net/bluetooth/hci_event.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (c) 2000-2001, 2010, Code Aurora Forum. All rights reserved.
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI event handling. */
  26
  27 #include <linux/module.h>
  28
  29 #include <linux/types.h>
  30 #include <linux/errno.h>
  31 #include <linux/kernel.h>
  32 #include <linux/slab.h>
  33 #include <linux/poll.h>
  34 #include <linux/fcntl.h>
  35 #include <linux/init.h>
  36 #include <linux/skbuff.h>
  37 #include <linux/interrupt.h>
  38 #include <linux/notifier.h>
  39 #include <net/sock.h>
  40
  41 #include <asm/system.h>
  42 #include <linux/uaccess.h>
  43 #include <asm/unaligned.h>
  44
  45 #include <net/bluetooth/bluetooth.h>
  46 #include <net/bluetooth/hci_core.h>
  47
  48 static int enable_le;
  49
  50 /* Handle HCI Event packets */
  51
  52 static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  53 {
  54         __u8 status = *((__u8 *) skb->data);
  55
  56         BT_DBG("%s status 0x%x", hdev->name, status);
  57
  58         if (status) {
  59                 hci_dev_lock(hdev);
  60                 mgmt_stop_discovery_failed(hdev, status);
  61                 hci_dev_unlock(hdev);
  62                 return;
  63         }
  64
  65         clear_bit(HCI_INQUIRY, &hdev->flags);
  66
  67         hci_dev_lock(hdev);
  68         mgmt_discovering(hdev, 0);
  69         hci_dev_unlock(hdev);
  70
  71         hci_req_complete(hdev, HCI_OP_INQUIRY_CANCEL, status);
  72
  73         hci_conn_check_pending(hdev);
  74 }
  75
  76 static void hci_cc_exit_periodic_inq(struct hci_dev *hdev, struct sk_buff *skb)
  77 {
  78         __u8 status = *((__u8 *) skb->data);
  79
  80         BT_DBG("%s status 0x%x", hdev->name, status);
  81
  82         if (status)
  83                 return;
  84
  85         hci_conn_check_pending(hdev);
  86 }
  87
  88 static void hci_cc_remote_name_req_cancel(struct hci_dev *hdev, struct sk_buff *skb)
  89 {
  90         BT_DBG("%s", hdev->name);
  91 }
  92
  93 static void hci_cc_role_discovery(struct hci_dev *hdev, struct sk_buff *skb)
  94 {
  95         struct hci_rp_role_discovery *rp = (void *) skb->data;
  96         struct hci_conn *conn;
  97
  98         BT_DBG("%s status 0x%x", hdev->name, rp->status);
  99
 100         if (rp->status)
 101                 return;
 102
 103         hci_dev_lock(hdev);
 104
 105         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 106         if (conn) {
 107                 if (rp->role)
 108                         conn->link_mode &= ~HCI_LM_MASTER;
 109                 else
 110                         conn->link_mode |= HCI_LM_MASTER;
 111         }
 112
 113         hci_dev_unlock(hdev);
 114 }
 115
 116 static void hci_cc_read_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 117 {
 118         struct hci_rp_read_link_policy *rp = (void *) skb->data;
 119         struct hci_conn *conn;
 120
 121         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 122
 123         if (rp->status)
 124                 return;
 125
 126         hci_dev_lock(hdev);
 127
 128         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 129         if (conn)
 130                 conn->link_policy = __le16_to_cpu(rp->policy);
 131
 132         hci_dev_unlock(hdev);
 133 }
 134
 135 static void hci_cc_write_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 136 {
 137         struct hci_rp_write_link_policy *rp = (void *) skb->data;
 138         struct hci_conn *conn;
 139         void *sent;
 140
 141         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 142
 143         if (rp->status)
 144                 return;
 145
 146         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LINK_POLICY);
 147         if (!sent)
 148                 return;
 149
 150         hci_dev_lock(hdev);
 151
 152         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(rp->handle));
 153         if (conn)
 154                 conn->link_policy = get_unaligned_le16(sent + 2);
 155
 156         hci_dev_unlock(hdev);
 157 }
 158
 159 static void hci_cc_read_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 160 {
 161         struct hci_rp_read_def_link_policy *rp = (void *) skb->data;
 162
 163         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 164
 165         if (rp->status)
 166                 return;
 167
 168         hdev->link_policy = __le16_to_cpu(rp->policy);
 169 }
 170
 171 static void hci_cc_write_def_link_policy(struct hci_dev *hdev, struct sk_buff *skb)
 172 {
 173         __u8 status = *((__u8 *) skb->data);
 174         void *sent;
 175
 176         BT_DBG("%s status 0x%x", hdev->name, status);
 177
 178         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_DEF_LINK_POLICY);
 179         if (!sent)
 180                 return;
 181
 182         if (!status)
 183                 hdev->link_policy = get_unaligned_le16(sent);
 184
 185         hci_req_complete(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, status);
 186 }
 187
 188 static void hci_cc_reset(struct hci_dev *hdev, struct sk_buff *skb)
 189 {
 190         __u8 status = *((__u8 *) skb->data);
 191
 192         BT_DBG("%s status 0x%x", hdev->name, status);
 193
 194         clear_bit(HCI_RESET, &hdev->flags);
 195
 196         hci_req_complete(hdev, HCI_OP_RESET, status);
 197
 198         hdev->dev_flags = 0;
 199 }
 200
 201 static void hci_cc_write_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 202 {
 203         __u8 status = *((__u8 *) skb->data);
 204         void *sent;
 205
 206         BT_DBG("%s status 0x%x", hdev->name, status);
 207
 208         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_LOCAL_NAME);
 209         if (!sent)
 210                 return;
 211
 212         hci_dev_lock(hdev);
 213
 214         if (test_bit(HCI_MGMT, &hdev->flags))
 215                 mgmt_set_local_name_complete(hdev, sent, status);
 216
 217         if (status == 0)
 218                 memcpy(hdev->dev_name, sent, HCI_MAX_NAME_LENGTH);
 219
 220         hci_dev_unlock(hdev);
 221 }
 222
 223 static void hci_cc_read_local_name(struct hci_dev *hdev, struct sk_buff *skb)
 224 {
 225         struct hci_rp_read_local_name *rp = (void *) skb->data;
 226
 227         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 228
 229         if (rp->status)
 230                 return;
 231
 232         memcpy(hdev->dev_name, rp->name, HCI_MAX_NAME_LENGTH);
 233 }
 234
 235 static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 236 {
 237         __u8 status = *((__u8 *) skb->data);
 238         void *sent;
 239
 240         BT_DBG("%s status 0x%x", hdev->name, status);
 241
 242         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_AUTH_ENABLE);
 243         if (!sent)
 244                 return;
 245
 246         if (!status) {
 247                 __u8 param = *((__u8 *) sent);
 248
 249                 if (param == AUTH_ENABLED)
 250                         set_bit(HCI_AUTH, &hdev->flags);
 251                 else
 252                         clear_bit(HCI_AUTH, &hdev->flags);
 253         }
 254
 255         hci_req_complete(hdev, HCI_OP_WRITE_AUTH_ENABLE, status);
 256 }
 257
 258 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
 259 {
 260         __u8 status = *((__u8 *) skb->data);
 261         void *sent;
 262
 263         BT_DBG("%s status 0x%x", hdev->name, status);
 264
 265         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_ENCRYPT_MODE);
 266         if (!sent)
 267                 return;
 268
 269         if (!status) {
 270                 __u8 param = *((__u8 *) sent);
 271
 272                 if (param)
 273                         set_bit(HCI_ENCRYPT, &hdev->flags);
 274                 else
 275                         clear_bit(HCI_ENCRYPT, &hdev->flags);
 276         }
 277
 278         hci_req_complete(hdev, HCI_OP_WRITE_ENCRYPT_MODE, status);
 279 }
 280
 281 static void hci_cc_write_scan_enable(struct hci_dev *hdev, struct sk_buff *skb)
 282 {
 283         __u8 param, status = *((__u8 *) skb->data);
 284         int old_pscan, old_iscan;
 285         void *sent;
 286
 287         BT_DBG("%s status 0x%x", hdev->name, status);
 288
 289         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SCAN_ENABLE);
 290         if (!sent)
 291                 return;
 292
 293         param = *((__u8 *) sent);
 294
 295         hci_dev_lock(hdev);
 296
 297         if (status != 0) {
 298                 mgmt_write_scan_failed(hdev, param, status);
 299                 hdev->discov_timeout = 0;
 300                 goto done;
 301         }
 302
 303         old_pscan = test_and_clear_bit(HCI_PSCAN, &hdev->flags);
 304         old_iscan = test_and_clear_bit(HCI_ISCAN, &hdev->flags);
 305
 306         if (param & SCAN_INQUIRY) {
 307                 set_bit(HCI_ISCAN, &hdev->flags);
 308                 if (!old_iscan)
 309                         mgmt_discoverable(hdev, 1);
 310                 if (hdev->discov_timeout > 0) {
 311                         int to = msecs_to_jiffies(hdev->discov_timeout * 1000);
 312                         queue_delayed_work(hdev->workqueue, &hdev->discov_off,
 313                                                                         to);
 314                 }
 315         } else if (old_iscan)
 316                 mgmt_discoverable(hdev, 0);
 317
 318         if (param & SCAN_PAGE) {
 319                 set_bit(HCI_PSCAN, &hdev->flags);
 320                 if (!old_pscan)
 321                         mgmt_connectable(hdev, 1);
 322         } else if (old_pscan)
 323                 mgmt_connectable(hdev, 0);
 324
 325 done:
 326         hci_dev_unlock(hdev);
 327         hci_req_complete(hdev, HCI_OP_WRITE_SCAN_ENABLE, status);
 328 }
 329
 330 static void hci_cc_read_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 331 {
 332         struct hci_rp_read_class_of_dev *rp = (void *) skb->data;
 333
 334         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 335
 336         if (rp->status)
 337                 return;
 338
 339         memcpy(hdev->dev_class, rp->dev_class, 3);
 340
 341         BT_DBG("%s class 0x%.2x%.2x%.2x", hdev->name,
 342                 hdev->dev_class[2], hdev->dev_class[1], hdev->dev_class[0]);
 343 }
 344
 345 static void hci_cc_write_class_of_dev(struct hci_dev *hdev, struct sk_buff *skb)
 346 {
 347         __u8 status = *((__u8 *) skb->data);
 348         void *sent;
 349
 350         BT_DBG("%s status 0x%x", hdev->name, status);
 351
 352         if (status)
 353                 return;
 354
 355         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_CLASS_OF_DEV);
 356         if (!sent)
 357                 return;
 358
 359         memcpy(hdev->dev_class, sent, 3);
 360 }
 361
 362 static void hci_cc_read_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 363 {
 364         struct hci_rp_read_voice_setting *rp = (void *) skb->data;
 365         __u16 setting;
 366
 367         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 368
 369         if (rp->status)
 370                 return;
 371
 372         setting = __le16_to_cpu(rp->voice_setting);
 373
 374         if (hdev->voice_setting == setting)
 375                 return;
 376
 377         hdev->voice_setting = setting;
 378
 379         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 380
 381         if (hdev->notify)
 382                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 383 }
 384
 385 static void hci_cc_write_voice_setting(struct hci_dev *hdev, struct sk_buff *skb)
 386 {
 387         __u8 status = *((__u8 *) skb->data);
 388         __u16 setting;
 389         void *sent;
 390
 391         BT_DBG("%s status 0x%x", hdev->name, status);
 392
 393         if (status)
 394                 return;
 395
 396         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_VOICE_SETTING);
 397         if (!sent)
 398                 return;
 399
 400         setting = get_unaligned_le16(sent);
 401
 402         if (hdev->voice_setting == setting)
 403                 return;
 404
 405         hdev->voice_setting = setting;
 406
 407         BT_DBG("%s voice setting 0x%04x", hdev->name, setting);
 408
 409         if (hdev->notify)
 410                 hdev->notify(hdev, HCI_NOTIFY_VOICE_SETTING);
 411 }
 412
 413 static void hci_cc_host_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 414 {
 415         __u8 status = *((__u8 *) skb->data);
 416
 417         BT_DBG("%s status 0x%x", hdev->name, status);
 418
 419         hci_req_complete(hdev, HCI_OP_HOST_BUFFER_SIZE, status);
 420 }
 421
 422 static void hci_cc_read_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 423 {
 424         struct hci_rp_read_ssp_mode *rp = (void *) skb->data;
 425
 426         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 427
 428         if (rp->status)
 429                 return;
 430
 431         hdev->ssp_mode = rp->mode;
 432 }
 433
 434 static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
 435 {
 436         __u8 status = *((__u8 *) skb->data);
 437         void *sent;
 438
 439         BT_DBG("%s status 0x%x", hdev->name, status);
 440
 441         if (status)
 442                 return;
 443
 444         sent = hci_sent_cmd_data(hdev, HCI_OP_WRITE_SSP_MODE);
 445         if (!sent)
 446                 return;
 447
 448         hdev->ssp_mode = *((__u8 *) sent);
 449 }
 450
 451 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 452 {
 453         if (hdev->features[6] & LMP_EXT_INQ)
 454                 return 2;
 455
 456         if (hdev->features[3] & LMP_RSSI_INQ)
 457                 return 1;
 458
 459         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 460                                                 hdev->lmp_subver == 0x0757)
 461                 return 1;
 462
 463         if (hdev->manufacturer == 15) {
 464                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 465                         return 1;
 466                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 467                         return 1;
 468                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 469                         return 1;
 470         }
 471
 472         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 473                                                 hdev->lmp_subver == 0x1805)
 474                 return 1;
 475
 476         return 0;
 477 }
 478
 479 static void hci_setup_inquiry_mode(struct hci_dev *hdev)
 480 {
 481         u8 mode;
 482
 483         mode = hci_get_inquiry_mode(hdev);
 484
 485         hci_send_cmd(hdev, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486 }
