net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         mgmt_discovering(hdev, 0);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         hdev->dev_flags = 0;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216
 217         if (status == 0)
 218                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 219
 220         hci_dev_unlock(hdev);
 221 }
 222
 223 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         struct hci_rp_read_local_name *rp = (void *) skb->data;
 226
 227         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 228
 229         if (rp->status)
 230                 return;
 231
 232         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 256 }
 257
 258 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 259 {
 260         __u8 status = *((__u8 *) skb->data);
 261         void *sent;
 262
 263         BT_DBG("%s status 0x%x", hdev->name, status);
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 266         if (!sent)
 267                 return;
 268
 269         if (!status) {
 270                 __u8 param = *((__u8 *) sent);
 271
 272                 if (param)
 273                         set_bit(HCI_ENCRYPT, &hdev->flags);
 274                 else
 275                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 276         }
 277
 278         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 279 }
 280
 281 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 282 {
 283         __u8 param, status = *((__u8 *) skb->data);
 284         int old_pscan, old_iscan;
 285         void *sent;
 286
 287         BT_DBG("%s status 0x%x", hdev->name, status);
 288
 289         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 290         if (!sent)
 291                 return;
 292
 293         param = *((__u8 *) sent);
 294
 295         hci_dev_lock(hdev);
 296
 297         if (status != 0) {
 298                 mgmt_write_scan_failed(hdev, param, status);
 299                 hdev->discov_timeout = 0;
 300                 goto done;
 301         }
 302
 303         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 304         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 305
 306         if (param & SCAN_INQUIRY) {
 307                 set_bit(HCI_ISCAN, &hdev->flags);
 308                 if (!old_iscan)
 309                         mgmt_discoverable(hdev, 1);
 310                 if (hdev->discov_timeout > 0) {
 311                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 312                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 313                                                                         to);
 314                 }
 315         } else if (old_iscan)
 316                 mgmt_discoverable(hdev, 0);
 317
 318         if (param & SCAN_PAGE) {
 319                 set_bit(HCI_PSCAN, &hdev->flags);
 320                 if (!old_pscan)
 321                         mgmt_connectable(hdev, 1);
 322         } else if (old_pscan)
 323                 mgmt_connectable(hdev, 0);
 324
 325 done:
 326         hci_dev_unlock(hdev);
 327         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%x", hdev->name, status);
 351
 352         if (status)
 353                 return;
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         memcpy(hdev->dev_class, sent, 3);
 360 }
 361
 362 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 365         __u16 setting;
 366
 367         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 368
 369         if (rp->status)
 370                 return;
 371
 372         setting = __le16_to_cpu(rp->voice_setting);
 373
 374         if (hdev->voice_setting == setting)
 375                 return;
 376
 377         hdev->voice_setting = setting;
 378
 379         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 380
 381         if (hdev->notify)
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383 }
 384
 385 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388         __u16 setting;
 389         void *sent;
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         if (status)
 394                 return;
 395
 396         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 397         if (!sent)
 398                 return;
 399
 400         setting = get_unaligned_le16(sent);
 401
 402         if (hdev->voice_setting == setting)
 403                 return;
 404
 405         hdev->voice_setting = setting;
 406
 407         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 408
 409         if (hdev->notify)
 410                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 411 }
 412
 413 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 420 }
 421
 422 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->ssp_mode = rp->mode;
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         void *sent;
 438
 439         BT_DBG("%s status 0x%x", hdev->name, status);
 440
 441         if (status)
 442                 return;
 443
 444         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 445         if (!sent)
 446                 return;
 447
 448         hdev->ssp_mode = *((__u8 *) sent);
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         if (hdev->dev_type != HCI_BREDR)
 560                 return;
 561
 562         hci_setup_event_mask(hdev);
 563
 564         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 565                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 566
 567         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 568                 u8 mode = 0x01;
 569                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 570         }
 571
 572         if (hdev->features[3] & LMP_RSSI_INQ)
 573                 hci_setup_inquiry_mode(hdev);
 574
 575         if (hdev->features[7] & LMP_INQ_TX_PWR)
 576                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 577
 578         if (hdev->features[7] & LMP_EXTFEATURES) {
 579                 struct hci_cp_read_local_ext_features cp;
 580
 581                 cp.page = 0x01;
 582                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 583                                                         sizeof(cp), &cp);
 584         }
 585
 586         if (hdev->features[4] & LMP_LE)
 587                 hci_set_le_support(hdev);
 588 }
 589
 590 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 591 {
 592         struct hci_rp_read_local_version *rp = (void *) skb->data;
 593
 594         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 595
 596         if (rp->status)
 597                 return;
 598
 599         hdev->hci_ver = rp->hci_ver;
 600         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 601         hdev->lmp_ver = rp->lmp_ver;
 602         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 603         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 604
 605         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 606                                         hdev->manufacturer,
 607                                         hdev->hci_ver, hdev->hci_rev);
 608
 609         if (test_bit(HCI_INIT, &hdev->flags))
 610                 hci_setup(hdev);
 611 }
 612
 613 static void hci_setup_link_policy(struct hci_dev *hdev)
 614 {
 615         u16 link_policy = 0;
 616
 617         if (hdev->features[0] & LMP_RSWITCH)
 618                 link_policy |= HCI_LP_RSWITCH;
 619         if (hdev->features[0] & LMP_HOLD)
 620                 link_policy |= HCI_LP_HOLD;
 621         if (hdev->features[0] & LMP_SNIFF)
 622                 link_policy |= HCI_LP_SNIFF;
 623         if (hdev->features[1] & LMP_PARK)
 624                 link_policy |= HCI_LP_PARK;
 625
 626         link_policy = cpu_to_le16(link_policy);
 627         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 628                                         sizeof(link_policy), &link_policy);
 629 }
 630
 631 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 632 {
 633         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 634
 635         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 636
 637         if (rp->status)
 638                 goto done;
 639
 640         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 641
 642         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 643                 hci_setup_link_policy(hdev);
 644
 645 done:
 646         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 647 }
 648
 649 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 650 {
 651         struct hci_rp_read_local_features *rp = (void *) skb->data;
 652
 653         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 654
 655         if (rp->status)
 656                 return;
 657
 658         memcpy(hdev->features, rp->features, 8);
 659
 660         /* Adjust default settings according to features
 661          * supported by device. */
 662
 663         if (hdev->features[0] & LMP_3SLOT)
 664                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 665
 666         if (hdev->features[0] & LMP_5SLOT)
 667                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 668
 669         if (hdev->features[1] & LMP_HV2) {
 670                 hdev->pkt_type  |= (HCI_HV2);
 671                 hdev->esco_type |= (ESCO_HV2);
 672         }
 673
 674         if (hdev->features[1] & LMP_HV3) {
 675                 hdev->pkt_type  |= (HCI_HV3);
 676                 hdev->esco_type |= (ESCO_HV3);
 677         }
 678
 679         if (hdev->features[3] & LMP_ESCO)
 680                 hdev->esco_type |= (ESCO_EV3);
 681
 682         if (hdev->features[4] & LMP_EV4)
 683                 hdev->esco_type |= (ESCO_EV4);
 684
 685         if (hdev->features[4] & LMP_EV5)
 686                 hdev->esco_type |= (ESCO_EV5);
 687
 688         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 689                 hdev->esco_type |= (ESCO_2EV3);
 690
 691         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 692                 hdev->esco_type |= (ESCO_3EV3);
 693
 694         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 695                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 696
 697         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 698                                         hdev->features[0], hdev->features[1],
 699                                         hdev->features[2], hdev->features[3],
 700                                         hdev->features[4], hdev->features[5],
 701                                         hdev->features[6], hdev->features[7]);
 702 }
 703
 704 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 705                                                         struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         switch (rp->page) {
 715         case 0:
 716                 memcpy(hdev->features, rp->features, 8);
 717                 break;
 718         case 1:
 719                 memcpy(hdev->host_features, rp->features, 8);
 720                 break;
 721         }
 722
 723         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 724 }
 725
 726 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 727                                                 struct sk_buff *skb)
 728 {
 729         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 730
 731         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 732
 733         if (rp->status)
 734                 return;
 735
 736         hdev->flow_ctl_mode = rp->mode;
 737
 738         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 739 }
 740
 741 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 742 {
 743         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 744
 745         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 746
 747         if (rp->status)
 748                 return;
 749
 750         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 751         hdev->sco_mtu  = rp->sco_mtu;
 752         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 753         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 754
 755         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 756                 hdev->sco_mtu  = 64;
 757                 hdev->sco_pkts = 8;
 758         }
 759
 760         hdev->acl_cnt = hdev->acl_pkts;
 761         hdev->sco_cnt = hdev->sco_pkts;
 762
 763         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 764                                         hdev->acl_mtu, hdev->acl_pkts,
 765                                         hdev->sco_mtu, hdev->sco_pkts);
 766 }
 767
