name, status);
 973
 974         if (status)
 975                 return;
 976
 977         cp.page = 0x01;
 978         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
 979 }
 980
 981 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
 982 {
 983         BT_DBG("%s status 0x%x", hdev->name, status);
 984
 985         if (status) {
 986                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
 987                 hci_conn_check_pending(hdev);
 988                 if (test_bit(HCI_MGMT, &hdev->flags))
 989                         mgmt_inquiry_failed(hdev->id, status);
 990                 return;
 991         }
 992
 993         set_bit(HCI_INQUIRY, &hdev->flags);
 994
 995         mgmt_discovering(hdev->id, 1);
 996 }
 997
 998 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
 999 {
1000         struct hci_cp_create_conn *cp;
1001         struct hci_conn *conn;
1002
1003         BT_DBG("%s status 0x%x", hdev->name, status);
1004
1005         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1006         if (!cp)
1007                 return;
1008
1009         hci_dev_lock(hdev);
1010
1011         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1012
1013         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1014
1015         if (status) {
1016                 if (conn && conn->state == BT_CONNECT) {
1017                         if (status != 0x0c || conn->attempt > 2) {
1018                                 conn->state = BT_CLOSED;
1019                                 hci_proto_connect_cfm(conn, status);
1020                                 hci_conn_del(conn);
1021                         } else
1022                                 conn->state = BT_CONNECT2;
1023                 }
1024         } else {
1025                 if (!conn) {
1026                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1027                         if (conn) {
1028                                 conn->out = 1;
1029                                 conn->link_mode |= HCI_LM_MASTER;
1030                         } else
1031                                 BT_ERR("No memory for new connection");
1032                 }
1033         }
1034
1035         hci_dev_unlock(hdev);
1036 }
1037
1038 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1039 {
1040         struct hci_cp_add_sco *cp;
1041         struct hci_conn *acl, *sco;
1042         __u16 handle;
1043
1044         BT_DBG("%s status 0x%x", hdev->name, status);
1045
1046         if (!status)
1047                 return;
1048
1049         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1050         if (!cp)
1051                 return;
1052
1053         handle = __le16_to_cpu(cp->handle);
1054
1055         BT_DBG("%s handle %d", hdev->name, handle);
1056
1057         hci_dev_lock(hdev);
1058
1059         acl = hci_conn_hash_lookup_handle(hdev, handle);
1060         if (acl) {
1061                 sco = acl->link;
1062                 if (sco) {
1063                         sco->state = BT_CLOSED;
1064
1065                         hci_proto_connect_cfm(sco, status);
1066                         hci_conn_del(sco);
1067                 }
1068         }
1069
1070         hci_dev_unlock(hdev);
1071 }
1072
1073 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1074 {
1075         struct hci_cp_auth_requested *cp;
1076         struct hci_conn *conn;
1077
1078         BT_DBG("%s status 0x%x", hdev->name, status);
1079
1080         if (!status)
1081                 return;
1082
1083         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1084         if (!cp)
1085                 return;
1086
1087         hci_dev_lock(hdev);
1088
1089         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1090         if (conn) {
1091                 if (conn->state == BT_CONFIG) {
1092                         hci_proto_connect_cfm(conn, status);
1093                         hci_conn_put(conn);
1094                 }
1095         }
1096
1097         hci_dev_unlock(hdev);
1098 }
1099
1100 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1101 {
1102         struct hci_cp_set_conn_encrypt *cp;
1103         struct hci_conn *conn;
1104
1105         BT_DBG("%s status 0x%x", hdev->name, status);
1106
1107         if (!status)
1108                 return;
1109
1110         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1111         if (!cp)
1112                 return;
1113
1114         hci_dev_lock(hdev);
1115
1116         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1117         if (conn) {
1118                 if (conn->state == BT_CONFIG) {
1119                         hci_proto_connect_cfm(conn, status);
1120                         hci_conn_put(conn);
1121                 }
1122         }
1123
1124         hci_dev_unlock(hdev);
1125 }
1126
1127 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1128                                                         struct hci_conn *conn)
1129 {
1130         if (conn->state != BT_CONFIG || !conn->out)
1131                 return 0;
1132
1133         if (conn->pending_sec_level == BT_SECURITY_SDP)
1134                 return 0;
1135
1136         /* Only request authentication for SSP connections or non-SSP
1137          * devices with sec_level HIGH or if MITM protection is requested */
1138         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1139                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1140                                 !(conn->auth_type & 0x01))
1141                 return 0;
1142
1143         return 1;
1144 }
1145
1146 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1147 {
1148         struct hci_cp_remote_name_req *cp;
1149         struct hci_conn *conn;
1150
1151         BT_DBG("%s status 0x%x", hdev->name, status);
1152
1153         /* If successful wait for the name req complete event before
1154          * checking for the need to do authentication */
1155         if (!status)
1156                 return;
1157
1158         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1159         if (!cp)
1160                 return;
1161
1162         hci_dev_lock(hdev);
1163
1164         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1165         if (!conn)
1166                 goto unlock;
1167
1168         if (!hci_outgoing_auth_needed(hdev, conn))
1169                 goto unlock;
1170
1171         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1172                 struct hci_cp_auth_requested cp;
1173                 cp.handle = __cpu_to_le16(conn->handle);
1174                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1175         }
1176
1177 unlock:
1178         hci_dev_unlock(hdev);
1179 }
1180
1181 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1182 {
1183         struct hci_cp_read_remote_features *cp;
1184         struct hci_conn *conn;
1185
1186         BT_DBG("%s status 0x%x", hdev->name, status);
1187
1188         if (!status)
1189                 return;
1190
1191         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1192         if (!cp)
1193                 return;
1194
1195         hci_dev_lock(hdev);
1196
1197         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1198         if (conn) {
1199                 if (conn->state == BT_CONFIG) {
1200                         hci_proto_connect_cfm(conn, status);
1201                         hci_conn_put(conn);
1202                 }
1203         }
1204
1205         hci_dev_unlock(hdev);
1206 }
1207
1208 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1209 {
1210         struct hci_cp_read_remote_ext_features *cp;
1211         struct hci_conn *conn;
1212
1213         BT_DBG("%s status 0x%x", hdev->name, status);
1214
1215         if (!status)
1216                 return;
1217
1218         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1219         if (!cp)
1220                 return;
1221
1222         hci_dev_lock(hdev);
1223
1224         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1225         if (conn) {
1226                 if (conn->state == BT_CONFIG) {
1227                         hci_proto_connect_cfm(conn, status);
1228                         hci_conn_put(conn);
1229                 }
1230         }
1231
1232         hci_dev_unlock(hdev);
1233 }
1234
1235 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1236 {
1237         struct hci_cp_setup_sync_conn *cp;
1238         struct hci_conn *acl, *sco;
1239         __u16 handle;
1240
1241         BT_DBG("%s status 0x%x", hdev->name, status);
1242
1243         if (!status)
1244                 return;
1245
1246         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1247         if (!cp)
1248                 return;
1249
1250         handle = __le16_to_cpu(cp->handle);
1251
1252         BT_DBG("%s handle %d", hdev->name, handle);
1253
1254         hci_dev_lock(hdev);
1255
1256         acl = hci_conn_hash_lookup_handle(hdev, handle);
1257         if (acl) {
1258                 sco = acl->link;
1259                 if (sco) {
1260                         sco->state = BT_CLOSED;
1261
1262                         hci_proto_connect_cfm(sco, status);
1263                         hci_conn_del(sco);
1264                 }
1265         }
1266
1267         hci_dev_unlock(hdev);
1268 }
1269
1270 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1271 {
1272         struct hci_cp_sniff_mode *cp;
1273         struct hci_conn *conn;
1274
1275         BT_DBG("%s status 0x%x", hdev->name, status);