 487
 488 static void hci_setup_event_mask(struct hci_dev *hdev)
 489 {
 490         /* The second byte is 0xff instead of 0x9f (two reserved bits
 491          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 492          * command otherwise */
 493         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 494
 495         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 496          * any event mask for pre 1.2 devices */
 497         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 498                 return;
 499
 500         events[4] |= 0x01; /* Flow Specification Complete */
 501         events[4] |= 0x02; /* Inquiry Result with RSSI */
 502         events[4] |= 0x04; /* Read Remote Extended Features Complete */
 503         events[5] |= 0x08; /* Synchronous Connection Complete */
 504         events[5] |= 0x10; /* Synchronous Connection Changed */
 505
 506         if (hdev->features[3] & LMP_RSSI_INQ)
 507                 events[4] |= 0x04; /* Inquiry Result with RSSI */
 508
 509         if (hdev->features[5] & LMP_SNIFF_SUBR)
 510                 events[5] |= 0x20; /* Sniff Subrating */
 511
 512         if (hdev->features[5] & LMP_PAUSE_ENC)
 513                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 514
 515         if (hdev->features[6] & LMP_EXT_INQ)
 516                 events[5] |= 0x40; /* Extended Inquiry Result */
 517
 518         if (hdev->features[6] & LMP_NO_FLUSH)
 519                 events[7] |= 0x01; /* Enhanced Flush Complete */
 520
 521         if (hdev->features[7] & LMP_LSTO)
 522                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 523
 524         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 525                 events[6] |= 0x01;      /* IO Capability Request */
 526                 events[6] |= 0x02;      /* IO Capability Response */
 527                 events[6] |= 0x04;      /* User Confirmation Request */
 528                 events[6] |= 0x08;      /* User Passkey Request */
 529                 events[6] |= 0x10;      /* Remote OOB Data Request */
 530                 events[6] |= 0x20;      /* Simple Pairing Complete */
 531                 events[7] |= 0x04;      /* User Passkey Notification */
 532                 events[7] |= 0x08;      /* Keypress Notification */
 533                 events[7] |= 0x10;      /* Remote Host Supported
 534                                          * Features Notification */
 535         }
 536
 537         if (hdev->features[4] & LMP_LE)
 538                 events[7] |= 0x20;      /* LE Meta-Event */
 539
 540         hci_send_cmd(hdev, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 541 }
 542
 543 static void hci_set_le_support(struct hci_dev *hdev)
 544 {
 545         struct hci_cp_write_le_host_supported cp;
 546
 547         memset(&cp, 0, sizeof(cp));
 548
 549         if (enable_le) {
 550                 cp.le = 1;
 551                 cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
 552         }
 553
 554         hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), &cp);
 555 }
 556
 557 static void hci_setup(struct hci_dev *hdev)
 558 {
 559         if (hdev->dev_type != HCI_BREDR)
 560                 return;
 561
 562         hci_setup_event_mask(hdev);
 563
 564         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 565                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 566
 567         if (hdev->features[6] & LMP_SIMPLE_PAIR) {
 568                 u8 mode = 0x01;
 569                 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
 570         }
 571
 572         if (hdev->features[3] & LMP_RSSI_INQ)
 573                 hci_setup_inquiry_mode(hdev);
 574
 575         if (hdev->features[7] & LMP_INQ_TX_PWR)
 576                 hci_send_cmd(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 577
 578         if (hdev->features[7] & LMP_EXTFEATURES) {
 579                 struct hci_cp_read_local_ext_features cp;
 580
 581                 cp.page = 0x01;
 582                 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
 583                                                         sizeof(cp), &cp);
 584         }
 585
 586         if (hdev->features[4] & LMP_LE)
 587                 hci_set_le_support(hdev);
 588 }
 589
 590 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
 591 {
 592         struct hci_rp_read_local_version *rp = (void *) skb->data;
 593
 594         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 595
 596         if (rp->status)
 597                 return;
 598
 599         hdev->hci_ver = rp->hci_ver;
 600         hdev->hci_rev = __le16_to_cpu(rp->hci_rev);
 601         hdev->lmp_ver = rp->lmp_ver;
 602         hdev->manufacturer = __le16_to_cpu(rp->manufacturer);
 603         hdev->lmp_subver = __le16_to_cpu(rp->lmp_subver);
 604
 605         BT_DBG("%s manufacturer %d hci ver %d:%d", hdev->name,
 606                                         hdev->manufacturer,
 607                                         hdev->hci_ver, hdev->hci_rev);
 608
 609         if (test_bit(HCI_INIT, &hdev->flags))
 610                 hci_setup(hdev);
 611 }
 612
 613 static void hci_setup_link_policy(struct hci_dev *hdev)
 614 {
 615         u16 link_policy = 0;
 616
 617         if (hdev->features[0] & LMP_RSWITCH)
 618                 link_policy |= HCI_LP_RSWITCH;
 619         if (hdev->features[0] & LMP_HOLD)
 620                 link_policy |= HCI_LP_HOLD;
 621         if (hdev->features[0] & LMP_SNIFF)
 622                 link_policy |= HCI_LP_SNIFF;
 623         if (hdev->features[1] & LMP_PARK)
 624                 link_policy |= HCI_LP_PARK;
 625
 626         link_policy = cpu_to_le16(link_policy);
 627         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
 628                                         sizeof(link_policy), &link_policy);
 629 }
 630
 631 static void hci_cc_read_local_commands(struct hci_dev *hdev, struct sk_buff *skb)
 632 {
 633         struct hci_rp_read_local_commands *rp = (void *) skb->data;
 634
 635         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 636
 637         if (rp->status)
 638                 goto done;
 639
 640         memcpy(hdev->commands, rp->commands, sizeof(hdev->commands));
 641
 642         if (test_bit(HCI_INIT, &hdev->flags) && (hdev->commands[5] & 0x10))
 643                 hci_setup_link_policy(hdev);
 644
 645 done:
 646         hci_req_complete(hdev, HCI_OP_READ_LOCAL_COMMANDS, rp->status);
 647 }
 648
 649 static void hci_cc_read_local_features(struct hci_dev *hdev, struct sk_buff *skb)
 650 {
 651         struct hci_rp_read_local_features *rp = (void *) skb->data;
 652
 653         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 654
 655         if (rp->status)
 656                 return;
 657
 658         memcpy(hdev->features, rp->features, 8);
 659
 660         /* Adjust default settings according to features
 661          * supported by device. */
 662
 663         if (hdev->features[0] & LMP_3SLOT)
 664                 hdev->pkt_type |= (HCI_DM3 | HCI_DH3);
 665
 666         if (hdev->features[0] & LMP_5SLOT)
 667                 hdev->pkt_type |= (HCI_DM5 | HCI_DH5);
 668
 669         if (hdev->features[1] & LMP_HV2) {
 670                 hdev->pkt_type  |= (HCI_HV2);
 671                 hdev->esco_type |= (ESCO_HV2);
 672         }
 673
 674         if (hdev->features[1] & LMP_HV3) {
 675                 hdev->pkt_type  |= (HCI_HV3);
 676                 hdev->esco_type |= (ESCO_HV3);
 677         }
 678
 679         if (hdev->features[3] & LMP_ESCO)
 680                 hdev->esco_type |= (ESCO_EV3);
 681
 682         if (hdev->features[4] & LMP_EV4)
 683                 hdev->esco_type |= (ESCO_EV4);
 684
 685         if (hdev->features[4] & LMP_EV5)
 686                 hdev->esco_type |= (ESCO_EV5);
 687
 688         if (hdev->features[5] & LMP_EDR_ESCO_2M)
 689                 hdev->esco_type |= (ESCO_2EV3);
 690
 691         if (hdev->features[5] & LMP_EDR_ESCO_3M)
 692                 hdev->esco_type |= (ESCO_3EV3);
 693
 694         if (hdev->features[5] & LMP_EDR_3S_ESCO)
 695                 hdev->esco_type |= (ESCO_2EV5 | ESCO_3EV5);
 696
 697         BT_DBG("%s features 0x%.2x%.2x%.2x%.2x%.2x%.2x%.2x%.2x", hdev->name,
 698                                         hdev->features[0], hdev->features[1],
 699                                         hdev->features[2], hdev->features[3],
 700                                         hdev->features[4], hdev->features[5],
 701                                         hdev->features[6], hdev->features[7]);
 702 }
 703
 704 static void hci_cc_read_local_ext_features(struct hci_dev *hdev,
 705                                                         struct sk_buff *skb)
 706 {
 707         struct hci_rp_read_local_ext_features *rp = (void *) skb->data;
 708
 709         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 710
 711         if (rp->status)
 712                 return;
 713
 714         switch (rp->page) {
 715         case 0:
 716                 memcpy(hdev->features, rp->features, 8);
 717                 break;
 718         case 1:
 719                 memcpy(hdev->host_features, rp->features, 8);
 720                 break;
 721         }
 722
 723         hci_req_complete(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, rp->status);
 724 }
 725
 726 static void hci_cc_read_flow_control_mode(struct hci_dev *hdev,
 727                                                 struct sk_buff *skb)
 728 {
 729         struct hci_rp_read_flow_control_mode *rp = (void *) skb->data;
 730
 731         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 732
 733         if (rp->status)
 734                 return;
 735
 736         hdev->flow_ctl_mode = rp->mode;
 737
 738         hci_req_complete(hdev, HCI_OP_READ_FLOW_CONTROL_MODE, rp->status);
 739 }
 740
 741 static void hci_cc_read_buffer_size(struct hci_dev *hdev, struct sk_buff *skb)
 742 {
 743         struct hci_rp_read_buffer_size *rp = (void *) skb->data;
 744
 745         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 746
 747         if (rp->status)
 748                 return;
 749
 750         hdev->acl_mtu  = __le16_to_cpu(rp->acl_mtu);
 751         hdev->sco_mtu  = rp->sco_mtu;
 752         hdev->acl_pkts = __le16_to_cpu(rp->acl_max_pkt);
 753         hdev->sco_pkts = __le16_to_cpu(rp->sco_max_pkt);
 754
 755         if (test_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks)) {
 756                 hdev->sco_mtu  = 64;
 757                 hdev->sco_pkts = 8;
 758         }
 759
 760         hdev->acl_cnt = hdev->acl_pkts;
 761         hdev->sco_cnt = hdev->sco_pkts;
 762
 763         BT_DBG("%s acl mtu %d:%d sco mtu %d:%d", hdev->name,
 764                                         hdev->acl_mtu, hdev->acl_pkts,
 765                                         hdev->sco_mtu, hdev->sco_pkts);
 766 }
 767
 768 static void hci_cc_read_bd_addr(struct hci_dev *hdev, struct sk_buff *skb)
 769 {
 770         struct hci_rp_read_bd_addr *rp = (void *) skb->data;
 771
 772         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 773
 774         if (!rp->status)
 775                 bacpy(&hdev->bdaddr, &rp->bdaddr);
 776
 777         hci_req_complete(hdev, HCI_OP_READ_BD_ADDR, rp->status);
 778 }
 779
 780 static void hci_cc_read_data_block_size(struct hci_dev *hdev,
 781                                                         struct sk_buff *skb)
 782 {
 783         struct hci_rp_read_data_block_size *rp = (void *) skb->data;
 784
 785         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 786
 787         if (rp->status)
 788                 return;
 789
 790         hdev->block_mtu = __le16_to_cpu(rp->max_acl_len);
 791         hdev->block_len = __le16_to_cpu(rp->block_len);
 792         hdev->num_blocks = __le16_to_cpu(rp->num_blocks);
 793
 794         hdev->block_cnt = hdev->num_blocks;
 795
 796         BT_DBG("%s blk mtu %d cnt %d len %d", hdev->name, hdev->block_mtu,
 797                                         hdev->block_cnt, hdev->block_len);
 798
 799         hci_req_complete(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, rp->status);
 800 }
 801
 802 static void hci_cc_write_ca_timeout(struct hci_dev *hdev, struct sk_buff *skb)
 803 {
 804         __u8 status = *((__u8 *) skb->data);
 805
 806         BT_DBG("%s status 0x%x", hdev->name, status);
 807
 808         hci_req_complete(hdev, HCI_OP_WRITE_CA_TIMEOUT, status);
 809 }
 810
 811 static void hci_cc_read_local_amp_info(struct hci_dev *hdev,
 812                 struct sk_buff *skb)
 813 {
 814         struct hci_rp_read_local_amp_info *rp = (void *) skb->data;
 815
 816         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 817
 818         if (rp->status)
 819                 return;
 820
 821         hdev->amp_status = rp->amp_status;
 822         hdev->amp_total_bw = __le32_to_cpu(rp->total_bw);
 823         hdev->amp_max_bw = __le32_to_cpu(rp->max_bw);
 824         hdev->amp_min_latency = __le32_to_cpu(rp->min_latency);
 825         hdev->amp_max_pdu = __le32_to_cpu(rp->max_pdu);
 826         hdev->amp_type = rp->amp_type;
 827         hdev->amp_pal_cap = __le16_to_cpu(rp->pal_cap);
 828         hdev->amp_assoc_size = __le16_to_cpu(rp->max_assoc_size);
 829         hdev->amp_be_flush_to = __le32_to_cpu(rp->be_flush_to);
 830         hdev->amp_max_flush_to = __le32_to_cpu(rp->max_flush_to);
 831
 832         hci_req_complete(hdev, HCI_OP_READ_LOCAL_AMP_INFO, rp->status);
 833 }
 834
 835 static void hci_cc_delete_stored_link_key(struct hci_dev *hdev,
 836                                                         struct sk_buff *skb)
 837 {
 838         __u8 status = *((__u8 *) skb->data);
 839
 840         BT_DBG("%s status 0x%x", hdev->name, status);
 841
 842         hci_req_complete(hdev, HCI_OP_DELETE_STORED_LINK_KEY, status);
 843 }
 844
 845 static void hci_cc_set_event_mask(struct hci_dev *hdev, struct sk_buff *skb)
 846 {
 847         __u8 status = *((__u8 *) skb->data);
 848
 849         BT_DBG("%s status 0x%x", hdev->name, status);
 850
 851         hci_req_complete(hdev, HCI_OP_SET_EVENT_MASK, status);
 852 }
 853
 854 static void hci_cc_write_inquiry_mode(struct hci_dev *hdev,
 855                                                         struct sk_buff *skb)
 856 {
 857         __u8 status = *((__u8 *) skb->data);
 858
 859         BT_DBG("%s status 0x%x", hdev->name, status);
 860
 861         hci_req_complete(hdev, HCI_OP_WRITE_INQUIRY_MODE, status);
 862 }
 863
 864 static void hci_cc_read_inq_rsp_tx_power(struct hci_dev *hdev,