 768 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 769 {
 770         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 771
 772         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 773
 774         if (!rp->status)
 775                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 776
 777         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 778 }
 779
 780 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 781                                                         struct sk_buff *skb)
 782 {
 783         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 784
 785         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 786
 787         if (rp->status)
 788                 return;
 789
 790         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 791         hdev->block_len = __le16_to_cpu(rp->block_len);
 792         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 793
 794         hdev->block_cnt = hdev->num_blocks;
 795
 796         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 797                                         hdev->block_cnt, hdev->block_len);
 798
 799         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 800 }
 801
 802 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 803 {
 804         __u8 status = *((__u8 *) skb->data);
 805
 806         BT_DBG("%s status 0x%x", hdev->name, status);
 807
 808         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 809 }
 810
 811 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 812                 struct sk_buff *skb)
 813 {
 814         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 815
 816         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 817
 818         if (rp->status)
 819                 return;
 820
 821         hdev->amp_status = rp->amp_status;
 822         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 823         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 824         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 825         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 826         hdev->amp_type = rp->amp_type;
 827         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 828         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 829         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 830         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 831
 832         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 833 }
 834
 835 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 836                                                         struct sk_buff *skb)
 837 {
 838         __u8 status = *((__u8 *) skb->data);
 839
 840         BT_DBG("%s status 0x%x", hdev->name, status);
 841
 842         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 843 }
 844
 845 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 846 {
 847         __u8 status = *((__u8 *) skb->data);
 848
 849         BT_DBG("%s status 0x%x", hdev->name, status);
 850
 851         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 852 }
 853
 854 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 855                                                         struct sk_buff *skb)
 856 {
 857         __u8 status = *((__u8 *) skb->data);
 858
 859         BT_DBG("%s status 0x%x", hdev->name, status);
 860
 861         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 862 }
 863
 864 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 865                                                         struct sk_buff *skb)
 866 {
 867         __u8 status = *((__u8 *) skb->data);
 868
 869         BT_DBG("%s status 0x%x", hdev->name, status);
 870
 871         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 872 }
 873
 874 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         __u8 status = *((__u8 *) skb->data);
 877
 878         BT_DBG("%s status 0x%x", hdev->name, status);
 879
 880         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 881 }
 882
 883 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 884 {
 885         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 886         struct hci_cp_pin_code_reply *cp;
 887         struct hci_conn *conn;
 888
 889         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 890
 891         hci_dev_lock(hdev);
 892
 893         if (test_bit(HCI_MGMT, &hdev->flags))
 894                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 895
 896         if (rp->status != 0)
 897                 goto unlock;
 898
 899         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 900         if (!cp)
 901                 goto unlock;
 902
 903         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 904         if (conn)
 905                 conn->pin_length = cp->pin_len;
 906
 907 unlock:
 908         hci_dev_unlock(hdev);
 909 }
 910
 911 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 912 {
 913         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 914
 915         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 916
 917         hci_dev_lock(hdev);
 918
 919         if (test_bit(HCI_MGMT, &hdev->flags))
 920                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 921                                                                 rp->status);
 922
 923         hci_dev_unlock(hdev);
 924 }
 925
 926 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 927                                        struct sk_buff *skb)
 928 {
 929         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 930
 931         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 932
 933         if (rp->status)
 934                 return;
 935
 936         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 937         hdev->le_pkts = rp->le_max_pkt;
 938
 939         hdev->le_cnt = hdev->le_pkts;
 940
 941         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 942
 943         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 944 }
 945
 946 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 947 {
 948         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 949
 950         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 951
 952         hci_dev_lock(hdev);
 953
 954         if (test_bit(HCI_MGMT, &hdev->flags))
 955                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 956                                                                 rp->status);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 962                                                         struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (test_bit(HCI_MGMT, &hdev->flags))
 971                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 972                                                                 rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (test_bit(HCI_MGMT, &hdev->flags))
 986                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 987                                                                 rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 993                                                         struct sk_buff *skb)
 994 {
 995         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 996
 997         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 998
 999         hci_dev_lock(hdev);
1000
1001         if (test_bit(HCI_MGMT, &hdev->flags))
1002                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1003                                                                 rp->status);
1004
1005         hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1009                                                         struct sk_buff *skb)
1010 {
1011         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
1013         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1014
1015         hci_dev_lock(hdev);
1016         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1017                                                 rp->randomizer, rp->status);
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         __u8 status = *((__u8 *) skb->data);
1024
1025         BT_DBG("%s status 0x%x", hdev->name, status);
1026 }
1027
1028 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1029                                         struct sk_buff *skb)
1030 {
1031         struct hci_cp_le_set_scan_enable *cp;
1032         __u8 status = *((__u8 *) skb->data);
1033
1034         BT_DBG("%s status 0x%x", hdev->name, status);
1035
1036         if (status)
1037                 return;
1038
1039         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1040         if (!cp)
1041                 return;
1042
1043         switch (cp->enable) {
1044         case LE_SCANNING_ENABLED:
1045                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1046
1047                 cancel_delayed_work_sync(&hdev->adv_work);
1048
1049                 hci_dev_lock(hdev);
1050                 hci_adv_entries_clear(hdev);
1051                 hci_dev_unlock(hdev);
1052                 break;
1053
1054         case LE_SCANNING_DISABLED:
1055                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1056
1057                 cancel_delayed_work_sync(&hdev->adv_work);
1058                 queue_delayed_work(hdev->workqueue, &hdev->adv_work,
1059                                                  jiffies + ADV_CLEAR_TIMEOUT);
1060                 break;
1061
1062         default:
1063                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1064                 break;
1065         }
1066 }
1067
1068 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1069 {
1070         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1071
1072         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1073
1074         if (rp->status)
1075                 return;
1076
1077         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1078 }
1079
1080 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1081 {
1082         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1083
1084         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1085
1086         if (rp->status)
1087                 return;
1088
1089         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1090 }
1091
1092 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1093                                                         struct sk_buff *skb)
1094 {
1095         struct hci_cp_read_local_ext_features cp;
1096         __u8 status = *((__u8 *) skb->data);
1097
1098         BT_DBG("%s status 0x%x", hdev->name, status);
1099
1100         if (status)
1101                 return;
1102
1103         cp.page = 0x01;
1104         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1105 }
1106
1107 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1108 {
1109         BT_DBG("%s status 0x%x", hdev->name, status);
1110
1111         if (status) {
1112                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1113                 hci_conn_check_pending(hdev);
1114                 hci_dev_lock(hdev);
1115                 if (test_bit(HCI_MGMT, &hdev->flags))
1116                         mgmt_start_discovery_failed(hdev, status);
1117                 hci_dev_unlock(hdev);
1118                 return;
1119         }
1120
1121         set_bit(HCI_INQUIRY, &hdev->flags);
1122
1123         hci_dev_lock(hdev);
1124         mgmt_discovering(hdev, 1);
1125         hci_dev_unlock(hdev);
1126 }
1127
1128 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1129 {
1130         struct hci_cp_create_conn *cp;
1131         struct hci_conn *conn;
1132
1133         BT_DBG("%s status 0x%x", hdev->name, status);
1134
1135         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1136         if (!cp)
1137                 return;
1138
1139         hci_dev_lock(hdev);
1140
1141         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1142
1143         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1144
1145         if (status) {
1146                 if (conn && conn->state == BT_CONNECT) {
1147                         if (status != 0x0c || conn->attempt > 2) {
1148                                 conn->state = BT_CLOSED;
1149                                 hci_proto_connect_cfm(conn, status);
1150                                 hci_conn_del(conn);
1151                         } else
1152                                 conn->state = BT_CONNECT2;
1153                 }
1154         } else {
1155                 if (!conn) {
1156                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1157                         if (conn) {