1276
1277         if (!status)
1278                 return;
1279
1280         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1281         if (!cp)
1282                 return;
1283
1284         hci_dev_lock(hdev);
1285
1286         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1287         if (conn) {
1288                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1289
1290                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1291                         hci_sco_setup(conn, status);
1292         }
1293
1294         hci_dev_unlock(hdev);
1295 }
1296
1297 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1298 {
1299         struct hci_cp_exit_sniff_mode *cp;
1300         struct hci_conn *conn;
1301
1302         BT_DBG("%s status 0x%x", hdev->name, status);
1303
1304         if (!status)
1305                 return;
1306
1307         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1308         if (!cp)
1309                 return;
1310
1311         hci_dev_lock(hdev);
1312
1313         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1314         if (conn) {
1315                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1316
1317                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1318                         hci_sco_setup(conn, status);
1319         }
1320
1321         hci_dev_unlock(hdev);
1322 }
1323
1324 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1325 {
1326         struct hci_cp_le_create_conn *cp;
1327         struct hci_conn *conn;
1328
1329         BT_DBG("%s status 0x%x", hdev->name, status);
1330
1331         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1332         if (!cp)
1333                 return;
1334
1335         hci_dev_lock(hdev);
1336
1337         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1338
1339         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1340                 conn);
1341
1342         if (status) {
1343                 if (conn && conn->state == BT_CONNECT) {
1344                         conn->state = BT_CLOSED;
1345                         hci_proto_connect_cfm(conn, status);
1346                         hci_conn_del(conn);
1347                 }
1348         } else {
1349                 if (!conn) {
1350                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1351                         if (conn) {
1352                                 conn->dst_type = cp->peer_addr_type;
1353                                 conn->out = 1;
1354                         } else {
1355                                 BT_ERR("No memory for new connection");
1356                         }
1357                 }
1358         }
1359
1360         hci_dev_unlock(hdev);
1361 }
1362
1363 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1364 {
1365         BT_DBG("%s status 0x%x", hdev->name, status);
1366 }
1367
1368 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1369 {
1370         __u8 status = *((__u8 *) skb->data);
1371
1372         BT_DBG("%s status %d", hdev->name, status);
1373
1374         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1375
1376         hci_conn_check_pending(hdev);
1377
1378         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1379                 return;
1380
1381         mgmt_discovering(hdev->id, 0);
1382 }
1383
1384 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1385 {
1386         struct inquiry_data data;
1387         struct inquiry_info *info = (void *) (skb->data + 1);
1388         int num_rsp = *((__u8 *) skb->data);
1389
1390         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1391
1392         if (!num_rsp)
1393                 return;
1394
1395         hci_dev_lock(hdev);
1396
1397         for (; num_rsp; num_rsp--, info++) {
1398                 bacpy(&data.bdaddr, &info->bdaddr);
1399                 data.pscan_rep_mode     = info->pscan_rep_mode;
1400                 data.pscan_period_mode  = info->pscan_period_mode;
1401                 data.pscan_mode         = info->pscan_mode;
1402                 memcpy(data.dev_class, info->dev_class, 3);
1403                 data.clock_offset       = info->clock_offset;
1404                 data.rssi               = 0x00;
1405                 data.ssp_mode           = 0x00;
1406                 hci_inquiry_cache_update(hdev, &data);
1407                 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class, 0,
1408                                                                         NULL);
1409         }
1410
1411         hci_dev_unlock(hdev);
1412 }
1413
1414 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1415 {
1416         struct hci_ev_conn_complete *ev = (void *) skb->data;
1417         struct hci_conn *conn;
1418
1419         BT_DBG("%s", hdev->name);
1420
1421         hci_dev_lock(hdev);
1422
1423         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1424         if (!conn) {
1425                 if (ev->link_type != SCO_LINK)
1426                         goto unlock;
1427
1428                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1429                 if (!conn)
1430                         goto unlock;
1431
1432                 conn->type = SCO_LINK;
1433         }
1434
1435         if (!ev->status) {
1436                 conn->handle = __le16_to_cpu(ev->handle);
1437
1438                 if (conn->type == ACL_LINK) {
1439                         conn->state = BT_CONFIG;
1440                         hci_conn_hold(conn);
1441                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1442                         mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
1443                 } else
1444                         conn->state = BT_CONNECTED;
1445
1446                 hci_conn_hold_device(conn);
1447                 hci_conn_add_sysfs(conn);
1448
1449                 if (test_bit(HCI_AUTH, &hdev->flags))
1450                         conn->link_mode |= HCI_LM_AUTH;
1451
1452                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1453                         conn->link_mode |= HCI_LM_ENCRYPT;
1454
1455                 /* Get remote features */
1456                 if (conn->type == ACL_LINK) {
1457                         struct hci_cp_read_remote_features cp;
1458                         cp.handle = ev->handle;
1459                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1460                                                         sizeof(cp), &cp);
1461                 }
1462
1463                 /* Set packet type for incoming connection */
1464                 if (!conn->out && hdev->hci_ver < 3) {
1465                         struct hci_cp_change_conn_ptype cp;
1466                         cp.handle = ev->handle;
1467                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1468                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1469                                                         sizeof(cp), &cp);
1470                 }
1471         } else {
1472                 conn->state = BT_CLOSED;
1473                 if (conn->type == ACL_LINK)
1474                         mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
1475         }
1476
1477         if (conn->type == ACL_LINK)
1478                 hci_sco_setup(conn, ev->status);
1479
1480         if (ev->status) {
1481                 hci_proto_connect_cfm(conn, ev->status);
1482                 hci_conn_del(conn);
1483         } else if (ev->link_type != ACL_LINK)
1484                 hci_proto_connect_cfm(conn, ev->status);
1485
1486 unlock:
1487         hci_dev_unlock(hdev);
1488
1489         hci_conn_check_pending(hdev);
1490 }
1491
1492 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1493 {
1494         struct hci_ev_conn_request *ev = (void *) skb->data;
1495         int mask = hdev->link_mode;
1496
1497         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1498                                         batostr(&ev->bdaddr), ev->link_type);
1499
1500         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1501
1502         if ((mask & HCI_LM_ACCEPT) &&
1503                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1504                 /* Connection accepted */
1505                 struct inquiry_entry *ie;
1506                 struct hci_conn *conn;
1507
1508                 hci_dev_lock(hdev);
1509
1510                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1511                 if (ie)
1512                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1513
1514                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1515                 if (!conn) {
1516                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1517                         if (!conn) {
1518                                 BT_ERR("No memory for new connection");
1519                                 hci_dev_unlock(hdev);
1520                                 return;
1521                         }
1522                 }
1523
1524                 memcpy(conn->dev_class, ev->dev_class, 3);
1525                 conn->state = BT_CONNECT;
1526
1527                 hci_dev_unlock(hdev);
1528
1529                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1530                         struct hci_cp_accept_conn_req cp;
1531
1532                         bacpy(&cp.bdaddr, &ev->bdaddr);
1533
1534                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1535                                 cp.role = 0x00; /* Become master */