 865                                                         struct sk_buff *skb)
 866 {
 867         __u8 status = *((__u8 *) skb->data);
 868
 869         BT_DBG("%s status 0x%x", hdev->name, status);
 870
 871         hci_req_complete(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, status);
 872 }
 873
 874 static void hci_cc_set_event_flt(struct hci_dev *hdev, struct sk_buff *skb)
 875 {
 876         __u8 status = *((__u8 *) skb->data);
 877
 878         BT_DBG("%s status 0x%x", hdev->name, status);
 879
 880         hci_req_complete(hdev, HCI_OP_SET_EVENT_FLT, status);
 881 }
 882
 883 static void hci_cc_pin_code_reply(struct hci_dev *hdev, struct sk_buff *skb)
 884 {
 885         struct hci_rp_pin_code_reply *rp = (void *) skb->data;
 886         struct hci_cp_pin_code_reply *cp;
 887         struct hci_conn *conn;
 888
 889         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 890
 891         hci_dev_lock(hdev);
 892
 893         if (test_bit(HCI_MGMT, &hdev->flags))
 894                 mgmt_pin_code_reply_complete(hdev, &rp->bdaddr, rp->status);
 895
 896         if (rp->status != 0)
 897                 goto unlock;
 898
 899         cp = hci_sent_cmd_data(hdev, HCI_OP_PIN_CODE_REPLY);
 900         if (!cp)
 901                 goto unlock;
 902
 903         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
 904         if (conn)
 905                 conn->pin_length = cp->pin_len;
 906
 907 unlock:
 908         hci_dev_unlock(hdev);
 909 }
 910
 911 static void hci_cc_pin_code_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
 912 {
 913         struct hci_rp_pin_code_neg_reply *rp = (void *) skb->data;
 914
 915         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 916
 917         hci_dev_lock(hdev);
 918
 919         if (test_bit(HCI_MGMT, &hdev->flags))
 920                 mgmt_pin_code_neg_reply_complete(hdev, &rp->bdaddr,
 921                                                                 rp->status);
 922
 923         hci_dev_unlock(hdev);
 924 }
 925
 926 static void hci_cc_le_read_buffer_size(struct hci_dev *hdev,
 927                                        struct sk_buff *skb)
 928 {
 929         struct hci_rp_le_read_buffer_size *rp = (void *) skb->data;
 930
 931         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 932
 933         if (rp->status)
 934                 return;
 935
 936         hdev->le_mtu = __le16_to_cpu(rp->le_mtu);
 937         hdev->le_pkts = rp->le_max_pkt;
 938
 939         hdev->le_cnt = hdev->le_pkts;
 940
 941         BT_DBG("%s le mtu %d:%d", hdev->name, hdev->le_mtu, hdev->le_pkts);
 942
 943         hci_req_complete(hdev, HCI_OP_LE_READ_BUFFER_SIZE, rp->status);
 944 }
 945
 946 static void hci_cc_user_confirm_reply(struct hci_dev *hdev, struct sk_buff *skb)
 947 {
 948         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 949
 950         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 951
 952         hci_dev_lock(hdev);
 953
 954         if (test_bit(HCI_MGMT, &hdev->flags))
 955                 mgmt_user_confirm_reply_complete(hdev, &rp->bdaddr,
 956                                                                 rp->status);
 957
 958         hci_dev_unlock(hdev);
 959 }
 960
 961 static void hci_cc_user_confirm_neg_reply(struct hci_dev *hdev,
 962                                                         struct sk_buff *skb)
 963 {
 964         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 965
 966         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 967
 968         hci_dev_lock(hdev);
 969
 970         if (test_bit(HCI_MGMT, &hdev->flags))
 971                 mgmt_user_confirm_neg_reply_complete(hdev, &rp->bdaddr,
 972                                                                 rp->status);
 973
 974         hci_dev_unlock(hdev);
 975 }
 976
 977 static void hci_cc_user_passkey_reply(struct hci_dev *hdev, struct sk_buff *skb)
 978 {
 979         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 980
 981         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 982
 983         hci_dev_lock(hdev);
 984
 985         if (test_bit(HCI_MGMT, &hdev->flags))
 986                 mgmt_user_passkey_reply_complete(hdev, &rp->bdaddr,
 987                                                                 rp->status);
 988
 989         hci_dev_unlock(hdev);
 990 }
 991
 992 static void hci_cc_user_passkey_neg_reply(struct hci_dev *hdev,
 993                                                         struct sk_buff *skb)
 994 {
 995         struct hci_rp_user_confirm_reply *rp = (void *) skb->data;
 996
 997         BT_DBG("%s status 0x%x", hdev->name, rp->status);
 998
 999         hci_dev_lock(hdev);
1000
1001         if (test_bit(HCI_MGMT, &hdev->flags))
1002                 mgmt_user_passkey_neg_reply_complete(hdev, &rp->bdaddr,
1003                                                                 rp->status);
1004
1005         hci_dev_unlock(hdev);
1006 }
1007
1008 static void hci_cc_read_local_oob_data_reply(struct hci_dev *hdev,
1009                                                         struct sk_buff *skb)
1010 {
1011         struct hci_rp_read_local_oob_data *rp = (void *) skb->data;
1012
1013         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1014
1015         hci_dev_lock(hdev);
1016         mgmt_read_local_oob_data_reply_complete(hdev, rp->hash,
1017                                                 rp->randomizer, rp->status);
1018         hci_dev_unlock(hdev);
1019 }
1020
1021 static void hci_cc_le_set_scan_param(struct hci_dev *hdev, struct sk_buff *skb)
1022 {
1023         __u8 status = *((__u8 *) skb->data);
1024
1025         BT_DBG("%s status 0x%x", hdev->name, status);
1026 }
1027
1028 static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
1029                                         struct sk_buff *skb)
1030 {
1031         struct hci_cp_le_set_scan_enable *cp;
1032         __u8 status = *((__u8 *) skb->data);
1033
1034         BT_DBG("%s status 0x%x", hdev->name, status);
1035
1036         if (status)
1037                 return;
1038
1039         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_SET_SCAN_ENABLE);
1040         if (!cp)
1041                 return;
1042
1043         switch (cp->enable) {
1044         case LE_SCANNING_ENABLED:
1045                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
1046
1047                 cancel_delayed_work_sync(&hdev->adv_work);
1048
1049                 hci_dev_lock(hdev);
1050                 hci_adv_entries_clear(hdev);
1051                 hci_dev_unlock(hdev);
1052                 break;
1053
1054         case LE_SCANNING_DISABLED:
1055                 clear_bit(HCI_LE_SCAN, &hdev->dev_flags);
1056
1057                 queue_delayed_work(hdev->workqueue, &hdev->adv_work,
1058                                                         ADV_CLEAR_TIMEOUT);
1059                 break;
1060
1061         default:
1062                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
1063                 break;
1064         }
1065 }
1066
1067 static void hci_cc_le_ltk_reply(struct hci_dev *hdev, struct sk_buff *skb)
1068 {
1069         struct hci_rp_le_ltk_reply *rp = (void *) skb->data;
1070
1071         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1072
1073         if (rp->status)
1074                 return;
1075
1076         hci_req_complete(hdev, HCI_OP_LE_LTK_REPLY, rp->status);
1077 }
1078
1079 static void hci_cc_le_ltk_neg_reply(struct hci_dev *hdev, struct sk_buff *skb)
1080 {
1081         struct hci_rp_le_ltk_neg_reply *rp = (void *) skb->data;
1082
1083         BT_DBG("%s status 0x%x", hdev->name, rp->status);
1084
1085         if (rp->status)
1086                 return;
1087
1088         hci_req_complete(hdev, HCI_OP_LE_LTK_NEG_REPLY, rp->status);
1089 }
1090
1091 static inline void hci_cc_write_le_host_supported(struct hci_dev *hdev,
1092                                                         struct sk_buff *skb)
1093 {
1094         struct hci_cp_read_local_ext_features cp;
1095         __u8 status = *((__u8 *) skb->data);
1096
1097         BT_DBG("%s status 0x%x", hdev->name, status);
1098
1099         if (status)
1100                 return;
1101
1102         cp.page = 0x01;
1103         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, sizeof(cp), &cp);
1104 }
1105
1106 static inline void hci_cs_inquiry(struct hci_dev *hdev, __u8 status)
1107 {
1108         BT_DBG("%s status 0x%x", hdev->name, status);
1109
1110         if (status) {
1111                 hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1112                 hci_conn_check_pending(hdev);
1113                 hci_dev_lock(hdev);
1114                 if (test_bit(HCI_MGMT, &hdev->flags))
1115                         mgmt_start_discovery_failed(hdev, status);
1116                 hci_dev_unlock(hdev);
1117                 return;
1118         }
1119
1120         set_bit(HCI_INQUIRY, &hdev->flags);
1121
1122         hci_dev_lock(hdev);
1123         mgmt_discovering(hdev, 1);
1124         hci_dev_unlock(hdev);
1125 }
1126
1127 static inline void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
1128 {
1129         struct hci_cp_create_conn *cp;
1130         struct hci_conn *conn;
1131
1132         BT_DBG("%s status 0x%x", hdev->name, status);
1133
1134         cp = hci_sent_cmd_data(hdev, HCI_OP_CREATE_CONN);
1135         if (!cp)
1136                 return;
1137
1138         hci_dev_lock(hdev);
1139
1140         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1141
1142         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->bdaddr), conn);
1143
1144         if (status) {
1145                 if (conn && conn->state == BT_CONNECT) {
1146                         if (status != 0x0c || conn->attempt > 2) {
1147                                 conn->state = BT_CLOSED;
1148                                 hci_proto_connect_cfm(conn, status);
1149                                 hci_conn_del(conn);
1150                         } else
1151                                 conn->state = BT_CONNECT2;
1152                 }
1153         } else {
1154                 if (!conn) {
1155                         conn = hci_conn_add(hdev, ACL_LINK, &cp->bdaddr);
1156                         if (conn) {
1157                                 conn->out = 1;
1158                                 conn->link_mode |= HCI_LM_MASTER;
1159                         } else
1160                                 BT_ERR("No memory for new connection");
1161                 }
1162         }
1163
1164         hci_dev_unlock(hdev);
1165 }
1166
1167 static void hci_cs_add_sco(struct hci_dev *hdev, __u8 status)
1168 {
1169         struct hci_cp_add_sco *cp;
1170         struct hci_conn *acl, *sco;
1171         __u16 handle;
1172
1173         BT_DBG("%s status 0x%x", hdev->name, status);
1174
1175         if (!status)
1176                 return;
1177
1178         cp = hci_sent_cmd_data(hdev, HCI_OP_ADD_SCO);
1179         if (!cp)
1180                 return;
1181
1182         handle = __le16_to_cpu(cp->handle);
1183
1184         BT_DBG("%s handle %d", hdev->name, handle);
1185
1186         hci_dev_lock(hdev);
1187
1188         acl = hci_conn_hash_lookup_handle(hdev, handle);
1189         if (acl) {
1190                 sco = acl->link;
1191                 if (sco) {
1192                         sco->state = BT_CLOSED;
1193
1194                         hci_proto_connect_cfm(sco, status);
1195                         hci_conn_del(sco);
1196                 }
1197         }
1198
1199         hci_dev_unlock(hdev);
1200 }
1201
1202 static void hci_cs_auth_requested(struct hci_dev *hdev, __u8 status)
1203 {
1204         struct hci_cp_auth_requested *cp;
1205         struct hci_conn *conn;
1206
1207         BT_DBG("%s status 0x%x", hdev->name, status);
1208
1209         if (!status)
1210                 return;
1211
1212         cp = hci_sent_cmd_data(hdev, HCI_OP_AUTH_REQUESTED);
1213         if (!cp)
1214                 return;
1215
1216         hci_dev_lock(hdev);
1217
1218         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1219         if (conn) {
1220                 if (conn->state == BT_CONFIG) {
1221                         hci_proto_connect_cfm(conn, status);
1222                         hci_conn_put(conn);
1223                 }
1224         }
1225
1226         hci_dev_unlock(hdev);
1227 }
1228
1229 static void hci_cs_set_conn_encrypt(struct hci_dev *hdev, __u8 status)
1230 {
1231         struct hci_cp_set_conn_encrypt *cp;
1232         struct hci_conn *conn;
1233
1234         BT_DBG("%s status 0x%x", hdev->name, status);
1235
1236         if (!status)
1237                 return;
1238
1239         cp = hci_sent_cmd_data(hdev, HCI_OP_SET_CONN_ENCRYPT);
1240         if (!cp)
1241                 return;
1242
1243         hci_dev_lock(hdev);
1244
1245         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1246         if (conn) {
1247                 if (conn->state == BT_CONFIG) {
1248                         hci_proto_connect_cfm(conn, status);
1249                         hci_conn_put(conn);
1250                 }
1251         }
1252
1253         hci_dev_unlock(hdev);
1254 }
1255
1256 static int hci_outgoing_auth_needed(struct hci_dev *hdev,
1257                                                         struct hci_conn *conn)
1258 {
1259         if (conn->state != BT_CONFIG || !conn->out)
1260                 return 0;
1261
1262         if (conn->pending_sec_level == BT_SECURITY_SDP)
1263                 return 0;
1264
1265         /* Only request authentication for SSP connections or non-SSP
1266          * devices with sec_level HIGH or if MITM protection is requested */
1267         if (!(hdev->ssp_mode > 0 && conn->ssp_mode > 0) &&
1268                                 conn->pending_sec_level != BT_SECURITY_HIGH &&
1269                                 !(conn->auth_type & 0x01))
1270                 return 0;
1271
1272         return 1;
1273 }
1274
1275 static void hci_cs_remote_name_req(struct hci_dev *hdev, __u8 status)
1276 {
1277         struct hci_cp_remote_name_req *cp;
1278         struct hci_conn *conn;
1279
1280         BT_DBG("%s status 0x%x", hdev->name, status);
1281
1282         /* If successful wait for the name req complete event before
1283          * checking for the need to do authentication */
1284         if (!status)
1285                 return;
1286
1287         cp = hci_sent_cmd_data(hdev, HCI_OP_REMOTE_NAME_REQ);
1288         if (!cp)
1289                 return;
1290
1291         hci_dev_lock(hdev);
1292
1293         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->bdaddr);
1294         if (!conn)
1295                 goto unlock;