1158                                 conn->out = 1;
1159                                 conn->link_mode |= HCI_LM_MASTER;
1160                         } else
1161                                 BT_ERR("No memory for new connection");
1162                 }
1163         }
1164
1165         hci_dev_unlock(hdev);
1166 }
1167
1168 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1169 {
1170         struct hci_cp_add_sco *cp;
1171         struct hci_conn *acl, *sco;
1172         __u16 handle;
1173
1174         BT_DBG("%s status 0x%x", hdev->name, status);
1175
1176         if (!status)
1177                 return;
1178
1179         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1180         if (!cp)
1181                 return;
1182
1183         handle = __le16_to_cpu(cp->handle);
1184
1185         BT_DBG("%s handle %d", hdev->name, handle);
1186
1187         hci_dev_lock(hdev);
1188
1189         acl = hci_conn_hash_lookup_handle(hdev, handle);
1190         if (acl) {
1191                 sco = acl->link;
1192                 if (sco) {
1193                         sco->state = BT_CLOSED;
1194
1195                         hci_proto_connect_cfm(sco, status);
1196                         hci_conn_del(sco);
1197                 }
1198         }
1199
1200         hci_dev_unlock(hdev);
1201 }
1202
1203 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1204 {
1205         struct hci_cp_auth_requested *cp;
1206         struct hci_conn *conn;
1207
1208         BT_DBG("%s status 0x%x", hdev->name, status);
1209
1210         if (!status)
1211                 return;
1212
1213         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1214         if (!cp)
1215                 return;
1216
1217         hci_dev_lock(hdev);
1218
1219         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1220         if (conn) {
1221                 if (conn->state == BT_CONFIG) {
1222                         hci_proto_connect_cfm(conn, status);
1223                         hci_conn_put(conn);
1224                 }
1225         }
1226
1227         hci_dev_unlock(hdev);
1228 }
1229
1230 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1231 {
1232         struct hci_cp_set_conn_encrypt *cp;
1233         struct hci_conn *conn;
1234
1235         BT_DBG("%s status 0x%x", hdev->name, status);
1236
1237         if (!status)
1238                 return;
1239
1240         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1241         if (!cp)
1242                 return;
1243
1244         hci_dev_lock(hdev);
1245
1246         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1247         if (conn) {
1248                 if (conn->state == BT_CONFIG) {
1249                         hci_proto_connect_cfm(conn, status);
1250                         hci_conn_put(conn);
1251                 }
1252         }
1253
1254         hci_dev_unlock(hdev);
1255 }
1256
1257 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1258                                                         struct hci_conn *conn)
1259 {
1260         if (conn->state != BT_CONFIG || !conn->out)
1261                 return 0;
1262
1263         if (conn->pending_sec_level == BT_SECURITY_SDP)
1264                 return 0;
1265
1266         /* Only request authentication for SSP connections or non-SSP
1267          * devices with sec_level HIGH or if MITM protection is requested */
1268         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1269                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1270                                 !(conn->auth_type & 0x01))
1271                 return 0;
1272
1273         return 1;
1274 }
1275
1276 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1277 {
1278         struct hci_cp_remote_name_req *cp;
1279         struct hci_conn *conn;
1280
1281         BT_DBG("%s status 0x%x", hdev->name, status);
1282
1283         /* If successful wait for the name req complete event before
1284          * checking for the need to do authentication */
1285         if (!status)
1286                 return;
1287
1288         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1289         if (!cp)
1290                 return;
1291
1292         hci_dev_lock(hdev);
1293
1294         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1295         if (!conn)
1296                 goto unlock;
1297
1298         if (!hci_outgoing_auth_needed(hdev, conn))
1299                 goto unlock;
1300
1301         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1302                 struct hci_cp_auth_requested cp;
1303                 cp.handle = __cpu_to_le16(conn->handle);
1304                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1305         }
1306
1307 unlock:
1308         hci_dev_unlock(hdev);
1309 }
1310
1311 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1312 {
1313         struct hci_cp_read_remote_features *cp;
1314         struct hci_conn *conn;
1315
1316         BT_DBG("%s status 0x%x", hdev->name, status);
1317
1318         if (!status)
1319                 return;
1320
1321         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1322         if (!cp)
1323                 return;
1324
1325         hci_dev_lock(hdev);
1326
1327         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1328         if (conn) {
1329                 if (conn->state == BT_CONFIG) {
1330                         hci_proto_connect_cfm(conn, status);
1331                         hci_conn_put(conn);
1332                 }
1333         }
1334
1335         hci_dev_unlock(hdev);
1336 }
1337
1338 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1339 {
1340         struct hci_cp_read_remote_ext_features *cp;
1341         struct hci_conn *conn;
1342
1343         BT_DBG("%s status 0x%x", hdev->name, status);
1344
1345         if (!status)
1346                 return;
1347
1348         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1349         if (!cp)
1350                 return;
1351
1352         hci_dev_lock(hdev);
1353
1354         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1355         if (conn) {
1356                 if (conn->state == BT_CONFIG) {
1357                         hci_proto_connect_cfm(conn, status);
1358                         hci_conn_put(conn);
1359                 }
1360         }
1361
1362         hci_dev_unlock(hdev);
1363 }
1364
1365 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1366 {
1367         struct hci_cp_setup_sync_conn *cp;
1368         struct hci_conn *acl, *sco;
1369         __u16 handle;
1370
1371         BT_DBG("%s status 0x%x", hdev->name, status);
1372
1373         if (!status)
1374                 return;
1375
1376         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1377         if (!cp)
1378                 return;
1379
1380         handle = __le16_to_cpu(cp->handle);
1381
1382         BT_DBG("%s handle %d", hdev->name, handle);
1383
1384         hci_dev_lock(hdev);
1385
1386         acl = hci_conn_hash_lookup_handle(hdev, handle);
1387         if (acl) {
1388                 sco = acl->link;
1389                 if (sco) {
1390                         sco->state = BT_CLOSED;
1391
1392                         hci_proto_connect_cfm(sco, status);
1393                         hci_conn_del(sco);
1394                 }
1395         }
1396
1397         hci_dev_unlock(hdev);
1398 }
1399
1400 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1401 {
1402         struct hci_cp_sniff_mode *cp;
1403         struct hci_conn *conn;
1404
1405         BT_DBG("%s status 0x%x", hdev->name, status);
1406
1407         if (!status)
1408                 return;
1409
1410         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1411         if (!cp)
1412                 return;
1413
1414         hci_dev_lock(hdev);
1415
1416         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1417         if (conn) {
1418                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1419
1420                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1421                         hci_sco_setup(conn, status);
1422         }
1423
1424         hci_dev_unlock(hdev);
1425 }
1426
1427 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1428 {
1429         struct hci_cp_exit_sniff_mode *cp;
1430         struct hci_conn *conn;
1431
1432         BT_DBG("%s status 0x%x", hdev->name, status);
1433
1434         if (!status)
1435                 return;
1436
1437         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1438         if (!cp)
1439                 return;
1440
1441         hci_dev_lock(hdev);
1442
1443         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1444         if (conn) {
1445                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1446
1447                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1448                         hci_sco_setup(conn, status);
1449         }
1450
1451         hci_dev_unlock(hdev);
1452 }
1453
1454 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1455 {
1456         struct hci_cp_le_create_conn *cp;
1457         struct hci_conn *conn;
1458
1459         BT_DBG("%s status 0x%x", hdev->name, status);
1460
1461         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1462         if (!cp)
1463                 return;
1464
1465         hci_dev_lock(hdev);
1466
1467         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1468
1469         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1470                 conn);
1471
1472         if (status) {
1473                 if (conn && conn->state == BT_CONNECT) {
1474                         conn->state = BT_CLOSED;
1475                         hci_proto_connect_cfm(conn, status);
1476                         hci_conn_del(conn);
1477                 }
1478         } else {
1479                 if (!conn) {
1480                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1481                         if (conn) {
1482                                 conn->dst_type = cp->peer_addr_type;
1483                                 conn->out = 1;
1484                         } else {
1485                                 BT_ERR("No memory for new connection");
1486                         }
1487                 }
1488         }
1489
1490         hci_dev_unlock(hdev);
1491 }
1492
1493 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1494 {
1495         BT_DBG("%s status 0x%x", hdev->name, status);
1496 }
1497
1498 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1499 {
1500         __u8 status = *((__u8 *) skb->data);
1501
1502         BT_DBG("%s status %d", hdev->name, status);
1503
1504         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1505
1506         hci_conn_check_pending(hdev);
1507
1508         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1509                 return;
1510
1511         hci_dev_lock(hdev);
1512         mgmt_discovering(hdev, 0);
1513         hci_dev_unlock(hdev);
1514 }
1515
1516 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1517 {
1518         struct inquiry_data data;
1519         struct inquiry_info *info = (void *) (skb->data + 1);
1520         int num_rsp = *((__u8 *) skb->data);
1521
1522         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1523
1524         if (!num_rsp)
1525                 return;
1526
1527         hci_dev_lock(hdev);
1528
1529         for (; num_rsp; num_rsp--, info++) {
1530                 bacpy(&data.bdaddr, &info->bdaddr);
1531                 data.pscan_rep_mode     = info->pscan_rep_mode;
1532                 data.pscan_period_mode  = info->pscan_period_mode;
1533                 data.pscan_mode         = info->pscan_mode;
1534                 memcpy(data.dev_class, info->dev_class, 3);
1535                 data.clock_offset       = info->clock_offset;
1536                 data.rssi               = 0x00;
1537                 data.ssp_mode           = 0x00;
1538                 hci_inquiry_cache_update(hdev, &data);
1539                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1540                                                 info->dev_class, 0, NULL);
1541         }
1542
1543         hci_dev_unlock(hdev);
1544 }
1545
1546 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1547 {
1548         struct hci_ev_conn_complete *ev = (void *) skb->data;
1549         struct hci_conn *conn;
1550
1551         BT_DBG("%s", hdev->name);
1552
1553         hci_dev_lock(hdev);
1554
1555         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1556         if (!conn) {
1557                 if (ev->link_type != SCO_LINK)
1558                         goto unlock;
1559