1536                         else
1537                                 cp.role = 0x01; /* Remain slave */
1538
1539                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1540                                                         sizeof(cp), &cp);
1541                 } else {
1542                         struct hci_cp_accept_sync_conn_req cp;
1543
1544                         bacpy(&cp.bdaddr, &ev->bdaddr);
1545                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1546
1547                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1548                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1549                         cp.max_latency    = cpu_to_le16(0xffff);
1550                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1551                         cp.retrans_effort = 0xff;
1552
1553                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1554                                                         sizeof(cp), &cp);
1555                 }
1556         } else {
1557                 /* Connection rejected */
1558                 struct hci_cp_reject_conn_req cp;
1559
1560                 bacpy(&cp.bdaddr, &ev->bdaddr);
1561                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1562                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1563         }
1564 }
1565
1566 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1567 {
1568         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1569         struct hci_conn *conn;
1570
1571         BT_DBG("%s status %d", hdev->name, ev->status);
1572
1573         if (ev->status) {
1574                 mgmt_disconnect_failed(hdev->id);
1575                 return;
1576         }
1577
1578         hci_dev_lock(hdev);
1579
1580         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1581         if (!conn)
1582                 goto unlock;
1583
1584         conn->state = BT_CLOSED;
1585
1586         if (conn->type == ACL_LINK || conn->type == LE_LINK)
1587                 mgmt_disconnected(hdev->id, &conn->dst);
1588
1589         hci_proto_disconn_cfm(conn, ev->reason);
1590         hci_conn_del(conn);
1591
1592 unlock:
1593         hci_dev_unlock(hdev);
1594 }
1595
1596 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1597 {
1598         struct hci_ev_auth_complete *ev = (void *) skb->data;
1599         struct hci_conn *conn;
1600
1601         BT_DBG("%s status %d", hdev->name, ev->status);
1602
1603         hci_dev_lock(hdev);
1604
1605         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1606         if (!conn)
1607                 goto unlock;
1608
1609         if (!ev->status) {
1610                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1611                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1612                         BT_INFO("re-auth of legacy device is not possible.");
1613                 } else {
1614                         conn->link_mode |= HCI_LM_AUTH;
1615                         conn->sec_level = conn->pending_sec_level;
1616                 }
1617         } else {
1618                 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
1619         }
1620
1621         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1622         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1623
1624         if (conn->state == BT_CONFIG) {
1625                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1626                         struct hci_cp_set_conn_encrypt cp;
1627                         cp.handle  = ev->handle;
1628                         cp.encrypt = 0x01;
1629                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1630                                                                         &cp);
1631                 } else {
1632                         conn->state = BT_CONNECTED;
1633                         hci_proto_connect_cfm(conn, ev->status);
1634                         hci_conn_put(conn);
1635                 }
1636         } else {
1637                 hci_auth_cfm(conn, ev->status);
1638
1639                 hci_conn_hold(conn);
1640                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1641                 hci_conn_put(conn);
1642         }
1643
1644         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1645                 if (!ev->status) {
1646                         struct hci_cp_set_conn_encrypt cp;
1647                         cp.handle  = ev->handle;
1648                         cp.encrypt = 0x01;
1649                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1650                                                                         &cp);
1651                 } else {
1652                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1653                         hci_encrypt_cfm(conn, ev->status, 0x00);
1654                 }
1655         }
1656
1657 unlock:
1658         hci_dev_unlock(hdev);
1659 }
1660
1661 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1662 {
1663         struct hci_ev_remote_name *ev = (void *) skb->data;
1664         struct hci_conn *conn;
1665
1666         BT_DBG("%s", hdev->name);
1667
1668         hci_conn_check_pending(hdev);
1669
1670         hci_dev_lock(hdev);
1671
1672         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1673                 mgmt_remote_name(hdev->id, &ev->bdaddr, ev->name);
1674
1675         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1676         if (!conn)
1677                 goto unlock;
1678
1679         if (!hci_outgoing_auth_needed(hdev, conn))
1680                 goto unlock;
1681
1682         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1683                 struct hci_cp_auth_requested cp;
1684                 cp.handle = __cpu_to_le16(conn->handle);
1685                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1686         }
1687
1688 unlock:
1689         hci_dev_unlock(hdev);
1690 }
1691
1692 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1693 {
1694         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1695         struct hci_conn *conn;
1696
1697         BT_DBG("%s status %d", hdev->name, ev->status);
1698
1699         hci_dev_lock(hdev);
1700
1701         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1702         if (conn) {
1703                 if (!ev->status) {
1704                         if (ev->encrypt) {
1705                                 /* Encryption implies authentication */
1706                                 conn->link_mode |= HCI_LM_AUTH;
1707                                 conn->link_mode |= HCI_LM_ENCRYPT;
1708                                 conn->sec_level = conn->pending_sec_level;
1709                         } else
1710                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1711                 }
1712
1713                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1714
1715                 if (conn->state == BT_CONFIG) {
1716                         if (!ev->status)
1717                                 conn->state = BT_CONNECTED;
1718
1719                         hci_proto_connect_cfm(conn, ev->status);
1720                         hci_conn_put(conn);
1721                 } else
1722                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1723         }
1724
1725         hci_dev_unlock(hdev);
1726 }
1727
1728 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1729 {
1730         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1731         struct hci_conn *conn;
1732
1733         BT_DBG("%s status %d", hdev->name, ev->status);
1734
1735         hci_dev_lock(hdev);
1736
1737         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1738         if (conn) {
1739                 if (!ev->status)
1740                         conn->link_mode |= HCI_LM_SECURE;
1741
1742                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1743
1744                 hci_key_change_cfm(conn, ev->status);
1745         }
1746
1747         hci_dev_unlock(hdev);
1748 }
1749
1750 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1751 {
1752         struct hci_ev_remote_features *ev = (void *) skb->data;
1753         struct hci_conn *conn;
1754
1755         BT_DBG("%s status %d", hdev->name, ev->status);
1756
1757         hci_dev_lock(hdev);
1758
1759         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1760         if (!conn)
1761                 goto unlock;
1762
1763         if (!ev->status)
1764                 memcpy(conn->features, ev->features, 8);
1765
1766         if (conn->state != BT_CONFIG)
1767                 goto unlock;
1768
1769         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1770                 struct hci_cp_read_remote_ext_features cp;
1771                 cp.handle = ev->handle;
1772                 cp.page = 0x01;
1773                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1774                                                         sizeof(cp), &cp);
1775                 goto unlock;
1776         }
1777
1778         if (!ev->status) {
1779                 struct hci_cp_remote_name_req cp;
1780                 memset(&cp, 0, sizeof(cp));
1781                 bacpy(&cp.bdaddr, &conn->dst);
1782                 cp.pscan_rep_mode = 0x02;
1783                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1784         }
1785