1296
1297         if (!hci_outgoing_auth_needed(hdev, conn))
1298                 goto unlock;
1299
1300         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1301                 struct hci_cp_auth_requested cp;
1302                 cp.handle = __cpu_to_le16(conn->handle);
1303                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1304         }
1305
1306 unlock:
1307         hci_dev_unlock(hdev);
1308 }
1309
1310 static void hci_cs_read_remote_features(struct hci_dev *hdev, __u8 status)
1311 {
1312         struct hci_cp_read_remote_features *cp;
1313         struct hci_conn *conn;
1314
1315         BT_DBG("%s status 0x%x", hdev->name, status);
1316
1317         if (!status)
1318                 return;
1319
1320         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_FEATURES);
1321         if (!cp)
1322                 return;
1323
1324         hci_dev_lock(hdev);
1325
1326         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1327         if (conn) {
1328                 if (conn->state == BT_CONFIG) {
1329                         hci_proto_connect_cfm(conn, status);
1330                         hci_conn_put(conn);
1331                 }
1332         }
1333
1334         hci_dev_unlock(hdev);
1335 }
1336
1337 static void hci_cs_read_remote_ext_features(struct hci_dev *hdev, __u8 status)
1338 {
1339         struct hci_cp_read_remote_ext_features *cp;
1340         struct hci_conn *conn;
1341
1342         BT_DBG("%s status 0x%x", hdev->name, status);
1343
1344         if (!status)
1345                 return;
1346
1347         cp = hci_sent_cmd_data(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES);
1348         if (!cp)
1349                 return;
1350
1351         hci_dev_lock(hdev);
1352
1353         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1354         if (conn) {
1355                 if (conn->state == BT_CONFIG) {
1356                         hci_proto_connect_cfm(conn, status);
1357                         hci_conn_put(conn);
1358                 }
1359         }
1360
1361         hci_dev_unlock(hdev);
1362 }
1363
1364 static void hci_cs_setup_sync_conn(struct hci_dev *hdev, __u8 status)
1365 {
1366         struct hci_cp_setup_sync_conn *cp;
1367         struct hci_conn *acl, *sco;
1368         __u16 handle;
1369
1370         BT_DBG("%s status 0x%x", hdev->name, status);
1371
1372         if (!status)
1373                 return;
1374
1375         cp = hci_sent_cmd_data(hdev, HCI_OP_SETUP_SYNC_CONN);
1376         if (!cp)
1377                 return;
1378
1379         handle = __le16_to_cpu(cp->handle);
1380
1381         BT_DBG("%s handle %d", hdev->name, handle);
1382
1383         hci_dev_lock(hdev);
1384
1385         acl = hci_conn_hash_lookup_handle(hdev, handle);
1386         if (acl) {
1387                 sco = acl->link;
1388                 if (sco) {
1389                         sco->state = BT_CLOSED;
1390
1391                         hci_proto_connect_cfm(sco, status);
1392                         hci_conn_del(sco);
1393                 }
1394         }
1395
1396         hci_dev_unlock(hdev);
1397 }
1398
1399 static void hci_cs_sniff_mode(struct hci_dev *hdev, __u8 status)
1400 {
1401         struct hci_cp_sniff_mode *cp;
1402         struct hci_conn *conn;
1403
1404         BT_DBG("%s status 0x%x", hdev->name, status);
1405
1406         if (!status)
1407                 return;
1408
1409         cp = hci_sent_cmd_data(hdev, HCI_OP_SNIFF_MODE);
1410         if (!cp)
1411                 return;
1412
1413         hci_dev_lock(hdev);
1414
1415         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1416         if (conn) {
1417                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1418
1419                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1420                         hci_sco_setup(conn, status);
1421         }
1422
1423         hci_dev_unlock(hdev);
1424 }
1425
1426 static void hci_cs_exit_sniff_mode(struct hci_dev *hdev, __u8 status)
1427 {
1428         struct hci_cp_exit_sniff_mode *cp;
1429         struct hci_conn *conn;
1430
1431         BT_DBG("%s status 0x%x", hdev->name, status);
1432
1433         if (!status)
1434                 return;
1435
1436         cp = hci_sent_cmd_data(hdev, HCI_OP_EXIT_SNIFF_MODE);
1437         if (!cp)
1438                 return;
1439
1440         hci_dev_lock(hdev);
1441
1442         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(cp->handle));
1443         if (conn) {
1444                 clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend);
1445
1446                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
1447                         hci_sco_setup(conn, status);
1448         }
1449
1450         hci_dev_unlock(hdev);
1451 }
1452
1453 static void hci_cs_le_create_conn(struct hci_dev *hdev, __u8 status)
1454 {
1455         struct hci_cp_le_create_conn *cp;
1456         struct hci_conn *conn;
1457
1458         BT_DBG("%s status 0x%x", hdev->name, status);
1459
1460         cp = hci_sent_cmd_data(hdev, HCI_OP_LE_CREATE_CONN);
1461         if (!cp)
1462                 return;
1463
1464         hci_dev_lock(hdev);
1465
1466         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->peer_addr);
1467
1468         BT_DBG("%s bdaddr %s conn %p", hdev->name, batostr(&cp->peer_addr),
1469                 conn);
1470
1471         if (status) {
1472                 if (conn && conn->state == BT_CONNECT) {
1473                         conn->state = BT_CLOSED;
1474                         hci_proto_connect_cfm(conn, status);
1475                         hci_conn_del(conn);
1476                 }
1477         } else {
1478                 if (!conn) {
1479                         conn = hci_conn_add(hdev, LE_LINK, &cp->peer_addr);
1480                         if (conn) {
1481                                 conn->dst_type = cp->peer_addr_type;
1482                                 conn->out = 1;
1483                         } else {
1484                                 BT_ERR("No memory for new connection");
1485                         }
1486                 }
1487         }
1488
1489         hci_dev_unlock(hdev);
1490 }
1491
1492 static void hci_cs_le_start_enc(struct hci_dev *hdev, u8 status)
1493 {
1494         BT_DBG("%s status 0x%x", hdev->name, status);
1495 }
1496
1497 static inline void hci_inquiry_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1498 {
1499         __u8 status = *((__u8 *) skb->data);
1500
1501         BT_DBG("%s status %d", hdev->name, status);
1502
1503         hci_req_complete(hdev, HCI_OP_INQUIRY, status);
1504
1505         hci_conn_check_pending(hdev);
1506
1507         if (!test_and_clear_bit(HCI_INQUIRY, &hdev->flags))
1508                 return;
1509
1510         hci_dev_lock(hdev);
1511         mgmt_discovering(hdev, 0);
1512         hci_dev_unlock(hdev);
1513 }
1514
1515 static inline void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
1516 {
1517         struct inquiry_data data;
1518         struct inquiry_info *info = (void *) (skb->data + 1);
1519         int num_rsp = *((__u8 *) skb->data);
1520
1521         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
1522
1523         if (!num_rsp)
1524                 return;
1525
1526         hci_dev_lock(hdev);
1527
1528         for (; num_rsp; num_rsp--, info++) {
1529                 bacpy(&data.bdaddr, &info->bdaddr);
1530                 data.pscan_rep_mode     = info->pscan_rep_mode;
1531                 data.pscan_period_mode  = info->pscan_period_mode;
1532                 data.pscan_mode         = info->pscan_mode;
1533                 memcpy(data.dev_class, info->dev_class, 3);
1534                 data.clock_offset       = info->clock_offset;
1535                 data.rssi               = 0x00;
1536                 data.ssp_mode           = 0x00;
1537                 hci_inquiry_cache_update(hdev, &data);
1538                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
1539                                                 info->dev_class, 0, NULL);
1540         }
1541
1542         hci_dev_unlock(hdev);
1543 }
1544
1545 static inline void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1546 {
1547         struct hci_ev_conn_complete *ev = (void *) skb->data;
1548         struct hci_conn *conn;
1549
1550         BT_DBG("%s", hdev->name);
1551
1552         hci_dev_lock(hdev);
1553
1554         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1555         if (!conn) {
1556                 if (ev->link_type != SCO_LINK)
1557                         goto unlock;
1558
1559                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
1560                 if (!conn)
1561                         goto unlock;
1562
1563                 conn->type = SCO_LINK;
1564         }
1565
1566         if (!ev->status) {
1567                 conn->handle = __le16_to_cpu(ev->handle);
1568
1569                 if (conn->type == ACL_LINK) {
1570                         conn->state = BT_CONFIG;
1571                         hci_conn_hold(conn);
1572                         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1573                         mgmt_connected(hdev, &ev->bdaddr, conn->type,
1574                                                         conn->dst_type);
1575                 } else
1576                         conn->state = BT_CONNECTED;
1577
1578                 hci_conn_hold_device(conn);
1579                 hci_conn_add_sysfs(conn);
1580
1581                 if (test_bit(HCI_AUTH, &hdev->flags))
1582                         conn->link_mode |= HCI_LM_AUTH;
1583
1584                 if (test_bit(HCI_ENCRYPT, &hdev->flags))
1585                         conn->link_mode |= HCI_LM_ENCRYPT;
1586
1587                 /* Get remote features */
1588                 if (conn->type == ACL_LINK) {
1589                         struct hci_cp_read_remote_features cp;
1590                         cp.handle = ev->handle;
1591                         hci_send_cmd(hdev, HCI_OP_READ_REMOTE_FEATURES,
1592                                                         sizeof(cp), &cp);
1593                 }
1594
1595                 /* Set packet type for incoming connection */
1596                 if (!conn->out && hdev->hci_ver < BLUETOOTH_VER_2_0) {
1597                         struct hci_cp_change_conn_ptype cp;
1598                         cp.handle = ev->handle;
1599                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1600                         hci_send_cmd(hdev, HCI_OP_CHANGE_CONN_PTYPE,
1601                                                         sizeof(cp), &cp);
1602                 }
1603         } else {
1604                 conn->state = BT_CLOSED;
1605                 if (conn->type == ACL_LINK)
1606                         mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
1607                                                 conn->dst_type, ev->status);
1608         }
1609
1610         if (conn->type == ACL_LINK)
1611                 hci_sco_setup(conn, ev->status);
1612
1613         if (ev->status) {
1614                 hci_proto_connect_cfm(conn, ev->status);
1615                 hci_conn_del(conn);
1616         } else if (ev->link_type != ACL_LINK)
1617                 hci_proto_connect_cfm(conn, ev->status);
1618
1619 unlock:
1620         hci_dev_unlock(hdev);
1621
1622         hci_conn_check_pending(hdev);
1623 }
1624
1625 static inline void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
1626 {
1627         struct hci_ev_conn_request *ev = (void *) skb->data;
1628         int mask = hdev->link_mode;
1629
1630         BT_DBG("%s bdaddr %s type 0x%x", hdev->name,
1631                                         batostr(&ev->bdaddr), ev->link_type);
1632
1633         mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type);
1634
1635         if ((mask & HCI_LM_ACCEPT) &&
1636                         !hci_blacklist_lookup(hdev, &ev->bdaddr)) {
1637                 /* Connection accepted */
1638                 struct inquiry_entry *ie;
1639                 struct hci_conn *conn;
1640
1641                 hci_dev_lock(hdev);
1642
1643                 ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
1644                 if (ie)
1645                         memcpy(ie->data.dev_class, ev->dev_class, 3);
1646
1647                 conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
1648                 if (!conn) {
1649                         conn = hci_conn_add(hdev, ev->link_type, &ev->bdaddr);
1650                         if (!conn) {
1651                                 BT_ERR("No memory for new connection");
1652                                 hci_dev_unlock(hdev);
1653                                 return;
1654                         }
1655                 }
1656
1657                 memcpy(conn->dev_class, ev->dev_class, 3);
1658                 conn->state = BT_CONNECT;
1659
1660                 hci_dev_unlock(hdev);
1661
1662                 if (ev->link_type == ACL_LINK || !lmp_esco_capable(hdev)) {
1663                         struct hci_cp_accept_conn_req cp;
1664
1665                         bacpy(&cp.bdaddr, &ev->bdaddr);
1666
1667                         if (lmp_rswitch_capable(hdev) && (mask & HCI_LM_MASTER))
1668                                 cp.role = 0x00; /* Become master */
1669                         else
1670                                 cp.role = 0x01; /* Remain slave */
1671
1672                         hci_send_cmd(hdev, HCI_OP_ACCEPT_CONN_REQ,
1673                                                         sizeof(cp), &cp);
1674                 } else {
1675                         struct hci_cp_accept_sync_conn_req cp;
1676
1677                         bacpy(&cp.bdaddr, &ev->bdaddr);
1678                         cp.pkt_type = cpu_to_le16(conn->pkt_type);
1679
1680                         cp.tx_bandwidth   = cpu_to_le32(0x00001f40);
1681                         cp.rx_bandwidth   = cpu_to_le32(0x00001f40);
1682                         cp.max_latency    = cpu_to_le16(0xffff);
1683                         cp.content_format = cpu_to_le16(hdev->voice_setting);
1684                         cp.retrans_effort = 0xff;
1685
1686                         hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
1687                                                         sizeof(cp), &cp);
1688                 }
1689         } else {
1690                 /* Connection rejected */
1691                 struct hci_cp_reject_conn_req cp;
1692
1693                 bacpy(&cp.bdaddr, &ev->bdaddr);
1694                 cp.reason = HCI_ERROR_REJ_BAD_ADDR;
1695                 hci_send_cmd(hdev, HCI_OP_REJECT_CONN_REQ, sizeof(cp), &cp);