1560                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1561                 if (!conn)
1562                         goto unlock;
1563
1564                 conn->type = SCO_LINK;
1565         }
1566
1567         if (!ev->status) {
1568                 conn->handle = __le16_to_cpu(ev->handle);
1569
1570                 if (conn->type == ACL_LINK) {
1571                         conn->state = BT_CONFIG;
1572                         hci_conn_hold(conn);
1573                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1574                         mgmt_connected(hdev, &ev->bdaddr, conn->type,
1575                                                         conn->dst_type);
1576                 } else
1577                         conn->state = BT_CONNECTED;
1578
1579                 hci_conn_hold_device(conn);
1580                 hci_conn_add_sysfs(conn);
1581
1582                 if (test_bit(HCI_AUTH, &hdev->flags))
1583                         conn->link_mode |= HCI_LM_AUTH;
1584
1585                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1586                         conn->link_mode |= HCI_LM_ENCRYPT;
1587
1588                 /* Get remote features */
1589                 if (conn->type == ACL_LINK) {
1590                         struct hci_cp_read_remote_features cp;
1591                         cp.handle = ev->handle;
1592                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1593                                                         sizeof(cp), &cp);
1594                 }
1595
1596                 /* Set packet type for incoming connection */
1597                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1598                         struct hci_cp_change_conn_ptype cp;
1599                         cp.handle = ev->handle;
1600                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1601                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1602                                                         sizeof(cp), &cp);
1603                 }
1604         } else {
1605                 conn->state = BT_CLOSED;
1606                 if (conn->type == ACL_LINK)
1607                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1608                                                 conn->dst_type, ev->status);
1609         }
1610
1611         if (conn->type == ACL_LINK)
1612                 hci_sco_setup(conn, ev->status);
1613
1614         if (ev->status) {
1615                 hci_proto_connect_cfm(conn, ev->status);
1616                 hci_conn_del(conn);
1617         } else if (ev->link_type != ACL_LINK)
1618                 hci_proto_connect_cfm(conn, ev->status);
1619
1620 unlock:
1621         hci_dev_unlock(hdev);
1622
1623         hci_conn_check_pending(hdev);
1624 }
1625
1626 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1627 {
1628         struct hci_ev_conn_request *ev = (void *) skb->data;
1629         int mask = hdev->link_mode;
1630
1631         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1632                                         batostr(&ev->bdaddr), ev->link_type);
1633
1634         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1635
1636         if ((mask & HCI_LM_ACCEPT) &&
1637                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1638                 /* Connection accepted */
1639                 struct inquiry_entry *ie;
1640                 struct hci_conn *conn;
1641
1642                 hci_dev_lock(hdev);
1643
1644                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1645                 if (ie)
1646                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1647
1648                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1649                 if (!conn) {
1650                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1651                         if (!conn) {
1652                                 BT_ERR("No memory for new connection");
1653                                 hci_dev_unlock(hdev);
1654                                 return;
1655                         }
1656                 }
1657
1658                 memcpy(conn->dev_class, ev->dev_class, 3);
1659                 conn->state = BT_CONNECT;
1660
1661                 hci_dev_unlock(hdev);
1662
1663                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1664                         struct hci_cp_accept_conn_req cp;
1665
1666                         bacpy(&cp.bdaddr, &ev->bdaddr);
1667
1668                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1669                                 cp.role = 0x00; /* Become master */
1670                         else
1671                                 cp.role = 0x01; /* Remain slave */
1672
1673                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1674                                                         sizeof(cp), &cp);
1675                 } else {
1676                         struct hci_cp_accept_sync_conn_req cp;
1677
1678                         bacpy(&cp.bdaddr, &ev->bdaddr);
1679                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1680
1681                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1682                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1683                         cp.max_latency    = cpu_to_le16(0xffff);
1684                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1685                         cp.retrans_effort = 0xff;
1686
1687                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1688                                                         sizeof(cp), &cp);
1689                 }
1690         } else {
1691                 /* Connection rejected */
1692                 struct hci_cp_reject_conn_req cp;
1693
1694                 bacpy(&cp.bdaddr, &ev->bdaddr);
1695                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1696                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1697         }
1698 }
1699
1700 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1701 {
1702         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1703         struct hci_conn *conn;
1704
1705         BT_DBG("%s status %d", hdev->name, ev->status);
1706
1707         hci_dev_lock(hdev);
1708
1709         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1710         if (!conn)
1711                 goto unlock;
1712
1713         if (ev->status == 0)
1714                 conn->state = BT_CLOSED;
1715
1716         if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1717                 if (ev->status != 0)
1718                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1719                 else
1720                         mgmt_disconnected(hdev, &conn->dst, conn->type,
1721                                                         conn->dst_type);
1722         }
1723
1724         if (ev->status == 0) {
1725                 hci_proto_disconn_cfm(conn, ev->reason);
1726                 hci_conn_del(conn);
1727         }
1728
1729 unlock:
1730         hci_dev_unlock(hdev);
1731 }
1732
1733 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1734 {
1735         struct hci_ev_auth_complete *ev = (void *) skb->data;
1736         struct hci_conn *conn;
1737
1738         BT_DBG("%s status %d", hdev->name, ev->status);
1739
1740         hci_dev_lock(hdev);
1741
1742         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1743         if (!conn)
1744                 goto unlock;
1745
1746         if (!ev->status) {
1747                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1748                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1749                         BT_INFO("re-auth of legacy device is not possible.");
1750                 } else {
1751                         conn->link_mode |= HCI_LM_AUTH;
1752                         conn->sec_level = conn->pending_sec_level;
1753                 }
1754         } else {
1755                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1756         }
1757
1758         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1759         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1760
1761         if (conn->state == BT_CONFIG) {
1762                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1763                         struct hci_cp_set_conn_encrypt cp;
1764                         cp.handle  = ev->handle;
1765                         cp.encrypt = 0x01;
1766                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1767                                                                         &cp);
1768                 } else {
1769                         conn->state = BT_CONNECTED;
1770                         hci_proto_connect_cfm(conn, ev->status);
1771                         hci_conn_put(conn);
1772                 }
1773         } else {
1774                 hci_auth_cfm(conn, ev->status);
1775
1776                 hci_conn_hold(conn);
1777                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1778                 hci_conn_put(conn);
1779         }
1780
1781         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1782                 if (!ev->status) {
1783                         struct hci_cp_set_conn_encrypt cp;
1784                         cp.handle  = ev->handle;
1785                         cp.encrypt = 0x01;
1786                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1787                                                                         &cp);
1788                 } else {
1789                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1790                         hci_encrypt_cfm(conn, ev->status, 0x00);
1791                 }
1792         }
1793
1794 unlock:
1795         hci_dev_unlock(hdev);
1796 }
1797
1798 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1799 {
1800         struct hci_ev_remote_name *ev = (void *) skb->data;
1801         struct hci_conn *conn;
1802
1803         BT_DBG("%s", hdev->name);
1804
1805         hci_conn_check_pending(hdev);
1806
1807         hci_dev_lock(hdev);
1808
1809         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1810                 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
1811
1812         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1813         if (!conn)
1814                 goto unlock;
1815
1816         if (!hci_outgoing_auth_needed(hdev, conn))
1817                 goto unlock;
1818
1819         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1820                 struct hci_cp_auth_requested cp;
1821                 cp.handle = __cpu_to_le16(conn->handle);
1822                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1823         }
1824
1825 unlock:
1826         hci_dev_unlock(hdev);
1827 }
1828
1829 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1830 {
1831         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1832         struct hci_conn *conn;
1833
1834         BT_DBG("%s status %d", hdev->name, ev->status);
1835
1836         hci_dev_lock(hdev);
1837
1838         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1839         if (conn) {
1840                 if (!ev->status) {
1841                         if (ev->encrypt) {
1842                                 /* Encryption implies authentication */
1843                                 conn->link_mode |= HCI_LM_AUTH;
1844                                 conn->link_mode |= HCI_LM_ENCRYPT;
1845                                 conn->sec_level = conn->pending_sec_level;
1846                         } else
1847                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1848                 }
1849
1850                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1851
1852                 if (conn->state == BT_CONFIG) {
1853                         if (!ev->status)
1854                                 conn->state = BT_CONNECTED;
1855
1856                         hci_proto_connect_cfm(conn, ev->status);
1857                         hci_conn_put(conn);
1858                 } else
1859                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1860         }
1861
1862         hci_dev_unlock(hdev);
1863 }
1864
1865 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1866 {
1867         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1868         struct hci_conn *conn;
1869
1870         BT_DBG("%s status %d", hdev->name, ev->status);
1871
1872         hci_dev_lock(hdev);
1873
1874         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1875         if (conn) {
1876                 if (!ev->status)