1786         if (!hci_outgoing_auth_needed(hdev, conn)) {
1787                 conn->state = BT_CONNECTED;
1788                 hci_proto_connect_cfm(conn, ev->status);
1789                 hci_conn_put(conn);
1790         }
1791
1792 unlock:
1793         hci_dev_unlock(hdev);
1794 }
1795
1796 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1797 {
1798         BT_DBG("%s", hdev->name);
1799 }
1800
1801 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1802 {
1803         BT_DBG("%s", hdev->name);
1804 }
1805
1806 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1807 {
1808         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1809         __u16 opcode;
1810
1811         skb_pull(skb, sizeof(*ev));
1812
1813         opcode = __le16_to_cpu(ev->opcode);
1814
1815         switch (opcode) {
1816         case HCI_OP_INQUIRY_CANCEL:
1817                 hci_cc_inquiry_cancel(hdev, skb);
1818                 break;
1819
1820         case HCI_OP_EXIT_PERIODIC_INQ:
1821                 hci_cc_exit_periodic_inq(hdev, skb);
1822                 break;
1823
1824         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1825                 hci_cc_remote_name_req_cancel(hdev, skb);
1826                 break;
1827
1828         case HCI_OP_ROLE_DISCOVERY:
1829                 hci_cc_role_discovery(hdev, skb);
1830                 break;
1831
1832         case HCI_OP_READ_LINK_POLICY:
1833                 hci_cc_read_link_policy(hdev, skb);
1834                 break;
1835
1836         case HCI_OP_WRITE_LINK_POLICY:
1837                 hci_cc_write_link_policy(hdev, skb);
1838                 break;
1839
1840         case HCI_OP_READ_DEF_LINK_POLICY:
1841                 hci_cc_read_def_link_policy(hdev, skb);
1842                 break;
1843
1844         case HCI_OP_WRITE_DEF_LINK_POLICY:
1845                 hci_cc_write_def_link_policy(hdev, skb);
1846                 break;
1847
1848         case HCI_OP_RESET:
1849                 hci_cc_reset(hdev, skb);
1850                 break;
1851
1852         case HCI_OP_WRITE_LOCAL_NAME:
1853                 hci_cc_write_local_name(hdev, skb);
1854                 break;
1855
1856         case HCI_OP_READ_LOCAL_NAME:
1857                 hci_cc_read_local_name(hdev, skb);
1858                 break;
1859
1860         case HCI_OP_WRITE_AUTH_ENABLE:
1861                 hci_cc_write_auth_enable(hdev, skb);
1862                 break;
1863
1864         case HCI_OP_WRITE_ENCRYPT_MODE:
1865                 hci_cc_write_encrypt_mode(hdev, skb);
1866                 break;
1867
1868         case HCI_OP_WRITE_SCAN_ENABLE:
1869                 hci_cc_write_scan_enable(hdev, skb);
1870                 break;
1871
1872         case HCI_OP_READ_CLASS_OF_DEV:
1873                 hci_cc_read_class_of_dev(hdev, skb);
1874                 break;
1875
1876         case HCI_OP_WRITE_CLASS_OF_DEV:
1877                 hci_cc_write_class_of_dev(hdev, skb);
1878                 break;
1879
1880         case HCI_OP_READ_VOICE_SETTING:
1881                 hci_cc_read_voice_setting(hdev, skb);
1882                 break;
1883
1884         case HCI_OP_WRITE_VOICE_SETTING:
1885                 hci_cc_write_voice_setting(hdev, skb);
1886                 break;
1887
1888         case HCI_OP_HOST_BUFFER_SIZE:
1889                 hci_cc_host_buffer_size(hdev, skb);
1890                 break;
1891
1892         case HCI_OP_READ_SSP_MODE:
1893                 hci_cc_read_ssp_mode(hdev, skb);
1894                 break;
1895
1896         case HCI_OP_WRITE_SSP_MODE:
1897                 hci_cc_write_ssp_mode(hdev, skb);
1898                 break;
1899
1900         case HCI_OP_READ_LOCAL_VERSION:
1901                 hci_cc_read_local_version(hdev, skb);
1902                 break;
1903
1904         case HCI_OP_READ_LOCAL_COMMANDS:
1905                 hci_cc_read_local_commands(hdev, skb);
1906                 break;
1907
1908         case HCI_OP_READ_LOCAL_FEATURES:
1909                 hci_cc_read_local_features(hdev, skb);
1910                 break;
1911
1912         case HCI_OP_READ_LOCAL_EXT_FEATURES:
1913                 hci_cc_read_local_ext_features(hdev, skb);
1914                 break;
1915
1916         case HCI_OP_READ_BUFFER_SIZE:
1917                 hci_cc_read_buffer_size(hdev, skb);
1918                 break;
1919
1920         case HCI_OP_READ_BD_ADDR:
1921                 hci_cc_read_bd_addr(hdev, skb);
1922                 break;
1923
1924         case HCI_OP_WRITE_CA_TIMEOUT:
1925                 hci_cc_write_ca_timeout(hdev, skb);
1926                 break;
1927
1928         case HCI_OP_READ_LOCAL_AMP_INFO:
1929                 hci_cc_read_local_amp_info(hdev, skb);
1930                 break;
1931
1932         case HCI_OP_DELETE_STORED_LINK_KEY:
1933                 hci_cc_delete_stored_link_key(hdev, skb);
1934                 break;
1935
1936         case HCI_OP_SET_EVENT_MASK:
1937                 hci_cc_set_event_mask(hdev, skb);
1938                 break;
1939
1940         case HCI_OP_WRITE_INQUIRY_MODE:
1941                 hci_cc_write_inquiry_mode(hdev, skb);
1942                 break;
1943
1944         case HCI_OP_READ_INQ_RSP_TX_POWER:
1945                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
1946                 break;
1947
1948         case HCI_OP_SET_EVENT_FLT:
1949                 hci_cc_set_event_flt(hdev, skb);
1950                 break;
1951
1952         case HCI_OP_PIN_CODE_REPLY:
1953                 hci_cc_pin_code_reply(hdev, skb);
1954                 break;
1955
1956         case HCI_OP_PIN_CODE_NEG_REPLY:
1957                 hci_cc_pin_code_neg_reply(hdev, skb);
1958                 break;
1959
1960         case HCI_OP_READ_LOCAL_OOB_DATA:
1961                 hci_cc_read_local_oob_data_reply(hdev, skb);
1962                 break;
1963
1964         case HCI_OP_LE_READ_BUFFER_SIZE:
1965                 hci_cc_le_read_buffer_size(hdev, skb);
1966                 break;
1967
1968         case HCI_OP_USER_CONFIRM_REPLY:
1969                 hci_cc_user_confirm_reply(hdev, skb);
1970                 break;
1971
1972         case HCI_OP_USER_CONFIRM_NEG_REPLY:
1973                 hci_cc_user_confirm_neg_reply(hdev, skb);
1974                 break;
1975
1976         case HCI_OP_LE_SET_SCAN_ENABLE:
1977                 hci_cc_le_set_scan_enable(hdev, skb);
1978                 break;
1979
1980         case HCI_OP_LE_LTK_REPLY:
1981                 hci_cc_le_ltk_reply(hdev, skb);
1982                 break;
1983
1984         case HCI_OP_LE_LTK_NEG_REPLY:
1985                 hci_cc_le_ltk_neg_reply(hdev, skb);
1986                 break;
1987
1988         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
1989                 hci_cc_write_le_host_supported(hdev, skb);
1990                 break;
1991
1992         default:
1993                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1994                 break;
1995         }
1996
1997         if (ev->opcode != HCI_OP_NOP)
1998                 del_timer(&hdev->cmd_timer);
1999
2000         if (ev->ncmd) {
2001                 atomic_set(&hdev->cmd_cnt, 1);
2002                 if (!skb_queue_empty(&hdev->cmd_q))
2003                         tasklet_schedule(&hdev->cmd_task);
2004         }
2005 }
2006
2007 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2008 {
2009         struct hci_ev_cmd_status *ev = (void *) skb->data;
2010         __u16 opcode;
2011
2012         skb_pull(skb, sizeof(*ev));
2013
2014         opcode = __le16_to_cpu(ev->opcode);
2015
2016         switch (opcode) {
2017         case HCI_OP_INQUIRY:
2018                 hci_cs_inquiry(hdev, ev->status);
2019                 break;
2020
2021         case HCI_OP_CREATE_CONN:
2022                 hci_cs_create_conn(hdev, ev->status);
2023                 break;
2024
2025         case HCI_OP_ADD_SCO:
2026                 hci_cs_add_sco(hdev, ev->status);
2027                 break;
2028
2029         case HCI_OP_AUTH_REQUESTED:
2030                 hci_cs_auth_requested(hdev, ev->status);
2031                 break;
2032
2033         case HCI_OP_SET_CONN_ENCRYPT:
2034                 hci_cs_set_conn_encrypt(hdev, ev->status);
2035                 break;
2036
2037         case HCI_OP_REMOTE_NAME_REQ:
2038                 hci_cs_remote_name_req(hdev, ev->status);
2039                 break;
2040
2041         case HCI_OP_READ_REMOTE_FEATURES:
2042                 hci_cs_read_remote_features(hdev, ev->status);
2043                 break;
2044
2045         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2046                 hci_cs_read_remote_ext_features(hdev, ev->status);
2047                 break;
2048
2049         case HCI_OP_SETUP_SYNC_CONN:
2050                 hci_cs_setup_sync_conn(hdev, ev->status);
2051                 break;
2052
2053         case HCI_OP_SNIFF_MODE:
2054                 hci_cs_sniff_mode(hdev, ev->status);
2055                 break;
2056
2057         case HCI_OP_EXIT_SNIFF_MODE:
2058                 hci_cs_exit_sniff_mode(hdev, ev->status);
2059                 break;
2060
2061         case HCI_OP_DISCONNECT:
2062                 if (ev->status != 0)
2063                         mgmt_disconnect_failed(hdev->id);
2064                 break;
2065
2066         case HCI_OP_LE_CREATE_CONN:
2067                 hci_cs_le_create_conn(hdev, ev->status);
2068                 break;
2069
2070         case HCI_OP_LE_START_ENC:
2071                 hci_cs_le_start_enc(hdev, ev->status);
2072                 break;