1696         }
1697 }
1698
1699 static inline void hci_disconn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1700 {
1701         struct hci_ev_disconn_complete *ev = (void *) skb->data;
1702         struct hci_conn *conn;
1703
1704         BT_DBG("%s status %d", hdev->name, ev->status);
1705
1706         hci_dev_lock(hdev);
1707
1708         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1709         if (!conn)
1710                 goto unlock;
1711
1712         if (ev->status == 0)
1713                 conn->state = BT_CLOSED;
1714
1715         if (conn->type == ACL_LINK || conn->type == LE_LINK) {
1716                 if (ev->status != 0)
1717                         mgmt_disconnect_failed(hdev, &conn->dst, ev->status);
1718                 else
1719                         mgmt_disconnected(hdev, &conn->dst, conn->type,
1720                                                         conn->dst_type);
1721         }
1722
1723         if (ev->status == 0) {
1724                 hci_proto_disconn_cfm(conn, ev->reason);
1725                 hci_conn_del(conn);
1726         }
1727
1728 unlock:
1729         hci_dev_unlock(hdev);
1730 }
1731
1732 static inline void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1733 {
1734         struct hci_ev_auth_complete *ev = (void *) skb->data;
1735         struct hci_conn *conn;
1736
1737         BT_DBG("%s status %d", hdev->name, ev->status);
1738
1739         hci_dev_lock(hdev);
1740
1741         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1742         if (!conn)
1743                 goto unlock;
1744
1745         if (!ev->status) {
1746                 if (!(conn->ssp_mode > 0 && hdev->ssp_mode > 0) &&
1747                                 test_bit(HCI_CONN_REAUTH_PEND,  &conn->pend)) {
1748                         BT_INFO("re-auth of legacy device is not possible.");
1749                 } else {
1750                         conn->link_mode |= HCI_LM_AUTH;
1751                         conn->sec_level = conn->pending_sec_level;
1752                 }
1753         } else {
1754                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
1755         }
1756
1757         clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1758         clear_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
1759
1760         if (conn->state == BT_CONFIG) {
1761                 if (!ev->status && hdev->ssp_mode > 0 && conn->ssp_mode > 0) {
1762                         struct hci_cp_set_conn_encrypt cp;
1763                         cp.handle  = ev->handle;
1764                         cp.encrypt = 0x01;
1765                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1766                                                                         &cp);
1767                 } else {
1768                         conn->state = BT_CONNECTED;
1769                         hci_proto_connect_cfm(conn, ev->status);
1770                         hci_conn_put(conn);
1771                 }
1772         } else {
1773                 hci_auth_cfm(conn, ev->status);
1774
1775                 hci_conn_hold(conn);
1776                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
1777                 hci_conn_put(conn);
1778         }
1779
1780         if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend)) {
1781                 if (!ev->status) {
1782                         struct hci_cp_set_conn_encrypt cp;
1783                         cp.handle  = ev->handle;
1784                         cp.encrypt = 0x01;
1785                         hci_send_cmd(hdev, HCI_OP_SET_CONN_ENCRYPT, sizeof(cp),
1786                                                                         &cp);
1787                 } else {
1788                         clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1789                         hci_encrypt_cfm(conn, ev->status, 0x00);
1790                 }
1791         }
1792
1793 unlock:
1794         hci_dev_unlock(hdev);
1795 }
1796
1797 static inline void hci_remote_name_evt(struct hci_dev *hdev, struct sk_buff *skb)
1798 {
1799         struct hci_ev_remote_name *ev = (void *) skb->data;
1800         struct hci_conn *conn;
1801
1802         BT_DBG("%s", hdev->name);
1803
1804         hci_conn_check_pending(hdev);
1805
1806         hci_dev_lock(hdev);
1807
1808         if (ev->status == 0 && test_bit(HCI_MGMT, &hdev->flags))
1809                 mgmt_remote_name(hdev, &ev->bdaddr, ev->name);
1810
1811         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
1812         if (!conn)
1813                 goto unlock;
1814
1815         if (!hci_outgoing_auth_needed(hdev, conn))
1816                 goto unlock;
1817
1818         if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
1819                 struct hci_cp_auth_requested cp;
1820                 cp.handle = __cpu_to_le16(conn->handle);
1821                 hci_send_cmd(hdev, HCI_OP_AUTH_REQUESTED, sizeof(cp), &cp);
1822         }
1823
1824 unlock:
1825         hci_dev_unlock(hdev);
1826 }
1827
1828 static inline void hci_encrypt_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
1829 {
1830         struct hci_ev_encrypt_change *ev = (void *) skb->data;
1831         struct hci_conn *conn;
1832
1833         BT_DBG("%s status %d", hdev->name, ev->status);
1834
1835         hci_dev_lock(hdev);
1836
1837         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1838         if (conn) {
1839                 if (!ev->status) {
1840                         if (ev->encrypt) {
1841                                 /* Encryption implies authentication */
1842                                 conn->link_mode |= HCI_LM_AUTH;
1843                                 conn->link_mode |= HCI_LM_ENCRYPT;
1844                                 conn->sec_level = conn->pending_sec_level;
1845                         } else
1846                                 conn->link_mode &= ~HCI_LM_ENCRYPT;
1847                 }
1848
1849                 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
1850
1851                 if (conn->state == BT_CONFIG) {
1852                         if (!ev->status)
1853                                 conn->state = BT_CONNECTED;
1854
1855                         hci_proto_connect_cfm(conn, ev->status);
1856                         hci_conn_put(conn);
1857                 } else
1858                         hci_encrypt_cfm(conn, ev->status, ev->encrypt);
1859         }
1860
1861         hci_dev_unlock(hdev);
1862 }
1863
1864 static inline void hci_change_link_key_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1865 {
1866         struct hci_ev_change_link_key_complete *ev = (void *) skb->data;
1867         struct hci_conn *conn;
1868
1869         BT_DBG("%s status %d", hdev->name, ev->status);
1870
1871         hci_dev_lock(hdev);
1872
1873         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1874         if (conn) {
1875                 if (!ev->status)
1876                         conn->link_mode |= HCI_LM_SECURE;
1877
1878                 clear_bit(HCI_CONN_AUTH_PEND, &conn->pend);
1879
1880                 hci_key_change_cfm(conn, ev->status);
1881         }
1882
1883         hci_dev_unlock(hdev);
1884 }
1885
1886 static inline void hci_remote_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
1887 {
1888         struct hci_ev_remote_features *ev = (void *) skb->data;
1889         struct hci_conn *conn;
1890
1891         BT_DBG("%s status %d", hdev->name, ev->status);
1892
1893         hci_dev_lock(hdev);
1894
1895         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
1896         if (!conn)
1897                 goto unlock;
1898
1899         if (!ev->status)
1900                 memcpy(conn->features, ev->features, 8);
1901
1902         if (conn->state != BT_CONFIG)
1903                 goto unlock;
1904
1905         if (!ev->status && lmp_ssp_capable(hdev) && lmp_ssp_capable(conn)) {
1906                 struct hci_cp_read_remote_ext_features cp;
1907                 cp.handle = ev->handle;
1908                 cp.page = 0x01;
1909                 hci_send_cmd(hdev, HCI_OP_READ_REMOTE_EXT_FEATURES,
1910                                                         sizeof(cp), &cp);
1911                 goto unlock;
1912         }
1913
1914         if (!ev->status) {
1915                 struct hci_cp_remote_name_req cp;
1916                 memset(&cp, 0, sizeof(cp));
1917                 bacpy(&cp.bdaddr, &conn->dst);
1918                 cp.pscan_rep_mode = 0x02;
1919                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
1920         }
1921
1922         if (!hci_outgoing_auth_needed(hdev, conn)) {
1923                 conn->state = BT_CONNECTED;
1924                 hci_proto_connect_cfm(conn, ev->status);
1925                 hci_conn_put(conn);
1926         }
1927
1928 unlock:
1929         hci_dev_unlock(hdev);
1930 }
1931
1932 static inline void hci_remote_version_evt(struct hci_dev *hdev, struct sk_buff *skb)
1933 {
1934         BT_DBG("%s", hdev->name);
1935 }
1936
1937 static inline void hci_qos_setup_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1938 {
1939         BT_DBG("%s", hdev->name);
1940 }
1941
1942 static inline void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
1943 {
1944         struct hci_ev_cmd_complete *ev = (void *) skb->data;
1945         __u16 opcode;
1946
1947         skb_pull(skb, sizeof(*ev));
1948
1949         opcode = __le16_to_cpu(ev->opcode);
1950
1951         switch (opcode) {
1952         case HCI_OP_INQUIRY_CANCEL:
1953                 hci_cc_inquiry_cancel(hdev, skb);
1954                 break;
1955
1956         case HCI_OP_EXIT_PERIODIC_INQ:
1957                 hci_cc_exit_periodic_inq(hdev, skb);
1958                 break;
1959
1960         case HCI_OP_REMOTE_NAME_REQ_CANCEL:
1961                 hci_cc_remote_name_req_cancel(hdev, skb);
1962                 break;
1963
1964         case HCI_OP_ROLE_DISCOVERY:
1965                 hci_cc_role_discovery(hdev, skb);
1966                 break;
1967
1968         case HCI_OP_READ_LINK_POLICY:
1969                 hci_cc_read_link_policy(hdev, skb);
1970                 break;
1971
1972         case HCI_OP_WRITE_LINK_POLICY:
1973                 hci_cc_write_link_policy(hdev, skb);
1974                 break;
1975
1976         case HCI_OP_READ_DEF_LINK_POLICY:
1977                 hci_cc_read_def_link_policy(hdev, skb);
1978                 break;
1979
1980         case HCI_OP_WRITE_DEF_LINK_POLICY:
1981                 hci_cc_write_def_link_policy(hdev, skb);
1982                 break;
1983
1984         case HCI_OP_RESET:
1985                 hci_cc_reset(hdev, skb);
1986                 break;
1987
1988         case HCI_OP_WRITE_LOCAL_NAME:
1989                 hci_cc_write_local_name(hdev, skb);
1990                 break;
1991
1992         case HCI_OP_READ_LOCAL_NAME:
1993                 hci_cc_read_local_name(hdev, skb);
1994                 break;
1995
1996         case HCI_OP_WRITE_AUTH_ENABLE:
1997                 hci_cc_write_auth_enable(hdev, skb);
1998                 break;
1999
2000         case HCI_OP_WRITE_ENCRYPT_MODE:
2001                 hci_cc_write_encrypt_mode(hdev, skb);
2002                 break;
2003
2004         case HCI_OP_WRITE_SCAN_ENABLE:
2005                 hci_cc_write_scan_enable(hdev, skb);
2006                 break;
2007
2008         case HCI_OP_READ_CLASS_OF_DEV:
2009                 hci_cc_read_class_of_dev(hdev, skb);
2010                 break;
2011
2012         case HCI_OP_WRITE_CLASS_OF_DEV:
2013                 hci_cc_write_class_of_dev(hdev, skb);
2014                 break;
2015
2016         case HCI_OP_READ_VOICE_SETTING:
2017                 hci_cc_read_voice_setting(hdev, skb);
2018                 break;
2019
2020         case HCI_OP_WRITE_VOICE_SETTING:
2021                 hci_cc_write_voice_setting(hdev, skb);
2022                 break;
2023
2024         case HCI_OP_HOST_BUFFER_SIZE:
2025                 hci_cc_host_buffer_size(hdev, skb);
2026                 break;
2027
2028         case HCI_OP_READ_SSP_MODE:
2029                 hci_cc_read_ssp_mode(hdev, skb);
2030                 break;
2031
2032         case HCI_OP_WRITE_SSP_MODE:
2033                 hci_cc_write_ssp_mode(hdev, skb);
2034                 break;
2035
2036         case HCI_OP_READ_LOCAL_VERSION:
2037                 hci_cc_read_local_version(hdev, skb);
2038                 break;
2039
2040         case HCI_OP_READ_LOCAL_COMMANDS:
2041                 hci_cc_read_local_commands(hdev, skb);
2042                 break;
2043
2044         case HCI_OP_READ_LOCAL_FEATURES:
2045                 hci_cc_read_local_features(hdev, skb);
2046                 break;
2047
2048         case HCI_OP_READ_LOCAL_EXT_FEATURES:
2049                 hci_cc_read_local_ext_features(hdev, skb);
2050                 break;
2051
2052         case HCI_OP_READ_BUFFER_SIZE:
2053                 hci_cc_read_buffer_size(hdev, skb);
2054                 break;
2055
2056         case HCI_OP_READ_BD_ADDR:
2057                 hci_cc_read_bd_addr(hdev, skb);
2058                 break;
2059
2060         case HCI_OP_READ_DATA_BLOCK_SIZE:
2061                 hci_cc_read_data_block_size(hdev, skb);
2062                 break;
2063
2064         case HCI_OP_WRITE_CA_TIMEOUT:
2065                 hci_cc_write_ca_timeout(hdev, skb);
2066                 break;
2067
2068         case HCI_OP_READ_FLOW_CONTROL_MODE:
2069                 hci_cc_read_flow_control_mode(hdev, skb);
2070                 break;
2071
2072         case HCI_OP_READ_LOCAL_AMP_INFO:
2073                 hci_cc_read_local_amp_info(hdev, skb);
2074                 break;
2075
2076         case HCI_OP_DELETE_STORED_LINK_KEY:
2077                 hci_cc_delete_stored_link_key(hdev, skb);
2078                 break;
2079
2080         case HCI_OP_SET_EVENT_MASK:
2081                 hci_cc_set_event_mask(hdev, skb);
2082                 break;
2083
2084         case HCI_OP_WRITE_INQUIRY_MODE:
2085                 hci_cc_write_inquiry_mode(hdev, skb);
2086                 break;
2087
2088         case HCI_OP_READ_INQ_RSP_TX_POWER:
2089                 hci_cc_read_inq_rsp_tx_power(hdev, skb);
2090                 break;
2091
2092         case HCI_OP_SET_EVENT_FLT:
2093                 hci_cc_set_event_flt(hdev, skb);
2094                 break;
2095
2096         case HCI_OP_PIN_CODE_REPLY:
2097                 hci_cc_pin_code_reply(hdev, skb);
2098                 break;
2099
2100         case HCI_OP_PIN_CODE_NEG_REPLY:
2101                 hci_cc_pin_code_neg_reply(hdev, skb);
2102                 break;
2103
2104         case HCI_OP_READ_LOCAL_OOB_DATA:
2105                 hci_cc_read_local_oob_data_reply(hdev, skb);
2106                 break;
2107
2108         case HCI_OP_LE_READ_BUFFER_SIZE:
2109                 hci_cc_le_read_buffer_size(hdev, skb);
2110                 break;
2111
2112         case HCI_OP_USER_CONFIRM_REPLY:
2113                 hci_cc_user_confirm_reply(hdev, skb);
2114                 break;
2115
2116         case HCI_OP_USER_CONFIRM_NEG_REPLY:
2117                 hci_cc_user_confirm_neg_reply(hdev, skb);
2118                 break;
2119
2120         case HCI_OP_USER_PASSKEY_REPLY:
2121                 hci_cc_user_passkey_reply(hdev, skb);
2122                 break;
2123
2124         case HCI_OP_USER_PASSKEY_NEG_REPLY:
2125                 hci_cc_user_passkey_neg_reply(hdev, skb);
2126
2127         case HCI_OP_LE_SET_SCAN_PARAM:
2128                 hci_cc_le_set_scan_param(hdev, skb);
2129                 break;
2130
2131         case HCI_OP_LE_SET_SCAN_ENABLE:
2132                 hci_cc_le_set_scan_enable(hdev, skb);
2133                 break;
2134
2135         case HCI_OP_LE_LTK_REPLY:
2136                 hci_cc_le_ltk_reply(hdev, skb);
2137                 break;
2138
2139         case HCI_OP_LE_LTK_NEG_REPLY:
2140                 hci_cc_le_ltk_neg_reply(hdev, skb);
2141                 break;
2142
2143         case HCI_OP_WRITE_LE_HOST_SUPPORTED:
2144                 hci_cc_write_le_host_supported(hdev, skb);
2145                 break;
2146
2147         default:
2148                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2149                 break;
2150         }
2151
2152         if (ev->opcode != HCI_OP_NOP)
2153                 del_timer(&hdev->cmd_timer);
2154
2155         if (ev->ncmd) {
2156                 atomic_set(&hdev->cmd_cnt, 1);
2157                 if (!skb_queue_empty(&hdev->cmd_q))
2158                         queue_work(hdev->workqueue, &hdev->cmd_work);
2159         }
2160 }
2161
2162 static inline void hci_cmd_status_evt(struct hci_dev *hdev, struct sk_buff *skb)
2163 {
2164         struct hci_ev_cmd_status *ev = (void *) skb->data;
2165         __u16 opcode;
2166
2167         skb_pull(skb, sizeof(*ev));
2168
2169         opcode = __le16_to_cpu(ev->opcode);
2170
2171         switch (opcode) {
2172         case HCI_OP_INQUIRY:
2173                 hci_cs_inquiry(hdev, ev->status);
2174                 break;
2175
2176         case HCI_OP_CREATE_CONN:
2177                 hci_cs_create_conn(hdev, ev->status);
2178                 break;
2179
2180         case HCI_OP_ADD_SCO:
2181                 hci_cs_add_sco(hdev, ev->status);
2182                 break;
2183
2184         case HCI_OP_AUTH_REQUESTED:
2185                 hci_cs_auth_requested(hdev, ev->status);
2186                 break;
2187
2188         case HCI_OP_SET_CONN_ENCRYPT:
2189                 hci_cs_set_conn_encrypt(hdev, ev->status);
2190                 break;
2191
2192         case HCI_OP_REMOTE_NAME_REQ:
2193                 hci_cs_remote_name_req(hdev, ev->status);
2194                 break;
2195
2196         case HCI_OP_READ_REMOTE_FEATURES:
2197                 hci_cs_read_remote_features(hdev, ev->status);
2198                 break;
2199
2200         case HCI_OP_READ_REMOTE_EXT_FEATURES:
2201                 hci_cs_read_remote_ext_features(hdev, ev->status);
2202                 break;
2203
2204         case HCI_OP_SETUP_SYNC_CONN:
2205                 hci_cs_setup_sync_conn(hdev, ev->status);
2206                 break;
2207
2208         case HCI_OP_SNIFF_MODE:
2209                 hci_cs_sniff_mode(hdev, ev->status);
2210                 break;
2211
2212         case HCI_OP_EXIT_SNIFF_MODE:
2213                 hci_cs_exit_sniff_mode(hdev, ev->status);
2214                 break;
2215
2216         case HCI_OP_DISCONNECT:
2217                 if (ev->status != 0)
2218                         mgmt_disconnect_failed(hdev, NULL, ev->status);
2219                 break;
2220
2221         case HCI_OP_LE_CREATE_CONN:
2222                 hci_cs_le_create_conn(hdev, ev->status);
2223                 break;
2224
2225         case HCI_OP_LE_START_ENC:
2226                 hci_cs_le_start_enc(hdev, ev->status);
2227                 break;
2228
2229         default:
2230                 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2231                 break;
2232         }
2233
2234         if (ev->opcode != HCI_OP_NOP)
2235                 del_timer(&hdev->cmd_timer);
2236
2237         if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2238                 atomic_set(&hdev->cmd_cnt, 1);
2239                 if (!skb_queue_empty(&hdev->cmd_q))
2240                         queue_work(hdev->workqueue, &hdev->cmd_work);
2241         }
2242 }
2243
2244 static inline void hci_role_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2245 {
2246         struct hci_ev_role_change *ev = (void *) skb->data;
2247         struct hci_conn *conn;
2248
2249         BT_DBG("%s status %d", hdev->name, ev->status);
2250
2251         hci_dev_lock(hdev);
2252
2253         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2254         if (conn) {
2255                 if (!ev->status) {
2256                         if (ev->role)
2257                                 conn->link_mode &= ~HCI_LM_MASTER;
2258                         else
2259                                 conn->link_mode |= HCI_LM_MASTER;
2260                 }
2261
2262                 clear_bit(HCI_CONN_RSWITCH_PEND, &conn->pend);
2263
2264                 hci_role_switch_cfm(conn, ev->status, ev->role);
2265         }
2266
2267         hci_dev_unlock(hdev);
2268 }
2269
2270 static inline void hci_num_comp_pkts_evt(struct hci_dev *hdev, struct sk_buff *skb)
2271 {
2272         struct hci_ev_num_comp_pkts *ev = (void *) skb->data;
2273         int i;
2274
2275         skb_pull(skb, sizeof(*ev));
2276
2277         BT_DBG("%s num_hndl %d", hdev->name, ev->num_hndl);
2278
2279         if (hdev->flow_ctl_mode != HCI_FLOW_CTL_MODE_PACKET_BASED) {
2280                 BT_ERR("Wrong event for mode %d", hdev->flow_ctl_mode);
2281                 return;
2282         }
2283
2284         if (skb->len < ev->num_hndl * 4) {
2285                 BT_DBG("%s bad parameters", hdev->name);
2286                 return;
2287         }
2288
2289         for (i = 0; i < ev->num_hndl; i++) {
2290                 struct hci_comp_pkts_info *info = &ev->handles[i];
2291                 struct hci_conn *conn;
2292                 __u16  handle, count;
2293
2294                 handle = __le16_to_cpu(info->handle);
2295                 count  = __le16_to_cpu(info->count);
2296
2297                 conn = hci_conn_hash_lookup_handle(hdev, handle);
2298                 if (!conn)
2299                         continue;
2300
2301                 conn->sent -= count;
2302
2303                 switch (conn->type) {
2304                 case ACL_LINK:
2305                         hdev->acl_cnt += count;
2306                         if (hdev->acl_cnt > hdev->acl_pkts)
2307                                 hdev->acl_cnt = hdev->acl_pkts;
2308                         break;
2309
2310                 case LE_LINK:
2311                         if (hdev->le_pkts) {
2312                                 hdev->le_cnt += count;
2313                                 if (hdev->le_cnt > hdev->le_pkts)
2314                                         hdev->le_cnt = hdev->le_pkts;
2315                         } else {
2316                                 hdev->acl_cnt += count;
2317                                 if (hdev->acl_cnt > hdev->acl_pkts)
2318                                         hdev->acl_cnt = hdev->acl_pkts;
2319                         }
2320                         break;
2321
2322                 case SCO_LINK:
2323                         hdev->sco_cnt += count;
2324                         if (hdev->sco_cnt > hdev->sco_pkts)
2325                                 hdev->sco_cnt = hdev->sco_pkts;
2326                         break;
2327
2328                 default:
2329                         BT_ERR("Unknown type %d conn %p", conn->type, conn);
2330                         break;
2331                 }
2332         }
2333
2334         queue_work(hdev->workqueue, &hdev->tx_work);
2335 }
2336
2337 static inline void hci_mode_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2338 {
2339         struct hci_ev_mode_change *ev = (void *) skb->data;
2340         struct hci_conn *conn;
2341
2342         BT_DBG("%s status %d", hdev->name, ev->status);
2343
2344         hci_dev_lock(hdev);
2345
2346         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2347         if (conn) {
2348                 conn->mode = ev->mode;
2349                 conn->interval = __le16_to_cpu(ev->interval);
2350
2351                 if (!test_and_clear_bit(HCI_CONN_MODE_CHANGE_PEND, &conn->pend)) {
2352                         if (conn->mode == HCI_CM_ACTIVE)
2353                                 conn->power_save = 1;
2354                         else
2355                                 conn->power_save = 0;
2356                 }
2357
2358                 if (test_and_clear_bit(HCI_CONN_SCO_SETUP_PEND, &conn->pend))
2359                         hci_sco_setup(conn, ev->status);
2360         }
2361
2362         hci_dev_unlock(hdev);
2363 }
2364
2365 static inline void hci_pin_code_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2366 {
2367         struct hci_ev_pin_code_req *ev = (void *) skb->data;
2368         struct hci_conn *conn;
2369
2370         BT_DBG("%s", hdev->name);
2371
2372         hci_dev_lock(hdev);
2373
2374         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2375         if (!conn)
2376                 goto unlock;
2377
2378         if (conn->state == BT_CONNECTED) {
2379                 hci_conn_hold(conn);
2380                 conn->disc_timeout = HCI_PAIRING_TIMEOUT;
2381                 hci_conn_put(conn);
2382         }
2383
2384         if (!test_bit(HCI_PAIRABLE, &hdev->flags))
2385                 hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY,
2386                                         sizeof(ev->bdaddr), &ev->bdaddr);
2387         else if (test_bit(HCI_MGMT, &hdev->flags)) {
2388                 u8 secure;
2389
2390                 if (conn->pending_sec_level == BT_SECURITY_HIGH)
2391                         secure = 1;
2392                 else
2393                         secure = 0;
2394
2395                 mgmt_pin_code_request(hdev, &ev->bdaddr, secure);
2396         }
2397
2398 unlock:
2399         hci_dev_unlock(hdev);
2400 }
2401
2402 static inline void hci_link_key_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2403 {
2404         struct hci_ev_link_key_req *ev = (void *) skb->data;
2405         struct hci_cp_link_key_reply cp;
2406         struct hci_conn *conn;
2407         struct link_key *key;
2408
2409         BT_DBG("%s", hdev->name);
2410
2411         if (!test_bit(HCI_LINK_KEYS, &hdev->flags))
2412                 return;
2413
2414         hci_dev_lock(hdev);
2415
2416         key = hci_find_link_key(hdev, &ev->bdaddr);
2417         if (!key) {
2418                 BT_DBG("%s link key not found for %s", hdev->name,
2419                                                         batostr(&ev->bdaddr));
2420                 goto not_found;
2421         }
2422
2423         BT_DBG("%s found key type %u for %s", hdev->name, key->type,
2424                                                         batostr(&ev->bdaddr));
2425
2426         if (!test_bit(HCI_DEBUG_KEYS, &hdev->flags) &&
2427                                 key->type == HCI_LK_DEBUG_COMBINATION) {
2428                 BT_DBG("%s ignoring debug key", hdev->name);
2429                 goto not_found;
2430         }
2431
2432         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2433         if (conn) {
2434                 if (key->type == HCI_LK_UNAUTH_COMBINATION &&
2435                                 conn->auth_type != 0xff &&
2436                                 (conn->auth_type & 0x01)) {
2437                         BT_DBG("%s ignoring unauthenticated key", hdev->name);
2438                         goto not_found;
2439                 }
2440
2441                 if (key->type == HCI_LK_COMBINATION && key->pin_len < 16 &&
2442                                 conn->pending_sec_level == BT_SECURITY_HIGH) {
2443                         BT_DBG("%s ignoring key unauthenticated for high \
2444                                                         security", hdev->name);
2445                         goto not_found;
2446                 }
2447
2448                 conn->key_type = key->type;
2449                 conn->pin_length = key->pin_len;
2450         }
2451
2452         bacpy(&cp.bdaddr, &ev->bdaddr);
2453         memcpy(cp.link_key, key->val, 16);
2454
2455         hci_send_cmd(hdev, HCI_OP_LINK_KEY_REPLY, sizeof(cp), &cp);
2456
2457         hci_dev_unlock(hdev);
2458
2459         return;
2460
2461 not_found:
2462         hci_send_cmd(hdev, HCI_OP_LINK_KEY_NEG_REPLY, 6, &ev->bdaddr);
2463         hci_dev_unlock(hdev);
2464 }
2465
2466 static inline void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
2467 {
2468         struct hci_ev_link_key_notify *ev = (void *) skb->data;
2469         struct hci_conn *conn;
2470         u8 pin_len = 0;
2471
2472         BT_DBG("%s", hdev->name);
2473
2474         hci_dev_lock(hdev);
2475
2476         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2477         if (conn) {
2478                 hci_conn_hold(conn);
2479                 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
2480                 pin_len = conn->pin_length;
2481
2482                 if (ev->key_type != HCI_LK_CHANGED_COMBINATION)
2483                         conn->key_type = ev->key_type;
2484
2485                 hci_conn_put(conn);
2486         }
2487
2488         if (test_bit(HCI_LINK_KEYS, &hdev->flags))
2489                 hci_add_link_key(hdev, conn, 1, &ev->bdaddr, ev->link_key,
2490                                                         ev->key_type, pin_len);
2491
2492         hci_dev_unlock(hdev);
2493 }
2494
2495 static inline void hci_clock_offset_evt(struct hci_dev *hdev, struct sk_buff *skb)
2496 {
2497         struct hci_ev_clock_offset *ev = (void *) skb->data;
2498         struct hci_conn *conn;
2499
2500         BT_DBG("%s status %d", hdev->name, ev->status);
2501
2502         hci_dev_lock(hdev);
2503
2504         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2505         if (conn && !ev->status) {
2506                 struct inquiry_entry *ie;
2507
2508                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2509                 if (ie) {