1877                         conn->link_mode |= HCI_LM_SECURE;
1878
1879                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1880
1881                 hci_key_change_cfm(conn, ev->status);
1882         }
1883
1884         hci_dev_unlock(hdev);
1885 }
1886
1887 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1888 {
1889         struct hci_ev_remote_features *ev = (void *) skb->data;
1890         struct hci_conn *conn;
1891
1892         BT_DBG("%s status %d", hdev->name, ev->status);
1893
1894         hci_dev_lock(hdev);
1895
1896         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1897         if (!conn)
1898                 goto unlock;
1899
1900         if (!ev->status)
1901                 memcpy(conn->features, ev->features, 8);
1902
1903         if (conn->state != BT_CONFIG)
1904                 goto unlock;
1905
1906         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1907                 struct hci_cp_read_remote_ext_features cp;
1908                 cp.handle = ev->handle;
1909                 cp.page = 0x01;
1910                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1911                                                         sizeof(cp), &cp);
1912                 goto unlock;
1913         }
1914
1915         if (!ev->status) {
1916                 struct hci_cp_remote_name_req cp;
1917                 memset(&cp, 0, sizeof(cp));
1918                 bacpy(&cp.bdaddr, &conn->dst);
1919                 cp.pscan_rep_mode = 0x02;
1920                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1921         }
1922
1923         if (!hci_outgoing_auth_needed(hdev, conn)) {
1924                 conn->state = BT_CONNECTED;
1925                 hci_proto_connect_cfm(conn, ev->status);
1926                 hci_conn_put(conn);
1927         }
1928
1929 unlock:
1930         hci_dev_unlock(hdev);
1931 }
1932
1933 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1934 {
1935         BT_DBG("%s", hdev->name);
1936 }
1937
1938 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1939 {
1940         BT_DBG("%s", hdev->name);
1941 }
1942
1943 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1944 {
1945         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1946         __u16 opcode;
1947
1948         skb_pull(skb, sizeof(*ev));
1949
1950         opcode = __le16_to_cpu(ev->opcode);
1951
1952         switch (opcode) {
1953         case HCI_OP_INQUIRY_CANCEL:
1954                 hci_cc_inquiry_cancel(hdev, skb);
1955                 break;
1956
1957         case HCI_OP_EXIT_PERIODIC_INQ:
1958                 hci_cc_exit_periodic_inq(hdev, skb);
1959                 break;
1960
1961         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1962                 hci_cc_remote_name_req_cancel(hdev, skb);
1963                 break;
1964
1965         case HCI_OP_ROLE_DISCOVERY:
1966                 hci_cc_role_discovery(hdev, skb);
1967                 break;
1968
1969         case HCI_OP_READ_LINK_POLICY:
1970                 hci_cc_read_link_policy(hdev, skb);
1971                 break;
1972
1973         case HCI_OP_WRITE_LINK_POLICY:
1974                 hci_cc_write_link_policy(hdev, skb);
1975                 break;
1976
1977         case HCI_OP_READ_DEF_LINK_POLICY:
1978                 hci_cc_read_def_link_policy(hdev, skb);
1979                 break;
1980
1981         case HCI_OP_WRITE_DEF_LINK_POLICY:
1982                 hci_cc_write_def_link_policy(hdev, skb);
1983                 break;
1984
1985         case HCI_OP_RESET:
1986                 hci_cc_reset(hdev, skb);
1987                 break;
1988
1989         case HCI_OP_WRITE_LOCAL_NAME:
1990                 hci_cc_write_local_name(hdev, skb);
1991                 break;
1992
1993         case HCI_OP_READ_LOCAL_NAME:
1994                 hci_cc_read_local_name(hdev, skb);
1995                 break;
1996
1997         case HCI_OP_WRITE_AUTH_ENABLE:
1998                 hci_cc_write_auth_enable(hdev, skb);
1999                 break;
2000
2001         case HCI_OP_WRITE_ENCRYPT_MODE:
2002                 hci_cc_write_encrypt_mode(hdev, skb);
2003                 break;
2004
2005         case HCI_OP_WRITE_SCAN_ENABLE:
2006                 hci_cc_write_scan_enable(hdev, skb);
2007                 break;
2008
2009         case HCI_OP_READ_CLASS_OF_DEV:
2010                 hci_cc_read_class_of_dev(hdev, skb);
2011                 break;
2012
2013         case HCI_OP_WRITE_CLASS_OF_DEV:
2014                 hci_cc_write_class_of_dev(hdev, skb);
2015                 break;
2016
2017         case HCI_OP_READ_VOICE_SETTING:
2018                 hci_cc_read_voice_setting(hdev, skb);
2019                 break;
2020
2021         case HCI_OP_WRITE_VOICE_SETTING:
2022                 hci_cc_write_voice_setting(hdev, skb);
2023                 break;
2024
2025         case HCI_OP_HOST_BUFFER_SIZE:
2026                 hci_cc_host_buffer_size(hdev, skb);
2027                 break;
2028
2029         case HCI_OP_READ_SSP_MODE:
2030                 hci_cc_read_ssp_mode(hdev, skb);
2031                 break;
2032
2033         case HCI_OP_WRITE_SSP_MODE:
2034                 hci_cc_write_ssp_mode(hdev, skb);
2035                 break;
2036
2037         case HCI_OP_READ_LOCAL_VERSION:
2038                 hci_cc_read_local_version(hdev, skb);
2039                 break;
2040
2041         case HCI_OP_READ_LOCAL_COMMANDS:
2042                 hci_cc_read_local_commands(hdev, skb);
2043                 break;
2044
2045         case HCI_OP_READ_LOCAL_FEATURES:
2046                 hci_cc_read_local_features(hdev, skb);
2047                 break;
2048
2049         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2050                 hci_cc_read_local_ext_features(hdev, skb);
2051                 break;
2052
2053         case HCI_OP_READ_BUFFER_SIZE:
2054                 hci_cc_read_buffer_size(hdev, skb);
2055                 break;
2056
2057         case HCI_OP_READ_BD_ADDR:
2058                 hci_cc_read_bd_addr(hdev, skb);
2059                 break;
2060
2061         case HCI_OP_READ_DATA_BLOCK_SIZE:
2062                 hci_cc_read_data_block_size(hdev, skb);
2063                 break;
2064
2065         case HCI_OP_WRITE_CA_TIMEOUT:
2066                 hci_cc_write_ca_timeout(hdev, skb);
2067                 break;
2068
2069         case HCI_OP_READ_FLOW_CONTROL_MODE:
2070                 hci_cc_read_flow_control_mode(hdev, skb);
2071                 break;
2072
2073         case HCI_OP_READ_LOCAL_AMP_INFO:
2074                 hci_cc_read_local_amp_info(hdev, skb);
2075                 break;
2076
2077         case HCI_OP_DELETE_STORED_LINK_KEY:
2078                 hci_cc_delete_stored_link_key(hdev, skb);
2079                 break;
2080
2081         case HCI_OP_SET_EVENT_MASK:
2082                 hci_cc_set_event_mask(hdev, skb);
2083                 break;
2084
2085         case HCI_OP_WRITE_INQUIRY_MODE:
2086                 hci_cc_write_inquiry_mode(hdev, skb);
2087                 break;
2088
2089         case HCI_OP_READ_INQ_RSP_TX_POWER:
2090                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2091                 break;
2092
2093         case HCI_OP_SET_EVENT_FLT:
2094                 hci_cc_set_event_flt(hdev, skb);
2095                 break;
2096
2097         case HCI_OP_PIN_CODE_REPLY:
2098                 hci_cc_pin_code_reply(hdev, skb);
2099                 break;
2100
2101         case HCI_OP_PIN_CODE_NEG_REPLY:
2102                 hci_cc_pin_code_neg_reply(hdev, skb);
2103                 break;
2104
2105         case HCI_OP_READ_LOCAL_OOB_DATA:
2106                 hci_cc_read_local_oob_data_reply(hdev, skb);
2107                 break;
2108
2109         case HCI_OP_LE_READ_BUFFER_SIZE:
2110                 hci_cc_le_read_buffer_size(hdev, skb);
2111                 break;
2112
2113         case HCI_OP_USER_CONFIRM_REPLY:
2114                 hci_cc_user_confirm_reply(hdev, skb);
2115                 break;
2116
2117         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2118                 hci_cc_user_confirm_neg_reply(hdev, skb);
2119                 break;
2120
2121         case HCI_OP_USER_PASSKEY_REPLY:
2122                 hci_cc_user_passkey_reply(hdev, skb);
2123                 break;
2124
2125         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2126                 hci_cc_user_passkey_neg_reply(hdev, skb);
2127
2128         case HCI_OP_LE_SET_SCAN_PARAM:
2129                 hci_cc_le_set_scan_param(hdev, skb);
2130                 break;
2131
2132         case HCI_OP_LE_SET_SCAN_ENABLE:
2133                 hci_cc_le_set_scan_enable(hdev, skb);
2134                 break;
2135
2136         case HCI_OP_LE_LTK_REPLY:
2137                 hci_cc_le_ltk_reply(hdev, skb);
2138                 break;
2139
2140         case HCI_OP_LE_LTK_NEG_REPLY:
2141                 hci_cc_le_ltk_neg_reply(hdev, skb);
2142                 break;
2143
2144         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2145                 hci_cc_write_le_host_supported(hdev, skb);
2146                 break;
2147
2148         default:
2149                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2150                 break;
2151         }
2152
2153         if (ev->opcode != HCI_OP_NOP)
2154                 del_timer(&hdev->cmd_timer);
2155
2156         if (ev->ncmd) {
2157                 atomic_set(&hdev->cmd_cnt, 1);
2158                 if (!skb_queue_empty(&hdev->cmd_q))
2159                         queue_work(hdev->workqueue, &hdev->cmd_work);
2160         }
2161 }
2162
2163 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2164 {
2165         struct hci_ev_cmd_status *ev = (void *) skb->data;
2166         __u16 opcode;
2167
2168         skb_pull(skb, sizeof(*ev));
2169
2170         opcode = __le16_to_cpu(ev->opcode);
2171
2172         switch (opcode) {
2173         case HCI_OP_INQUIRY:
2174                 hci_cs_inquiry(hdev, ev->status);
2175                 break;
2176
2177         case HCI_OP_CREATE_CONN:
2178                 hci_cs_create_conn(hdev, ev->status);
2179                 break;
2180
2181         case HCI_OP_ADD_SCO:
2182                 hci_cs_add_sco(hdev, ev->status);
2183                 break;
2184
2185         case HCI_OP_AUTH_REQUESTED:
2186                 hci_cs_auth_requested(hdev, ev->status);
2187                 break;
2188
2189         case HCI_OP_SET_CONN_ENCRYPT:
2190                 hci_cs_set_conn_encrypt(hdev, ev->status);
2191                 break;
2192
2193         case HCI_OP_REMOTE_NAME_REQ:
2194                 hci_cs_remote_name_req(hdev, ev->status);
2195                 break;
2196
2197         case HCI_OP_READ_REMOTE_FEATURES:
2198                 hci_cs_read_remote_features(hdev, ev->status);
2199                 break;
2200
2201         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2202                 hci_cs_read_remote_ext_features(hdev, ev->status);
2203                 break;
2204
2205         case HCI_OP_SETUP_SYNC_CONN:
2206                 hci_cs_setup_sync_conn(hdev, ev->status);
2207                 break;
2208
2209         case HCI_OP_SNIFF_MODE:
2210                 hci_cs_sniff_mode(hdev, ev->status);
2211                 break;
2212
2213         case HCI_OP_EXIT_SNIFF_MODE:
2214                 hci_cs_exit_sniff_mode(hdev, ev->status);
2215                 break;
2216
2217         case HCI_OP_DISCONNECT:
2218                 if (ev->status != 0)
2219                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2220                 break;
2221
2222         case HCI_OP_LE_CREATE_CONN:
2223                 hci_cs_le_create_conn(hdev, ev->status);
2224                 break;
2225
2226         case HCI_OP_LE_START_ENC:
2227                 hci_cs_le_start_enc(hdev, ev->status);
2228                 break;
2229
2230         default:
2231                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2232                 break;
2233         }
2234
2235         if (ev->opcode != HCI_OP_NOP)
2236                 del_timer(&hdev->cmd_timer);
2237
2238         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2239                 atomic_set(&hdev->cmd_cnt, 1);
2240                 if (!skb_queue_empty(&hdev->cmd_q))
2241                         queue_work(hdev->workqueue, &hdev->cmd_work);
2242         }
2243 }
2244
2245 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2246 {
2247         struct hci_ev_role_change *ev = (void *) skb->data;
2248         struct hci_conn *conn;
2249
2250         BT_DBG("%s status %d", hdev->name, ev->status);
2251
2252         hci_dev_lock(hdev);
2253
2254         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2255         if (conn) {