2073
2074         default:
2075                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2076                 break;
2077         }
2078
2079         if (ev->opcode != HCI_OP_NOP)
2080                 del_timer(&hdev->cmd_timer);
2081
2082         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2083                 atomic_set(&hdev->cmd_cnt, 1);
2084                 if (!skb_queue_empty(&hdev->cmd_q))
2085                         tasklet_schedule(&hdev->cmd_task);
2086         }
2087 }
2088
2089 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2090 {
2091         struct hci_ev_role_change *ev = (void *) skb->data;
2092         struct hci_conn *conn;
2093
2094         BT_DBG("%s status %d", hdev->name, ev->status);
2095
2096         hci_dev_lock(hdev);
2097
2098         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2099         if (conn) {
2100                 if (!ev->status) {
2101                         if (ev->role)
2102                                 conn->link_mode &= ~HCI_LM_MASTER;
2103                         else
2104                                 conn->link_mode |= HCI_LM_MASTER;
2105                 }
2106
2107                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2108
2109                 hci_role_switch_cfm(conn, ev->status, ev->role);
2110         }
2111
2112         hci_dev_unlock(hdev);
2113 }
2114
2115 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2116 {
2117         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2118         __le16 *ptr;
2119         int i;
2120
2121         skb_pull(skb, sizeof(*ev));
2122
2123         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2124
2125         if (skb->len < ev->num_hndl * 4) {
2126                 BT_DBG("%s bad parameters", hdev->name);
2127                 return;
2128         }
2129
2130         tasklet_disable(&hdev->tx_task);
2131
2132         for (i = 0, ptr = (__le16 *) skb->data; i < ev->num_hndl; i++) {
2133                 struct hci_conn *conn;
2134                 __u16  handle, count;
2135
2136                 handle = get_unaligned_le16(ptr++);
2137                 count  = get_unaligned_le16(ptr++);
2138
2139                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2140                 if (conn) {
2141                         conn->sent -= count;
2142
2143                         if (conn->type == ACL_LINK) {
2144                                 hdev->acl_cnt += count;
2145                                 if (hdev->acl_cnt > hdev->acl_pkts)
2146                                         hdev->acl_cnt = hdev->acl_pkts;
2147                         } else if (conn->type == LE_LINK) {
2148                                 if (hdev->le_pkts) {
2149                                         hdev->le_cnt += count;
2150                                         if (hdev->le_cnt > hdev->le_pkts)
2151                                                 hdev->le_cnt = hdev->le_pkts;
2152                                 } else {
2153                                         hdev->acl_cnt += count;
2154                                         if (hdev->acl_cnt > hdev->acl_pkts)
2155                                                 hdev->acl_cnt = hdev->acl_pkts;
2156                                 }
2157                         } else {
2158                                 hdev->sco_cnt += count;
2159                                 if (hdev->sco_cnt > hdev->sco_pkts)
2160                                         hdev->sco_cnt = hdev->sco_pkts;
2161                         }
2162                 }
2163         }
2164
2165         tasklet_schedule(&hdev->tx_task);
2166
2167         tasklet_enable(&hdev->tx_task);
2168 }
2169
2170 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2171 {
2172         struct hci_ev_mode_change *ev = (void *) skb->data;
2173         struct hci_conn *conn;
2174
2175         BT_DBG("%s status %d", hdev->name, ev->status);
2176
2177         hci_dev_lock(hdev);
2178
2179         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2180         if (conn) {
2181                 conn->mode = ev->mode;
2182                 conn->interval = __le16_to_cpu(ev->interval);
2183
2184                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2185                         if (conn->mode == HCI_CM_ACTIVE)
2186                                 conn->power_save = 1;
2187                         else
2188                                 conn->power_save = 0;
2189                 }
2190
2191                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2192                         hci_sco_setup(conn, ev->status);
2193         }
2194
2195         hci_dev_unlock(hdev);
2196 }
2197
2198 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2199 {
2200         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2201         struct hci_conn *conn;
2202
2203         BT_DBG("%s", hdev->name);
2204
2205         hci_dev_lock(hdev);
2206
2207         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2208         if (!conn)
2209                 goto unlock;
2210
2211         if (conn->state == BT_CONNECTED) {
2212                 hci_conn_hold(conn);
2213                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2214                 hci_conn_put(conn);
2215         }
2216
2217         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2218                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2219                                         sizeof(ev->bdaddr), &ev->bdaddr);
2220         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2221                 u8 secure;
2222
2223                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2224                         secure = 1;
2225                 else
2226                         secure = 0;
2227
2228                 mgmt_pin_code_request(hdev->id, &ev->bdaddr, secure);
2229         }
2230
2231 unlock:
2232         hci_dev_unlock(hdev);
2233 }
2234
2235 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2236 {
2237         struct hci_ev_link_key_req *ev = (void *) skb->data;
2238         struct hci_cp_link_key_reply cp;
2239         struct hci_conn *conn;
2240         struct link_key *key;
2241
2242         BT_DBG("%s", hdev->name);
2243
2244         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2245                 return;
2246
2247         hci_dev_lock(hdev);
2248
2249         key = hci_find_link_key(hdev, &ev->bdaddr);
2250         if (!key) {
2251                 BT_DBG("%s link key not found for %s", hdev->name,
2252                                                         batostr(&ev->bdaddr));
2253                 goto not_found;
2254         }
2255
2256         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2257                                                         batostr(&ev->bdaddr));
2258
2259         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2260                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2261                 BT_DBG("%s ignoring debug key", hdev->name);
2262                 goto not_found;
2263         }
2264
2265         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2266         if (conn) {
2267                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2268                                 conn->auth_type != 0xff &&
2269                                 (conn->auth_type & 0x01)) {
2270                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2271                         goto not_found;
2272                 }
2273
2274                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2275                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2276                         BT_DBG("%s ignoring key unauthenticated for high \
2277                                                         security", hdev->name);
2278                         goto not_found;
2279                 }
2280
2281                 conn->key_type = key->type;
2282                 conn->pin_length = key->pin_len;
2283         }
2284
2285         bacpy(&cp.bdaddr, &ev->bdaddr);
2286         memcpy(cp.link_key, key->val, 16);
2287
2288         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2289
2290         hci_dev_unlock(hdev);
2291
2292         return;
2293
2294 not_found:
2295         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2296         hci_dev_unlock(hdev);
2297 }
2298
2299 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2300 {
2301         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2302         struct hci_conn *conn;
2303         u8 pin_len = 0;
2304
2305         BT_DBG("%s", hdev->name);
2306
2307         hci_dev_lock(hdev);
2308
2309         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2310         if (conn) {
2311                 hci_conn_hold(conn);
2312                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2313                 pin_len = conn->pin_length;
2314
2315                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2316                         conn->key_type = ev->key_type;
2317
2318                 hci_conn_put(conn);
2319         }
2320
2321         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2322                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2323                                                         ev->key_type, pin_len);
2324
2325         hci_dev_unlock(hdev);
2326 }
2327
2328 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2329 {