2510                         ie->data.clock_offset = ev->clock_offset;
2511                         ie->timestamp = jiffies;
2512                 }
2513         }
2514
2515         hci_dev_unlock(hdev);
2516 }
2517
2518 static inline void hci_pkt_type_change_evt(struct hci_dev *hdev, struct sk_buff *skb)
2519 {
2520         struct hci_ev_pkt_type_change *ev = (void *) skb->data;
2521         struct hci_conn *conn;
2522
2523         BT_DBG("%s status %d", hdev->name, ev->status);
2524
2525         hci_dev_lock(hdev);
2526
2527         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2528         if (conn && !ev->status)
2529                 conn->pkt_type = __le16_to_cpu(ev->pkt_type);
2530
2531         hci_dev_unlock(hdev);
2532 }
2533
2534 static inline void hci_pscan_rep_mode_evt(struct hci_dev *hdev, struct sk_buff *skb)
2535 {
2536         struct hci_ev_pscan_rep_mode *ev = (void *) skb->data;
2537         struct inquiry_entry *ie;
2538
2539         BT_DBG("%s", hdev->name);
2540
2541         hci_dev_lock(hdev);
2542
2543         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2544         if (ie) {
2545                 ie->data.pscan_rep_mode = ev->pscan_rep_mode;
2546                 ie->timestamp = jiffies;
2547         }
2548
2549         hci_dev_unlock(hdev);
2550 }
2551
2552 static inline void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev, struct sk_buff *skb)
2553 {
2554         struct inquiry_data data;
2555         int num_rsp = *((__u8 *) skb->data);
2556
2557         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2558
2559         if (!num_rsp)
2560                 return;
2561
2562         hci_dev_lock(hdev);
2563
2564         if ((skb->len - 1) / num_rsp != sizeof(struct inquiry_info_with_rssi)) {
2565                 struct inquiry_info_with_rssi_and_pscan_mode *info;
2566                 info = (void *) (skb->data + 1);
2567
2568                 for (; num_rsp; num_rsp--, info++) {
2569                         bacpy(&data.bdaddr, &info->bdaddr);
2570                         data.pscan_rep_mode     = info->pscan_rep_mode;
2571                         data.pscan_period_mode  = info->pscan_period_mode;
2572                         data.pscan_mode         = info->pscan_mode;
2573                         memcpy(data.dev_class, info->dev_class, 3);
2574                         data.clock_offset       = info->clock_offset;
2575                         data.rssi               = info->rssi;
2576                         data.ssp_mode           = 0x00;
2577                         hci_inquiry_cache_update(hdev, &data);
2578                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2579                                                 info->dev_class, info->rssi,
2580                                                 NULL);
2581                 }
2582         } else {
2583                 struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
2584
2585                 for (; num_rsp; num_rsp--, info++) {
2586                         bacpy(&data.bdaddr, &info->bdaddr);
2587                         data.pscan_rep_mode     = info->pscan_rep_mode;
2588                         data.pscan_period_mode  = info->pscan_period_mode;
2589                         data.pscan_mode         = 0x00;
2590                         memcpy(data.dev_class, info->dev_class, 3);
2591                         data.clock_offset       = info->clock_offset;
2592                         data.rssi               = info->rssi;
2593                         data.ssp_mode           = 0x00;
2594                         hci_inquiry_cache_update(hdev, &data);
2595                         mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2596                                                 info->dev_class, info->rssi,
2597                                                 NULL);
2598                 }
2599         }
2600
2601         hci_dev_unlock(hdev);
2602 }
2603
2604 static inline void hci_remote_ext_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2605 {
2606         struct hci_ev_remote_ext_features *ev = (void *) skb->data;
2607         struct hci_conn *conn;
2608
2609         BT_DBG("%s", hdev->name);
2610
2611         hci_dev_lock(hdev);
2612
2613         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
2614         if (!conn)
2615                 goto unlock;
2616
2617         if (!ev->status && ev->page == 0x01) {
2618                 struct inquiry_entry *ie;
2619
2620                 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
2621                 if (ie)
2622                         ie->data.ssp_mode = (ev->features[0] & 0x01);
2623
2624                 conn->ssp_mode = (ev->features[0] & 0x01);
2625         }
2626
2627         if (conn->state != BT_CONFIG)
2628                 goto unlock;
2629
2630         if (!ev->status) {
2631                 struct hci_cp_remote_name_req cp;
2632                 memset(&cp, 0, sizeof(cp));
2633                 bacpy(&cp.bdaddr, &conn->dst);
2634                 cp.pscan_rep_mode = 0x02;
2635                 hci_send_cmd(hdev, HCI_OP_REMOTE_NAME_REQ, sizeof(cp), &cp);
2636         }
2637
2638         if (!hci_outgoing_auth_needed(hdev, conn)) {
2639                 conn->state = BT_CONNECTED;
2640                 hci_proto_connect_cfm(conn, ev->status);
2641                 hci_conn_put(conn);
2642         }
2643
2644 unlock:
2645         hci_dev_unlock(hdev);
2646 }
2647
2648 static inline void hci_sync_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2649 {
2650         struct hci_ev_sync_conn_complete *ev = (void *) skb->data;
2651         struct hci_conn *conn;
2652
2653         BT_DBG("%s status %d", hdev->name, ev->status);
2654
2655         hci_dev_lock(hdev);
2656
2657         conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr);
2658         if (!conn) {
2659                 if (ev->link_type == ESCO_LINK)
2660                         goto unlock;
2661
2662                 conn = hci_conn_hash_lookup_ba(hdev, ESCO_LINK, &ev->bdaddr);
2663                 if (!conn)
2664                         goto unlock;
2665
2666                 conn->type = SCO_LINK;
2667         }
2668
2669         switch (ev->status) {
2670         case 0x00:
2671                 conn->handle = __le16_to_cpu(ev->handle);
2672                 conn->state  = BT_CONNECTED;
2673
2674                 hci_conn_hold_device(conn);
2675                 hci_conn_add_sysfs(conn);
2676                 break;
2677
2678         case 0x11:      /* Unsupported Feature or Parameter Value */
2679         case 0x1c:      /* SCO interval rejected */
2680         case 0x1a:      /* Unsupported Remote Feature */
2681         case 0x1f:      /* Unspecified error */
2682                 if (conn->out && conn->attempt < 2) {
2683                         conn->pkt_type = (hdev->esco_type & SCO_ESCO_MASK) |
2684                                         (hdev->esco_type & EDR_ESCO_MASK);
2685                         hci_setup_sync(conn, conn->link->handle);
2686                         goto unlock;
2687                 }
2688                 /* fall through */
2689
2690         default:
2691                 conn->state = BT_CLOSED;
2692                 break;
2693         }
2694
2695         hci_proto_connect_cfm(conn, ev->status);
2696         if (ev->status)
2697                 hci_conn_del(conn);
2698
2699 unlock:
2700         hci_dev_unlock(hdev);
2701 }
2702
2703 static inline void hci_sync_conn_changed_evt(struct hci_dev *hdev, struct sk_buff *skb)
2704 {
2705         BT_DBG("%s", hdev->name);
2706 }
2707
2708 static inline void hci_sniff_subrate_evt(struct hci_dev *hdev, struct sk_buff *skb)
2709 {
2710         struct hci_ev_sniff_subrate *ev = (void *) skb->data;
2711
2712         BT_DBG("%s status %d", hdev->name, ev->status);
2713 }
2714
2715 static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
2716 {
2717         struct inquiry_data data;
2718         struct extended_inquiry_info *info = (void *) (skb->data + 1);
2719         int num_rsp = *((__u8 *) skb->data);
2720
2721         BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
2722
2723         if (!num_rsp)
2724                 return;
2725
2726         hci_dev_lock(hdev);
2727
2728         for (; num_rsp; num_rsp--, info++) {
2729                 bacpy(&data.bdaddr, &info->bdaddr);
2730                 data.pscan_rep_mode     = info->pscan_rep_mode;
2731                 data.pscan_period_mode  = info->pscan_period_mode;
2732                 data.pscan_mode         = 0x00;
2733                 memcpy(data.dev_class, info->dev_class, 3);
2734                 data.clock_offset       = info->clock_offset;
2735                 data.rssi               = info->rssi;
2736                 data.ssp_mode           = 0x01;
2737                 hci_inquiry_cache_update(hdev, &data);
2738                 mgmt_device_found(hdev, &info->bdaddr, ACL_LINK, 0x00,
2739                                 info->dev_class, info->rssi, info->data);
2740         }
2741
2742         hci_dev_unlock(hdev);
2743 }
2744
2745 static inline u8 hci_get_auth_req(struct hci_conn *conn)
2746 {
2747         /* If remote requests dedicated bonding follow that lead */
2748         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) {
2749                 /* If both remote and local IO capabilities allow MITM
2750                  * protection then require it, otherwise don't */
2751                 if (conn->remote_cap == 0x03 || conn->io_capability == 0x03)
2752                         return 0x02;
2753                 else
2754                         return 0x03;
2755         }
2756
2757         /* If remote requests no-bonding follow that lead */
2758         if (conn->remote_auth == 0x00 || conn->remote_auth == 0x01)
2759                 return conn->remote_auth | (conn->auth_type & 0x01);
2760
2761         return conn->auth_type;
2762 }
2763
2764 static inline void hci_io_capa_request_evt(struct hci_dev *hdev, struct sk_buff *skb)
2765 {
2766         struct hci_ev_io_capa_request *ev = (void *) skb->data;
2767         struct hci_conn *conn;
2768
2769         BT_DBG("%s", hdev->name);
2770
2771         hci_dev_lock(hdev);
2772
2773         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2774         if (!conn)
2775                 goto unlock;
2776
2777         hci_conn_hold(conn);
2778
2779         if (!test_bit(HCI_MGMT, &hdev->flags))
2780                 goto unlock;
2781
2782         if (test_bit(HCI_PAIRABLE, &hdev->flags) ||
2783                         (conn->remote_auth & ~0x01) == HCI_AT_NO_BONDING) {
2784                 struct hci_cp_io_capability_reply cp;
2785
2786                 bacpy(&cp.bdaddr, &ev->bdaddr);
2787                 cp.capability = conn->io_capability;
2788                 conn->auth_type = hci_get_auth_req(conn);
2789                 cp.authentication = conn->auth_type;
2790
2791                 if ((conn->out == 0x01 || conn->remote_oob == 0x01) &&
2792                                 hci_find_remote_oob_data(hdev, &conn->dst))
2793                         cp.oob_data = 0x01;
2794                 else
2795                         cp.oob_data = 0x00;
2796
2797                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_REPLY,
2798                                                         sizeof(cp), &cp);
2799         } else {
2800                 struct hci_cp_io_capability_neg_reply cp;
2801
2802                 bacpy(&cp.bdaddr, &ev->bdaddr);
2803                 cp.reason = HCI_ERROR_PAIRING_NOT_ALLOWED;
2804
2805                 hci_send_cmd(hdev, HCI_OP_IO_CAPABILITY_NEG_REPLY,
2806                                                         sizeof(cp), &cp);
2807         }
2808
2809 unlock:
2810         hci_dev_unlock(hdev);
2811 }
2812
2813 static inline void hci_io_capa_reply_evt(struct hci_dev *hdev, struct sk_buff *skb)
2814 {
2815         struct hci_ev_io_capa_reply *ev = (void *) skb->data;
2816         struct hci_conn *conn;
2817
2818         BT_DBG("%s", hdev->name);
2819
2820         hci_dev_lock(hdev);
2821
2822         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2823         if (!conn)
2824                 goto unlock;
2825
2826         conn->remote_cap = ev->capability;
2827         conn->remote_oob = ev->oob_data;
2828         conn->remote_auth = ev->authentication;
2829
2830 unlock:
2831         hci_dev_unlock(hdev);
2832 }
2833
2834 static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
2835                                                         struct sk_buff *skb)
2836 {
2837         struct hci_ev_user_confirm_req *ev = (void *) skb->data;
2838         int loc_mitm, rem_mitm, confirm_hint = 0;
2839         struct hci_conn *conn;
2840
2841         BT_DBG("%s", hdev->name);
2842
2843         hci_dev_lock(hdev);
2844
2845         if (!test_bit(HCI_MGMT, &hdev->flags))
2846                 goto unlock;
2847
2848         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2849         if (!conn)
2850                 goto unlock;
2851
2852         loc_mitm = (conn->auth_type & 0x01);
2853         rem_mitm = (conn->remote_auth & 0x01);
2854
2855         /* If we require MITM but the remote device can't provide that
2856          * (it has NoInputNoOutput) then reject the confirmation
2857          * request. The only exception is when we're dedicated bonding
2858          * initiators (connect_cfm_cb set) since then we always have the MITM
2859          * bit set. */
2860         if (!conn->connect_cfm_cb && loc_mitm && conn->remote_cap == 0x03) {
2861                 BT_DBG("Rejecting request: remote device can't provide MITM");
2862                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_NEG_REPLY,
2863                                         sizeof(ev->bdaddr), &ev->bdaddr);
2864                 goto unlock;
2865         }
2866
2867         /* If no side requires MITM protection; auto-accept */
2868         if ((!loc_mitm || conn->remote_cap == 0x03) &&
2869                                 (!rem_mitm || conn->io_capability == 0x03)) {
2870
2871                 /* If we're not the initiators request authorization to
2872                  * proceed from user space (mgmt_user_confirm with
2873                  * confirm_hint set to 1). */
2874                 if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
2875                         BT_DBG("Confirming auto-accept as acceptor");
2876                         confirm_hint = 1;
2877                         goto confirm;
2878                 }
2879
2880                 BT_DBG("Auto-accept of user confirmation with %ums delay",
2881                                                 hdev->auto_accept_delay);
2882