2256                 if (!ev->status) {
2257                         if (ev->role)
2258                                 conn->link_mode &= ~HCI_LM_MASTER;
2259                         else
2260                                 conn->link_mode |= HCI_LM_MASTER;
2261                 }
2262
2263                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2264
2265                 hci_role_switch_cfm(conn, ev->status, ev->role);
2266         }
2267
2268         hci_dev_unlock(hdev);
2269 }
2270
2271 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2272 {
2273         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2274         int i;
2275
2276         skb_pull(skb, sizeof(*ev));
2277
2278         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2279
2280         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2281                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2282                 return;
2283         }
2284
2285         if (skb->len < ev->num_hndl * 4) {
2286                 BT_DBG("%s bad parameters", hdev->name);
2287                 return;
2288         }
2289
2290         for (i = 0; i < ev->num_hndl; i++) {
2291                 struct hci_comp_pkts_info *info = &ev->handles[i];
2292                 struct hci_conn *conn;
2293                 __u16  handle, count;
2294
2295                 handle = __le16_to_cpu(info->handle);
2296                 count  = __le16_to_cpu(info->count);
2297
2298                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2299                 if (!conn)
2300                         continue;
2301
2302                 conn->sent -= count;
2303
2304                 switch (conn->type) {
2305                 case ACL_LINK:
2306                         hdev->acl_cnt += count;
2307                         if (hdev->acl_cnt > hdev->acl_pkts)
2308                                 hdev->acl_cnt = hdev->acl_pkts;
2309                         break;
2310
2311                 case LE_LINK:
2312                         if (hdev->le_pkts) {
2313                                 hdev->le_cnt += count;
2314                                 if (hdev->le_cnt > hdev->le_pkts)
2315                                         hdev->le_cnt = hdev->le_pkts;
2316                         } else {
2317                                 hdev->acl_cnt += count;
2318                                 if (hdev->acl_cnt > hdev->acl_pkts)
2319                                         hdev->acl_cnt = hdev->acl_pkts;
2320                         }
2321                         break;
2322
2323                 case SCO_LINK:
2324                         hdev->sco_cnt += count;
2325                         if (hdev->sco_cnt > hdev->sco_pkts)
2326                                 hdev->sco_cnt = hdev->sco_pkts;
2327                         break;
2328
2329                 default:
2330                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2331                         break;
2332                 }
2333         }
2334
2335         queue_work(hdev->workqueue, &hdev->tx_work);
2336 }
2337
2338 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2339 {
2340         struct hci_ev_mode_change *ev = (void *) skb->data;
2341         struct hci_conn *conn;
2342
2343         BT_DBG("%s status %d", hdev->name, ev->status);
2344
2345         hci_dev_lock(hdev);
2346
2347         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2348         if (conn) {
2349                 conn->mode = ev->mode;
2350                 conn->interval = __le16_to_cpu(ev->interval);
2351
2352                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2353                         if (conn->mode == HCI_CM_ACTIVE)
2354                                 conn->power_save = 1;
2355                         else
2356                                 conn->power_save = 0;
2357                 }
2358
2359                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2360                         hci_sco_setup(conn, ev->status);
2361         }
2362
2363         hci_dev_unlock(hdev);
2364 }
2365
2366 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2367 {
2368         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2369         struct hci_conn *conn;
2370
2371         BT_DBG("%s", hdev->name);
2372
2373         hci_dev_lock(hdev);
2374
2375         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2376         if (!conn)
2377                 goto unlock;
2378
2379         if (conn->state == BT_CONNECTED) {
2380                 hci_conn_hold(conn);
2381                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2382                 hci_conn_put(conn);
2383         }
2384
2385         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2386                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2387                                         sizeof(ev->bdaddr), &ev->bdaddr);
2388         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2389                 u8 secure;
2390
2391                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2392                         secure = 1;
2393                 else
2394                         secure = 0;
2395
2396                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2397         }
2398
2399 unlock:
2400         hci_dev_unlock(hdev);
2401 }
2402
2403 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2404 {
2405         struct hci_ev_link_key_req *ev = (void *) skb->data;
2406         struct hci_cp_link_key_reply cp;
2407         struct hci_conn *conn;
2408         struct link_key *key;
2409
2410         BT_DBG("%s", hdev->name);
2411
2412         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2413                 return;
2414
2415         hci_dev_lock(hdev);
2416
2417         key = hci_find_link_key(hdev, &ev->bdaddr);
2418         if (!key) {
2419                 BT_DBG("%s link key not found for %s", hdev->name,
2420                                                         batostr(&ev->bdaddr));
2421                 goto not_found;
2422         }
2423
2424         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2425                                                         batostr(&ev->bdaddr));
2426
2427         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2428                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2429                 BT_DBG("%s ignoring debug key", hdev->name);
2430                 goto not_found;
2431         }
2432
2433         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2434         if (conn) {
2435                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2436                                 conn->auth_type != 0xff &&
2437                                 (conn->auth_type & 0x01)) {
2438                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2439                         goto not_found;
2440                 }
2441
2442                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2443                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2444                         BT_DBG("%s ignoring key unauthenticated for high \
2445                                                         security", hdev->name);
2446                         goto not_found;
2447                 }
2448
2449                 conn->key_type = key->type;
2450                 conn->pin_length = key->pin_len;
2451         }
2452
2453         bacpy(&cp.bdaddr, &ev->bdaddr);
2454         memcpy(cp.link_key, key->val, 16);
2455
2456         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2457
2458         hci_dev_unlock(hdev);
2459
2460         return;
2461
2462 not_found:
2463         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2464         hci_dev_unlock(hdev);
2465 }
2466
2467 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2468 {
2469         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2470         struct hci_conn *conn;
2471         u8 pin_len = 0;
2472
2473         BT_DBG("%s", hdev->name);
2474
2475         hci_dev_lock(hdev);
2476
2477         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2478         if (conn) {
2479                 hci_conn_hold(conn);
2480                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2481                 pin_len = conn->pin_length;
2482
2483                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2484                         conn->key_type = ev->key_type;
2485
2486                 hci_conn_put(conn);
2487         }
2488
2489         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2490                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2491                                                         ev->key_type, pin_len);
2492
2493         hci_dev_unlock(hdev);
2494 }
2495
2496 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2497 {
2498         struct hci_ev_clock_offset *ev = (void *) skb->data;
2499         struct hci_conn *conn;
2500
2501         BT_DBG("%s status %d", hdev->name, ev->status);
2502
2503         hci_dev_lock(hdev);
2504
2505         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2506         if (conn && !ev->status) {
2507                 struct inquiry_entry *ie;
2508
2509                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2510                 if (ie) {
2511                         ie->data.clock_offset = ev->clock_offset;
2512                         ie->timestamp = jiffies;
2513                 }
2514         }
2515
2516         hci_dev_unlock(hdev);
2517 }
2518
2519 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2520 {
2521         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2522         struct hci_conn *conn;
2523
2524         BT_DBG("%s status %d", hdev->name, ev->status);
2525
2526         hci_dev_lock(hdev);
2527
2528         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2529         if (conn && !ev->status)
2530                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2531
2532         hci_dev_unlock(hdev);
2533 }
2534
2535 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2536 {
2537         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2538         struct inquiry_entry *ie;
2539
2540         BT_DBG("%s", hdev->name);
2541
2542         hci_dev_lock(hdev);
2543
2544         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2545         if (ie) {
2546                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2547                 ie->timestamp = jiffies;
2548         }
2549
2550         hci_dev_unlock(hdev);
2551 }
2552
2553 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2554 {
2555         struct inquiry_data data;
2556         int num_rsp = *((__u8 *) skb->data);
2557
2558         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2559
2560         if (!num_rsp)
2561                 return;
2562
2563         hci_dev_lock(hdev);
2564
2565         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2566                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2567                 info = (void *) (skb->data + 1);
2568
2569                 for (; num_rsp; num_rsp--, info++) {
2570                         bacpy(&data.bdaddr, &info->bdaddr);
2571                         data.pscan_rep_mode     = info->pscan_rep_mode;
2572                         data.pscan_period_mode  = info->pscan_period_mode;
2573                         data.pscan_mode         = info->pscan_mode;
2574                         memcpy(data.dev_class, info->dev_class, 3);
2575                         data.clock_offset       = info->clock_offset;
2576                         data.rssi               = info->rssi;
2577                         data.ssp_mode           = 0x00;
2578                         hci_inquiry_cache_update(hdev, &data);
2579                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2580                                                 info->dev_class, info->rssi,
2581                                                 NULL);
2582                 }
2583         } else {
2584                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2585
2586                 for (; num_rsp; num_rsp--, info++) {
2587                         bacpy(&data.bdaddr, &info->bdaddr);
2588                         data.pscan_rep_mode     = info->pscan_rep_mode;
2589                         data.pscan_period_mode  = info->pscan_period_mode;
2590                         data.pscan_mode         = 0x00;
2591                         memcpy(data.dev_class, info->dev_class, 3);
2592                         data.clock_offset       = info->clock_offset;