2330         struct hci_ev_clock_offset *ev = (void *) skb->data;
2331         struct hci_conn *conn;
2332
2333         BT_DBG("%s status %d", hdev->name, ev->status);
2334
2335         hci_dev_lock(hdev);
2336
2337         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2338         if (conn && !ev->status) {
2339                 struct inquiry_entry *ie;
2340
2341                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2342                 if (ie) {
2343                         ie->data.clock_offset = ev->clock_offset;
2344                         ie->timestamp = jiffies;
2345                 }
2346         }
2347
2348         hci_dev_unlock(hdev);
2349 }
2350
2351 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2352 {
2353         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2354         struct hci_conn *conn;
2355
2356         BT_DBG("%s status %d", hdev->name, ev->status);
2357
2358         hci_dev_lock(hdev);
2359
2360         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2361         if (conn && !ev->status)
2362                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2363
2364         hci_dev_unlock(hdev);
2365 }
2366
2367 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2368 {
2369         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2370         struct inquiry_entry *ie;
2371
2372         BT_DBG("%s", hdev->name);
2373
2374         hci_dev_lock(hdev);
2375
2376         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2377         if (ie) {
2378                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2379                 ie->timestamp = jiffies;
2380         }
2381
2382         hci_dev_unlock(hdev);
2383 }
2384
2385 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2386 {
2387         struct inquiry_data data;
2388         int num_rsp = *((__u8 *) skb->data);
2389
2390         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2391
2392         if (!num_rsp)
2393                 return;
2394
2395         hci_dev_lock(hdev);
2396
2397         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2398                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2399                 info = (void *) (skb->data + 1);
2400
2401                 for (; num_rsp; num_rsp--, info++) {
2402                         bacpy(&data.bdaddr, &info->bdaddr);
2403                         data.pscan_rep_mode     = info->pscan_rep_mode;
2404                         data.pscan_period_mode  = info->pscan_period_mode;
2405                         data.pscan_mode         = info->pscan_mode;
2406                         memcpy(data.dev_class, info->dev_class, 3);
2407                         data.clock_offset       = info->clock_offset;
2408                         data.rssi               = info->rssi;
2409                         data.ssp_mode           = 0x00;
2410                         hci_inquiry_cache_update(hdev, &data);
2411                         mgmt_device_found(hdev->id, &info->bdaddr,
2412                                                 info->dev_class, info->rssi,
2413                                                 NULL);
2414                 }
2415         } else {
2416                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2417
2418                 for (; num_rsp; num_rsp--, info++) {
2419                         bacpy(&data.bdaddr, &info->bdaddr);
2420                         data.pscan_rep_mode     = info->pscan_rep_mode;
2421                         data.pscan_period_mode  = info->pscan_period_mode;
2422                         data.pscan_mode         = 0x00;
2423                         memcpy(data.dev_class, info->dev_class, 3);
2424                         data.clock_offset       = info->clock_offset;
2425                         data.rssi               = info->rssi;
2426                         data.ssp_mode           = 0x00;
2427                         hci_inquiry_cache_update(hdev, &data);
2428                         mgmt_device_found(hdev->id, &info->bdaddr,
2429                                                 info->dev_class, info->rssi,
2430                                                 NULL);
2431                 }
2432         }
2433
2434         hci_dev_unlock(hdev);
2435 }
2436
2437 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2438 {
2439         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2440         struct hci_conn *conn;
2441
2442         BT_DBG("%s", hdev->name);
2443
2444         hci_dev_lock(hdev);
2445
2446         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2447         if (!conn)
2448                 goto unlock;
2449
2450         if (!ev->status && ev->page == 0x01) {
2451                 struct inquiry_entry *ie;
2452
2453                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2454                 if (ie)
2455                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2456
2457                 conn->ssp_mode = (ev->features[0] & 0x01);
2458         }
2459
2460         if (conn->state != BT_CONFIG)
2461                 goto unlock;
2462
2463         if (!ev->status) {
2464                 struct hci_cp_remote_name_req cp;
2465                 memset(&cp, 0, sizeof(cp));
2466                 bacpy(&cp.bdaddr, &conn->dst);
2467                 cp.pscan_rep_mode = 0x02;
2468                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2469         }
2470
2471         if (!hci_outgoing_auth_needed(hdev, conn)) {
2472                 conn->state = BT_CONNECTED;
2473                 hci_proto_connect_cfm(conn, ev->status);
2474                 hci_conn_put(conn);
2475         }
2476
2477 unlock:
2478         hci_dev_unlock(hdev);
2479 }
2480
2481 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2482 {
2483         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2484         struct hci_conn *conn;
2485
2486         BT_DBG("%s status %d", hdev->name, ev->status);
2487
2488         hci_dev_lock(hdev);
2489
2490         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2491         if (!conn) {
2492                 if (ev->link_type == ESCO_LINK)
2493                         goto unlock;
2494
2495                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2496                 if (!conn)
2497                         goto unlock;
2498
2499                 conn->type = SCO_LINK;
2500         }
2501
2502         switch (ev->status) {
2503         case 0x00:
2504                 conn->handle = __le16_to_cpu(ev->handle);
2505                 conn->state  = BT_CONNECTED;
2506
2507                 hci_conn_hold_device(conn);
2508                 hci_conn_add_sysfs(conn);
2509                 break;
2510
2511         case 0x11:      /* Unsupported Feature or Parameter Value */
2512         case 0x1c:      /* SCO interval rejected */
2513         case 0x1a:      /* Unsupported Remote Feature */
2514         case 0x1f:      /* Unspecified error */
2515                 if (conn->out && conn->attempt < 2) {
2516                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2517                                         (hdev->esco_type & EDR_ESCO_MASK);
2518                         hci_setup_sync(conn, conn->link->handle);
2519                         goto unlock;
2520                 }
2521                 /* fall through */
2522
2523         default:
2524                 conn->state = BT_CLOSED;
2525                 break;
2526         }
2527
2528         hci_proto_connect_cfm(conn, ev->status);
2529         if (ev->status)
2530                 hci_conn_del(conn);
2531
2532 unlock:
2533         hci_dev_unlock(hdev);
2534 }
2535
2536 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2537 {
2538         BT_DBG("%s", hdev->name);
2539 }
2540
2541 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2542 {
2543         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2544
2545         BT_DBG("%s status %d", hdev->name, ev->status);
2546 }
2547
2548 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2549 {
2550         struct inquiry_data data;
2551         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2552         int num_rsp = *((__u8 *) skb->data);
2553
2554         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2555
2556         if (!num_rsp)
2557                 return;
2558
2559         hci_dev_lock(hdev);
2560
2561         for (; num_rsp; num_rsp--, info++) {
2562                 bacpy(&data.bdaddr, &info->bdaddr);
2563                 data.pscan_rep_mode     = info->pscan_rep_mode;
2564                 data.pscan_period_mode  = info->pscan_period_mode;
2565                 data.pscan_mode         = 0x00;
2566                 memcpy(data.dev_class, info->dev_class, 3);
2567                 data.clock_offset       = info->clock_offset;
2568                 data.rssi               = info->rssi;
2569                 data.ssp_mode           = 0x01;
2570                 hci_inquiry_cache_update(hdev, &data);
2571                 mgmt_device_found(hdev->id, &info->bdaddr, info->dev_class,
2572                                                 info->rssi, info->data);
2573         }
2574
2575         hci_dev_unlock(hdev);
2576 }
2577
2578 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2579 {
2580         /* If remote requests dedicated bonding follow that lead */
2581         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2582                 /* If both remote and local IO capabilities allow MITM