2883                 if (hdev->auto_accept_delay > 0) {
2884                         int delay = msecs_to_jiffies(hdev->auto_accept_delay);
2885                         mod_timer(&conn->auto_accept_timer, jiffies + delay);
2886                         goto unlock;
2887                 }
2888
2889                 hci_send_cmd(hdev, HCI_OP_USER_CONFIRM_REPLY,
2890                                                 sizeof(ev->bdaddr), &ev->bdaddr);
2891                 goto unlock;
2892         }
2893
2894 confirm:
2895         mgmt_user_confirm_request(hdev, &ev->bdaddr, ev->passkey,
2896                                                                 confirm_hint);
2897
2898 unlock:
2899         hci_dev_unlock(hdev);
2900 }
2901
2902 static inline void hci_user_passkey_request_evt(struct hci_dev *hdev,
2903                                                         struct sk_buff *skb)
2904 {
2905         struct hci_ev_user_passkey_req *ev = (void *) skb->data;
2906
2907         BT_DBG("%s", hdev->name);
2908
2909         hci_dev_lock(hdev);
2910
2911         if (test_bit(HCI_MGMT, &hdev->flags))
2912                 mgmt_user_passkey_request(hdev, &ev->bdaddr);
2913
2914         hci_dev_unlock(hdev);
2915 }
2916
2917 static inline void hci_simple_pair_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2918 {
2919         struct hci_ev_simple_pair_complete *ev = (void *) skb->data;
2920         struct hci_conn *conn;
2921
2922         BT_DBG("%s", hdev->name);
2923
2924         hci_dev_lock(hdev);
2925
2926         conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
2927         if (!conn)
2928                 goto unlock;
2929
2930         /* To avoid duplicate auth_failed events to user space we check
2931          * the HCI_CONN_AUTH_PEND flag which will be set if we
2932          * initiated the authentication. A traditional auth_complete
2933          * event gets always produced as initiator and is also mapped to
2934          * the mgmt_auth_failed event */
2935         if (!test_bit(HCI_CONN_AUTH_PEND, &conn->pend) && ev->status != 0)
2936                 mgmt_auth_failed(hdev, &conn->dst, ev->status);
2937
2938         hci_conn_put(conn);
2939
2940 unlock:
2941         hci_dev_unlock(hdev);
2942 }
2943
2944 static inline void hci_remote_host_features_evt(struct hci_dev *hdev, struct sk_buff *skb)
2945 {
2946         struct hci_ev_remote_host_features *ev = (void *) skb->data;
2947         struct inquiry_entry *ie;
2948
2949         BT_DBG("%s", hdev->name);
2950
2951         hci_dev_lock(hdev);
2952
2953         ie = hci_inquiry_cache_lookup(hdev, &ev->bdaddr);
2954         if (ie)
2955                 ie->data.ssp_mode = (ev->features[0] & 0x01);
2956
2957         hci_dev_unlock(hdev);
2958 }
2959
2960 static inline void hci_remote_oob_data_request_evt(struct hci_dev *hdev,
2961                                                         struct sk_buff *skb)
2962 {
2963         struct hci_ev_remote_oob_data_request *ev = (void *) skb->data;
2964         struct oob_data *data;
2965
2966         BT_DBG("%s", hdev->name);
2967
2968         hci_dev_lock(hdev);
2969
2970         if (!test_bit(HCI_MGMT, &hdev->flags))
2971                 goto unlock;
2972
2973         data = hci_find_remote_oob_data(hdev, &ev->bdaddr);
2974         if (data) {
2975                 struct hci_cp_remote_oob_data_reply cp;
2976
2977                 bacpy(&cp.bdaddr, &ev->bdaddr);
2978                 memcpy(cp.hash, data->hash, sizeof(cp.hash));
2979                 memcpy(cp.randomizer, data->randomizer, sizeof(cp.randomizer));
2980
2981                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_REPLY, sizeof(cp),
2982                                                                         &cp);
2983         } else {
2984                 struct hci_cp_remote_oob_data_neg_reply cp;
2985
2986                 bacpy(&cp.bdaddr, &ev->bdaddr);
2987                 hci_send_cmd(hdev, HCI_OP_REMOTE_OOB_DATA_NEG_REPLY, sizeof(cp),
2988                                                                         &cp);
2989         }
2990
2991 unlock:
2992         hci_dev_unlock(hdev);
2993 }
2994
2995 static inline void hci_le_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2996 {
2997         struct hci_ev_le_conn_complete *ev = (void *) skb->data;
2998         struct hci_conn *conn;
2999
3000         BT_DBG("%s status %d", hdev->name, ev->status);
3001
3002         hci_dev_lock(hdev);
3003
3004         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &ev->bdaddr);
3005         if (!conn) {
3006                 conn = hci_conn_add(hdev, LE_LINK, &ev->bdaddr);
3007                 if (!conn) {
3008                         BT_ERR("No memory for new connection");
3009                         hci_dev_unlock(hdev);
3010                         return;
3011                 }
3012
3013                 conn->dst_type = ev->bdaddr_type;
3014         }
3015
3016         if (ev->status) {
3017                 mgmt_connect_failed(hdev, &ev->bdaddr, conn->type,
3018                                                 conn->dst_type, ev->status);
3019                 hci_proto_connect_cfm(conn, ev->status);
3020                 conn->state = BT_CLOSED;
3021                 hci_conn_del(conn);
3022                 goto unlock;
3023         }
3024
3025         mgmt_connected(hdev, &ev->bdaddr, conn->type, conn->dst_type);
3026
3027         conn->sec_level = BT_SECURITY_LOW;
3028         conn->handle = __le16_to_cpu(ev->handle);
3029         conn->state = BT_CONNECTED;
3030
3031         hci_conn_hold_device(conn);
3032         hci_conn_add_sysfs(conn);
3033
3034         hci_proto_connect_cfm(conn, ev->status);
3035
3036 unlock:
3037         hci_dev_unlock(hdev);
3038 }
3039
3040 static inline void hci_le_adv_report_evt(struct hci_dev *hdev,
3041                                                 struct sk_buff *skb)
3042 {
3043         u8 num_reports = skb->data[0];
3044         void *ptr = &skb->data[1];
3045
3046         hci_dev_lock(hdev);
3047
3048         while (num_reports--) {
3049                 struct hci_ev_le_advertising_info *ev = ptr;
3050
3051                 hci_add_adv_entry(hdev, ev);
3052
3053                 ptr += sizeof(*ev) + ev->length + 1;
3054         }
3055
3056         hci_dev_unlock(hdev);
3057 }
3058
3059 static inline void hci_le_ltk_request_evt(struct hci_dev *hdev,
3060                                                 struct sk_buff *skb)
3061 {
3062         struct hci_ev_le_ltk_req *ev = (void *) skb->data;
3063         struct hci_cp_le_ltk_reply cp;
3064         struct hci_cp_le_ltk_neg_reply neg;
3065         struct hci_conn *conn;
3066         struct link_key *ltk;
3067
3068         BT_DBG("%s handle %d", hdev->name, cpu_to_le16(ev->handle));
3069
3070         hci_dev_lock(hdev);
3071
3072         conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3073         if (conn == NULL)
3074                 goto not_found;
3075
3076         ltk = hci_find_ltk(hdev, ev->ediv, ev->random);
3077         if (ltk == NULL)
3078                 goto not_found;
3079
3080         memcpy(cp.ltk, ltk->val, sizeof(ltk->val));
3081         cp.handle = cpu_to_le16(conn->handle);
3082         conn->pin_length = ltk->pin_len;
3083
3084         hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
3085
3086         hci_dev_unlock(hdev);
3087
3088         return;
3089
3090 not_found:
3091         neg.handle = ev->handle;
3092         hci_send_cmd(hdev, HCI_OP_LE_LTK_NEG_REPLY, sizeof(neg), &neg);
3093         hci_dev_unlock(hdev);
3094 }
3095
3096 static inline void hci_le_meta_evt(struct hci_dev *hdev, struct sk_buff *skb)
3097 {
3098         struct hci_ev_le_meta *le_ev = (void *) skb->data;
3099
3100         skb_pull(skb, sizeof(*le_ev));
3101
3102         switch (le_ev->subevent) {
3103         case HCI_EV_LE_CONN_COMPLETE:
3104                 hci_le_conn_complete_evt(hdev, skb);
3105                 break;
3106
3107         case HCI_EV_LE_ADVERTISING_REPORT:
3108                 hci_le_adv_report_evt(hdev, skb);
3109                 break;
3110
3111         case HCI_EV_LE_LTK_REQ:
3112                 hci_le_ltk_request_evt(hdev, skb);
3113                 break;
3114
3115         default:
3116                 break;
3117         }
3118 }
3119
3120 void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3121 {
3122         struct hci_event_hdr *hdr = (void *) skb->data;
3123         __u8 event = hdr->evt;
3124
3125         skb_pull(skb, HCI_EVENT_HDR_SIZE);
3126
3127         switch (event) {
3128         case HCI_EV_INQUIRY_COMPLETE:
3129                 hci_inquiry_complete_evt(hdev, skb);
3130                 break;
3131
3132         case HCI_EV_INQUIRY_RESULT:
3133                 hci_inquiry_result_evt(hdev, skb);
3134                 break;
3135
3136         case HCI_EV_CONN_COMPLETE:
3137                 hci_conn_complete_evt(hdev, skb);
3138                 break;
3139
3140         case HCI_EV_CONN_REQUEST:
3141                 hci_conn_request_evt(hdev, skb);
3142                 break;
3143
3144         case HCI_EV_DISCONN_COMPLETE:
3145                 hci_disconn_complete_evt(hdev, skb);
3146                 break;
3147
3148         case HCI_EV_AUTH_COMPLETE:
3149                 hci_auth_complete_evt(hdev, skb);
3150                 break;
3151
3152         case HCI_EV_REMOTE_NAME:
3153                 hci_remote_name_evt(hdev, skb);
3154                 break;
3155
3156         case HCI_EV_ENCRYPT_CHANGE:
3157                 hci_encrypt_change_evt(hdev, skb);
3158                 break;
3159
3160         case HCI_EV_CHANGE_LINK_KEY_COMPLETE:
3161                 hci_change_link_key_complete_evt(hdev, skb);
3162                 break;
3163
3164         case HCI_EV_REMOTE_FEATURES:
3165                 hci_remote_features_evt(hdev, skb);
3166                 break;
3167
3168         case HCI_EV_REMOTE_VERSION:
3169                 hci_remote_version_evt(hdev, skb);
3170                 break;
3171
3172         case HCI_EV_QOS_SETUP_COMPLETE:
3173                 hci_qos_setup_complete_evt(hdev, skb);
3174                 break;
3175
3176         case HCI_EV_CMD_COMPLETE:
3177                 hci_cmd_complete_evt(hdev, skb);
3178                 break;
3179
3180         case HCI_EV_CMD_STATUS:
3181                 hci_cmd_status_evt(hdev, skb);
3182                 break;
3183
3184         case HCI_EV_ROLE_CHANGE:
3185                 hci_role_change_evt(hdev, skb);
3186                 break;
3187
3188         case HCI_EV_NUM_COMP_PKTS:
3189                 hci_num_comp_pkts_evt(hdev, skb);
3190                 break;
3191
3192         case HCI_EV_MODE_CHANGE:
3193                 hci_mode_change_evt(hdev, skb);
3194                 break;
3195
3196         case HCI_EV_PIN_CODE_REQ:
3197                 hci_pin_code_request_evt(hdev, skb);
3198                 break;
3199
3200         case HCI_EV_LINK_KEY_REQ:
3201                 hci_link_key_request_evt(hdev, skb);
3202                 break;
3203
3204         case HCI_EV_LINK_KEY_NOTIFY:
3205                 hci_link_key_notify_evt(hdev, skb);
3206                 break;
3207
3208         case HCI_EV_CLOCK_OFFSET:
3209                 hci_clock_offset_evt(hdev, skb);
3210                 break;
3211
3212         case HCI_EV_PKT_TYPE_CHANGE:
3213                 hci_pkt_type_change_evt(hdev, skb);
3214                 break;
3215
3216         case HCI_EV_PSCAN_REP_MODE:
3217                 hci_pscan_rep_mode_evt(hdev, skb);
3218                 break;
3219
3220         case HCI_EV_INQUIRY_RESULT_WITH_RSSI:
3221                 hci_inquiry_result_with_rssi_evt(hdev, skb);
3222                 break;
3223
3224         case HCI_EV_REMOTE_EXT_FEATURES:
3225                 hci_remote_ext_features_evt(hdev, skb);
3226                 break;
3227
3228         case HCI_EV_SYNC_CONN_COMPLETE:
3229                 hci_sync_conn_complete_evt(hdev, skb);
3230                 break;
3231
3232         case HCI_EV_SYNC_CONN_CHANGED:
3233                 hci_sync_conn_changed_evt(hdev, skb);
3234                 break;
3235
3236         case HCI_EV_SNIFF_SUBRATE:
3237                 hci_sniff_subrate_evt(hdev, skb);
3238                 break;
3239
3240         case HCI_EV_EXTENDED_INQUIRY_RESULT:
3241                 hci_extended_inquiry_result_evt(hdev, skb);
3242                 break;
3243
3244         case HCI_EV_IO_CAPA_REQUEST:
3245                 hci_io_capa_request_evt(hdev, skb);
3246                 break;
3247
3248         case HCI_EV_IO_CAPA_REPLY:
3249                 hci_io_capa_reply_evt(hdev, skb);
3250                 break;
3251
3252         case HCI_EV_USER_CONFIRM_REQUEST:
3253                 hci_user_confirm_request_evt(hdev, skb);
3254                 break;
3255
3256         case HCI_EV_USER_PASSKEY_REQUEST:
3257                 hci_user_passkey_request_evt(hdev, skb);
3258                 break;
3259
3260         case HCI_EV_SIMPLE_PAIR_COMPLETE:
3261                 hci_simple_pair_complete_evt(hdev, skb);
3262                 break;
3263
3264         case HCI_EV_REMOTE_HOST_FEATURES:
3265                 hci_remote_host_features_evt(hdev, skb);
3266                 break;
3267
3268         case HCI_EV_LE_META:
3269                 hci_le_meta_evt(hdev, skb);
3270                 break;
3271
3272         case HCI_EV_REMOTE_OOB_DATA_REQUEST:
3273                 hci_remote_oob_data_request_evt(hdev, skb);
3274                 break;
3275
3276         default:
3277                 BT_DBG("%s event 0x%x", hdev->name, event);
3278                 break;
3279         }
3280
3281         kfree_skb(skb);
3282         hdev->stat.evt_rx++;
3283 }
3284
3285 /* Generate internal stack event */
3286 void hci_si_event(struct hci_dev *hdev, int type, int dlen, void *data)
3287 {
3288         struct hci_event_hdr *hdr;
3289         struct hci_ev_stack_internal *ev;
3290         struct sk_buff *skb;
3291
3292         skb = bt_skb_alloc(HCI_EVENT_HDR_SIZE + sizeof(*ev) + dlen, GFP_ATOMIC);
3293         if (!skb)
3294                 return;
3295
3296         hdr = (void *) skb_put(skb, HCI_EVENT_HDR_SIZE);
3297         hdr->evt  = HCI_EV_STACK_INTERNAL;
3298         hdr->plen = sizeof(*ev) + dlen;
3299
3300         ev  = (void *) skb_put(skb, sizeof(*ev) + dlen);
3301         ev->type = type;
3302         memcpy(ev->data, data, dlen);
3303
3304         bt_cb(skb)->incoming = 1;
3305         __net_timestamp(skb);
3306
3307         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3308         skb->dev = (void *) hdev;
3309         hci_send_to_sock(hdev, skb, NULL);
3310         kfree_skb(skb);
3311 }
3312
3313 module_param(enable_le, bool, 0644);
3314 MODULE_PARM_DESC(enable_le, "Enable LE support");