2593                         data.rssi               = info->rssi;
2594                         data.ssp_mode           = 0x00;
2595                         hci_inquiry_cache_update(hdev, &data);
2596                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2597                                                 info->dev_class, info->rssi,
2598                                                 NULL);
2599                 }
2600         }
2601
2602         hci_dev_unlock(hdev);
2603 }
2604
2605 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2606 {
2607         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2608         struct hci_conn *conn;
2609
2610         BT_DBG("%s", hdev->name);
2611
2612         hci_dev_lock(hdev);
2613
2614         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2615         if (!conn)
2616                 goto unlock;
2617
2618         if (!ev->status && ev->page == 0x01) {
2619                 struct inquiry_entry *ie;
2620
2621                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2622                 if (ie)
2623                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2624
2625                 conn->ssp_mode = (ev->features[0] & 0x01);
2626         }
2627
2628         if (conn->state != BT_CONFIG)
2629                 goto unlock;
2630
2631         if (!ev->status) {
2632                 struct hci_cp_remote_name_req cp;
2633                 memset(&cp, 0, sizeof(cp));
2634                 bacpy(&cp.bdaddr, &conn->dst);
2635                 cp.pscan_rep_mode = 0x02;
2636                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2637         }
2638
2639         if (!hci_outgoing_auth_needed(hdev, conn)) {
2640                 conn->state = BT_CONNECTED;
2641                 hci_proto_connect_cfm(conn, ev->status);
2642                 hci_conn_put(conn);
2643         }
2644
2645 unlock:
2646         hci_dev_unlock(hdev);
2647 }
2648
2649 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2650 {
2651         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2652         struct hci_conn *conn;
2653
2654         BT_DBG("%s status %d", hdev->name, ev->status);
2655
2656         hci_dev_lock(hdev);
2657
2658         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2659         if (!conn) {
2660                 if (ev->link_type == ESCO_LINK)
2661                         goto unlock;
2662
2663                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2664                 if (!conn)
2665                         goto unlock;
2666
2667                 conn->type = SCO_LINK;
2668         }
2669
2670         switch (ev->status) {
2671         case 0x00:
2672                 conn->handle = __le16_to_cpu(ev->handle);
2673                 conn->state  = BT_CONNECTED;
2674
2675                 hci_conn_hold_device(conn);
2676                 hci_conn_add_sysfs(conn);
2677                 break;
2678
2679         case 0x11:      /* Unsupported Feature or Parameter Value */
2680         case 0x1c:      /* SCO interval rejected */
2681         case 0x1a:      /* Unsupported Remote Feature */
2682         case 0x1f:      /* Unspecified error */
2683                 if (conn->out && conn->attempt < 2) {
2684                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2685                                         (hdev->esco_type & EDR_ESCO_MASK);
2686                         hci_setup_sync(conn, conn->link->handle);
2687                         goto unlock;
2688                 }
2689                 /* fall through */
2690
2691         default:
2692                 conn->state = BT_CLOSED;
2693                 break;
2694         }
2695
2696         hci_proto_connect_cfm(conn, ev->status);
2697         if (ev->status)
2698                 hci_conn_del(conn);
2699
2700 unlock:
2701         hci_dev_unlock(hdev);
2702 }
2703
2704 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2705 {
2706         BT_DBG("%s", hdev->name);
2707 }
2708
2709 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2710 {
2711         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2712
2713         BT_DBG("%s status %d", hdev->name, ev->status);
2714 }
2715
2716 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2717 {
2718         struct inquiry_data data;
2719         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2720         int num_rsp = *((__u8 *) skb->data);
2721
2722         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2723
2724         if (!num_rsp)
2725                 return;
2726
2727         hci_dev_lock(hdev);
2728
2729         for (; num_rsp; num_rsp--, info++) {
2730                 bacpy(&data.bdaddr, &info->bdaddr);
2731                 data.pscan_rep_mode     = info->pscan_rep_mode;
2732                 data.pscan_period_mode  = info->pscan_period_mode;
2733                 data.pscan_mode         = 0x00;
2734                 memcpy(data.dev_class, info->dev_class, 3);
2735                 data.clock_offset       = info->clock_offset;
2736                 data.rssi               = info->rssi;
2737                 data.ssp_mode           = 0x01;
2738                 hci_inquiry_cache_update(hdev, &data);
2739                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2740                                 info->dev_class, info->rssi, info->data);
2741         }
2742
2743         hci_dev_unlock(hdev);
2744 }
2745
2746 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2747 {
2748         /* If remote requests dedicated bonding follow that lead */
2749         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2750                 /* If both remote and local IO capabilities allow MITM
2751                  * protection then require it, otherwise don't */
2752                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2753                         return 0x02;
2754                 else
2755                         return 0x03;
2756         }
2757
2758         /* If remote requests no-bonding follow that lead */
2759         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2760                 return conn->remote_auth | (conn->auth_type & 0x01);
2761
2762         return conn->auth_type;
2763 }
2764
2765 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2766 {
2767         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2768         struct hci_conn *conn;
2769
2770         BT_DBG("%s", hdev->name);
2771
2772         hci_dev_lock(hdev);
2773
2774         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2775         if (!conn)
2776                 goto unlock;
2777
2778         hci_conn_hold(conn);
2779
2780         if (!test_bit(HCI_MGMT, &hdev->flags))
2781                 goto unlock;
2782
2783         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2784                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2785                 struct hci_cp_io_capability_reply cp;
2786
2787                 bacpy(&cp.bdaddr, &ev->bdaddr);
2788                 cp.capability = conn->io_capability;
2789                 conn->auth_type = hci_get_auth_req(conn);
2790                 cp.authentication = conn->auth_type;
2791
2792                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2793                                 hci_find_remote_oob_data(hdev, &conn->dst))
2794                         cp.oob_data = 0x01;
2795                 else
2796                         cp.oob_data = 0x00;
2797
2798                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2799                                                         sizeof(cp), &cp);
2800         } else {
2801                 struct hci_cp_io_capability_neg_reply cp;
2802
2803                 bacpy(&cp.bdaddr, &ev->bdaddr);
2804                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2805
2806                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2807                                                         sizeof(cp), &cp);
2808         }
2809
2810 unlock:
2811         hci_dev_unlock(hdev);
2812 }
2813
2814 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2815 {
2816         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2817         struct hci_conn *conn;
2818
2819         BT_DBG("%s", hdev->name);
2820
2821         hci_dev_lock(hdev);
2822
2823         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2824         if (!conn)
2825                 goto unlock;
2826
2827         conn->remote_cap = ev->capability;
2828         conn->remote_oob = ev->oob_data;
2829         conn->remote_auth = ev->authentication;
2830
2831 unlock:
2832         hci_dev_unlock(hdev);
2833 }
2834
2835 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2836                                                         struct sk_buff *skb)
2837 {
2838         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2839         int loc_mitm, rem_mitm, confirm_hint = 0;
2840         struct hci_conn *conn;
2841
2842         BT_DBG("%s", hdev->name);
2843
2844         hci_dev_lock(hdev);
2845
2846         if (!test_bit(HCI_MGMT, &hdev->flags))
2847                 goto unlock;
2848
2849         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2850         if (!conn)
2851                 goto unlock;
2852
2853         loc_mitm = (conn->auth_type & 0x01);
2854         rem_mitm = (conn->remote_auth & 0x01);
2855
2856         /* If we require MITM but the remote device can't provide that
2857          * (it has NoInputNoOutput) then reject the confirmation
2858          * request. The only exception is when we're dedicated bonding
2859          * initiators (connect_cfm_cb set) since then we always have the MITM
2860          * bit set. */
2861         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2862                 BT_DBG("Rejecting request: remote device can't provide MITM");
2863                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2864                                         sizeof(ev->bdaddr), &ev->bdaddr);
2865                 goto unlock;
2866         }
2867
2868         /* If no side requires MITM protection; auto-accept */
2869         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2870                                 (!rem_mitm || conn->io_capability == 0x03)) {
2871
2872                 /* If we're not the initiators request authorization to
2873                  * proceed from user space (mgmt_user_confirm with
2874                  * confirm_hint set to 1). */
2875                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2876                         BT_DBG("Confirming auto-accept as acceptor");
2877                         confirm_hint = 1;
2878                         goto confirm;
2879                 }
2880
2881                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2882                                                 hdev->auto_accept_delay);
2883
2884                 if (hdev->auto_accept_delay > 0) {
2885                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2886                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2887                         goto unlock;
2888                 }
2889
2890                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2891                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2892                 goto unlock;
2893         }
2894
2895 confirm:
2896         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
2897                                                                 confirm_hint);
2898
2899 unlock:
2900         hci_dev_unlock(hdev);
2901 }
2902
2903 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
2904                                                         struct sk_buff *skb)
2905 {
2906         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
2907
2908         BT_DBG("%s", hdev->name);
2909
2910         hci_dev_lock(hdev);
2911
2912         if (test_bit(HCI_MGMT, &hdev->flags))
2913                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
2914
2915         hci_dev_unlock(hdev);
2916 }
2917
2918 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2919 {
2920         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2921         struct hci_conn *conn;
2922
2923         BT_DBG("%s", hdev->name);
2924
2925         hci_dev_lock(hdev);
2926
2927         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2928         if (!conn)
2929                 goto unlock;
2930
2931         /* To avoid duplicate auth_failed events to user space we check
2932          * the HCI_CONN_AUTH_PEND flag which will be set if we
2933          * initiated the authentication. A traditional auth_complete