2583                  * protection then require it, otherwise don't */
2584                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2585                         return 0x02;
2586                 else
2587                         return 0x03;
2588         }
2589
2590         /* If remote requests no-bonding follow that lead */
2591         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2592                 return conn->remote_auth | (conn->auth_type & 0x01);
2593
2594         return conn->auth_type;
2595 }
2596
2597 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2598 {
2599         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2600         struct hci_conn *conn;
2601
2602         BT_DBG("%s", hdev->name);
2603
2604         hci_dev_lock(hdev);
2605
2606         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2607         if (!conn)
2608                 goto unlock;
2609
2610         hci_conn_hold(conn);
2611
2612         if (!test_bit(HCI_MGMT, &hdev->flags))
2613                 goto unlock;
2614
2615         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2616                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2617                 struct hci_cp_io_capability_reply cp;
2618
2619                 bacpy(&cp.bdaddr, &ev->bdaddr);
2620                 cp.capability = conn->io_capability;
2621                 conn->auth_type = hci_get_auth_req(conn);
2622                 cp.authentication = conn->auth_type;
2623
2624                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2625                                 hci_find_remote_oob_data(hdev, &conn->dst))
2626                         cp.oob_data = 0x01;
2627                 else
2628                         cp.oob_data = 0x00;
2629
2630                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2631                                                         sizeof(cp), &cp);
2632         } else {
2633                 struct hci_cp_io_capability_neg_reply cp;
2634
2635                 bacpy(&cp.bdaddr, &ev->bdaddr);
2636                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2637
2638                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2639                                                         sizeof(cp), &cp);
2640         }
2641
2642 unlock:
2643         hci_dev_unlock(hdev);
2644 }
2645
2646 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2647 {
2648         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2649         struct hci_conn *conn;
2650
2651         BT_DBG("%s", hdev->name);
2652
2653         hci_dev_lock(hdev);
2654
2655         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2656         if (!conn)
2657                 goto unlock;
2658
2659         conn->remote_cap = ev->capability;
2660         conn->remote_oob = ev->oob_data;
2661         conn->remote_auth = ev->authentication;
2662
2663 unlock:
2664         hci_dev_unlock(hdev);
2665 }
2666
2667 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2668                                                         struct sk_buff *skb)
2669 {
2670         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2671         int loc_mitm, rem_mitm, confirm_hint = 0;
2672         struct hci_conn *conn;
2673
2674         BT_DBG("%s", hdev->name);
2675
2676         hci_dev_lock(hdev);
2677
2678         if (!test_bit(HCI_MGMT, &hdev->flags))
2679                 goto unlock;
2680
2681         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2682         if (!conn)
2683                 goto unlock;
2684
2685         loc_mitm = (conn->auth_type & 0x01);
2686         rem_mitm = (conn->remote_auth & 0x01);
2687
2688         /* If we require MITM but the remote device can't provide that
2689          * (it has NoInputNoOutput) then reject the confirmation
2690          * request. The only exception is when we're dedicated bonding
2691          * initiators (connect_cfm_cb set) since then we always have the MITM
2692          * bit set. */
2693         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2694                 BT_DBG("Rejecting request: remote device can't provide MITM");
2695                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2696                                         sizeof(ev->bdaddr), &ev->bdaddr);
2697                 goto unlock;
2698         }
2699
2700         /* If no side requires MITM protection; auto-accept */
2701         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2702                                 (!rem_mitm || conn->io_capability == 0x03)) {
2703
2704                 /* If we're not the initiators request authorization to
2705                  * proceed from user space (mgmt_user_confirm with
2706                  * confirm_hint set to 1). */
2707                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2708                         BT_DBG("Confirming auto-accept as acceptor");
2709                         confirm_hint = 1;
2710                         goto confirm;
2711                 }
2712
2713                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2714                                                 hdev->auto_accept_delay);
2715
2716                 if (hdev->auto_accept_delay > 0) {
2717                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2718                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2719                         goto unlock;
2720                 }
2721
2722                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2723                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2724                 goto unlock;
2725         }
2726
2727 confirm:
2728         mgmt_user_confirm_request(hdev->id, &ev->bdaddr, ev->passkey,
2729                                                                 confirm_hint);
2730
2731 unlock:
2732         hci_dev_unlock(hdev);
2733 }
2734
2735 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2736 {
2737         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2738         struct hci_conn *conn;
2739
2740         BT_DBG("%s", hdev->name);
2741
2742         hci_dev_lock(hdev);
2743
2744         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2745         if (!conn)
2746                 goto unlock;
2747
2748         /* To avoid duplicate auth_failed events to user space we check
2749          * the HCI_CONN_AUTH_PEND flag which will be set if we
2750          * initiated the authentication. A traditional auth_complete
2751          * event gets always produced as initiator and is also mapped to
2752          * the mgmt_auth_failed event */
2753         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2754                 mgmt_auth_failed(hdev->id, &conn->dst, ev->status);
2755
2756         hci_conn_put(conn);
2757
2758 unlock:
2759         hci_dev_unlock(hdev);
2760 }
2761
2762 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2763 {
2764         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2765         struct inquiry_entry *ie;
2766
2767         BT_DBG("%s", hdev->name);
2768
2769         hci_dev_lock(hdev);
2770
2771         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2772         if (ie)
2773                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2774
2775         hci_dev_unlock(hdev);
2776 }
2777
2778 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2779                                                         struct sk_buff *skb)
2780 {
2781         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2782         struct oob_data *data;
2783
2784         BT_DBG("%s", hdev->name);
2785
2786         hci_dev_lock(hdev);
2787
2788         if (!test_bit(HCI_MGMT, &hdev->flags))
2789                 goto unlock;
2790
2791         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2792         if (data) {
2793                 struct hci_cp_remote_oob_data_reply cp;
2794
2795                 bacpy(&cp.bdaddr, &ev->bdaddr);
2796                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2797                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2798
2799                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2800                                                                         &cp);
2801         } else {
2802                 struct hci_cp_remote_oob_data_neg_reply cp;
2803
2804                 bacpy(&cp.bdaddr, &ev->bdaddr);
2805                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2806                                                                         &cp);
2807         }
2808
2809 unlock:
2810         hci_dev_unlock(hdev);
2811 }
2812
2813 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2814 {
2815         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2816         struct hci_conn *conn;
2817
2818         BT_DBG("%s status %d", hdev->name, ev->status);
2819
2820         hci_dev_lock(hdev);
2821
2822         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
2823         if (!conn) {
2824                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
2825                 if (!conn) {
2826                         BT_ERR("No memory for new connection");
2827                         hci_dev_unlock(hdev);
2828                         return;
2829                 }
2830
2831                 conn->dst_type = ev->bdaddr_type;
2832         }
2833
2834         if (ev->status) {
2835                 mgmt_connect_failed(hdev->id, &ev->bdaddr, ev->status);