2934          * event gets always produced as initiator and is also mapped to
2935          * the mgmt_auth_failed event */
2936         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2937                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
2938
2939         hci_conn_put(conn);
2940
2941 unlock:
2942         hci_dev_unlock(hdev);
2943 }
2944
2945 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2946 {
2947         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2948         struct inquiry_entry *ie;
2949
2950         BT_DBG("%s", hdev->name);
2951
2952         hci_dev_lock(hdev);
2953
2954         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2955         if (ie)
2956                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2957
2958         hci_dev_unlock(hdev);
2959 }
2960
2961 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2962                                                         struct sk_buff *skb)
2963 {
2964         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2965         struct oob_data *data;
2966
2967         BT_DBG("%s", hdev->name);
2968
2969         hci_dev_lock(hdev);
2970
2971         if (!test_bit(HCI_MGMT, &hdev->flags))
2972                 goto unlock;
2973
2974         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2975         if (data) {
2976                 struct hci_cp_remote_oob_data_reply cp;
2977
2978                 bacpy(&cp.bdaddr, &ev->bdaddr);
2979                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2980                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2981
2982                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2983                                                                         &cp);
2984         } else {
2985                 struct hci_cp_remote_oob_data_neg_reply cp;
2986
2987                 bacpy(&cp.bdaddr, &ev->bdaddr);
2988                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2989                                                                         &cp);
2990         }
2991
2992 unlock:
2993         hci_dev_unlock(hdev);
2994 }
2995
2996 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2997 {
2998         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2999         struct hci_conn *conn;
3000
3001         BT_DBG("%s status %d", hdev->name, ev->status);
3002
3003         hci_dev_lock(hdev);
3004
3005         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
3006         if (!conn) {
3007                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3008                 if (!conn) {
3009                         BT_ERR("No memory for new connection");
3010                         hci_dev_unlock(hdev);
3011                         return;
3012                 }
3013
3014                 conn->dst_type = ev->bdaddr_type;
3015         }
3016
3017         if (ev->status) {
3018                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
3019                                                 conn->dst_type, ev->status);
3020                 hci_proto_connect_cfm(conn, ev->status);
3021                 conn->state = BT_CLOSED;
3022                 hci_conn_del(conn);
3023                 goto unlock;
3024         }
3025
3026         mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
3027
3028         conn->sec_level = BT_SECURITY_LOW;
3029         conn->handle = __le16_to_cpu(ev->handle);
3030         conn->state = BT_CONNECTED;
3031
3032         hci_conn_hold_device(conn);
3033         hci_conn_add_sysfs(conn);
3034
3035         hci_proto_connect_cfm(conn, ev->status);
3036
3037 unlock:
3038         hci_dev_unlock(hdev);
3039 }
3040
3041 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3042                                                 struct sk_buff *skb)
3043 {
3044         u8 num_reports = skb->data[0];
3045         void *ptr = &skb->data[1];
3046
3047         hci_dev_lock(hdev);
3048
3049         while (num_reports--) {
3050                 struct hci_ev_le_advertising_info *ev = ptr;
3051
3052                 hci_add_adv_entry(hdev, ev);
3053
3054                 ptr += sizeof(*ev) + ev->length + 1;
3055         }
3056
3057         hci_dev_unlock(hdev);
3058 }
3059
3060 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3061                                                 struct sk_buff *skb)
3062 {
3063         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3064         struct hci_cp_le_ltk_reply cp;
3065         struct hci_cp_le_ltk_neg_reply neg;
3066         struct hci_conn *conn;
3067         struct link_key *ltk;
3068
3069         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3070
3071         hci_dev_lock(hdev);
3072
3073         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3074         if (conn == NULL)
3075                 goto not_found;
3076
3077         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3078         if (ltk == NULL)
3079                 goto not_found;
3080
3081         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3082         cp.handle = cpu_to_le16(conn->handle);
3083         conn->pin_length = ltk->pin_len;
3084
3085         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3086
3087         hci_dev_unlock(hdev);
3088
3089         return;
3090
3091 not_found:
3092         neg.handle = ev->handle;
3093         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3094         hci_dev_unlock(hdev);
3095 }
3096
3097 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3098 {
3099         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3100
3101         skb_pull(skb, sizeof(*le_ev));
3102
3103         switch (le_ev->subevent) {
3104         case HCI_EV_LE_CONN_COMPLETE:
3105                 hci_le_conn_complete_evt(hdev, skb);
3106                 break;
3107
3108         case HCI_EV_LE_ADVERTISING_REPORT:
3109                 hci_le_adv_report_evt(hdev, skb);
3110                 break;
3111
3112         case HCI_EV_LE_LTK_REQ:
3113                 hci_le_ltk_request_evt(hdev, skb);
3114                 break;
3115
3116         default:
3117                 break;
3118         }
3119 }
3120
3121 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3122 {
3123         struct hci_event_hdr *hdr = (void *) skb->data;
3124         __u8 event = hdr->evt;
3125
3126         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3127
3128         switch (event) {
3129         case HCI_EV_INQUIRY_COMPLETE:
3130                 hci_inquiry_complete_evt(hdev, skb);
3131                 break;
3132
3133         case HCI_EV_INQUIRY_RESULT:
3134                 hci_inquiry_result_evt(hdev, skb);
3135                 break;
3136
3137         case HCI_EV_CONN_COMPLETE:
3138                 hci_conn_complete_evt(hdev, skb);
3139                 break;
3140
3141         case HCI_EV_CONN_REQUEST:
3142                 hci_conn_request_evt(hdev, skb);
3143                 break;
3144
3145         case HCI_EV_DISCONN_COMPLETE:
3146                 hci_disconn_complete_evt(hdev, skb);
3147                 break;
3148
3149         case HCI_EV_AUTH_COMPLETE:
3150                 hci_auth_complete_evt(hdev, skb);
3151                 break;
3152
3153         case HCI_EV_REMOTE_NAME:
3154                 hci_remote_name_evt(hdev, skb);
3155                 break;
3156
3157         case HCI_EV_ENCRYPT_CHANGE:
3158                 hci_encrypt_change_evt(hdev, skb);
3159                 break;
3160
3161         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3162                 hci_change_link_key_complete_evt(hdev, skb);
3163                 break;
3164
3165         case HCI_EV_REMOTE_FEATURES:
3166                 hci_remote_features_evt(hdev, skb);
3167                 break;
3168
3169         case HCI_EV_REMOTE_VERSION:
3170                 hci_remote_version_evt(hdev, skb);
3171                 break;
3172
3173         case HCI_EV_QOS_SETUP_COMPLETE:
3174                 hci_qos_setup_complete_evt(hdev, skb);
3175                 break;
3176
3177         case HCI_EV_CMD_COMPLETE:
3178                 hci_cmd_complete_evt(hdev, skb);
3179                 break;
3180
3181         case HCI_EV_CMD_STATUS:
3182                 hci_cmd_status_evt(hdev, skb);
3183                 break;
3184
3185         case HCI_EV_ROLE_CHANGE:
3186                 hci_role_change_evt(hdev, skb);
3187                 break;
3188
3189         case HCI_EV_NUM_COMP_PKTS:
3190                 hci_num_comp_pkts_evt(hdev, skb);
3191                 break;
3192
3193         case HCI_EV_MODE_CHANGE:
3194                 hci_mode_change_evt(hdev, skb);
3195                 break;
3196
3197         case HCI_EV_PIN_CODE_REQ:
3198                 hci_pin_code_request_evt(hdev, skb);
3199                 break;
3200
3201         case HCI_EV_LINK_KEY_REQ:
3202                 hci_link_key_request_evt(hdev, skb);
3203                 break;
3204
3205         case HCI_EV_LINK_KEY_NOTIFY:
3206                 hci_link_key_notify_evt(hdev, skb);
3207                 break;
3208
3209         case HCI_EV_CLOCK_OFFSET:
3210                 hci_clock_offset_evt(hdev, skb);
3211                 break;
3212
3213         case HCI_EV_PKT_TYPE_CHANGE:
3214                 hci_pkt_type_change_evt(hdev, skb);
3215                 break;
3216
3217         case HCI_EV_PSCAN_REP_MODE:
3218                 hci_pscan_rep_mode_evt(hdev, skb);
3219                 break;
3220
3221         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3222                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3223                 break;
3224
3225         case HCI_EV_REMOTE_EXT_FEATURES:
3226                 hci_remote_ext_features_evt(hdev, skb);
3227                 break;
3228
3229         case HCI_EV_SYNC_CONN_COMPLETE:
3230                 hci_sync_conn_complete_evt(hdev, skb);
3231                 break;
3232
3233         case HCI_EV_SYNC_CONN_CHANGED:
3234                 hci_sync_conn_changed_evt(hdev, skb);
3235                 break;
3236
3237         case HCI_EV_SNIFF_SUBRATE:
3238                 hci_sniff_subrate_evt(hdev, skb);
3239                 break;
3240
3241         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3242                 hci_extended_inquiry_result_evt(hdev, skb);
3243                 break;
3244
3245         case HCI_EV_IO_CAPA_REQUEST:
3246                 hci_io_capa_request_evt(hdev, skb);
3247                 break;
3248
3249         case HCI_EV_IO_CAPA_REPLY:
3250                 hci_io_capa_reply_evt(hdev, skb);
3251                 break;
3252
3253         case HCI_EV_USER_CONFIRM_REQUEST:
3254                 hci_user_confirm_request_evt(hdev, skb);
3255                 break;
3256
3257         case HCI_EV_USER_PASSKEY_REQUEST:
3258                 hci_user_passkey_request_evt(hdev, skb);
3259                 break;
3260
3261         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3262                 hci_simple_pair_complete_evt(hdev, skb);
3263                 break;
3264
3265         case HCI_EV_REMOTE_HOST_FEATURES:
3266                 hci_remote_host_features_evt(hdev, skb);
3267                 break;
3268
3269         case HCI_EV_LE_META:
3270                 hci_le_meta_evt(hdev, skb);
3271                 break;
3272
3273         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3274                 hci_remote_oob_data_request_evt(hdev, skb);
3275                 break;
3276
3277         default:
3278                 BT_DBG("%s event 0x%x", hdev->name, event);
3279                 break;
3280         }
3281
3282         kfree_skb(skb);
3283         hdev->stat.evt_rx++;
3284 }
3285
3286 /* Generate internal stack event */
3287 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3288 {
3289         struct hci_event_hdr *hdr;
3290         struct hci_ev_stack_internal *ev;
3291         struct sk_buff *skb;
3292
3293         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3294         if (!skb)
3295                 return;
3296
3297         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3298         hdr->evt  = HCI_EV_STACK_INTERNAL;
3299         hdr->plen = sizeof(*ev) + dlen;
3300
3301         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3302         ev->type = type;
3303         memcpy(ev->data, data, dlen);
3304
3305         bt_cb(skb)->incoming = 1;
3306         __net_timestamp(skb);
3307
3308         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3309         skb->dev = (void *) hdev;
3310         hci_send_to_sock(hdev, skb, NULL);
3311         kfree_skb(skb);
3312 }
3313
3314 module_param(enable_le, bool, 0644);
3315 MODULE_PARM_DESC(enable_le, "Enable LE support");