2836                 hci_proto_connect_cfm(conn, ev->status);
2837                 conn->state = BT_CLOSED;
2838                 hci_conn_del(conn);
2839                 goto unlock;
2840         }
2841
2842         mgmt_connected(hdev->id, &ev->bdaddr, conn->type);
2843
2844         conn->sec_level = BT_SECURITY_LOW;
2845         conn->handle = __le16_to_cpu(ev->handle);
2846         conn->state = BT_CONNECTED;
2847
2848         hci_conn_hold_device(conn);
2849         hci_conn_add_sysfs(conn);
2850
2851         hci_proto_connect_cfm(conn, ev->status);
2852
2853 unlock:
2854         hci_dev_unlock(hdev);
2855 }
2856
2857 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
2858                                                 struct sk_buff *skb)
2859 {
2860         u8 num_reports = skb->data[0];
2861         void *ptr = &skb->data[1];
2862
2863         hci_dev_lock(hdev);
2864
2865         while (num_reports--) {
2866                 struct hci_ev_le_advertising_info *ev = ptr;
2867
2868                 hci_add_adv_entry(hdev, ev);
2869
2870                 ptr += sizeof(*ev) + ev->length + 1;
2871         }
2872
2873         hci_dev_unlock(hdev);
2874 }
2875
2876 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
2877                                                 struct sk_buff *skb)
2878 {
2879         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
2880         struct hci_cp_le_ltk_reply cp;
2881         struct hci_cp_le_ltk_neg_reply neg;
2882         struct hci_conn *conn;
2883         struct link_key *ltk;
2884
2885         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
2886
2887         hci_dev_lock(hdev);
2888
2889         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2890         if (conn == NULL)
2891                 goto not_found;
2892
2893         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
2894         if (ltk == NULL)
2895                 goto not_found;
2896
2897         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
2898         cp.handle = cpu_to_le16(conn->handle);
2899         conn->pin_length = ltk->pin_len;
2900
2901         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
2902
2903         hci_dev_unlock(hdev);
2904
2905         return;
2906
2907 not_found:
2908         neg.handle = ev->handle;
2909         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
2910         hci_dev_unlock(hdev);
2911 }
2912
2913 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
2914 {
2915         struct hci_ev_le_meta *le_ev = (void *) skb->data;
2916
2917         skb_pull(skb, sizeof(*le_ev));
2918
2919         switch (le_ev->subevent) {
2920         case HCI_EV_LE_CONN_COMPLETE:
2921                 hci_le_conn_complete_evt(hdev, skb);
2922                 break;
2923
2924         case HCI_EV_LE_ADVERTISING_REPORT:
2925                 hci_le_adv_report_evt(hdev, skb);
2926                 break;
2927
2928         case HCI_EV_LE_LTK_REQ:
2929                 hci_le_ltk_request_evt(hdev, skb);
2930                 break;
2931
2932         default:
2933                 break;
2934         }
2935 }
2936
2937 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
2938 {
2939         struct hci_event_hdr *hdr = (void *) skb->data;
2940         __u8 event = hdr->evt;
2941
2942         skb_pull(skb, HCI_EVENT_HDR_SIZE);
2943
2944         switch (event) {
2945         case HCI_EV_INQUIRY_COMPLETE:
2946                 hci_inquiry_complete_evt(hdev, skb);
2947                 break;
2948
2949         case HCI_EV_INQUIRY_RESULT:
2950                 hci_inquiry_result_evt(hdev, skb);
2951                 break;
2952
2953         case HCI_EV_CONN_COMPLETE:
2954                 hci_conn_complete_evt(hdev, skb);
2955                 break;
2956
2957         case HCI_EV_CONN_REQUEST:
2958                 hci_conn_request_evt(hdev, skb);
2959                 break;
2960
2961         case HCI_EV_DISCONN_COMPLETE:
2962                 hci_disconn_complete_evt(hdev, skb);
2963                 break;
2964
2965         case HCI_EV_AUTH_COMPLETE:
2966                 hci_auth_complete_evt(hdev, skb);
2967                 break;
2968
2969         case HCI_EV_REMOTE_NAME:
2970                 hci_remote_name_evt(hdev, skb);
2971                 break;
2972
2973         case HCI_EV_ENCRYPT_CHANGE:
2974                 hci_encrypt_change_evt(hdev, skb);
2975                 break;
2976
2977         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
2978                 hci_change_link_key_complete_evt(hdev, skb);
2979                 break;
2980
2981         case HCI_EV_REMOTE_FEATURES:
2982                 hci_remote_features_evt(hdev, skb);
2983                 break;
2984
2985         case HCI_EV_REMOTE_VERSION:
2986                 hci_remote_version_evt(hdev, skb);
2987                 break;
2988
2989         case HCI_EV_QOS_SETUP_COMPLETE:
2990                 hci_qos_setup_complete_evt(hdev, skb);
2991                 break;
2992
2993         case HCI_EV_CMD_COMPLETE:
2994                 hci_cmd_complete_evt(hdev, skb);
2995                 break;
2996
2997         case HCI_EV_CMD_STATUS:
2998                 hci_cmd_status_evt(hdev, skb);
2999                 break;
3000
3001         case HCI_EV_ROLE_CHANGE:
3002                 hci_role_change_evt(hdev, skb);
3003                 break;
3004
3005         case HCI_EV_NUM_COMP_PKTS:
3006                 hci_num_comp_pkts_evt(hdev, skb);
3007                 break;
3008
3009         case HCI_EV_MODE_CHANGE:
3010                 hci_mode_change_evt(hdev, skb);
3011                 break;
3012
3013         case HCI_EV_PIN_CODE_REQ:
3014                 hci_pin_code_request_evt(hdev, skb);
3015                 break;
3016
3017         case HCI_EV_LINK_KEY_REQ:
3018                 hci_link_key_request_evt(hdev, skb);
3019                 break;
3020
3021         case HCI_EV_LINK_KEY_NOTIFY:
3022                 hci_link_key_notify_evt(hdev, skb);
3023                 break;
3024
3025         case HCI_EV_CLOCK_OFFSET:
3026                 hci_clock_offset_evt(hdev, skb);
3027                 break;
3028
3029         case HCI_EV_PKT_TYPE_CHANGE:
3030                 hci_pkt_type_change_evt(hdev, skb);
3031                 break;
3032
3033         case HCI_EV_PSCAN_REP_MODE:
3034                 hci_pscan_rep_mode_evt(hdev, skb);
3035                 break;
3036
3037         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3038                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3039                 break;
3040
3041         case HCI_EV_REMOTE_EXT_FEATURES:
3042                 hci_remote_ext_features_evt(hdev, skb);
3043                 break;
3044
3045         case HCI_EV_SYNC_CONN_COMPLETE:
3046                 hci_sync_conn_complete_evt(hdev, skb);
3047                 break;
3048
3049         case HCI_EV_SYNC_CONN_CHANGED:
3050                 hci_sync_conn_changed_evt(hdev, skb);
3051                 break;
3052
3053         case HCI_EV_SNIFF_SUBRATE:
3054                 hci_sniff_subrate_evt(hdev, skb);
3055                 break;
3056
3057         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3058                 hci_extended_inquiry_result_evt(hdev, skb);
3059                 break;
3060
3061         case HCI_EV_IO_CAPA_REQUEST:
3062                 hci_io_capa_request_evt(hdev, skb);
3063                 break;
3064
3065         case HCI_EV_IO_CAPA_REPLY:
3066                 hci_io_capa_reply_evt(hdev, skb);
3067                 break;
3068
3069         case HCI_EV_USER_CONFIRM_REQUEST:
3070                 hci_user_confirm_request_evt(hdev, skb);
3071                 break;
3072
3073         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3074                 hci_simple_pair_complete_evt(hdev, skb);
3075                 break;
3076
3077         case HCI_EV_REMOTE_HOST_FEATURES:
3078                 hci_remote_host_features_evt(hdev, skb);
3079                 break;
3080
3081         case HCI_EV_LE_META:
3082                 hci_le_meta_evt(hdev, skb);
3083                 break;
3084
3085         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3086                 hci_remote_oob_data_request_evt(hdev, skb);
3087                 break;
3088
3089         default:
3090                 BT_DBG("%s event 0x%x", hdev->name, event);
3091                 break;
3092         }
3093
3094         kfree_skb(skb);
3095         hdev->stat.evt_rx++;
3096 }
3097
3098 /* Generate internal stack event */
3099 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3100 {
3101         struct hci_event_hdr *hdr;
3102         struct hci_ev_stack_internal *ev;
3103         struct sk_buff *skb;
3104
3105         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3106         if (!skb)
3107                 return;
3108
3109         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3110         hdr->evt  = HCI_EV_STACK_INTERNAL;
3111         hdr->plen = sizeof(*ev) + dlen;
3112
3113         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3114         ev->type = type;
3115         memcpy(ev->data, data, dlen);
3116
3117         bt_cb(skb)->incoming = 1;
3118         __net_timestamp(skb);
3119
3120         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3121         skb->dev = (void *) hdev;
3122         hci_send_to_sock(hdev, skb, NULL);
3123         kfree_skb(skb);
3124 }
3125
3126 module_param(enable_le, bool, 0644);
3127 MODULE_PARM_DESC(enable_le, "Enable LE support");